From 36b837002718c23cd87d277e438c0fc74336bbc4 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 03:51:55 +0800 Subject: [PATCH 01/21] fix(scope): close remaining ownership boundaries --- docs/config-catalog.md | 23 +- docs/cookbook/adding-a-tool.md | 6 +- docs/cordis-catalog/events.md | 16 +- docs/cordis-catalog/services.md | 12 +- docs/core-data-structures/skills.md | 10 +- docs/core-data-structures/tools.md | 4 +- docs/event-producer-consumer.md | 16 +- docs/module-graph.md | 43 +- docs/persistence-catalog.md | 30 +- docs/rfc/INDEX.md | 2 +- ...06-11-dev-invariants-over-deep-readonly.md | 53 +- .../2026-07-08-agent-scope-contexts.md | 76 ++- .../2026-06-21-subagent-capability-seam.md | 2 +- .../feature/2026-06-30-interception-seams.md | 6 +- .../2026-06-11-immutable-public-surfaces.md | 9 +- .../compact-basic/tests/compact-basic.spec.ts | 2 +- .../tests/compact-loop-repro.spec.ts | 2 +- .../cordis/tool-cordis/src/api-catalog.ts | 2 +- packages/core/agent-loop/README.md | 4 +- packages/core/agent-loop/src/index.ts | 28 +- packages/core/agent-loop/tests/resume.spec.ts | 66 ++- .../agent-loop/tests/review-fixes.spec.ts | 12 +- .../agent-loop/tests/scope-lifecycle.spec.ts | 32 +- packages/core/agent/README.md | 2 +- packages/core/agent/src/index.ts | 13 +- packages/core/scope/README.md | 2 +- packages/core/scope/src/index.ts | 10 +- packages/core/scope/tests/scope.spec.ts | 10 + packages/core/session/README.md | 19 +- packages/core/session/src/index.ts | 324 ++++++++--- packages/core/session/src/json.ts | 133 ++++- packages/core/session/src/types.ts | 6 +- packages/core/session/tests/fork.spec.ts | 7 +- packages/core/session/tests/json.spec.ts | 152 +++++ packages/core/session/tests/session.spec.ts | 521 +++++++++++++++++- packages/core/system-prompt/README.md | 6 +- packages/core/system-prompt/package.json | 2 + packages/core/system-prompt/src/index.ts | 55 +- .../system-prompt/tests/system-prompt.spec.ts | 24 + .../system-prompt/tests/tool-order.spec.ts | 94 ++++ packages/core/system-prompt/tsconfig.json | 3 + packages/core/tools/README.md | 8 +- packages/core/tools/src/index.ts | 241 +++++--- packages/core/tools/src/schema.ts | 43 +- packages/core/tools/tests/scoped.spec.ts | 140 ++++- packages/core/tools/tests/tools.spec.ts | 237 +++++++- .../session-persistence-jsonl/README.md | 2 +- .../session-persistence-sqlite/README.md | 2 +- .../session-persistence/README.md | 2 +- .../session-persistence/src/coordinator.ts | 47 +- .../session-persistence/src/index.ts | 28 +- .../session-persistence/tests/contract.ts | 2 +- .../tests/coordinator-contract.ts | 7 +- .../tests/persistence.spec.ts | 15 +- packages/skill/skill/README.md | 14 +- packages/skill/skill/src/index.ts | 245 +++++++- packages/skill/skill/tests/skill.spec.ts | 502 +++++++++++++++++ .../subagent-fork/tests/subagent-fork.spec.ts | 7 +- .../subagent/subagent-inprocess/README.md | 2 +- .../subagent/subagent-inprocess/src/index.ts | 81 +-- .../subagent-inprocess/src/structured.ts | 4 +- .../tests/subagent-inprocess.spec.ts | 96 +++- packages/subagent/subagent/README.md | 8 +- packages/subagent/subagent/package.json | 2 + packages/subagent/subagent/src/index.ts | 210 +++++-- .../subagent/subagent/tests/service.spec.ts | 446 ++++++++++++++- packages/subagent/subagent/tsconfig.json | 3 + packages/support/README.md | 2 +- packages/support/invariants/README.md | 21 +- packages/support/invariants/package.json | 2 +- packages/support/invariants/src/index.ts | 73 +-- .../invariants/tests/invariants.spec.ts | 154 +++--- .../subagent-mock/tests/subagent-mock.spec.ts | 3 +- .../workflow/workflow-workerthread/README.md | 4 +- .../workflow-workerthread/package.json | 1 + .../workflow-workerthread/src/host.ts | 64 ++- .../tests/workflow-workerthread.spec.ts | 134 ++++- .../workflow-workerthread/tsconfig.json | 3 + pnpm-lock.yaml | 80 +-- 79 files changed, 3957 insertions(+), 817 deletions(-) create mode 100644 packages/core/session/tests/json.spec.ts diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 18ef659ee0..d7b7be2d88 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -343,24 +343,6 @@ export interface Config { Source: [`packages/hooks/hooks-codex/src/index.ts:43`](../packages/hooks/hooks-codex/src/index.ts) -## `@deepseek-ai/dsh-invariants` - -Requires: `sessions` - -```ts config-catalog -/** Plugin config. */ -export interface Config { - /** - * Deep-freeze logged session-event data so mutating a logged event throws. - * Default true — this plugin only runs in dev/test, where freezing is the - * point. Set false to assert the event contract without freezing. - */ - freeze?: boolean -} -``` - -Source: [`packages/support/invariants/src/index.ts:48`](../packages/support/invariants/src/index.ts) - ## `@deepseek-ai/dsh-llm-deepseek` Requires: `llm` @@ -583,7 +565,7 @@ export interface Config { } ``` -Source: [`packages/skill/skill/src/index.ts:112`](../packages/skill/skill/src/index.ts) +Source: [`packages/skill/skill/src/index.ts:114`](../packages/skill/skill/src/index.ts) ## `@deepseek-ai/dsh-skill-local` @@ -808,7 +790,7 @@ export interface Config { } ``` -Source: [`packages/core/system-prompt/src/index.ts:264`](../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:265`](../packages/core/system-prompt/src/index.ts) ## `@deepseek-ai/dsh-tool-cordis` @@ -1168,6 +1150,7 @@ These load from a `cordis.yml` entry with no `config:` block; they declare no co - `@deepseek-ai/dsh-agent` ([`packages/core/agent/src/index.ts`](../packages/core/agent/src/index.ts)) - `@deepseek-ai/dsh-fs-policy` ([`packages/fs/fs-policy/src/index.ts`](../packages/fs/fs-policy/src/index.ts)) +- `@deepseek-ai/dsh-invariants` — requires `sessions` ([`packages/support/invariants/src/index.ts`](../packages/support/invariants/src/index.ts)) - `@deepseek-ai/dsh-llm` ([`packages/llm/llm/src/index.ts`](../packages/llm/llm/src/index.ts)) - `@deepseek-ai/dsh-session` ([`packages/core/session/src/index.ts`](../packages/core/session/src/index.ts)) - `@deepseek-ai/dsh-subagent` ([`packages/subagent/subagent/src/index.ts`](../packages/subagent/subagent/src/index.ts)) diff --git a/docs/cookbook/adding-a-tool.md b/docs/cookbook/adding-a-tool.md index 5eede7ff5d..3832f44dd0 100644 --- a/docs/cookbook/adding-a-tool.md +++ b/docs/cookbook/adding-a-tool.md @@ -34,9 +34,9 @@ Registration is effect-based: disposing the plugin fiber unregisters the tool (w ## Rules of the execute() contract - **Args are validated for you.** `defineTool` validates the model-generated `arguments` against the `SchemaSpec` before `execute` runs (type, required keys, enum membership, nested objects/arrays — [runtime arg validation](../rfc/implemented/architecture/2026-06-11-runtime-arg-validation.md)), so inside `execute` the args already match `InferArgs`. You still hand-check value constraints the DSL can't express (non-empty strings, positive numbers, cross-field rules); throw a descriptive Error for those. Raw JSON-Schema tools registered directly (MCP) are NOT validated by the harness — they validate their own input. -- **Registration snapshots your definition.** Parameters must be losslessly JSON-serializable; the registry validates and clones them, copies the scalar fields, binds each callback once to your definition as its method receiver, and freezes the stored record. Reassigning `definition.execute` after registration does not hot-swap the tool—dispose and register a new definition through the owning effect instead. Deliberate mutable state inside the callback's closure or receiver remains ordinary plugin state. -- **Execution identity is protected.** The registry requires `arguments` to survive lossless-JSON validation before and after cloning, freezes the detached value before policy starts, and assigns an opaque `exec.token`; `callId`, `name`, `arguments`, `agent`, `token`, and an optional enclosing-transport `parent` token stay immutable through dispatch. `parent` is identity-only and exposes no live outer execution. Treat `args` as readonly input. An around-dispatch wrapper may add, replace, or remove only `exec.signal` to impose cancellation or a deadline. -- **Throwing or returning non-JSON data means isError.** The registry catches anything `execute()` throws and validates the complete post-policy result as losslessly JSON-serializable before final observers run. A throw, malformed result, or non-JSON content/context/meta becomes `{isError: true}` so the live outcome cannot succeed and then fail at the durable log. Use errors for infrastructure failures (bad input, spawn errors, aborts), but report domain failures in the result text instead (for example, tool-bash returns `[exit code: 9]` with `isError: false` because the model decides what a failing command means). +- **Registration snapshots your definition.** Parameters must be losslessly JSON-serializable; the registry reads them once and materializes the detached stored value in one recursive pass, copies the scalar fields, binds each callback once to your definition as its method receiver, and freezes the stored record. Reassigning `definition.execute` after registration does not hot-swap the tool—dispose and register a new definition through the owning effect instead. Deliberate mutable state inside the callback's closure or receiver remains ordinary plugin state. +- **Execution identity is protected.** The registry materializes `arguments` as detached lossless JSON in one recursive pass, freezes that value before policy starts, and assigns an opaque `exec.token`; `callId`, `name`, `arguments`, `agent`, `token`, and an optional enclosing-transport `parent` token stay immutable through dispatch. `parent` is identity-only and exposes no live outer execution. Treat `args` as readonly input. An around-dispatch wrapper may add, replace, or remove only `exec.signal` to impose cancellation or a deadline. +- **Throwing or returning non-JSON data means isError.** The registry catches anything `execute()` throws and materializes the complete post-policy result as lossless JSON before final observers run. A throw, malformed result, or non-JSON content/context/meta becomes `{isError: true}` so the live outcome cannot succeed and then fail at the durable log. Use errors for infrastructure failures (bad input, spawn errors, aborts), but report domain failures in the result text instead (for example, tool-bash returns `[exit code: 9]` with `isError: false` because the model decides what a failing command means). - **Honor `exec.signal`.** Cancel in-flight work when it fires. - **Attach durable card data with `meta` (optional).** `execute` may return `{ content, meta }` instead of a bare `ContentBlock[]` — `meta` is a JSON-serializable payload the core treats as opaque, persisted on the `tool/result` event and handed back to your `presentResult` (so a card that needs more than `args`, like `write`/`edit`'s applied-hunk diff, survives a session replay). Keep UI-only data here, never in the model-facing `content`. - **Use `exec.agent` for async notifications.** `agent.inject(content, {source: {kind: 'plugin', plugin: ''}})` appends durable context the NEXT model request sees — it is not a wake-up (an idle agent stays idle). Guard against disposed agents (try/catch). diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index 0c5399b41b..f5a0533842 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -285,7 +285,7 @@ A skill provider became resolvable in the `ctx.skills` registry. Consumers can o 'skill/provider-added'(provider: SkillProvider): void ``` -Source: [`packages/skill/skill/src/index.ts:130`](../../packages/skill/skill/src/index.ts) +Source: [`packages/skill/skill/src/index.ts:132`](../../packages/skill/skill/src/index.ts) ### `skill/provider-removed` — emit @@ -295,7 +295,7 @@ A skill provider left the registry because its plugin fiber was disposed. 'skill/provider-removed'(name: string): void ``` -Source: [`packages/skill/skill/src/index.ts:136`](../../packages/skill/skill/src/index.ts) +Source: [`packages/skill/skill/src/index.ts:138`](../../packages/skill/skill/src/index.ts) ## `subagent/*` @@ -307,7 +307,7 @@ A started subagent run settled — emitted when SubagentRun.result resolves (any 'subagent/end'(this: Scoped, info: SubagentRunEndInfo): void ``` -Source: [`packages/subagent/subagent/src/index.ts:114`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:115`](../../packages/subagent/subagent/src/index.ts) ### `subagent/provider-added` — emit @@ -317,7 +317,7 @@ A provider became resolvable in the SubagentService registry. Consumers that der 'subagent/provider-added'(provider: SubagentProvider): void ``` -Source: [`packages/subagent/subagent/src/index.ts:75`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:76`](../../packages/subagent/subagent/src/index.ts) ### `subagent/provider-removed` — emit @@ -327,7 +327,7 @@ A provider left the registry (its plugin's fiber was disposed — an unload or a 'subagent/provider-removed'(name: string): void ``` -Source: [`packages/subagent/subagent/src/index.ts:86`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:87`](../../packages/subagent/subagent/src/index.ts) ### `subagent/start` — emit @@ -337,7 +337,7 @@ A subagent run started — emitted only after SubagentRun.started fulfills, when 'subagent/start'(this: Scoped, info: SubagentRunInfo): void ``` -Source: [`packages/subagent/subagent/src/index.ts:101`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:102`](../../packages/subagent/subagent/src/index.ts) ## `system-prompt/*` @@ -349,7 +349,7 @@ Waterfall around prompt assembly — mutate or extend the PromptAssembly (sectio 'system-prompt/assemble'(this: Scoped, assembly: PromptAssembly, context: AssembleContext, next: () => Promise): Promise ``` -Source: [`packages/core/system-prompt/src/index.ts:45`](../../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:46`](../../packages/core/system-prompt/src/index.ts) ### `system-prompt/change` — emit @@ -359,7 +359,7 @@ A section, tool provider, variable provider, or protection was registered or unr 'system-prompt/change'(): void ``` -Source: [`packages/core/system-prompt/src/index.ts:55`](../../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:56`](../../packages/core/system-prompt/src/index.ts) ## `tools/*` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index ddf2a860e4..903c368b7c 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -40,7 +40,7 @@ list(): Agent[] Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/index.ts:169`](../../packages/core/agent/src/index.ts) +Source: [`packages/core/agent/src/index.ts:174`](../../packages/core/agent/src/index.ts) ## `ctx.approval` — `ApprovalService` @@ -189,7 +189,7 @@ Contracts every implementation MUST honor (a DB backend asserts them inside a tr - **Append-only; a crashed turn is closed, not truncated.** Committed events — those at or below a flushed `turn/end` — are never rewritten. A crash can leave an unclosed final turn whose events are real (and possibly large); load preserves them and closes the orphaned turn with synthetic boundary events (see load). Only a never-fully-written torn tail fragment is discarded. - **Contiguous seq.** A persisted log is contiguous: `events[i].seq === i`. load rejects a parse error or a `seq` gap in the COMMITTED region (unloadable); append's first event `seq` MUST equal the backend's stored next-seq (after `load` has balanced any interrupted turn). -- **JSON-serializable data.** `SessionEventMap` is merge-extensible and `event.data` is typed only as `SessionEventMap[K]`, so append REJECTS non-JSON-serializable data with an error naming the offending event type. A backend snapshots (serializes/clones) each event when it buffers, since `session.events` hands out the live mutable object. +- **JSON-serializable events.** `SessionEventMap` is merge-extensible, so append materializes each complete batch through the shared lossless-JSON boundary before buffering it. The public `session.events` view is immutable, but persistence still snapshots direct/replay callers at this independent trust boundary. - **Durability.** append returns only once the batch is durable (the file backend fsyncs; a DB commits). create MAY defer the physical write until the first append (lazy materialization). ```ts cordis-catalog @@ -220,7 +220,7 @@ list(): Session[] fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Session ``` -Source: [`packages/core/session/src/index.ts:427`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:608`](../../packages/core/session/src/index.ts) ## `ctx.skills` — `SkillService` @@ -233,7 +233,7 @@ async list(options: SkillLookupOptions = {}): Promise async get(name: string, options: SkillLookupOptions = {}): Promise ``` -Source: [`packages/skill/skill/src/index.ts:157`](../../packages/skill/skill/src/index.ts) +Source: [`packages/skill/skill/src/index.ts:159`](../../packages/skill/skill/src/index.ts) ## `ctx.subagents` — `SubagentService` @@ -246,7 +246,7 @@ list(): string[] start(name: string, request: SubagentStartRequest): SubagentRun ``` -Source: [`packages/subagent/subagent/src/index.ts:160`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:161`](../../packages/subagent/subagent/src/index.ts) ## `ctx.systemPrompt` — `SystemPrompt` @@ -260,7 +260,7 @@ protect(protection: PromptProtection): () => Promise | void async assemble(context: AssembleContext = {}): Promise ``` -Source: [`packages/core/system-prompt/src/index.ts:379`](../../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:380`](../../packages/core/system-prompt/src/index.ts) ## `ctx.tools` — `ToolRegistry` diff --git a/docs/core-data-structures/skills.md b/docs/core-data-structures/skills.md index b356aba720..0c5bfcae13 100644 --- a/docs/core-data-structures/skills.md +++ b/docs/core-data-structures/skills.md @@ -6,7 +6,7 @@ Source: [`packages/skill/skill/src/index.ts`](../../packages/skill/skill/src/ind ## Provider registry -`ctx.skills` is a multi-provider registry. Providers can represent local directories, embedded plugin data, HTTP catalogs, or another source. Provider plugins register synchronously during `apply()`; remote initialization, authentication, and discovery are awaited by `list()`. The registry validates candidates, resolves duplicate skill names first-wins by rank/provider order/local order, and sorts the final summaries by `name` for deterministic consumers. A provider `list()` rejection is logged and skipped without caching the degraded catalog; malformed candidates still fail fast because they violate the provider contract. +`ctx.skills` is a multi-provider registry. Providers can represent local directories, embedded plugin data, HTTP catalogs, or another source. Provider plugins register synchronously during `apply()`; remote initialization, authentication, and discovery are awaited by `list()`. Each lookup snapshots its read-only options before provider work, and each provider candidate becomes registry-owned data while its opaque locator retains provider-owned identity. The registry validates candidates, resolves duplicate skill names first-wins by rank/provider order/local order, and sorts the final summaries by `name` for deterministic consumers. A provider `list()` rejection is logged and skipped without caching the degraded catalog; malformed candidates still fail fast because they violate the provider contract. ```ts type-equiv interface SkillProvider { @@ -28,7 +28,7 @@ The shipped local provider scans roots in rank order: | 400 | `user-dsh` | `/skills` | | 500 | `user-agents` | `/skills` | -The project root is the nearest ancestor containing `.git`; without one, the current cwd is used. When `ctx.fs` is available, the git-root walk probes `.git` through the filesystem service so remote or sandboxed workspaces do not fall back to the host filesystem boundary. The user DSH root skips its `.system` child, and DeepSeek Harness no longer ships built-in system skills from the local provider. Additional built-ins can be supplied later by another provider. +The project root is the nearest ancestor containing `.git`; without one, the current cwd is used. When `ctx.fs` is available, the git-root walk probes `.git` through the filesystem service so remote or sandboxed workspaces do not fall back to the host filesystem boundary. The user DSH root skips its `.system` child. The local provider does not ship built-in system skills; deployments supply built-ins through another provider. ## Skill identity @@ -92,12 +92,12 @@ type SkillRegistration = Omit & { ## Lookup and configuration -Skill lookup is cwd-sensitive because providers may expose workspace-local skills, and its optional signal cancels provider work for the caller. If no git root is found, the local provider treats the supplied cwd itself as the project root. +Skill lookup is cwd-sensitive because providers may expose workspace-local skills, and its optional signal cancels provider work for the caller. The registry captures both fields once and providers receive the same read-only snapshot used for cache identity and loading. Cancellation is checked before and after catalog selection, including cache hits, and races both discovery and full-definition loading. If no git root is found, the local provider treats the supplied cwd itself as the project root. ```ts type-equiv interface SkillLookupOptions { - cwd?: string | undefined - signal?: AbortSignal | undefined + readonly cwd?: string | undefined + readonly signal?: AbortSignal | undefined } ``` diff --git a/docs/core-data-structures/tools.md b/docs/core-data-structures/tools.md index ad741a7522..5c11f1a07c 100644 --- a/docs/core-data-structures/tools.md +++ b/docs/core-data-structures/tools.md @@ -81,7 +81,7 @@ type InferArgs = Simplify< `defineTool({ name, description, parameters, execute, … })` ties it together: `parameters` is a `SchemaSpec`, `execute(args, exec)` gets `args: InferArgs`, and the helper converts the spec to JSON Schema (`schemaSpecToJsonSchema`) for the wire and validates model-generated args (`validateArgs`) before the typed body runs. A mismatch throws `ToolArgsError` (`code: 'INVALID_ARGS'`), which the registry turns into an `isError` result so the model can self-correct. Why a custom DSL and not schemastery: tool parameters need JSON Schema (the LLM wire format), not validation/transformation — the lightweight DSL gives the best authoring DX with the smallest surface. -Registration is a value boundary. `ToolRegistry.register()` validates `ToolDefinition.parameters` as lossless JSON before and after cloning, copies the scalar fields, binds the execute/presentation callbacks once to the original definition as their method receiver, and deep-freezes the stored record. Replacing a callback property on the caller-owned definition later does not change dispatch. `get()`/`visible()` expose only that frozen snapshot, while `schemas()` produces detached projections, so the model-visible and executable views cannot drift through a leaked mutable registry object. +Registration is a value boundary. `ToolRegistry.register()` reads every top-level field once, validates fixed scalar and callback types, materializes `ToolDefinition.parameters` as detached lossless JSON in one recursive pass, binds the accepted execute/presentation callbacks once to the original definition as their method receiver, and deep-freezes the stored record. Replacing a callback property on the caller-owned definition later does not change dispatch. `get()`/`visible()` expose only that frozen snapshot, while `schemas()` produces detached projections, so the model-visible and executable views cannot drift through a leaked mutable registry object. ## Execution: extensible waterfalls plus monotonic policy @@ -118,7 +118,7 @@ interface ToolExecution extends ToolExecutionInput { } ``` -`ToolExecutionToken` is a compile-time opaque type and a frozen, property-free object at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` requires the caller's `arguments` to be losslessly JSON-serializable, checks again after cloning to contain unstable accessors, assigns a fresh token, and deep-freezes the detached arguments. A cloneable mutable exotic such as `Map` is rejected and normalized to an error before policy. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are non-writable throughout all waterfalls, so a listener cannot change which capability or scope was authorized or reach a live enclosing execution; an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers, where the execution remains usable as a `WeakMap` key without mutation races. +`ToolExecutionToken` is a compile-time opaque type and a frozen, property-free object at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` reads each caller-owned field once, materializes `arguments` as detached lossless JSON in one recursive pass, assigns a fresh token, and deep-freezes the accepted arguments. A mutable exotic such as `Map` is rejected and normalized to an error before policy; one-pass materialization prevents a stateful getter from supplying different values to validation and storage. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are non-writable throughout all waterfalls, so a listener cannot change which capability or scope was authorized or reach a live enclosing execution; an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers, where the execution remains usable as a `WeakMap` key without mutation races. A `ToolGuard` is scope-aware final pre-dispatch policy. Its shape deliberately has no allow result: `undefined` preserves the waterfall decision, while a returned reason can only reduce permission, so a later listener cannot undo it. diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index 1ed2405671..5a0c547e70 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -28,14 +28,14 @@ This matrix shows which packages dispatch each harness-owned event and which pac | `session/created` | `emit` | [`packages/core/session/src/index.ts:47`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | | `session/event` | `emit` | [`packages/core/session/src/index.ts:61`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | | `session/flush` | `parallel` | [`packages/core/session/src/index.ts:79`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | -| `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:130`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | -| `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:136`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | -| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:114`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | -| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:75`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) | -| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:86`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) | -| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:101`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | -| `system-prompt/assemble` | `waterfall` | [`packages/core/system-prompt/src/index.ts:45`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`waterfall`) | - | -| `system-prompt/change` | `emit` | [`packages/core/system-prompt/src/index.ts:55`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`emit`) | - | +| `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:132`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | +| `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:138`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | +| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:115`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | +| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:76`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) | +| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:87`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) | +| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:102`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | +| `system-prompt/assemble` | `waterfall` | [`packages/core/system-prompt/src/index.ts:46`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`waterfall`) | - | +| `system-prompt/change` | `emit` | [`packages/core/system-prompt/src/index.ts:56`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`emit`) | - | | `tools/change` | `emit` | [`packages/core/tools/src/index.ts:176`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`emit`) | - | | `tools/execute` | `waterfall` | [`packages/core/tools/src/index.ts:131`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`timeout-policy`](../packages/timeout/timeout-policy) | | `tools/post-execute` | `waterfall` | [`packages/core/tools/src/index.ts:151`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | diff --git a/docs/module-graph.md b/docs/module-graph.md index 372c401954..8d0993b59a 100644 --- a/docs/module-graph.md +++ b/docs/module-graph.md @@ -120,17 +120,13 @@ flowchart TD pkg_session --> pkg_brand pkg_session --> pkg_llm pkg_session --> pkg_scope - pkg_system_prompt --> pkg_llm - pkg_system_prompt --> pkg_scope pkg_fs --> pkg_brand pkg_fs --> pkg_llm pkg_web --> pkg_llm pkg_sandbox --> pkg_llm - pkg_agent --> pkg_brand - pkg_agent --> pkg_llm - pkg_agent --> pkg_scope - pkg_agent --> pkg_session - pkg_agent --> pkg_system_prompt + pkg_system_prompt --> pkg_llm + pkg_system_prompt --> pkg_scope + pkg_system_prompt --> pkg_session pkg_bash --> pkg_brand pkg_bash --> pkg_sandbox pkg_bash --> pkg_session @@ -150,18 +146,26 @@ flowchart TD pkg_llm_replay --> pkg_session pkg_sandbox_local --> pkg_llm pkg_sandbox_local --> pkg_sandbox + pkg_agent --> pkg_brand + pkg_agent --> pkg_llm + pkg_agent --> pkg_scope + pkg_agent --> pkg_session + pkg_agent --> pkg_system_prompt pkg_bash_local --> pkg_bash pkg_bash_local --> pkg_timeout - pkg_compact_basic --> pkg_agent - pkg_compact_basic --> pkg_compact - pkg_compact_basic --> pkg_llm - pkg_compact_basic --> pkg_session pkg_hook_protocol --> pkg_bash pkg_hook_protocol --> pkg_session pkg_session_persistence_jsonl --> pkg_session pkg_session_persistence_jsonl --> pkg_session_persistence pkg_session_persistence_sqlite --> pkg_session pkg_session_persistence_sqlite --> pkg_session_persistence + pkg_bash_sandbox --> pkg_bash + pkg_bash_sandbox --> pkg_bash_local + pkg_bash_sandbox --> pkg_sandbox + pkg_compact_basic --> pkg_agent + pkg_compact_basic --> pkg_compact + pkg_compact_basic --> pkg_llm + pkg_compact_basic --> pkg_session pkg_user_approval --> pkg_agent pkg_user_approval --> pkg_brand pkg_user_approval --> pkg_llm @@ -180,9 +184,6 @@ flowchart TD pkg_tools --> pkg_session pkg_tools --> pkg_system_prompt pkg_tools --> pkg_user_approval - pkg_bash_sandbox --> pkg_bash - pkg_bash_sandbox --> pkg_bash_local - pkg_bash_sandbox --> pkg_sandbox pkg_agent_loop --> pkg_agent pkg_agent_loop --> pkg_llm pkg_agent_loop --> pkg_scope @@ -209,6 +210,7 @@ flowchart TD pkg_subagent --> pkg_agent pkg_subagent --> pkg_llm pkg_subagent --> pkg_scope + pkg_subagent --> pkg_session pkg_subagent --> pkg_tools pkg_tool_web --> pkg_llm pkg_tool_web --> pkg_system_prompt @@ -289,6 +291,7 @@ flowchart TD pkg_workflow_workerthread --> pkg_agent pkg_workflow_workerthread --> pkg_brand pkg_workflow_workerthread --> pkg_llm + pkg_workflow_workerthread --> pkg_session pkg_workflow_workerthread --> pkg_subagent pkg_workflow_workerthread --> pkg_tools pkg_workflow_workerthread --> pkg_workflow @@ -330,11 +333,10 @@ flowchart TD | [`llm-deepseek`](../packages/llm/llm-deepseek) | `llm` | [`llm`](../packages/llm/llm) | | [`llm-pi-ai`](../packages/llm/llm-pi-ai) | `llm` | [`llm`](../packages/llm/llm) | | [`session`](../packages/core/session) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope) | -| [`system-prompt`](../packages/core/system-prompt) | `core` | [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope) | | [`fs`](../packages/fs/fs) | `fs` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm) | | [`web`](../packages/web/web) | `web` | [`llm`](../packages/llm/llm) | | [`sandbox`](../packages/sandbox/sandbox) | `sandbox` | [`llm`](../packages/llm/llm) | -| [`agent`](../packages/core/agent) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | +| [`system-prompt`](../packages/core/system-prompt) | `core` | [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session) | | [`bash`](../packages/bash/bash) | `bash` | [`brand`](../packages/util/brand), [`sandbox`](../packages/sandbox/sandbox), [`session`](../packages/core/session) | | [`fs-local`](../packages/fs/fs-local) | `fs` | [`fs`](../packages/fs/fs) | | [`fs-policy`](../packages/fs/fs-policy) | `fs` | [`fs`](../packages/fs/fs) | @@ -347,21 +349,22 @@ flowchart TD | [`session-persistence`](../packages/session-persistence/session-persistence) | `session-persistence` | [`session`](../packages/core/session) | | [`llm-replay`](../packages/support/llm-replay) | `support` | [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | | [`sandbox-local`](../packages/sandbox/sandbox-local) | `sandbox` | [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox) | +| [`agent`](../packages/core/agent) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | | [`bash-local`](../packages/bash/bash-local) | `bash` | [`bash`](../packages/bash/bash), [`timeout`](../packages/util/timeout) | -| [`compact-basic`](../packages/compact/compact-basic) | `compact` | [`agent`](../packages/core/agent), [`compact`](../packages/compact/compact), [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | | [`hook-protocol`](../packages/hooks/hook-protocol) | `hooks` | [`bash`](../packages/bash/bash), [`session`](../packages/core/session) | | [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) | | [`session-persistence-sqlite`](../packages/session-persistence/session-persistence-sqlite) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) | +| [`bash-sandbox`](../packages/bash/bash-sandbox) | `bash` | [`bash`](../packages/bash/bash), [`bash-local`](../packages/bash/bash-local), [`sandbox`](../packages/sandbox/sandbox) | +| [`compact-basic`](../packages/compact/compact-basic) | `compact` | [`agent`](../packages/core/agent), [`compact`](../packages/compact/compact), [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | | [`user-approval`](../packages/ui/user-approval) | `ui` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | | [`user-interaction`](../packages/ui/user-interaction) | `ui` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm) | | [`workflow`](../packages/workflow/workflow) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm) | | [`tools`](../packages/core/tools) | `core` | [`agent`](../packages/core/agent), [`code-runtime`](../packages/code-runtime/code-runtime), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`user-approval`](../packages/ui/user-approval) | -| [`bash-sandbox`](../packages/bash/bash-sandbox) | `bash` | [`bash`](../packages/bash/bash), [`bash-local`](../packages/bash/bash-local), [`sandbox`](../packages/sandbox/sandbox) | | [`agent-loop`](../packages/core/agent-loop) | `core` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-bash`](../packages/bash/tool-bash) | `bash` | [`agent`](../packages/core/agent), [`bash`](../packages/bash/bash), [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-approval`](../packages/ui/user-approval) | | [`tool-fs`](../packages/fs/tool-fs) | `fs` | [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-skill`](../packages/skill/tool-skill) | `skill` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`skill`](../packages/skill/skill), [`tools`](../packages/core/tools) | -| [`subagent`](../packages/subagent/subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`tools`](../packages/core/tools) | +| [`subagent`](../packages/subagent/subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | | [`tool-web`](../packages/web/tool-web) | `web` | [`llm`](../packages/llm/llm), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`web`](../packages/web/web) | | [`timeout-policy`](../packages/timeout/timeout-policy) | `timeout` | [`llm`](../packages/llm/llm), [`timeout`](../packages/util/timeout), [`tools`](../packages/core/tools) | | [`tool-todo`](../packages/todo/tool-todo) | `todo` | [`agent`](../packages/core/agent), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | @@ -378,7 +381,7 @@ flowchart TD | [`tool-subagent`](../packages/subagent/tool-subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | | [`hooks-claude`](../packages/hooks/hooks-claude) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools) | | [`subagent-mock`](../packages/support/subagent-mock) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent) | -| [`workflow-workerthread`](../packages/workflow/workflow-workerthread) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools), [`workflow`](../packages/workflow/workflow) | +| [`workflow-workerthread`](../packages/workflow/workflow-workerthread) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`tools`](../packages/core/tools), [`workflow`](../packages/workflow/workflow) | | [`subagent-fork`](../packages/subagent/subagent-fork) | `subagent` | [`agent`](../packages/core/agent), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | | [`subagent-spawn`](../packages/subagent/subagent-spawn) | `subagent` | [`subagent`](../packages/subagent/subagent), [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | | [`acp-agent`](../packages/ui/acp-agent) | `ui` | [`acp`](../packages/ui/acp), [`agent-core`](../packages/core/agent-core), [`app-boot`](../packages/ui/app-boot), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`tools`](../packages/core/tools), [`user-interaction`](../packages/ui/user-interaction) | diff --git a/docs/persistence-catalog.md b/docs/persistence-catalog.md index 4bbe894338..cb0e8ce0dc 100644 --- a/docs/persistence-catalog.md +++ b/docs/persistence-catalog.md @@ -57,7 +57,7 @@ Raw stream chunk — token-level replay fidelity. Types: [StreamChunk](core-data-structures/llm-streaming.md) -Source: [`packages/core/session/src/types.ts:313`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:317`](../packages/core/session/src/types.ts) #### `assistant/message` — surface @@ -69,7 +69,7 @@ Assembled assistant message for one step (derived history uses this). Carries th Types: [ContentBlock](core-data-structures/core.md) · [TokenUsage](core-data-structures/llm-streaming.md) -Source: [`packages/core/session/src/types.ts:320`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:324`](../packages/core/session/src/types.ts) ### `bash/*` @@ -129,7 +129,7 @@ In-session context injection (file-change notices, subdir AGENTS.md, skill conte Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:311`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:315`](../packages/core/session/src/types.ts) ### `hook/*` @@ -165,7 +165,7 @@ A queued prompt an `agent/prompt-submit` listener VETOED — the durable record Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:305`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:309`](../packages/core/session/src/types.ts) ### `request/*` @@ -177,7 +177,7 @@ Full snapshot of the EpochHeader the NEXT request is built under, with the Reque 'request/header': { header: EpochHeader; reason: RequestHeaderReason } ``` -Source: [`packages/core/session/src/types.ts:365`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:369`](../packages/core/session/src/types.ts) #### `request/header-delta` — log-only @@ -187,7 +187,7 @@ Amendment to the folded EpochHeader: at least one of a SystemDelta, a ToolsDelta 'request/header-delta': { system?: SystemDelta; tools?: ToolsDelta; config?: LlmCallConfig; messagePrefix?: Message[] } ``` -Source: [`packages/core/session/src/types.ts:382`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:386`](../packages/core/session/src/types.ts) ### `steering/*` @@ -201,7 +201,7 @@ Steering content injected between steps of a running turn. Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:338`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:342`](../packages/core/session/src/types.ts) ### `step/*` @@ -213,7 +213,7 @@ Closes step `step` of turn `turn`. 'step/end': { turn: number; step: number } ``` -Source: [`packages/core/session/src/types.ts:292`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:296`](../packages/core/session/src/types.ts) #### `step/start` — log-only @@ -223,7 +223,7 @@ Opens step `step` of turn `turn` — one model call plus the tool executions it 'step/start': { turn: number; step: number } ``` -Source: [`packages/core/session/src/types.ts:290`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:294`](../packages/core/session/src/types.ts) ### `todo/*` @@ -239,7 +239,7 @@ NOT a SurfaceEventType: it produces no LLM message and never reaches `deriveMess Types: [TodoItem](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:352`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:356`](../packages/core/session/src/types.ts) ### `tool/*` @@ -253,7 +253,7 @@ The model requested one tool invocation: `name` with the raw `arguments` JSON st Types: [CallId](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:326`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:330`](../packages/core/session/src/types.ts) #### `tool/code-dispatch` — log-only @@ -277,7 +277,7 @@ A completed tool call's model-facing result, plus an optional tool-private `meta Types: [CallId](core-data-structures/core.md) · [ContentBlock](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:336`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:340`](../packages/core/session/src/types.ts) ### `turn/*` @@ -291,7 +291,7 @@ Closes turn `turn` with the TurnEndReason that ended it. The loop fires the awai Types: [TurnEndReason](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:288`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:292`](../packages/core/session/src/types.ts) #### `turn/start` — log-only @@ -303,7 +303,7 @@ Opens turn `turn`. `trigger` records what started it — a drained message batch Types: [TurnTrigger](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:282`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:286`](../packages/core/session/src/types.ts) ### `user/*` @@ -317,4 +317,4 @@ A user-visible prompt (queued message drained at turn start). Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:294`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:298`](../packages/core/session/src/types.ts) diff --git a/docs/rfc/INDEX.md b/docs/rfc/INDEX.md index 654b68ffb5..454997ef1f 100644 --- a/docs/rfc/INDEX.md +++ b/docs/rfc/INDEX.md @@ -101,7 +101,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand; |---|---| | [Provider-neutral content-block vocabulary owned by dsh-llm](implemented/architecture/2026-06-11-content-block-vocabulary.md) | 2026-06-11 | | [Custom typed tool-schema DSL instead of schemastery](implemented/architecture/2026-06-11-custom-schema-dsl.md) | 2026-06-11 | -| [Dev-mode invariants over compile-time deep-readonly](implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) | 2026-06-11 | +| [Source-owned session immutability and dev-mode invariants](implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) | 2026-06-11 | | [Event-sourced sessions with derived message history](implemented/architecture/2026-06-11-event-sourced-sessions.md) | 2026-06-11 | | [Microkernel — extension via Cordis event taxonomy, one concrete loop](implemented/architecture/2026-06-11-microkernel-event-taxonomy.md) | 2026-06-11 | | [Runtime arg validation at the model boundary](implemented/architecture/2026-06-11-runtime-arg-validation.md) | 2026-06-11 | diff --git a/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md b/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md index a3240153d0..aac3991f46 100644 --- a/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md +++ b/docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md @@ -1,29 +1,58 @@ -# RFC: Dev-mode invariants over compile-time deep-readonly +# RFC: Source-owned session immutability and dev-mode invariants Status: implemented ## Problem -The session log is append-only by contract, but the types don't enforce it: `session.events` returns `readonly SessionEvent[]` whose *elements* are mutable, and `deriveMessages()` handed the logged `content` arrays/blocks out by reference. The loop then passes those derived messages into the `agent/request` waterfall and on to adapters, where mutating the request is sanctioned — so a request middleware could reach back and rewrite history, silently breaking replay equivalence and the derived-history guarantee. Separately, the event taxonomy (turn/step nesting, seq monotonicity, tool-call/result pairing, legal status transitions) was asserted only where individual tests happened to look. +The session log needs two different protections: immutable ownership of each stored fact, and checks for relationships among facts across time and service seams. Conflating them in an optional development plugin would leave production history vulnerable; trying to express both through TypeScript readonly types would not create a runtime boundary or describe relational rules. -Two ways to defend the log: make immutability part of the type (`DeepReadonly` on the way out), or catch corruption at runtime in dev. The runtime-validation proposal took the runtime route; [the deep-readonly proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) took the type route. +The session log is the durable source of truth for replay, request reconstruction, persistence, and user-visible history. Code outside the session package must be able to inspect that history without retaining a reference that can rewrite it later, and inputs accepted from callers must not remain connected to caller-owned mutable objects. + +Immutability of individual values is only half of the contract. A log can contain perfectly immutable records whose sequence, turn/step nesting, tool-call pairing, scoped delivery, or reconstructed model request is wrong. Those rules relate multiple records or services and cannot be established by freezing one object. + +TypeScript readonly types are not a sufficient runtime boundary. They disappear when the program runs, a cast can bypass them, and a recursive `DeepReadonly` would spread through every log and message consumer even though some downstream request-processing APIs intentionally work with mutable values. ## Decision -Reject the pervasive `DeepReadonly` type flip. Instead: +Responsibility is split between an always-on storage boundary and optional development assertions. -1. **Always-on:** `deriveMessages()` deep-clones the content it emits (one `structuredClone` per derived message). In-flight mutation of a request can no longer reach the log — this is the real fix, and it costs nothing meaningful next to a model call. -2. **Dev-mode:** a new `dsh-invariants` plugin (pure listeners, off in production, on in tests and demos) asserts the event contract and `Object.freeze`s logged event data so any *other* code that mutates a logged event throws instead of corrupting silently. Seeded sessions are frozen and checked on `session/created` (the constructor copies the seed without emitting `session/event`). +### Session owns immutable history -The invariants encode the *real* contract, not an idealized one: a `tool/call` may have no `tool/result` (a thrown tool-execution pipeline step ends the turn), and both `idle→disposed` and `running→disposed` are legal. +`Session` accepts an event only after one recursive pass has materialized a lossless JSON snapshot. That pass rejects unsupported values and produces the exact detached record that enters the log, so validation and storage cannot observe different values from a stateful getter or retain caller-owned nested references. + +The accepted event and all of its descendants are deep-frozen before publication. `append()` returns that owned frozen event, `session/event` observers receive the same record, and `session.events` returns a frozen array snapshot. A previously returned array does not grow after a later append. Seed records pass through the same validation, snapshot, and freeze boundary before construction succeeds. + +This guarantee belongs in `Session`, not in an optional listener, because every composition relies on trustworthy history. A production deployment, a focused test, or a custom embedding receives the same storage semantics whether or not development support plugins are registered. + +### Derived requests remain detached + +`deriveMessages()` projects logged surface events into detached, deep-frozen `Message` objects and returns a fresh array snapshot. Request assembly can therefore combine derived history with other inputs without exposing a path back into the log. The cache reuses safe immutable projections rather than recloning the complete history for each model call. + +### The invariants plugin checks relationships + +`dsh-invariants` is a pure-listener development plugin. It does not freeze records and has no configuration; disposal removes only its assertions. It checks rules that require trace state or observation of another seam, including monotonic sequence numbers, turn and step nesting, tool-call/result pairing, legal agent-status transitions, subject-correct scoped dispatch, and equality between a loop-built request and the request reconstructed from its session-log prefix. + +When the plugin attaches to an existing or seeded session, it replays the immutable log to rebuild trace state. This makes hot reload safe in the middle of a turn without giving the plugin ownership of session storage. ## Alternatives considered -**The pervasive `DeepReadonly` type flip** ([the rejected proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md)) — compile-time only (a plugin casts straight through it), high type-noise across every log/message consumer and adapter, and it would force readonly types through code where mutation is the sanctioned API. The clone draws the mutable/immutable boundary exactly at "logged vs in-flight" without any of that noise. +### Pervasive deep-readonly types + +[The rejected immutable-public-surfaces proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) would apply a recursive readonly type across public log and message surfaces. That provides editor feedback but not a runtime guarantee: TypeScript types are erased and plugin code can cast through them. It also pushes readonly types into consumers where mutation is intentional. Runtime ownership at the `Session` boundary protects every caller without that type propagation. + +### Development-only freezing + +Freezing history only when an invariants plugin is installed would make the core guarantee composition-dependent. Code could pass development tests and still corrupt history in production or in a focused composition that omits the plugin. Storage immutability is therefore always on, while the more expensive relational checks remain opt-in development support. + +### Clone only when deriving messages + +Detaching `deriveMessages()` would protect the most common request path but leave other readers of `session.events`, append return values, and session-event observers able to mutate durable history. The log must protect its own boundary; derived projections are an additional isolation boundary, not a substitute. ## Consequences -- History corruption is caught loudly in tests and demos, at zero production cost and zero type noise. The trade-off is that the guarantee is dynamic (a dev-mode tripwire) rather than static. -- The invariants plugin doubles as executable documentation of the event taxonomy — the assertions are the contract. -- `Session.events` keeps its `readonly SessionEvent[]` type; no consumer churn. -- This folds in [the deep-readonly proposal](../../rejected/architecture/2026-06-11-immutable-public-surfaces.md) — there is no separate deep-readonly record; this records the decision to *not* pursue that approach. `InvariantError` is a plain `Error` with a `code` for now; a later taxonomy change can promote it. +- Every accepted live or seeded session event is detached from caller-owned inputs and deeply immutable before any observer can receive it. +- `session.events` exposes stable immutable snapshots instead of the private growing array. +- Request-side mutation cannot reach stored history through derived messages. +- Development builds can enable relational assertions without changing storage behavior, and disposing or omitting the plugin does not weaken log immutability. +- `dsh-invariants` has no `Config` surface because it has no behavior to tune. +- The runtime boundary carries a recursive snapshot-and-freeze cost once per accepted event; later readers and cached projections reuse the owned immutable records. diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 9091965a59..981603cb19 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -149,18 +149,23 @@ Calling a service through `agent.ctx` does not implicitly make every later read The tool view must not change because a caller kept the object it passed to `register()` or received a definition from `get()` or `visible()`. Registration therefore creates the stored identity once; future changes happen through explicit unregister/register effects. -Tool parameters cross the model and log boundary, so the registry requires them to be lossless JSON before cloning and validates the clone again to contain unstable getters. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections. +Tool parameters cross the model and log boundary, so the registry materializes them with `snapshotJsonValue`: one recursive traversal reads each property once, rejects anything outside lossless JSON, and constructs the detached value that is actually stored. A check followed by `structuredClone` is not equivalent—a getter could return plain JSON to the check and a class instance to the clone, which would erase its prototype and silently accept different data. The first-party `defineTool()` helper closes the earlier authoring boundary with the same primitive: it reads every top-level option once, materializes the `SchemaSpec`, and derives an independent wire schema plus all later execute/presentation validation from that accepted snapshot. Without that split, mutating an author-owned spec after definition could make the model call a schema that the tool no longer accepts. Registration then reads every top-level definition field exactly once, validates, binds, and stores only those captured values; a stateful `parameters` or callback accessor therefore cannot make the checked definition differ from the executable one. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections. ```text +defineTool(options): + accepted = read each top-level option exactly once + parameterSpec = snapshotLosslessJson(accepted.parameters) + wireParameters = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) + build execute and presentation validators over parameterSpec + registerTool(context, definition): - require definition.parameters is lossless JSON - parameters = clone(definition.parameters) - require parameters is still lossless JSON + accepted = read each top-level definition field exactly once + parameters = snapshotLosslessJson(accepted.parameters) stored = deepFreeze({ - copied name, description, timeout, + accepted name, description, timeout, parameters, - execute: bind definition.execute to definition, + execute: bind accepted.execute to definition, presentation callbacks: bind once when present }) @@ -173,7 +178,7 @@ The reserved Code Mode transport uses the same frozen-definition contract even t A tool restriction masks the global end-capability layer for one agent, while tools registered in that agent's own layer are explicit grants. Multiple restrictions intersect, so separately installed policies can only reduce the global surface. -The restriction snapshots its input, rejects an empty filter, and validates named tools against the pre-restriction capability universe. A restricted-away tool behaves like an unknown tool at execution, avoiding disclosure of a hidden global implementation. +The restriction reads `allow` and `deny` once, snapshots those exact values, rejects an empty filter, and validates named tools against the pre-restriction capability universe. The same captured arrays are then enforced, so a stateful accessor cannot pass one policy through validation and install another. A restricted-away tool behaves like an unknown tool at execution, avoiding disclosure of a hidden global implementation. [Code Mode](../feature/2026-06-15-code-mode.md)'s `run_code` is not an end capability. It is a reserved presentation transport that carries calls to the visible end capabilities, so the registry keeps it outside both global and scoped registration layers: restrictions cannot remove it, a scoped tool cannot shadow it, and configuration cannot explicitly allow or deny it. Without this exception, a restriction could leave the generated SDK in the prompt but remove the only way to invoke it. @@ -241,7 +246,9 @@ An agent's scope, session, registry entry, and driver form one owned transaction Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup. -The factory captures IDs and the setup callback and clones caller-owned agent options, session metadata, and seed events before the first asynchronous boundary. Resume does the same before persistence loading. A caller mutating its options object later therefore cannot move the transaction away from the identities it reserved or change the configuration eventually published. +The factory captures IDs and the setup callback and clones caller-owned agent options before the first asynchronous boundary. Seed events and session metadata take a stricter route: pre-cloning either could erase a class or exotic prototype before the session validator saw it, so the factory reads each reference once and hands it synchronously to `SessionStore.prepare`. That boundary rejects exotic shells, reads each accepted metadata field once, and recursively validates and copies every seed value in one pass. One-pass materialization matters because `validate(value); structuredClone(value); validate(clone)` still reads a getter twice, and the clone can erase the prototype of a class instance returned only on the second read. The accepted metadata becomes a detached, deep-frozen `SessionHeader` whose id must equal the session id. Resume applies the same rule after persistence loading by capturing `createdAt`, `cwd`, `parentSession`, and `seedLength` once before reconstruction. A caller or stateful backend therefore cannot move the transaction away from the identities it reserved, change persistence routing or lineage after publication, or sanitize invalid data into acceptance. + +The session log also closes the ownership boundary after acceptance. Seed and append paths share exact runtime surface-metadata checks: surface events require either `'append'` or an exact replace record with non-negative safe-integer bounds, provenance is an array of non-negative safe integers, and non-surface events reject both fields. Accepted events are deep-frozen, and `session.events` returns a cached frozen array snapshot rather than the mutable internal array. A later append invalidates the cache and publishes a new snapshot; any earlier snapshot remains unchanged. This preserves append-only behavior even for JavaScript callers that cast away TypeScript's readonly view or retain an event reference received from `append` or `session/event`. Reservations prevent two concurrent transactions from composing different unpublished agents under the same public identity. They remain held across persistence loading and setup and are released on every success or failure path. @@ -356,9 +363,9 @@ Cooperative waterfalls remain the general extension mechanism, but an invariant ### Prompt protection restores named canonical contributions -`systemPrompt.protect({ sections, tools })` declares that selected names must match the canonical registry/provider assembly after the complete `system-prompt/assemble` waterfall. Protections registered globally and for the current scope compose by set union, so callback order cannot weaken them. Protection finalizes a returned assembly rather than recovering from listener failure; if the waterfall throws, assembly still fails. +`systemPrompt.protect({ sections, tools })` declares that selected names must match the canonical registry/provider assembly after the complete `system-prompt/assemble` waterfall. It reads each caller array once before deduplication, so the names checked for an empty protection are the names actually installed. Protections registered globally and for the current scope compose by set union, so callback order cannot weaken them. Protection finalizes a returned assembly rather than recovering from listener failure; if the waterfall throws, assembly still fails. -For each protected name, the service restores the canonical presence and definition. If the canonical assembly omitted the name, protection removes a listener-fabricated entry; this makes mode-dependent absence enforceable as well as presence. +For each protected name, the service restores the canonical presence and definition. If the canonical assembly omitted the name, protection removes a listener-fabricated entry; this makes mode-dependent absence enforceable as well as presence. Tool providers receive the same coherence treatment: assembly reads `schemas`, optional `knownNames`, and every schema field once, detaches that record, and uses its captured names for both `toolOrder` validation and the model-visible collection. A stateful provider therefore cannot validate a phantom name while showing a different tool. A global section protection also reserves the registry name against scoped shadowing. Registering a scoped section under an already protected global name throws, and adding global protection throws if any scoped shadow already exists. Section registration copies `name`, `order`, and the text value or callback before the check and stores that record, so later mutation of the caller's object cannot rename a safe section into a reserved one. This check must happen before assembly: otherwise the ordinary scoped-over-global merge would make the shadow itself look canonical, leaving post-waterfall restoration with the wrong owner's value. Tool-schema protection does not impose a blanket schema-name reservation because providers are additive and may deliberately contribute unrelated executable schemas. @@ -392,7 +399,7 @@ Code Mode uses global protection for the `tools:sdk` section and reserved `run_c ### Tool executions have stable identity -`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. The registry requires `arguments` to be losslessly JSON-serializable, validates before cloning and again after cloning to contain unstable accessors, then deep-freezes the detached value. A cloneable but mutable exotic such as `Map` is rejected before policy rather than smuggled through an apparently frozen wrapper. Invalid input still produces one normalized final error notification. +`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. It captures the required `callId`/`name` correlation identity, then reads every other top-level caller field once before using it, so parent-token validation, scope routing, policy, dispatch, and final observation all see one coherent identity; those captured optional fields construct the normalized error shell if a later accessor or argument validation fails. The registry materializes `arguments` in one lossless-JSON traversal and deep-freezes the result, so policy and dispatch receive exactly the value that passed validation. A cloneable but mutable exotic such as `Map` or a class instance is rejected before policy rather than smuggled through an apparently frozen wrapper. Invalid input still produces one normalized final error notification; a throwing `callId` or `name` accessor is outside that guarantee because no trustworthy result correlation exists. The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution's `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field: an around-dispatch wrapper may add, replace, or remove it, and the registry freezes the complete execution before outcome observation. @@ -404,19 +411,18 @@ The input-to-execution conversion is intentionally one-way: ```text prepareExecution(input): - require input.parent is absent or a registry-minted token - require input.arguments is lossless JSON - detachedArguments = clone(input.arguments) - require detachedArguments is still lossless JSON + accepted = read callId, name, arguments, agent, parent, signal exactly once + require accepted.parent is absent or a registry-minted token + detachedArguments = snapshotLosslessJson(accepted.arguments) execution = { token: new frozen property-free object, - callId: input.callId, - name: input.name, + callId: accepted.callId, + name: accepted.name, arguments: deepFreeze(detachedArguments), - agent: input.agent, - parent: input.parent, - signal: input.signal + agent: accepted.agent, + parent: accepted.parent, + signal: accepted.signal } make every field except signal non-writable and non-configurable @@ -431,7 +437,7 @@ This one-way result makes the boundary monotonic. Pre-execution hooks can still ### `tools/result` observes the authoritative live outcome -The complete live pipeline is `tools/pre-execute` → monotonic guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first three named events are transformable waterfalls; `tools/result` is an awaited, observe-only notification after all transforms and the registry's outer error normalization. Immediately before that boundary, the registry validates that the entire authoritative result can round-trip losslessly through JSON; an invalid tool or listener result becomes a normal JSON-safe `isError` outcome instead of reaching observers as apparent success and failing later at the session log. +The complete live pipeline is `tools/pre-execute` → monotonic guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first three named events are transformable waterfalls; `tools/result` is an awaited, observe-only notification after all transforms and the registry's outer error normalization. At each untrusted result boundary, the registry captures every top-level field once and materializes the complete authoritative outcome as detached lossless JSON. Immediately before observation it materializes that owned outcome again and deep-freezes the shared listener snapshot. An invalid tool or listener result becomes a normal JSON-safe `isError` outcome instead of reaching observers as apparent success and failing later at the session log. Every `tools/result` listener receives the same frozen execution and deep-frozen result snapshot. Listener failures are contained independently, so they cannot change the caller's result or starve peer observers. Scope filtering derives from `execution.agent`. @@ -468,12 +474,12 @@ execute(input): result = requireValidExecutionResult(result) result = await tools/post-execute(execution, result) - result = requireLosslessJson(result) + result = snapshotLosslessJson(result) catch pipelineFailure: result = errorResult(pipelineFailure) freeze(execution) - frozenResult = deepFreeze(clone(result)) + frozenResult = deepFreeze(snapshotLosslessJson(result)) await every tools/result observer independently, containing each failure return result ``` @@ -520,11 +526,11 @@ In-process subagents demonstrate how the scope, lifecycle, and final-policy piec Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider receiver so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and HMR cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key. -Starting a run snapshots every accepted field before asynchronous owner setup. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached. The schema is validated before cloning, while the prompt must pass the same lossless-JSON check before and after cloning that the session log requires. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. +Starting a run reads every top-level request field once before capability validation, then snapshots every accepted field before asynchronous owner setup. This order makes checked and delegated capabilities identical even for a JavaScript caller with stateful accessors. Fixed scalars are checked at the same boundary: `maxDepth` must be a non-negative safe integer and `persona` must be a string. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached through the one-pass lossless-JSON materializer. The exported in-process driver repeats this boundary for direct callers before it awaits run-owner activation, including taking one seed snapshot from which it derives both the child prefix and `seedLength`. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. The child factory runs through the owner fiber. Parent teardown, provider teardown, and manual run disposal all dispose this same node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. -The returned run separates acceptance from publication with `started: Promise`. For spawn and fork, it fulfills only after the child factory returns a published handle, so the service can emit `subagent/start` with `ctx.agents.get(run.id)` already live; it rejects when rollback prevents publication. The service observes `result` immediately but buffers its cloned end payload until readiness, preserving start-before-end order without leaving an early rejection unhandled. A readiness rejection emits neither lifecycle event. The result driver awaits the same boundary before sending the child prompt. +The provider's run separates acceptance from publication with `started: Promise`, but the service does not return that caller-owned handle directly. It reads `id`, `started`, `result`, and every method once, binds methods to the original provider receiver, and returns a frozen service-owned wrapper. Its `result` promise captures `output`, optional `structured`, and `stopReason` once and resolves to one detached, deeply frozen lossless-JSON value shared by the caller and lifecycle telemetry; malformed provider data rejects as an infrastructure fault and produces contained `error` telemetry. For spawn and fork, the accepted `started` promise fulfills only after the child factory returns a published handle, so the service can emit `subagent/start` with `ctx.agents.get(id)` already live; it rejects when rollback prevents publication. The service observes the normalized result immediately but buffers its end payload until readiness, preserving start-before-end order without leaving an early rejection unhandled. Both lifecycle payloads are deeply frozen before contained per-listener dispatch, so one observer cannot corrupt the caller or a peer. A readiness rejection emits neither lifecycle event. The result driver awaits the same boundary before sending the child prompt. ```text startInProcessRun(providerContext, acceptedRequest): @@ -540,7 +546,7 @@ startInProcessRun(providerContext, acceptedRequest): creation = runOwner.ctx.agents.create({ fresh ids and lineage, - cloned options and optional seed, + detached options and optional seed, setup(childCtx) => install persona, tool restriction, structured runtime }) @@ -550,9 +556,16 @@ startInProcessRun(providerContext, acceptedRequest): send the child prompt, await idle, derive the terminal result SubagentService.start(...): - attach result settlement handlers immediately - await returnedRun.started + providerRun = provider.start(detached request) + serviceRun = freeze({ + id, started, and methods captured once from providerRun, + methods bound to providerRun, + result: normalize once into detached, deeply frozen lossless JSON + }) + attach settlement handlers to serviceRun.result immediately + await serviceRun.started emit subagent/start; later emit the buffered or eventual subagent/end + return serviceRun Workflow worker bridge after receiving returnedRun: register the run so cancellation can reach pre-publication work @@ -561,9 +574,14 @@ Workflow worker bridge after receiving returnedRun: send ChildStarted; then send the buffered or eventual outcome else: send ChildStartError and dispose the attempt + +Before publishing the workflow's own result: + abort the shared child-request signal + call cancel("workflow settled") on every host-registered run + only then settle the workflow result ``` -Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. This keeps cancellation able to reach pending creation, prevents an early result rejection from going unhandled, and ensures `workflow/agent-start` never names an unpublished child. +Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. Before the workflow result becomes observable, the host also drives both permitted cancellation channels—the shared abort signal and each registered run's explicit `cancel()`—because a fire-and-forget child still waiting on readiness has no worker-side handle that could relay cancellation. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. This keeps cancellation able to reach pending creation, prevents an early result rejection from going unhandled, ensures `workflow/agent-start` never names an unpublished child, and prevents a child from publishing after its workflow has ended. Parent teardown reaches `runOwner` by nesting; the provider and returned run handle reach the same node through their explicit disposers. diff --git a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md index 474abd2c67..f26aa501ef 100644 --- a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md +++ b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md @@ -46,7 +46,7 @@ A provider exposes `start(request) → SubagentRun`. The run carries `started` ( ### Fork vs. fresh are separate backends, not a flag -Rather than a `context: 'fresh' | 'fork'` request field, the distinction is the provider's identity: `dsh-subagent-spawn` (fresh, isolated, own system prompt) and `dsh-subagent-fork` (seeded from the parent's log) are two registered providers. You pick behavior by picking a provider — consistent with the registry being the selection mechanism. The fork backend seeds only a **balanced, completed-turn prefix** of the parent log: at tool-execute time the parent's turn is open (it holds the `assistant/message` and the dangling spawn `tool/call` with no `tool/result`), and seeding that raw prefix would give the child an unbalanced turn the [invariants](../../../../packages/support/invariants/src/index.ts) freeze-check rejects. +Rather than a `context: 'fresh' | 'fork'` request field, the distinction is the provider's identity: `dsh-subagent-spawn` (fresh, isolated, own system prompt) and `dsh-subagent-fork` (seeded from the parent's log) are two registered providers. You pick behavior by picking a provider — consistent with the registry being the selection mechanism. The fork backend seeds only a **balanced, completed-turn prefix** of the parent log: at tool-execute time the parent's turn is open (it holds the `assistant/message` and the dangling spawn `tool/call` with no `tool/result`), and seeding that raw prefix would give the child an unbalanced turn that the [invariants](../../../../packages/support/invariants/src/index.ts) trace replay rejects. ### Child isolation and the parent log diff --git a/docs/rfc/implemented/feature/2026-06-30-interception-seams.md b/docs/rfc/implemented/feature/2026-06-30-interception-seams.md index ba372b98b2..52d7e2b425 100644 --- a/docs/rfc/implemented/feature/2026-06-30-interception-seams.md +++ b/docs/rfc/implemented/feature/2026-06-30-interception-seams.md @@ -20,13 +20,13 @@ The canonical surface separates transformable policy, around-dispatch control, a ### The tool pipeline gives each phase one kind of authority -Every call follows one ordered pipeline: `tools/pre-execute` → monotonic guards → `tools/execute` → core dispatch → `tools/post-execute` → `tools/result`. The registry requires caller-owned `arguments` to survive lossless-JSON validation before and after cloning, then snapshots `ToolExecutionInput` into a pipeline execution with its own opaque token: identity fields and deeply frozen detached arguments are immutable for the whole pipeline, and a nested call's `parent` contains only the enclosing execution's token rather than its live object. Optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove, and the complete object freezes before final observers run. This identity contract prevents a policy listener from silently changing what the log, UI, and tool body believe ran. +Every call follows one ordered pipeline: `tools/pre-execute` → monotonic guards → `tools/execute` → core dispatch → `tools/post-execute` → `tools/result`. The registry reads each caller-owned input field once, materializes `arguments` as detached lossless JSON in one recursive pass, and snapshots `ToolExecutionInput` into a pipeline execution with its own opaque token. Identity fields and deeply frozen arguments are immutable for the whole pipeline, and a nested call's `parent` contains only the enclosing execution's token rather than its live object. Optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove, and the complete object freezes before final observers run. This identity contract prevents a policy listener from silently changing what the log, UI, and tool body believe ran. - **`tools/pre-execute`** is the extensible waterfall gate. Its `PreToolDecision` allows, denies, or asks. Deny skips `tools/execute` and core dispatch. Ask resolves through the optional approval seam: only `allowed-once` continues through guards and dispatch; rejection, cancellation, an unavailable channel, a missing approval service, or an agent-less call becomes a normalized denial. Every outcome still reaches post-policy and final observers. - **`ctx.tools.guard()`** installs synchronous scope-aware policy after the whole pre-execute waterfall. A guard may deny or abstain, never force-allow, so listener ordering cannot resurrect an operation that a final invariant forbids. - **`tools/execute`** is the around-dispatch waterfall for timeout, retry, and metrics plugins. A wrapper delegates to core dispatch with `next()`, may add, replace, or remove only `exec.signal` before doing so, and receives the already-normalized result of a thrown or unknown tool; returning its own valid result short-circuits dispatch. - **`tools/post-execute`** is the inspect/transform waterfall. Its `PostToolDecision` accepts, blocks with feedback, optionally replaces content, or attaches `additionalContext`; in-place mutation of the result is not a transform channel, because the registry rebuilds the outcome from a protected snapshot plus the returned decision. -- **`tools/result`** is the awaited parallel notification after every transform, lossless-JSON validation, and the outer error boundary. It receives the same frozen execution identity and an immutable snapshot of the authoritative result; observer failures are contained per listener and cannot change or reject `ToolRegistry.execute()`'s returned outcome. +- **`tools/result`** is the awaited parallel notification after every transform, lossless-JSON materialization, and the outer error boundary. It receives the same frozen execution identity and an immutable snapshot of the authoritative result; observer failures are contained per listener and cannot change or reject `ToolRegistry.execute()`'s returned outcome. Core dispatch and the tool body sit inside normalization boundaries, so tool, listener, malformed-result, non-JSON result, and identity-shape failures resolve as JSON-safe `isError` results rather than escaping the turn. A post-execute listener can therefore inspect a thrown tool, and a final observer sees exactly what the caller receives and the session log can persist. @@ -42,7 +42,7 @@ Core dispatch and the tool body sit inside normalization boundaries, so tool, li ### Pre-tool input rewrite is a separate consistency decision -`PreToolDecision` is allow/deny/ask only — **no `arguments` rewrite**. Output replacement is safe because `tool/result` is logged after execution from the final result. Input rewrite is different: `assistant/message` (model history) and `tool/call` (the audit record) are logged before `ToolRegistry.execute()`, while ACP and tool presentation read those arguments. The registry therefore seals the cloned arguments before `tools/pre-execute`; no listener or test shim can mutate them in place. An honest rewrite must update history, audit, presentation, and execution as one unit before that identity is created, which belongs to the separate [pre-tool input-rewrite proposal](../../proposed/feature/2026-06-30-pre-tool-input-rewrite.md) and its loop-side `TODO(pre-tool-input-rewrite)`. +`PreToolDecision` is allow/deny/ask only — **no `arguments` rewrite**. Output replacement is safe because `tool/result` is logged after execution from the final result. Input rewrite is different: `assistant/message` (model history) and `tool/call` (the audit record) are logged before `ToolRegistry.execute()`, while ACP and tool presentation read those arguments. The registry therefore seals the materialized arguments before `tools/pre-execute`; no listener or test shim can mutate them in place. An honest rewrite must update history, audit, presentation, and execution as one unit before that identity is created, which belongs to the separate [pre-tool input-rewrite proposal](../../proposed/feature/2026-06-30-pre-tool-input-rewrite.md) and its loop-side `TODO(pre-tool-input-rewrite)`. ### Boundaries diff --git a/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md b/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md index 6c404a05a9..3eedd92a2d 100644 --- a/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md +++ b/docs/rfc/rejected/architecture/2026-06-11-immutable-public-surfaces.md @@ -1,25 +1,24 @@ # RFC: Deep-readonly public surfaces -Status: rejected — the pervasive `DeepReadonly` type flip was rejected in favor of an always-on `deriveMessages` clone plus dev-mode `Object.freeze` + invariants. The immutability *goal* shipped via that alternative; see [dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md). +Status: rejected — the pervasive `DeepReadonly` type flip is replaced by source-owned runtime immutability in `Session` plus relational development assertions. See [source-owned session immutability and dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md). ## Problem -The session log is append-only by contract, but `session.events` returns `readonly SessionEvent[]` whose *elements* are mutable: a plugin can reach in and rewrite history (`events[0].data.content.push(...)`), silently breaking replay equivalence and the derived-history guarantee. The same applies to derived messages and prompt assemblies passed through waterfalls — mutation is sometimes the intended idiom (waterfall middleware mutates the request) and sometimes corruption (mutating a *logged* event), and the types don't distinguish. +The rejected proposal targeted an ownership hole that a `readonly SessionEvent[]` type alone cannot close: its elements remain mutable at runtime, so a cast or plain JavaScript can rewrite nested history. The implemented design closes that hole in `Session` by materializing and deep-freezing every accepted event and returning frozen array snapshots. In-flight prompt waterfalls remain intentionally transformable, so immutability is an ownership boundary rather than a blanket type rule. ## Proposal -> **Implemented differently — see the Status line and [dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).** The `DeepReadonly` design below was rejected as written (compile-only, high type-noise, castable). What shipped: an always-on deep clone in `deriveMessages` (closing the request/adapter aliasing path) plus a dev-mode `Object.freeze` + invariants plugin. The proposal text is kept for the record. +> **Implemented differently — see the Status line and [source-owned session immutability and dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md).** The `DeepReadonly` design below is rejected as written: it is compile-only, noisy across consumers, and castable. `Session` instead snapshots and deep-freezes accepted events and public log snapshots in every composition; `deriveMessages()` returns detached frozen projections; the development plugin checks cross-record and cross-seam relationships. Make immutability part of the type where mutation is corruption: - `SessionEvent` data becomes `DeepReadonly` on the way OUT of a session (`events`, `session/event` listeners); `append()` keeps taking plain mutable input. A `DeepReadonly` utility type lands in dsh-llm next to the brand/never helpers. - `deriveMessages()` returns deep-readonly messages; the loop clones before handing a mutable request to the `agent/request` waterfall (mutation there is sanctioned — the clone makes the boundary explicit and cheap, once per step). - `PromptAssembly` stays mutable through its waterfall (sanctioned) but the registry's internal section list is cloned per assembly (already true). -- Optionally, dev-mode `Object.freeze` of event data behind [the dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) flag, so sanctioned-mutation violations throw in tests rather than corrupting silently. ## Plan -Introduce `DeepReadonly`, flip the session read paths, fix resulting compile errors in consumers (expected: a handful in tests), add the freeze-in-dev option alongside [the dev-mode invariants](../../implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md) plugin. +Introduce `DeepReadonly`, flip the session read paths, and fix the resulting compile errors in consumers. ## Risks diff --git a/packages/compact/compact-basic/tests/compact-basic.spec.ts b/packages/compact/compact-basic/tests/compact-basic.spec.ts index e3d80cd567..e47ca434e3 100644 --- a/packages/compact/compact-basic/tests/compact-basic.spec.ts +++ b/packages/compact/compact-basic/tests/compact-basic.spec.ts @@ -1700,7 +1700,7 @@ describe('BasicCompactService under the real invariants plugin', () => { async function setup(): Promise<{ ctx: Context; session: Session; svc: BasicCompactService }> { const ctx = new Context() await ctx.plugin(SessionStore) - await ctx.plugin(Invariants, {}) + await ctx.plugin(Invariants) await ctx.plugin(LlmService) ctx.llm.registerAdapter(['test-model'], new ScriptedAdapter('CONDENSED')) await ctx.plugin(BasicCompactService, cfg({ auto: false })) diff --git a/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts b/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts index f2ca3ccdd0..1efb417b48 100644 --- a/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts +++ b/packages/compact/compact-basic/tests/compact-loop-repro.spec.ts @@ -76,7 +76,7 @@ async function harness(toolSteps: number): Promise<{ ctx: Context; compact: Repr const ctx = new Context() await ctx.plugin(LlmService) await ctx.plugin(SessionStore) - await ctx.plugin(Invariants, {}) + await ctx.plugin(Invariants) await ctx.plugin(SystemPrompt) await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts index 7f7882f2b7..aea7927571 100644 --- a/packages/cordis/tool-cordis/src/api-catalog.ts +++ b/packages/cordis/tool-cordis/src/api-catalog.ts @@ -813,7 +813,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'SkillLookupOptions', - declaration: 'export interface SkillLookupOptions {\n cwd?: string | undefined;\n signal?: AbortSignal | undefined;\n}', + declaration: 'export interface SkillLookupOptions {\n readonly cwd?: string | undefined;\n readonly signal?: AbortSignal | undefined;\n}', }, { name: 'SkillProvider', diff --git a/packages/core/agent-loop/README.md b/packages/core/agent-loop/README.md index 217ba0a643..ac1a0e079f 100644 --- a/packages/core/agent-loop/README.md +++ b/packages/core/agent-loop/README.md @@ -8,13 +8,13 @@ This is the only package in the harness that contains concrete loop logic. Every ### Public API -Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. Resume installs an owner-liveness sentinel before persistence load, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`. +Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume installs an owner-liveness sentinel before persistence load, captures each loaded metadata field once, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`. - `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — config-driven create: an agent on a fresh per-run session id `${id}-session-` with optional session metadata. Used for `cordis.yml`-configured agents. The per-run uuid avoids colliding with the on-disk log a prior run materialized once a durable persistence backend is loaded; each run is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber. `AgentLoop` also implements the `AgentFactory` seam and registers itself via `ctx.agents.setFactory(this)`, so plugins create/resume agents through `ctx.agents` (the interface): -- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown. +- `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix after the session boundary validates and detaches each raw value in one pass. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown. - `ctx.agents.resume({ agentId, resumeSessionId, agentOptions?, setup? }): Promise` — load a persisted session via `ctx.sessionPersistence` ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), reconstruct its history, then await setup against a fresh unpublished agent scope before rollback-covered publication. The live session id is the resumed id; turn numbering and derived history continue from the loaded log. Requires a session-persistence backend (NOT hard-injected — non-persistent demos still work; `resume` rejects with a clear error when persistence is absent). Returns an `AgentHandle`. The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle) — only the programmatic factory callers (the ACP bridge and in-process subagent backends) hold a handle and own per-agent teardown. diff --git a/packages/core/agent-loop/src/index.ts b/packages/core/agent-loop/src/index.ts index bd5b7e3188..1e5c122fc5 100644 --- a/packages/core/agent-loop/src/index.ts +++ b/packages/core/agent-loop/src/index.ts @@ -178,20 +178,21 @@ export class AgentLoop extends Service implements AgentFactory { */ async createAgent(options: CreateAgentOptions): Promise { // Snapshot every caller-owned field before the first async setup boundary. - // The callback itself is an identity capability; all data fields are - // detached so caller mutation cannot drift a reserved/published identity or - // the options the accepted agent observes. + // The callback itself is an identity capability. Agent options detach here; + // seed and metadata stay raw only until sessions.prepare() synchronously + // reads, validates, and detaches them, so structuredClone cannot erase an + // exotic prototype before the session boundary sees it. const agentId = options.agentId const sessionId = options.sessionId const setup = options.setup const agentOptions = structuredClone(options.agentOptions ?? {}) - const seed = options.seed === undefined ? undefined : structuredClone(options.seed) - const meta = structuredClone(options.meta ?? {}) + const seed = options.seed + const meta = options.meta const release = this.reserve(agentId, sessionId) try { const session = this.ctx.sessions.prepare(sessionId, { ...seed !== undefined ? { seed } : {}, - meta, + ...meta !== undefined ? { meta } : {}, }) // A seeded (forked) create is still a fresh start, NOT a resume. return await this.startOwned(agentId, agentOptions, session, 'startup', setup) @@ -281,16 +282,23 @@ export class AgentLoop extends Service implements AgentFactory { throw new Error(`agent "${agentId}" resume aborted: owner disposed during persistence load`) }), ]) + // The backend is an async boundary too. Read each loaded header field + // once so a stateful implementation cannot pass a valid presence check + // and then substitute a different value during reconstruction. + const createdAt = meta.createdAt + const cwd = meta.cwd + const parentSession = meta.parentSession + const seedLength = meta.seedLength // An out-of-band direct registry/session insertion can still race this // service's reservation, so the public enter primitives re-check exact // liveness at publication. const session = this.ctx.sessions.prepare(sessionId, { seed: events, meta: { - createdAt: meta.createdAt, - ...meta.cwd !== undefined ? { cwd: meta.cwd } : {}, - ...meta.parentSession !== undefined ? { parentSession: meta.parentSession } : {}, - ...meta.seedLength !== undefined ? { seedLength: meta.seedLength } : {}, + createdAt, + ...cwd !== undefined ? { cwd } : {}, + ...parentSession !== undefined ? { parentSession } : {}, + ...seedLength !== undefined ? { seedLength } : {}, }, }) // Calling startOwned synchronously installs the complete lifecycle diff --git a/packages/core/agent-loop/tests/resume.spec.ts b/packages/core/agent-loop/tests/resume.spec.ts index 2a4ba7e904..8ed557faaf 100644 --- a/packages/core/agent-loop/tests/resume.spec.ts +++ b/packages/core/agent-loop/tests/resume.spec.ts @@ -5,7 +5,7 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import LlmService from '@deepseek-ai/dsh-llm' import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session' -import type { SessionEvent } from '@deepseek-ai/dsh-session' +import type { SessionEvent, SessionHeader } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry from '@deepseek-ai/dsh-tools' import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent' @@ -99,6 +99,22 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => { await ctx.fiber.dispose() }) + it('createAgent sends raw metadata to the session validator before cloning can sanitize it', async () => { + class ExoticMeta { + readonly cwd = '/accepted' + } + const { ctx } = await persistentHarness(new MockAdapter([textResponse('hi')])) + + await expect(ctx.agents.create({ + agentId: AgentId('exotic-meta-agent'), + sessionId: SessionId('exotic-meta-session'), + meta: new ExoticMeta(), + })).rejects.toThrow(/session metadata is not a plain JSON record/) + expect(ctx.agents.get(AgentId('exotic-meta-agent'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('exotic-meta-session'))).toBeUndefined() + await ctx.fiber.dispose() + }) + it('resume of a session with no cwd carries an undefined cwd header', async () => { // Lifecycle 1: create a no-cwd session and run a turn. const adapter1 = new MockAdapter([textResponse('a')]) @@ -411,6 +427,54 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => { await ctx2.fiber.dispose() }) + it('reads each loaded metadata field once before reconstructing a resumed session', async () => { + const sessionId = SessionId('resume-loaded-meta-once') + const root = await persistSession(sessionId) + const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')])) + const loaded = await ctx.sessionPersistence.load(sessionId) + const reads = { createdAt: 0, cwd: 0, parentSession: 0, seedLength: 0 } + const meta = Object.defineProperties({ + version: loaded.meta.version, + id: loaded.meta.id, + }, { + createdAt: { + enumerable: true, + get: () => { reads.createdAt += 1; return reads.createdAt === 1 ? loaded.meta.createdAt : 1n }, + }, + cwd: { + enumerable: true, + get: () => { reads.cwd += 1; return reads.cwd === 1 ? '/loaded' : 'relative' }, + }, + parentSession: { + enumerable: true, + get: () => { reads.parentSession += 1; return reads.parentSession === 1 ? SessionId('parent') : 1n }, + }, + seedLength: { + enumerable: true, + get: () => { reads.seedLength += 1; return reads.seedLength === 1 ? 0 : 1n }, + }, + }) as unknown as SessionHeader + ctx.sessionPersistence.load = () => Promise.resolve({ meta, events: loaded.events }) + + const resumed = await ctx.agents.resume({ + agentId: AgentId('resume-loaded-meta-once'), + resumeSessionId: sessionId, + agentOptions: { model: 'mock' }, + }) + + expect(reads).toEqual({ createdAt: 1, cwd: 1, parentSession: 1, seedLength: 1 }) + expect(resumed.agent.session.header).toEqual({ + version: loaded.meta.version, + id: sessionId, + createdAt: loaded.meta.createdAt, + cwd: '/loaded', + parentSession: 'parent', + seedLength: 0, + }) + await resumed.dispose() + await ctx.fiber.dispose() + }) + it('an idle inject() is flushed durably on its own (survives without explicit flush/dispose)', async () => { // Lifecycle 1: run a turn, then inject context while idle. The idle inject // wraps its context/message in a one-shot turn AND checkpoints it (the turn-enclosure RFC) diff --git a/packages/core/agent-loop/tests/review-fixes.spec.ts b/packages/core/agent-loop/tests/review-fixes.spec.ts index e527099a88..3cfa743b65 100644 --- a/packages/core/agent-loop/tests/review-fixes.spec.ts +++ b/packages/core/agent-loop/tests/review-fixes.spec.ts @@ -605,7 +605,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) return ctx } @@ -1014,7 +1014,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) // Blocking listener on the parent context (survives fiber disposal). @@ -1071,7 +1071,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) const unlisten = ctx.on('system-prompt/assemble', async function (_assembly, _context, next) { @@ -1127,7 +1127,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) ctx.on('agent/pre-step', async () => { @@ -1179,7 +1179,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) ctx.on('agent/pre-step', async () => { @@ -1228,7 +1228,7 @@ describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) await ctx.plugin(AgentLoop, { agents: [] }) - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) ctx.llm.registerAdapter(['mock'], adapter) ctx.on('system-prompt/assemble', async function (_assembly, _context, next) { diff --git a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts index 2bf58be832..6d0bb3107b 100644 --- a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts +++ b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from 'vitest' import { Context } from 'cordis' import LlmService from '@deepseek-ai/dsh-llm' -import SessionStore, { SessionId } from '@deepseek-ai/dsh-session' +import SessionStore, { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry from '@deepseek-ai/dsh-tools' import AgentRegistry, { AgentId, agentEvents, assembleContextFor } from '@deepseek-ai/dsh-agent' @@ -307,6 +307,36 @@ describe('agent scope lifecycle', () => { await retry.dispose() }) + it('rejects an exotic seed before publishing either reserved identity', async () => { + const ctx = await harness() + const published: string[] = [] + ctx.on('session/created', () => { published.push('session') }) + ctx.on('agent/created', () => { published.push('agent') }) + class ExoticData { readonly value = 'not durable JSON' } + const seed = [{ + seq: 0, + type: 'test/exotic-seed', + data: new ExoticData(), + }] as unknown as SessionEvent[] + + await expect(ctx.agents.create({ + agentId: AgentId('exotic-seed'), + sessionId: SessionId('exotic-seed-session'), + agentOptions: { model: 'mock' }, + seed, + })).rejects.toThrow(/seed event at index 0 is not losslessly JSON-serializable/) + + expect(published).toEqual([]) + expect(ctx.agents.get(AgentId('exotic-seed'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('exotic-seed-session'))).toBeUndefined() + const retry = await ctx.agents.create({ + agentId: AgentId('exotic-seed'), + sessionId: SessionId('exotic-seed-session'), + agentOptions: { model: 'mock' }, + }) + await retry.dispose() + }) + it('a throwing session/created listener disposes the scope (pre-nesting rollback window)', async () => { const ctx = await harness() let boom = true diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md index 71e2be279d..23fa073ea1 100644 --- a/packages/core/agent/README.md +++ b/packages/core/agent/README.md @@ -20,7 +20,7 @@ The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh- Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package. - `ctx.agents.setFactory(factory: AgentFactory): () => Promise | void` — register the creation factory (the loop calls this on construction). Throws on a second factory; the slot clears on dispose. -- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata/seed, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Agent/session IDs are reserved across setup; setup rejection or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; an agent whose announcement began emits `agent/disposed` during that rollback. Rejects if no factory is registered. +- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata and hand the one-read raw seed synchronously to the session boundary for one-pass lossless-JSON materialization, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Agent/session IDs are reserved across setup; seed rejection, setup rejection, or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; an agent whose announcement began emits `agent/disposed` during that rollback. Rejects if no factory is registered. - `ctx.agents.resume(options: ResumeAgentOptions): Promise` — snapshot caller-owned IDs/options, load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh agent scope, await optional setup while unpublished, then follow the same insert → announce → session-start → loop-start boundary. The IDs are reserved across persistence load and setup; load/setup rejection or owner unload publishes nothing. Rejects if no factory is registered or session persistence is unconfigured. `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **capability** — only the holder can tear this agent down. `dispose()` stops the loop, `await`s its exit plus every outstanding idle-injection flush (quiescence — NOT just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent` — the handle is only for the OWNER that created it. The ACP bridge and in-process subagent backends are production consumers; config-created agents are owned by the loop fiber and never need a handle. diff --git a/packages/core/agent/src/index.ts b/packages/core/agent/src/index.ts index c73de89e6d..959ca4784c 100644 --- a/packages/core/agent/src/index.ts +++ b/packages/core/agent/src/index.ts @@ -48,7 +48,10 @@ export interface CreateAgentOptions { * `cwd`/`parentSession`/`seedLength` fields of * {@link CreateSessionOptions.meta} in dsh-session (the internal-only * `createdAt`, used when reconstructing a persisted session, is deliberately - * excluded — a factory caller never sets it). + * excluded — a factory caller never sets it). The factory reads this raw + * reference once and hands it synchronously to the session boundary, which + * rejects an exotic shell and captures each accepted field once before any + * asynchronous setup. */ meta?: { cwd?: string; parentSession?: SessionId; seedLength?: number } /** @@ -57,9 +60,11 @@ export interface CreateAgentOptions { * prefix so `deriveMessages()`/`lastTurnNumber` continue from it — used by the * in-process FORK subagent backend to seed a child with a balanced * completed-turn prefix of the parent's log. The prefix MUST be contiguous - * from seq 0 and balanced (no open turn/step, no dangling tool-call), or the - * session constructor (and the dev-mode invariants replay) reject it. Absent - * for a fresh (spawn) child. + * from seq 0, carry only lossless-JSON data, and be balanced (no open + * turn/step, no dangling tool-call), or the session constructor (and the + * dev-mode invariants replay) reject it. The factory passes the raw seed to + * the synchronous one-pass validator/copier; it never pre-clones and thereby + * sanitizes exotic prototypes. Absent for a fresh (spawn) child. */ seed?: SessionEvent[] /** Per-agent options (model, …). */ diff --git a/packages/core/scope/README.md b/packages/core/scope/README.md index e57f475816..f779dab57e 100644 --- a/packages/core/scope/README.md +++ b/packages/core/scope/README.md @@ -12,7 +12,7 @@ Scoped-context registration primitive. `createScope(ctx, key)` mints a Cordis co - `scopeTarget(base: T, key?: ScopeKey): Scoped` Build the dispatch `thisArg` for a scope-filtered event: composes `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics). - `Scoped` The compile-time carrier brand: scope-filtered events demand it as their `this` type, so dispatching with a bare subject is a compile error. - `isScopeCarrier(value)` / `carrierKeyOf(value)` Runtime carrier marks, used by the dev invariants to assert every scope-filtered dispatch carries a carrier keyed to the subject its arguments name. -- `scopeHost(ctx, services)` Test/tooling host whose shared `dispose()` waits for both the host fiber and every minted scope, including a child already tearing down through `rawDispose`. +- `scopeHost(ctx, services)` Test/tooling host that snapshots the requested service list before activation, fails loud with stable missing-service diagnostics, and whose shared `dispose()` waits for both the host fiber and every minted scope, including a child already tearing down through `rawDispose`. ## Design contract diff --git a/packages/core/scope/src/index.ts b/packages/core/scope/src/index.ts index 7a7032b0b6..276b406dcd 100644 --- a/packages/core/scope/src/index.ts +++ b/packages/core/scope/src/index.ts @@ -320,6 +320,8 @@ export interface ScopeHost { * can never be satisfied RESOLVES its fiber await without ever running the * callback — a silent no-op host. This helper fails LOUD instead: when the * callback did not run, it names the absent services and disposes the host. + * The service list is copied before plugin activation so caller mutation + * across the await cannot change dependency resolution or diagnostics. * @param ctx - the context to mount the host under. * @param services - the service names scopes minted through this host reach * (the host plugin's `inject` list). @@ -328,16 +330,20 @@ export interface ScopeHost { * Cordis dead end. */ export async function scopeHost(ctx: Context, services: string[]): Promise { + // The inject list crosses an await before missing-service diagnostics run. + // Detach it now so caller mutation cannot change either Cordis dependency + // resolution or the names reported by this helper. + const requiredServices = [...services] let hostCtx: Context | undefined // A named function statement (not Object.assign({name}) — Function.name is // read-only) so diagnostics read `scopeHost`. function scopeHostPlugin(inner: Context): void { hostCtx = inner } - const fiber = ctx.plugin(Object.assign(scopeHostPlugin, { inject: services })) + const fiber = ctx.plugin(Object.assign(scopeHostPlugin, { inject: requiredServices })) await fiber if (hostCtx === undefined) { // Dependency-pending: cordis resolves the await without running the // callback. Name the absentees and unwind the pending fiber. - const missing = services.filter(name => ctx.get(name) === undefined) + const missing = requiredServices.filter(name => ctx.get(name) === undefined) await fiber.dispose() /* v8 ignore next -- the '(unknown)' fallback is defensive: a pending * fiber with zero absent services cannot occur (an all-present inject diff --git a/packages/core/scope/tests/scope.spec.ts b/packages/core/scope/tests/scope.spec.ts index 44b9cf4442..e572584fb1 100644 --- a/packages/core/scope/tests/scope.spec.ts +++ b/packages/core/scope/tests/scope.spec.ts @@ -367,6 +367,16 @@ describe('scopeHost', () => { .rejects.toThrow('scopeHost: services "tools", "systemPrompt" not available') }) + it('snapshots missing-service diagnostics across the host activation await', async () => { + const ctx = new Context() + const services = ['tools', 'systemPrompt'] + const pending = scopeHost(ctx, services) + services.splice(0) + + await expect(pending) + .rejects.toThrow('scopeHost: services "tools", "systemPrompt" not available') + }) + it('names a single absent service in the singular', async () => { const ctx = new Context() await expect(scopeHost(ctx, ['tools'])).rejects.toThrow('scopeHost: service "tools" not available') diff --git a/packages/core/session/README.md b/packages/core/session/README.md index 094c3073df..36052d9e7a 100644 --- a/packages/core/session/README.md +++ b/packages/core/session/README.md @@ -8,7 +8,7 @@ Creates and holds event-sourced `Session` instances. Persistence is intentionall ### Public API -- `ctx.sessions.create(id?: SessionId, options?: { seed?: SessionEvent[]; meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number } }): Session` — Create a session. `options.seed` replays/forks an existing event log; `options.meta` attaches creation metadata (validated absolute `cwd`, `parentSession` lineage, seed boundary) as the immutable `SessionHeader`. The store fills `version`/`id` and defaults `createdAt` to now; a caller reconstructing a persisted session passes the original `createdAt` and persisted `seedLength` to preserve them. Disposed with the calling fiber. +- `ctx.sessions.create(id?: SessionId, options?: { seed?: SessionEvent[]; meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number } }): Session` — Create a session. `options.seed` replays/forks an existing event log: the constructor reads each array entry once, then recursively validates and copies every nested value in one pass so validation and storage cannot observe different getter results or erase an exotic prototype before checking it. `options.meta` attaches creation metadata (validated absolute `cwd`, `parentSession` lineage, seed boundary) as the immutable `SessionHeader`: the store rejects an exotic metadata shell, reads every accepted field once, and constructs a detached, deep-frozen header. The store fills `version`/`id` and defaults `createdAt` to now; a caller reconstructing a persisted session passes the original `createdAt` and persisted `seedLength` to preserve them. Disposed with the calling fiber. - `ctx.sessions.flush(session: Session): Promise` Dispatch the awaited `session/flush` durability checkpoint with the carrier captured at enter — THE flush entry point (the loop's turn-end checkpoint and idle injection call it; never dispatch a raw `ctx.parallel`). Rejects a prepared, detached, or stale same-id object instead of inventing a subject-less carrier. - `ctx.sessions.fork(source, boundary?, childSessionId?): Session` — Resolve a live session object or id, select a seed through the inclusive `boundary` event seq (default: current last event), require that boundary to be `turn/end`, and create a live child session with lineage metadata. - `ctx.sessions.get(id: SessionId): Session | undefined` @@ -18,7 +18,7 @@ Creates and holds event-sourced `Session` instances. Persistence is intentionall `create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before `onAppend` detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: -- `ctx.sessions.prepare(id?, options?): Session` — validate the id/cwd and construct the `Session`, WITHOUT entering it into the store. Same options as `create`. +- `ctx.sessions.prepare(id?, options?): Session` — read `options.seed`/`options.meta` once, validate and detach the metadata/header, and construct the `Session` WITHOUT entering it into the store. Same options as `create`. - `ctx.sessions.enter(session): () => void` — wire `onAppend` → `session/event`, capture its scope carrier, and add the session to the store; returns the idempotent DETACH disposer, which clears both notification and carrier state. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved; a stale prepared object must not overwrite a live same-id session. - `ctx.sessions.announce(session): void` — emit `session/created` for an entered session. @@ -32,12 +32,17 @@ The store announces creation, publishes each append, and provides an awaited dur Plain class (not a Cordis Service). Create via `ctx.sessions.create()`. -- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. **Throws** if `data` is not losslessly JSON-serializable (BigInt, function, symbol, undefined, non-finite number, circular ref, or an exotic object like Map/Set/Date) — the event log is the durable source of truth, so this invariant is enforced at the source (exported as `isJsonValue` for backends to reuse on their replay/fork entry points). A third parameter `opts: SurfaceIntent` carries surface metadata: `surfaceOp` controls how the event enters the surface linked list, and `sourceEventSeqs` records provenance (the seq numbers of events this one derives from). It is **required** for the five `SurfaceEventType` events (every message-producing event must declare how it joins the surface) and rejected by the compiler for non-surface types. The marker requirement is enforced two ways: the typed overload makes `opts` mandatory when `type` is a specific `SurfaceEventType` literal, AND `append` **throws** at runtime if a surface-eligible event arrives with no `surfaceOp` — covering the case where `type` widens to the `SessionEventType` union (a caller iterating raw events, where the conditional overload collapses to optional) so a marker-less message event can never silently land in the log and vanish from `deriveMessages()`. +- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. **Throws** if `data` or surface metadata is not losslessly JSON-serializable (BigInt, function, symbol, undefined, `-0`, non-finite number, circular ref, or an exotic object like Map/Set/Date/class instance). One recursive validate-and-copy pass reads each nested value exactly once and produces the detached value that enters the log, so validation and durability cannot diverge through a stateful getter or a prototype-erasing clone. The accepted event and every nested value are deep-frozen before publication; the returned event and observer notification share that immutable owned record. A third parameter `opts: SurfaceIntent` carries surface metadata: `surfaceOp` and `sourceEventSeqs` are each read once, then the former controls how the event enters the surface linked list and the latter records provenance. Runtime validation accepts only `'append'` or the exact `{ op: 'replace', start, end }` record with non-negative safe-integer bounds, and provenance must be an array of non-negative safe integers; non-surface events reject either field. The marker is **required** for the five `SurfaceEventType` events (every message-producing event must declare how it joins the surface) and rejected by the compiler for non-surface types. The contract is enforced two ways: the typed overload handles a specific event literal, AND runtime checks cover widened unions and raw seed/load logs so invalid metadata can never silently enter or disappear from `deriveMessages()`. - `session.deriveMessages(): Message[]` — the LLM message history, CACHED: each surface node is projected exactly once, when first seen (O(new nodes) per call; a surface rewrite rebuilds via `surface.replaceGeneration`). Returns a fresh array snapshot per call over SHARED, deep-frozen `Message` objects — cloned once off the log at projection time, so a consumer can never mutate logged data (mutation throws). The surface is the single source of derived history — there is no raw-log fallback. - `session.deriveEventMessage(event): Message | null` — the per-event projection `deriveMessages()` folds: one event's derived message (an unfrozen clone), or `null` when it produces none (a non-surface event, or an empty-content `assistant/message` hosting only usage). External reconstructors and the dev invariant fold the same function over a log prefix's surface, so no two paths can disagree about what a request's messages were (the reconstructability RFC). - `session.surface: SurfaceManager` — the derived surface, lazily rebuilt from `surfaceOp` markers in the log. Processes only new events (delta) on each access — the log is append-only, so prior events never change. `surface.replaceGeneration` is the rewrite signal: bumped by every folded `replace` and by `invalidate()`, never reset, so an incremental consumer comparing generations cannot be fooled. -- `session.events`, `session.seq`, `session.id` -- `session.header: SessionHeader` — immutable creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`). Kept out of the event log (a storage concern, not replayable state); a minimal header (stamped with the current `SESSION_FORMAT_VERSION`) is synthesized for bare `Session` construction. +- `session.events` — a cached, frozen array snapshot over deep-frozen events. Repeated reads without an append return the same array; an append invalidates the cache and the next read returns a new snapshot, while earlier snapshots stay unchanged. Neither a cast nor a retained reference can push into the live log or rewrite an accepted event. +- `session.seq`, `session.id` +- `session.header: SessionHeader` — detached, deep-frozen creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`). Construction validates its lossless-JSON shape and requires the header id to match `session.id`, so a caller cannot later mutate persistence routing or lineage through an aliased header. Kept out of the event log (a storage concern, not replayable state); a minimal header (stamped with the current `SESSION_FORMAT_VERSION`) is synthesized for bare `Session` construction. + +### Lossless JSON utilities + +Durable values need one accepted representation, not a check followed by a second read. `isJsonValue(value)` is the boolean predicate; `snapshotJsonValue(value)` recursively validates and copies a plain value in one pass, returning `undefined` for invalid input and propagating a throwing getter. The snapshot helper accepts finite JSON numbers except `-0` (JSON rewrites it to `0`), dense ordinary arrays, and plain or null-prototype objects; it rejects cycles, unsupported scalars, and exotic prototypes before normalization. ### Surface types @@ -65,12 +70,12 @@ Every `SessionEvent` carries two optional top-level fields (structural metadata) ### Metadata types (`types.ts`) -- `SessionHeader` — immutable session metadata, written once: `{ version, id, createdAt, cwd?, parentSession?, seedLength? }`. Owned here (beside `SessionId`) because `Session.header` is typed by it; persistence backends re-export it rather than own it (which would force a package cycle). +- `SessionHeader` — session metadata written once when published as `Session.header`, where detachment and deep-freezing enforce immutability at runtime: `{ version, id, createdAt, cwd?, parentSession?, seedLength? }`. Persistence loaders may return mutable detached copies of the same data type. Owned here (beside `SessionId`) because `Session.header` is typed by it; persistence backends re-export it rather than own it (which would force a package cycle). ### Extension points - Persistence plugins: subscribe to `session/event` (write-behind) and drain on `session/flush` (awaited) and fiber dispose. A durable backend reads the log and reloads it into a live session; the metadata seam (`SessionHeader`, `session.header`) is what such a backend stores beside the log. -- Replay/fork: `ctx.sessions.create(id, { seed })` seeds a new session with an existing event log. The surface rebuilds deterministically from `surfaceOp` markers in the seeded events. The seed is validated to the SAME always-on invariants `append` enforces — contiguous seqs, JSON-serializable data, and required `surfaceOp` markers on surface-eligible events — so marker-less message events are rejected at construction rather than silently vanishing from `deriveMessages()`. Broader turn-enclosure checks stay in `dsh-invariants` and persistence repair. Ordinary live-session forks use `ctx.sessions.fork(source, boundary?, childSessionId?)`, where `boundary` is the inclusive source event seq to fork through. +- Replay/fork: `ctx.sessions.create(id, { seed })` seeds a new session with an existing event log. The surface rebuilds deterministically from `surfaceOp` markers in the seeded events. The constructor reads each seed entry once and uses the same one-pass lossless-JSON snapshot and exact surface-metadata shape checks as `append`, then enforces contiguous seqs and deep-freezes every accepted record; a stateful caller, exotic nested value, marker-less or malformed surface event, metadata on a non-surface event, or retained seed reference therefore cannot silently change the reconstructed history. Broader turn-enclosure checks stay in `dsh-invariants` and persistence repair. Ordinary live-session forks use `ctx.sessions.fork(source, boundary?, childSessionId?)`, where `boundary` is the inclusive source event seq to fork through. - Compaction: the `dsh-compact-basic` plugin appends a `user/message` with `surfaceOp: { op: 'replace', start, end }` to shadow old surface nodes behind a summary checkpoint. ### What is NOT here (TODO) diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts index d3f4ca4890..51500e9e1b 100644 --- a/packages/core/session/src/index.ts +++ b/packages/core/session/src/index.ts @@ -14,12 +14,12 @@ import type { Scoped } from '@deepseek-ai/dsh-scope' import type { ContentBlock, Message, MessageSource } from '@deepseek-ai/dsh-llm' import { SESSION_FORMAT_VERSION, SessionId } from './types.ts' import type { CreateSessionOptions, EpochHeader, SessionEvent, SessionEventMap, SessionEventType, SessionHeader, SurfaceIntent, SurfaceEventType } from './types.ts' -import { isJsonValue } from './json.ts' +import { snapshotJsonValue } from './json.ts' import { SurfaceManager, isSurfaceEligibleType } from './surface.ts' import { foldRequestHeader } from './request-header.ts' export * from './types.ts' -export { isJsonValue } from './json.ts' +export { isJsonValue, snapshotJsonValue } from './json.ts' export type { JsonValue } from './json.ts' export { interruptedTurnClosers } from './repair.ts' export type { SurfaceNode } from './surface.ts' @@ -99,6 +99,160 @@ function renderTagged(tag: string, content: ContentBlock[], source: MessageSourc ] } +/** Reject a record shell that cloning or spreading would otherwise sanitize. */ +function assertPlainRecord(value: unknown, label: string): asserts value is Record { + if (value === null || typeof value !== 'object') { + throw new Error(`${label} is not a plain JSON record`) + } + const prototype = Object.getPrototypeOf(value) as unknown + if (prototype !== Object.prototype && prototype !== null) { + throw new Error(`${label} is not a plain JSON record`) + } +} + +/** Capture and validate the caller-owned fields that become a session header. */ +function snapshotSessionMeta(source: CreateSessionOptions['meta']): NonNullable { + if (source === undefined) return {} + assertPlainRecord(source, 'session metadata') + + // Read each accepted field exactly once. The metadata vocabulary is scalar, + // so this plain record is already detached from the caller; cloning the + // caller's shell first would erase a class prototype before validation. + const cwd = source.cwd + const parentSession = source.parentSession + const createdAt = source.createdAt + const seedLength = source.seedLength + const accepted = { + ...cwd !== undefined ? { cwd } : {}, + ...parentSession !== undefined ? { parentSession } : {}, + ...createdAt !== undefined ? { createdAt } : {}, + ...seedLength !== undefined ? { seedLength } : {}, + } + const snapshot = snapshotJsonValue(accepted) + if (snapshot === undefined) throw new Error('session metadata is not losslessly JSON-serializable') + if (snapshot.cwd !== undefined) { + if (typeof snapshot.cwd !== 'string') throw new Error('session cwd must be a string') + if (!isAbsolute(snapshot.cwd)) { + throw new Error(`session cwd must be an absolute path, got "${snapshot.cwd}"`) + } + } + if (snapshot.parentSession !== undefined && typeof snapshot.parentSession !== 'string') { + throw new Error('session parentSession must be a string') + } + if (snapshot.createdAt !== undefined + && (typeof snapshot.createdAt !== 'number' || !Number.isFinite(snapshot.createdAt))) { + throw new Error('session createdAt must be a finite number') + } + if (snapshot.seedLength !== undefined + && (typeof snapshot.seedLength !== 'number' || !Number.isSafeInteger(snapshot.seedLength) || snapshot.seedLength < 0)) { + throw new Error('session seedLength must be a non-negative safe integer') + } + return snapshot +} + +/** Detach, validate, and freeze the creation metadata published by a session. */ +function snapshotSessionHeader(id: SessionId, source?: SessionHeader): SessionHeader { + const input: SessionHeader = source === undefined + ? { version: SESSION_FORMAT_VERSION, id, createdAt: Date.now() } + : source + assertPlainRecord(input, 'session header') + + // Capture each property once before validation. A stateful accessor therefore + // cannot present one identity or storage location to a check and publish a + // different one afterward. + const version = input.version + const headerId = input.id + const createdAt = input.createdAt + const cwd = input.cwd + const parentSession = input.parentSession + const seedLength = input.seedLength + const accepted = { + version, + id: headerId, + createdAt, + ...cwd !== undefined ? { cwd } : {}, + ...parentSession !== undefined ? { parentSession } : {}, + ...seedLength !== undefined ? { seedLength } : {}, + } + const snapshot = snapshotJsonValue(accepted) + if (snapshot === undefined) throw new Error('session header is not losslessly JSON-serializable') + if (snapshot.version !== SESSION_FORMAT_VERSION) { + throw new Error(`session header version must be ${SESSION_FORMAT_VERSION}, got ${String(snapshot.version)}`) + } + if (snapshot.id !== id) { + throw new Error(`session header id "${String(snapshot.id)}" does not match session id "${id}"`) + } + if (typeof snapshot.createdAt !== 'number' || !Number.isFinite(snapshot.createdAt)) { + throw new Error('session header createdAt must be a finite number') + } + if (snapshot.cwd !== undefined) { + if (typeof snapshot.cwd !== 'string') throw new Error('session header cwd must be a string') + if (!isAbsolute(snapshot.cwd)) { + throw new Error(`session header cwd must be an absolute path, got "${snapshot.cwd}"`) + } + } + if (snapshot.parentSession !== undefined && typeof snapshot.parentSession !== 'string') { + throw new Error('session header parentSession must be a string') + } + if (snapshot.seedLength !== undefined + && (typeof snapshot.seedLength !== 'number' || !Number.isSafeInteger(snapshot.seedLength) || snapshot.seedLength < 0)) { + throw new Error('session header seedLength must be a non-negative safe integer') + } + return deepFreeze(snapshot) +} + +/** Validate the runtime shape of surface metadata after its JSON snapshot. */ +function assertSurfaceMetadataShape( + type: string, + surfaceOp: unknown, + sourceEventSeqs: unknown, +): void { + const eligible = isSurfaceEligibleType(type) + if (!eligible) { + if (surfaceOp !== undefined || sourceEventSeqs !== undefined) { + throw new Error(`session event "${type}" is not surface-eligible and cannot carry surface metadata`) + } + return + } + if (surfaceOp === undefined) { + throw new Error(`session event "${type}" is surface-eligible and requires a surfaceOp marker`) + } + if (surfaceOp !== 'append') { + if (surfaceOp === null || typeof surfaceOp !== 'object' || Array.isArray(surfaceOp)) { + throw new Error(`session event "${type}" carries an invalid surfaceOp`) + } + const op = surfaceOp as Record + const keys = Object.keys(op) + if (keys.length !== 3 || !Object.hasOwn(op, 'op') || !Object.hasOwn(op, 'start') || !Object.hasOwn(op, 'end') + || op['op'] !== 'replace' + || typeof op['start'] !== 'number' || !Number.isSafeInteger(op['start']) || op['start'] < 0 + || typeof op['end'] !== 'number' || !Number.isSafeInteger(op['end']) || op['end'] < 0) { + throw new Error(`session event "${type}" carries an invalid replace surfaceOp`) + } + } + if (sourceEventSeqs !== undefined) { + if (!Array.isArray(sourceEventSeqs) + || sourceEventSeqs.some(seq => typeof seq !== 'number' || !Number.isSafeInteger(seq) || seq < 0)) { + throw new Error(`session event "${type}" sourceEventSeqs must contain non-negative safe integers`) + } + } +} + +/** Validate the fixed event envelope after one-pass JSON materialization. */ +function assertSessionEventEnvelope(value: Record, index: number): asserts value is SessionEvent { + const event = value + const allowed = new Set(['type', 'seq', 'time', 'data', 'surfaceOp', 'sourceEventSeqs']) + if (Object.keys(event).some(key => !allowed.has(key)) + || !Object.hasOwn(event, 'type') || typeof event['type'] !== 'string' + || !Object.hasOwn(event, 'seq') || typeof event['seq'] !== 'number' + || !Number.isSafeInteger(event['seq']) || event['seq'] < 0 + || !Object.hasOwn(event, 'time') || typeof event['time'] !== 'number' + || !Number.isSafeInteger(event['time']) || event['time'] < 0 + || !Object.hasOwn(event, 'data')) { + throw new Error(`seed event at index ${index} has an invalid event envelope`) + } +} + /** * An event-sourced session: an append-only log of {@link SessionEvent}s. * @@ -126,10 +280,10 @@ export class Session { } /** - * Immutable creation metadata (format version, cwd, lineage, seed boundary). - * Supplied by the store via `ctx.sessions.create()`. When a `Session` is - * constructed bare (tests, ad-hoc replay), a minimal header is synthesized - * (stamped with the current {@link SESSION_FORMAT_VERSION}) so + * Detached, deep-frozen creation metadata (format version, cwd, lineage, + * seed boundary). Supplied by the store via `ctx.sessions.create()`. When a + * `Session` is constructed bare (tests, ad-hoc replay), a minimal header is + * synthesized (stamped with the current {@link SESSION_FORMAT_VERSION}) so * `session.header` is always present. Kept out of the event log — it is a * storage concern, not replayable conversation state. */ @@ -144,12 +298,27 @@ export class Session { // `seq = log.length` contract the whole system relies on). Without this, // a bad seed would surface only later as a backend rejection or a silent // divergence between the live log and disk. - seed.forEach((event, index) => { - if (event.seq !== index) { - throw new Error(`seed event at index ${index} has seq ${event.seq} (expected ${index}); seed must be contiguous from 0`) + this.log = Array.from(seed, (source, index) => { + // Spreading would erase a class instance's prototype. Reject an exotic + // event shell before that normalization can turn it into an apparently + // valid plain record; field values are still captured by the one spread + // below, so their accessors are not read twice. + assertPlainRecord(source, `seed event at index ${index}`) + // Read every enumerable event field once. Validation and snapshot + // construction must consume this same captured record: a stateful seed + // index or event getter cannot present one record to the checks and + // another to the durable log. + const event = { ...source } + // Materialize the complete accepted record in one recursive pass. A + // validate-then-structuredClone sequence would reread nested getters and + // could sanitize a class instance returned only to the clone. + const snapshot = snapshotJsonValue(event) + if (snapshot === undefined) { + throw new Error(`seed event at index ${index} is not losslessly JSON-serializable`) } - if (!isJsonValue(event.data)) { - throw new Error(`seed event "${event.type}" (seq ${event.seq}) carries non-JSON-serializable data`) + assertSessionEventEnvelope(snapshot, index) + if (snapshot.seq !== index) { + throw new Error(`seed event at index ${index} has seq ${snapshot.seq} (expected ${index}); seed must be contiguous from 0`) } // Surface-eligible events MUST carry a surfaceOp marker — the surface is // the sole source of derived history, so a marker-less message event @@ -157,30 +326,30 @@ export class Session { // this at compile time via its typed overload; a seed arrives as raw // SessionEvent[] (replay/fork/load), bypassing that, so re-check at // runtime here rather than silently resuming with empty history. - if (isSurfaceEligibleType(event.type) - && (event as SessionEvent).surfaceOp === undefined) { - throw new Error(`seed event "${event.type}" (seq ${event.seq}) is surface-eligible but carries no surfaceOp marker`) + const structural = snapshot as SessionEvent & { surfaceOp?: unknown; sourceEventSeqs?: unknown } + try { + assertSurfaceMetadataShape(snapshot.type, structural.surfaceOp, structural.sourceEventSeqs) + } catch (error: unknown) { + throw new Error(`invalid seed event at index ${index}: ${error instanceof Error ? error.message : 'invalid surface metadata'}`) } + return deepFreeze(snapshot) }) - // Deep-clone each seed event, NOT just the array: the seed events and - // their `data` are still owned by the caller (or the source session of a - // fork), so keeping the references would let a post-create mutation of the - // original rewrite this session's durable log — or reintroduce a - // non-JSON-serializable value AFTER the validation above. Snapshotting at - // the boundary makes `session.events` independent and keeps it equal to - // what was validated. Serializability is guaranteed by the check above, so - // structuredClone can never hit a non-cloneable value here. - this.log = seed.map(event => structuredClone(event)) } - this.header = header ?? { version: SESSION_FORMAT_VERSION, id, createdAt: Date.now() } + this.header = snapshotSessionHeader(id, header) } + /** Cached immutable public snapshot of the private append-only log. */ + private eventsSnapshot: readonly SessionEvent[] | undefined + /** - * The append-only event log, exposed live by reference (readonly-typed, not - * a snapshot): later appends are visible through the same array. + * An immutable snapshot of the append-only event log. The snapshot is reused + * until the next append; a previously returned array does not grow later. + * Events and their nested data are deep-frozen at acceptance, so neither a + * cast nor ordinary JavaScript can rewrite durable history. */ get events(): readonly SessionEvent[] { - return this.log + this.eventsSnapshot ??= Object.freeze([...this.log]) + return this.eventsSnapshot } /** The next event's sequence number — always the log length (the `seq = log.length` contiguity contract). */ @@ -205,23 +374,27 @@ export class Session { * @returns the logged event — its assigned `seq`/`time` plus the SNAPSHOT of * `data` that entered the log, so reading `event.data` back sees the logged * value, never the caller's still-mutable input. - * @throws if `data` is not losslessly JSON-serializable (BigInt, function, - * symbol, undefined, non-finite number, circular ref, or an exotic object - * like Map/Set/Date). The event log is the durable source of truth, so this - * invariant is enforced at the source — a bad event never enters the log, - * keeping `session.events` always equal to what a backend can persist. The - * throw surfaces at the buggy caller's append site, not asynchronously in a - * backend flush. + * @throws if `type` is not a string, or if `data` or surface metadata is not + * losslessly JSON-serializable + * (BigInt, function, symbol, undefined, negative zero, non-finite number, + * circular reference, sparse array, or an exotic object such as + * Map/Set/Date/class instance). One recursive pass reads, validates, and + * copies each nested value once, so a stateful getter cannot supply one value + * to validation and another to storage. The event log is the durable source + * of truth, so a bad event fails at the append site rather than later during + * a backend flush. */ append( type: T, data: SessionEventMap[T], ...opts: T extends SurfaceEventType ? [opts: SurfaceIntent] : [] ): SessionEvent { - if (!isJsonValue(data)) { - throw new Error(`session event "${type}" carries non-JSON-serializable data`) + if (typeof type !== 'string') { + throw new TypeError('session event type must be a string') } const surfaceOpts: SurfaceIntent | undefined = opts[0] + const sourceEventSeqs = surfaceOpts?.sourceEventSeqs + const surfaceOp = surfaceOpts?.surfaceOp // Surface-eligible events MUST carry a surfaceOp marker — the surface is the // sole source of derived history, so a marker-less message event would be // logged yet vanish from deriveMessages(). The typed `opts` overload makes @@ -230,41 +403,49 @@ export class Session { // events: `for (const e of log) append(e.type, e.data)`), the conditional // rest collapses to optional and the compiler stops enforcing it. Re-check // at runtime so that loophole can't silently drop history. - if (isSurfaceEligibleType(type) && surfaceOpts?.surfaceOp === undefined) { - throw new Error(`session event "${type}" is surface-eligible and requires a surfaceOp marker`) + const surfaceMetadata = { + ...sourceEventSeqs !== undefined ? { sourceEventSeqs } : {}, + ...surfaceOp !== undefined ? { surfaceOp } : {}, } - // Snapshot `data` into the log, NOT the caller's reference: the validation - // above proves it is JSON-serializable AT THIS MOMENT, but the caller still - // owns the object and could mutate it afterwards (before a persistence - // flush, or permanently in the in-memory history) — making `session.events` - // diverge from the value that passed validation, or reintroducing a - // non-serializable value. Cloning here keeps the log equal to what was - // validated. structuredClone is safe because serializability was just - // checked. The returned event carries the SAME snapshot, so a caller reading - // back `event.data` sees the logged value, not its own mutable input. + // The caller still owns the data and metadata objects and could mutate them + // after append. Materialize each accepted value exactly once while checking + // its JSON vocabulary, so the log cannot drift and a stateful getter cannot + // show one value to validation and another to a prototype-erasing clone. The + // returned event carries these SAME snapshots. // - // Surface metadata is snapshot separately: sourceEventSeqs (number[] — - // primitives, so array spread is a complete copy) and surfaceOp (a string - // primitive, or cloned if it's a replace object). + // Surface metadata accessors are read once into one plain record; the + // recursive snapshot then reads each nested value once as it copies it. // Build the event shape with conditional surface fields via spreading. // The result is cast through `unknown` because the conditional spreads // produce an intersection type that the assignability checker can't // narrow to a specific discriminated-union member when T is generic. - // This is a safe internal boundary: data was validated above, and - // surface metadata was snapshot from primitive/clone-safe values. + // This is a safe internal boundary: data and surface metadata are + // materialized below before the event enters the log. + const dataSnapshot = snapshotJsonValue(data) + if (dataSnapshot === undefined) { + throw new Error(`session event "${type}" carries non-JSON-serializable data`) + } + const surfaceMetadataSnapshot = snapshotJsonValue(surfaceMetadata) + if (surfaceMetadataSnapshot === undefined) { + throw new Error(`session event "${type}" carries non-JSON-serializable surface metadata`) + } + assertSurfaceMetadataShape( + type, + (surfaceMetadataSnapshot as { surfaceOp?: unknown }).surfaceOp, + (surfaceMetadataSnapshot as { sourceEventSeqs?: unknown }).sourceEventSeqs, + ) const event = { type, seq: this.log.length, time: Date.now(), - data: structuredClone(data), - ...surfaceOpts?.sourceEventSeqs !== undefined ? { sourceEventSeqs: [...surfaceOpts.sourceEventSeqs] } : {}, - ...surfaceOpts?.surfaceOp !== undefined ? { - surfaceOp: typeof surfaceOpts.surfaceOp === 'string' ? surfaceOpts.surfaceOp : structuredClone(surfaceOpts.surfaceOp), - } : {}, + data: dataSnapshot, + ...surfaceMetadataSnapshot, } as unknown as SessionEvent - this.log.push(event as unknown as SessionEvent) - this.onAppend?.(event as unknown as SessionEvent) - return event + const acceptedEvent = deepFreeze(event) + this.log.push(acceptedEvent as unknown as SessionEvent) + this.eventsSnapshot = undefined + this.onAppend?.(acceptedEvent as unknown as SessionEvent) + return acceptedEvent } /** Cached fold of the request-header events — see {@link requestHeader}. */ @@ -457,7 +638,8 @@ export class SessionStore extends Service { * @param id - the session id; omitted, the store mints `session-`. * @param options - seed events and/or creation metadata for the header. * @returns the live session, already entered and announced. - * @throws if a session with `id` already exists, or if `meta.cwd` is a + * @throws if a session with `id` already exists, metadata is not a plain + * lossless-JSON record with valid scalar fields, or `meta.cwd` is a * non-absolute path (storage backends key directories off it). */ create(id?: SessionId, options?: CreateSessionOptions): Session { @@ -485,25 +667,27 @@ export class SessionStore extends Service { * @param id - the session id; omitted, the store mints `session-`. * @param options - seed events and/or creation metadata for the header. * @returns the constructed session, NOT yet in the store. - * @throws if a session with `id` already exists, or if `meta.cwd` is a + * @throws if a session with `id` already exists, metadata is not a plain + * lossless-JSON record with valid scalar fields, or `meta.cwd` is a * non-absolute path. */ prepare(id?: SessionId, options?: CreateSessionOptions): Session { const sessionId = SessionId(id ?? `session-${++this.counter}`) if (this.store.has(sessionId)) throw new Error(`session "${sessionId}" already exists`) - const cwd = options?.meta?.cwd - if (cwd !== undefined && !isAbsolute(cwd)) { - throw new Error(`session cwd must be an absolute path, got "${cwd}"`) - } + const seed = options?.seed + const meta = snapshotSessionMeta(options?.meta) + const cwd = meta.cwd + const parentSession = meta.parentSession + const seedLength = meta.seedLength const header: SessionHeader = { version: SESSION_FORMAT_VERSION, id: sessionId, - createdAt: options?.meta?.createdAt ?? Date.now(), + createdAt: meta.createdAt ?? Date.now(), ...cwd !== undefined ? { cwd } : {}, - ...options?.meta?.parentSession !== undefined ? { parentSession: options.meta.parentSession } : {}, - ...options?.meta?.seedLength !== undefined ? { seedLength: options.meta.seedLength } : {}, + ...parentSession !== undefined ? { parentSession } : {}, + ...seedLength !== undefined ? { seedLength } : {}, } - return new Session(sessionId, options?.seed, header) + return new Session(sessionId, seed, header) } /** diff --git a/packages/core/session/src/json.ts b/packages/core/session/src/json.ts index 22303c6c61..2ec36087dd 100644 --- a/packages/core/session/src/json.ts +++ b/packages/core/session/src/json.ts @@ -1,45 +1,127 @@ /** - * JSON-serializability validation for session event data. + * Lossless-JSON validation and snapshot materialization for session data. * * The session event log is the durable source of truth (the event-sourcing / session-persistence RFCs): every * `event.data` must round-trip losslessly through JSON so any persistence * backend can store and reload it byte-identically. This invariant belongs to * the log itself — `Session.append` enforces it at the source, so a * non-serializable event never enters `session.events` and the live log can - * never diverge from what a backend can persist. Backends re-use the same - * predicate to validate their own `append(events)` entry point (replay/fork - * paths that do not go through a live `Session`). + * never diverge from what a backend can persist. Other public boundaries use + * {@link snapshotJsonValue} when they must validate and detach in one pass; + * {@link isJsonValue} remains the non-copying structural predicate. * * @module @deepseek-ai/dsh-session/json */ /** * A value that round-trips losslessly through JSON: `null`, a boolean, a finite - * number, a string, an array of such values, or a plain object whose values are - * such values. The static type companion to {@link isJsonValue} (which validates - * the same shape at runtime). Use it to type a payload that must survive - * session-log persistence and replay byte-identically — e.g. a tool's private - * presentation `meta`. + * number other than negative zero, a string, an array of such values, or a + * plain object whose values are such values. TypeScript cannot distinguish + * `-0` from `number`, so {@link isJsonValue} and {@link snapshotJsonValue} + * enforce that last numeric detail at runtime. Use this type for a payload that + * must survive session-log persistence and replay byte-identically — e.g. a + * tool's private presentation `meta`. */ export type JsonValue = null | boolean | number | string | JsonValue[] | { [key: string]: JsonValue } /** - * Whether `value` is losslessly JSON-serializable: only `null`, finite numbers, - * booleans, strings, plain arrays, and plain objects of such values. Rejects - * `BigInt`, function, symbol, `undefined`, non-finite numbers (`NaN`/`Infinity`, - * which `JSON.stringify` turns into `null`), and exotic objects (`Map`/`Set`/ - * `Date`/class instances) — anything `JSON.stringify` would drop, throw on, or - * convert lossily. Sparse arrays are rejected too: a hole serializes to `null`, - * so `[1, , 3]` would not round-trip. Detects circular references (which would - * throw) and reports them as non-serializable rather than propagating the throw. + * Materialize one detached lossless-JSON snapshot in a SINGLE recursive pass. + * Each array slot or own enumerable string-keyed object value is read exactly + * once, validated, and copied immediately. This is intentionally not + * `isJsonValue(value)` followed by `structuredClone(value)`: a stateful getter + * could return plain JSON to the check and an exotic class instance to the + * clone, whose prototype `structuredClone` would erase before a later check. * - * Scope — matches `JSON.stringify` exactly: only an object's OWN ENUMERABLE - * STRING-keyed properties are inspected (`Object.values`). Symbol-keyed and - * non-enumerable properties are NOT examined, because `JSON.stringify` likewise - * drops them — they never reach the durable form, so a non-serializable value - * hiding under a symbol/non-enumerable key cannot make the round-trip lossy. - * Getters are invoked during the check (again as `JSON.stringify` would), so the - * contract is for plain data records, not objects with side-effecting accessors. + * Accepts the same scalar/object vocabulary as {@link isJsonValue}: arrays use + * the ordinary `Array.prototype` (subclass instances are not plain JSON + * containers), while null-prototype objects are accepted and normalized to + * ordinary plain objects. Sparse arrays, cycles, negative zero, non-finite + * numbers, unsupported scalar types, and exotic object or array shells return + * `undefined`. A throwing getter is a caller failure and propagates unchanged. + * + * @param value - the candidate value to validate and detach. + * @returns the detached snapshot, or `undefined` when the value is not + * losslessly JSON-serializable. + */ +export function snapshotJsonValue(value: T): T | undefined { + const ancestors = new Set() + + const visit = (current: unknown): JsonValue | undefined => { + if (current === null) return null + switch (typeof current) { + case 'boolean': + case 'string': + return current + case 'number': + return Number.isFinite(current) && !Object.is(current, -0) ? current : undefined + case 'bigint': + case 'function': + case 'symbol': + case 'undefined': + return undefined + case 'object': + break + } + + if (ancestors.has(current)) return undefined + ancestors.add(current) + try { + if (Array.isArray(current)) { + if (Object.getPrototypeOf(current) !== Array.prototype) return undefined + const length = current.length + const snapshot: JsonValue[] = [] + for (let index = 0; index < length; index++) { + if (!Object.prototype.hasOwnProperty.call(current, index)) return undefined + const item = visit(current[index]) + if (item === undefined) return undefined + snapshot.push(item) + } + return snapshot + } + + const prototype = Object.getPrototypeOf(current) as unknown + if (prototype !== Object.prototype && prototype !== null) return undefined + const snapshot: { [key: string]: JsonValue } = {} + for (const key of Object.keys(current)) { + const item = visit((current as Record)[key]) + if (item === undefined) return undefined + // Define the key as data so a JSON field literally named "__proto__" + // cannot mutate the snapshot's prototype through ordinary assignment. + Object.defineProperty(snapshot, key, { + value: item, + enumerable: true, + configurable: true, + writable: true, + }) + } + return snapshot + } finally { + ancestors.delete(current) + } + } + + return visit(value) as T | undefined +} + +/** + * Whether `value` is losslessly JSON-serializable: only `null`, finite numbers + * other than negative zero, booleans, strings, plain arrays, and plain objects + * of such values. Rejects `BigInt`, function, symbol, `undefined`, `-0` (which + * JSON rewrites to `0`), non-finite numbers (`NaN`/`Infinity`, which JSON turns + * into `null`), and exotic objects (`Map`/`Set`/`Date`/class instances) — + * anything `JSON.stringify` would drop, throw on, or convert lossily. Sparse + * arrays are rejected too: a hole serializes to `null`, so `[1, , 3]` would not + * round-trip. Detects circular references (which would throw) and reports them + * as non-serializable rather than propagating the throw. + * + * Scope — this is a structural plain-data predicate, not an invocation of + * `JSON.stringify`: only an object's OWN ENUMERABLE STRING-keyed properties are + * inspected (`Object.values`). Symbol-keyed and non-enumerable properties are + * omitted from the durable data surface. Custom `toJSON` behavior is not + * executed; boundaries that persist a value first materialize a new plain-data + * record with {@link snapshotJsonValue}. Getters are invoked during this check, + * so callers that need a stable detached value use that one-pass materializer + * instead of checking and then rereading a side-effecting record. * @param value - the candidate event data to test. * @param seen - objects on the current descent path, for circular-reference * detection; the recursion threads it — callers omit it. @@ -52,7 +134,7 @@ export function isJsonValue(value: unknown, seen: Set = new Set()): bool case 'string': return true case 'number': - return Number.isFinite(value) + return Number.isFinite(value) && !Object.is(value, -0) case 'bigint': case 'function': case 'symbol': @@ -66,6 +148,7 @@ export function isJsonValue(value: unknown, seen: Set = new Set()): bool seen.add(value) try { if (Array.isArray(value)) { + if (Object.getPrototypeOf(value) !== Array.prototype) return false // Reject sparse arrays: a hole is skipped by `every`/`forEach` but // JSON.stringify writes it as `null`, so `[1, , 3]` would round-trip // lossily. Require every index 0..length-1 to be an OWN property. diff --git a/packages/core/session/src/types.ts b/packages/core/session/src/types.ts index ca6779e1dc..e564929ae0 100644 --- a/packages/core/session/src/types.ts +++ b/packages/core/session/src/types.ts @@ -32,6 +32,9 @@ export const SESSION_FORMAT_VERSION = 0 /** * Immutable session metadata — written once at creation and never rewritten. + * {@link Session} enforces that contract at runtime: it validates and detaches + * the accepted scalar fields, requires this header's id to match the session + * id, and deep-freezes the published record. * * Kept SEPARATE from the event log deliberately: format-version, cwd, and * lineage are storage concerns, not conversation events, so they stay out of @@ -75,7 +78,8 @@ export interface CreateSessionOptions { /** Events to seed the new session with (replay/fork). */ seed?: SessionEvent[] /** - * Creation metadata. The store fills in `version`/`id` and defaults + * Creation metadata. The store reads this plain record and each accepted + * field once, then fills in `version`/`id` and defaults * `createdAt` to now; the caller supplies the storage-level fields (validated * absolute `cwd`, `parentSession` lineage, the seed boundary `seedLength`, and * — when reconstructing a persisted session — the original `createdAt` to diff --git a/packages/core/session/tests/fork.spec.ts b/packages/core/session/tests/fork.spec.ts index 25328294cf..af143ea5ee 100644 --- a/packages/core/session/tests/fork.spec.ts +++ b/packages/core/session/tests/fork.spec.ts @@ -60,7 +60,7 @@ describe('SessionStore.fork', () => { }) }) - it('forks the latest completed boundary by default and deep-clones seed events', async () => { + it('forks the latest completed boundary by default into detached frozen seed events', async () => { const { ctx, sessions } = await setup() const source = ctx.sessions.create(SessionId('parent'), { meta: { cwd: '/workspace' } }) appendClosedTurn(source, 1, 'hello') @@ -70,8 +70,11 @@ describe('SessionStore.fork', () => { expect(child.events).toEqual(source.events) expect(child.events).not.toBe(source.events) expect(child.events[1]).not.toBe(source.events[1]) - firstUserMessage(child.events).data.content[0] = { type: 'text', text: 'child mutation' } + expect(() => { + firstUserMessage(child.events).data.content[0] = { type: 'text', text: 'child mutation' } + }).toThrow(TypeError) expect(firstUserMessage(source.events).data.content).toEqual([{ type: 'text', text: 'hello' }]) + expect(firstUserMessage(child.events).data.content).toEqual([{ type: 'text', text: 'hello' }]) expect(child.header).toMatchObject({ id: SessionId('child'), cwd: '/workspace', diff --git a/packages/core/session/tests/json.spec.ts b/packages/core/session/tests/json.spec.ts new file mode 100644 index 0000000000..4fb06fd744 --- /dev/null +++ b/packages/core/session/tests/json.spec.ts @@ -0,0 +1,152 @@ +import { describe, expect, it } from 'vitest' +import { isJsonValue, snapshotJsonValue } from '@deepseek-ai/dsh-session' + +describe('snapshotJsonValue', () => { + it('copies the complete JSON scalar vocabulary and rejects unsupported scalars', () => { + const unsupportedFunction = (): void => {} + + expect(snapshotJsonValue(null)).toBeNull() + expect(snapshotJsonValue(true)).toBe(true) + expect(snapshotJsonValue('text')).toBe('text') + expect(snapshotJsonValue(1.25)).toBe(1.25) + expect(snapshotJsonValue(-0)).toBeUndefined() + expect(isJsonValue(-0)).toBe(false) + expect(snapshotJsonValue(Number.NaN)).toBeUndefined() + expect(snapshotJsonValue(Number.POSITIVE_INFINITY)).toBeUndefined() + expect(snapshotJsonValue(1n)).toBeUndefined() + expect(snapshotJsonValue(unsupportedFunction)).toBeUndefined() + expect(snapshotJsonValue(Symbol('value'))).toBeUndefined() + const unsupportedUndefined: unknown = undefined + expect(snapshotJsonValue(unsupportedUndefined)).toBeUndefined() + }) + + it('recursively detaches dense arrays and plain or null-prototype objects', () => { + const shared = { value: 1 } + const nullPrototype = Object.assign(Object.create(null) as Record, { shared }) + const source = { list: [nullPrototype, shared], alias: shared } + + const snapshot = snapshotJsonValue(source)! + shared.value = 2 + + expect(snapshot).toEqual({ list: [{ shared: { value: 1 } }, { value: 1 }], alias: { value: 1 } }) + expect(snapshot).not.toBe(source) + expect(snapshot.list).not.toBe(source.list) + expect(snapshot.alias).not.toBe(shared) + expect(snapshot.list[0]).not.toBe(nullPrototype) + expect(Object.getPrototypeOf(snapshot.list[0])).toBe(Object.prototype) + }) + + it('reads each object value and array slot once while materializing', () => { + class Exotic { + readonly accepted = false + } + let objectReads = 0 + let arrayReads = 0 + const nested = Object.defineProperty({}, 'value', { + enumerable: true, + get: () => { + objectReads += 1 + return objectReads === 1 ? { accepted: true } : new Exotic() + }, + }) + const array = new Array(1) + Object.defineProperty(array, 0, { + enumerable: true, + get: () => { + arrayReads += 1 + return arrayReads === 1 ? nested : new Exotic() + }, + }) + + expect(snapshotJsonValue(array)).toEqual([{ value: { accepted: true } }]) + expect(objectReads).toBe(1) + expect(arrayReads).toBe(1) + }) + + it('rejects exotic containers, sparse arrays, cycles, and invalid children', () => { + class ExoticObject { + readonly value = 1 + } + class ExoticArray extends Array {} + const sparse = new Array(1) + const cyclic: Record = {} + cyclic.self = cyclic + + expect(snapshotJsonValue(new ExoticObject())).toBeUndefined() + expect(snapshotJsonValue(new Map([['value', 1]]))).toBeUndefined() + expect(snapshotJsonValue(new ExoticArray(1))).toBeUndefined() + expect(snapshotJsonValue(sparse)).toBeUndefined() + expect(snapshotJsonValue(cyclic)).toBeUndefined() + expect(snapshotJsonValue([undefined])).toBeUndefined() + expect(snapshotJsonValue({ value: undefined })).toBeUndefined() + }) + + it('preserves a literal __proto__ JSON key without changing the snapshot prototype', () => { + const source = Object.create(null) as Record + source.__proto__ = { safe: true } + + const snapshot = snapshotJsonValue(source)! + + expect(Object.getPrototypeOf(snapshot)).toBe(Object.prototype) + expect(Object.prototype.hasOwnProperty.call(snapshot, '__proto__')).toBe(true) + expect(snapshot.__proto__).toEqual({ safe: true }) + }) + + it('propagates a throwing getter after reading it once', () => { + const failure = new Error('getter failed') + let reads = 0 + const source = Object.defineProperty({}, 'value', { + enumerable: true, + get: () => { + reads += 1 + throw failure + }, + }) + + expect(() => snapshotJsonValue(source)).toThrow(failure) + expect(reads).toBe(1) + }) +}) + +describe('isJsonValue', () => { + it('recognizes supported scalars and rejects every lossy scalar case', () => { + const unsupportedFunction = (): void => {} + const unsupportedUndefined: unknown = undefined + + expect(isJsonValue(null)).toBe(true) + expect(isJsonValue(false)).toBe(true) + expect(isJsonValue('text')).toBe(true) + expect(isJsonValue(1.25)).toBe(true) + expect(isJsonValue(-0)).toBe(false) + expect(isJsonValue(Number.NaN)).toBe(false) + expect(isJsonValue(1n)).toBe(false) + expect(isJsonValue(unsupportedFunction)).toBe(false) + expect(isJsonValue(Symbol('value'))).toBe(false) + expect(isJsonValue(unsupportedUndefined)).toBe(false) + }) + + it('accepts dense arrays and plain objects, including null-prototype records', () => { + const nullPrototype = Object.assign(Object.create(null) as Record, { value: true }) + + expect(isJsonValue([1, { nested: null }, nullPrototype])).toBe(true) + expect(isJsonValue({ value: [1, 2] })).toBe(true) + expect(isJsonValue(nullPrototype)).toBe(true) + }) + + it('rejects sparse arrays, invalid children, exotic objects, and cycles', () => { + class Exotic { + readonly value = 1 + } + class ExoticArray extends Array {} + const sparse = new Array(1) + const cyclic: Record = {} + cyclic.self = cyclic + + expect(isJsonValue(sparse)).toBe(false) + expect(isJsonValue(new ExoticArray(1))).toBe(false) + expect(isJsonValue([undefined])).toBe(false) + expect(isJsonValue({ value: undefined })).toBe(false) + expect(isJsonValue(new Exotic())).toBe(false) + expect(isJsonValue(cyclic)).toBe(false) + }) +}) diff --git a/packages/core/session/tests/session.spec.ts b/packages/core/session/tests/session.spec.ts index f63353af9b..f7037609e6 100644 --- a/packages/core/session/tests/session.spec.ts +++ b/packages/core/session/tests/session.spec.ts @@ -1,8 +1,8 @@ -import { describe, expect, it } from 'vitest' +import { describe, expect, it, vi } from 'vitest' import { Context } from 'cordis' import { CallId } from '@deepseek-ai/dsh-llm' import SessionStore, { SESSION_FORMAT_VERSION, Session, SessionEvent, SessionId } from '@deepseek-ai/dsh-session' -import type { SessionEventType, TodoItem } from '@deepseek-ai/dsh-session' +import type { CreateSessionOptions, SessionEventType, SessionHeader, TodoItem } from '@deepseek-ai/dsh-session' describe('Session', () => { it('derives message history from the event log', () => { @@ -129,6 +129,16 @@ describe('Session', () => { expect(session.events).toHaveLength(0) }) + it('rejects a non-string event type without retaining or freezing caller data', () => { + const session = new Session(SessionId('invalid-event-type')) + const type = { tag: 'caller-owned' } + const appendRaw = session.append.bind(session) as unknown as (type: unknown, data: unknown) => SessionEvent + + expect(() => appendRaw(type, {})).toThrow(/event type must be a string/) + expect(Object.isFrozen(type)).toBe(false) + expect(session.events).toEqual([]) + }) + it('rejects a surface-eligible append with no surfaceOp marker (runtime guard for the union-widening loophole)', () => { const session = new Session(SessionId('s5b')) session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -156,7 +166,7 @@ describe('Session', () => { const badSeed = [ { type: 'user/message' as const, seq: 0, time: 1, data: { content: [{ type: 'text' as const, text: 'x' }], source: { kind: 'user' as const }, bad: 1n } }, ] as unknown as SessionEvent[] - expect(() => new Session(SessionId('seed-bad'), badSeed)).toThrow(/non-JSON-serializable/) + expect(() => new Session(SessionId('seed-bad'), badSeed)).toThrow(/losslessly JSON-serializable/) }) it('validates seed events: rejects a non-contiguous seq', () => { @@ -177,7 +187,7 @@ describe('Session', () => { { type: 'user/message' as const, seq: 1, time: 2, data: { content: [{ type: 'text' as const, text: 'hi' }], source: { kind: 'user' as const } } }, { type: 'turn/end' as const, seq: 2, time: 3, data: { turn: 1, reason: { kind: 'completed' as const } } }, ] as SessionEvent[] - expect(() => new Session(SessionId('seed-no-marker'), markerlessSeed)).toThrow(/surface-eligible but carries no surfaceOp/) + expect(() => new Session(SessionId('seed-no-marker'), markerlessSeed)).toThrow(/requires a surfaceOp marker/) }) it('accepts a well-formed contiguous serializable seed', () => { @@ -190,6 +200,151 @@ describe('Session', () => { expect(session.events).toHaveLength(3) }) + it('reads each seed array entry once so validation and storage use the same event', () => { + const accepted = { + type: 'turn/start' as const, + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } }, + } + const drifted = { ...accepted, seq: 99, data: { invalid: 1n } } + let reads = 0 + const seed = new Array(1) + Object.defineProperty(seed, 0, { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? accepted : drifted + }, + }) + + const session = new Session(SessionId('seed-entry-snapshot'), seed) + + expect(reads).toBe(1) + expect(session.events).toEqual([accepted]) + }) + + it('reads a nested seed-data getter once and stores its first JSON value', () => { + let reads = 0 + const data = Object.defineProperty({}, 'value', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? 'accepted' : 1n + }, + }) + const seed = [{ type: 'test/unstable', seq: 0, time: 1, data }] as unknown as SessionEvent[] + + const session = new Session(SessionId('seed-nested-drift'), seed) + + expect(reads).toBe(1) + expect(session.events[0]!.data).toEqual({ value: 'accepted' }) + }) + + it('rejects non-JSON surface metadata in a seed event', () => { + const seed = [{ + type: 'user/message', + seq: 0, + time: 1, + data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + surfaceOp: { op: 'replace', start: 1n, end: 2 }, + }] as unknown as SessionEvent[] + + expect(() => new Session(SessionId('seed-bad-metadata'), seed)) + .toThrow(/losslessly JSON-serializable/) + }) + + it('rejects exotic seed metadata before cloning can erase its prototype', () => { + class ReplaceOp { + readonly op = 'replace' as const + readonly start = 0 + readonly end = 0 + } + const seed = [{ + type: 'user/message', + seq: 0, + time: 1, + data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + surfaceOp: new ReplaceOp(), + }] as unknown as SessionEvent[] + + expect(() => new Session(SessionId('seed-exotic-metadata'), seed)) + .toThrow(/losslessly JSON-serializable/) + }) + + it('rejects an exotic seed event shell before spreading erases its prototype', () => { + class SeedEvent { + readonly type = 'turn/start' as const + readonly seq = 0 + readonly time = 1 + readonly data = { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } + } + const seed: SessionEvent[] = [new SeedEvent()] + + expect(() => new Session(SessionId('seed-exotic-shell'), seed)) + .toThrow(/not a plain JSON record/) + }) + + it('accepts a null-prototype seed event shell as a plain JSON record', () => { + const event = Object.assign(Object.create(null) as Record, { + type: 'turn/start' as const, + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } }, + }) as unknown as SessionEvent + + const session = new Session(SessionId('seed-null-prototype'), [event]) + + expect(session.events).toEqual([{ ...event }]) + }) + + it('reads a nested seed-metadata getter once and stores its first JSON value', () => { + let reads = 0 + const surfaceOp = Object.defineProperty({ op: 'replace', end: 0 }, 'start', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? 0 : 1n + }, + }) + const seed = [{ + type: 'user/message', + seq: 0, + time: 1, + data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + surfaceOp, + }] as unknown as SessionEvent[] + + const session = new Session(SessionId('seed-unstable-metadata'), seed) + const event = session.events[0]! + if (event.type !== 'user/message') throw new Error('test fixture must remain a user/message') + + expect(reads).toBe(1) + expect(event.surfaceOp).toEqual({ op: 'replace', start: 0, end: 0 }) + }) + + it('adds seed context when surface validation throws a non-Error value', () => { + const originalHasOwn = Object.hasOwn + const hasOwn = vi.spyOn(Object, 'hasOwn').mockImplementation((object: object, property: PropertyKey): boolean => { + if ((object as Record)['op'] === 'replace') throw 'validator failed' + return originalHasOwn(object, property) + }) + const seed = [{ + type: 'user/message', + seq: 0, + time: 1, + data: { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + surfaceOp: { op: 'replace', start: 0, end: 0 }, + }] as unknown as SessionEvent[] + + try { + expect(() => new Session(SessionId('seed-non-error-metadata-failure'), seed)) + .toThrow('invalid seed event at index 0: invalid surface metadata') + } finally { + hasOwn.mockRestore() + } + }) + it('snapshots the seed: mutating the original after construction does not affect session.events', () => { const seed = [ { type: 'turn/start' as const, seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } }, @@ -222,6 +377,304 @@ describe('Session', () => { // The returned event carries the same snapshot, not the caller's input. expect((event.data.content[0] as { text: string }).text).toBe('original') }) + + it('reads a nested append-data getter once and stores its first JSON value', () => { + const session = new Session(SessionId('append-nested-drift')) + let reads = 0 + const data = Object.defineProperty({}, 'value', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? 'accepted' : 1n + }, + }) + + const event = session.append('todo/write', data as never) + + expect(reads).toBe(1) + expect(event.data).toEqual({ value: 'accepted' }) + expect(session.events).toEqual([event]) + }) + + it('reads surface metadata accessors once so a validated marker is logged', () => { + const session = new Session(SessionId('surface-intent-snapshot')) + let reads = 0 + const intent = { + get surfaceOp(): 'append' | undefined { + reads += 1 + return reads === 1 ? 'append' : undefined + }, + } + + const event = session.append( + 'user/message', + { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + intent as { surfaceOp: 'append' }, + ) + + expect(reads).toBe(1) + expect(event.surfaceOp).toBe('append') + }) + + it('rejects non-JSON surface metadata before appending the event', () => { + const session = new Session(SessionId('append-bad-metadata')) + + expect(() => session.append( + 'user/message', + { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + { surfaceOp: { op: 'replace', start: 1n, end: 2 } } as never, + )).toThrow(/non-JSON-serializable surface metadata/) + expect(session.events).toEqual([]) + }) + + it('rejects exotic surface metadata before cloning can erase its prototype', () => { + class ReplaceOp { + readonly op = 'replace' as const + readonly start = 0 + readonly end = 0 + } + const session = new Session(SessionId('append-exotic-metadata')) + + expect(() => session.append( + 'user/message', + { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + { surfaceOp: new ReplaceOp() }, + )).toThrow(/non-JSON-serializable surface metadata/) + expect(session.events).toEqual([]) + }) + + it('reads a nested append-metadata getter once and stores its first JSON value', () => { + const session = new Session(SessionId('append-unstable-metadata')) + let reads = 0 + const surfaceOp = Object.defineProperty({ op: 'replace', end: 0 }, 'start', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? 0 : 1n + }, + }) + + const event = session.append( + 'user/message', + { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } }, + { surfaceOp } as never, + ) + + expect(reads).toBe(1) + expect(event.surfaceOp).toEqual({ op: 'replace', start: 0, end: 0 }) + expect(session.events).toEqual([event]) + }) + + it('rejects invalid plain surface metadata shapes at append', () => { + const session = new Session(SessionId('append-invalid-surface-shape')) + const appendRaw = session.append.bind(session) as unknown as ( + type: SessionEventType, + data: unknown, + opts?: unknown, + ) => SessionEvent + const data = { content: [{ type: 'text', text: 'hello' }], source: { kind: 'user' } } + + expect(() => appendRaw('user/message', data, { surfaceOp: 'invalid' })) + .toThrow(/invalid surfaceOp/) + expect(() => appendRaw('user/message', data, { + surfaceOp: { op: 'replace', start: -1, end: 0 }, + })).toThrow(/invalid replace surfaceOp/) + expect(() => appendRaw('user/message', data, { + surfaceOp: 'append', + sourceEventSeqs: [0, -1], + })).toThrow(/non-negative safe integers/) + expect(session.events).toEqual([]) + }) + + it('rejects surface metadata on non-surface append and seed events', () => { + const session = new Session(SessionId('non-surface-metadata')) + const appendRaw = session.append.bind(session) as unknown as ( + type: SessionEventType, + data: unknown, + opts?: unknown, + ) => SessionEvent + + expect(() => appendRaw( + 'turn/start', + { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }, + { surfaceOp: 'append' }, + )).toThrow(/not surface-eligible and cannot carry surface metadata/) + expect(() => new Session(SessionId('non-surface-metadata-seed'), [{ + type: 'turn/start', + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }, + surfaceOp: 'append', + } as unknown as SessionEvent])).toThrow(/invalid seed event.*not surface-eligible/) + expect(session.events).toEqual([]) + }) + + it('deep-freezes seeded and appended event snapshots', () => { + const seeded = new Session(SessionId('seed-frozen'), [{ + type: 'turn/start', + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }, + }]) + const seededEvent = seeded.events[0]! + if (seededEvent.type !== 'turn/start') throw new Error('test fixture must remain a turn/start') + expect(Object.isFrozen(seededEvent)).toBe(true) + expect(Object.isFrozen(seededEvent.data)).toBe(true) + expect(Object.isFrozen(seededEvent.data.trigger)).toBe(true) + expect(() => { seededEvent.data.turn = 99 }).toThrow(TypeError) + + const appended = new Session(SessionId('append-frozen')) + const appendedEvent = appended.append('todo/write', { + todos: [{ content: 'first', status: 'pending' }], + }) + expect(Object.isFrozen(appendedEvent)).toBe(true) + expect(Object.isFrozen(appendedEvent.data)).toBe(true) + expect(Object.isFrozen(appendedEvent.data.todos)).toBe(true) + expect(Object.isFrozen(appendedEvent.data.todos[0])).toBe(true) + expect(() => { appendedEvent.data.todos[0]!.content = 'mutated' }).toThrow(TypeError) + }) + + it('returns cached frozen event-array snapshots that do not grow after append', () => { + const session = new Session(SessionId('events-snapshot')) + session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) + const before = session.events + const beforeEvent = before[0]! + if (beforeEvent.type !== 'turn/start') throw new Error('test fixture must remain a turn/start') + + expect(session.events).toBe(before) + expect(Object.isFrozen(before)).toBe(true) + expect(() => { (before as SessionEvent[]).push(beforeEvent) }).toThrow(TypeError) + expect(() => { beforeEvent.data.turn = 99 }).toThrow(TypeError) + + session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + const after = session.events + expect(before).toHaveLength(1) + expect(after).toHaveLength(2) + expect(after).not.toBe(before) + expect(session.events).toBe(after) + }) + + it('detaches and freezes an explicitly supplied session header', () => { + const input = { + version: SESSION_FORMAT_VERSION, + id: SessionId('header-owned'), + createdAt: 123, + cwd: '/accepted', + parentSession: SessionId('parent'), + seedLength: 2, + } + + const session = new Session(SessionId('header-owned'), undefined, input) + input.cwd = '/caller-mutated' + + expect(session.header).toEqual({ + version: SESSION_FORMAT_VERSION, + id: 'header-owned', + createdAt: 123, + cwd: '/accepted', + parentSession: 'parent', + seedLength: 2, + }) + expect(session.header).not.toBe(input) + expect(Object.isFrozen(session.header)).toBe(true) + expect(Reflect.set(session.header, 'cwd', '/published-mutated')).toBe(false) + expect(session.header.cwd).toBe('/accepted') + }) + + it('reads each supplied header field once before validation and publication', () => { + const reads = { version: 0, id: 0, createdAt: 0, cwd: 0, parentSession: 0, seedLength: 0 } + const header = { + get version() { reads.version += 1; return reads.version === 1 ? SESSION_FORMAT_VERSION : 99 }, + get id() { reads.id += 1; return reads.id === 1 ? SessionId('header-once') : SessionId('drifted') }, + get createdAt() { reads.createdAt += 1; return reads.createdAt === 1 ? 123 : Number.NaN }, + get cwd() { reads.cwd += 1; return reads.cwd === 1 ? '/accepted' : 'relative' }, + get parentSession() { reads.parentSession += 1; return reads.parentSession === 1 ? SessionId('parent') : 1n }, + get seedLength() { reads.seedLength += 1; return reads.seedLength === 1 ? 0 : 1n }, + } as unknown as SessionHeader + + const session = new Session(SessionId('header-once'), undefined, header) + + expect(reads).toEqual({ version: 1, id: 1, createdAt: 1, cwd: 1, parentSession: 1, seedLength: 1 }) + expect(session.header).toEqual({ + version: SESSION_FORMAT_VERSION, + id: 'header-once', + createdAt: 123, + cwd: '/accepted', + parentSession: 'parent', + seedLength: 0, + }) + }) + + it('rejects an exotic, non-JSON, or mismatched supplied header', () => { + class ExoticHeader implements SessionHeader { + readonly version = SESSION_FORMAT_VERSION + readonly id = SessionId('header-invalid') + readonly createdAt = 123 + } + + expect(() => new Session(SessionId('header-invalid'), undefined, new ExoticHeader())) + .toThrow(/not a plain JSON record/) + expect(() => new Session(SessionId('header-invalid'), undefined, { + version: SESSION_FORMAT_VERSION, + id: SessionId('header-invalid'), + createdAt: 123, + parentSession: 1n, + } as unknown as SessionHeader)).toThrow(/not losslessly JSON-serializable/) + expect(() => new Session(SessionId('header-invalid'), undefined, { + version: SESSION_FORMAT_VERSION, + id: SessionId('other'), + createdAt: 123, + })).toThrow(/does not match session id/) + }) + + it('rejects invalid scalar fields in an explicitly supplied header', () => { + const base = { + version: SESSION_FORMAT_VERSION, + id: SessionId('header-shape'), + createdAt: 123, + } + const cases: Array<{ header: unknown; error: RegExp }> = [ + { header: 1, error: /not a plain JSON record/ }, + { header: null, error: /not a plain JSON record/ }, + { header: { ...base, version: 1 }, error: /header version/ }, + { header: { ...base, createdAt: '123' }, error: /createdAt must be a finite number/ }, + { header: { ...base, cwd: 1 }, error: /header cwd must be a string/ }, + { header: { ...base, cwd: 'relative' }, error: /header cwd must be an absolute path/ }, + { header: { ...base, parentSession: 1 }, error: /header parentSession must be a string/ }, + { header: { ...base, seedLength: '1' }, error: /seedLength must be a non-negative safe integer/ }, + { header: { ...base, seedLength: 0.5 }, error: /seedLength must be a non-negative safe integer/ }, + { header: { ...base, seedLength: -1 }, error: /seedLength must be a non-negative safe integer/ }, + ] + + for (const { header, error } of cases) { + expect(() => new Session(SessionId('header-shape'), undefined, header as SessionHeader)).toThrow(error) + } + }) + + it('rejects seed records with invalid fixed-envelope fields', () => { + const base = { + type: 'turn/start', + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }, + } + const cases: unknown[] = [ + { ...base, extra: true }, + { ...base, type: 1 }, + { ...base, seq: '0' }, + { ...base, seq: 0.5 }, + { ...base, seq: -1 }, + { ...base, time: '1' }, + { ...base, time: 0.5 }, + { ...base, time: -1 }, + { type: base.type, seq: base.seq, time: base.time }, + ] + + for (const [index, event] of cases.entries()) { + expect(() => new Session(SessionId(`bad-envelope-${index}`), [event as SessionEvent])) + .toThrow(/invalid event envelope/) + } + }) }) @@ -317,6 +770,66 @@ describe('SessionStore', () => { }) }) + it('reads session options and each metadata field once in prepare()', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const reads = { seed: 0, meta: 0, cwd: 0, parentSession: 0, createdAt: 0, seedLength: 0 } + const meta = { + get cwd() { reads.cwd += 1; return reads.cwd === 1 ? '/accepted' : 'relative' }, + get parentSession() { reads.parentSession += 1; return reads.parentSession === 1 ? SessionId('parent') : 1n }, + get createdAt() { reads.createdAt += 1; return reads.createdAt === 1 ? 123 : Number.NaN }, + get seedLength() { reads.seedLength += 1; return reads.seedLength === 1 ? 0 : 1n }, + } + const options = { + get seed() { reads.seed += 1; return reads.seed === 1 ? undefined : [] }, + get meta() { reads.meta += 1; return reads.meta === 1 ? meta : undefined }, + } as unknown as CreateSessionOptions + + const session = ctx.sessions.prepare(SessionId('metadata-once'), options) + + expect(reads).toEqual({ seed: 1, meta: 1, cwd: 1, parentSession: 1, createdAt: 1, seedLength: 1 }) + expect(session.header).toEqual({ + version: SESSION_FORMAT_VERSION, + id: 'metadata-once', + createdAt: 123, + cwd: '/accepted', + parentSession: 'parent', + seedLength: 0, + }) + }) + + it('rejects exotic metadata before cloning can erase its prototype', async () => { + class ExoticMeta { + readonly cwd = '/accepted' + } + const ctx = new Context() + await ctx.plugin(SessionStore) + + expect(() => ctx.sessions.prepare(SessionId('exotic-meta'), { meta: new ExoticMeta() })) + .toThrow(/session metadata is not a plain JSON record/) + }) + + it('rejects non-JSON and invalid scalar session metadata', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const cases: Array<{ meta: unknown; error: RegExp }> = [ + { meta: 1, error: /metadata is not a plain JSON record/ }, + { meta: { parentSession: 1n }, error: /metadata is not losslessly JSON-serializable/ }, + { meta: { cwd: 1 }, error: /session cwd must be a string/ }, + { meta: { parentSession: 1 }, error: /parentSession must be a string/ }, + { meta: { createdAt: '123' }, error: /createdAt must be a finite number/ }, + { meta: { seedLength: '1' }, error: /seedLength must be a non-negative safe integer/ }, + { meta: { seedLength: 0.5 }, error: /seedLength must be a non-negative safe integer/ }, + { meta: { seedLength: -1 }, error: /seedLength must be a non-negative safe integer/ }, + ] + + for (const [index, { meta, error }] of cases.entries()) { + expect(() => ctx.sessions.prepare(SessionId(`bad-meta-${index}`), { + meta: meta as NonNullable, + })).toThrow(error) + } + }) + it('rejects a non-absolute meta.cwd', async () => { const ctx = new Context() await ctx.plugin(SessionStore) diff --git a/packages/core/system-prompt/README.md b/packages/core/system-prompt/README.md index d712cd4b5b..439ebebfc7 100644 --- a/packages/core/system-prompt/README.md +++ b/packages/core/system-prompt/README.md @@ -14,10 +14,10 @@ System prompt assembly registry. Plugins contribute ordered text sections, tool- ### Public API - `ctx.systemPrompt.section(section: PromptSection): () => Promise | void` Contribute a section. The registry snapshots `name`, `order`, and the text value/callback, so later caller-object mutation cannot rename a stored section. The layer is the CALLING context's scope: `agent.ctx` contributes to that agent alone, SHADOWING a same-named global section there (the per-agent persona mechanism — a scoped `deployment:persona`). Duplicate names within one layer throw, and a globally protected section name cannot be shadowed. Disposed with the calling fiber. -- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void` Contribute tool schemas, evaluated at each assembly with that assembly's context. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the schemas' names) is the pre-restriction universe `toolOrder` validates against. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber. +- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void` Contribute tool schemas, evaluated at each assembly with that assembly's context. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the same captured schemas' names) is the pre-restriction universe `toolOrder` validates against. Assembly reads the result, each schema field, and the optional known-name list once before detaching them, rejects non-string schema names/descriptions or known names, and uses those same accepted strings for validation and the model-visible collection. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber. - `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise | void` Contribute a prompt variable, referenced from section text as `{{name}}`. Scoped variables (via `agent.ctx`) shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber. -- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Inputs are snapshotted, empty protections throw, and disposal removes the protection. -- `ctx.systemPrompt.assemble(context?: AssembleContext): Promise` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer (scoped shadows global). Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores protected contributions from the pre-waterfall canonical assembly. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe (a restricted-away KNOWN tool is a normal absence), or when a provider returns the reserved rest-entry name. +- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Each input array is read once and snapshotted, empty protections throw, and disposal removes the protection. +- `ctx.systemPrompt.assemble(context?: AssembleContext): Promise` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer (scoped shadows global). Provider output becomes one coherent detached snapshot before `toolOrder` validation. Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores protected contributions from the pre-waterfall canonical assembly. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe (a restricted-away KNOWN tool is a normal absence), or when a provider returns the reserved rest-entry name. ### Live events diff --git a/packages/core/system-prompt/package.json b/packages/core/system-prompt/package.json index 120e10ef11..69af28f3b5 100644 --- a/packages/core/system-prompt/package.json +++ b/packages/core/system-prompt/package.json @@ -24,6 +24,7 @@ "peerDependencies": { "@deepseek-ai/dsh-llm": "^0.0.1", "@deepseek-ai/dsh-scope": "^0.0.1", + "@deepseek-ai/dsh-session": "^0.0.1", "cordis": "^4.0.0-rc.6" }, "dependencies": { @@ -32,6 +33,7 @@ "devDependencies": { "@deepseek-ai/dsh-llm": "workspace:^", "@deepseek-ai/dsh-scope": "workspace:^", + "@deepseek-ai/dsh-session": "workspace:^", "cordis": "^4.0.0-rc.6" } } diff --git a/packages/core/system-prompt/src/index.ts b/packages/core/system-prompt/src/index.ts index 6d3ed3af58..8d3cc501a8 100644 --- a/packages/core/system-prompt/src/index.ts +++ b/packages/core/system-prompt/src/index.ts @@ -18,6 +18,7 @@ import z from 'schemastery' import { scopeOf, scopeTarget } from '@deepseek-ai/dsh-scope' import type { ScopeKey, Scoped } from '@deepseek-ai/dsh-scope' import type { ToolSchema } from '@deepseek-ai/dsh-llm' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' declare module 'cordis' { interface Context { @@ -598,8 +599,9 @@ export class SystemPrompt extends Service { * restored AFTER the whole waterfall, so listener registration order cannot * strip, replace, duplicate, or fabricate it. Canonical absence is restored * too: if the protected name is intentionally absent for an assembly, a - * listener-injected entry with that name is removed. The input arrays are - * snapshotted; an empty protection throws because it cannot affect output. + * listener-injected entry with that name is removed. Each input array is + * read once and snapshotted; an empty protection throws because it cannot + * affect output. * Removed with the calling fiber and emits `system-prompt/change` on * registration/unregistration. A global section protection also reserves the * name against scoped section shadows; registering protection when such a @@ -609,9 +611,11 @@ export class SystemPrompt extends Service { */ protect(protection: PromptProtection): () => Promise | void { const scope = scopeOf(this.ctx) + const sections = protection.sections + const tools = protection.tools const snapshot: PromptProtection = { - ...protection.sections !== undefined ? { sections: [...new Set(protection.sections)] } : {}, - ...protection.tools !== undefined ? { tools: [...new Set(protection.tools)] } : {}, + ...sections !== undefined ? { sections: [...new Set(sections)] } : {}, + ...tools !== undefined ? { tools: [...new Set(tools)] } : {}, } if ((snapshot.sections?.length ?? 0) === 0 && (snapshot.tools?.length ?? 0) === 0) { throw new Error('systemPrompt.protect() requires at least one section or tool name') @@ -669,6 +673,8 @@ export class SystemPrompt extends Service { * the providers' `knownNames` universe rejects the assembly, while a known * name restricted away for this scope is a normal absence), and every * visible variable resolved against `context` into `assembly.variables`. + * Each provider result and schema field is read once; those same captured + * names drive both `toolOrder` validation and the model-visible collection. * Tool schemas are deep-cloned because adapters and request waterfalls may * mutate schema objects. Runs through the `system-prompt/assemble` * waterfall, giving listeners the opportunity to mutate or replace the @@ -724,12 +730,43 @@ export class SystemPrompt extends Service { const knownNames = new Set() for (const provider of providers) { const result = provider(context) - for (const tool of result.schemas) { - collected.push({ ...tool, parameters: structuredClone(tool.parameters) }) - } - for (const name of result.knownNames ?? result.schemas.map(tool => tool.name)) { - knownNames.add(name) + // One provider result snapshot: `schemas`, `knownNames`, and each schema + // field may be accessor-backed. The same captured names must drive both + // toolOrder validation and the model-visible collection. + const inputSchemas = result.schemas + const inputKnownNames = result.knownNames + const schemas = inputSchemas.map((tool, index): ToolSchema => { + const name = tool.name + const description = tool.description + const inputParameters = tool.parameters + if (typeof name !== 'string') { + throw new TypeError(`system prompt tool schema at index ${index} name must be a string`) + } + if (typeof description !== 'string') { + throw new TypeError(`system prompt tool "${name}" description must be a string`) + } + const parameters = snapshotJsonValue(inputParameters) + if (parameters === undefined) { + throw new TypeError(`system prompt tool "${name}" parameters must be losslessly JSON-serializable`) + } + return { name, description, parameters } + }) + let acceptedKnownNames: string[] + if (inputKnownNames === undefined) { + acceptedKnownNames = schemas.map(tool => tool.name) + } else { + if (!Array.isArray(inputKnownNames)) { + throw new TypeError('system prompt tool provider knownNames must be an array of strings') + } + acceptedKnownNames = Array.from(inputKnownNames, (name) => { + if (typeof name !== 'string') { + throw new TypeError('system prompt tool provider knownNames must be an array of strings') + } + return name + }) } + collected.push(...schemas) + for (const name of acceptedKnownNames) knownNames.add(name) } const assembly: PromptAssembly = { sections: [...sectionByName.values()] diff --git a/packages/core/system-prompt/tests/system-prompt.spec.ts b/packages/core/system-prompt/tests/system-prompt.spec.ts index 95d46b705e..9eef467a8e 100644 --- a/packages/core/system-prompt/tests/system-prompt.spec.ts +++ b/packages/core/system-prompt/tests/system-prompt.spec.ts @@ -258,6 +258,30 @@ describe('SystemPrompt', () => { expect(assembly.tools.map(tool => tool.name)).toEqual(['alpha', 'protected', 'zulu']) }) + it('reads protection accessors once so the checked names are the protected names', async () => { + const ctx = new Context() + await ctx.plugin(SystemPrompt) + ctx.systemPrompt.section({ name: 'protected', order: 10, text: 'canonical' }) + let reads = 0 + const protection = { + get sections(): string[] { + reads += 1 + return reads === 1 ? ['protected'] : undefined as unknown as string[] + }, + } + ctx.systemPrompt.protect(protection) + ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { + const result = await next() + result.sections = result.sections.filter(section => section.name !== 'protected') + return result + }) + + const assembly = await ctx.systemPrompt.assemble() + + expect(reads).toBe(1) + expect(assembly.sections).toContainEqual({ name: 'protected', order: 10, text: 'canonical' }) + }) + it('protects canonical absence and rejects an empty protection', async () => { const ctx = new Context() await ctx.plugin(SystemPrompt) diff --git a/packages/core/system-prompt/tests/tool-order.spec.ts b/packages/core/system-prompt/tests/tool-order.spec.ts index 16eff6e354..088c6b70ed 100644 --- a/packages/core/system-prompt/tests/tool-order.spec.ts +++ b/packages/core/system-prompt/tests/tool-order.spec.ts @@ -48,6 +48,100 @@ describe('SystemPrompt tool order', () => { expect(names(await ctx.systemPrompt.assemble())).toEqual(['todo_write', 'echo_a', 'echo_b', 'bash']) }) + it('reads provider schemas once so toolOrder validates the model-visible collection', async () => { + const ctx = await mount({ toolOrder: ['actual', TOOL_ORDER_REST] }) + let reads = 0 + ctx.systemPrompt.tools(() => ({ + get schemas(): ToolSchema[] { + reads += 1 + return reads === 1 ? [tool('actual')] : [tool('phantom')] + }, + })) + + const assembly = await ctx.systemPrompt.assemble() + + expect(reads).toBe(1) + expect(names(assembly)).toEqual(['actual']) + }) + + it('reads each provider schema field once before detaching it', async () => { + const ctx = await mount() + const accepted = { type: 'object', properties: { accepted: { type: 'string' } } } + let reads = 0 + const schema = { + name: 'stable', + description: 'stable', + get parameters(): object { + reads += 1 + return reads === 1 ? accepted : { type: 'object', properties: { drifted: { type: 'number' } } } + }, + } as ToolSchema + ctx.systemPrompt.tools(() => ({ schemas: [schema] })) + + const assembly = await ctx.systemPrompt.assemble() + + expect(reads).toBe(1) + expect(assembly.tools[0]?.parameters).toEqual(accepted) + }) + + it('rejects exotic provider parameters before model-visible assembly', async () => { + const ctx = await mount() + class ExoticParameters { + readonly type = 'object' + readonly properties = { value: { type: 'string' } } + } + ctx.systemPrompt.tools(() => ({ + schemas: [{ + name: 'exotic', + description: 'must not be sanitized', + parameters: new ExoticParameters() as unknown as ToolSchema['parameters'], + }], + })) + + await expect(ctx.systemPrompt.assemble()) + .rejects.toThrow(/parameters must be losslessly JSON-serializable/) + }) + + it('rejects malformed fixed provider fields without freezing caller objects', async () => { + const ctx = await mount() + const badName = { value: 'object-name' } + const badDescription = { value: 'object-description' } + ctx.systemPrompt.tools(() => ({ + schemas: [{ + name: badName as unknown as string, + description: 'bad name', + parameters: {}, + }], + })) + await expect(ctx.systemPrompt.assemble()).rejects.toThrow('name must be a string') + expect(Object.isFrozen(badName)).toBe(false) + + const descriptions = await mount() + descriptions.systemPrompt.tools(() => ({ + schemas: [{ + name: 'bad-description', + description: badDescription as unknown as string, + parameters: {}, + }], + })) + await expect(descriptions.systemPrompt.assemble()).rejects.toThrow('description must be a string') + expect(Object.isFrozen(badDescription)).toBe(false) + + const knownNames = await mount() + knownNames.systemPrompt.tools(() => ({ + schemas: [tool('valid')], + knownNames: [{} as unknown as string], + })) + await expect(knownNames.systemPrompt.assemble()).rejects.toThrow('knownNames must be an array of strings') + + const nonArrayKnownNames = await mount() + nonArrayKnownNames.systemPrompt.tools(() => ({ + schemas: [tool('valid')], + knownNames: 'valid' as unknown as string[], + })) + await expect(nonArrayKnownNames.systemPrompt.assemble()).rejects.toThrow('knownNames must be an array of strings') + }) + it('rejects the assembly when toolOrder names a tool that is not registered (misconfiguration blocks work)', async () => { const ctx = await mount({ toolOrder: ['todo_write', 'ghost', TOOL_ORDER_REST, 'wraith'] }) ctx.systemPrompt.tools(() => ({ schemas: [tool('bash'), tool('todo_write')] })) diff --git a/packages/core/system-prompt/tsconfig.json b/packages/core/system-prompt/tsconfig.json index 91e7bf1ba4..a66ece4854 100644 --- a/packages/core/system-prompt/tsconfig.json +++ b/packages/core/system-prompt/tsconfig.json @@ -22,6 +22,9 @@ }, { "path": "../../core/scope" + }, + { + "path": "../../core/session" } ] } diff --git a/packages/core/tools/README.md b/packages/core/tools/README.md index 2a678408e0..0776ff39f6 100644 --- a/packages/core/tools/README.md +++ b/packages/core/tools/README.md @@ -15,14 +15,14 @@ tools: ### Public API -- `ctx.tools.register(definition: ToolDefinition): () => Promise | void` Register a tool as a frozen snapshot. Parameters must survive lossless-JSON validation before and after cloning; scalar fields are copied, and execute/presentation callbacks are bound once to the original definition as their method receiver, so later callback-property replacement cannot change dispatch. The layer is the CALLING context's scope (`dsh-scope`): a plain plugin context registers globally; an agent's `agent.ctx` registers for that agent alone, SHADOWING a same-named global tool there (per-agent tool variants). Duplicate names within one layer throw; non-native modes also reject the reserved `run_code` transport name. Disposed with the calling fiber (= the agent, for scoped registrations). -- `ctx.tools.restrict(filter: ToolRestriction): () => Promise | void` Scoped-only (throws on a plain context): mask the GLOBAL end-capability surface for the calling agent — `allow` keeps only the listed tools, `deny` removes them; multiple restrictions intersect; scoped registrations bypass restriction as explicit grants. The reserved `run_code` transport remains available automatically and cannot be named explicitly. Snapshot-at-registration, loud unknown-name validation, `restrict({})` rejects (the materialized-empty-config trap). +- `ctx.tools.register(definition: ToolDefinition): () => Promise | void` Register a tool as a frozen snapshot. Every top-level caller field is read once into one coherent acceptance record; `name`/`description` must be strings and `timeoutMs`, when present, must be positive and finite before the snapshot can own them. Parameters are validated and detached by one recursive lossless-JSON traversal, so a stateful getter cannot show one value to a check and another to a prototype-erasing clone. Execute/presentation callbacks are bound once to the original definition as their method receiver, so later caller mutation cannot change the executable definition. The layer is the CALLING context's scope (`dsh-scope`): a plain plugin context registers globally; an agent's `agent.ctx` registers for that agent alone, SHADOWING a same-named global tool there (per-agent tool variants). Duplicate names within one layer throw; non-native modes also reject the reserved `run_code` transport name. Disposed with the calling fiber (= the agent, for scoped registrations). +- `ctx.tools.restrict(filter: ToolRestriction): () => Promise | void` Scoped-only (throws on a plain context): mask the GLOBAL end-capability surface for the calling agent — `allow` keeps only the listed tools, `deny` removes them; multiple restrictions intersect; scoped registrations bypass restriction as explicit grants. The registry reads `allow`/`deny` once, so the values checked for an empty filter and unknown names are exactly the values enforced. The reserved `run_code` transport remains available automatically and cannot be named explicitly. Snapshot-at-registration, loud unknown-name validation, `restrict({})` rejects (the materialized-empty-config trap). - `ctx.tools.get(name: string, scope?: ScopeKey): ToolDefinition | undefined` Resolution as one scope sees it (shadowing applied; a restricted-away global reads as absent) — presenters pass the calling agent so the card matches what executed. Returned definitions are the registry's frozen snapshots. - `ctx.tools.visible(scope?: ScopeKey): ToolDefinition[]` The canonical executable view — restricted global layer ∪ the scope's own layer, plus the reserved transport in non-native modes — feeding prompt assembly, `get`, and `execute`, so presentation and dispatch resolve the same frozen definitions. - `ctx.tools.knownNames(scope?: ScopeKey): string[]` The PRE-restriction end-capability name universe `restrict` validates against: a typo fails loud while a restricted-away tool stays a normal absence. Presentation providers add reserved transport names separately when validating `toolOrder`. - `ctx.tools.schemas(scope?: ScopeKey): ToolSchema[]` Schemas of everything the scope can see (without the `execute` functions). The shipped tools' schemas are catalogued in [docs/tool-catalog.md](../../../docs/tool-catalog.md), generated by booting each tool plugin and harvesting this method (see [the tool-schema-catalog RFC](../../../docs/rfc/implemented/process/2026-07-02-tool-schema-catalog.md)). - `ctx.tools.guard(guard: ToolGuard): () => Promise | void` Register a monotonic synchronous execution guard after `tools/pre-execute`: returning a reason denies the call, while `undefined` leaves it unchanged. A plain-context guard applies globally; an `agent.ctx` guard applies only to that agent. Later waterfall listeners cannot turn a guard denial back into permission. Disposed with the calling fiber. -- `ctx.tools.execute(exec: ToolExecutionInput): Promise` Snapshot one single-use call input into a pipeline-owned execution, assign its opaque correlation token, require `arguments` to be losslessly JSON-serializable before and after cloning, deep-freeze the detached arguments, and protect its identity before running `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`; optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove. Validate the final result as losslessly JSON-serializable and freeze the complete execution before `tools/result` observers run. Invalid or unstable input—including cloneable mutable exotics—and malformed or non-JSON listener/tool results normalize to `isError` outcomes rather than bypassing policy or failing later at the session log. +- `ctx.tools.execute(exec: ToolExecutionInput): Promise` Read each caller-owned top-level field once, snapshot the single-use call into a pipeline-owned execution, assign its opaque correlation token, materialize `arguments` through one lossless-JSON traversal, deep-freeze them, and protect identity before running `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`; optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove. After the required `callId`/`name` correlation identity is captured, the same captured optional fields build the normalized error shell if a later accessor or validation fails, so policy, dispatch, routing, and `tools/result` cannot observe different caller values. Every top-level result field is likewise captured once and the complete result or post-decision is losslessly materialized before final observation. Invalid input—including cloneable mutable exotics—and malformed or non-JSON listener/tool results normalize to `isError` outcomes rather than bypassing policy or failing later at the session log. A throwing `callId` or `name` accessor rejects because no trustworthy result identity exists yet. ### Injected services @@ -77,7 +77,7 @@ ctx.tools.register(defineTool({ })) ``` -The helper converts the author-facing `SchemaSpec` (with `required: true` as a per-property boolean) to standard JSON Schema for the wire format. Raw JSON-Schema tool definitions (from MCP servers) are still accepted by the registry directly. +The helper converts the author-facing `SchemaSpec` (with `required: true` as a per-property boolean) to standard JSON Schema for the wire format. Definition is a snapshot boundary: `defineTool` reads every top-level option once, detaches the schema, and derives both an independent wire schema and every later execute/presentation validation from that accepted snapshot. Stateful accessors or later caller mutation therefore cannot make the schema shown to the model disagree with the schema enforced at runtime. Raw JSON-Schema tool definitions (from MCP servers) are still accepted by the registry directly. A `defineTool` tool also **validates the model-generated arguments against its `SchemaSpec` before `execute` runs** (`validateArgs`). The model's JSON is untrusted — `InferArgs` is a compile-time claim, not a runtime guarantee — so on a mismatch (missing required key, wrong primitive, bad enum member, nested violation) the tool throws a `ToolArgsError` (`code: 'INVALID_ARGS'`); the registry turns it into an `isError` result whose text lists the violations, which the model sees and self-corrects from. Validation mirrors the JSON Schema conversion exactly: extra keys are allowed, `default` is not applied, and an `object`/`array` prop without `properties`/`items` only type-checks. Raw-registered tools (MCP) are **not** validated by the harness — they validate their own input. diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts index 71dd465dd6..b466875c75 100644 --- a/packages/core/tools/src/index.ts +++ b/packages/core/tools/src/index.ts @@ -23,7 +23,7 @@ import type { ScopeKey, Scoped } from '@deepseek-ai/dsh-scope' import type { CallId, ContentBlock, ToolSchema } from '@deepseek-ai/dsh-llm' import { assertNever, deepFreeze, HarnessError } from '@deepseek-ai/dsh-llm' import type { Agent, HookContext } from '@deepseek-ai/dsh-agent' -import { isJsonValue } from '@deepseek-ai/dsh-session' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { ToolProviderResult } from '@deepseek-ai/dsh-system-prompt' import type { CodeRuntime } from '@deepseek-ai/dsh-code-runtime' // Type-only: makes `ctx.get('approval')` resolve to the ApprovalService @@ -275,10 +275,10 @@ export interface ToolExecutionInput { /** * One pending tool call inside the registry pipeline. Call identity, the - * registry-assigned {@link token}, and a lossless-JSON-validated, deep-frozen - * clone of the parsed arguments are immutable from the first policy listener onward, while an - * around-dispatch wrapper may set, replace, or remove only `signal`. The - * registry freezes the complete object before `tools/result` observers run. + * registry-assigned {@link token}, and a deep-frozen lossless-JSON snapshot of + * the parsed arguments are immutable from the first policy listener onward, + * while an around-dispatch wrapper may set, replace, or remove only `signal`. + * The registry freezes the complete object before `tools/result` observers run. */ export interface ToolExecution extends ToolExecutionInput { /** Registry-assigned identity shared with nested calls only as their opaque `parent` token. */ @@ -590,12 +590,13 @@ export class ToolRegistry extends Service { * the shadowing feature, not an error; the global-duplicate message names * `agent.ctx` as the per-agent alternative), or if a non-native mode reserves * the `run_code` name for its presentation transport. The visible schema set - * flows into prompt assembly automatically. Registration validates and - * clones the JSON parameters, copies scalar fields, binds each callback once - * to the caller's definition as its method receiver, and freezes the stored - * snapshot; later mutation or callback replacement on the input object does - * not rewrite the registry. Disposed with the calling fiber. Emits - * `tools/change` on register/unregister. + * flows into prompt assembly automatically. Registration materializes the JSON + * parameters in one pass, copies scalar fields, binds each callback once to the + * caller's definition as its method receiver, and freezes the stored snapshot; + * later mutation or callback replacement on the input object does not rewrite + * the registry. Every top-level field is read once into one coherent acceptance + * snapshot, so stateful accessors cannot make validation and storage use + * different values. Emits `tools/change` on register/unregister. * @param definition - the tool's schema plus its execute (and optional * presentation) functions. * @returns the disposer that unregisters the tool. The exact @@ -604,31 +605,57 @@ export class ToolRegistry extends Service { */ register(definition: ToolDefinition): () => Promise | void { const scope = scopeOf(this.ctx) - // A schema crosses the same model/log boundary as execution arguments. - // Validate BEFORE cloning because structuredClone silently turns some - // forbidden values (for example class instances) into plain records, then - // validate the detached value again to contain hostile getters that change - // between inspection and snapshotting. A frozen Map is still mutable, so - // deepFreeze alone is not a sufficient registration boundary. - if (!isJsonValue(definition.parameters)) { - throw new TypeError('tool parameters must be losslessly JSON-serializable') + // One coherent acceptance snapshot: a caller may expose fields through + // accessors, so every top-level value is read exactly once before any + // validation or binding. Checked parameters and stored parameters must be + // the same reference, and a callback cannot change between lookup/bind. + const name = definition.name + const description = definition.description + const inputParameters = definition.parameters + const timeoutMs = definition.timeoutMs + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputExecute = definition.execute + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputPresentCall = definition.presentCall + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputPresentResult = definition.presentResult + // Reject malformed fixed fields before any caller-owned value can enter the + // frozen snapshot. In particular, a boxed string/object must not become a + // Map key or get recursively frozen as though it were a scalar. + if (typeof name !== 'string') throw new TypeError('tool name must be a string') + if (typeof description !== 'string') throw new TypeError(`tool "${name}" description must be a string`) + if (timeoutMs !== undefined + && (typeof timeoutMs !== 'number' || !Number.isFinite(timeoutMs) || timeoutMs <= 0)) { + throw new TypeError(`tool "${name}" timeoutMs must be a positive finite number`) } - const parameters = structuredClone(definition.parameters) - if (!isJsonValue(parameters)) { - throw new TypeError('tool parameters must be stable losslessly JSON-serializable data') + if (typeof inputExecute !== 'function') throw new TypeError(`tool "${name}" execute must be a function`) + if (inputPresentCall !== undefined && typeof inputPresentCall !== 'function') { + throw new TypeError(`tool "${name}" presentCall must be a function when provided`) + } + if (inputPresentResult !== undefined && typeof inputPresentResult !== 'function') { + throw new TypeError(`tool "${name}" presentResult must be a function when provided`) + } + const execute = inputExecute.bind(definition) + const presentCall = inputPresentCall?.bind(definition) + const presentResult = inputPresentResult?.bind(definition) + // A schema crosses the same model/log boundary as execution arguments. + // Validate and detach it in one traversal: validate-then-structuredClone + // would reread getters and could erase an exotic prototype returned only to + // the clone. A frozen Map is still mutable, so deepFreeze alone is not a + // sufficient registration boundary. + const parameters = snapshotJsonValue(inputParameters) + if (parameters === undefined) { + throw new TypeError('tool parameters must be losslessly JSON-serializable') } // Bind once so replacing a callback on the caller-owned definition after // registration cannot change dispatch, while preserving the historical // method receiver (`this === definition`) for callbacks that use it. - const execute = definition.execute.bind(definition) - const presentCall = definition.presentCall?.bind(definition) - const presentResult = definition.presentResult?.bind(definition) const snapshot: ToolDefinition = deepFreeze({ - name: definition.name, - description: definition.description, + name, + description, parameters, execute, - ...definition.timeoutMs !== undefined ? { timeoutMs: definition.timeoutMs } : {}, + ...timeoutMs !== undefined ? { timeoutMs } : {}, ...presentCall !== undefined ? { presentCall } : {}, ...presentResult !== undefined ? { presentResult } : {}, }) @@ -677,8 +704,9 @@ export class ToolRegistry extends Service { * global tools they mask exist (the agent-creation `setup` window satisfies * this). A non-native mode's reserved `run_code` presentation transport is * not a filterable capability; naming it explicitly throws, while omitting - * it from an allow-list cannot remove it. The filter is SNAPSHOT at - * registration: later caller mutation of the arrays changes nothing. + * it from an allow-list cannot remove it. `allow` and `deny` are each read + * once, then the filter is SNAPSHOT at registration: the values checked are + * the values enforced, and later caller mutation of the arrays changes nothing. * Multiple restrictions compose by intersection. Scoped registrations * bypass restrictions (explicit grants win). Disposed with the calling * fiber (revocable independently); emits `tools/change`. @@ -692,13 +720,19 @@ export class ToolRegistry extends Service { if (scope === undefined) { throw new Error('tools.restrict() requires a scoped context (agent.ctx): a context-global restriction would mask every agent — deny the tool for the intended agent instead') } - if (filter.allow === undefined && filter.deny === undefined) { + // Read each caller-owned accessor once. The same values must decide + // whether the filter is meaningful AND become the enforced snapshot: a + // stateful getter must not pass the no-op check as `allow: []` and then + // disappear when the snapshot is built. + const allow = filter.allow + const deny = filter.deny + if (allow === undefined && deny === undefined) { throw new Error('tools.restrict({}) is a no-op: pass `allow` and/or `deny` (an empty filter is almost always a materialized-empty-config bug)') } // Snapshot BEFORE validation so what was checked is what is enforced. const snapshot: ToolRestriction = { - ...filter.allow !== undefined ? { allow: [...filter.allow] } : {}, - ...filter.deny !== undefined ? { deny: [...filter.deny] } : {}, + ...allow !== undefined ? { allow: [...allow] } : {}, + ...deny !== undefined ? { deny: [...deny] } : {}, } if (this.codeTransport !== undefined && [...snapshot.allow ?? [], ...snapshot.deny ?? []].includes(RUN_CODE_NAME)) { @@ -909,35 +943,62 @@ export class ToolRegistry extends Service { * restricted-away global is exactly as absent as a nonexistent one), the * result is an `isError` carrying a `UNKNOWN_TOOL` structured error. A thrown * {@link HarnessError} surfaces its `{ name, code }` on the result. Before - * the final observe-only notification, the authoritative outcome must survive - * a lossless JSON round trip; an invalid outcome is normalized to an error. + * the final observe-only notification, the authoritative outcome is + * materialized as a detached lossless-JSON snapshot; an invalid outcome is + * normalized to an error. * A malformed runtime/casted `tools/pre-execute` decision likewise normalizes * to an error before approval, guards, or the tool body. - * Caller-owned arguments must survive lossless-JSON validation before and - * after cloning; a violation normalizes to an error before policy or dispatch. - * @param exec - the single-use call input; its identity is snapshotted and - * protected before policy runs. - * @returns the final result after every waterfall; failures resolve as - * `isError` results, never rejections. + * Caller-owned arguments are validated and detached in one recursive + * lossless-JSON traversal; a violation normalizes to an error before policy + * or dispatch. + * @param exec - the single-use call input; every top-level field is read once + * and that identity snapshot is protected before policy runs (and reused by + * the normalized error shell if validation fails). + * @returns the final result after every waterfall. Once the required + * `callId` and `name` correlation identity has been captured, later + * accessor, validation, listener, and tool failures resolve as `isError` + * results rather than rejections. A throwing `callId` or `name` accessor + * rejects because no trustworthy result identity exists yet. */ async execute(exec: ToolExecutionInput): Promise { + // callId/name are the minimum correlation identity needed to construct a + // result at all. Every other caller-controlled accessor is read once + // INSIDE the normalization boundary; if one throws, the error shell uses + // the fields captured before it and never rereads the hostile record. + const callId = exec.callId + const name = exec.name + let agent: Agent | undefined + let parent: ToolExecutionToken | undefined + let signal: AbortSignal | undefined let execution: ToolExecution try { - execution = this.prepareExecution(exec) + agent = exec.agent + parent = exec.parent + signal = exec.signal + const args = exec.arguments + const input: Readonly = Object.freeze({ + callId, + name, + arguments: args, + ...agent !== undefined ? { agent } : {}, + ...parent !== undefined ? { parent } : {}, + ...signal !== undefined ? { signal } : {}, + }) + execution = this.prepareExecution(input) } catch (error: unknown) { - // Contract-violating non-JSON or non-cloneable arguments cannot enter a - // pipeline whose logged and executed forms must agree. Still publish one - // scoped final outcome, using an immutable identity shell, so result - // observers retain their every-call guarantee without seeing the invalid - // value. + // Contract-violating arguments outside the lossless-JSON vocabulary cannot + // enter a pipeline whose logged and executed forms must agree. Still + // publish one scoped final outcome, using an immutable identity shell, so + // result observers retain their every-call guarantee without seeing the + // invalid value. execution = Object.freeze({ token: createExecutionToken(), - callId: exec.callId, - name: exec.name, + callId, + name, arguments: undefined, - ...exec.agent !== undefined ? { agent: exec.agent } : {}, - ...isExecutionToken(exec.parent) ? { parent: exec.parent } : {}, - ...exec.signal !== undefined ? { signal: exec.signal } : {}, + ...agent !== undefined ? { agent } : {}, + ...isExecutionToken(parent) ? { parent } : {}, + ...signal !== undefined ? { signal } : {}, }) const result = toolErrorResult(execution.callId, error) await this.notifyResult(execution, result) @@ -945,11 +1006,11 @@ export class ToolRegistry extends Service { } let result: ToolExecutionResult try { - // Validate the authoritative FINAL result, not merely the tool body's + // Materialize the authoritative FINAL result, not merely the tool body's // intermediate return. Post-policy may replace content or attach context, - // and every one of these fields is session-bound. Reject anything that - // cannot round-trip losslessly through the durable JSON log before the - // observe-only `tools/result` commit point sees success. + // and every one of these fields is session-bound. Reject anything outside + // the lossless-JSON vocabulary before the observe-only `tools/result` + // commit point sees success. result = this.snapshotExecutionResult(execution, await this.executePipeline(execution)) } catch (error: unknown) { // Outer backstop: a throwing pre/post-execute listener, guard, or the @@ -961,17 +1022,14 @@ export class ToolRegistry extends Service { } /** Snapshot one call into a shared pipeline object with immutable identity and mutable cancellation. */ - private prepareExecution(input: ToolExecutionInput): ToolExecution { + private prepareExecution(input: Readonly): ToolExecution { if (input.parent !== undefined && !isExecutionToken(input.parent)) { throw new TypeError('tool execution parent must be a registry-minted opaque token') } - if (!isJsonValue(input.arguments)) { + const args = snapshotJsonValue(input.arguments) + if (args === undefined) { throw new TypeError('tool execution arguments must be losslessly JSON-serializable') } - const args = structuredClone(input.arguments) - if (!isJsonValue(args)) { - throw new TypeError('tool execution arguments must be stable losslessly JSON-serializable data') - } const execution: ToolExecution = { token: createExecutionToken(), callId: input.callId, @@ -1100,10 +1158,13 @@ export class ToolRegistry extends Service { // The pipeline is over: freeze the remaining mutable signal slot so every // observer sees the SAME WeakMap-keyable execution without a mutation race. Object.freeze(exec) - // postExecute clones every accepted result/decision before rebuilding the - // outcome; all error paths construct plain data. The final result is thus - // structurally cloneable before it reaches this observe-only boundary. - const snapshot = deepFreeze(structuredClone(result)) + // Materialize once more at the observer boundary so every listener receives + // the same detached result even when an internal error path constructed it. + const detached = snapshotJsonValue(result) + if (detached === undefined) { + throw new TypeError('tool result notification must be losslessly JSON-serializable') + } + const snapshot = deepFreeze(detached) const callbacks = this.ctx.events.dispatch('parallel', [ scopeTarget(this, exec.agent), 'tools/result', exec, snapshot, ]) @@ -1169,13 +1230,16 @@ export class ToolRegistry extends Service { // authoritative-call-id requirement and the "preserve the dispatched // isError/error" contract. The decision is the ONLY sanctioned channel for a // listener to change the outcome (block, or accept-with-replacement); the - // call id is always the authoritative `exec.callId`. Deep cloning protects - // nested content, error, and meta data from in-place listener mutation. + // call id is always the authoritative `exec.callId`. The one-pass snapshot + // protects nested content, error, and meta from in-place listener mutation. const dispatched = this.snapshotExecutionResult(exec, result) - const decision = structuredClone(await this.ctx.waterfall( + const decision = snapshotJsonValue(await this.ctx.waterfall( scopeTarget(this, exec.agent), 'tools/post-execute', exec, result, () => Promise.resolve({ kind: 'accept' }), )) + if (decision === undefined) { + throw new TypeError('tools/post-execute must return a losslessly JSON-serializable decision') + } this.assertPostDecision(decision) const additionalContext = decision.additionalContext if (decision.kind === 'block') { @@ -1200,31 +1264,36 @@ export class ToolRegistry extends Service { throw new TypeError('tools/execute must return a ToolExecutionResult object') } const result = value as Partial - if (!Array.isArray(result.content) || typeof result.isError !== 'boolean') { + // Capture the provider/listener-owned result exactly once. The same values + // must pass shape/correlation checks and become the detached final outcome; + // a stateful accessor cannot validate one result and publish another. + const callId = result.callId + const content = result.content + const isError = result.isError + const error = result.error + const additionalContext = result.additionalContext + const meta = result.meta + if (!Array.isArray(content) || typeof isError !== 'boolean') { throw new TypeError('tools/execute must return a ToolExecutionResult with content[] and boolean isError') } - if (result.callId !== exec.callId) { - throw new TypeError(`tools/execute returned callId "${String(result.callId)}" for authoritative call "${exec.callId}"`) + if (callId !== exec.callId) { + throw new TypeError(`tools/execute returned callId "${String(callId)}" for authoritative call "${exec.callId}"`) } const candidate = { callId: exec.callId, - content: result.content, - isError: result.isError, - ...result.error !== undefined ? { error: result.error } : {}, - ...result.additionalContext !== undefined ? { additionalContext: result.additionalContext } : {}, - ...result.meta !== undefined ? { meta: result.meta } : {}, + content, + isError, + ...error !== undefined ? { error } : {}, + ...additionalContext !== undefined ? { additionalContext } : {}, + ...meta !== undefined ? { meta } : {}, } - // Validate BEFORE cloning: structuredClone turns some forbidden exotic or - // class instances into plain objects, which would hide a lossy JSON - // boundary violation. Validate the detached clone again to contain hostile - // getters whose value changes between inspection and snapshotting. - if (!isJsonValue(candidate)) { + // One traversal both validates and detaches the accepted result. A separate + // check followed by structuredClone would reread getters and could sanitize + // a class instance into an apparently valid plain record. + const snapshot = snapshotJsonValue(candidate) + if (snapshot === undefined) { throw new TypeError('tools/execute must return a losslessly JSON-serializable ToolExecutionResult') } - const snapshot = structuredClone(candidate) - if (!isJsonValue(snapshot)) { - throw new TypeError('tools/execute must return a stable losslessly JSON-serializable ToolExecutionResult') - } return snapshot } diff --git a/packages/core/tools/src/schema.ts b/packages/core/tools/src/schema.ts index 1a428ffd40..add9c29e61 100644 --- a/packages/core/tools/src/schema.ts +++ b/packages/core/tools/src/schema.ts @@ -20,6 +20,7 @@ */ import { assertNever, HarnessError } from '@deepseek-ai/dsh-llm' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { ToolDefinition, ToolExecuteReturn, ToolExecution, ToolResult } from './index.ts' import type { ToolCallView, ToolResultView } from './presentation.ts' @@ -353,6 +354,12 @@ export interface DefineToolOptions { * Raw JSON-Schema tool definitions (from MCP servers) are still accepted * by `ToolRegistry.register()` directly — `defineTool` is sugar for * first-party plugin authors. + * + * Definition is an acceptance boundary: every top-level option is read once, + * and the parameter spec is detached before either the wire schema or the + * runtime validators are built. Later mutation of the caller's options or + * schema therefore cannot make the model-visible schema disagree with execute + * or presentation validation. * @param options - the tool's name, description, typed parameter schema, * execute body, and optional presenters. * @returns a registry-ready {@link ToolDefinition}: its `execute` validates the @@ -362,6 +369,13 @@ export interface DefineToolOptions { * args). */ export function defineTool(options: DefineToolOptions): ToolDefinition { + // Capture every caller-owned top-level field before inspecting any nested + // schema value. Accessors may be stateful, so validation, presentation, and + // the returned definition must all derive from this one accepted record. + const name = options.name + const description = options.description + const inputParameters = options.parameters + const timeoutMs = options.timeoutMs // Object-literal execute methods don't use `this`; the reference is safe. // eslint-disable-next-line @typescript-eslint/unbound-method const userExecute = options.execute @@ -369,20 +383,31 @@ export function defineTool(options: DefineToolOptions): const userPresentCall = options.presentCall // eslint-disable-next-line @typescript-eslint/unbound-method const userPresentResult = options.presentResult - if (options.timeoutMs !== undefined && (!Number.isFinite(options.timeoutMs) || options.timeoutMs <= 0)) { - throw new Error(`defineTool(${options.name}): timeoutMs must be a positive finite number`) + if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) { + throw new Error(`defineTool(${name}): timeoutMs must be a positive finite number`) + } + // The internal SchemaSpec and public wire schema must not share mutable + // subobjects. Each is materialized through the lossless one-pass boundary; + // structuredClone alone could sanitize an exotic default or nested getter. + const parameterSpec = snapshotJsonValue(inputParameters) + if (parameterSpec === undefined) { + throw new Error(`defineTool(${name}): parameters must be losslessly JSON-serializable`) + } + const wireParameters = snapshotJsonValue(schemaSpecToJsonSchema(parameterSpec)) + if (wireParameters === undefined) { + throw new Error(`defineTool(${name}): generated parameters must be losslessly JSON-serializable`) } const tool: ToolDefinition = { - name: options.name, - description: options.description, - parameters: schemaSpecToJsonSchema(options.parameters) as unknown as Record, - ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}), + name, + description, + parameters: wireParameters as unknown as Record, + ...(timeoutMs !== undefined ? { timeoutMs } : {}), async execute(args: unknown, exec: ToolExecution): Promise { // Validate the model-generated args before the typed body runs. On // mismatch we throw ToolArgsError; the registry turns it into an // isError result so the model can self-correct. After this guard, the // cast to InferArgs reflects the validated shape. - const violations = validateArgs(options.parameters, args) + const violations = validateArgs(parameterSpec, args) if (violations.length > 0) throw new ToolArgsError(violations) return userExecute(args as InferArgs, exec) }, @@ -393,13 +418,13 @@ export function defineTool(options: DefineToolOptions): // than the hard `ToolArgsError` the execute path raises. if (userPresentCall) { tool.presentCall = (args: unknown): ToolCallView | undefined => { - if (validateArgs(options.parameters, args).length > 0) return undefined + if (validateArgs(parameterSpec, args).length > 0) return undefined return userPresentCall(args as InferArgs) } } if (userPresentResult) { tool.presentResult = (args: unknown, result: ToolResult): ToolResultView | undefined => { - if (validateArgs(options.parameters, args).length > 0) return undefined + if (validateArgs(parameterSpec, args).length > 0) return undefined return userPresentResult(args as InferArgs, result) } } diff --git a/packages/core/tools/tests/scoped.spec.ts b/packages/core/tools/tests/scoped.spec.ts index cac4a7e29b..ea4ef57ddd 100644 --- a/packages/core/tools/tests/scoped.spec.ts +++ b/packages/core/tools/tests/scoped.spec.ts @@ -4,7 +4,7 @@ import { createScope } from '@deepseek-ai/dsh-scope' import type { Scope } from '@deepseek-ai/dsh-scope' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry from '@deepseek-ai/dsh-tools' -import type { PreToolDecision, ToolDefinition, ToolExecution, ToolExecutionToken } from '@deepseek-ai/dsh-tools' +import type { PreToolDecision, ToolDefinition, ToolExecution, ToolExecutionInput, ToolExecutionToken, ToolRestriction } from '@deepseek-ai/dsh-tools' import type { Agent, AgentId } from '@deepseek-ai/dsh-agent' import { CallId } from '@deepseek-ai/dsh-llm' import type { ContentBlock } from '@deepseek-ai/dsh-llm' @@ -141,6 +141,25 @@ describe('restrict()', () => { expect(ctx.tools.schemas(key).map(t => t.name)).toEqual(['b']) }) + it('reads restriction accessors once so the checked filter is the enforced filter', async () => { + const ctx = await mount() + const { scope, key } = await mintAgentScope(ctx, 'a') + ctx.tools.register(tool('global')) + let allowReads = 0 + const filter = { + get allow(): string[] | undefined { + allowReads += 1 + return allowReads === 1 ? [] : undefined + }, + } as ToolRestriction + + scope.ctx.tools.restrict(filter) + + expect(allowReads).toBe(1) + expect(ctx.tools.schemas(key)).toEqual([]) + expect(await run(ctx, 'global', key)).toBe('Error: unknown tool "global"') + }) + it('fails loud on an unscoped call, an empty filter, and unknown names', async () => { const ctx = await mount() const { scope } = await mintAgentScope(ctx, 'a') @@ -372,6 +391,116 @@ describe('scoped execution dispatch', () => { expect(Object.isFrozen(forged)).toBe(false) }) + it('reads a stateful parent accessor once before policy, dispatch, and result observation', async () => { + const ctx = await mount() + const observed: (ToolExecutionToken | undefined)[] = [] + ctx.tools.register({ + ...tool('t'), + execute: (_args, exec) => { + observed.push(exec.parent) + return Promise.resolve([{ type: 'text', text: 'ran:t' }]) + }, + }) + ctx.on('tools/pre-execute', (exec, next) => { + observed.push(exec.parent) + return next() + }) + ctx.on('tools/execute', (exec, next) => { + observed.push(exec.parent) + return next() + }) + ctx.on('tools/result', (exec) => { observed.push(exec.parent) }) + const forged = { fake: true } as unknown as ToolExecutionToken + let parentReads = 0 + const input = { + callId: CallId('stateful-parent'), + name: 't', + arguments: {}, + get parent(): ToolExecutionToken | undefined { + parentReads += 1 + return parentReads === 1 ? undefined : forged + }, + } as ToolExecutionInput + + const result = await ctx.tools.execute(input) + + expect(result.isError).toBe(false) + expect(parentReads).toBe(1) + expect(observed).toEqual([undefined, undefined, undefined, undefined]) + }) + + it('uses one input snapshot for the normalized error shell', async () => { + const ctx = await mount() + const { scope, key } = await mintAgentScope(ctx, 'accepted') + const driftAgent = { id: 'drift' as AgentId } as Agent + ctx.tools.register(tool('parent')) + ctx.tools.register(tool('t')) + let parent!: ToolExecutionToken + const stopCapture = ctx.on('tools/pre-execute', (exec, next) => { + if (exec.name === 'parent') parent = exec.token + return next() + }) + await ctx.tools.execute({ callId: CallId('parent'), name: 'parent', arguments: {} }) + stopCapture() + const acceptedSignal = new AbortController().signal + const driftSignal = new AbortController().signal + const forged = { fake: true } as unknown as ToolExecutionToken + const reads = { callId: 0, name: 0, arguments: 0, agent: 0, parent: 0, signal: 0 } + const input = { + get callId() { reads.callId += 1; return CallId('unstable-error') }, + get name() { reads.name += 1; return 't' }, + get arguments(): unknown { reads.arguments += 1; return { invalid: () => undefined } }, + get agent() { reads.agent += 1; return reads.agent === 1 ? key : driftAgent }, + get parent() { reads.parent += 1; return reads.parent <= 2 ? parent : forged }, + get signal() { reads.signal += 1; return reads.signal === 1 ? acceptedSignal : driftSignal }, + } as ToolExecutionInput + let observed: Readonly | undefined + let scopedObserved = 0 + ctx.on('tools/result', (exec) => { observed = exec }) + scope.ctx.on('tools/result', () => { scopedObserved += 1 }) + + const result = await ctx.tools.execute(input) + + expect(result.isError).toBe(true) + expect(reads).toEqual({ callId: 1, name: 1, arguments: 1, agent: 1, parent: 1, signal: 1 }) + expect(scopedObserved).toBe(1) + expect(observed).toMatchObject({ + callId: CallId('unstable-error'), + name: 't', + agent: key, + parent, + signal: acceptedSignal, + }) + expect(Object.isFrozen(observed)).toBe(true) + }) + + it('normalizes a throwing arguments accessor without rereading it or losing the final notification', async () => { + const ctx = await mount() + ctx.tools.register(tool('t')) + let argumentReads = 0 + let observed = 0 + ctx.on('tools/result', (exec, result) => { + observed += 1 + expect(exec.arguments).toBeUndefined() + expect(result.isError).toBe(true) + }) + const input = { + callId: CallId('throwing-arguments'), + name: 't', + get arguments(): unknown { + argumentReads += 1 + throw new Error('getter exploded') + }, + } as ToolExecutionInput + + const result = await ctx.tools.execute(input) + + expect(result.isError).toBe(true) + expect(result.content).toEqual([{ type: 'text', text: 'Error: getter exploded' }]) + expect(argumentReads).toBe(1) + expect(observed).toBe(1) + }) + it.each([ ['Map', new Map([['mutable', true]])], ['class instance', new (class Arguments { value = 1 })()], @@ -408,7 +537,7 @@ describe('scoped execution dispatch', () => { expect({ policyCalls, bodyCalls, observed }).toEqual({ policyCalls: 0, bodyCalls: 0, observed: 1 }) }) - it('rejects arguments that change to non-JSON data while being snapshotted', async () => { + it('reads nested arguments once into the executed snapshot', async () => { const ctx = await mount() ctx.tools.register(tool('t')) let reads = 0 @@ -421,12 +550,11 @@ describe('scoped execution dispatch', () => { callId: CallId('unstable-arguments'), name: 't', arguments: argumentsValue, }) + expect(reads).toBe(1) expect(result).toEqual({ callId: CallId('unstable-arguments'), - content: [{ - type: 'text', text: 'Error: tool execution arguments must be stable losslessly JSON-serializable data', - }], - isError: true, + content: [{ type: 'text', text: 'ran:t' }], + isError: false, }) }) diff --git a/packages/core/tools/tests/tools.spec.ts b/packages/core/tools/tests/tools.spec.ts index deb53b7dc7..5bff94c960 100644 --- a/packages/core/tools/tests/tools.spec.ts +++ b/packages/core/tools/tests/tools.spec.ts @@ -6,8 +6,8 @@ import type { Agent } from '@deepseek-ai/dsh-agent' import ApprovalService, { type ApprovalOutcome, type ApprovalRequest } from '@deepseek-ai/dsh-user-approval' import ToolRegistry, { defineTool, schemaSpecToJsonSchema, validateArgs, ToolArgsError, ToolNotFoundError, - type InferArgs, type SchemaSpec, type PreToolDecision, type PostToolDecision, - type ToolExecution, type ToolExecutionResult, type ToolGuard, + type DefineToolOptions, type InferArgs, type SchemaSpec, type PreToolDecision, type PostToolDecision, + type ToolDefinition, type ToolExecution, type ToolExecutionResult, type ToolGuard, } from '@deepseek-ai/dsh-tools' async function setup() { @@ -135,7 +135,7 @@ describe('ToolRegistry', () => { expect(observedError).toBe(true) }) - it('normalizes a result that changes to non-JSON data while being snapshotted', async () => { + it('reads each result value once so later getter drift cannot change the snapshot', async () => { const ctx = await setup() ctx.tools.register(echoTool) let reads = 0 @@ -153,15 +153,59 @@ describe('ToolRegistry', () => { callId: CallId('unstable-result'), name: 'echo', arguments: {}, }) + expect(reads).toBe(1) expect(result).toEqual({ callId: CallId('unstable-result'), - content: [{ - type: 'text', text: 'Error: tools/execute must return a stable losslessly JSON-serializable ToolExecutionResult', - }], - isError: true, + content: [{ type: 'text', text: 'safe' }], + isError: false, }) }) + it('reads every top-level execution result field once before validation', async () => { + const ctx = await setup() + ctx.tools.register(echoTool) + const reads = { callId: 0, content: 0, isError: 0, error: 0, additionalContext: 0, meta: 0 } + ctx.on('tools/execute', async exec => Object.defineProperties({}, { + callId: { enumerable: true, get: () => { reads.callId += 1; return reads.callId === 1 ? exec.callId : CallId('drifted') } }, + content: { enumerable: true, get: () => { reads.content += 1; return reads.content === 1 ? [{ type: 'text', text: 'accepted' }] : [] } }, + isError: { enumerable: true, get: () => { reads.isError += 1; return reads.isError !== 1 } }, + error: { enumerable: true, get: () => { reads.error += 1; return undefined } }, + additionalContext: { enumerable: true, get: () => { reads.additionalContext += 1; return undefined } }, + meta: { enumerable: true, get: () => { reads.meta += 1; return undefined } }, + }) as ToolExecutionResult) + + const result = await ctx.tools.execute({ + callId: CallId('one-read-result'), name: 'echo', arguments: {}, + }) + + expect(reads).toEqual({ callId: 1, content: 1, isError: 1, error: 1, additionalContext: 1, meta: 1 }) + expect(result).toEqual({ + callId: CallId('one-read-result'), + content: [{ type: 'text', text: 'accepted' }], + isError: false, + }) + }) + + it('rejects an exotic nested result before its prototype can be sanitized', async () => { + const ctx = await setup() + ctx.tools.register(echoTool) + class ExoticText { readonly value = 'not text' } + ctx.on('tools/execute', exec => Promise.resolve({ + callId: exec.callId, + content: [{ type: 'text', text: new ExoticText() }], + isError: false, + } as unknown as ToolExecutionResult)) + + const result = await ctx.tools.execute({ + callId: CallId('exotic-result'), name: 'echo', arguments: {}, + }) + + expect(result.isError).toBe(true) + expect(result.content).toEqual([{ + type: 'text', text: 'Error: tools/execute must return a losslessly JSON-serializable ToolExecutionResult', + }]) + }) + it('returns isError results for unknown tools and throwing tools', async () => { const ctx = await setup() ctx.tools.register({ @@ -729,6 +773,29 @@ describe('ToolRegistry', () => { expect(observedError).toBe(true) }) + it('rejects non-JSON data at the defensive final-result notification boundary', async () => { + const ctx = await setup() + ctx.tools.register(echoTool) + let execution: ToolExecution | undefined + ctx.on('tools/execute', async (exec, next) => { + execution = exec + return next() + }) + await ctx.tools.execute({ callId: CallId('capture-execution'), name: 'echo', arguments: {} }) + if (execution === undefined) throw new Error('test fixture did not capture the execution') + + const internal = ctx.tools as unknown as { + notifyResult(exec: ToolExecution, result: ToolExecutionResult): Promise + } + const invalid = { + callId: CallId('capture-execution'), + content: new Map() as unknown as ToolExecutionResult['content'], + isError: false, + } + await expect(internal.notifyResult(execution, invalid)) + .rejects.toThrow('tool result notification must be losslessly JSON-serializable') + }) + it.each([ { name: 'non-object result', @@ -780,6 +847,11 @@ describe('ToolRegistry', () => { replacement: { kind: 'defer' }, message: 'tools/post-execute must return an accept or block decision', }, + { + name: 'non-JSON decision', + replacement: { kind: 'accept', content: new Map() }, + message: 'tools/post-execute must return a losslessly JSON-serializable decision', + }, ])('normalizes a tools/post-execute $name', async ({ replacement, message }) => { const ctx = await setup() ctx.tools.register(echoTool) @@ -886,7 +958,7 @@ describe('ToolRegistry', () => { expect(ctx.tools.get('invalid-parameters')).toBeUndefined() }) - it('rejects tool parameters that change to non-JSON data while being snapshotted', async () => { + it('reads nested tool parameters once into the accepted snapshot', async () => { const ctx = await setup() let reads = 0 const parameters = Object.defineProperty({}, 'properties', { @@ -898,8 +970,58 @@ describe('ToolRegistry', () => { ...echoTool, name: 'unstable-parameters', parameters, - })).toThrow('tool parameters must be stable losslessly JSON-serializable data') - expect(ctx.tools.get('unstable-parameters')).toBeUndefined() + })).not.toThrow() + expect(reads).toBe(1) + expect(ctx.tools.get('unstable-parameters')?.parameters).toEqual({ properties: {} }) + }) + + it('reads a top-level parameters accessor once so validation and storage use one value', async () => { + const ctx = await setup() + const accepted = { type: 'object', properties: { accepted: { type: 'string' } } } + class DriftedParameters { + readonly type = 'object' + readonly properties = { drifted: { type: 'number' } } + } + let reads = 0 + const definition = { ...echoTool, name: 'top-level-parameters' } + Object.defineProperty(definition, 'parameters', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? accepted : new DriftedParameters() + }, + }) + + ctx.tools.register(definition) + + expect(reads).toBe(1) + expect(ctx.tools.get('top-level-parameters')?.parameters).toEqual(accepted) + }) + + it('rejects malformed fixed definition fields without freezing caller objects', async () => { + const ctx = await setup() + const badName = { value: 'object-name' } + const badDescription = { value: 'object-description' } + const badTimeout = { value: 100 } + + expect(() => ctx.tools.register({ ...echoTool, name: badName as unknown as string })) + .toThrow('tool name must be a string') + expect(() => ctx.tools.register({ ...echoTool, name: 'bad-description', description: badDescription as unknown as string })) + .toThrow('description must be a string') + expect(() => ctx.tools.register({ ...echoTool, name: 'bad-timeout', timeoutMs: badTimeout as unknown as number })) + .toThrow('timeoutMs must be a positive finite number') + expect(() => ctx.tools.register({ ...echoTool, name: 'zero-timeout', timeoutMs: 0 })) + .toThrow('timeoutMs must be a positive finite number') + expect(() => ctx.tools.register({ ...echoTool, name: 'bad-execute', execute: { bind() {} } as unknown as typeof echoTool.execute })) + .toThrow('execute must be a function') + expect(() => ctx.tools.register({ ...echoTool, name: 'bad-present-call', presentCall: 1 as unknown as NonNullable })) + .toThrow('presentCall must be a function') + expect(() => ctx.tools.register({ ...echoTool, name: 'bad-present-result', presentResult: 1 as unknown as NonNullable })) + .toThrow('presentResult must be a function') + expect(Object.isFrozen(badName)).toBe(false) + expect(Object.isFrozen(badDescription)).toBe(false) + expect(Object.isFrozen(badTimeout)).toBe(false) + expect(ctx.tools.schemas()).toEqual([]) }) it('snapshots callbacks while preserving their registration-time method receiver', async () => { @@ -1094,6 +1216,101 @@ describe('defineTool / schema DSL', () => { expect(result.content).toEqual([{ type: 'text', text: 'HELLO' }]) }) + it('reads defineTool options once and keeps wire and runtime schemas on one detached snapshot', async () => { + const accepted: SchemaSpec = { value: { type: 'string', required: true, enum: ['accepted'] } } + const drifted: SchemaSpec = { count: { type: 'number', required: true } } + const reads = { + name: 0, + description: 0, + parameters: 0, + timeoutMs: 0, + execute: 0, + presentCall: 0, + presentResult: 0, + } + const options = {} as DefineToolOptions + Object.defineProperties(options, { + name: { enumerable: true, get: () => { reads.name += 1; return reads.name === 1 ? 'accepted' : 'drifted' } }, + description: { enumerable: true, get: () => { reads.description += 1; return reads.description === 1 ? 'accepted description' : 'drifted description' } }, + parameters: { enumerable: true, get: () => { reads.parameters += 1; return reads.parameters === 1 ? accepted : drifted } }, + timeoutMs: { enumerable: true, get: () => { reads.timeoutMs += 1; return reads.timeoutMs === 1 ? 250 : 0 } }, + execute: { + enumerable: true, + get: () => { + reads.execute += 1 + return (args: Record) => Promise.resolve([{ type: 'text' as const, text: String(args['value']) }]) + }, + }, + presentCall: { + enumerable: true, + get: () => { + reads.presentCall += 1 + return (args: Record) => ({ card: 'generic' as const, title: String(args['value']) }) + }, + }, + presentResult: { + enumerable: true, + get: () => { + reads.presentResult += 1 + return (args: Record) => ({ card: 'generic' as const, title: String(args['value']) }) + }, + }, + }) + + const tool = defineTool(options) + accepted.value!.type = 'number' + accepted.value!.enum!.push('mutated') + + expect(tool).toMatchObject({ + name: 'accepted', + description: 'accepted description', + timeoutMs: 250, + parameters: { + type: 'object', + properties: { value: { type: 'string', enum: ['accepted'] } }, + required: ['value'], + }, + }) + await expect(tool.execute({ value: 'accepted' }, {} as ToolExecution)) + .resolves.toEqual([{ type: 'text', text: 'accepted' }]) + expect(tool.presentCall?.({ value: 'accepted' })).toEqual({ card: 'generic', title: 'accepted' }) + expect(tool.presentResult?.( + { value: 'accepted' }, + { content: [], isError: false }, + )).toEqual({ card: 'generic', title: 'accepted' }) + expect(reads).toEqual({ + name: 1, + description: 1, + parameters: 1, + timeoutMs: 1, + execute: 1, + presentCall: 1, + presentResult: 1, + }) + }) + + it('rejects an exotic defineTool schema before it can be normalized for the wire', () => { + class ExoticDefault { readonly value = 'not JSON' } + + expect(() => defineTool({ + name: 'exotic-schema', + description: 'must reject exotic defaults', + parameters: { + value: { type: 'string', default: new ExoticDefault() }, + }, + execute: () => Promise.resolve([]), + })).toThrow(/parameters must be losslessly JSON-serializable/) + }) + + it('rejects a malformed defineTool spec whose generated wire schema is not JSON', () => { + expect(() => defineTool({ + name: 'malformed-schema', + description: 'missing property type', + parameters: { value: {} } as unknown as SchemaSpec, + execute: () => Promise.resolve([]), + })).toThrow(/generated parameters must be losslessly JSON-serializable/) + }) + it('type-level: InferArgs maps required properties to non-optional', () => { // Compile-time check: if this compiles, InferArgs is correct. // args.a is string (required), args.b is number|undefined (optional). diff --git a/packages/session-persistence/session-persistence-jsonl/README.md b/packages/session-persistence/session-persistence-jsonl/README.md index 9a76381614..990ad2fcc4 100644 --- a/packages/session-persistence/session-persistence-jsonl/README.md +++ b/packages/session-persistence/session-persistence-jsonl/README.md @@ -29,4 +29,4 @@ The JSONL durable session-persistence backend — a concrete `SessionPersistence ## Write path -The plugin generalizes the example `session-jsonl.ts`: it subscribes to `session/created` (capture the header; persist a fork's seed once), `session/event` (snapshot each event when buffering — the live `session.events` object is mutable), and `session/flush`/dispose (drain the write-behind buffer through `append`). A per-session write cursor means a resumed session never re-appends already-stored events. Existing live sessions are seeded on plugin apply (HMR does not replay `session/created`). All backend operations for one session are serialized, and disposal awaits quiescence (every init + final drain) before returning, so no write lands after teardown. +The plugin generalizes the example `session-jsonl.ts`: it subscribes to `session/created` (capture the header; persist a fork's seed once), `session/event` (copy each already-frozen event into the persistence-owned write-behind buffer), and `session/flush`/dispose (drain that buffer through `append`). A per-session write cursor means a resumed session never re-appends already-stored events. Existing live sessions are seeded on plugin apply (HMR does not replay `session/created`). All backend operations for one session are serialized, and disposal awaits quiescence (every init + final drain) before returning, so no write lands after teardown. diff --git a/packages/session-persistence/session-persistence-sqlite/README.md b/packages/session-persistence/session-persistence-sqlite/README.md index c14d3a70ea..082b60af88 100644 --- a/packages/session-persistence/session-persistence-sqlite/README.md +++ b/packages/session-persistence/session-persistence-sqlite/README.md @@ -27,4 +27,4 @@ interface Config { ## Write path -Like the JSONL backend, the plugin also installs the `session/event` → buffer → `session/flush` drain: it snapshots each event when buffered (the live `session.events` object is mutable), persists a fork's seed once on `session/created`, keeps a per-session write cursor so a resumed session never re-appends stored events, and seeds existing live sessions on apply (HMR does not replay `session/created`). Dispose awaits every in-flight init + final drain and then closes the database, so no write lands after teardown. +Like the JSONL backend, the plugin also installs the `session/event` → buffer → `session/flush` drain: it copies each already-frozen event into a persistence-owned buffer, persists a fork's seed once on `session/created`, keeps a per-session write cursor so a resumed session never re-appends stored events, and seeds existing live sessions on apply (HMR does not replay `session/created`). Dispose awaits every in-flight init + final drain and then closes the database, so no write lands after teardown. diff --git a/packages/session-persistence/session-persistence/README.md b/packages/session-persistence/session-persistence/README.md index 8bd3fed568..bf7da03757 100644 --- a/packages/session-persistence/session-persistence/README.md +++ b/packages/session-persistence/session-persistence/README.md @@ -17,7 +17,7 @@ The persisted unit IS the existing `SessionEvent` (event-sourced model — the l - **Append-only; a crashed turn is closed, not truncated.** Committed events (at or below a flushed `turn/end`) are never rewritten. A crash can leave an unclosed final turn whose events are real and possibly large; `load` preserves them and durably appends synthetic closers (an error `tool/result` per unanswered `tool-call`, then `step/end?`+`turn/end {interrupted}`) to balance the log and keep the rehydrated history a valid provider transcript. Only a never-fully-written torn tail fragment is discarded. - **Contiguous seq.** `load` rejects a `seq` gap/parse error in the MIDDLE of the log; `append`'s first `seq` must equal the stored next-seq. -- **JSON-serializable data.** `append` rejects non-serializable `event.data`; backends snapshot each event when buffering (the live `session.events` object is mutable). +- **JSON-serializable data.** `append` materializes each direct/replay batch through the shared one-pass lossless-JSON boundary. Live `Session` events are already deep-frozen, but the write coordinator still copies each event into a persistence-owned buffer. - **Durability.** `append` returns only once the batch is durable. ## The write coordinator diff --git a/packages/session-persistence/session-persistence/src/coordinator.ts b/packages/session-persistence/session-persistence/src/coordinator.ts index 0180999842..b1fc118a21 100644 --- a/packages/session-persistence/session-persistence/src/coordinator.ts +++ b/packages/session-persistence/session-persistence/src/coordinator.ts @@ -25,9 +25,9 @@ */ import { Context } from 'cordis' -import { interruptedTurnClosers, SESSION_FORMAT_VERSION } from '@deepseek-ai/dsh-session' +import { interruptedTurnClosers, SESSION_FORMAT_VERSION, snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { Session, SessionEvent, SessionId, SessionHeader } from '@deepseek-ai/dsh-session' -import { assertSerializable, seedCoversPrefix } from './index.ts' +import { seedCoversPrefix } from './index.ts' /** * A stored session's durable prefix as read back from a backend: its @@ -186,14 +186,18 @@ export class PersistenceCoordinator { /** * Register a new session's metadata (lazy: no physical write until the first * {@link append}). Rejects if the id is already tracked or already persisted. - * @param meta - the immutable header (id, version, cwd, lineage) to record; snapshotted at call time. + * @param meta - the header (id, version, cwd, lineage) to record; materialized + * as a detached lossless-JSON snapshot at call time. */ create(meta: SessionHeader): Promise { // Snapshot the metadata at call time: the op runs later (behind the // per-session chain) and the snapshot is stored as the lazy state, so keeping // the caller's object by reference would let a later mutation of `id`/`cwd` // register under one key but materialize under a different path/header. - const snapshot: SessionHeader = { ...meta } + const snapshot = snapshotJsonValue(meta) + if (snapshot === undefined) { + return Promise.reject(new TypeError('session metadata must be losslessly JSON-serializable')) + } return this.serialize(snapshot.id, () => this.createCore(snapshot)) } @@ -212,23 +216,25 @@ export class PersistenceCoordinator { this.states.set(meta.id, { meta, cursor: 0, materialized: false }) } - // `async` so the synchronous validate/clone below reject (not throw) per the - // Promise contract — callers use `await expect(...).rejects`. + // `async` so synchronous materialization failures below reject (not throw) per + // the Promise contract — callers use `await expect(...).rejects`. /** * Durably persist a batch of events. Honors the append-only and contiguous-seq * contracts; rejects non-JSON-serializable `event.data`. * @param id - the session the batch belongs to. - * @param events - the contiguous batch to persist, in seq order; deep-cloned at call time. + * @param events - the contiguous batch to persist, in seq order; materialized + * as a detached lossless-JSON snapshot at call time. */ async append(id: SessionId, events: readonly SessionEvent[]): Promise { - // Validate serializability BEFORE cloning so a bad event surfaces the typed - // error rather than an opaque DataCloneError from structuredClone. - assertSerializable(events) - // Deep-snapshot the batch HERE, before the op waits behind the per-session - // chain: a caller that mutates a live array (e.g. session.events) — or an - // event inside it — before the op runs would otherwise have those changes - // persisted. The clone is taken synchronously (at call time). - const batch = events.map(e => structuredClone(e)) + // Validate and deep-snapshot the complete batch HERE, in one traversal, + // before the op waits behind the per-session chain. A check followed by + // structuredClone would reread accessors and could sanitize an exotic value + // into an apparently valid record; the single-pass materializer makes the + // checked value exactly the value persisted. + const batch = snapshotJsonValue(events) + if (batch === undefined) { + throw new TypeError('session event batch is not losslessly JSON-serializable because it contains non-JSON-serializable data') + } return this.serialize(id, () => this.appendCore(id, batch)) } @@ -338,9 +344,10 @@ export class PersistenceCoordinator { // promise so flush/dispose can await it (onCreated is async). ctx.on('session/created', (session) => { void this.initFor(session) }) - // Snapshot + buffer every event (the live object is mutable; clone so a later - // in-place mutation cannot rewrite a buffered event). Serializability is - // guaranteed at the source (Session.append), so structuredClone is safe. + // Session emits an owned frozen event. Keep a persistence-owned copy anyway + // so the write-behind queue owns exactly the record it will flush rather than + // retaining a product-layer record by identity. Serializability is guaranteed + // at the source, so structuredClone is safe. ctx.on('session/event', (session, event) => { let buffer = this.buffers.get(session) if (!buffer) this.buffers.set(session, buffer = []) @@ -391,8 +398,8 @@ export class PersistenceCoordinator { const existing = this.inits.get(session) if (existing) return existing // Snapshot the seed SYNCHRONOUSLY — initFor runs inside the `session/created` - // emit, before any later `append` adds non-seed events. A clone freezes it - // against later mutation of the live event objects. + // emit, before any later append invalidates the public array snapshot. Events + // are already frozen; cloning gives persistence independent ownership. const seed = session.events.map(e => structuredClone(e)) const p = this.onCreated(session, seed) // Attach a no-op rejection handler so a failing init does not surface as an diff --git a/packages/session-persistence/session-persistence/src/index.ts b/packages/session-persistence/session-persistence/src/index.ts index 1588ed2526..b03691d17b 100644 --- a/packages/session-persistence/session-persistence/src/index.ts +++ b/packages/session-persistence/session-persistence/src/index.ts @@ -22,7 +22,7 @@ */ import { Context, Service } from 'cordis' -import { isJsonValue } from '@deepseek-ai/dsh-session' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { SessionEvent, SessionId, SessionHeader } from '@deepseek-ai/dsh-session' // Re-export the metadata vocabulary so consumers import it from the seam. @@ -58,16 +58,16 @@ export function seedCoversPrefix(seed: readonly SessionEvent[], prefix: readonly } /** - * Reject non-JSON-serializable event data before a backend serializes a batch. - * Live session appends already enforce this; persistence append paths also - * accept replay/fork batches that may bypass a live session instance. - * @param events - the batch to validate; throws naming the offending event's type and seq. + * Reject a batch that is not wholly losslessly JSON-serializable. Live session + * appends already enforce this; persistence append paths also accept replay or + * direct batches that may bypass a live session instance. Validation uses the + * same one-pass materializer as the coordinator, so getters are read once. + * @param events - the complete event batch to validate. */ export function assertSerializable(events: readonly SessionEvent[]): void { - for (const event of events) { - if (!isJsonValue(event.data)) { - throw new Error(`event "${event.type}" carries non-JSON-serializable data (seq ${event.seq})`) - } + const snapshot = snapshotJsonValue(events) + if (snapshot === undefined) { + throw new Error('session event batch is not losslessly JSON-serializable because it contains non-JSON-serializable data') } } @@ -90,11 +90,11 @@ export function assertSerializable(events: readonly SessionEvent[]): void { * {@link load} rejects a parse error or a `seq` gap in the COMMITTED region * (unloadable); {@link append}'s first event `seq` MUST equal the backend's * stored next-seq (after `load` has balanced any interrupted turn). - * - **JSON-serializable data.** `SessionEventMap` is merge-extensible and - * `event.data` is typed only as `SessionEventMap[K]`, so {@link append} - * REJECTS non-JSON-serializable data with an error naming the offending - * event type. A backend snapshots (serializes/clones) each event when it - * buffers, since `session.events` hands out the live mutable object. + * - **JSON-serializable events.** `SessionEventMap` is merge-extensible, so + * {@link append} materializes each complete batch through the shared + * lossless-JSON boundary before buffering it. The public `session.events` + * view is immutable, but persistence still snapshots direct/replay callers at + * this independent trust boundary. * - **Durability.** {@link append} returns only once the batch is durable * (the file backend fsyncs; a DB commits). {@link create} MAY defer the * physical write until the first {@link append} (lazy materialization). diff --git a/packages/session-persistence/session-persistence/tests/contract.ts b/packages/session-persistence/session-persistence/tests/contract.ts index 9f2facb827..789aa72c91 100644 --- a/packages/session-persistence/session-persistence/tests/contract.ts +++ b/packages/session-persistence/session-persistence/tests/contract.ts @@ -245,7 +245,7 @@ export function runPersistenceContract(name: string, make: () => Promise Promise< } }) - it('snapshot-on-buffer: mutating an event after session/event does not corrupt the persisted copy', async () => { + it('source-frozen events cannot be mutated after buffering and persist unchanged', async () => { const fix = await makeFixture() const { ctx, fiber } = await freshCtx(fix) try { const session = ctx.sessions.create(SessionId('mutate'), { meta: { cwd: WORK } }) const ev = session.append('user/message', { content: [{ type: 'text', text: 'original' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) - // Mutate the live event object AFTER it was buffered by session/event. - ;(ev.data as { content: { type: 'text'; text: string }[] }).content[0]!.text = 'HACKED' + expect(() => { + ;(ev.data as { content: { type: 'text'; text: string }[] }).content[0]!.text = 'HACKED' + }).toThrow(TypeError) session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) await ctx.parallel('session/flush', session) diff --git a/packages/session-persistence/session-persistence/tests/persistence.spec.ts b/packages/session-persistence/session-persistence/tests/persistence.spec.ts index 4e4cf67822..9c766d4b66 100644 --- a/packages/session-persistence/session-persistence/tests/persistence.spec.ts +++ b/packages/session-persistence/session-persistence/tests/persistence.spec.ts @@ -158,6 +158,17 @@ describe('SessionPersistence service registration', () => { expect(loaded.events).toHaveLength(6) await fiber.dispose() }) + + it('rejects non-JSON session metadata before registering lazy state', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const fiber = await ctx.plugin(MemoryPersistence) + const invalid = { ...meta('invalid-meta'), createdAt: 1n as unknown as number } + + await expect(ctx.sessionPersistence.create(invalid)) + .rejects.toThrow('session metadata must be losslessly JSON-serializable') + await fiber.dispose() + }) }) describe('shared persistence helpers', () => { @@ -187,10 +198,10 @@ describe('shared persistence helpers', () => { expect(() => { assertSerializable(oneTurnLog()) }).not.toThrow() }) - it('rejects non-JSON-serializable event data with type and seq context', () => { + it('rejects a batch containing non-JSON-serializable event data', () => { const bad = [ { type: 'user/message', seq: 0, time: 1, data: { content: 1n } }, ] as unknown as SessionEvent[] - expect(() => { assertSerializable(bad) }).toThrow(/"user\/message".*seq 0/) + expect(() => { assertSerializable(bad) }).toThrow(/batch is not losslessly JSON-serializable/) }) }) diff --git a/packages/skill/skill/README.md b/packages/skill/skill/README.md index 33d16e1b69..b035acf767 100644 --- a/packages/skill/skill/README.md +++ b/packages/skill/skill/README.md @@ -9,9 +9,9 @@ This package owns the `ctx.skills` interface. It does not know whether skills co ### Public API - `ctx.skills.registerProvider(provider): () => Promise | void` Registers a provider by unique `provider.name`. Duplicate provider names throw, and `runtime` is reserved for `ctx.skills.register(...)`. The registry snapshots the name and callback identities at registration, so replacing those fields later cannot change lookup or HMR cleanup; callbacks remain bound to the original provider object and can still read its mutable state. The registration is effect-scoped and HMR-safe, and the exact Cordis disposer supports ordered composite teardown. -- `ctx.skills.list({ cwd?, signal? })` Returns model-invocable skill summaries for the current workspace, merged across providers and sorted by name. -- `ctx.skills.get(name, { cwd?, signal? })` Returns the full winning skill, including disabled-for-model skills. -- `ctx.skills.register(skill): () => Promise | void` Registers a runtime embedded skill. Same-name runtime registrations are first-wins: a duplicate logs a warning and gets a no-op disposer. Successful registrations return the exact Cordis disposer for ordered composite teardown. +- `ctx.skills.list({ cwd?, signal? })` Snapshots the lookup options, then returns detached model-invocable summaries for the current workspace, merged across providers and sorted by name. +- `ctx.skills.get(name, { cwd?, signal? })` Uses one lookup-options snapshot to select and load the winner, rechecks cancellation after discovery or a cache hit, races provider loading against the same signal, then returns a detached full definition, including disabled-for-model skills. +- `ctx.skills.register(skill): () => Promise | void` Registers a detached runtime embedded skill. Same-name runtime registrations are first-wins: a duplicate logs a warning and gets a no-op disposer. Successful registrations return the exact Cordis disposer for ordered composite teardown. ### Config @@ -21,13 +21,15 @@ This package owns the `ctx.skills` interface. It does not know whether skills co ## Provider Contract -A provider registers synchronously from its `apply()` and returns `SkillCandidate[]` from `list(options)` when discovery is requested. Registration copies `name` and binds the current `list` and `get` methods once; replacing those fields on the caller-owned object later does not rewrite the live registry entry, and disposal always removes the original name. Remote setup, authentication, and discovery belong in the awaited `list()` call rather than plugin registration. Providers should stop promptly when `options.signal` aborts; the registry also stops awaiting an uncooperative provider so agent cancellation cannot hang prefix composition. The provider later receives the winning candidate back in `get(candidate, options)`. The candidate's `locator` is opaque to the registry, so a local provider can store a file path while a remote provider can store a URL, id, or version token. +A provider registers synchronously from its `apply()` and returns `SkillCandidate[]` from `list(options)` when discovery is requested. Registration copies `name` and binds the current `list` and `get` methods once; replacing those fields on the caller-owned object later does not rewrite the live registry entry, and disposal always removes the original name. Remote setup, authentication, and discovery belong in the awaited `list()` call rather than plugin registration. Providers should stop promptly when `options.signal` aborts; the registry also stops awaiting uncooperative discovery and loading work so agent cancellation cannot hang prefix composition or skill loading. -The registry validates candidate names, descriptions, ranks, and provider ownership. Candidate contract violations fail fast because the provider plugin is malformed; a provider `list()` rejection is treated as a transient source failure, logged, skipped for that request, and not cached. Only completed catalogs are cached, and a provider/runtime revision change during discovery discards the stale result and retries. Duplicate skill names are resolved first-wins by `rank`, provider registration order, then the provider's own local order. The final summary list is sorted by skill `name` for deterministic consumers. +Each public lookup captures `cwd` and the abort-signal identity once before cache or provider work, and providers receive that frozen lookup record. The registry reads each returned candidate once, validates that snapshot, and detaches its resource metadata before caching it. The winning provider receives another detached candidate in `get(candidate, options)`, while `candidate.locator` preserves the exact provider-owned identity originally returned by `list()`; a local provider can therefore use a file-path handle while a remote provider can use a URL, id, or version token. A loaded definition is detached again before it reaches the caller. + +The registry validates fixed provider, candidate, runtime-registration, and loaded-definition fields before detachment: names/descriptions/content use their declared string types, ranks are finite numbers, and `disableModelInvocation` is boolean when present. Caller-owned objects masquerading as scalars are rejected without being frozen. Candidate contract violations fail fast because the provider plugin is malformed; a provider `list()` rejection is treated as a transient source failure, logged, skipped for that request, and not cached. Only completed, registry-owned catalogs are cached, and a provider/runtime revision change during discovery discards the stale result and retries. Duplicate skill names are resolved first-wins by `rank`, provider registration order, then the provider's own local order. The final summary list is sorted by skill `name` for deterministic consumers. ## Runtime Skills -`ctx.skills.register(...)` is a convenience for embedded runtime skills. Runtime skills use rank `250`: project providers can override them, while they override the shipped local provider's custom and user roots. Runtime registration is also first-wins within runtime contributions, so a duplicate contribution cannot remove the active one through its disposer. +`ctx.skills.register(...)` is a convenience for embedded runtime skills. Runtime skills use rank `250`: project providers can override them, while they override the shipped local provider's custom and user roots. Runtime registration detaches the accepted definition and nested resource metadata; later mutation of the registration object or a returned list/get value cannot rewrite the live skill. Registration is also first-wins within runtime contributions, so a duplicate contribution cannot remove the active one through its disposer. ## Consumer boundary diff --git a/packages/skill/skill/src/index.ts b/packages/skill/skill/src/index.ts index 20ac717e9c..f06788cde7 100644 --- a/packages/skill/skill/src/index.ts +++ b/packages/skill/skill/src/index.ts @@ -81,9 +81,10 @@ export type SkillRegistration = Omit & { provider?: /** Caller context used for cwd-sensitive and abortable provider work. */ export interface SkillLookupOptions { - cwd?: string | undefined + /** Workspace selector captured at lookup entry; providers receive a read-only snapshot. */ + readonly cwd?: string | undefined /** Abort discovery or loading work for the current caller. */ - signal?: AbortSignal | undefined + readonly signal?: AbortSignal | undefined } /** Provider interface for one source of skills, such as local directories or a remote registry. */ @@ -101,7 +102,8 @@ export interface SkillProvider { list(options: SkillLookupOptions): Promise /** * Load a complete skill body for a previously listed candidate. - * @param candidate - the winning candidate originally returned by this provider. + * @param candidate - a detached snapshot of the winning candidate; its opaque + * `locator` retains the exact identity originally returned by this provider. * @param options - lookup options; `cwd` selects workspace-sensitive skills and `signal` cancels work. * @returns the full skill body, or `undefined` if it is no longer loadable. */ @@ -194,10 +196,18 @@ export class SkillService extends Service { // replacement of `provider.list`/`provider.get` after registration inert. // In particular, cleanup must never re-read caller-owned `provider.name`: // an HMR host may mutate or reuse that object before its old fiber unloads. + const name = provider.name + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputList = provider.list + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputGet = provider.get + if (typeof name !== 'string') throw new TypeError('skill provider name must be a string') + if (typeof inputList !== 'function') throw new TypeError(`skill provider "${name}" list must be a function`) + if (typeof inputGet !== 'function') throw new TypeError(`skill provider "${name}" get must be a function`) const snapshot: SkillProvider = Object.freeze({ - name: provider.name, - list: provider.list.bind(provider), - get: provider.get.bind(provider), + name, + list: inputList.bind(provider), + get: inputGet.bind(provider), }) const dispose = this.ctx.effect(function* (this: SkillService) { if (snapshot.name === RUNTIME_PROVIDER) { @@ -223,7 +233,9 @@ export class SkillService extends Service { * Register a runtime skill contribution. Runtime registrations are treated as * embedded provider entries with project-over-user priority. Same-name runtime * registrations are first-wins: a duplicate logs a warning and gets a no-op - * disposer so it cannot remove the active contribution. + * disposer so it cannot remove the active contribution. The registry detaches + * the accepted definition, including nested resource metadata, so later caller + * mutation cannot rewrite the live contribution. * @param skill - the complete skill definition to expose for discovery. * @returns the exact Cordis effect disposer that removes this runtime * contribution and invalidates caches; composite effects may yield it @@ -250,12 +262,15 @@ export class SkillService extends Service { } /** - * List model-invocable skill summaries for a workspace. + * List model-invocable skill summaries for a workspace. The lookup options are + * snapshotted before discovery, and every returned summary is detached from the + * cached provider catalog. * @param options - lookup options; `cwd` selects project roots and `signal` cancels discovery. * @returns sorted summaries, excluding skills disabled for model invocation. */ async list(options: SkillLookupOptions = {}): Promise { - return (await this.collect(options)) + const accepted = snapshotLookupOptions(options) + return (await this.collect(accepted)) .map(entry => entry.candidate) .filter(skill => skill.disableModelInvocation !== true) .map(toSummary) @@ -263,20 +278,32 @@ export class SkillService extends Service { } /** - * Load one full skill definition by name. + * Load one full skill definition by name. One lookup-options snapshot selects + * and loads the winner; the provider receives detached candidate metadata with + * its opaque locator identity preserved, and the returned definition is also + * detached from provider-owned data. Cancellation is rechecked after catalog + * selection (including a cache hit), and provider loading is raced against the + * same signal so an uncooperative provider cannot hang the caller. * @param name - kebab-case skill name. * @param options - lookup options; `cwd` selects workspace-sensitive skills and `signal` cancels work. * @returns the full skill, including body content, or `undefined`. */ async get(name: string, options: SkillLookupOptions = {}): Promise { if (!isSkillName(name)) return undefined - const match = (await this.collect(options)).find(entry => entry.candidate.name === name) + const accepted = snapshotLookupOptions(options) + const collected = await this.collect(accepted) + throwIfAborted(accepted.signal) + const match = collected.find(entry => entry.candidate.name === name) if (match === undefined) return undefined - return await match.provider.get(match.candidate, options) + const definition = await waitWithAbort( + match.provider.get(copyCandidate(match.candidate), accepted), + accepted.signal, + ) + return definition === undefined ? undefined : snapshotDefinition(definition) } private async collect(options: SkillLookupOptions): Promise { - options.signal?.throwIfAborted() + throwIfAborted(options.signal) while (true) { const providerRevision = this.providerRevision const runtimeRevision = this.runtimeRevision @@ -285,7 +312,7 @@ export class SkillService extends Service { if (cached !== undefined) return cached const result = await this.collectFresh(options) - options.signal?.throwIfAborted() + throwIfAborted(options.signal) if (providerRevision !== this.providerRevision || runtimeRevision !== this.runtimeRevision) continue if (result.cacheable) { this.collectCache.set(key, result.entries) @@ -316,7 +343,7 @@ export class SkillService extends Service { } private async listAllCandidates(options: SkillLookupOptions): Promise { - options.signal?.throwIfAborted() + throwIfAborted(options.signal) const candidates: IndexedCandidate[] = [] let cacheable = true let runtimeOrder = 0 @@ -340,9 +367,12 @@ export class SkillService extends Service { this.ctx.logger.warn(`skill provider "${provider.name}" skipped: ${errorMessage(error)}`) } if (listed === undefined) continue + if (!Array.isArray(listed)) { + throw new TypeError(`skill provider "${provider.name}" list() must return an array`) + } for (const candidate of listed) { - validateCandidate(candidate, provider.name) - candidates.push({ candidate, provider, providerOrder: order, localOrder }) + const snapshot = snapshotCandidate(candidate, provider.name) + candidates.push({ candidate: snapshot, provider, providerOrder: order, localOrder }) localOrder += 1 } } @@ -377,28 +407,161 @@ function runtimeCandidate(skill: SkillDefinition): SkillCandidate { } } +/** Read provider candidate data once and detach it while preserving its opaque locator identity. */ +function copyCandidate(candidate: SkillCandidate, providerName?: string): SkillCandidate { + const name = candidate.name + const description = candidate.description + const whenToUse = candidate.whenToUse + const disableModelInvocation = candidate.disableModelInvocation + const source = candidate.source + const provider = candidate.provider + const resourceBase = candidate.resourceBase + const rank = candidate.rank + const locator = candidate.locator + const path = candidate.path + const metadata = candidate.metadata + const accepted: SkillCandidate = { + name, + description, + ...whenToUse !== undefined ? { whenToUse } : {}, + ...disableModelInvocation !== undefined ? { disableModelInvocation } : {}, + source, + provider, + ...resourceBase !== undefined ? { resourceBase } : {}, + rank, + // `locator` is the one deliberately provider-owned capability in a + // candidate. Its exact identity must round-trip back to provider.get(). + locator, + ...path !== undefined ? { path } : {}, + ...metadata !== undefined ? { metadata } : {}, + } + // Validate the exact scalar snapshot before cloning nested data. This keeps a + // malformed candidate's provider-contract error from being masked by an + // unrelated DataCloneError in its metadata. + if (providerName !== undefined) validateCandidate(accepted, providerName) + return { + ...accepted, + ...resourceBase !== undefined ? { resourceBase: structuredClone(resourceBase) } : {}, + ...metadata !== undefined ? { metadata: structuredClone(metadata) } : {}, + } +} + +/** Normalize one provider result into the registry-owned catalog snapshot. */ +function snapshotCandidate(candidate: SkillCandidate, providerName: string): SkillCandidate { + return copyCandidate(candidate, providerName) +} + function validateCandidate(candidate: SkillCandidate, providerName: string): void { + if (typeof candidate.name !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned a non-string skill name`) + } if (!SKILL_NAME.test(candidate.name)) { throw new Error(`skill provider "${providerName}" returned invalid skill name "${candidate.name}"`) } + if (typeof candidate.description !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string description`) + } if (candidate.description.length === 0) { throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" without a description`) } - if (!Number.isFinite(candidate.rank)) { + if (candidate.disableModelInvocation !== undefined && typeof candidate.disableModelInvocation !== 'boolean') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-boolean disableModelInvocation`) + } + if (candidate.whenToUse !== undefined && typeof candidate.whenToUse !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string whenToUse`) + } + if (typeof candidate.source !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string source`) + } + if (typeof candidate.rank !== 'number' || !Number.isFinite(candidate.rank)) { throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" with an invalid rank`) } + if (typeof candidate.provider !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string provider`) + } if (candidate.provider !== providerName) { throw new Error(`skill provider "${providerName}" returned skill "${candidate.name}" for provider "${candidate.provider}"`) } + if (candidate.path !== undefined && typeof candidate.path !== 'string') { + throw new TypeError(`skill provider "${providerName}" returned skill "${candidate.name}" with a non-string path`) + } } function normalizeRuntimeSkill(skill: SkillRegistration): SkillDefinition { - if (!SKILL_NAME.test(skill.name)) throw new Error(`invalid skill name "${skill.name}"`) - if (skill.description.length === 0) throw new Error(`skill "${skill.name}" requires a description`) + // Read every caller-owned top-level field once so validation and storage use + // one coherent definition even when JavaScript accessors are involved. + const name = skill.name + const description = skill.description + const whenToUse = skill.whenToUse + const disableModelInvocation = skill.disableModelInvocation + const source = skill.source + const inputProvider = skill.provider + const provider = inputProvider === undefined ? RUNTIME_PROVIDER : inputProvider + const resourceBase = skill.resourceBase + const content = skill.content + const path = skill.path + const metadata = skill.metadata + if (typeof name !== 'string') throw new TypeError('runtime skill name must be a string') + if (!SKILL_NAME.test(name)) throw new Error(`invalid skill name "${name}"`) + if (typeof description !== 'string') throw new TypeError(`skill "${name}" description must be a string`) + if (description.length === 0) throw new Error(`skill "${name}" requires a description`) + if (disableModelInvocation !== undefined && typeof disableModelInvocation !== 'boolean') { + throw new TypeError(`skill "${name}" disableModelInvocation must be a boolean`) + } + if (whenToUse !== undefined && typeof whenToUse !== 'string') throw new TypeError(`skill "${name}" whenToUse must be a string`) + if (typeof source !== 'string') throw new TypeError(`skill "${name}" source must be a string`) + if (typeof provider !== 'string') throw new TypeError(`skill "${name}" provider must be a string`) + if (typeof content !== 'string') throw new TypeError(`skill "${name}" content must be a string`) + if (path !== undefined && typeof path !== 'string') throw new TypeError(`skill "${name}" path must be a string`) return { - ...skill, - provider: skill.provider ?? RUNTIME_PROVIDER, - source: skill.source, + name, + description, + ...whenToUse !== undefined ? { whenToUse } : {}, + ...disableModelInvocation !== undefined ? { disableModelInvocation } : {}, + source, + provider, + ...resourceBase !== undefined ? { resourceBase: structuredClone(resourceBase) } : {}, + content, + ...path !== undefined ? { path } : {}, + ...metadata !== undefined ? { metadata: structuredClone(metadata) } : {}, + } +} + +/** Detach a provider-loaded definition before it crosses back to the caller. */ +function snapshotDefinition(skill: SkillDefinition): SkillDefinition { + const name = skill.name + const description = skill.description + const whenToUse = skill.whenToUse + const disableModelInvocation = skill.disableModelInvocation + const source = skill.source + const provider = skill.provider + const resourceBase = skill.resourceBase + const content = skill.content + const path = skill.path + const metadata = skill.metadata + if (typeof name !== 'string') throw new TypeError('loaded skill name must be a string') + if (!SKILL_NAME.test(name)) throw new Error(`loaded skill has invalid name "${name}"`) + if (typeof description !== 'string') throw new TypeError(`loaded skill "${name}" description must be a string`) + if (description.length === 0) throw new Error(`loaded skill "${name}" requires a description`) + if (disableModelInvocation !== undefined && typeof disableModelInvocation !== 'boolean') { + throw new TypeError(`loaded skill "${name}" disableModelInvocation must be a boolean`) + } + if (whenToUse !== undefined && typeof whenToUse !== 'string') throw new TypeError(`loaded skill "${name}" whenToUse must be a string`) + if (typeof source !== 'string') throw new TypeError(`loaded skill "${name}" source must be a string`) + if (typeof provider !== 'string') throw new TypeError(`loaded skill "${name}" provider must be a string`) + if (typeof content !== 'string') throw new TypeError(`loaded skill "${name}" content must be a string`) + if (path !== undefined && typeof path !== 'string') throw new TypeError(`loaded skill "${name}" path must be a string`) + return { + name, + description, + ...whenToUse !== undefined ? { whenToUse } : {}, + ...disableModelInvocation !== undefined ? { disableModelInvocation } : {}, + source, + provider, + ...resourceBase !== undefined ? { resourceBase: structuredClone(resourceBase) } : {}, + content, + ...path !== undefined ? { path } : {}, + ...metadata !== undefined ? { metadata: structuredClone(metadata) } : {}, } } @@ -411,7 +574,7 @@ function toSummary(skill: SkillDefinition | SkillCandidate): SkillSummary { ...disableModelInvocation !== undefined ? { disableModelInvocation } : {}, source, provider, - ...resourceBase !== undefined ? { resourceBase } : {}, + ...resourceBase !== undefined ? { resourceBase: structuredClone(resourceBase) } : {}, } } @@ -441,9 +604,19 @@ function collectCacheKey(options: SkillLookupOptions, providerRevision: number, return JSON.stringify({ cwd: options.cwd, providerRevision, runtimeRevision }) } +/** Capture one lookup identity before any provider or cache async boundary. */ +function snapshotLookupOptions(options: SkillLookupOptions): Readonly { + const cwd = options.cwd + const signal = options.signal + return Object.freeze({ + ...cwd !== undefined ? { cwd } : {}, + ...signal !== undefined ? { signal } : {}, + }) +} + function waitWithAbort(promise: Promise, signal: AbortSignal | undefined): Promise { if (signal === undefined) return promise - signal.throwIfAborted() + throwIfAborted(signal) return new Promise((resolve, reject) => { const cleanup = (): void => { signal.removeEventListener('abort', onAbort) @@ -467,12 +640,28 @@ function waitWithAbort(promise: Promise, signal: AbortSignal | undefined): }) } -function toError(error: unknown): Error { - return error instanceof Error ? error : new Error(String(error)) +/** Throw a total Error for an already-aborted lookup. */ +function throwIfAborted(signal: AbortSignal | undefined): void { + if (signal?.aborted === true) throw toError(signal.reason) } +/** Normalize an arbitrary abort or provider failure without trusting coercion. */ +function toError(error: unknown): Error { + try { + if (error instanceof Error) return error + } catch { + // A hostile proxy may throw during instanceof; fall through to the total renderer. + } + return new Error(errorMessage(error)) +} + +/** Render an arbitrary provider failure without letting coercion escape containment. */ function errorMessage(error: unknown): string { - return String(error) + try { + return String(error) + } catch { + return '[unrenderable thrown value]' + } } export default SkillService diff --git a/packages/skill/skill/tests/skill.spec.ts b/packages/skill/skill/tests/skill.spec.ts index e3b491f690..b47bdb6431 100644 --- a/packages/skill/skill/tests/skill.spec.ts +++ b/packages/skill/skill/tests/skill.spec.ts @@ -165,6 +165,480 @@ describe('SkillService registry', () => { expect(() => ctx.skills.registerProvider(replacement)).not.toThrow() }) + it('rejects malformed provider and candidate scalar fields without freezing caller objects', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + const badProviderName = { value: 'object-provider' } + expect(() => ctx.skills.registerProvider({ + name: badProviderName as unknown as string, + list: () => Promise.resolve([]), + get: () => Promise.resolve(undefined), + })).toThrow('skill provider name must be a string') + expect(Object.isFrozen(badProviderName)).toBe(false) + expect(() => ctx.skills.registerProvider({ + name: 'bad-list', + list: { bind() {} } as unknown as SkillProvider['list'], + get: () => Promise.resolve(undefined), + })).toThrow('list must be a function') + expect(() => ctx.skills.registerProvider({ + name: 'bad-get', + list: () => Promise.resolve([]), + get: { bind() {} } as unknown as SkillProvider['get'], + })).toThrow('get must be a function') + + const badDescription = { value: 'object-description' } + ctx.skills.registerProvider({ + name: 'bad-candidate', + list: () => Promise.resolve([{ + ...memorySkill('bad-candidate', 'placeholder', 1), + provider: 'bad-candidate', + description: badDescription as unknown as string, + disableModelInvocation: 'false' as unknown as boolean, + }]), + get: () => Promise.resolve(undefined), + }) + await expect(ctx.skills.list()).rejects.toThrow('non-string description') + expect(Object.isFrozen(badDescription)).toBe(false) + + const badBoolean = new Context() + await badBoolean.plugin(SkillService) + badBoolean.skills.registerProvider({ + name: 'bad-boolean', + list: () => Promise.resolve([{ + ...memorySkill('bad-boolean', 'Bad boolean', 1), + provider: 'bad-boolean', + disableModelInvocation: 'false' as unknown as boolean, + }]), + get: () => Promise.resolve(undefined), + }) + await expect(badBoolean.skills.list()).rejects.toThrow('non-boolean disableModelInvocation') + }) + + it('rejects non-array provider results and every malformed candidate scalar', async () => { + const badList = new Context() + await badList.plugin(SkillService) + badList.skills.registerProvider({ + name: 'non-array-list', + list: () => Promise.resolve({} as unknown as SkillCandidate[]), + get: () => Promise.resolve(undefined), + }) + await expect(badList.skills.list()).rejects.toThrow('list() must return an array') + + const cases: { patch: Partial; expected: string }[] = [ + { patch: { name: { value: 'candidate' } as unknown as string }, expected: 'non-string skill name' }, + { patch: { whenToUse: 1 as unknown as string }, expected: 'non-string whenToUse' }, + { patch: { source: { value: 'source' } as unknown as string }, expected: 'non-string source' }, + { patch: { rank: '1' as unknown as number }, expected: 'invalid rank' }, + { patch: { provider: { value: 'provider' } as unknown as string }, expected: 'non-string provider' }, + { patch: { path: 1 as unknown as string }, expected: 'non-string path' }, + ] + for (const [index, { patch, expected }] of cases.entries()) { + const ctx = new Context() + await ctx.plugin(SkillService) + const providerName = `candidate-provider-${index}` + const candidate = { + name: `candidate-${index}`, + description: 'Candidate', + whenToUse: 'Use this candidate.', + disableModelInvocation: false, + provider: providerName, + source: 'test', + rank: 1, + locator: 'candidate', + path: '/skills/candidate/SKILL.md', + ...patch, + } as SkillCandidate + ctx.skills.registerProvider({ + name: providerName, + list: () => Promise.resolve([candidate]), + get: () => Promise.resolve(undefined), + }) + + await expect(ctx.skills.list()).rejects.toThrow(expected) + } + }) + + it('snapshots lookup options before asynchronous discovery and loading', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + let release: (() => void) | undefined + const gate = new Promise((resolve) => { release = resolve }) + const listCwds: (string | undefined)[] = [] + const getCwds: (string | undefined)[] = [] + ctx.skills.registerProvider({ + name: 'contextual', + async list(options) { + listCwds.push(options.cwd) + await gate + const name = options.cwd === '/workspace/a' ? 'skill-a' : 'skill-b' + return [ + { name, description: name, provider: 'contextual', source: 'test', rank: 1, locator: name }, + { name: 'vanished', description: 'Vanished', provider: 'contextual', source: 'test', rank: 2, locator: 'vanished' }, + ] + }, + async get(candidate, options) { + getCwds.push(options.cwd) + if (candidate.name === 'vanished') return undefined + return { ...candidate, content: `${options.cwd}:${candidate.name}` } + }, + }) + + const listOptions: { cwd: string | undefined } = { cwd: '/workspace/a' } + const pending = ctx.skills.list(listOptions) + listOptions.cwd = '/workspace/b' + release?.() + + expect((await pending).map(skill => skill.name)).toEqual(['skill-a', 'vanished']) + expect((await ctx.skills.list({ cwd: '/workspace/a' })).map(skill => skill.name)).toEqual(['skill-a', 'vanished']) + expect(listCwds).toEqual(['/workspace/a']) + + const getOptions: { cwd: string | undefined } = { cwd: '/workspace/a' } + const loading = ctx.skills.get('skill-a', getOptions) + getOptions.cwd = '/workspace/b' + expect((await loading)?.content).toBe('/workspace/a:skill-a') + expect(await ctx.skills.get('vanished', { cwd: '/workspace/a' })).toBeUndefined() + expect(getCwds).toEqual(['/workspace/a', '/workspace/a']) + }) + + it('rechecks cancellation after cached discovery before provider loading', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + let getCalls = 0 + ctx.skills.registerProvider({ + name: 'cached', + async list() { + return [{ + name: 'cached-skill', + description: 'Cached skill', + provider: 'cached', + source: 'test', + rank: 1, + locator: 'cached', + }] + }, + async get(candidate) { + getCalls += 1 + return { ...candidate, content: 'Cached body.' } + }, + }) + await ctx.skills.list({ cwd: '/workspace/cache' }) + const controller = new AbortController() + const reason = new Error('cancelled after cached discovery') + + const pending = ctx.skills.get('cached-skill', { + cwd: '/workspace/cache', + signal: controller.signal, + }) + controller.abort(reason) + + await expect(pending).rejects.toBe(reason) + expect(getCalls).toBe(0) + }) + + it('stops waiting for cached provider loading when a hostile abort reason fires', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + let markStarted: (() => void) | undefined + let release: (() => void) | undefined + let seenSignal: AbortSignal | undefined + const started = new Promise((resolve) => { markStarted = resolve }) + const held = new Promise((resolve) => { + release = () => { + resolve({ + name: 'held-skill', + description: 'Held skill', + provider: 'held', + source: 'test', + content: 'Held body.', + }) + } + }) + ctx.skills.registerProvider({ + name: 'held', + async list() { + return [{ + name: 'held-skill', + description: 'Held skill', + provider: 'held', + source: 'test', + rank: 1, + locator: 'held', + }] + }, + get(_candidate, options) { + seenSignal = options.signal + markStarted?.() + return held + }, + }) + await ctx.skills.list({ cwd: '/workspace/cache' }) + const controller = new AbortController() + const hostileReason = { + [Symbol.toPrimitive]() { + throw new Error('abort reason coercion failed') + }, + } + const pending = ctx.skills.get('held-skill', { + cwd: '/workspace/cache', + signal: controller.signal, + }) + const outcome = pending.then( + () => 'resolved', + (error: unknown) => error instanceof Error && error.message === '[unrenderable thrown value]' + ? 'aborted' + : 'other-error', + ) + await started + controller.abort(hostileReason) + + const settled = await Promise.race([ + outcome, + new Promise<'timeout'>(resolve => setTimeout(() => { resolve('timeout') }, 25)), + ]) + release?.() + await pending.catch(() => undefined) + + expect(seenSignal).toBe(controller.signal) + expect(settled).toBe('aborted') + }) + + it('detaches cached candidates and loaded definitions while preserving locator identity', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + const locator = { id: 'provider-owned' } + const candidate: SkillCandidate = { + name: 'stable-skill', + description: 'Stable description', + whenToUse: 'When stability matters.', + disableModelInvocation: false, + provider: 'detached', + source: 'test', + resourceBase: { kind: 'opaque', description: 'candidate resources' }, + rank: 1, + locator, + path: '/skills/stable/SKILL.md', + metadata: { owner: 'candidate' }, + } + const definition: SkillDefinition = { + name: 'stable-skill', + description: 'Stable description', + whenToUse: 'When stability matters.', + disableModelInvocation: false, + provider: 'detached', + source: 'test', + resourceBase: { kind: 'opaque', description: 'definition resources' }, + path: '/skills/stable/SKILL.md', + metadata: { owner: 'definition' }, + content: 'Stable body.', + } + let listCalls = 0 + let received: SkillCandidate | undefined + ctx.skills.registerProvider({ + name: 'detached', + async list() { + listCalls += 1 + return [candidate] + }, + async get(loaded) { + received = loaded + return definition + }, + }) + + const first = await ctx.skills.list() + candidate.name = 'Bad_Name' + candidate.description = '' + if (candidate.resourceBase?.kind === 'opaque') candidate.resourceBase.description = 'mutated candidate' + if (candidate.metadata) candidate.metadata.owner = 'mutated candidate' + if (first[0]?.resourceBase?.kind === 'opaque') first[0].resourceBase.description = 'mutated summary' + + const second = await ctx.skills.list() + expect(second).toEqual([expect.objectContaining({ + name: 'stable-skill', + description: 'Stable description', + resourceBase: { kind: 'opaque', description: 'candidate resources' }, + })]) + expect(listCalls).toBe(1) + + const loaded = await ctx.skills.get('stable-skill') + expect(received).not.toBe(candidate) + expect(received?.locator).toBe(locator) + expect(received).toMatchObject({ + name: 'stable-skill', + description: 'Stable description', + resourceBase: { kind: 'opaque', description: 'candidate resources' }, + metadata: { owner: 'candidate' }, + }) + expect(loaded).not.toBe(definition) + if (loaded?.resourceBase?.kind === 'opaque') loaded.resourceBase.description = 'mutated definition output' + if (loaded?.metadata) loaded.metadata.owner = 'mutated definition output' + + expect(await ctx.skills.get('stable-skill')).toMatchObject({ + resourceBase: { kind: 'opaque', description: 'definition resources' }, + metadata: { owner: 'definition' }, + }) + expect(definition).toMatchObject({ + resourceBase: { kind: 'opaque', description: 'definition resources' }, + metadata: { owner: 'definition' }, + }) + }) + + it('detaches runtime registrations and every public resource view', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + const resourceBase = { kind: 'opaque' as const, description: 'runtime resources' } + const metadata = { owner: 'runtime' } + ctx.skills.register({ + name: 'runtime-skill', + description: 'Runtime', + whenToUse: 'When runtime data is needed.', + disableModelInvocation: false, + source: 'runtime', + resourceBase, + metadata, + content: 'Runtime body.', + }) + ctx.skills.register({ + name: 'z-runtime', + description: 'Second runtime skill', + source: 'runtime', + content: 'Second runtime body.', + }) + resourceBase.description = 'mutated registration' + metadata.owner = 'mutated registration' + + const listed = await ctx.skills.list() + const loaded = await ctx.skills.get('runtime-skill') + expect(listed[0]?.resourceBase).toEqual({ kind: 'opaque', description: 'runtime resources' }) + expect(loaded?.metadata).toEqual({ owner: 'runtime' }) + if (listed[0]?.resourceBase?.kind === 'opaque') listed[0].resourceBase.description = 'mutated list output' + if (loaded?.resourceBase?.kind === 'opaque') loaded.resourceBase.description = 'mutated get output' + if (loaded?.metadata) loaded.metadata.owner = 'mutated get output' + + expect((await ctx.skills.list())[0]?.resourceBase).toEqual({ kind: 'opaque', description: 'runtime resources' }) + expect(await ctx.skills.get('runtime-skill')).toMatchObject({ + resourceBase: { kind: 'opaque', description: 'runtime resources' }, + metadata: { owner: 'runtime' }, + }) + }) + + it('rejects malformed runtime and loaded-definition scalar fields without freezing them', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + const runtimeDescription = { value: 'runtime-description' } + expect(() => ctx.skills.register({ + name: 'bad-runtime', + description: runtimeDescription as unknown as string, + source: 'runtime', + content: 'body', + })).toThrow('description must be a string') + expect(Object.isFrozen(runtimeDescription)).toBe(false) + expect(() => ctx.skills.register({ + name: 'bad-runtime-boolean', + description: 'Runtime', + disableModelInvocation: 'false' as unknown as boolean, + source: 'runtime', + content: 'body', + })).toThrow('disableModelInvocation must be a boolean') + expect(() => ctx.skills.register({ + name: 'bad-runtime-provider', + description: 'Runtime', + source: 'runtime', + provider: null as unknown as string, + content: 'body', + })).toThrow('provider must be a string') + + const loadedContent = { value: 'loaded-content' } + ctx.skills.registerProvider({ + name: 'bad-definition', + list: () => Promise.resolve([{ + name: 'bad-definition', + description: 'Candidate', + provider: 'bad-definition', + source: 'test', + rank: 1, + locator: 'bad-definition', + }]), + get: candidate => Promise.resolve({ + ...candidate, + content: loadedContent as unknown as string, + }), + }) + await expect(ctx.skills.get('bad-definition')).rejects.toThrow('content must be a string') + expect(Object.isFrozen(loadedContent)).toBe(false) + }) + + it('rejects every other malformed runtime scalar', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + type Registration = Parameters[0] + const valid: Registration = { + name: 'runtime-validation', + description: 'Runtime validation', + whenToUse: 'Use this runtime skill.', + disableModelInvocation: false, + source: 'runtime', + provider: 'runtime-validation', + content: 'Runtime body.', + path: '/skills/runtime-validation/SKILL.md', + } + const cases: { patch: Partial; expected: string }[] = [ + { patch: { name: { value: 'runtime' } as unknown as string }, expected: 'runtime skill name must be a string' }, + { patch: { whenToUse: 1 as unknown as string }, expected: 'whenToUse must be a string' }, + { patch: { source: { value: 'source' } as unknown as string }, expected: 'source must be a string' }, + { patch: { content: { value: 'content' } as unknown as string }, expected: 'content must be a string' }, + { patch: { path: 1 as unknown as string }, expected: 'path must be a string' }, + ] + for (const { patch, expected } of cases) { + expect(() => ctx.skills.register({ ...valid, ...patch })).toThrow(expected) + } + }) + + it('rejects every malformed scalar in provider-loaded definitions', async () => { + const cases: { patch: Partial; expected: string }[] = [ + { patch: { name: { value: 'loaded' } as unknown as string }, expected: 'loaded skill name must be a string' }, + { patch: { name: 'Bad_Name' }, expected: 'loaded skill has invalid name' }, + { patch: { description: { value: 'description' } as unknown as string }, expected: 'description must be a string' }, + { patch: { description: '' }, expected: 'requires a description' }, + { patch: { disableModelInvocation: 'false' as unknown as boolean }, expected: 'disableModelInvocation must be a boolean' }, + { patch: { whenToUse: 1 as unknown as string }, expected: 'whenToUse must be a string' }, + { patch: { source: { value: 'source' } as unknown as string }, expected: 'source must be a string' }, + { patch: { provider: { value: 'provider' } as unknown as string }, expected: 'provider must be a string' }, + { patch: { content: { value: 'content' } as unknown as string }, expected: 'content must be a string' }, + { patch: { path: 1 as unknown as string }, expected: 'path must be a string' }, + ] + for (const [index, { patch, expected }] of cases.entries()) { + const ctx = new Context() + await ctx.plugin(SkillService) + const providerName = `definition-provider-${index}` + const skillName = `definition-${index}` + ctx.skills.registerProvider({ + name: providerName, + list: () => Promise.resolve([{ + name: skillName, + description: 'Candidate', + provider: providerName, + source: 'test', + rank: 1, + locator: 'definition', + }]), + get: () => Promise.resolve({ + name: skillName, + description: 'Definition', + whenToUse: 'Use this definition.', + disableModelInvocation: false, + provider: providerName, + source: 'test', + content: 'Definition body.', + path: '/skills/definition/SKILL.md', + ...patch, + } as SkillDefinition), + }) + + await expect(ctx.skills.get(skillName)).rejects.toThrow(expected) + } + }) + it('validates provider candidates and invalid registry caps', async () => { const defaultedService = new SkillService(new Context()) expect(await defaultedService.list()).toEqual([]) @@ -282,6 +756,34 @@ describe('SkillService registry', () => { expect(flakyCalls).toBe(3) }) + it('contains a provider rejection whose string coercion throws', async () => { + const ctx = new Context() + await ctx.plugin(SkillService) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const hostileFailure = { + toString() { + throw new Error('provider failure coercion failed') + }, + } + ctx.skills.registerProvider({ + name: 'hostile-failure', + list() { + // Deliberately violate the provider contract to prove containment is total. + // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors + return Promise.reject(hostileFailure) + }, + async get() { + return undefined + }, + }) + + await expect(ctx.skills.list()).resolves.toEqual([]) + expect(warnings).toEqual([ + 'skill provider "hostile-failure" skipped: [unrenderable thrown value]', + ]) + }) + it('abandons an in-flight catalog when provider registrations change', async () => { const ctx = new Context() await ctx.plugin(SkillService) diff --git a/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts b/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts index f9c7b04a51..66234a012c 100644 --- a/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts +++ b/packages/subagent/subagent-fork/tests/subagent-fork.spec.ts @@ -23,10 +23,9 @@ const emptyStop: StreamChunk[] = [{ type: 'finish', reason: { kind: 'stop' } }] /** * Drives the REAL fork backend with a real loop + scripted mock MODEL + the - * real dsh-invariants plugin. The invariants plugin re-replays a seeded child - * log on `session/created` (its freeze-check), so a malformed (unbalanced) fork - * seed makes these tests THROW — that is the regression guard for the - * completed-turn-prefix boundary. + * real dsh-invariants plugin. The plugin replays a seeded child log on + * `session/created`, so a malformed (unbalanced) fork seed makes these tests + * THROW — that is the regression guard for the completed-turn-prefix boundary. */ async function setup(script: Script) { const ctx = new Context() diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md index caa7b9b161..e9f7beb540 100644 --- a/packages/subagent/subagent-inprocess/README.md +++ b/packages/subagent/subagent-inprocess/README.md @@ -8,7 +8,7 @@ The shared **in-process subagent run driver**. A library with no provider or imp Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`): -1. snapshots the accepted request before asynchronous owner setup: the parent and signal remain identity capabilities but are never reread from the caller-owned record; tool filter, seed, agent options, output schema, and prompt are detached. It computes child depth = `depthOf(parent) + 1` and rejects `request.maxDepth` overflow with `SubagentDepthError`; `outputSchema` is asserted before cloning so a hostile value fails as `OutputSchemaError`, while the prompt passes the session log's lossless-JSON check before and after cloning; +1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It computes child depth = `depthOf(parent) + 1`, rejects `request.maxDepth` overflow with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; 2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, and manual `run.dispose()` all dispose this exact node, preventing publication after it becomes inactive and awaiting the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child (and rejects if publication never happens), while cancellation during creation is recorded and applied when a child exists; 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent; 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field). diff --git a/packages/subagent/subagent-inprocess/src/index.ts b/packages/subagent/subagent-inprocess/src/index.ts index de3b042fe3..518ea6a8b4 100644 --- a/packages/subagent/subagent-inprocess/src/index.ts +++ b/packages/subagent/subagent-inprocess/src/index.ts @@ -18,9 +18,9 @@ import { randomUUID } from 'node:crypto' import type { Context, Fiber } from 'cordis' import { AgentId, type Agent, type AgentHandle, type AgentOptions } from '@deepseek-ai/dsh-agent' -import { SessionId, isJsonValue, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session' +import { SessionId, snapshotJsonValue, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session' import type { ContentBlock } from '@deepseek-ai/dsh-llm' -import { assertSupportedOutputSchema } from '@deepseek-ai/dsh-tools' +import { assertSupportedOutputSchema, OutputSchemaError } from '@deepseek-ai/dsh-tools' import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent' import { attachStructuredRuntime, @@ -125,59 +125,74 @@ export function startInProcessRun( request: SubagentStartRequest, options: InProcessRunOptions, ): SubagentRun { - // Snapshot the accepted request synchronously. The parent and signal are - // identity capabilities (kept live but never reread from the mutable request - // record); every data field is detached before asynchronous owner setup. + // Capture every top-level field once. Parent/signal are identity capabilities; + // every data value is materialized below before asynchronous owner setup. const parent = request.parent const signal = request.signal const persona = request.persona - const toolFilter = request.toolFilter === undefined ? undefined : structuredClone(request.toolFilter) - const seed = options.seed === undefined ? undefined : structuredClone(options.seed) + const inputToolFilter = request.toolFilter + const inputMaxDepth = request.maxDepth + const inputSchema = request.outputSchema + const inputPrompt = request.prompt + const inputAgentOptions = request.agentOptions + const inputSeed = options.seed + const toolFilter = inputToolFilter === undefined ? undefined : snapshotJsonValue(inputToolFilter) + if (inputToolFilter !== undefined && toolFilter === undefined) { + throw new TypeError('subagent tool filter must be losslessly JSON-serializable') + } + const seed = inputSeed === undefined ? undefined : snapshotJsonValue(inputSeed) + if (inputSeed !== undefined && seed === undefined) { + throw new TypeError('subagent seed must be losslessly JSON-serializable') + } const childDepth = depthOf(parent) + 1 - if (request.maxDepth !== undefined && childDepth > request.maxDepth) { - throw new SubagentDepthError(childDepth, request.maxDepth) + if (inputMaxDepth !== undefined && childDepth > inputMaxDepth) { + throw new SubagentDepthError(childDepth, inputMaxDepth) } - // Assert, then snapshot, the schema subset BEFORE any child exists (the - // service has already capability-gated; this rejects a schema outside the - // enforced subset loud). Assertion comes FIRST so a hostile value fails as - // OutputSchemaError, never as structuredClone's raw DataCloneError — the - // asserted subset is plain JSON data, which always clones. The snapshot is - // load-bearing: the caller keeps its reference, so attaching the ORIGINAL - // would let a post-start() mutation drift the enforced schema away from the - // asserted one — the clone (taken synchronously with the assertion, no - // interleaving possible) pins assertion, the model-visible parameters, and - // validateStructuredValue to one isolation-immutable value. - if (request.outputSchema !== undefined) assertSupportedOutputSchema(request.outputSchema) - const schema = request.outputSchema === undefined ? undefined : structuredClone(request.outputSchema) + const requestedAgentOptions = inputAgentOptions === undefined + ? {} + : snapshotJsonValue(inputAgentOptions) + if (requestedAgentOptions === undefined) { + throw new TypeError('subagent agent options must be losslessly JSON-serializable') + } + // Materialize, then assert, the schema subset BEFORE any child exists. The + // single traversal rejects non-JSON data without rereading accessors; the + // detached value then pins assertion, model-visible parameters, and runtime + // validation to one provider-owned schema. Contract failures stay typed as + // OutputSchemaError rather than leaking a materialization detail. + const schema = inputSchema === undefined ? undefined : snapshotJsonValue(inputSchema) + if (inputSchema !== undefined && schema === undefined) { + throw new OutputSchemaError(['schema annotation must be JSON data; the complete schema must be losslessly JSON-serializable']) + } + if (schema !== undefined) assertSupportedOutputSchema(schema) // The accepted request owns a value snapshot, not the caller's mutable - // content array. Validate the same lossless-JSON contract Session.append - // enforces before any child exists, then detach it synchronously so mutation - // during async creation cannot change what is logged or sent to the model. - if (!isJsonValue(request.prompt)) { + // content array. Use the same one-pass boundary Session.append enforces before + // any child exists so later mutation cannot change what is logged or sent. + const prompt = snapshotJsonValue(inputPrompt) + if (prompt === undefined) { throw new TypeError('subagent prompt must be losslessly JSON-serializable') } - const prompt = structuredClone(request.prompt) - if (!isJsonValue(prompt)) { - throw new TypeError('subagent prompt must be stable losslessly JSON-serializable data') - } const childId = AgentId(randomUUID()) // The child's OWN events begin after the seed (fork seeds the parent's // completed-turn prefix; spawn seeds nothing). `readResult` scopes to this // boundary so a child that produces no message of its own never returns the // SEEDED parent's last assistant message as its result. - const seedLength = options.seed?.length ?? 0 + const seedLength = seed?.length ?? 0 const parentHeader = parent.session.header // Inherit the parent's model by default (a child with no model cannot run); // an explicit `request.agentOptions.model` overrides it. The deployment // persona needs no inheritance (a context-wide section both render); a // per-child `request.persona` becomes a SCOPED section of the same name in // the setup below, shadowing the deployment's for this child alone. - const agentOptions: AgentOptions = structuredClone({ - ...parent.options.model !== undefined ? { model: parent.options.model } : {}, - ...request.agentOptions, + const parentModel = parent.options.model + const agentOptions = snapshotJsonValue({ + ...parentModel !== undefined ? { model: parentModel } : {}, + ...requestedAgentOptions, subagentDepth: childDepth, }) + if (agentOptions === undefined) { + throw new TypeError('subagent agent options must be losslessly JSON-serializable') + } // The child's scoped world, composed in the factory's unpublished setup // window. The factory awaits it before inserting or announcing the child, so diff --git a/packages/subagent/subagent-inprocess/src/structured.ts b/packages/subagent/subagent-inprocess/src/structured.ts index dff63486ed..d4267ae009 100644 --- a/packages/subagent/subagent-inprocess/src/structured.ts +++ b/packages/subagent/subagent-inprocess/src/structured.ts @@ -79,8 +79,8 @@ export interface StructuredAttachment { * agent-creation `setup` window with the child's scope context — every * registration rides the child's fiber and unwinds with the child. * @param childCtx - the child agent's scope context (`setup`'s argument). - * @param schema - the isolation-cloned, already-asserted schema subset to - * enforce (see `assertSupportedOutputSchema` in dsh-tools). + * @param schema - the detached, already-asserted schema subset to enforce (see + * `assertSupportedOutputSchema` in dsh-tools). * @returns the attachment handle (read `captured()` after the child settles). */ export function attachStructuredRuntime(childCtx: Context, schema: StructuredOutputSchema): StructuredAttachment { diff --git a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts index 648ee5935f..f8e18ed572 100644 --- a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts +++ b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts @@ -1,15 +1,15 @@ import { describe, expect, it, vi } from 'vitest' import { Context, type Fiber } from 'cordis' import LlmService from '@deepseek-ai/dsh-llm' -import SessionStore from '@deepseek-ai/dsh-session' +import SessionStore, { type SessionEvent } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry from '@deepseek-ai/dsh-tools' import AgentRegistry, { AgentId, type Agent } from '@deepseek-ai/dsh-agent' import AgentLoop from '@deepseek-ai/dsh-agent-loop' import * as Invariants from '@deepseek-ai/dsh-invariants' -import SubagentService from '@deepseek-ai/dsh-subagent' +import SubagentService, { type SubagentStartRequest } from '@deepseek-ai/dsh-subagent' import { MockAdapter, textResponse } from '../../../core/agent-loop/tests/mock-adapter.ts' -import { depthOf, SubagentDepthError, startInProcessRun } from '../src/index.ts' +import { depthOf, type InProcessRunOptions, SubagentDepthError, startInProcessRun } from '../src/index.ts' type Script = ConstructorParameters[0] @@ -57,7 +57,7 @@ describe('startInProcessRun', () => { }, {})).toThrow('subagent prompt must be losslessly JSON-serializable') }) - it('rejects a prompt whose getter becomes non-JSON while it is snapshotted', async () => { + it('reads each prompt value once before asynchronous child creation', async () => { const { ctx, parent } = await setup([]) let reads = 0 const prompt = [{ @@ -68,9 +68,91 @@ describe('startInProcessRun', () => { }, }] - expect(() => startInProcessRun(ctx, { prompt, parent }, {})) - .toThrow('subagent prompt must be stable losslessly JSON-serializable data') - expect(reads).toBe(2) + const run = startInProcessRun(ctx, { prompt, parent }, {}) + expect(reads).toBe(1) + await run.dispose() + }) + + it('reads each public request and seed option field once', async () => { + const { ctx, parent } = await setup([]) + const reads = { prompt: 0, toolFilter: 0, maxDepth: 0, outputSchema: 0, agentOptions: 0, persona: 0, seed: 0 } + const request = Object.defineProperties({ parent }, { + prompt: { enumerable: true, get: () => { reads.prompt += 1; return [{ type: 'text', text: 'accepted' }] } }, + toolFilter: { enumerable: true, get: () => { reads.toolFilter += 1; return reads.toolFilter === 1 ? undefined : { deny: ['ghost'] } } }, + maxDepth: { enumerable: true, get: () => { reads.maxDepth += 1; return reads.maxDepth === 1 ? undefined : 0 } }, + outputSchema: { enumerable: true, get: () => { reads.outputSchema += 1; return undefined } }, + agentOptions: { enumerable: true, get: () => { reads.agentOptions += 1; return {} } }, + persona: { enumerable: true, get: () => { reads.persona += 1; return undefined } }, + }) as unknown as SubagentStartRequest + const options = Object.defineProperty({}, 'seed', { + enumerable: true, + get: () => { reads.seed += 1; return reads.seed === 1 ? undefined : [] }, + }) as InProcessRunOptions + + const run = startInProcessRun(ctx, request, options) + + expect(reads).toEqual({ prompt: 1, toolFilter: 1, maxDepth: 1, outputSchema: 1, agentOptions: 1, persona: 1, seed: 1 }) + await run.dispose() + }) + + it('rejects an exotic seed before asynchronous owner setup can sanitize it', async () => { + const { ctx, parent } = await setup([]) + class ExoticSeedEvent { + readonly type = 'turn/start' + readonly seq = 0 + readonly time = 1 + readonly data = { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } + } + + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'accepted' }], + parent, + }, { seed: [new ExoticSeedEvent()] as unknown as SessionEvent[] })) + .toThrow(/subagent seed must be losslessly JSON-serializable/) + }) + + it.each([ + { + label: 'tool filter', + overrides: { toolFilter: { deny: [Number.NaN as unknown as string] } }, + message: 'subagent tool filter must be losslessly JSON-serializable', + }, + { + label: 'agent options', + overrides: { agentOptions: { model: Number.NaN as unknown as string } }, + message: 'subagent agent options must be losslessly JSON-serializable', + }, + { + label: 'output schema', + overrides: { + outputSchema: { + type: 'object', + properties: { answer: { type: Number.NaN } }, + } as unknown as NonNullable, + }, + message: 'schema annotation must be JSON data', + }, + ])('rejects non-JSON $label before asynchronous child creation', async ({ overrides, message }) => { + const { ctx, parent } = await setup([]) + + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'accepted' }], + parent, + ...overrides, + }, {})).toThrow(message) + }) + + it('rejects a non-JSON model inherited from the parent before child creation', async () => { + const { ctx, parent } = await setup([]) + const invalidParent = { + options: { ...parent.options, model: Number.NaN as unknown as string }, + session: parent.session, + } as unknown as Agent + + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'accepted' }], + parent: invalidParent, + }, {})).toThrow('subagent agent options must be losslessly JSON-serializable') }) it('rejects when the run-owner fiber settles without installing its context', async () => { diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md index e214ba58c6..b068cfe79d 100644 --- a/packages/subagent/subagent/README.md +++ b/packages/subagent/subagent/README.md @@ -21,7 +21,7 @@ Unlike the bash seam (one executor per context, second load throws), **multiple | `registerProvider(provider)` | Register a frozen acceptance snapshot under `provider.name`; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. | | `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). | | `list()` | Registered provider names (insertion order). | -| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), validate every requested START-TIME capability (`UNSUPPORTED_CAPABILITY` for the first unmet one — before any child is created), then delegate to `provider.start`. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | +| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Return a frozen service-owned run wrapper whose provider fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | ## Capabilities: two kinds, discovered two ways @@ -32,12 +32,12 @@ Beside `capabilities` sits one DESCRIPTIVE fact, not validated by the service: ` ## Run lifecycle -`provider.start(request)` returns a `SubagentRun`: a handle with `started` (the publication/readiness promise), `result` (the terminal outcome), `cancel()`, `dispose()`, and the optional runtime methods. `started` resolves only after the provider has established a real child and rejects if the attempt fails or is cancelled first. `result` resolves with a `SubagentResult` (`output`, optional `structured`, `stopReason`) — it does **not** reject on a child-level failure (a model/transport failure resolves with `stopReason: 'error'`), so the consumer maps a non-`completed` reason to an `isError` tool result. The consumer MUST `dispose()` on every path (success, error, abort) to reach child quiescence and avoid leaking an idle child / session. +`provider.start(request)` returns a provider-owned `SubagentRun`; `SubagentService.start` captures that handle once and returns a frozen service-owned wrapper with `started` (the publication/readiness promise), a normalized `result` (the terminal outcome), bound `cancel()` and `dispose()`, and bound optional runtime methods. `started` resolves only after the provider has established a real child and rejects if the attempt fails or is cancelled first. `result` resolves with one detached, deeply frozen `SubagentResult` (`output`, optional `structured`, `stopReason`) that the service and caller share — it does **not** reject on a child-level failure (a model/transport failure resolves with `stopReason: 'error'`), but malformed provider data rejects as an infrastructure contract fault. The consumer maps a non-`completed` reason to an `isError` tool result and MUST `dispose()` on every path (success, error, abort) to reach child quiescence and avoid leaking an idle child / session. -The service also announces provider lifecycle: `subagent/provider-added` (the frozen registry snapshot) fires after a registration and `subagent/provider-removed` (the accepted name) after an unregistration, so a consumer deriving state from a named provider (the model-facing tool wording) mirrors registry membership instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier" does not mean "registered earlier". Run lifecycle is gated by provider readiness: `subagent/start` (payload `SubagentRunInfo`) fires only after `run.started` fulfills, and `subagent/end` (payload `SubagentRunEndInfo`) fires only for that announced run; readiness rejection emits neither. For spawn/fork, the start listener can resolve the published child via `ctx.agents.get(info.id)`; a remote provider need not have a local registry entry. Both events are **observe-only** plain emits. The service observes `result` immediately even while readiness is pending, clones its output before the caller can mutate it, and buffers that end payload until start has fired; a rejecting result cannot become an unhandled detached promise, start always precedes end, and a listener cannot corrupt the caller's result. `subagent/end` carries the cloned output as `lastAssistantMessage` on the settle path and omits it on infrastructure rejection. Any run-affecting decision is out of scope for this observe-only surface. +The service also announces provider lifecycle: `subagent/provider-added` (the frozen registry snapshot) fires after a registration and `subagent/provider-removed` (the accepted name) after an unregistration, so a consumer deriving state from a named provider (the model-facing tool wording) mirrors registry membership instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier" does not mean "registered earlier". Run lifecycle is gated by provider readiness: the service captures the provider handle's public fields once, `subagent/start` (payload `SubagentRunInfo`) fires only after the accepted `started` promise fulfills, and `subagent/end` (payload `SubagentRunEndInfo`) uses the same accepted id and normalized result; readiness rejection emits neither. For spawn/fork, the start listener can resolve the published child via `ctx.agents.get(info.id)`; a remote provider need not have a local registry entry. Both events are **observe-only** plain emits whose service-owned payloads are deeply frozen before per-listener dispatch. The service observes the normalized `result` immediately even while readiness is pending and buffers that end payload until start has fired; a malformed provider result rejects the returned result promise and becomes contained `error` telemetry, a rejection cannot become an unhandled detached promise, start always precedes end, and one listener cannot corrupt either the caller or later listeners. `subagent/end` carries the same frozen output as `lastAssistantMessage` on a valid settle path and omits it on infrastructure or result-contract failure. Any run-affecting decision is out of scope for this observe-only surface. ## Scope (first cut) -The consumer collects **synchronously**: it starts a run and awaits `result`. Steering (`sendMessage`) is part of the contract but intentionally unused. Background / poll / spill semantics are deferred to a future redesign unifying long-running-tool handling across subagents and bash. See the RFC: [docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md). +The consumer collects **synchronously**: it starts a run and awaits `result`. Steering (`sendMessage`) is part of the contract but intentionally unused. Background, poll, and spill semantics are outside this seam; long-running-tool handling is shared work across subagents and bash. See the RFC: [docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md](../../../docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md). See `src/types.ts` for the full contracts. diff --git a/packages/subagent/subagent/package.json b/packages/subagent/subagent/package.json index eb0dbf8da0..cf1ebf9485 100644 --- a/packages/subagent/subagent/package.json +++ b/packages/subagent/subagent/package.json @@ -25,6 +25,7 @@ "@deepseek-ai/dsh-agent": "^0.0.1", "@deepseek-ai/dsh-llm": "^0.0.1", "@deepseek-ai/dsh-scope": "^0.0.1", + "@deepseek-ai/dsh-session": "^0.0.1", "@deepseek-ai/dsh-tools": "^0.0.1", "cordis": "^4.0.0-rc.6" }, @@ -32,6 +33,7 @@ "@deepseek-ai/dsh-agent": "workspace:^", "@deepseek-ai/dsh-llm": "workspace:^", "@deepseek-ai/dsh-scope": "workspace:^", + "@deepseek-ai/dsh-session": "workspace:^", "@deepseek-ai/dsh-tools": "workspace:^", "cordis": "^4.0.0-rc.6" } diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts index e1f4fac594..de376686fd 100644 --- a/packages/subagent/subagent/src/index.ts +++ b/packages/subagent/subagent/src/index.ts @@ -34,10 +34,11 @@ import { Context, Service } from 'cordis' import { scopeTarget } from '@deepseek-ai/dsh-scope' -import { assertSupportedOutputSchema } from '@deepseek-ai/dsh-tools' +import { assertSupportedOutputSchema, OutputSchemaError } from '@deepseek-ai/dsh-tools' import type { Scoped } from '@deepseek-ai/dsh-scope' -import { HarnessError } from '@deepseek-ai/dsh-llm' +import { deepFreeze, HarnessError } from '@deepseek-ai/dsh-llm' import type { ContentBlock } from '@deepseek-ai/dsh-llm' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { Agent, AgentId } from '@deepseek-ai/dsh-agent' import type { SubagentCapabilities, @@ -115,7 +116,7 @@ declare module 'cordis' { } } -/** Identifying detail for a started subagent run (the `subagent/start` payload). */ +/** Deep-frozen, observe-only identifying detail for a started subagent run. */ export interface SubagentRunInfo { /** The provider that started the run. */ provider: string @@ -123,7 +124,7 @@ export interface SubagentRunInfo { id: AgentId } -/** Outcome detail for a settled subagent run (the `subagent/end` payload). */ +/** Deep-frozen, observe-only outcome detail for a settled subagent run. */ export interface SubagentRunEndInfo { /** The provider that ran it. */ provider: string @@ -186,11 +187,12 @@ export class SubagentService extends Service { // mutate or reuse the provider object before its old fiber unloads. Binding // preserves the provider method's receiver while making replacement of the // public callback field after registration inert. + const inputCapabilities = provider.capabilities const capabilities: SubagentCapabilities = Object.freeze({ - outputSchema: provider.capabilities.outputSchema, - depthLimit: provider.capabilities.depthLimit, - toolFilter: provider.capabilities.toolFilter, - persona: provider.capabilities.persona, + outputSchema: inputCapabilities.outputSchema, + depthLimit: inputCapabilities.depthLimit, + toolFilter: inputCapabilities.toolFilter, + persona: inputCapabilities.persona, }) const snapshot: SubagentProvider = Object.freeze({ name: provider.name, @@ -244,10 +246,16 @@ export class SubagentService extends Service { /** * Start a subagent run on the named provider. Resolves the provider (throws - * `NO_PROVIDER` if absent), validates every requested START-TIME capability + * `NO_PROVIDER` if absent), reads the caller request once into a coherent + * acceptance snapshot, validates every requested START-TIME capability * against {@link SubagentProvider.capabilities} (throws `UNSUPPORTED_CAPABILITY` * for the first unmet one — fail loud, before any child is created), then - * delegates to {@link SubagentProvider.start}, then emits `subagent/start` / + * validates the request's scalar values, materializes model-bound data in one + * lossless-JSON traversal, and delegates the detached request to + * {@link SubagentProvider.start}. The returned handle is a service-owned, + * frozen wrapper: provider fields are captured once, methods stay bound to the + * provider handle, and `result` resolves to one detached, deeply frozen value + * shared by the caller and lifecycle telemetry. Emits `subagent/start` / * `subagent/end` only after the run's readiness boundary fulfills. A provider * that fails before establishing a child emits neither event. * @param name - the provider to run on. @@ -255,32 +263,94 @@ export class SubagentService extends Service { * @returns the live run (its `result` resolves when the child settles). */ start(name: string, request: SubagentStartRequest): SubagentRun { - // Parent is the lifecycle scope identity accepted at start. Never reread it - // from the caller-owned request after the provider/result async boundary, - // or start/end could be dispatched into different agent scopes. - const parent = request.parent const provider = this.providers.get(name) if (!provider) { throw new SubagentError(`no subagent provider registered for "${name}"`, 'NO_PROVIDER') } - this.assertCapabilities(provider, request) - if (request.outputSchema !== undefined) assertSupportedOutputSchema(request.outputSchema) + // Read every top-level field exactly once before capability checks or + // detachment. A stateful accessor must not look absent to validation and then + // appear in the provider request (or vice versa). + const input = this.snapshotStartRequest(request) + const parent = input.parent + this.assertCapabilities(provider, input) + if (input.maxDepth !== undefined && ( + !Number.isSafeInteger(input.maxDepth) + || input.maxDepth < 0 + || Object.is(input.maxDepth, -0) + )) { + throw new TypeError('subagent maxDepth must be a non-negative safe integer') + } + if (input.persona !== undefined && typeof input.persona !== 'string') { + throw new TypeError('subagent persona must be a string') + } + // Model/session-bound values are validated and detached in a single + // recursive pass. A check followed by structuredClone would reread getters + // and could erase an exotic prototype returned only to the clone. + const prompt = snapshotJsonValue(input.prompt) + if (prompt === undefined) { + throw new TypeError('subagent prompt must be losslessly JSON-serializable') + } + const outputSchema = input.outputSchema === undefined + ? undefined + : snapshotJsonValue(input.outputSchema) + if (input.outputSchema !== undefined && outputSchema === undefined) { + throw new OutputSchemaError(['schema annotation must be JSON data; the complete schema must be losslessly JSON-serializable']) + } + if (outputSchema !== undefined) assertSupportedOutputSchema(outputSchema) + const agentOptions = input.agentOptions === undefined + ? undefined + : snapshotJsonValue(input.agentOptions) + if (input.agentOptions !== undefined && agentOptions === undefined) { + throw new TypeError('subagent agent options must be losslessly JSON-serializable') + } + const toolFilter = input.toolFilter === undefined + ? undefined + : snapshotJsonValue(input.toolFilter) + if (input.toolFilter !== undefined && toolFilter === undefined) { + throw new TypeError('subagent tool filter must be losslessly JSON-serializable') + } // Detach every data field before crossing into a provider. Parent/signal // are live identity capabilities and stay exact; the mutable request record // and its arrays/objects are never retained, so every backend (including an // async out-of-process one) observes the request accepted at start. const accepted: SubagentStartRequest = { - prompt: structuredClone(request.prompt), + prompt, parent, - ...request.signal !== undefined ? { signal: request.signal } : {}, - ...request.agentOptions !== undefined ? { agentOptions: structuredClone(request.agentOptions) } : {}, - ...request.outputSchema !== undefined ? { outputSchema: structuredClone(request.outputSchema) } : {}, - ...request.maxDepth !== undefined ? { maxDepth: request.maxDepth } : {}, - ...request.toolFilter !== undefined ? { toolFilter: structuredClone(request.toolFilter) } : {}, - ...request.persona !== undefined ? { persona: request.persona } : {}, + ...input.signal !== undefined ? { signal: input.signal } : {}, + ...agentOptions !== undefined ? { agentOptions } : {}, + ...outputSchema !== undefined ? { outputSchema } : {}, + ...input.maxDepth !== undefined ? { maxDepth: input.maxDepth } : {}, + ...toolFilter !== undefined ? { toolFilter } : {}, + ...input.persona !== undefined ? { persona: input.persona } : {}, } - const run = provider.start(accepted) + const providerRun = provider.start(accepted) + // Provider-owned run objects can be accessor-backed too. Capture every + // public field exactly once, bind methods to the provider's original handle, + // and expose only this service-owned wrapper. The normalized result promise + // is also the one lifecycle telemetry observes, so the caller and observers + // cannot receive different values from stateful accessors. + const id = providerRun.id + const started = providerRun.started + const providerResult = providerRun.result + const cancel = providerRun.cancel.bind(providerRun) + const sendMessage = providerRun.sendMessage?.bind(providerRun) + const dispose = providerRun.dispose.bind(providerRun) + const resume = providerRun.resume?.bind(providerRun) + const result = providerResult.then(value => this.snapshotRunResult(value)) + const run: SubagentRun = Object.freeze({ + id, + started, + result, + cancel, + dispose, + ...sendMessage === undefined + ? {} + : { sendMessage }, + ...resume === undefined + ? {} + : { resume }, + }) // Observe result settlement IMMEDIATELY, before waiting on readiness. A // provider may fail both promises in the same turn; deferring the rejection @@ -296,26 +366,16 @@ export class SubagentService extends Service { // remains observable by the run's consumer, but telemetry must not claim // that a child started. } - void run.result.then( - (result) => { - // Snapshot before the caller's own `await run.result` continuation. Even - // when readiness is still pending, buffering the clone rather than the - // caller-owned result keeps the eventual observe-only event immutable - // with respect to consumer mutation. - let lastAssistantMessage: SubagentResult['output'] | undefined - try { - lastAssistantMessage = structuredClone(result.output) - } catch (error: unknown) { - this.ctx.logger.warn(`subagent: could not clone ${name} output for subagent/end: ${String(error)}`) - } + void result.then( + (value) => { deliverEnd({ provider: name, - id: run.id, - stopReason: result.stopReason, - ...lastAssistantMessage !== undefined ? { lastAssistantMessage } : {}, + id, + stopReason: value.stopReason, + lastAssistantMessage: value.output, }) }, - () => { deliverEnd({ provider: name, id: run.id, stopReason: 'error' }) }, + () => { deliverEnd({ provider: name, id, stopReason: 'error' }) }, ) // Readiness is the publication boundary owned by the provider. For @@ -324,10 +384,10 @@ export class SubagentService extends Service { // per-listener containment, then flush an outcome that settled unusually // early. A readiness rejection is handled here and deliberately emits no // false start/end pair; the result path above remains independently handled. - void run.started.then( + void started.then( () => { readiness = 'started' - this.emitLifecycle('subagent/start', { provider: name, id: run.id }, parent) + this.emitLifecycle('subagent/start', { provider: name, id }, parent) if (pendingEnd !== undefined) { const info = pendingEnd pendingEnd = undefined @@ -342,6 +402,54 @@ export class SubagentService extends Service { return run } + /** Normalize one provider result into the immutable seam value. */ + private snapshotRunResult(value: SubagentResult): SubagentResult { + // Capture every provider-owned field once before validation. In particular, + // lifecycle telemetry must not reread accessors after the caller receives + // the result and observe a different terminal outcome. + const output = value.output + const structured = value.structured + const stopReason = value.stopReason + if (!Array.isArray(output)) { + throw new TypeError('subagent result output must be an array') + } + if (typeof stopReason !== 'string') { + throw new TypeError('subagent result stopReason must be a string') + } + const accepted: SubagentResult = { + output, + ...structured === undefined ? {} : { structured }, + stopReason, + } + const snapshot = snapshotJsonValue(accepted) + if (snapshot === undefined) { + throw new TypeError('subagent result must be losslessly JSON-serializable') + } + return deepFreeze(snapshot) + } + + /** Read one coherent caller request into immutable data properties. */ + private snapshotStartRequest(request: SubagentStartRequest): Readonly { + const prompt = request.prompt + const parent = request.parent + const signal = request.signal + const agentOptions = request.agentOptions + const outputSchema = request.outputSchema + const maxDepth = request.maxDepth + const toolFilter = request.toolFilter + const persona = request.persona + return Object.freeze({ + prompt, + parent, + ...signal !== undefined ? { signal } : {}, + ...agentOptions !== undefined ? { agentOptions } : {}, + ...outputSchema !== undefined ? { outputSchema } : {}, + ...maxDepth !== undefined ? { maxDepth } : {}, + ...toolFilter !== undefined ? { toolFilter } : {}, + ...persona !== undefined ? { persona } : {}, + }) + } + /** * Emit a `subagent/*` lifecycle event with PER-LISTENER containment: dispatch * each subscriber individually and log (never propagate) a thrown one, so one @@ -374,14 +482,15 @@ export class SubagentService extends Service { // parent-scoped listener observes only its own delegations); the // provider-removed registry notification stays unfiltered. The carrier is // args[0] of the dispatch call, exactly as cordis' own emit spells it. + const acceptedInfo = typeof info === 'string' ? info : deepFreeze(info) const dispatchArgs: unknown[] = parent === undefined - ? [name, info] - : [scopeTarget(this, parent), name, info] + ? [name, acceptedInfo] + : [scopeTarget(this, parent), name, acceptedInfo] for (const callback of this.ctx.events.dispatch('emit', dispatchArgs)) { try { - callback(info) + callback(acceptedInfo) } catch (error: unknown) { - this.ctx.logger.warn(`subagent: ${name} listener threw: ${String(error)}`) + this.ctx.logger.warn(`subagent: ${name} listener threw: ${renderThrown(error)}`) } } } @@ -409,4 +518,13 @@ export class SubagentService extends Service { } } +/** Render an arbitrary thrown value without allowing coercion to throw again. */ +function renderThrown(value: unknown): string { + try { + return value instanceof Error ? `${value.name}: ${value.message}` : String(value) + } catch { + return '' + } +} + export default SubagentService diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts index 7b9e828c37..ba4b58c2fc 100644 --- a/packages/subagent/subagent/tests/service.spec.ts +++ b/packages/subagent/subagent/tests/service.spec.ts @@ -173,6 +173,16 @@ describe('SubagentService', () => { persona: true, } const provider = new StubProvider('stable', capabilities) + let capabilityReads = 0 + let capabilityValue = capabilities + Object.defineProperty(provider, 'capabilities', { + configurable: true, + get: () => { + capabilityReads += 1 + return capabilityValue + }, + set: (value: SubagentCapabilities) => { capabilityValue = value }, + }) const added: SubagentProvider[] = [] const removed: string[] = [] ctx.on('subagent/provider-added', registered => void added.push(registered)) @@ -184,6 +194,7 @@ describe('SubagentService', () => { pluginCtx.subagents.registerProvider(provider) }, }) + expect(capabilityReads).toBe(1) const accepted = ctx.subagents.getProvider('stable') const mutable = provider as unknown as { @@ -216,7 +227,10 @@ describe('SubagentService', () => { expect(ctx.subagents.list()).toEqual(['stable']) expect(ctx.subagents.getProvider('mutated')).toBeUndefined() + const controller = new AbortController() const run = ctx.subagents.start('stable', baseRequest({ + signal: controller.signal, + agentOptions: { model: 'mock' }, outputSchema: { type: 'object', properties: { answer: { type: 'string' } } }, maxDepth: 2, toolFilter: { deny: ['bash'] }, @@ -277,6 +291,142 @@ describe('SubagentService', () => { ctx.subagents.start('strong', baseRequest({ outputSchema: { type: 'object', properties: { x: { type: 'string' } } }, maxDepth: 1 })) expect(provider.startCount).toBe(1) }) + + it.each([ + { label: 'NaN', value: Number.NaN }, + { label: 'a fraction', value: 1.5 }, + { label: 'a negative integer', value: -1 }, + { label: 'negative zero', value: -0 }, + ])('rejects maxDepth=$label before the provider starts', async ({ value }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = new StubProvider('invalid-depth', ALL_CAPS) + ctx.subagents.registerProvider(provider) + + expect(() => ctx.subagents.start('invalid-depth', baseRequest({ maxDepth: value }))) + .toThrow('subagent maxDepth must be a non-negative safe integer') + expect(provider.startCount).toBe(0) + }) + + it('rejects a non-string persona before the provider starts', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = new StubProvider('invalid-persona', { ...ALL_CAPS, persona: true }) + ctx.subagents.registerProvider(provider) + + expect(() => ctx.subagents.start('invalid-persona', baseRequest({ + persona: 42 as unknown as string, + }))).toThrow('subagent persona must be a string') + expect(provider.startCount).toBe(0) + }) + + it('reads an optional capability accessor once so it cannot appear after validation', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + let accepted: SubagentStartRequest | undefined + const provider: SubagentProvider = { + name: 'weak-getter', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: (request) => { + accepted = request + return { + id: AgentId('weak-getter-child'), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel() {}, + async dispose() {}, + } + }, + } + ctx.subagents.registerProvider(provider) + let reads = 0 + const request = baseRequest() + Object.defineProperty(request, 'toolFilter', { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? undefined : { deny: ['bash'] } + }, + }) + + ctx.subagents.start('weak-getter', request) + + expect(reads).toBe(1) + expect(accepted?.toolFilter).toBeUndefined() + }) + }) + + it('rejects an exotic public prompt before the provider starts', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = new StubProvider('prompt-boundary') + ctx.subagents.registerProvider(provider) + class ExoticTextBlock { + readonly type = 'text' + readonly text = 'hello' + } + + expect(() => ctx.subagents.start('prompt-boundary', baseRequest({ + prompt: [new ExoticTextBlock()] as unknown as SubagentStartRequest['prompt'], + }))).toThrow('subagent prompt must be losslessly JSON-serializable') + expect(provider.startCount).toBe(0) + }) + + it.each([ + { + label: 'agent options', + overrides: { agentOptions: { model: Number.NaN as unknown as string } }, + message: 'subagent agent options must be losslessly JSON-serializable', + }, + { + label: 'tool filter', + overrides: { toolFilter: { deny: [Number.NaN as unknown as string] } }, + message: 'subagent tool filter must be losslessly JSON-serializable', + }, + { + label: 'output schema', + overrides: { + outputSchema: { + type: 'object', + properties: { answer: { type: Number.NaN } }, + } as unknown as NonNullable, + }, + message: 'schema annotation must be JSON data', + }, + ])('rejects non-JSON $label before the provider starts', async ({ overrides, message }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = new StubProvider('invalid-request-data', ALL_CAPS) + ctx.subagents.registerProvider(provider) + + expect(() => ctx.subagents.start('invalid-request-data', baseRequest(overrides))) + .toThrow(message) + expect(provider.startCount).toBe(0) + }) + + it('reads each nested prompt value once into the provider snapshot', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = new StubProvider('unstable-prompt') + ctx.subagents.registerProvider(provider) + let reads = 0 + const block = Object.defineProperties({}, { + type: { enumerable: true, value: 'text' }, + text: { + enumerable: true, + get: () => { + reads += 1 + return reads === 1 ? 'hello' : new Map([['not', 'json']]) + }, + }, + }) + + expect(() => ctx.subagents.start('unstable-prompt', baseRequest({ + prompt: [block] as unknown as SubagentStartRequest['prompt'], + }))).not.toThrow() + expect(reads).toBe(1) + expect(provider.startCount).toBe(1) }) it('emits subagent/start then subagent/end around a run', async () => { @@ -299,6 +449,165 @@ describe('SubagentService', () => { expect(ended).toHaveBeenCalledWith(expect.objectContaining({ provider: 'events', id: run.id, stopReason: 'completed' })) }) + it('captures a provider run once and gives callers and telemetry one normalized result', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const reads = { + id: 0, + started: 0, + result: 0, + cancel: 0, + sendMessage: 0, + dispose: 0, + resume: 0, + output: 0, + structured: 0, + stopReason: 0, + } + const methodReceivers: string[] = [] + const providerResult = Object.defineProperties({}, { + output: { + enumerable: true, + get: () => { + reads.output += 1 + return reads.output === 1 + ? [{ type: 'text', text: 'accepted output' }] + : [{ type: 'text', text: 'drifted output' }] + }, + }, + structured: { + enumerable: true, + get: () => { + reads.structured += 1 + return { verdict: reads.structured === 1 ? 'accepted' : 'drifted' } + }, + }, + stopReason: { + enumerable: true, + get: () => { + reads.stopReason += 1 + return reads.stopReason === 1 ? 'completed' : 'error' + }, + }, + }) as SubagentResult + const providerRun = Object.defineProperties({}, { + id: { + enumerable: true, + get: () => { + reads.id += 1 + return AgentId(reads.id === 1 ? 'accepted-child' : 'drifted-child') + }, + }, + started: { + enumerable: true, + get: () => { + reads.started += 1 + if (reads.started !== 1) throw new Error('started reread') + return Promise.resolve() + }, + }, + result: { + enumerable: true, + get: () => { + reads.result += 1 + if (reads.result !== 1) throw new Error('result reread') + return Promise.resolve(providerResult) + }, + }, + cancel: { + enumerable: true, + get: () => { + reads.cancel += 1 + if (reads.cancel !== 1) throw new Error('cancel reread') + return function (this: SubagentRun): void { + expect(this).toBe(providerRun) + methodReceivers.push('cancel') + } + }, + }, + sendMessage: { + enumerable: true, + get: () => { + reads.sendMessage += 1 + if (reads.sendMessage !== 1) throw new Error('sendMessage reread') + return function (this: SubagentRun): void { + expect(this).toBe(providerRun) + methodReceivers.push('sendMessage') + } + }, + }, + dispose: { + enumerable: true, + get: () => { + reads.dispose += 1 + if (reads.dispose !== 1) throw new Error('dispose reread') + return async function (this: SubagentRun): Promise { + expect(this).toBe(providerRun) + methodReceivers.push('dispose') + } + }, + }, + resume: { + enumerable: true, + get: () => { + reads.resume += 1 + if (reads.resume !== 1) throw new Error('resume reread') + return function (this: SubagentRun): SubagentRun { + expect(this).toBe(providerRun) + methodReceivers.push('resume') + return providerRun + } + }, + }, + }) as SubagentRun + ctx.subagents.registerProvider({ + name: 'stateful-run', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => providerRun, + }) + const ended = vi.fn() + ctx.on('subagent/end', ended) + + const run = ctx.subagents.start('stateful-run', baseRequest()) + expect(Object.is(run, providerRun)).toBe(false) + expect(Object.isFrozen(run)).toBe(true) + run.cancel() + run.sendMessage?.([]) + expect(Object.is(run.resume?.([]), providerRun)).toBe(true) + await run.dispose() + const result = await run.result + await run.started + await Promise.resolve() + + expect(reads).toEqual({ + id: 1, + started: 1, + result: 1, + cancel: 1, + sendMessage: 1, + dispose: 1, + resume: 1, + output: 1, + structured: 1, + stopReason: 1, + }) + expect(methodReceivers).toEqual(['cancel', 'sendMessage', 'resume', 'dispose']) + expect(result).toEqual({ + output: [{ type: 'text', text: 'accepted output' }], + structured: { verdict: 'accepted' }, + stopReason: 'completed', + }) + expect(Object.isFrozen(result)).toBe(true) + expect(Object.isFrozen(result.output)).toBe(true) + expect(ended).toHaveBeenCalledWith({ + provider: 'stateful-run', + id: 'accepted-child', + stopReason: 'completed', + lastAssistantMessage: [{ type: 'text', text: 'accepted output' }], + }) + }) + it('waits for provider readiness and observes an early result rejection without reordering lifecycle', async () => { const ctx = new Context() await ctx.plugin(SubagentService) @@ -428,12 +737,13 @@ describe('SubagentService', () => { })) }) - it('observe-only: a subagent/end listener mutating lastAssistantMessage cannot corrupt the caller\'s result', async () => { + it('observe-only: a mutating subagent/end listener cannot corrupt the caller or later listeners', async () => { // The subagent/end emit fires from a detached `.then` registered before // start() returns — i.e. BEFORE the caller's own `await run.result` // continuation. If the event shared the result.output reference, a mutating - // listener would change the SubagentResult the caller consumes. The service - // deep-clones output onto the event, so the listener mutates only its copy. + // listener would change the SubagentResult the caller consumes or the value + // a later observer sees. The service freezes one normalized result and the + // lifecycle payload before dispatching either public surface. const ctx = new Context() await ctx.plugin(SubagentService) ctx.subagents.registerProvider(new StubProvider( @@ -448,12 +758,22 @@ describe('SubagentService', () => { if (blocks?.[0]?.type === 'text') blocks[0].text = 'HIJACKED' blocks?.push({ type: 'text', text: 'injected' }) }) + const later = vi.fn() + ctx.on('subagent/end', later) const run = ctx.subagents.start('clone', baseRequest()) const result = await run.result await Promise.resolve() // let the detached settle hook (and its listener) run - // The caller's result.output is untouched by the listener's mutation. + // The caller and the listener after the mutator both retain the accepted value. expect(result.output).toEqual([{ type: 'text', text: 'original' }]) + expect(Object.isFrozen(result.output)).toBe(true) + expect(later).toHaveBeenCalledWith(expect.objectContaining({ + stopReason: 'completed', + lastAssistantMessage: [{ type: 'text', text: 'original' }], + })) + const laterInfo = later.mock.calls[0]![0] as Record + expect(Object.isFrozen(laterInfo)).toBe(true) + expect(Object.isFrozen(laterInfo.lastAssistantMessage)).toBe(true) }) it('omits lastAssistantMessage on the reject path (no SubagentResult was produced)', async () => { @@ -483,17 +803,14 @@ describe('SubagentService', () => { expect('lastAssistantMessage' in endInfo).toBe(false) // no output exists on reject }) - it('contains a structuredClone failure: emits subagent/end without lastAssistantMessage (no unhandled rejection)', async () => { - // The clone runs inside onFulfilled, OUTSIDE emitLifecycle's per-listener - // containment. An uncloneable output (here a content block carrying a - // function) would otherwise throw and become an unhandled rejection on the - // detached `.then`. The handler must instead log and emit the event WITHOUT - // lastAssistantMessage, still carrying the real stopReason. + it('rejects an invalid provider output and maps the contract fault to error telemetry', async () => { + // A function is outside the lossless JSON vocabulary. The service-owned + // result promise rejects instead of exposing the malformed provider value; + // its already-attached lifecycle observer maps that infrastructure fault to + // error telemetry without producing an unhandled rejection. const ctx = new Context() await ctx.plugin(SubagentService) - const warn = vi.fn(); ctx.logger.warn = warn as never - // An output value structuredClone cannot handle (a function is uncloneable). - const uncloneable = [{ type: 'text', text: 'x', evil: () => 0 }] as unknown as SubagentResult['output'] + const nonJsonOutput = [{ type: 'text', text: 'x', evil: () => 0 }] as unknown as SubagentResult['output'] ctx.subagents.registerProvider({ name: 'unclone', capabilities: NO_CAPS, @@ -501,7 +818,7 @@ describe('SubagentService', () => { start: () => ({ id: AgentId('unclone-child'), started: Promise.resolve(), - result: Promise.resolve({ output: uncloneable, stopReason: 'completed' } as SubagentResult), + result: Promise.resolve({ output: nonJsonOutput, stopReason: 'completed' } as SubagentResult), cancel() {}, dispose: async () => {}, }), @@ -510,13 +827,52 @@ describe('SubagentService', () => { const ended = vi.fn() ctx.on('subagent/end', ended) const run = ctx.subagents.start('unclone', baseRequest()) - await run.result + await expect(run.result).rejects.toThrow('subagent result must be losslessly JSON-serializable') await Promise.resolve() const endInfo = ended.mock.calls[0]![0] as Record - expect(endInfo.stopReason).toBe('completed') // the real outcome is preserved - expect('lastAssistantMessage' in endInfo).toBe(false) // clone failed → omitted, not crashed - expect(warn).toHaveBeenCalledWith(expect.stringContaining('could not clone')) + expect(endInfo.stopReason).toBe('error') + expect('lastAssistantMessage' in endInfo).toBe(false) + }) + + it.each([ + { + label: 'a non-array output', + value: { output: { type: 'text', text: 'not an array' }, stopReason: 'completed' }, + message: 'subagent result output must be an array', + }, + { + label: 'a non-string stopReason', + value: { output: [], stopReason: 42 }, + message: 'subagent result stopReason must be a string', + }, + ])('rejects a provider result with $label', async ({ value, message }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + ctx.subagents.registerProvider({ + name: 'invalid-shape', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('invalid-shape-child'), + started: Promise.resolve(), + result: Promise.resolve(value as unknown as SubagentResult), + cancel() {}, + async dispose() {}, + }), + }) + const ended = vi.fn() + ctx.on('subagent/end', ended) + + const run = ctx.subagents.start('invalid-shape', baseRequest()) + await expect(run.result).rejects.toThrow(message) + await Promise.resolve() + + expect(ended).toHaveBeenCalledWith(expect.objectContaining({ + provider: 'invalid-shape', + id: 'invalid-shape-child', + stopReason: 'error', + })) }) it('emits subagent/end with stopReason "error" when the run result promise rejects', async () => { @@ -566,6 +922,60 @@ describe('SubagentService', () => { await expect(run.result).resolves.toMatchObject({ stopReason: 'completed' }) }) + it('contains a listener whose thrown value cannot be stringified', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + ctx.subagents.registerProvider(new StubProvider('hostile-listener')) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const hostile = { + [Symbol.toPrimitive]() { throw new Error('render failed') }, + } + const second = vi.fn() + ctx.on('subagent/start', () => { throw hostile }) + ctx.on('subagent/start', second) + + const run = ctx.subagents.start('hostile-listener', baseRequest()) + await run.started + + expect(second).toHaveBeenCalledOnce() + expect(warnings.some(message => message.includes(''))).toBe(true) + await run.result + }) + + it('rejects a throwing provider result accessor and maps it to error telemetry', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + ctx.subagents.registerProvider({ + name: 'hostile-result', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('hostile-result-child'), + started: Promise.resolve(), + result: Promise.resolve({ + output: [], + get stopReason(): 'completed' { throw new Error('stop reason exploded') }, + }), + cancel() {}, + async dispose() {}, + }), + }) + const ended = vi.fn() + ctx.on('subagent/end', ended) + + const run = ctx.subagents.start('hostile-result', baseRequest()) + await run.started + await expect(run.result).rejects.toThrow('stop reason exploded') + await Promise.resolve() + + expect(ended).toHaveBeenCalledWith(expect.objectContaining({ + provider: 'hostile-result', + id: 'hostile-result-child', + stopReason: 'error', + })) + }) + it('contains a throwing subagent/end listener per-listener: a later listener still observes the settle, no unhandled rejection', async () => { const ctx = new Context() await ctx.plugin(SubagentService) diff --git a/packages/subagent/subagent/tsconfig.json b/packages/subagent/subagent/tsconfig.json index f93f929241..3d3c9be6a9 100644 --- a/packages/subagent/subagent/tsconfig.json +++ b/packages/subagent/subagent/tsconfig.json @@ -17,6 +17,9 @@ { "path": "../../core/agent" }, + { + "path": "../../core/session" + }, { "path": "../../llm/llm" }, diff --git a/packages/support/README.md b/packages/support/README.md index 2a08063bad..c8883a89ff 100644 --- a/packages/support/README.md +++ b/packages/support/README.md @@ -5,7 +5,7 @@ Packages that exist to serve development, testing, and the examples rather than | Package | Role | ctx key | |---|---|---| | `acp-snapshot/` | ACP snapshot suite kit: subprocess scenario harness + golden normalizers + the `defineAcpSnapshotSuite` factory | (library — imported by example `*.snapshot.ts` suites) | -| `invariants/` | Dev-mode event-contract invariants + session-log freeze | (listens on `session/*`, `agent/*`) | +| `invariants/` | Dev-mode event-contract assertions | (listens on `session/*`, `agent/*`) | | `llm-replay/` | Record/replay adapter: short-circuits `llm/stream` from a recorded session JSONL (keyless snapshot tests) | (listens on `llm/stream`) | | `subagent-mock/` | Scripted `SubagentProvider` for deterministic seam/tool tests | (registers on `ctx.subagents`) | diff --git a/packages/support/invariants/README.md b/packages/support/invariants/README.md index 94c2682f9d..4f50ec42f3 100644 --- a/packages/support/invariants/README.md +++ b/packages/support/invariants/README.md @@ -1,9 +1,11 @@ # dsh-invariants -Dev-mode event-contract invariants and session-log freeze. A pure-listener plugin (everything is a plugin) that asserts the harness event contract at runtime and, optionally, freezes logged session-event data so any code that mutates history throws instead of corrupting silently. +Dev-mode event-contract assertions. This pure-listener plugin checks relationships among session events, agent states, scoped dispatches, and model requests at runtime; it does not own or change product behavior. **Off in production.** Enable it in tests and the demos, where a contract violation should fail loudly. It costs nothing when not registered, and doubles as executable documentation of the event taxonomy — the assertions *are* the contract. +Session itself owns immutable log storage in every composition: it takes one lossless JSON snapshot of each accepted event, deep-freezes that record, and exposes the log through immutable array snapshots. The invariants plugin checks the cross-record and cross-seam rules that storage immutability cannot express. + ## Plugin A functional plugin — register the module namespace (this is what loading by name in `cordis.yml` does): @@ -14,17 +16,10 @@ import * as Invariants from '@deepseek-ai/dsh-invariants' declare const ctx: Context -await ctx.plugin(Invariants) // freeze on (default) -await ctx.plugin(Invariants, { freeze: false }) // assert contract, don't freeze +await ctx.plugin(Invariants) ``` -`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist (so a hot reload mid-turn doesn't falsely reject the next event). It listens on `session/created`, `session/event`, and `agent/status`. - -### Config - -| Key | Default | Meaning | -|---|---|---| -| `freeze` | `true` | Deep-freeze each logged event's data so mutating a logged event throws. Set `false` to assert the contract without freezing. | +`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist, so a hot reload mid-turn does not falsely reject the next event. It registers only listeners and has no configuration. ## Invariants asserted @@ -46,10 +41,10 @@ Model requests (on `llm/stream`): On any violation it throws `InvariantError` (`code: 'INVARIANT'`). -## Why runtime, not deep-readonly types +## Why runtime assertions remain useful -A `DeepReadonly` is high type-noise across every log consumer, and a plugin can cast straight through it. A dev-mode freeze plus these assertions catch real corruption at zero production cost and zero type noise. The always-on half of that defense — cloning derived messages so request/adapter mutation can't reach back into the log — lives in `dsh-session`'s `deriveMessages`. This package is the dev-mode tripwire. See [dev-mode invariants](../../../docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md). +Session enforces the per-record storage boundary at runtime, where a cast cannot bypass it. Pervasive `DeepReadonly` types would add noise across consumers without expressing relationships such as turn/step nesting, subject-correct scoped dispatch, or equality between a request and its log reconstruction. This plugin checks those relationships in development while `dsh-session` keeps history immutable in every composition. See [source-owned session immutability and dev-mode invariants](../../../docs/rfc/implemented/architecture/2026-06-11-dev-invariants-over-deep-readonly.md). ## Seeded sessions -A seeded/forked session arrives with events already in its log (the `Session` constructor copies the seed without emitting `session/event`). On `session/created` the plugin replays the existing log through the checker and freezes those entries, so seeded history is held to the same contract. +A seeded or forked session arrives with events already in its log because construction does not emit `session/event` for each seed record. `Session` validates, snapshots, and freezes every seed record before accepting it; on `session/created`, this plugin replays the accepted log only to rebuild and check its relational trace state. diff --git a/packages/support/invariants/package.json b/packages/support/invariants/package.json index 4ea36f66de..ba95eea315 100644 --- a/packages/support/invariants/package.json +++ b/packages/support/invariants/package.json @@ -1,6 +1,6 @@ { "name": "@deepseek-ai/dsh-invariants", - "description": "Dev-mode event-contract invariants + session-log freeze for the DeepSeek Harness", + "description": "Dev-mode event-contract assertions for the DeepSeek Harness", "version": "0.0.1", "private": true, "type": "module", diff --git a/packages/support/invariants/src/index.ts b/packages/support/invariants/src/index.ts index ee431a7f39..153d97a45c 100644 --- a/packages/support/invariants/src/index.ts +++ b/packages/support/invariants/src/index.ts @@ -1,20 +1,18 @@ /** - * Dev-mode invariants: a pure-listener plugin that asserts the harness event - * contract at runtime, and (optionally) freezes logged session-event data so - * any code that mutates history throws instead of corrupting silently. + * Dev-mode invariants: a pure-listener plugin that asserts relationships in + * the harness event contract at runtime. * * Everything is a plugin — this is just listeners on `session/created`, - * `session/event`, and `agent/status`. It is **off in production**: enable it - * in tests and the demos, where a contract violation should be a loud failure, - * not a subtle one. It doubles as executable documentation of the event - * taxonomy: the assertions below ARE the contract. + * `session/event`, `agent/status`, and the scoped dispatch and request seams. + * It is **off in production**: enable it in tests and demos, where a contract + * violation should be a loud failure rather than a subtle one. It doubles as + * executable documentation of the event taxonomy: the assertions below are + * the contract. * - * Why runtime assertions instead of compile-time deep-readonly types? See - * the dev-invariants RFC. Briefly: a `DeepReadonly` is high type-noise across - * every log consumer and a plugin casts straight through it; a dev-mode freeze - * + assertions catch real corruption at zero production cost and zero type - * noise. The always-on half of that defense (cloning derived messages) lives - * in dsh-session; this package is the dev-mode tripwire. + * Session owns immutable log storage: it snapshots and deep-freezes every + * accepted event at the source. This plugin checks relationships that one + * event's types and immutability cannot express, including turn/step nesting, + * scoped dispatch, status transitions, and request reconstructability. * * @module @deepseek-ai/dsh-invariants */ @@ -44,16 +42,6 @@ export class InvariantError extends HarnessError { } } -/** Plugin config. */ -export interface Config { - /** - * Deep-freeze logged session-event data so mutating a logged event throws. - * Default true — this plugin only runs in dev/test, where freezing is the - * point. Set false to assert the event contract without freezing. - */ - freeze?: boolean -} - /** Per-session bookkeeping for the session-log invariants. */ interface SessionTrace { /** Highest `seq` seen so far (must strictly increase). */ @@ -87,29 +75,6 @@ interface AgentSubject { agent: Agent } -/** - * Deep-freeze a value and everything reachable from it. - * - * Walks every object's own properties even when the object itself is already - * frozen: `Session.append()` accepts event data from arbitrary plugins/tools, - * so a caller can hand us a SHALLOW-frozen object whose descendants are still - * mutable. Skipping an already-frozen node (the obvious idempotence shortcut) - * would leave exactly the kind of mutable history the dev-invariants RFC means to catch. A - * `WeakSet` of visited objects keeps it terminating on cycles and avoids - * re-walking shared subtrees / already-processed seed events. - */ -function deepFreeze(value: unknown, seen: WeakSet = new WeakSet()): void { - if (value === null || typeof value !== 'object') return - if (seen.has(value)) return - seen.add(value) - // Freeze the node (no-op if a caller pre-froze it), then ALWAYS descend — - // a frozen container can still hold mutable children. - Object.freeze(value) - for (const key of Object.keys(value)) { - deepFreeze((value as Record)[key], seen) - } -} - /** Assert that a step-scoped event names the currently open turn and step. */ function requireOpenStep(trace: SessionTrace, kind: string, turn: number, step: number): void { if (trace.openTurn !== turn || trace.openStep !== step) { @@ -311,13 +276,13 @@ function checkTransition(from: AgentStatus | undefined, to: AgentStatus): void { /** * Register the dev-mode invariants. Contributions are effect-scoped, so - * disposing the plugin fiber removes all listeners and stops freezing - * (HMR-safe). On (re-)apply the trace state is rebuilt by replaying each - * existing session's log, so a hot reload mid-turn does not falsely reject the - * next event. + * disposing the plugin fiber removes all listeners (HMR-safe). On (re-)apply + * the trace state is rebuilt by replaying each existing session's log, so a + * hot reload mid-turn does not falsely reject the next event. + * + * @param ctx - Cordis context that receives the invariant listeners. */ -export function apply(ctx: Context, config: Config = {}): void { - const freeze = config.freeze ?? true +export function apply(ctx: Context): void { const traces = new WeakMap() // Agent status has no stored history to replay; the first observation after // (re-)apply seeds the baseline, so a reload never produces a false positive. @@ -334,13 +299,12 @@ export function apply(ctx: Context, config: Config = {}): void { surface: [], }) - /** Build (or rebuild) a session's trace by replaying its whole log; freeze it. */ + /** Build (or rebuild) a session's trace by replaying its whole log. */ const seedSession = (session: Session): SessionTrace => { const trace = freshTrace() traces.set(session, trace) for (const event of session.events) { checkEvent(trace, event) - if (freeze) deepFreeze(event) } return trace } @@ -362,7 +326,6 @@ export function apply(ctx: Context, config: Config = {}): void { ctx.on('session/event', (session, event) => { checkEvent(traceFor(session), event) - if (freeze) deepFreeze(event) }) ctx.on('agent/status', (agent, status) => { diff --git a/packages/support/invariants/tests/invariants.spec.ts b/packages/support/invariants/tests/invariants.spec.ts index ad3792b302..44a87abf8c 100644 --- a/packages/support/invariants/tests/invariants.spec.ts +++ b/packages/support/invariants/tests/invariants.spec.ts @@ -8,10 +8,10 @@ import * as Invariants from '@deepseek-ai/dsh-invariants' import { InvariantError } from '@deepseek-ai/dsh-invariants' /** A Context with the session store and the invariants plugin registered. */ -async function setup(config?: { freeze?: boolean }) { +async function setup() { const ctx = new Context() await ctx.plugin(SessionStore) - const fiber = await ctx.plugin(Invariants, config ?? {}) + const fiber = await ctx.plugin(Invariants) return { ctx, fiber } } @@ -22,7 +22,7 @@ function mockAgent(id: string): Agent { describe('session-log invariants', () => { it('accepts a well-formed turn/step/tool sequence', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() expect(() => { session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -38,7 +38,7 @@ describe('session-log invariants', () => { }) it('rejects a non-monotonic seq (replay spine)', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() // Session.append enforces seq-contiguity at the source, so drive the // invariants seq check directly via session/event with a regressing seq. @@ -48,7 +48,7 @@ describe('session-log invariants', () => { }) it('rejects a turn/start while another turn is open', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(() => session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } })) @@ -56,7 +56,7 @@ describe('session-log invariants', () => { }) it('rejects a turn/end that does not match the open turn', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(() => session.append('turn/end', { turn: 2, reason: { kind: 'completed' } })) @@ -64,14 +64,14 @@ describe('session-log invariants', () => { }) it('rejects a step/start outside its declared turn', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(() => session.append('step/start', { turn: 2, step: 1 })).toThrow(/open turn is 1/) }) it('rejects a step/end that does not match the open step', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -79,7 +79,7 @@ describe('session-log invariants', () => { }) it('rejects an assistant/chunk outside an open step', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(() => session.append('assistant/chunk', { turn: 1, step: 1, chunk: { type: 'text-delta', index: 0, text: 'x' } })) @@ -87,7 +87,7 @@ describe('session-log invariants', () => { }) it('rejects a message event appended outside any open turn (turn-enclosure)', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() // No turn open: every message-bearing event must be turn-enclosed (the turn-enclosure RFC). expect(() => session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })) @@ -97,7 +97,7 @@ describe('session-log invariants', () => { }) it('rejects steering and plugin-added events appended outside any open turn', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() // steering/message is turn-scoped: outside a turn it would land past the // commit boundary and be dropped on resume (the turn-enclosure RFC). @@ -113,7 +113,7 @@ describe('session-log invariants', () => { }) it('accepts message events once a turn is open', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(() => session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' })) @@ -121,7 +121,7 @@ describe('session-log invariants', () => { }) it('rejects a tool/result with no prior tool/call', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -130,7 +130,7 @@ describe('session-log invariants', () => { }) it('allows a synthetic interrupted tool/result from crash repair without a prior tool/call event', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() expect(() => { session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -152,7 +152,7 @@ describe('session-log invariants', () => { }) it('allows a tool/call with no matching tool/result (thrown waterfall ends the step)', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() expect(() => { session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -164,7 +164,7 @@ describe('session-log invariants', () => { }) it('holds seeded sessions to the contract on session/created', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() // A seq-contiguous, serializable seed (so it passes Session's constructor // validation) that nonetheless violates turn nesting — a second turn/start // while the first turn is still open — must be rejected by the invariants @@ -177,7 +177,7 @@ describe('session-log invariants', () => { }) it('tracks turns per session independently', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const a = ctx.sessions.create(SessionId('a')) const b = ctx.sessions.create(SessionId('b')) a.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -186,7 +186,7 @@ describe('session-log invariants', () => { }) it('accepts multiple steps in a turn and consecutive turns', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() expect(() => { session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) @@ -203,7 +203,7 @@ describe('session-log invariants', () => { }) it('rejects a skipped turn number', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) @@ -212,7 +212,7 @@ describe('session-log invariants', () => { }) it('rejects a skipped step number within a turn', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -222,7 +222,7 @@ describe('session-log invariants', () => { }) it('rejects a turn/end while a step is still open', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -231,7 +231,7 @@ describe('session-log invariants', () => { }) it('rejects a step/start while a step is still open', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -239,7 +239,7 @@ describe('session-log invariants', () => { }) it('rejects a tool/result satisfying a call from a previous step', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -252,7 +252,7 @@ describe('session-log invariants', () => { }) it('rejects an assistant/message naming the wrong step', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -266,7 +266,7 @@ describe('HMR state rebuild', () => { const ctx = new Context() await ctx.plugin(SessionStore) // First registration, mid-turn: a turn is open when the plugin reloads. - const first = await ctx.plugin(Invariants, { freeze: false }) + const first = await ctx.plugin(Invariants) const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('step/start', { turn: 1, step: 1 }) @@ -274,7 +274,7 @@ describe('HMR state rebuild', () => { // Re-apply (HMR): the fresh fiber must replay the existing log so the open // step is known — the next chunk must NOT be a false positive. - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) expect(() => session.append('assistant/chunk', { turn: 1, step: 1, chunk: { type: 'text-delta', index: 0, text: 'h' } })) .not.toThrow() // And a genuine violation is still caught after the rebuild. @@ -283,76 +283,49 @@ describe('HMR state rebuild', () => { }) }) -describe('dev-freeze', () => { - it('freezes appended event data so mutating a logged event throws', async () => { - const { ctx } = await setup() // freeze defaults true - const session = ctx.sessions.create() - session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) +describe('session immutability', () => { + it('always freezes appended event data without the invariants plugin', () => { + const session = new Session(SessionId('appended')) const event = session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) expect(Object.isFrozen(event)).toBe(true) expect(Object.isFrozen(event.data)).toBe(true) expect(Object.isFrozen(event.data.content)).toBe(true) + expect(Object.isFrozen(event.data.content[0])).toBe(true) + expect(Object.isFrozen(session.events)).toBe(true) expect(() => { (event.data.content[0] as { text: string }).text = 'HACKED' }).toThrow() }) - it('does not freeze when freeze:false', async () => { - const { ctx } = await setup({ freeze: false }) - const session = ctx.sessions.create() - session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) - const event = session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) - expect(Object.isFrozen(event)).toBe(false) - }) - - it('freezes seeded events on session/created', async () => { - const { ctx } = await setup() + it('always freezes seeded events without the invariants plugin', () => { const seed = [ { type: 'turn/start' as const, seq: 0, time: 0, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } }, { type: 'user/message' as const, seq: 1, time: 0, data: { content: [{ type: 'text' as const, text: 'seeded' }], source: { kind: 'user' as const } }, surfaceOp: 'append' as const }, ] - const session = ctx.sessions.create(undefined, { seed }) + const session = new Session(SessionId('seeded'), seed) + expect(Object.isFrozen(seed[0])).toBe(false) + expect(Object.isFrozen(session.events)).toBe(true) expect(Object.isFrozen(session.events[0])).toBe(true) + expect(Object.isFrozen(session.events[0]?.data)).toBe(true) + expect(Object.isFrozen(session.events[1]?.data)).toBe(true) }) - it('freezes mutable descendants of a shallow-frozen event datum', async () => { - const { ctx } = await setup() - const session = ctx.sessions.create() - session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) - // A caller hands in a SHALLOW-frozen block whose nested array is still - // mutable. deepFreeze must descend into the already-frozen object and - // freeze the descendant, not short-circuit on the frozen container — - // otherwise dev-mode misses exactly the history mutation the dev-invariants RFC catches. - // `append` snapshots `data`, so the freeze applies to the LOGGED clone, not - // the caller's input — read the event back and assert on its data. + it('snapshots and freezes descendants of a shallow-frozen caller value', () => { + const session = new Session(SessionId('shallow-frozen')) const innerContent: { type: 'text'; text: string }[] = [{ type: 'text', text: 'inner' }] const block = Object.freeze({ type: 'tool-result' as const, toolCallId: CallId('c1'), content: innerContent, isError: false }) const event = session.append('user/message', { content: [block], source: { kind: 'user' } }, { surfaceOp: 'append' }) const logged = event.data.content[0] as { content: { type: 'text'; text: string }[] } + expect(Object.isFrozen(innerContent)).toBe(false) expect(Object.isFrozen(logged.content)).toBe(true) expect(Object.isFrozen(logged.content[0])).toBe(true) + innerContent[0]!.text = 'caller mutation' + expect(logged.content[0]!.text).toBe('inner') expect(() => { logged.content.push({ type: 'text', text: 'mutation' }) }).toThrow() }) - - it('terminates on a cyclic event datum (WeakSet guard)', async () => { - const { ctx } = await setup() - const session = ctx.sessions.create() - // The deep-freeze WeakSet guard must terminate on a self-referential - // structure rather than recursing forever. Session.append now rejects - // non-serializable (incl. cyclic) data at the source, so drive the freeze - // handler directly via hand-built session/events — exactly the shape the - // invariants listener receives. Open a turn first (seq 0) so the cyclic - // user/message (seq 1) satisfies the turn-enclosure invariant. - ctx.emit(scopeTarget(session, undefined), 'session/event', session, { type: 'turn/start', seq: 0, time: 1, data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } } } as never) - const cyclic: Record = { type: 'text', text: 'x' } - cyclic['self'] = cyclic - const event = { type: 'user/message', seq: 1, time: 1, data: { content: [cyclic], source: { kind: 'user' } } } - expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) }).not.toThrow() - expect(Object.isFrozen(cyclic)).toBe(true) - }) }) describe('agent status invariants', () => { it('accepts legal transitions: idle→running→idle and →disposed', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const agent = mockAgent('a1') expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle') @@ -363,28 +336,28 @@ describe('agent status invariants', () => { }) it('accepts running→disposed', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const agent = mockAgent('a2') ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running') expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'disposed') }).not.toThrow() }) it('rejects a no-op transition', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const agent = mockAgent('a3') ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running') expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'running') }).toThrow(/no-op transition/) }) it('rejects leaving the terminal disposed state', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const agent = mockAgent('a4') ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'disposed') expect(() => { ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle') }).toThrow(/left terminal state disposed/) }) it('tracks status per agent independently', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const a = mockAgent('a5') const b = mockAgent('b5') ctx.emit(scopeTarget(a, a), 'agent/status', a, 'running') @@ -401,10 +374,10 @@ describe('HMR safety', () => { await fiber.dispose() - // After disposal: no freezing, no assertions. An event that WOULD have - // violated the open-turn rule now passes silently, and is not frozen. + // After disposal the plugin's assertions are gone, so an event that would + // violate the open-turn rule passes. Session still owns immutability. const event = session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } }) - expect(Object.isFrozen(event)).toBe(false) + expect(Object.isFrozen(event)).toBe(true) // A no-op status transition no longer throws either. const agent = mockAgent('hmr') ctx.emit(scopeTarget(agent, agent), 'agent/status', agent, 'idle') @@ -419,16 +392,17 @@ describe('HMR safety', () => { expect(err.message).toBe('invariant violated: seq must strictly increase') }) - it('does not leak listeners across dispose (no stale freezing)', async () => { + it('does not leak listeners across dispose', async () => { const { ctx, fiber } = await setup() await fiber.dispose() const spy = vi.fn() ctx.on('session/event', spy) const session = ctx.sessions.create() session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) - // our own spy fires, proving events still flow — but the plugin's frozen. + // The spy proves events still flow after plugin disposal. Session, not the + // disposed listener, freezes the accepted record. expect(spy).toHaveBeenCalledOnce() - expect(Object.isFrozen(session.events[0])).toBe(false) + expect(Object.isFrozen(session.events[0])).toBe(true) }) }) @@ -640,7 +614,7 @@ describe('surface invariants', () => { }) it('catches an incomplete-provenance replace on the load/seed path', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const badSeed = [ { type: 'turn/start' as const, seq: 0, time: 0, data: { turn: 1, trigger: { kind: 'message' as const, source: { kind: 'user' as const } } } }, { type: 'step/start' as const, seq: 1, time: 0, data: { turn: 1, step: 1 } }, @@ -655,10 +629,10 @@ describe('surface invariants', () => { const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) - // Type system prevents surface metadata on non-surface events; this test - // exercises the runtime guard against casts or persisted-data bypass. - // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return - expect(() => (session.append as any)('turn/end', { turn: 1, reason: { kind: 'completed' } }, { sourceEventSeqs: [0] })) + // Session rejects this at its own acceptance boundary. Emit a hand-built + // record to cover the listener's defensive check for alternate producers. + const event = { type: 'turn/end', seq: 1, time: 1, data: { turn: 1, reason: { kind: 'completed' } }, sourceEventSeqs: [0] } + expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) }) .toThrow(/cannot carry sourceEventSeqs/) }) @@ -666,8 +640,8 @@ describe('surface invariants', () => { const { ctx } = await setup() const session = ctx.sessions.create() session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) - // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-return - expect(() => (session.append as any)('turn/end', { turn: 1, reason: { kind: 'completed' } }, { surfaceOp: 'append' })) + const event = { type: 'turn/end', seq: 1, time: 1, data: { turn: 1, reason: { kind: 'completed' } }, surfaceOp: 'append' } + expect(() => { ctx.emit(scopeTarget(session, undefined), 'session/event', session, event as never) }) .toThrow(/cannot carry surfaceOp/) }) }) @@ -675,7 +649,7 @@ describe('surface invariants', () => { describe('request-reconstruction cross-check (llm/stream)', () => { /** Session with a boundary: one derivable user message, an open step, and the header event the loop would have logged. */ async function requestSetup() { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create(SessionId('req-check')) session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) @@ -737,7 +711,7 @@ describe('request-reconstruction cross-check (llm/stream)', () => { }) it('rejects a loop-built request with no header event or no step/start in its log', async () => { - const { ctx } = await setup({ freeze: false }) + const { ctx } = await setup() const session = ctx.sessions.create(SessionId('req-bare')) session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) const bare = Object.freeze({ model: 'm', messages: Object.freeze([]), sessionId: session.id }) @@ -778,7 +752,7 @@ describe('request cross-check ordering (prepend)', () => { const ctx = new Context() await ctx.plugin(SessionStore) ctx.on('llm/stream', () => (async function* () {})() as never) // short-circuits, no next() - await ctx.plugin(Invariants, { freeze: false }) + await ctx.plugin(Invariants) const session = ctx.sessions.create(SessionId('prepend-check')) session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) diff --git a/packages/support/subagent-mock/tests/subagent-mock.spec.ts b/packages/support/subagent-mock/tests/subagent-mock.spec.ts index ddd725da4b..8a96cc4141 100644 --- a/packages/support/subagent-mock/tests/subagent-mock.spec.ts +++ b/packages/support/subagent-mock/tests/subagent-mock.spec.ts @@ -57,7 +57,8 @@ describe('dsh-subagent-mock', () => { // the structured path is only reachable when the cap is on; with it off and // no schema requested, the result has no structured field. const run = ctx.subagents.start('mock', baseRequest()) - await expect(run.result).resolves.toMatchObject({ structured: undefined }) + const result = await run.result + expect(result).not.toHaveProperty('structured') }) it('honors a configured stop reason', async () => { diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md index 86d386350a..d7cd9ed64c 100644 --- a/packages/workflow/workflow-workerthread/README.md +++ b/packages/workflow/workflow-workerthread/README.md @@ -35,9 +35,9 @@ Values LEAVING the script (hook options/schemas, the script's return) are materi ## Cancellation, death, disposal -Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`. +Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). Each provider-owned cancel callback is exception-contained independently, so a broken child cannot prevent peer cancellation or workflow settlement. The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`. -A worker that dies unexpectedly (an OOM, a script reaching `process.exit` through the documented vm escape) settles the run `stopReason: 'error'` with the exit diagnostics — or `'cancelled'` when a cancel was in flight — and the host-side child registry is what winds every surviving child down. `dispose()` = cancel + immediate host-driven disposal of every registered child (a wedged worker can relay no dispose RPC, so child teardown overlaps the grace instead of starting after it; the worker's own dispose RPCs join the same per-child disposal) + bounded wait (result, then child-registry quiescence, capped by the grace) + unconditional `worker.terminate()`: the thread never outlives its run. Once a run settles, stray children a script fired without awaiting are cancelled too, and `dispose()` waits for their disposal (bounded by the grace) before returning. `agent-start`/`agent-end` pairing is host-guaranteed the same way: forwarded starts live in a ledger, worker-reported ends pair them on the graceful paths, and the termination paths (grace force-settle, worker death) synthesize the missing ends (outcome `cancelled`) before the run settles — a start still in flight across the force-settle can surface after `workflow/end`, immediately paired the same way. +A worker that dies unexpectedly (an OOM, a script reaching `process.exit` through the documented vm escape) settles the run `stopReason: 'error'` with the exit diagnostics — or `'cancelled'` when a cancel was in flight — and the host-side child registry is what winds every surviving child down. `dispose()` = cancel + immediate host-driven disposal of every registered child (a wedged worker can relay no dispose RPC, so child teardown overlaps the grace instead of starting after it; the worker's own dispose RPCs join the same per-child disposal) + bounded wait (result, then child-registry quiescence, capped by the grace) + unconditional `worker.terminate()`: the thread never outlives its run. Before an ordinary run settlement becomes observable, the host cancels every stray child on both channels too—even a fire-and-forget run still waiting on `started`, for which the worker has no handle yet—and `dispose()` then waits for their disposal (bounded by the grace) before returning. `agent-start`/`agent-end` pairing is host-guaranteed the same way: forwarded starts live in a ledger, worker-reported ends pair them on the graceful paths, and the termination paths (grace force-settle, worker death) synthesize the missing ends (outcome `cancelled`) before the run settles — a start still in flight across the force-settle can surface after `workflow/end`, immediately paired the same way. **Engine-specific limitations**: worker startup is paid per run; on a termination path `agentsStarted` reports the HOST-observed count (accepted `child-start`s — calls still queued worker-side for a concurrency slot are unknowable then); and a returned promise or thenable resolves per JavaScript semantics BEFORE materialization — that is what makes an un-awaited `return agent('x')` work — with the value-boundary guard applying to the resolution. diff --git a/packages/workflow/workflow-workerthread/package.json b/packages/workflow/workflow-workerthread/package.json index f86c74c2f7..ed934cd0cc 100644 --- a/packages/workflow/workflow-workerthread/package.json +++ b/packages/workflow/workflow-workerthread/package.json @@ -30,6 +30,7 @@ "@deepseek-ai/dsh-agent": "^0.0.1", "@deepseek-ai/dsh-brand": "^0.0.1", "@deepseek-ai/dsh-llm": "^0.0.1", + "@deepseek-ai/dsh-session": "^0.0.1", "@deepseek-ai/dsh-subagent": "^0.0.1", "@deepseek-ai/dsh-tools": "^0.0.1", "@deepseek-ai/dsh-workflow": "^0.0.1", diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index fff9d8496f..b1d92ac1d0 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -15,10 +15,13 @@ * terminated — the real kill an in-process engine could not perform). * * Children live in a host-side registry (callId → run) as soon as the provider - * accepts them, so cancellation reaches even a pre-publication attempt. The - * host observes `result` immediately but acknowledges the child to the worker - * only after `started` fulfills; readiness failure is a start error and the - * host disposes the attempt because the worker never received a handle. The + * accepts them, so cancellation reaches even a pre-publication attempt. Both + * explicit run cancellation and the shared request signal are driven when the + * workflow is cancelled OR normally settles, so a fire-and-forget child cannot + * survive merely by honoring only one channel. The host observes `result` + * immediately but acknowledges the child to the worker only after `started` + * fulfills; readiness failure is a start error and the host disposes the + * attempt because the worker never received a handle. The * worker drives disposal by RPC on the graceful path, `dispose()` host-drives * every registered child's disposal immediately (a wedged worker can relay no * dispose RPC, and child teardown must overlap the grace, not start after it), @@ -44,6 +47,7 @@ import type { WorkerOptions } from 'node:worker_threads' import type { Context } from 'cordis' import type { Agent } from '@deepseek-ai/dsh-agent' import { assertNever } from '@deepseek-ai/dsh-llm' +import { snapshotJsonValue } from '@deepseek-ai/dsh-session' import type { SubagentRun } from '@deepseek-ai/dsh-subagent' import type { WorkflowAgentEndInfo, WorkflowAgentInfo, WorkflowMeta, WorkflowResult, WorkflowRun, WorkflowRunId } from '@deepseek-ai/dsh-workflow' import { renderThrown } from './realm.ts' @@ -180,11 +184,10 @@ export class WorkerRun implements WorkflowRun { if (this.settled || this.cancelReason !== undefined) return this.cancelReason = reason ?? 'workflow cancelled' this.post(HostToWorkerType.Cancel, { reason: this.cancelReason }) - this.controller.abort(this.cancelReason) // The explicit channel is driven host-side, not left to the worker: a // provider honoring only run.cancel() must not wait on a wedged worker's // ChildCancel relay (those later RPCs land as idempotent no-ops). - for (const run of this.children.values()) run.cancel(this.cancelReason) + this.cancelChildren(this.cancelReason) this.graceTimer = setTimeout(() => { // The worker may no longer speak (it is about to be terminated): pair // every stranded start before the run settles, so ends precede @@ -274,7 +277,10 @@ export class WorkerRun implements WorkflowRun { this.onChildStart(message.callId, message.request) break case WorkerToHostType.ChildCancel: - this.children.get(message.callId)?.cancel(message.reason) + { + const run = this.children.get(message.callId) + if (run !== undefined) this.cancelChild(run, message.reason) + } break case WorkerToHostType.ChildDispose: this.onChildDispose(message.callId) @@ -322,11 +328,19 @@ export class WorkerRun implements WorkflowRun { const forwardResult = run.result.then<() => void, () => void>( (result) => { try { - const snapshot: ChildResult = structuredClone({ - output: result.output, - ...result.structured !== undefined ? { structured: result.structured } : {}, - stopReason: result.stopReason, + // Capture every provider-owned field once, then materialize the + // worker-bound value in one lossless traversal. A stateful accessor + // cannot validate one result and send another, and an exotic value is + // rejected before any prototype-erasing clone. + const output = result.output + const structured = result.structured + const stopReason = result.stopReason + const snapshot = snapshotJsonValue({ + output, + ...structured !== undefined ? { structured } : {}, + stopReason, }) + if (snapshot === undefined) throw new TypeError('child result is not losslessly JSON-serializable') return () => { this.post(HostToWorkerType.ChildSettled, { callId, result: snapshot }) } } catch (error: unknown) { const rendered = `workflow child result could not cross the worker boundary: ${renderThrown(error)}` @@ -416,18 +430,34 @@ export class WorkerRun implements WorkflowRun { /** Abort + dispose every registered child (worker death / final teardown); disposal is contained, not awaited. */ private reapChildren(reason: string): void { - this.controller.abort(this.cancelReason ?? reason) + const cancellation = this.cancelReason ?? reason + this.cancelChildren(cancellation) for (const [callId, run] of [...this.children]) { - run.cancel(this.cancelReason ?? reason) void this.disposeChild(callId, run) } } + /** Drive both cancellation channels for every child already accepted by the host. */ + private cancelChildren(reason: string): void { + this.controller.abort(reason) + for (const run of this.children.values()) this.cancelChild(run, reason) + } + + /** Contain one provider-owned cancel callback so every peer still receives cancellation. */ + private cancelChild(run: SubagentRun, reason?: string): void { + try { + run.cancel(reason) + } catch (error: unknown) { + this.ctx.logger.warn(`workflow-workerthread: child cancel failed: ${renderThrown(error)}`) + } + } + private onResult(result: WorkflowResult): void { - // The worker's settle-reap already child-cancel()s every stray; this - // abort fires the seam signal too, for providers that only honor the - // request signal (both channels, on every path). - if (this.cancelReason === undefined) this.controller.abort('workflow settled') + // The worker cancels handles it already received, but a fire-and-forget + // child may still be waiting on readiness and therefore have no worker + // handle. Drive BOTH provider-permitted channels from the host before the + // workflow becomes externally settled. + if (this.cancelReason === undefined) this.cancelChildren('workflow settled') if (this.cancelReason !== undefined && result.stopReason !== 'cancelled') { // The script settled while our cancel was crossing the thread boundary // — the seam-visible result had NOT settled when cancellation was diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 23d4de0f07..46a42e4036 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -366,15 +366,68 @@ describe('dsh-workflow-workerthread', () => { expect((result.value as { message: string }).message).toContain('backend exploded') }) - it('maps an uncloneable ready-child result to fatal AGENT_RESULT instead of wedging the bridge', async () => { + it('maps a non-JSON ready-child result to fatal AGENT_RESULT instead of wedging the bridge', async () => { const { ctx, parent } = await setup({ - reply: () => ({ output: [], structured: () => { /* deliberately not cloneable */ }, stopReason: 'completed' }), + reply: () => ({ output: [], structured: () => { /* deliberately outside lossless JSON */ }, stopReason: 'completed' }), }) const result = await run(ctx, parent, scripted(` try { await agent('p'); return 'unreachable' } catch (e) { return { code: e.code, message: e.message } } `)) expect(result.value).toMatchObject({ code: 'AGENT_RESULT' }) - expect((result.value as { message: string }).message).toContain('could not cross the worker boundary') + expect((result.value as { message: string }).message).toContain('subagent result must be losslessly JSON-serializable') + }) + + it('contains a non-JSON result even if the injected subagent service violates its normalization contract', async () => { + // SubagentService normally rejects this before the workflow sees it. Stub + // the injected seam itself so the host's defensive worker-boundary guard + // remains independently covered rather than becoming dead, untested code. + const { ctx, parent } = await setup() + const invalid = { + output: [], + structured: () => { /* deliberately outside lossless JSON */ }, + stopReason: 'completed', + } as unknown as SubagentResult + const start = vi.spyOn(ctx.subagents, 'start').mockReturnValue({ + id: AgentId('raw-invalid-child'), + started: Promise.resolve(), + result: Promise.resolve(invalid), + cancel: () => { /* already settled */ }, + dispose: () => Promise.resolve(), + }) + + const result = await run(ctx, parent, scripted(` + try { await agent('p'); return 'unreachable' } catch (e) { return { code: e.code, message: e.message } } + `)) + + expect(start).toHaveBeenCalledOnce() + expect(result.value).toMatchObject({ code: 'AGENT_RESULT' }) + expect((result.value as { message: string }).message) + .toContain('workflow child result could not cross the worker boundary') + }) + + it('reads each resolved child-result field once before crossing the worker boundary', async () => { + let structuredReads = 0 + class DriftedStructured { readonly value = 'drifted' } + const { ctx, parent } = await setup({ + reply: () => ({ + output: [], + get structured() { + structuredReads += 1 + return structuredReads === 1 ? { value: 'accepted' } : new DriftedStructured() + }, + stopReason: 'completed', + }), + }) + + const result = await run(ctx, parent, scripted(` + const found = await agent('p', { + schema: { type: 'object', properties: { value: { type: 'string' } }, required: ['value'] } + }) + return found.value + `)) + + expect(result.value).toBe('accepted') + expect(structuredReads).toBe(1) }) it('a child whose dispose() throws synchronously cannot wedge the script (the host acks anyway)', async () => { @@ -703,6 +756,81 @@ describe('dsh-workflow-workerthread', () => { await handle.dispose() }) + it('the settle-reap explicitly cancels a readiness-pending stray before workflow/end', async () => { + const { ctx, parent, provider } = await setup({ manual: true, deferStart: true }) + const childLifecycle: string[] = [] + let cancellationAtWorkflowEnd: string | undefined + ctx.on('workflow/agent-start', () => { childLifecycle.push('start') }) + ctx.on('workflow/agent-end', () => { childLifecycle.push('end') }) + ctx.on('workflow/end', () => { + cancellationAtWorkflowEnd = provider.runs[0]?.cancelled + }) + const handle = ctx.workflows.start({ + ...scripted(` + agent('readiness-pending stray') + return 'done' + `), + parent, + }) + + const result = await handle.result + + expect(result.stopReason).toBe('completed') + expect(provider.runs).toHaveLength(1) + expect(provider.runs[0]!.request.signal?.aborted).toBe(true) + expect(provider.runs[0]!.request.signal?.reason).toBe('workflow settled') + expect(provider.runs[0]!.cancelled).toBe('workflow settled') + expect(cancellationAtWorkflowEnd).toBe('workflow settled') + expect(childLifecycle).toEqual([]) + await handle.dispose() + expect(provider.runs[0]!.disposeCalls).toBe(1) + }) + + it('contains a throwing child cancel and still settles after cancelling peer strays', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + let starts = 0 + const cancelled: string[] = [] + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const provider: SubagentProvider = { + name: 'throwing-cancel', + capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, + inheritsParentContext: false, + start: () => { + const index = starts++ + return { + id: AgentId(`throwing-cancel-${index}`), + started: new Promise(() => { /* readiness stays pending */ }), + result: new Promise(() => { /* cancellation callback owns settlement */ }), + cancel: (reason?: string) => { + if (index === 0) throw new Error('cancel callback broke') + cancelled.push(`${index}:${reason ?? 'cancelled'}`) + }, + dispose: () => Promise.resolve(), + } + }, + } + ctx.subagents.registerProvider(provider) + await ctx.plugin(WorkerWorkflowEngine, { provider: 'throwing-cancel', maxConcurrentAgents: 2 }) + const handle = ctx.workflows.start({ + ...scripted(` + agent('first stray') + agent('second stray') + return 'done' + `), + parent: fakeParent(), + }) + + const result = await handle.result + + expect(result.stopReason).toBe('completed') + expect(starts).toBe(2) + expect(cancelled).toContain('1:workflow settled') + expect(warnings.some(message => message.includes('cancel callback broke'))).toBe(true) + await handle.dispose() + }) + it("cancel() drives each child's explicit cancel() host-side: a wedged worker cannot delay it", async () => { const ctx = new Context() await ctx.plugin(SubagentService) diff --git a/packages/workflow/workflow-workerthread/tsconfig.json b/packages/workflow/workflow-workerthread/tsconfig.json index 385651c192..730a3e61d9 100644 --- a/packages/workflow/workflow-workerthread/tsconfig.json +++ b/packages/workflow/workflow-workerthread/tsconfig.json @@ -26,6 +26,9 @@ { "path": "../../llm/llm" }, + { + "path": "../../core/session" + }, { "path": "../../subagent/subagent" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 68ec4e3183..575f2bbf9f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -75,34 +75,6 @@ importers: specifier: ^4.1.8 version: 4.1.8(@types/node@22.20.0)(@vitest/coverage-v8@4.1.8)(jsdom@29.1.1)(vite@8.0.16(@types/node@22.20.0)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.22.4)(yaml@2.9.0)) - packages/ui/user-approval: - dependencies: - schemastery: - specifier: ^3.18.0 - version: 3.18.0 - devDependencies: - '@deepseek-ai/dsh-agent': - specifier: workspace:^ - version: link:../../core/agent - '@deepseek-ai/dsh-brand': - specifier: workspace:^ - version: link:../../util/brand - '@deepseek-ai/dsh-llm': - specifier: workspace:^ - version: link:../../llm/llm - '@deepseek-ai/dsh-scope': - specifier: workspace:^ - version: link:../../core/scope - '@deepseek-ai/dsh-session': - specifier: workspace:^ - version: link:../../core/session - '@deepseek-ai/dsh-system-prompt': - specifier: workspace:^ - version: link:../../core/system-prompt - cordis: - specifier: ^4.0.0-rc.6 - version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) - packages/bash/bash: devDependencies: '@deepseek-ai/dsh-brand': @@ -167,9 +139,6 @@ importers: '@deepseek-ai/dsh-agent-loop': specifier: workspace:^ version: link:../../core/agent-loop - '@deepseek-ai/dsh-user-approval': - specifier: workspace:^ - version: link:../../ui/user-approval '@deepseek-ai/dsh-bash': specifier: workspace:^ version: link:../bash @@ -197,6 +166,9 @@ importers: '@deepseek-ai/dsh-tools': specifier: workspace:^ version: link:../../core/tools + '@deepseek-ai/dsh-user-approval': + specifier: workspace:^ + version: link:../../ui/user-approval cordis: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) @@ -436,6 +408,9 @@ importers: '@deepseek-ai/dsh-scope': specifier: workspace:^ version: link:../scope + '@deepseek-ai/dsh-session': + specifier: workspace:^ + version: link:../session cordis: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) @@ -449,9 +424,6 @@ importers: '@deepseek-ai/dsh-agent': specifier: workspace:^ version: link:../agent - '@deepseek-ai/dsh-user-approval': - specifier: workspace:^ - version: link:../../ui/user-approval '@deepseek-ai/dsh-code-runtime': specifier: workspace:^ version: link:../../code-runtime/code-runtime @@ -467,6 +439,9 @@ importers: '@deepseek-ai/dsh-system-prompt': specifier: workspace:^ version: link:../system-prompt + '@deepseek-ai/dsh-user-approval': + specifier: workspace:^ + version: link:../../ui/user-approval cordis: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) @@ -849,6 +824,9 @@ importers: '@deepseek-ai/dsh-scope': specifier: workspace:^ version: link:../../core/scope + '@deepseek-ai/dsh-session': + specifier: workspace:^ + version: link:../../core/session '@deepseek-ai/dsh-tools': specifier: workspace:^ version: link:../../core/tools @@ -1177,9 +1155,6 @@ importers: '@deepseek-ai/dsh-agent-loop': specifier: workspace:^ version: link:../../core/agent-loop - '@deepseek-ai/dsh-user-approval': - specifier: workspace:^ - version: link:../user-approval '@deepseek-ai/dsh-bash': specifier: workspace:^ version: link:../../bash/bash @@ -1228,6 +1203,9 @@ importers: '@deepseek-ai/dsh-tools': specifier: workspace:^ version: link:../../core/tools + '@deepseek-ai/dsh-user-approval': + specifier: workspace:^ + version: link:../user-approval '@deepseek-ai/dsh-user-interaction': specifier: workspace:^ version: link:../user-interaction @@ -1355,6 +1333,34 @@ importers: specifier: ^4.0.0-rc.6 version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/ui/user-approval: + dependencies: + schemastery: + specifier: ^3.18.0 + version: 3.18.0 + devDependencies: + '@deepseek-ai/dsh-agent': + specifier: workspace:^ + version: link:../../core/agent + '@deepseek-ai/dsh-brand': + specifier: workspace:^ + version: link:../../util/brand + '@deepseek-ai/dsh-llm': + specifier: workspace:^ + version: link:../../llm/llm + '@deepseek-ai/dsh-scope': + specifier: workspace:^ + version: link:../../core/scope + '@deepseek-ai/dsh-session': + specifier: workspace:^ + version: link:../../core/session + '@deepseek-ai/dsh-system-prompt': + specifier: workspace:^ + version: link:../../core/system-prompt + cordis: + specifier: ^4.0.0-rc.6 + version: 4.0.0-rc.6(@cordisjs/plugin-include@1.0.4)(@cordisjs/plugin-loader@1.0.0-rc.4) + packages/ui/user-interaction: devDependencies: '@deepseek-ai/dsh-agent': From a9cb70d89685a6e5fa6dc0fb093ec2ae7987747b Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 05:13:17 +0800 Subject: [PATCH 02/21] fix(scope): harden final ownership boundaries --- docs/config-catalog.md | 6 +- docs/cordis-catalog/events.md | 46 ++- docs/cordis-catalog/services.md | 16 +- docs/core-data-structures/core.md | 2 + docs/core-data-structures/scope.md | 31 ++ docs/core-data-structures/system-prompt.md | 37 +++ docs/event-producer-consumer.md | 33 +- ...-18-agent-lifecycle-and-ownership-seams.md | 4 +- .../2026-07-08-agent-scope-contexts.md | 123 ++++--- .../cordis/tool-cordis/src/api-catalog.ts | 20 +- packages/core/agent-loop/README.md | 4 +- packages/core/agent-loop/src/agent.ts | 84 +++-- packages/core/agent-loop/src/index.ts | 117 ++++--- packages/core/agent-loop/tests/agent.spec.ts | 51 ++- .../agent-loop/tests/scope-lifecycle.spec.ts | 56 ++++ packages/core/agent/README.md | 6 +- packages/core/agent/src/dispatch.ts | 33 +- packages/core/agent/src/index.ts | 153 ++++++++- packages/core/agent/src/types.ts | 5 +- packages/core/agent/tests/agent.spec.ts | 171 +++++++++- packages/core/scope/README.md | 2 +- packages/core/scope/src/index.ts | 156 +++++++-- packages/core/scope/tests/scope.spec.ts | 161 ++++++++- packages/core/session/README.md | 15 +- packages/core/session/src/index.ts | 246 ++++++++++++-- packages/core/session/tests/scoped.spec.ts | 17 + packages/core/session/tests/session.spec.ts | 183 +++++++++- packages/core/system-prompt/README.md | 8 +- packages/core/system-prompt/src/index.ts | 143 ++++++-- .../system-prompt/tests/system-prompt.spec.ts | 130 ++++++++ packages/core/tools/README.md | 4 +- packages/core/tools/src/index.ts | 33 +- packages/core/tools/tests/tools.spec.ts | 91 ++++- .../subagent/subagent-inprocess/README.md | 4 +- .../subagent/subagent-inprocess/src/index.ts | 57 ++-- .../tests/subagent-inprocess.spec.ts | 32 ++ packages/subagent/subagent-spawn/README.md | 2 +- .../tests/subagent-spawn.spec.ts | 31 +- packages/subagent/subagent/README.md | 8 +- packages/subagent/subagent/src/index.ts | 313 +++++++++++++----- .../subagent/subagent/tests/service.spec.ts | 306 ++++++++++++++++- packages/support/invariants/src/index.ts | 1 + packages/ui/acp/src/index.ts | 2 +- packages/ui/acp/tests/dispose.spec.ts | 8 +- packages/ui/user-approval/README.md | 4 +- packages/ui/user-approval/src/index.ts | 158 ++++++--- .../ui/user-approval/tests/approval.spec.ts | 161 +++++++++ .../workflow/workflow-workerthread/README.md | 2 +- .../workflow-workerthread/src/host.ts | 27 +- .../tests/workflow-workerthread.spec.ts | 35 ++ scripts/gen-doc-graphs.ts | 7 + scripts/type-equiv.manifest.json | 8 + 52 files changed, 2839 insertions(+), 514 deletions(-) create mode 100644 docs/core-data-structures/scope.md create mode 100644 docs/core-data-structures/system-prompt.md diff --git a/docs/config-catalog.md b/docs/config-catalog.md index d7b7be2d88..0a1c0289ae 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -144,7 +144,7 @@ export interface Config { Depends on: [`AgentId`](../packages/core/agent/src/index.ts) · [`AgentOptions`](../packages/core/agent/src/index.ts) · [`SessionId`](../packages/core/session/src/index.ts) -Source: [`packages/core/agent-loop/src/index.ts:37`](../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:44`](../packages/core/agent-loop/src/index.ts) ## `@deepseek-ai/dsh-bash-local` @@ -790,7 +790,7 @@ export interface Config { } ``` -Source: [`packages/core/system-prompt/src/index.ts:265`](../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:315`](../packages/core/system-prompt/src/index.ts) ## `@deepseek-ai/dsh-tool-cordis` @@ -1001,7 +1001,7 @@ export interface Config { export type ApprovalPolicy = 'ask' | 'never' ``` -Source: [`packages/ui/user-approval/src/index.ts:268`](../packages/ui/user-approval/src/index.ts) +Source: [`packages/ui/user-approval/src/index.ts:281`](../packages/ui/user-approval/src/index.ts) ## `@deepseek-ai/dsh-web` diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index f5a0533842..cc450a782e 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -15,7 +15,7 @@ Dispatch modes: **emit** (fire-and-forget), **waterfall** (each listener gets `n ### `agent/created` — emit -An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store, but concrete factories may keep driving verbs locked until the subsequent `agent/session-start` boundary; that event is the first supported place to inject or queue work during startup. +An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store, but concrete factories may keep driving verbs locked until the subsequent `agent/session-start` boundary; that event is the first supported place to inject or queue work during startup. A synchronous listener throw vetoes publication and rollback emits the matching disposal edges; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. ```ts cordis-catalog 'agent/created'(this: Scoped, agent: Agent): void @@ -23,7 +23,7 @@ An agent's fully composed scoped world was published in the AgentRegistry. Its s Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:300`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:303`](../../packages/core/agent/src/types.ts) ### `agent/disposed` — emit @@ -35,7 +35,7 @@ An agent was removed from the registry after its driver and any in-flight turn r Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:314`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:317`](../../packages/core/agent/src/types.ts) ### `agent/error` — emit @@ -47,7 +47,7 @@ A step or turn errored. The loop reports a failure here (plus the logger) even w Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:587`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:590`](../../packages/core/agent/src/types.ts) ### `agent/pre-step` — serial @@ -61,7 +61,7 @@ Serial (awaited in registration order), not a waterfall: a listener mutates the Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:419`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:422`](../../packages/core/agent/src/types.ts) ### `agent/prompt-submit` — waterfall @@ -73,7 +73,7 @@ Waterfall: decide what happens to ONE drained queued message before it becomes a Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:437`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:440`](../../packages/core/agent/src/types.ts) ### `agent/queued` — emit @@ -85,7 +85,7 @@ A message entered the agent's inbox (queued or steering). `source` is the resolv Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:342`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:345`](../../packages/core/agent/src/types.ts) ### `agent/request` — waterfall @@ -97,7 +97,7 @@ Waterfall: shape the step's call configuration — model switching, sampling ove Types: [Agent](../core-data-structures/core.md) · [LlmCallConfig](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:466`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:469`](../../packages/core/agent/src/types.ts) ### `agent/session-prefix` — waterfall @@ -113,7 +113,7 @@ The seed is a frozen empty list; a contributing listener returns a NEW array — Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:518`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:521`](../../packages/core/agent/src/types.ts) ### `agent/session-start` — emit @@ -125,7 +125,7 @@ The agent's session lifecycle began, fired once before its first turn. `source` Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:362`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:365`](../../packages/core/agent/src/types.ts) ### `agent/status` — emit @@ -137,7 +137,7 @@ Agent status changed (`idle` ⇄ `running`, or → `disposed`). Drive lifecycle Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:328`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:331`](../../packages/core/agent/src/types.ts) ### `agent/step-result` — waterfall @@ -149,7 +149,7 @@ Waterfall: post-process the assembled assistant Message before tool dispatch (va Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:533`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:536`](../../packages/core/agent/src/types.ts) ### `agent/turn-continuation` — waterfall @@ -161,7 +161,7 @@ Waterfall: override the turn-continuation decision via a typed ContinuationDecis Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:551`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:554`](../../packages/core/agent/src/types.ts) ### `agent/turn-stop` — serial @@ -173,7 +173,7 @@ Serial terminal-stop checkpoint after the ordinary `agent/turn-continuation` wat Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:570`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:573`](../../packages/core/agent/src/types.ts) ## `approval/*` @@ -245,13 +245,23 @@ Source: [`packages/llm/llm/src/index.ts:39`](../../packages/llm/llm/src/index.ts ### `session/created` — emit -A session was created in the store. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. +A session was created in the store. A synchronous listener throw vetoes publication and rollback emits the matching `session/disposed` edge; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. ```ts cordis-catalog 'session/created'(this: Scoped, session: Session): void ``` -Source: [`packages/core/session/src/index.ts:47`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:50`](../../packages/core/session/src/index.ts) + +### `session/disposed` — emit + +A previously announced session left the store. Emitted exactly once on normal detach or publication rollback, and never for a prepared/entered session whose `session/created` announcement did not begin. Listener failures (including returned-promise rejections) are logged and contained per listener so teardown always reaches quiescence. Scope-filtered dispatch uses the same owner carrier captured at entry; agent-scoped listeners hear only their own session's teardown. + +```ts cordis-catalog +'session/disposed'(this: Scoped, session: Session): void +``` + +Source: [`packages/core/session/src/index.ts:62`](../../packages/core/session/src/index.ts) ### `session/event` — emit @@ -263,7 +273,7 @@ An event was appended to a session log (sync, fire-and-forget). This is the per- Types: [SessionEvent](../core-data-structures/core.md) -Source: [`packages/core/session/src/index.ts:61`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:76`](../../packages/core/session/src/index.ts) ### `session/flush` — parallel @@ -273,7 +283,7 @@ Awaited durability checkpoint. The agent loop awaits `ctx.sessions.flush(session 'session/flush'(this: Scoped, session: Session): Promise | void ``` -Source: [`packages/core/session/src/index.ts:79`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:94`](../../packages/core/session/src/index.ts) ## `skill/*` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index 903c368b7c..b7caa6f842 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -21,18 +21,19 @@ async createAgent(options: CreateAgentOptions): Promise async resume(options: ResumeAgentOptions): Promise ``` -Source: [`packages/core/agent-loop/src/index.ts:71`](../../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:78`](../../packages/core/agent-loop/src/index.ts) ## `ctx.agents` — `AgentRegistry` Agent registry (`ctx.agents`): tracks live agents so UI, hook, and orchestrator plugins can find them without depending on the concrete loop package. Agent *creation* is provided by whichever plugin implements the AgentFactory (`@deepseek-ai/dsh-agent-loop`), registered via setFactory. ```ts cordis-catalog +reserve(id: AgentId): AgentRegistrationReservation setFactory(factory: AgentFactory): () => Promise | void async create(options: CreateAgentOptions): Promise async resume(options: ResumeAgentOptions): Promise register(agent: Agent): () => Promise | void -enter(agent: Agent): () => void +enter(agent: Agent, reservation?: AgentRegistrationReservation): () => void announce(agent: Agent): void get(id: AgentId): Agent | undefined list(): Agent[] @@ -40,7 +41,7 @@ list(): Agent[] Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/index.ts:174`](../../packages/core/agent/src/index.ts) +Source: [`packages/core/agent/src/index.ts:202`](../../packages/core/agent/src/index.ts) ## `ctx.approval` — `ApprovalService` @@ -54,7 +55,7 @@ async request(req: ApprovalRequest): Promise Types: [ApprovalOutcome](../core-data-structures/approval.md) · [ApprovalRequest](../core-data-structures/approval.md) -Source: [`packages/ui/user-approval/src/index.ts:292`](../../packages/ui/user-approval/src/index.ts) +Source: [`packages/ui/user-approval/src/index.ts:305`](../../packages/ui/user-approval/src/index.ts) ## `ctx.bash` — `BashExecutor` (abstract seam) @@ -210,9 +211,10 @@ In-memory session store (`ctx.sessions`). Persistence is intentionally not implemented here — persistence plugins subscribe to `session/event` and flush on `session/flush` / dispose. ```ts cordis-catalog +reserve(id: SessionId): SessionRegistrationReservation create(id?: SessionId, options?: CreateSessionOptions): Session prepare(id?: SessionId, options?: CreateSessionOptions): Session -enter(session: Session): () => void +enter(session: Session, reservation?: SessionRegistrationReservation): () => void announce(session: Session): void async flush(session: Session): Promise get(id: SessionId): Session | undefined @@ -220,7 +222,7 @@ list(): Session[] fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Session ``` -Source: [`packages/core/session/src/index.ts:608`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:663`](../../packages/core/session/src/index.ts) ## `ctx.skills` — `SkillService` @@ -260,7 +262,7 @@ protect(protection: PromptProtection): () => Promise | void async assemble(context: AssembleContext = {}): Promise ``` -Source: [`packages/core/system-prompt/src/index.ts:380`](../../packages/core/system-prompt/src/index.ts) +Source: [`packages/core/system-prompt/src/index.ts:430`](../../packages/core/system-prompt/src/index.ts) ## `ctx.tools` — `ToolRegistry` diff --git a/docs/core-data-structures/core.md b/docs/core-data-structures/core.md index b601c2ae29..76ec27e744 100644 --- a/docs/core-data-structures/core.md +++ b/docs/core-data-structures/core.md @@ -16,8 +16,10 @@ Everything else is documented on a **sub-page**, not here. The rule that draws t | Sub-page | Owns | |---|---| | [llm-streaming.md](llm-streaming.md) | the `StreamChunk` wire protocol + adapter contract, `BlockAssembler`, the `LlmAdapter` seam | +| [scope.md](scope.md) | scoped registration identity, dispatch carriers, and the owned `Scope` context | | [session.md](session.md) | the full `SessionEventMap` variant catalog, `TurnTrigger`/`TurnEndReason`, `deriveMessages()`, the turn-enclosure invariant | | [persistence.md](persistence.md) | the durability seam: `SessionPersistence`, JSONL + SQLite backends, `session/flush`, crash recovery, `SessionHeader` | +| [system-prompt.md](system-prompt.md) | per-assembly context, tool-provider results, and canonical contribution protection | | [tools.md](tools.md) | `ToolDefinition` full fields, the schema DSL, `ToolExecution`/`ToolResult`, tool-presentation UI types, and the guarded execution pipeline | | [user-interaction.md](user-interaction.md) | the UI-backed human question/answer seam: `AskUserQuestionRequest`, answer/options vocabulary, provider API, error taxonomy | | [approval.md](approval.md) | the one-shot user-approval seam: `ApprovalRequest`, `ApprovalOutcome`, per-session policy, audit and answerer contracts | diff --git a/docs/core-data-structures/scope.md b/docs/core-data-structures/scope.md new file mode 100644 index 0000000000..d2a2fc47d4 --- /dev/null +++ b/docs/core-data-structures/scope.md @@ -0,0 +1,31 @@ +# Scoped Registration + +The [scope package](../../packages/core/scope) supplies the identity and carrier vocabulary that makes one registration context mean both per-agent visibility and shared lifetime ownership. It is a library primitive rather than a Cordis service; the [agent-scope RFC](../rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md) owns the design rationale, while the package [README](../../packages/core/scope/README.md) owns the callable API and filtering semantics. + +Source: [`packages/core/scope/src/index.ts`](../../packages/core/scope/src/index.ts). + +## Identity and dispatch carrier + +`ScopeKey` is an opaque object identity. The shipped loop uses the live `Agent` object as its own key, but the primitive never inspects the object. + +```ts type-equiv +type ScopeKey = object +``` + +`Scoped` is the compile-time brand on the proxy returned by `scopeTarget(base, key)`. Scope-filtered event declarations require this carrier as their `this` type, preventing an ordinary subject object from type-checking as the dispatch carrier. + +```ts type-equiv +type Scoped = T & { readonly [ScopedBrand]: 'dsh.scope.carrier' } +``` + +## Owned registration context + +`Scope` pairs the tagged registration context with two teardown surfaces. `rawDispose` preserves the exact Cordis disposer identity needed by an ordered composite effect; `dispose()` is the public shared quiescence boundary for direct and racing callers. + +```ts type-equiv +interface Scope { + ctx: Context + rawDispose: () => Promise | void + dispose(): Promise +} +``` diff --git a/docs/core-data-structures/system-prompt.md b/docs/core-data-structures/system-prompt.md new file mode 100644 index 0000000000..0406ddb1a3 --- /dev/null +++ b/docs/core-data-structures/system-prompt.md @@ -0,0 +1,37 @@ +# System Prompt Assembly + +The [system-prompt package](../../packages/core/system-prompt) owns the data exchanged between prompt contributors and one assembly call. The package [README](../../packages/core/system-prompt/README.md) documents registration, ordering, scoping, and rendering behavior; this page pins the literal cross-package shapes that plugins implement or pass. + +Source: [`packages/core/system-prompt/src/index.ts`](../../packages/core/system-prompt/src/index.ts). + +## Assembly context + +`AssembleContext` identifies the scope layer one assembly resolves. It is merge-extensible: `dsh-agent` adds the optional live `agent` field, and `assembleContextFor(agent)` sets that field and `scope` together. + +```ts type-equiv +interface AssembleContext { + scope?: ScopeKey +} +``` + +## Tool-provider result + +`ToolProviderResult.schemas` is the model-visible set for the current assembly. `knownNames` is the provider's pre-restriction name universe used to distinguish a configured-name typo from a known tool that is deliberately hidden in this scope. + +```ts type-equiv +interface ToolProviderResult { + schemas: ToolSchema[] + knownNames?: readonly string[] +} +``` + +## Canonical contribution protection + +`PromptProtection` names section and tool contributions whose canonical registry output remains authoritative after the assembly waterfall. Either field may be omitted, but a registration with no names is rejected. + +```ts type-equiv +interface PromptProtection { + sections?: readonly string[] + tools?: readonly string[] +} +``` diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index 5a0c547e70..7b26f43b12 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -7,27 +7,28 @@ This matrix shows which packages dispatch each harness-owned event and which pac | Event | Mode | Declared in | Dispatchers | Listeners | | --- | --- | --- | --- | --- | -| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:300`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:314`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:587`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:419`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | -| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:437`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | -| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:342`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:466`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:518`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | -| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:362`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | -| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:328`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:533`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:551`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | -| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:570`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | +| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:303`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:317`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:590`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:422`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | +| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:440`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | +| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:345`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:469`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:521`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | +| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:365`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | +| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:331`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:536`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:554`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | +| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:573`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | | `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:72`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) | | `fs/edit-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:123`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) | | `fs/observed` | `emit` | [`packages/fs/fs/src/index.ts:138`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`emit`) | [`fs-policy`](../packages/fs/fs-policy) | | `fs/write-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:109`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) | | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:39`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`invariants`](../packages/support/invariants), [`llm-replay`](../packages/support/llm-replay) | -| `session/created` | `emit` | [`packages/core/session/src/index.ts:47`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | -| `session/event` | `emit` | [`packages/core/session/src/index.ts:61`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | -| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:79`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | +| `session/created` | `emit` | [`packages/core/session/src/index.ts:50`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | +| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:62`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | - | +| `session/event` | `emit` | [`packages/core/session/src/index.ts:76`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | +| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:94`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | | `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:132`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:138`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:115`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | diff --git a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md index 2b1c198812..8e1acd1638 100644 --- a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md +++ b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md @@ -18,7 +18,7 @@ A new `cancel()` verb on the `Agent` interface — the single public stop primit `ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **capability** — only the holder can tear down exactly this agent: stop its loop, `await` the loop's exit (true quiescence, not just the `disposed` status flip), unregister it, and remove its session from the store. `ctx.agents.get(id)` still returns a bare `Agent`. Config-created agents stay owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw). -**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race the session's `onAppend` detach against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The register disposer's `agent/disposed` emit is contained (a throwing listener must not reject the chain and skip the later session detach). +**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race detaching the session store's private append observer against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The contained `agent/disposed` and `session/disposed` notifications cannot reject the chain or skip later teardown. ### 3. Bash owner token in the seam @@ -40,7 +40,7 @@ The bash owner-token comparison relies on `session.header.id` being unique among ## Alternatives considered - **A public `BashTask.owner` field** instead of the `BashExecutor.ownerOf(id)` seam — rejected: one read path, no redundant API. -- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing the session's `onAppend` detach against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths. +- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing the store-owned append observer's detach against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths. - **A separate step-only `abort()` beside `cancel()`** — shipped originally, then removed as unused; `cancel()` is the single public stop primitive ([the public-stop-surface RFC](../simplification/2026-06-20-public-agent-stop-surface.md)). ## Consequences diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 981603cb19..436a208be8 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -11,7 +11,7 @@ This is a composition problem, not an application-isolation problem. Starting a | Surface | What varies by agent | Failure when it is only global | |---|---|---| | Tools | Available capabilities, a child-only tool, or a scoped replacement for one implementation | The model receives excess authority, or a child-specific tool leaks into every prompt | -| Prompt state | Persona, instructions, variables, and Code Mode SDK declarations | Every agent receives the same instructions or runtime facts | +| Prompt state | Persona, instructions, variables, and [Code Mode](../feature/2026-06-15-code-mode.md) SDK declarations | Every agent receives the same instructions or runtime facts | | Live policy | Hooks, execution guards, result observers, and continuation rules | A listener intended for one agent can alter another agent's work | | Lifetime | Cleanup when the agent fails, is cancelled, is disposed, or loses its owner | Registrations outlive the agent or disappear before its final work settles | @@ -19,23 +19,30 @@ Two consistency requirements make the problem deeper than filtering a list. Firs Second, some rules are invariants rather than cooperative extensions. An ordinary middleware listener may replace a prompt assembly, turn an allow into a deny, rewrite a result, force another model step, or short-circuit listeners registered after it. Structured output therefore cannot rely on being “first” or “last” in an extensible listener chain; the owning service needs a final boundary for rules that later listeners must not undo. -The subagent API makes both needs concrete. Two concurrent children can request different personas, tool filters, and output schemas. Those requests are honest only when each child receives an independently owned view and when its terminal-output protocol survives unrelated plugins. +Third, accepting a value must transfer ownership of the exact value that was checked. TypeScript `readonly` annotations disappear at runtime, callers and providers may expose stateful accessors, and a validation pass followed by a clone reads mutable input twice. Identity fields, schemas, session data, requests, and results therefore need runtime boundaries that capture each caller-owned field once, materialize data once, and expose only owner-controlled snapshots. Otherwise the checked, executed, logged, and observed views can diverge even when scope resolution itself is correct. + +The subagent API makes these requirements concrete. Two concurrent children can request different personas, tool filters, and output schemas. Those requests are honest only when each child receives an independently owned view and when its terminal-output protocol survives unrelated plugins. ## Decision Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's world composable with normal plugin APIs while keeping authority, observation, and cleanup aligned. -The design has three parts: +The design has four parts: | Part | Rule | Purpose | |---|---|---| | Registration scope | A registration through a plain plugin context is global; the same registration through `agent.ctx` belongs to that agent | Reuse existing APIs for per-agent tools, prompt state, and listeners | | Lifecycle transaction | Create and resume await scoped setup while the agent and session are unpublished, then publish them in an ordered rollback-covered sequence | No observer sees a partially composed agent, and every failure path owns cleanup | | Owner-final policy | Prompt protection, tool guards, final tool-result observation, and terminal turn stopping run at service-owned boundaries | Invariants do not depend on listener registration order | +| Boundary ownership | Services capture fixed fields once, materialize lossless-JSON data once, and publish owner-controlled views | Validation, execution, persistence, and telemetry cannot observe different values from one call | + +Three domain terms recur below. A **Session** is one agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** means JSON primitives plus dense arrays and plain objects that can be copied without changing meaning; the boundary rejects sparse arrays, cycles, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols instead of coercing or erasing them. **Code Mode** presents the model with a generated software-development-kit interface and a reserved `run_code` transport, rather than advertising every end-capability as a native tool. + +Ownership stays with the component that can enforce each fact. The scope package owns scope tags and carrier construction; each registry owns acceptance snapshots and resolution; the agent factory owns identity reservation, setup, and publication; the session owns accepted history; the tool and subagent services own their pipeline records; and the workflow host owns cancellation of the runs it started. A caller never validates a value that another component later rereads from the caller's mutable object. The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without silently inheriting authority. -The implementation lives primarily in [`dsh-scope`](../../../../packages/core/scope/README.md), [`dsh-agent`](../../../../packages/core/agent/README.md), [`dsh-system-prompt`](../../../../packages/core/system-prompt/README.md), and [`dsh-tools`](../../../../packages/core/tools/README.md). The [generated Cordis event catalog](../../../cordis-catalog/events.md) is the exhaustive event-signature reference; this RFC explains why the contracts have their current shape. +The core implementation lives in [`dsh-scope`](../../../../packages/core/scope/README.md), [`dsh-agent`](../../../../packages/core/agent/README.md), [`dsh-agent-loop`](../../../../packages/core/agent-loop/README.md), [`dsh-session`](../../../../packages/core/session/README.md), [`dsh-system-prompt`](../../../../packages/core/system-prompt/README.md), and [`dsh-tools`](../../../../packages/core/tools/README.md). The composition example spans [`dsh-subagent`](../../../../packages/subagent/subagent/README.md), [`dsh-subagent-inprocess`](../../../../packages/subagent/subagent-inprocess/README.md), and [`dsh-workflow-workerthread`](../../../../packages/workflow/workflow-workerthread/README.md). The [generated Cordis event catalog](../../../cordis-catalog/events.md) is the exhaustive event-signature reference; this RFC explains why the contracts have their current shape. ## Background: the small Cordis vocabulary used here @@ -149,7 +156,11 @@ Calling a service through `agent.ctx` does not implicitly make every later read The tool view must not change because a caller kept the object it passed to `register()` or received a definition from `get()` or `visible()`. Registration therefore creates the stored identity once; future changes happen through explicit unregister/register effects. -Tool parameters cross the model and log boundary, so the registry materializes them with `snapshotJsonValue`: one recursive traversal reads each property once, rejects anything outside lossless JSON, and constructs the detached value that is actually stored. A check followed by `structuredClone` is not equivalent—a getter could return plain JSON to the check and a class instance to the clone, which would erase its prototype and silently accept different data. The first-party `defineTool()` helper closes the earlier authoring boundary with the same primitive: it reads every top-level option once, materializes the `SchemaSpec`, and derives an independent wire schema plus all later execute/presentation validation from that accepted snapshot. Without that split, mutating an author-owned spec after definition could make the model call a schema that the tool no longer accepts. Registration then reads every top-level definition field exactly once, validates, binds, and stores only those captured values; a stateful `parameters` or callback accessor therefore cannot make the checked definition differ from the executable one. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections. +Tool parameters cross the model and log boundary, so the registry materializes them with `snapshotJsonValue`: one recursive traversal reads each property once, rejects anything outside lossless JSON, and constructs the detached value that is actually stored. A check followed by `structuredClone` is not equivalent—a getter could return plain JSON to the check and a class instance to the clone, which would erase its prototype and silently accept different data. + +The first-party `defineTool()` helper closes the authoring boundary with the same primitive. It reads every top-level option once, materializes the `SchemaSpec`, and derives an independent wire schema plus all later execute and presentation validation from that accepted snapshot. Without that split, mutating an author-owned spec after definition could make the model call a schema that the tool no longer accepts. + +Registration then reads every top-level definition field exactly once, validates, binds, and stores only those captured values; a stateful `parameters` or callback accessor therefore cannot make the checked definition differ from the executable one. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections. ```text defineTool(options): @@ -208,7 +219,7 @@ The operation being described determines the key; callers cannot attach an unrel | `approval/request` | `ApprovalRequest.agent` | | `tools/pre-execute`, `tools/execute`, `tools/post-execute`, `tools/result` | `ToolExecution.agent`, or no key for an agent-less call | | `system-prompt/assemble` | `AssembleContext.scope` | -| `session/created`, `session/event`, `session/flush` | The owner scope captured when the session enters the store | +| `session/created`, `session/disposed`, `session/event`, `session/flush` | The owner scope captured when the session enters the store | | `subagent/start`, `subagent/end` | The delegating parent agent | Approval requests cross an asynchronous answer boundary, so the service snapshots the accepted record synchronously. It preserves the exact agent and abort-signal identities but copies the scalar fields, captures the agent's session once, and uses that one snapshot for `approval/asked`, scoped dispatch, cancellation, policy, and `approval/decided`. Mutating the caller-owned record after `request()` returns therefore cannot split the audit pair or redirect the question to another agent's listeners. @@ -234,7 +245,7 @@ The real helpers fuse values that must agree. `agentEvents(context, agent)` uses Function-style listeners receive the carrier as `this`, and agent event APIs allow them to call subject methods. The carrier is therefore a JavaScript proxy that reads and writes through to the real subject and binds methods to it. -Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The proxy preserves the subject's existing event filter and JavaScript object invariants, but it is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. +Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The carrier therefore uses a dedicated surrogate proxy target with its own immutable composed-filter slot, while ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to the real subject; callable carriers also preserve whether the subject is constructable. For non-overlay properties owned by the subject, descriptor queries preserve values and flags except that `configurable` is reported as `true`, which is the Proxy-safe way for an extensible surrogate to expose a property it does not itself own. A filter property pinned on the subject before, during, or after construction cannot trigger the proxy invariant that would otherwise force delivery to use the subject's raw filter and silently drop scope isolation. The carrier is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. `Scoped` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime security, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches. @@ -246,11 +257,13 @@ An agent's scope, session, registry entry, and driver form one owned transaction Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup. -The factory captures IDs and the setup callback and clones caller-owned agent options before the first asynchronous boundary. Seed events and session metadata take a stricter route: pre-cloning either could erase a class or exotic prototype before the session validator saw it, so the factory reads each reference once and hands it synchronously to `SessionStore.prepare`. That boundary rejects exotic shells, reads each accepted metadata field once, and recursively validates and copies every seed value in one pass. One-pass materialization matters because `validate(value); structuredClone(value); validate(clone)` still reads a getter twice, and the clone can erase the prototype of a class instance returned only on the second read. The accepted metadata becomes a detached, deep-frozen `SessionHeader` whose id must equal the session id. Resume applies the same rule after persistence loading by capturing `createdAt`, `cwd`, `parentSession`, and `seedLength` once before reconstruction. A caller or stateful backend therefore cannot move the transaction away from the identities it reserved, change persistence routing or lineage after publication, or sanitize invalid data into acceptance. +The factory first captures the requested IDs, setup callback, and caller-owned agent options. Seed events and session metadata take a stricter route than a preliminary clone: cloning can erase an exotic prototype before validation sees it, so the factory reads each reference once and hands it synchronously to the session store's reservation-bound prepare operation. That boundary rejects exotic shells, reads accepted metadata fields once, and recursively materializes each seed record in one pass. Resume applies the same rule to persistence output by capturing the loaded header fields once before reconstruction. The transaction therefore cannot move to different identities, storage routing, or lineage after an asynchronous boundary. -The session log also closes the ownership boundary after acceptance. Seed and append paths share exact runtime surface-metadata checks: surface events require either `'append'` or an exact replace record with non-negative safe-integer bounds, provenance is an array of non-negative safe integers, and non-surface events reject both fields. Accepted events are deep-frozen, and `session.events` returns a cached frozen array snapshot rather than the mutable internal array. A later append invalidates the cache and publishes a new snapshot; any earlier snapshot remains unchanged. This preserves append-only behavior even for JavaScript callers that cast away TypeScript's readonly view or retain an event reference received from `append` or `session/event`. +Before setup can observe the new objects, their ownership-bearing public properties become stable runtime data slots rather than TypeScript-only `readonly` promises. The concrete agent pins its ID, accepted options, and session; the factory binds its scope context exactly once. The session pins its ID and detached, deep-frozen header. Registry detach closures likewise close over their accepted map keys instead of rereading public properties during teardown. A JavaScript assignment or stateful accessor therefore cannot split registry lookup, dispatch, persistence, and the driver into different identities. -Reservations prevent two concurrent transactions from composing different unpublished agents under the same public identity. They remain held across persistence loading and setup and are released on every success or failure path. +The session owns the accepted log as described in [the session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md). Seed and append paths materialize lossless JSON once, validate both the event envelope and the metadata that places message-producing events into derived model history, and deep-freeze the exact accepted event. `session.events` returns a frozen snapshot that never grows later. The store keeps append notification and scope-carrier state in store-owned private tables instead of caller-writable `Session` fields, so outside JavaScript cannot suppress or redirect `session/event` dispatch. + +Reservations prevent two concurrent factory transactions from composing different unpublished objects under the same public identities. Each reservation belongs both to the factory transaction and to the Cordis fiber that requested it: explicit release covers every success or failure path, while owner-fiber disposal is the backstop for an abandoned handle during plugin unload or HMR. The agent registry and session store recognize their own reserved keys: setup code that calls public reserve, prepare, create, register, or bare enter APIs with the same IDs fails. The session capability can prepare exactly one object, and publication succeeds only when both stores receive the factory-held exact capabilities; the session store additionally checks that the capability owns that exact prepared session. This closes the otherwise possible path in which setup publishes a substitute object under an ID that the factory merely tracked in a separate pending set, without letting a vanished owner wedge the ID forever. Resume installs an owner-liveness sentinel before reserving IDs or starting persistence I/O, then races loading against owner disposal. If disposal wins, resume rejects and releases both reservations immediately; a backend promise that settles later cannot publish. After a successful load, the factory synchronously installs the full agent lifecycle before removing the sentinel, so ownership passes from load to setup without an unobserved disposal gap. @@ -260,18 +273,18 @@ The sentinel exists only for the interval in which no agent lifecycle can exist resume(request): snapshot request ids, options, and setup callback sentinel = owner.effect(onDispose => signal ownerDisposed) - reserve(agentId, sessionId) + reservations = reserve agentId in AgentRegistry and sessionId in SessionStore try: persisted = await firstOf(persistence.load(sessionId), ownerDisposed) - session = reconstruct(persisted) + session = reservations.session.prepare(reconstruct persisted data) # This call installs the full lifecycle before its first await. - starting = startOwned(agentId, session, options, setup) + starting = startOwned(agentId, session, options, reservations, setup) disarm and dispose sentinel return await starting finally: - release both ids + release both reservation capabilities settle the sentinel transaction ``` @@ -326,8 +339,8 @@ The implementation keeps publication synchronous and leaves rollback to the surr ```text publish(world): - world.detachSession = world.agent.ctx.sessions.enter(world.session) - world.detachAgent = app.agents.enter(world.agent) + world.detachSession = world.agent.ctx.sessions.enter(world.session, world.sessionReservation) + world.detachAgent = app.agents.enter(world.agent, world.agentReservation) app.sessions.announce(world.session) app.agents.announce(world.agent) world.driver.enableDrivingVerbs() @@ -337,7 +350,11 @@ publish(world): Both registry entries exist before the first creation listener runs, and setup-installed listeners receive both announcements. Driving opens immediately before `agent/session-start`, so that event remains the first supported place for a listener to inject or queue startup work. -The sequence is not described as atomic because observers run between its steps. If a `session/created` or `agent/created` listener throws, the transaction rolls the registry entries and scope back, but effects already performed by an earlier listener cannot be retracted. An announced agent is paired with its disposal notification during rollback. `agent/session-start` is a non-vetoing notification: listener failures are logged and contained so the loop still starts. +The sequence is not described as atomic because observers run between its steps. If a `session/created` or `agent/created` listener throws synchronously, the transaction rolls the registry entries and scope back, but effects already performed by an earlier listener cannot be retracted. Each store therefore marks its announcement as begun before invoking creation listeners and rejects a repeat or reentrant announcement before dispatch. Rollback emits `session/disposed` or `agent/disposed` exactly once for every corresponding creation announcement that began, including a partial emit in which an early listener observed creation before a later listener threw. An object entered but never announced has no disposal notification because no observer was told it existed. + +Creation notification preserves that synchronous veto while also defending against JavaScript's asynchronous callback shape. A listener may return a promise even though the event type returns `void`; the dispatcher does not await it because publication has no asynchronous gap, but it observes and logs a later rejection. Such a rejection is too late to roll back, does not become unhandled, and does not starve the listeners invoked after that callback. + +The disposal notifications and `agent/session-start` are deliberately non-vetoing. Their dispatchers invoke every listener synchronously and independently; they log and contain both a synchronous throw and a rejection from a returned promise. Returned promises are observed for failure but not awaited, so an asynchronous notification listener cannot delay rollback or teardown, veto driver startup, or starve a later listener. ### Teardown stops work before revoking its world @@ -346,14 +363,16 @@ Every owner path uses the same reverse order: stop the loop and await its actual ```text disposeOwnedAgent(world): await world.stopDriver() # waits for loop exit and all agent-started flushes - world.detachAgent() # emits agent/disposed when announced - world.detachSession() + world.detachAgent() # leaves registry; emits agent/disposed if announced + world.detachSession() # stops event feed, leaves store; emits session/disposed if announced await world.scope.dispose() ``` The actual Cordis generator yields these disposers in reverse so its last-in-first-out teardown executes in the order shown. -`agent/disposed` means the driver is quiescent and the agent has left the registry; session detachment and scope unwind may still be completing after that notification. `AgentHandle.dispose()` is memoized so concurrent owners await the same full transaction, and `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races. +`agent/disposed` means the driver is quiescent and the agent has left the registry; the session is still live during that notification. `session/disposed` follows after append notification has been detached and the session has left its store. The scope is still live when each disposal listener is selected and invoked, although returned asynchronous work is observed rather than awaited. Both notifications use the same scope key and delivery rule as their creation partners and occur exactly once only when those creation announcements began. + +`AgentHandle.dispose()` is memoized so concurrent owners await the same full transaction, and `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races. Parent-owned subagents use explicit ownership rather than capability inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped capabilities. @@ -371,6 +390,8 @@ A global section protection also reserves the registry name against scoped shado Restoration is intentionally not a whole-assembly reset. The service first removes protected names from the waterfall result, then reinserts protected canonical entries in their canonical order immediately before the first surviving later unprotected canonical neighbor, or at the end when no such neighbor survives. Unprotected entries keep the ordering and definitions chosen by the waterfall. This anchor rule preserves the protected contribution's meaningful local placement without claiming that protection restores every global relative position after arbitrary listener reordering. +Only the restoration inputs are detached before dispatch: the canonical section array when section protection is active and the canonical tool array when tool protection is active. The waterfall receives the original mutable assembly, not a clone, and variables and other merge-extensible fields remain entirely under ordinary waterfall semantics. + ```text registerSection(input, scope): stored = copy(input.name, input.order, input.text) @@ -379,12 +400,14 @@ registerSection(input, scope): sectionLayer(scope).add(stored) assemble(context): - canonical = assemble registries for context.scope - transformed = await systemPromptAssembleWaterfall(clone(canonical)) + assembly = assemble registries for context.scope + canonicalSections = active section protection ? clone(assembly.sections) : absent + canonicalTools = active tool protection ? clone(assembly.tools) : absent + transformed = await systemPromptAssembleWaterfall(assembly) - for each protected name: + for each protected name in the corresponding canonical array: remove every transformed entry with that name - if canonical contains the name: + if the canonical array contains the name: if a later unprotected canonical neighbor survived: insert the canonical entry before that neighbor else: @@ -399,9 +422,11 @@ Code Mode uses global protection for the `tools:sdk` section and reserved `run_c ### Tool executions have stable identity -`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. It captures the required `callId`/`name` correlation identity, then reads every other top-level caller field once before using it, so parent-token validation, scope routing, policy, dispatch, and final observation all see one coherent identity; those captured optional fields construct the normalized error shell if a later accessor or argument validation fails. The registry materializes `arguments` in one lossless-JSON traversal and deep-freezes the result, so policy and dispatch receive exactly the value that passed validation. A cloneable but mutable exotic such as `Map` or a class instance is rejected before policy rather than smuggled through an apparently frozen wrapper. Invalid input still produces one normalized final error notification; a throwing `callId` or `name` accessor is outside that guarantee because no trustworthy result correlation exists. +`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. It reads `callId` and `name` once and requires each value to be a string before treating the pair as trustworthy correlation identity. A throwing accessor or non-string value rejects before `tools/result`, because even an error result could not carry a valid identity. After that boundary, the registry reads every other top-level caller field once, and any later accessor or validation failure becomes one normalized final error notification built from the already accepted strings and captured optional fields. -The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution's `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field: an around-dispatch wrapper may add, replace, or remove it, and the registry freezes the complete execution before outcome observation. +The registry materializes `arguments` in one lossless-JSON traversal and deep-freezes the result, so parent-token validation, scope routing, policy, dispatch, and final observation receive exactly the value that passed validation. A cloneable but mutable exotic such as `Map` or a class instance is rejected before policy rather than smuggled through an apparently frozen wrapper. + +The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution is identity-stable, not fully immutable, while the pipeline runs: its `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field; an around-dispatch wrapper may add, replace, or remove it. The registry freezes the complete execution before outcome observation. Stable identity prevents a listener from changing which capability or scope was authorized after policy ran. It also gives commit-style observers a safe `WeakMap` key even when an adapter reuses a model call ID. @@ -411,14 +436,19 @@ The input-to-execution conversion is intentionally one-way: ```text prepareExecution(input): - accepted = read callId, name, arguments, agent, parent, signal exactly once + callId = read input.callId exactly once + name = read input.name exactly once + require callId and name are strings + # A failure above rejects: no trustworthy correlation identity exists. + + accepted = read arguments, agent, parent, and signal exactly once require accepted.parent is absent or a registry-minted token detachedArguments = snapshotLosslessJson(accepted.arguments) execution = { token: new frozen property-free object, - callId: accepted.callId, - name: accepted.name, + callId, + name, arguments: deepFreeze(detachedArguments), agent: accepted.agent, parent: accepted.parent, @@ -447,8 +477,12 @@ The entire registry method reads like one authority ladder: ```text execute(input): + callId = read input.callId exactly once + name = read input.name exactly once + require callId and name are strings + try: - execution = prepareExecution(input) + execution = prepareExecutionFromTrustedIdentity(input, callId, name) catch invalidInput: execution = frozen identity shell with arguments = undefined result = errorResult(invalidInput) @@ -488,6 +522,8 @@ Waterfalls can transform only at their named stages. Guards can only deny, and t ### `agent/turn-stop` makes a composed continuation terminal +Steering is input injected into an already running turn for the next model step; ordinary queued prompts wait for a future turn. The loop normally preserves that distinction by moving leftover steering into another step while leaving the queued-prompt FIFO alone. + Ordinary continuation remains extensible. The loop computes a default, runs the `agent/turn-continuation` waterfall, records any force-continue reason as steering, and folds pending steering into the decision because steering normally demands another model step. The scoped serial `agent/turn-stop` checkpoint runs after that folding. Its strict serial helper consults listeners in order until one returns a non-`undefined` value; a listener returns `{ action: 'stop' }` or abstains with `undefined`. The dedicated helper exists because ordinary Cordis serial dispatch treats `null` and `false` as framework abstentions, while this public contract has exactly one abstention value. A stop is terminal, so later listeners and pending steering cannot restore continuation. A malformed result, including `null` or `false`, or a throwing policy closes the current turn with an error while leaving the driver available for later work. @@ -524,13 +560,17 @@ In-process subagents demonstrate how the scope, lifecycle, and final-policy piec ### Inputs and ownership are fixed before asynchronous creation -Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider receiver so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and HMR cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key. +Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider object so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and hot-reload cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key. Starting a run reads every top-level request field once before capability validation, then snapshots every accepted field before asynchronous owner setup. This order makes checked and delegated capabilities identical even for a JavaScript caller with stateful accessors. Fixed scalars are checked at the same boundary: `maxDepth` must be a non-negative safe integer and `persona` must be a string. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached through the one-pass lossless-JSON materializer. The exported in-process driver repeats this boundary for direct callers before it awaits run-owner activation, including taking one seed snapshot from which it derives both the child prefix and `seedLength`. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. The child factory runs through the owner fiber. Parent teardown, provider teardown, and manual run disposal all dispose this same node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. -The provider's run separates acceptance from publication with `started: Promise`, but the service does not return that caller-owned handle directly. It reads `id`, `started`, `result`, and every method once, binds methods to the original provider receiver, and returns a frozen service-owned wrapper. Its `result` promise captures `output`, optional `structured`, and `stopReason` once and resolves to one detached, deeply frozen lossless-JSON value shared by the caller and lifecycle telemetry; malformed provider data rejects as an infrastructure fault and produces contained `error` telemetry. For spawn and fork, the accepted `started` promise fulfills only after the child factory returns a published handle, so the service can emit `subagent/start` with `ctx.agents.get(id)` already live; it rejects when rollback prevents publication. The service observes the normalized result immediately but buffers its end payload until readiness, preserving start-before-end order without leaving an early rejection unhandled. Both lifecycle payloads are deeply frozen before contained per-listener dispatch, so one observer cannot corrupt the caller or a peer. A readiness rejection emits neither lifecycle event. The result driver awaits the same boundary before sending the child prompt. +The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. + +The wrapper's `result` promise captures `output`, optional `structured`, and `stopReason` once and resolves to one detached, deeply frozen lossless-JSON value shared by the caller and lifecycle telemetry. Malformed terminal data is an infrastructure fault; it rejects only after the service has started rollback of the provider attempt. The service observes the normalized result immediately, before waiting for readiness, so an early rejection is never temporarily unhandled. + +For spawn and fork, the accepted `started` promise fulfills only after the child factory returns a published handle. The service can then emit `subagent/start` with `ctx.agents.get(id)` already live and release any buffered terminal event; if readiness rejects, it emits neither start nor end. Lifecycle notification is fire-and-forget and non-vetoing: each listener receives the same deeply frozen payload, and synchronous throws or returned-promise rejections are logged and contained per listener without awaiting them. The child result driver awaits the same readiness boundary before sending the prompt. ```text startInProcessRun(providerContext, acceptedRequest): @@ -563,9 +603,10 @@ SubagentService.start(...): result: normalize once into detached, deeply frozen lossless JSON }) attach settlement handlers to serviceRun.result immediately - await serviceRun.started - emit subagent/start; later emit the buffered or eventual subagent/end - return serviceRun + attach handlers to serviceRun.started: + on fulfillment, emit subagent/start and then buffered or eventual subagent/end + on rejection, discard buffered lifecycle telemetry + return serviceRun immediately Workflow worker bridge after receiving returnedRun: register the run so cancellation can reach pre-publication work @@ -581,7 +622,11 @@ Before publishing the workflow's own result: only then settle the workflow result ``` -Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. Before the workflow result becomes observable, the host also drives both permitted cancellation channels—the shared abort signal and each registered run's explicit `cancel()`—because a fire-and-forget child still waiting on readiness has no worker-side handle that could relay cancellation. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. This keeps cancellation able to reach pending creation, prevents an early result rejection from going unhandled, ensures `workflow/agent-start` never names an unpublished child, and prevents a child from publishing after its workflow has ended. +Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. + +Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber, so the agent factory's liveness check fails, `started` rejects, and neither the child session nor agent can publish. The run's result still settles as `aborted`. Before the workflow's own result becomes observable, its host likewise drives both permitted cancellation channels: it aborts the shared request signal and calls each registered run's `cancel()`, including runs still waiting on readiness. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. + +Together these rules prevent an early result rejection from going unhandled, ensure `workflow/agent-start` never names an unpublished child, and prevent a child from publishing after its workflow has ended. Parent teardown reaches `runOwner` by nesting; the provider and returned run handle reach the same node through their explicit disposers. @@ -607,7 +652,7 @@ The table describes the registry's named canonical contribution. An unrelated as ### Capture uses stage, final commit, monotonic denial, and terminal stop -The capture tool validates its arguments and stages the cloned value in a JavaScript `WeakMap` keyed by the immutable `ToolExecution`. This is an object-identity table whose key does not keep an abandoned execution alive. Validation failure becomes the ordinary `INVALID_ARGS` error that the model can correct within the turn. +The capture tool validates its arguments and stages the cloned value in a JavaScript `WeakMap` keyed by the identity-stable `ToolExecution`. This is an object-identity table whose key does not keep an abandoned execution alive. Validation failure becomes the ordinary `INVALID_ARGS` error that the model can correct within the turn. The scoped `tools/result` observer commits a direct native capture only when that exact execution's authoritative final result succeeds. A later call with a reused string call ID cannot reach the weak-keyed stage, and a post-execution block cannot promote it. @@ -744,9 +789,9 @@ The costs are concentrated in dispatch discipline, per-scope registry state, and - `run_code` is protected transport infrastructure rather than a filterable end capability, so a policy that must forbid programs denies execution at the tool-policy layer instead of removing the transport from a Code Mode prompt. - Prompt protection restores named canonical contributions and their anchor placement, not the entire assembly; unprotected output remains extensible, while a globally protected section name is deliberately unavailable for scoped shadowing. - Terminal turn stopping has authority to discard pending steering. That power is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy. -- Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The config-only `ctx.agentLoop.create()` path has no setup callback and remains synchronous. +- Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The direct no-setup `ctx.agentLoop.create()` path, used by configuration and programmatic callers that already have complete options, remains synchronous. - Ordered composition requires both an exact raw scope disposer and a shared public quiescence promise; the dual surface reflects two distinct Cordis lifecycle requirements. ### Deliberate boundaries -The scope primitive is generic, but this decision applies it only where one agent needs a coherent registration view: tools, prompt state, scoped events, sessions, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and future registries retain their existing seams until their own designs explicitly adopt the context rule. +The scope primitive is generic, but this decision applies it only where one agent needs a coherent registration view: tools, prompt state, scoped events, sessions, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and other registries retain their existing seams until their own designs explicitly adopt the context rule. diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts index aea7927571..af8e9905e4 100644 --- a/packages/cordis/tool-cordis/src/api-catalog.ts +++ b/packages/cordis/tool-cordis/src/api-catalog.ts @@ -65,11 +65,12 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ key: 'agents', summary: 'Agent registry (`ctx.agents`): tracks live agents so UI, hook, and orchestrator plugins can find them without depending on the concrete loop package.', methods: [ + 'reserve(id: AgentId): AgentRegistrationReservation', 'setFactory(factory: AgentFactory): () => Promise | void', 'async create(options: CreateAgentOptions): Promise', 'async resume(options: ResumeAgentOptions): Promise', 'register(agent: Agent): () => Promise | void', - 'enter(agent: Agent): () => void', + 'enter(agent: Agent, reservation?: AgentRegistrationReservation): () => void', 'announce(agent: Agent): void', 'get(id: AgentId): Agent | undefined', 'list(): Agent[]', @@ -155,9 +156,10 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ key: 'sessions', summary: 'In-memory session store (`ctx.sessions`).', methods: [ + 'reserve(id: SessionId): SessionRegistrationReservation', 'create(id?: SessionId, options?: CreateSessionOptions): Session', 'prepare(id?: SessionId, options?: CreateSessionOptions): Session', - 'enter(session: Session): () => void', + 'enter(session: Session, reservation?: SessionRegistrationReservation): () => void', 'announce(session: Session): void', 'async flush(session: Session): Promise', 'get(id: SessionId): Session | undefined', @@ -353,6 +355,12 @@ export const EVENT_API: readonly EventApiEntry[] = [ signature: '\'session/created\'(this: Scoped, session: Session): void', summary: 'A session was created in the store.', }, + { + name: 'session/disposed', + mode: 'emit', + signature: '\'session/disposed\'(this: Scoped, session: Session): void', + summary: 'A previously announced session left the store.', + }, { name: 'session/event', mode: 'emit', @@ -503,6 +511,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [ name: 'AgentOptions', declaration: 'export interface AgentOptions {\n model?: string;\n}', }, + { + name: 'AgentRegistrationReservation', + declaration: 'export interface AgentRegistrationReservation {\n readonly id: AgentId;\n release(): void;\n}', + }, { name: 'AgentStatus', declaration: 'export type AgentStatus = \'idle\' | \'running\' | \'disposed\';', @@ -803,6 +815,10 @@ export const TYPE_API: readonly TypeApiEntry[] = [ name: 'SessionId', declaration: 'export type SessionId = Branded<\'SessionId\'>;', }, + { + name: 'SessionRegistrationReservation', + declaration: 'export interface SessionRegistrationReservation {\n readonly id: SessionId;\n prepare(options?: CreateSessionOptions): Session;\n release(): void;\n}', + }, { name: 'SkillCandidate', declaration: 'export interface SkillCandidate extends SkillSummary {\n rank: number;\n locator: unknown;\n path?: string;\n metadata?: Record;\n}', diff --git a/packages/core/agent-loop/README.md b/packages/core/agent-loop/README.md index ac1a0e079f..a8da612305 100644 --- a/packages/core/agent-loop/README.md +++ b/packages/core/agent-loop/README.md @@ -8,9 +8,9 @@ This is the only package in the harness that contains concrete loop logic. Every ### Public API -Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, reserve both IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume installs an owner-liveness sentinel before persistence load, captures each loaded metadata field once, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. Setup calls to `send`/`steer`/`inject`/`cancel` reject structurally; load/setup rejection or owner unload publishes nothing. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All `agent/*` dispatches go through `agentEvents(ctx, agent)`; per-step assembly through `assembleContextFor(agent)`; the turn-end durability checkpoint through `ctx.sessions.flush(session)`. +Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, obtain registry/store-owned capabilities for both unpublished IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. The capabilities reject competing `register`/`enter`/`prepare`/`create` calls, so setup cannot publish the factory objects or same-id replacements. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume installs an owner-liveness sentinel before persistence load, captures each loaded metadata field once, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. The concrete agent owns runtime-pinned `id`, frozen detached `options`, `session`, and `ctx` bindings. Load/setup rejection or owner unload publishes nothing; partial creation announcements are paired during rollback. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All non-vetoing `agent/*` notifications go through `agentEvents(ctx, agent)`, which contains sync/async listener failures per observer; per-step assembly goes through `assembleContextFor(agent)`; the turn-end durability checkpoint goes through `ctx.sessions.flush(session)`. -- `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — config-driven create: an agent on a fresh per-run session id `${id}-session-` with optional session metadata. Used for `cordis.yml`-configured agents. The per-run uuid avoids colliding with the on-disk log a prior run materialized once a durable persistence backend is loaded; each run is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber. +- `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — synchronous no-setup create, used directly by programs and by `cordis.yml`-configured agents. It creates a fresh per-run session id `${id}-session-` with optional metadata; the uuid avoids colliding with a prior durable log. Each call is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber. `AgentLoop` also implements the `AgentFactory` seam and registers itself via `ctx.agents.setFactory(this)`, so plugins create/resume agents through `ctx.agents` (the interface): diff --git a/packages/core/agent-loop/src/agent.ts b/packages/core/agent-loop/src/agent.ts index c4c35f34db..3234a47939 100644 --- a/packages/core/agent-loop/src/agent.ts +++ b/packages/core/agent-loop/src/agent.ts @@ -7,10 +7,10 @@ */ import type { Context } from 'cordis' -import { scopeTarget } from '@deepseek-ai/dsh-scope' -import type { Scoped } from '@deepseek-ai/dsh-scope' +import { agentEvents } from '@deepseek-ai/dsh-agent' import type { AgentId, AgentOptions, AgentStatus, SendOptions } from '@deepseek-ai/dsh-agent' import type { Agent } from '@deepseek-ai/dsh-agent' +import { deepFreeze } from '@deepseek-ai/dsh-llm' import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm' import type { Session } from '@deepseek-ai/dsh-session' import { Inbox } from './inbox.ts' @@ -65,6 +65,26 @@ export function prepareReactLoopAgent( } } +/** + * Install the concrete agent's scope context exactly once. Construction and + * scope minting are mutually referential (the scope key is the agent), so the + * factory performs this one post-construction binding before setup receives + * the unpublished agent. The runtime slot is non-writable/non-configurable; + * TypeScript `readonly` alone would still let JavaScript redirect later + * registrations to another context. + * @param agent - the unpublished concrete agent to bind. + * @param ctx - its fully extended agent scope context. + */ +export function bindReactLoopAgentContext(agent: ReactLoopAgent, ctx: Context): void { + if (Object.hasOwn(agent, 'ctx')) throw new Error(`agent "${agent.id}" context is already bound`) + Object.defineProperty(agent, 'ctx', { + value: ctx, + enumerable: true, + writable: false, + configurable: false, + }) +} + /** * The concrete {@link Agent} implementation owned by the agent-loop plugin. * @@ -84,18 +104,7 @@ export class ReactLoopAgent implements Agent { * context are mutually referential (the scope is keyed BY this agent), so * neither can exist strictly before the other. */ - ctx!: Context - - /** - * The dispatch carrier for this agent's own emits (`agent/status`, - * `agent/queued`, `agent/error`): keyed by the agent, base = the agent - * (listener `this` is the agent). Built lazily because it is self-referential. - */ - private get carrier(): Scoped { - return (this.#carrier ??= scopeTarget(this, this)) - } - - #carrier: Scoped | undefined + declare readonly ctx: Context private _status: AgentStatus = 'idle' private currentAbort: AbortController | undefined @@ -143,6 +152,16 @@ export class ReactLoopAgent implements Agent { public readonly options: AgentOptions, public readonly session: Session, ) { + const acceptedOptions = deepFreeze(structuredClone(options)) + // Pin the public ownership/identity bindings in the runtime object. A + // JavaScript caller can otherwise replace TS-readonly parameter properties + // after publication and split the registry, driver, session, and model + // configuration into different worlds. + Object.defineProperties(this, { + id: { value: id, enumerable: true, writable: false, configurable: false }, + options: { value: acceptedOptions, enumerable: true, writable: false, configurable: false }, + session: { value: session, enumerable: true, writable: false, configurable: false }, + }) const { promise, resolve } = Promise.withResolvers() this.disposed = promise this.resolveDisposed = resolve @@ -161,11 +180,7 @@ export class ReactLoopAgent implements Agent { // waiter (docs/defensive-patterns.md "contain callback exceptions" — a lifecycle await must // not hang on one bad listener). if (status !== 'running') this.settleIdleWaiters() - try { - this.loopCtx.emit(this.carrier, 'agent/status', this, status) - } catch (error: unknown) { - this.loopCtx.logger.warn(`agent "${this.id}": agent/status listener threw on ${status}: ${String(error)}`) - } + agentEvents(this.loopCtx, this).emit('agent/status', status) } /** @@ -194,7 +209,7 @@ export class ReactLoopAgent implements Agent { if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`) const source = this.resolveSource(options) this.#inbox.enqueue({ content, source }) - this.loopCtx.emit(this.carrier, 'agent/queued', this, content, { source, steering: false }) + agentEvents(this.loopCtx, this).emit('agent/queued', content, { source, steering: false }) } steer(content: ContentBlock[], options?: SendOptions): void { @@ -203,7 +218,7 @@ export class ReactLoopAgent implements Agent { if (this._status !== 'running') { this.send(content, options); return } const source = this.resolveSource(options) this.#inbox.steer({ content, source }) - this.loopCtx.emit(this.carrier, 'agent/queued', this, content, { source, steering: true }) + agentEvents(this.loopCtx, this).emit('agent/queued', content, { source, steering: true }) } inject(content: ContentBlock[], options?: SendOptions): void { @@ -269,14 +284,10 @@ export class ReactLoopAgent implements Agent { if (turnRecorded) { // Through the store's flush (the carrier owner), never a raw parallel. const flush = this.loopCtx.sessions.flush(this.session).catch((error: unknown) => { - const err = error instanceof Error ? error : new Error(String(error)) - this.loopCtx.logger.warn(`agent "${this.id}": flush after idle injection failed: ${err.message}`) - try { - this.loopCtx.emit(this.carrier, 'agent/error', this, turn, 0, err) - } catch { - // contained: the failure is already logged; a throwing agent/error - // listener must not escape this fire-and-forget catch. - } + const rendered = renderThrown(error) + const err = error instanceof Error ? error : new Error(rendered) + this.loopCtx.logger.warn(`agent "${this.id}": flush after idle injection failed: ${rendered}`) + agentEvents(this.loopCtx, this).emit('agent/error', turn, 0, err) }) this.pendingIdleFlushes.add(flush) // Attach the same retirement callback to both settlement arms so even a @@ -393,11 +404,7 @@ export class ReactLoopAgent implements Agent { // setStatus refuses transitions out of 'disposed', so emit directly — // 'disposed' is part of the agent/status contract. Guarded: a throwing // listener must not break the disposal chain. - try { - this.loopCtx.emit(this.carrier, 'agent/status', this, 'disposed') - } catch { - // listener error during disposal — nothing safe left to do with it - } + agentEvents(this.loopCtx, this).emit('agent/status', 'disposed') } // An unexpected driver rejection must not skip registry/session/scope // cleanup. The normal loop contains turn failures itself; allSettled is the @@ -414,3 +421,12 @@ export class ReactLoopAgent implements Agent { } } } + +/** Render an arbitrary thrown value without allowing coercion to throw again. */ +function renderThrown(value: unknown): string { + try { + return value instanceof Error ? value.message : String(value) + } catch { + return '' + } +} diff --git a/packages/core/agent-loop/src/index.ts b/packages/core/agent-loop/src/index.ts index 1e5c122fc5..902e1e2185 100644 --- a/packages/core/agent-loop/src/index.ts +++ b/packages/core/agent-loop/src/index.ts @@ -13,17 +13,24 @@ import z from 'schemastery' import { createScope } from '@deepseek-ai/dsh-scope' import type { Scope } from '@deepseek-ai/dsh-scope' import { agentEvents } from '@deepseek-ai/dsh-agent' -import type { AgentFactory, AgentHandle, AgentId, AgentOptions, CreateAgentOptions, ResumeAgentOptions, SessionStartSource } from '@deepseek-ai/dsh-agent' +import type { AgentFactory, AgentHandle, AgentId, AgentOptions, AgentRegistrationReservation, CreateAgentOptions, ResumeAgentOptions, SessionStartSource } from '@deepseek-ai/dsh-agent' import type {} from '@deepseek-ai/dsh-llm' import { SessionId, type SessionHeader } from '@deepseek-ai/dsh-session' -import type { Session } from '@deepseek-ai/dsh-session' +import type { Session, SessionRegistrationReservation } from '@deepseek-ai/dsh-session' import type {} from '@deepseek-ai/dsh-system-prompt' import type {} from '@deepseek-ai/dsh-tools' import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence' -import { prepareReactLoopAgent, ReactLoopAgent } from './agent.ts' +import { bindReactLoopAgentContext, prepareReactLoopAgent, ReactLoopAgent } from './agent.ts' export { ReactLoopAgent } from './agent.ts' +/** Both unpublished identity capabilities held by one factory transaction. */ +interface RegistrationReservations { + agent: AgentRegistrationReservation + session: SessionRegistrationReservation + release(): void +} + declare module 'cordis' { interface Context { agentLoop: AgentLoop @@ -71,10 +78,6 @@ export interface Config { export class AgentLoop extends Service implements AgentFactory { static inject = ['agents', 'sessions', 'llm', 'tools', 'systemPrompt'] - /** IDs held by unpublished async creation transactions. */ - private pendingAgentIds = new Set() - private pendingSessionIds = new Set() - // The schema validates plain strings (cordis.yml config values are untyped at // runtime); the {@link Config} TYPE declares the branded `id`/`resumeSessionId` // because the config format is the boundary where an id enters. The brand is a @@ -153,14 +156,19 @@ export class AgentLoop extends Service implements AgentFactory { * @returns the running agent, owned by the calling fiber (no handle). */ create(id: AgentId, options: AgentOptions = {}, meta: Pick = {}): ReactLoopAgent { - this.assertAgentIdFree(id) + const sessionId = SessionId(`${id}-session-${randomUUID()}`) + const reservations = this.reserve(id, sessionId) // Config/programmatic path: prepare the session and let start() fold its // lifecycle into the agent's composite effect (so a fiber unload tears the // session + agent down as one ordered chain, capturing the loop's closing // flush). The whole effect is owned by THIS fiber; no AgentHandle is needed. - const session = this.ctx.sessions.prepare(SessionId(`${id}-session-${randomUUID()}`), { meta }) - const { agent } = this.start(id, options, session, 'startup') - return agent + try { + const session = reservations.session.prepare({ meta }) + const { agent } = this.start(id, options, session, 'startup', reservations) + return agent + } finally { + reservations.release() + } } /** @@ -188,16 +196,16 @@ export class AgentLoop extends Service implements AgentFactory { const agentOptions = structuredClone(options.agentOptions ?? {}) const seed = options.seed const meta = options.meta - const release = this.reserve(agentId, sessionId) + const reservations = this.reserve(agentId, sessionId) try { - const session = this.ctx.sessions.prepare(sessionId, { + const session = reservations.session.prepare({ ...seed !== undefined ? { seed } : {}, ...meta !== undefined ? { meta } : {}, }) // A seeded (forked) create is still a fresh start, NOT a resume. - return await this.startOwned(agentId, agentOptions, session, 'startup', setup) + return await this.startOwned(agentId, agentOptions, session, 'startup', reservations, setup) } finally { - release() + reservations.release() } } @@ -273,7 +281,7 @@ export class AgentLoop extends Service implements AgentFactory { return transactionSettled }, `agentLoop.resumeLoad(${agentId})`) try { - const release = this.reserve(agentId, sessionId) + const reservations = this.reserve(agentId, sessionId) try { const loadTask = persistence.load(sessionId) const { meta, events } = await Promise.race([ @@ -292,7 +300,7 @@ export class AgentLoop extends Service implements AgentFactory { // An out-of-band direct registry/session insertion can still race this // service's reservation, so the public enter primitives re-check exact // liveness at publication. - const session = this.ctx.sessions.prepare(sessionId, { + const session = reservations.session.prepare({ seed: events, meta: { createdAt, @@ -305,12 +313,12 @@ export class AgentLoop extends Service implements AgentFactory { // effect before it reaches its first setup await. Only then disarm the // load sentinel: ownership passes directly from one effect to the other // with no disposal gap. - const starting = this.startOwned(agentId, agentOptions, session, 'resume', setup) + const starting = this.startOwned(agentId, agentOptions, session, 'resume', reservations, setup) observingOwner = false await disposeLoadSentinel() return await starting } finally { - release() + reservations.release() } } finally { try { @@ -327,29 +335,24 @@ export class AgentLoop extends Service implements AgentFactory { } } - /** - * Reject a duplicate agent id BEFORE the session is entered into the store, so - * a failed factory call never leaves an orphaned live session (and lazy - * persistence state) behind. `register()` enforces the same uniqueness, but - * only after the session has already entered the store. - */ - private assertAgentIdFree(id: AgentId): void { - if (this.ctx.agents.get(id) !== undefined || this.pendingAgentIds.has(id)) { - throw new Error(`agent "${id}" is already registered`) - } - } - - /** Reserve both public identities for one unpublished async transaction. */ - private reserve(agentId: AgentId, sessionId: SessionId): () => void { - this.assertAgentIdFree(agentId) - if (this.ctx.sessions.get(sessionId) !== undefined || this.pendingSessionIds.has(sessionId)) { - throw new Error(`session "${sessionId}" already exists`) - } - this.pendingAgentIds.add(agentId) - this.pendingSessionIds.add(sessionId) - return () => { - this.pendingAgentIds.delete(agentId) - this.pendingSessionIds.delete(sessionId) + /** Reserve both public identities in their owning registries. */ + private reserve(agentId: AgentId, sessionId: SessionId): RegistrationReservations { + const agent = this.ctx.agents.reserve(agentId) + try { + const session = this.ctx.sessions.reserve(sessionId) + return { + agent, + session, + release() { + // Both owner capabilities are independently idempotent, so the + // composite needs no second state machine of its own. + session.release() + agent.release() + }, + } + } catch (error: unknown) { + agent.release() + throw error } } @@ -361,7 +364,12 @@ export class AgentLoop extends Service implements AgentFactory { * `active`, unwinds the scope, and wins the race without any late Cordis * effect collection. */ - private prepareLifecycle(id: AgentId, options: AgentOptions, session: Session): { + private prepareLifecycle( + id: AgentId, + options: AgentOptions, + session: Session, + reservations: RegistrationReservations, + ): { agent: ReactLoopAgent active: () => boolean deactivated: Promise @@ -378,7 +386,7 @@ export class AgentLoop extends Service implements AgentFactory { const driver = prepareReactLoopAgent(this.ctx, id, options, session) const { agent } = driver const scope: Scope = createScope(this.ctx, agent) - agent.ctx = scope.ctx.extend({ agent }) + bindReactLoopAgentContext(agent, scope.ctx.extend({ agent })) let active = true let detachSession: (() => void) | undefined @@ -422,19 +430,15 @@ export class AgentLoop extends Service implements AgentFactory { const publish = (source: SessionStartSource): void => { // Publication is one synchronous, rollback-covered sequence. Setup has // already completed, so its scoped listeners observe both announcements. - detachSession = agent.ctx.sessions.enter(session) - detachAgent = this.ctx.agents.enter(agent) + detachSession = agent.ctx.sessions.enter(session, reservations.session) + detachAgent = this.ctx.agents.enter(agent, reservations.agent) this.ctx.sessions.announce(session) this.ctx.agents.announce(agent) // Setup is over and both entries are live. Open the driving surface just // before session-start so its listeners retain their supported ability to // inject/queue, while setup itself can never drive an unpublished agent. driver.enableDrive() - try { - agentEvents(this.ctx, agent).emit('agent/session-start', source) - } catch (error: unknown) { - this.ctx.logger.warn(`agent "${id}": agent/session-start listener threw: ${String(error)}`) - } + agentEvents(this.ctx, agent).emit('agent/session-start', source) stop = driver.startDriver() } @@ -453,9 +457,13 @@ export class AgentLoop extends Service implements AgentFactory { /** Publish a no-setup config agent synchronously. */ private start( - id: AgentId, options: AgentOptions, session: Session, source: SessionStartSource, + id: AgentId, + options: AgentOptions, + session: Session, + source: SessionStartSource, + reservations: RegistrationReservations, ): { agent: ReactLoopAgent; disposeAgent: () => Promise } { - const lifecycle = this.prepareLifecycle(id, options, session) + const lifecycle = this.prepareLifecycle(id, options, session, reservations) try { lifecycle.publish(source) return { agent: lifecycle.agent, disposeAgent: lifecycle.disposeAgent } @@ -485,9 +493,10 @@ export class AgentLoop extends Service implements AgentFactory { */ private async startOwned( id: AgentId, options: AgentOptions, session: Session, source: SessionStartSource, + reservations: RegistrationReservations, setup?: (agentCtx: Context) => Promise | void, ): Promise { - const lifecycle = this.prepareLifecycle(id, options, session) + const lifecycle = this.prepareLifecycle(id, options, session, reservations) try { // The owner-disposal branch makes a never-settling setup unable to hold // the transaction or its ID reservations forever. Promise.race installs diff --git a/packages/core/agent-loop/tests/agent.spec.ts b/packages/core/agent-loop/tests/agent.spec.ts index ab3494d991..b2a4fe30d5 100644 --- a/packages/core/agent-loop/tests/agent.spec.ts +++ b/packages/core/agent-loop/tests/agent.spec.ts @@ -7,7 +7,7 @@ import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry from '@deepseek-ai/dsh-tools' import AgentRegistry from '@deepseek-ai/dsh-agent' import AgentLoop, { ReactLoopAgent } from '@deepseek-ai/dsh-agent-loop' -import { prepareReactLoopAgent } from '../src/agent.ts' +import { bindReactLoopAgentContext, prepareReactLoopAgent } from '../src/agent.ts' import { MockAdapter, textResponse } from './mock-adapter.ts' async function harness(adapter: MockAdapter) { @@ -49,6 +49,34 @@ function send(agent: ReactLoopAgent, text: string) { } describe('ReactLoopAgent', () => { + it('owns immutable runtime bindings for id, options, session, and scoped context', async () => { + const ctx = await harness(new MockAdapter([textResponse('unused')])) + const options = { model: 'mock' } + const agent = ctx.agentLoop.create(AgentId('owned-bindings'), options) + const acceptedSession = agent.session + const acceptedContext = agent.ctx + + options.model = 'caller-mutated' + expect(agent.options).toEqual({ model: 'mock' }) + expect(Object.isFrozen(agent.options)).toBe(true) + expect(Reflect.set(agent, 'id', AgentId('redirected'))).toBe(false) + expect(Reflect.set(agent, 'options', { model: 'other' })).toBe(false) + expect(Reflect.set(agent, 'session', ctx.sessions.create(SessionId('other')))).toBe(false) + expect(Reflect.set(agent, 'ctx', new Context())).toBe(false) + expect(agent.id).toBe('owned-bindings') + expect(agent.session).toBe(acceptedSession) + expect(agent.ctx).toBe(acceptedContext) + expect(() => { bindReactLoopAgentContext(agent, new Context()) }).toThrow(/context is already bound/) + for (const name of ['id', 'options', 'session', 'ctx']) { + expect(Object.getOwnPropertyDescriptor(agent, name)).toMatchObject({ + configurable: false, + writable: false, + }) + } + + await ctx.fiber.dispose() + }) + it('send() throws after disposal', async () => { const adapter = new MockAdapter(['hang']) const ctx = await harness(adapter) @@ -197,6 +225,23 @@ describe('ReactLoopAgent', () => { warn.mockRestore() }) + it('idle inject() safely renders a hostile non-Error flush failure', async () => { + const ctx = await harness(new MockAdapter([textResponse('ok')])) + const hostile = { [Symbol.toPrimitive]() { throw new Error('no coercion') } } + ctx.on('session/flush', () => { throw hostile }) + const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => undefined) + const agent = ctx.agentLoop.create(AgentId('hostile-flush'), { model: 'mock' }) + const errors: string[] = [] + ctx.on('agent/error', (_a, _turn, _step, error) => void errors.push(error.message)) + + agent.inject([{ type: 'text', text: 'notice' }]) + await new Promise(r => setTimeout(r, 20)) + + expect(errors).toEqual(['']) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('')) + warn.mockRestore() + }) + it('idle inject() with a non-serializable source opens no turn (nothing to close)', async () => { const adapter = new MockAdapter([textResponse('ok')]) const ctx = await harness(adapter) @@ -416,7 +461,7 @@ describe('ReactLoopAgent', () => { expect(adapter.requests).toHaveLength(1) expect(agent.status).toBe('idle') - expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent/status listener threw on running')) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent event "agent/status" listener threw')) warn.mockRestore() }) @@ -434,7 +479,7 @@ describe('ReactLoopAgent', () => { expect(adapter.requests).toHaveLength(1) expect(agent.status).toBe('idle') - expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent/status listener threw on idle')) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('agent event "agent/status" listener threw')) warn.mockRestore() }) }) diff --git a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts index 6d0bb3107b..5ed11d396a 100644 --- a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts +++ b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts @@ -197,6 +197,35 @@ describe('agent scope lifecycle', () => { await handle.dispose() }) + it('makes setup-time publication structurally impossible through public stores', async () => { + const ctx = await harness() + const lifecycle: string[] = [] + ctx.on('session/created', () => void lifecycle.push('session')) + ctx.on('agent/created', () => void lifecycle.push('agent')) + + const handle = await ctx.agents.create({ + agentId: AgentId('guarded-publication'), + sessionId: SessionId('guarded-publication-s'), + agentOptions: { model: 'mock' }, + setup: (agentCtx) => { + const agent = agentCtx.agent! + expect(() => agentCtx.agents.enter(agent)).toThrow(/reserved for unpublished creation/) + expect(() => agentCtx.agents.register(agent)).toThrow(/reserved for unpublished creation/) + expect(() => agentCtx.sessions.enter(agent.session)).toThrow(/reserved for unpublished creation/) + expect(() => agentCtx.sessions.prepare(agent.session.id)).toThrow(/reserved for unpublished creation/) + expect(() => agentCtx.sessions.create(agent.session.id)).toThrow(/reserved for unpublished creation/) + expect(lifecycle).toEqual([]) + expect(ctx.agents.get(agent.id)).toBeUndefined() + expect(ctx.sessions.get(agent.session.id)).toBeUndefined() + }, + }) + + expect(lifecycle).toEqual(['session', 'agent']) + expect(ctx.agents.get(handle.agent.id)).toBe(handle.agent) + expect(ctx.sessions.get(handle.agent.session.id)).toBe(handle.agent.session) + await handle.dispose() + }) + it('structurally rejects every driving verb during setup', async () => { const ctx = await harness() const handle = await ctx.agents.create({ @@ -357,6 +386,33 @@ describe('agent scope lifecycle', () => { await retry.dispose() }) + it('pairs session and agent announcements when agent creation aborts publication', async () => { + const ctx = await harness() + const lifecycle: string[] = [] + ctx.on('session/created', (session) => { lifecycle.push(`session-created:${session.id}`) }) + ctx.on('session/disposed', (session) => { lifecycle.push(`session-disposed:${session.id}`) }) + ctx.on('agent/created', (agent) => { + lifecycle.push(`agent-created:${agent.id}`) + throw new Error('agent observer failed') + }) + ctx.on('agent/disposed', (agent) => { lifecycle.push(`agent-disposed:${agent.id}`) }) + + await expect(ctx.agents.create({ + agentId: AgentId('partial-agent'), + sessionId: SessionId('partial-session'), + agentOptions: { model: 'mock' }, + })).rejects.toThrow('agent observer failed') + + expect(lifecycle).toEqual([ + 'session-created:partial-session', + 'agent-created:partial-agent', + 'agent-disposed:partial-agent', + 'session-disposed:partial-session', + ]) + expect(ctx.agents.get(AgentId('partial-agent'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('partial-session'))).toBeUndefined() + }) + it('the synchronous config helper rolls back when publication throws', async () => { const ctx = await harness() const sessionsBefore = ctx.sessions.list().length diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md index 23fa073ea1..1b1e65a289 100644 --- a/packages/core/agent/README.md +++ b/packages/core/agent/README.md @@ -8,10 +8,10 @@ Tracks live agents so UI, hook, and orchestrator plugins can find them without i ### Public API -The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher every agent-subject event goes through (carrier + injected subject in one move); `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while the factory keeps the agent and session unpublished; creation awaits setup and a same-turn owner-unload checkpoint before either creation notification or the first assembly. Setup composes, it never drives: the concrete loop rejects driving verbs until the `agent/session-start` boundary. +The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher every agent-subject event goes through (carrier + injected subject in one move); its notification mode invokes every listener and contains both synchronous throws and returned-promise rejections. `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while registry/store-owned reservation capabilities keep both identities unpublished; creation awaits setup and a same-turn owner-unload checkpoint before either creation notification or the first assembly. Setup composes, it never drives or publishes: driving verbs and ordinary agent/session insertion both reject until the owning publication boundary. - `ctx.agents.register(agent: Agent): () => Promise | void` — record an **already-constructed** agent. Disposed with the calling fiber. -- Advanced ordered lifecycle: `enter(agent): () => void` inserts without announcing, and `announce(agent)` emits `agent/created` only for that exact live entry. The async factory uses this split after setup; ordinary plugins use `register()`. +- Advanced ordered lifecycle: `reserve(id)` returns an opaque unpublished-identity capability owned by the calling fiber (owner unload releases an abandoned reservation); `enter(agent, reservation?): () => void` inserts under one captured, runtime-pinned id without announcing; and `announce(agent)` emits `agent/created` exactly once for that exact live entry, rejecting repeat or reentrant announcement. While reserved, bare `register`/`enter` calls for the id reject, including from setup. The factory uses this split; ordinary plugins use `register()`. - `ctx.agents.get(id: AgentId): Agent | undefined` - `ctx.agents.list(): Agent[]` @@ -20,7 +20,7 @@ The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh- Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package. - `ctx.agents.setFactory(factory: AgentFactory): () => Promise | void` — register the creation factory (the loop calls this on construction). Throws on a second factory; the slot clears on dispose. -- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata and hand the one-read raw seed synchronously to the session boundary for one-pass lossless-JSON materialization, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Agent/session IDs are reserved across setup; seed rejection, setup rejection, or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; an agent whose announcement began emits `agent/disposed` during that rollback. Rejects if no factory is registered. +- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata and hand the one-read raw seed synchronously to the session boundary for one-pass lossless-JSON materialization, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Registry/store reservation capabilities block every competing public insertion across setup; seed rejection, setup rejection, or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; any creation announcement that began is paired by `agent/disposed` or `session/disposed`. Rejects if no factory is registered. - `ctx.agents.resume(options: ResumeAgentOptions): Promise` — snapshot caller-owned IDs/options, load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh agent scope, await optional setup while unpublished, then follow the same insert → announce → session-start → loop-start boundary. The IDs are reserved across persistence load and setup; load/setup rejection or owner unload publishes nothing. Rejects if no factory is registered or session persistence is unconfigured. `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **capability** — only the holder can tear this agent down. `dispose()` stops the loop, `await`s its exit plus every outstanding idle-injection flush (quiescence — NOT just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent` — the handle is only for the OWNER that created it. The ACP bridge and in-process subagent backends are production consumers; config-created agents are owned by the loop fiber and never need a handle. diff --git a/packages/core/agent/src/dispatch.ts b/packages/core/agent/src/dispatch.ts index b02dfeab57..881faa675f 100644 --- a/packages/core/agent/src/dispatch.ts +++ b/packages/core/agent/src/dispatch.ts @@ -45,7 +45,10 @@ type Tail = Params extends [Agent, ...in */ export interface AgentEventDispatch { /** - * Fire-and-forget notification (Cordis `emit`) in the agent's scope. + * Fire-and-forget notification in the agent's scope. Every listener is + * invoked; synchronous throws and returned-promise rejections are logged and + * contained per listener, so a notification cannot veto lifecycle progress + * or starve a later observer. * @param name - the agent-subject event to emit. * @param rest - the event's arguments after the injected agent. */ @@ -96,9 +99,22 @@ export function agentEvents(ctx: Context, agent: Agent): AgentEventDispatch { // tuple — hence one contained, shape-preserving cast per method. return { emit(name, ...rest) { - // eslint-disable-next-line @typescript-eslint/unbound-method -- the events mixin accessor returns a pre-bound function - const emit = ctx.emit as (thisArg: Scoped, name: string, ...args: unknown[]) => void - emit(carrier, name, agent, ...rest) + // Cordis emit invokes callbacks through Array.map: one synchronous throw + // starves later listeners, and returned promises are discarded. Agent + // notifications are non-vetoing, so resolve the same filtered callback + // set ourselves and contain both failure modes independently. + const args: unknown[] = [carrier, name, agent, ...rest] + const callbacks = ctx.events.dispatch('emit', args) + for (const callback of callbacks) { + try { + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + ctx.logger.warn(`agent event "${name}" listener rejected: ${renderThrown(error)}`) + }) + } catch (error: unknown) { + ctx.logger.warn(`agent event "${name}" listener threw: ${renderThrown(error)}`) + } + } }, async serial(name, ...rest) { // eslint-disable-next-line @typescript-eslint/unbound-method -- the events mixin accessor returns a pre-bound function @@ -129,6 +145,15 @@ export function agentEvents(ctx: Context, agent: Agent): AgentEventDispatch { } } +/** Render an arbitrary thrown value without allowing coercion to throw again. */ +function renderThrown(value: unknown): string { + try { + return value instanceof Error ? `${value.name}: ${value.message}` : String(value) + } catch { + return '' + } +} + /** * The assembly context for one agent's prompt: the typed `agent` DX field and * the `scope` layer selector, set together (setting `agent` without `scope` diff --git a/packages/core/agent/src/index.ts b/packages/core/agent/src/index.ts index 959ca4784c..be7bb02c67 100644 --- a/packages/core/agent/src/index.ts +++ b/packages/core/agent/src/index.ts @@ -9,6 +9,7 @@ import { Context, Service } from 'cordis' import { scopeTarget } from '@deepseek-ai/dsh-scope' import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session' import type { Agent, AgentId, AgentOptions } from './types.ts' +import { agentEvents } from './dispatch.ts' export * from './types.ts' export { agentEvents, assembleContextFor } from './dispatch.ts' @@ -141,9 +142,9 @@ export interface AgentFactory { * creation notifications in order, unlocks driving at * `agent/session-start`, and only then starts the loop. The sequence is * rollback-covered, but notifications delivered before a later listener - * failure remain observable; if agent announcement began, rollback emits - * `agent/disposed`, while the session entry is removed without a separate - * disposal event. The owner disposes the resolved handle to stop/drain, + * failure remain observable; every agent or session creation announcement + * that began is paired by `agent/disposed` or `session/disposed` during + * rollback. The owner disposes the resolved handle to stop/drain, * unregister, remove the session, and unwind the scope. * @param options - agent/session identity, configuration, and optional setup. * @returns the owned handle after setup, both announcements, and loop start complete. @@ -164,6 +165,33 @@ export interface AgentFactory { /** Thrown when create/resume is called before an agent factory is registered. */ const NO_FACTORY_MESSAGE = 'no agent factory registered (load an agent-loop plugin)' +/** Render an arbitrary thrown value without allowing coercion to throw again. */ +function renderThrown(value: unknown): string { + try { + return value instanceof Error ? `${value.name}: ${value.message}` : String(value) + } catch { + return '' + } +} + +/** + * Unforgeable ownership handle for one unpublished agent id. The factory holds + * this object across asynchronous setup; while it is live, ordinary public + * registration of that id fails, so setup cannot publish the factory's agent + * (or a replacement with the same id) ahead of the transaction. Callers obtain + * handles only from {@link AgentRegistry.reserve}. + */ +export interface AgentRegistrationReservation { + /** The reserved registry id. */ + readonly id: AgentId + /** + * Release the unpublished reservation; idempotent. The registry also + * releases it automatically when the fiber that called `reserve` disposes. + * @returns nothing. + */ + release(): void +} + /** * Agent registry (`ctx.agents`): tracks live agents so UI, hook, and * orchestrator plugins can find them without depending on the concrete loop @@ -173,6 +201,10 @@ const NO_FACTORY_MESSAGE = 'no agent factory registered (load an agent-loop plug */ export class AgentRegistry extends Service { private store = new Map() + /** The one accepted registry key for each live agent; never reread caller state. */ + private acceptedIds = new WeakMap() + /** Unpublished identities held across factory setup/load transactions. */ + private reservations = new Map() /** Entries whose `agent/created` announcement phase began. */ private announced = new WeakSet() private factory: AgentFactory | undefined @@ -188,6 +220,49 @@ export class AgentRegistry extends Service { ctx.accessor('agent', { get: () => undefined }) } + /** + * Reserve an unpublished agent id. Registration through {@link register} or + * bare {@link enter} fails until the returned capability is released; the + * owning factory passes the exact capability back to `enter` at publication. + * This makes “setup cannot publish” structural rather than a cooperative + * convention, including attempts to register a different object under the + * reserved id. The reservation belongs to the calling fiber and is released + * automatically if that owner unloads before the transaction settles. + * @param id - the id the factory transaction will publish. + * @returns the opaque reservation capability. + * @throws if the id is malformed, live, or already reserved. + */ + reserve(id: AgentId): AgentRegistrationReservation { + if (typeof id !== 'string') throw new TypeError('agent id must be a string') + if (this.store.has(id) || this.reservations.has(id)) { + throw new Error(`agent "${id}" is already registered or reserved`) + } + let active = true + const rawRelease = (): void => { + if (!active) return + active = false + this.reservations.delete(id) + } + let disposeEffect!: () => Promise | void + const reservation: AgentRegistrationReservation = Object.freeze({ + id, + release: () => { + rawRelease() + // Remove the now-inert ownership effect on manual transaction settle; + // its cleanup is the exact idempotent raw release above. + void disposeEffect() + }, + }) + this.reservations.set(id, reservation) + try { + disposeEffect = this.ctx.effect(() => rawRelease, `agents.reserve(${id})`) + } catch (error: unknown) { + rawRelease() + throw error + } + return reservation + } + /** * Register the agent-creation factory (the loop calls this on construction, * effect-scoped). Throws if a factory is already registered. Returns the @@ -269,43 +344,87 @@ export class AgentRegistry extends Service { * returned detach closure into its pre-installed composite teardown before * calling {@link announce}. Ordinary callers use {@link register}. * @param agent - the prepared, unpublished agent. + * @param reservation - the exact unpublished-id capability, when a factory + * reserved this id across setup. * @returns an idempotent closure that removes this exact entry and emits * `agent/disposed` with listener failures contained. */ - enter(agent: Agent): () => void { - if (this.store.has(agent.id)) { - throw new Error(`agent "${agent.id}" is already registered`) + enter(agent: Agent, reservation?: AgentRegistrationReservation): () => void { + const id = agent.id + if (typeof id !== 'string') throw new TypeError('agent id must be a string') + const held = this.reservations.get(id) + if (reservation === undefined) { + if (held !== undefined) throw new Error(`agent "${id}" is reserved for unpublished creation`) + } else if (reservation.id !== id || held !== reservation) { + throw new Error(`agent "${id}" registration reservation is not active for this id`) } - this.store.set(agent.id, agent) + if (this.acceptedIds.has(agent)) { + throw new Error(`agent "${id}" is already registered`) + } + if (this.store.has(id)) { + throw new Error(`agent "${id}" is already registered`) + } + try { + // Registration accepts ownership of the public identity contract. Pin an + // own data slot from the one captured value so a custom JavaScript Agent + // with a getter or writable field cannot later present a different id to + // event listeners while the registry still owns the accepted key. + Object.defineProperty(agent, 'id', { + value: id, + enumerable: true, + writable: false, + configurable: false, + }) + } catch { + // Only the engine's property-definition failure is swallowed; the stable + // public error below is the registration contract exposed to callers. + throw new TypeError('agent id must be installable as a stable own property') + } + this.store.set(id, agent) + this.acceptedIds.set(agent, id) let entered = true return () => { if (!entered) return entered = false - this.store.delete(agent.id) + this.store.delete(id) + this.acceptedIds.delete(agent) // An insertion rolled back before announce was never externally created, // so emitting disposed would invent an impossible lifecycle edge. Marking // happens before the created emit: if a later created listener throws, // earlier listeners may already have observed it and must see disposal. if (!this.announced.delete(agent)) return - try { - this.ctx.emit(scopeTarget(agent, agent), 'agent/disposed', agent) - } catch (error: unknown) { - this.ctx.logger.warn(`agent "${agent.id}": agent/disposed listener threw: ${String(error)}`) - } + agentEvents(this.ctx, agent).emit('agent/disposed') } } /** * Announce an agent previously inserted with {@link enter}. * @param agent - the live inserted agent to announce. - * @throws if `agent` is not the exact live registry entry for its id. + * @throws if `agent` is not the exact live registry entry for its id, or its + * creation announcement already began (including a reentrant call from a + * creation listener). */ announce(agent: Agent): void { - if (this.store.get(agent.id) !== agent) { - throw new Error(`agent "${agent.id}" is not live in this registry`) + const id = this.acceptedIds.get(agent) + if (id === undefined || this.store.get(id) !== agent) { + throw new Error(`agent "${id ?? ''}" is not live in this registry`) } + if (this.announced.has(agent)) { + throw new Error(`agent "${id}" was already announced`) + } + // Mark before dispatch so a listener cannot recursively create a second + // lifecycle edge; detach still pairs a partially delivered first edge. this.announced.add(agent) - this.ctx.emit(scopeTarget(agent, agent), 'agent/created', agent) + const args: unknown[] = [scopeTarget(agent, agent), 'agent/created', agent] + for (const callback of this.ctx.events.dispatch('emit', args)) { + // A synchronous creation failure vetoes publication and rolls back. + // Returned-promise rejection happens after this synchronous boundary, so + // observe and report it instead of leaking an unhandled rejection. + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`agent "${id}": agent/created listener rejected: ${renderThrown(error)}`) + }) + } } /** diff --git a/packages/core/agent/src/types.ts b/packages/core/agent/src/types.ts index 4196eb43d6..b6a32fa050 100644 --- a/packages/core/agent/src/types.ts +++ b/packages/core/agent/src/types.ts @@ -288,7 +288,10 @@ declare module 'cordis' { * {@link AgentRegistry}. Its session is already live in the session store, * but concrete factories may keep driving verbs locked until the subsequent * `agent/session-start` boundary; that event is the first supported place - * to inject or queue work during startup. + * to inject or queue work during startup. A synchronous listener throw + * vetoes publication and rollback emits the matching disposal edges; + * returned-promise rejection is observed and logged but cannot + * retroactively veto this synchronous boundary. * @param agent - the newly registered agent with its live session and completed setup. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered * through `agent.ctx` fires only for that agent's dispatches; a listener on a diff --git a/packages/core/agent/tests/agent.spec.ts b/packages/core/agent/tests/agent.spec.ts index 4e89dc0e84..87a0e51e9d 100644 --- a/packages/core/agent/tests/agent.spec.ts +++ b/packages/core/agent/tests/agent.spec.ts @@ -1,7 +1,7 @@ import { describe, expect, it } from 'vitest' import { Context } from 'cordis' import { Session, SessionId } from '@deepseek-ai/dsh-session' -import AgentRegistry, { Agent, AgentId } from '@deepseek-ai/dsh-agent' +import AgentRegistry, { Agent, AgentId, agentEvents } from '@deepseek-ai/dsh-agent' function stubAgent(rawId: string): Agent { const id = AgentId(rawId) @@ -78,6 +78,32 @@ describe('AgentRegistry', () => { expect(ctx.agents.get(AgentId('main'))).toBeUndefined() }) + it('observes async agent/created rejection without rolling back or starving peers', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const hostile = { [Symbol.toPrimitive]() { throw new Error('cannot stringify') } } + const heard: string[] = [] + ctx.on('agent/created', () => Promise.reject(new Error('ordinary async failure')) as never) + // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors -- hostile thrown values are the boundary under test + ctx.on('agent/created', () => Promise.reject(hostile) as never) + ctx.on('agent/created', (agent) => { heard.push(agent.id) }) + + const agent = stubAgent('async-created') + const dispose = ctx.agents.register(agent) + await Promise.resolve() + await Promise.resolve() + + expect(ctx.agents.get(agent.id)).toBe(agent) + expect(heard).toEqual(['async-created']) + expect(warnings).toEqual([ + 'agent "async-created": agent/created listener rejected: Error: ordinary async failure', + 'agent "async-created": agent/created listener rejected: ', + ]) + await dispose() + }) + it('splits insertion from announcement and makes the detach exact/idempotent', async () => { const ctx = new Context() await ctx.plugin(AgentRegistry) @@ -107,6 +133,149 @@ describe('AgentRegistry', () => { // no disposed-without-created notification. expect(disposed).toEqual([first]) }) + + it('captures and pins one runtime id before insertion, announcement, and detach', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const existing = stubAgent('occupied') + const disposeExisting = ctx.agents.register(existing) + const candidate = stubAgent('placeholder') + let reads = 0 + Object.defineProperty(candidate, 'id', { + configurable: true, + get() { + reads += 1 + return reads === 1 ? AgentId('accepted') : AgentId('occupied') + }, + }) + + const detach = ctx.agents.enter(candidate) + expect(reads).toBe(1) + expect(candidate.id).toBe('accepted') + expect(reads).toBe(1) + expect(Object.getOwnPropertyDescriptor(candidate, 'id')).toMatchObject({ + configurable: false, + writable: false, + value: 'accepted', + }) + expect(ctx.agents.get(AgentId('accepted'))).toBe(candidate) + expect(ctx.agents.get(AgentId('occupied'))).toBe(existing) + expect(() => ctx.agents.enter(candidate)).toThrow(/already registered/) + + ctx.agents.announce(candidate) + detach() + expect(ctx.agents.get(AgentId('accepted'))).toBeUndefined() + expect(ctx.agents.get(AgentId('occupied'))).toBe(existing) + await disposeExisting() + + expect(() => ctx.agents.enter({ ...stubAgent('bad'), id: 42 } as unknown as Agent)) + .toThrow(/id must be a string/) + const pinnedAccessor = stubAgent('pinned') + Object.defineProperty(pinnedAccessor, 'id', { + configurable: false, + get: () => AgentId('pinned'), + }) + expect(() => ctx.agents.enter(pinnedAccessor)).toThrow(/installable as a stable own property/) + }) + + it('uses an opaque one-id reservation to gate unpublished factory insertion', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const held = ctx.agents.reserve(AgentId('held')) + + expect(() => ctx.agents.reserve(AgentId('held'))).toThrow(/already registered or reserved/) + expect(() => ctx.agents.enter(stubAgent('held'))).toThrow(/reserved for unpublished creation/) + const other = ctx.agents.reserve(AgentId('other')) + expect(() => ctx.agents.enter(stubAgent('held'), other)).toThrow(/not active for this id/) + + const agent = stubAgent('held') + const detach = ctx.agents.enter(agent, held) + ctx.agents.announce(agent) + held.release() + held.release() + expect(ctx.agents.get(AgentId('held'))).toBe(agent) + expect(() => ctx.agents.reserve(AgentId('held'))).toThrow(/already registered or reserved/) + detach() + other.release() + + const expired = ctx.agents.reserve(AgentId('expired')) + expired.release() + expect(() => ctx.agents.enter(stubAgent('expired'), expired)).toThrow(/not active for this id/) + expect(() => ctx.agents.reserve(42 as unknown as AgentId)).toThrow(/id must be a string/) + }) + + it('owns reservations by the calling fiber and rolls back failed ownership registration', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + let held!: import('@deepseek-ai/dsh-agent').AgentRegistrationReservation + let scopedAgents!: AgentRegistry + const owner = await ctx.plugin(Object.assign((inner: Context) => { + scopedAgents = inner.agents + held = inner.agents.reserve(AgentId('fiber-held')) + }, { inject: ['agents'] })) + + expect(() => ctx.agents.reserve(AgentId('fiber-held'))).toThrow(/already registered or reserved/) + await owner.dispose() + const reused = ctx.agents.reserve(AgentId('fiber-held')) + reused.release() + held.release() // idempotent after the automatic owner-disposal release + + // A disposed tracker cannot own a new effect. The failed effect install + // must remove the map entry it tentatively reserved before propagating. + expect(() => scopedAgents.reserve(AgentId('inactive-owner'))).toThrow(/inactive context/) + const recovered = ctx.agents.reserve(AgentId('inactive-owner')) + recovered.release() + }) + + it('rejects direct and reentrant repeat announcements to preserve one lifecycle pair', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + let created = 0 + let disposed = 0 + let reentrantError = '' + ctx.on('agent/created', (agent) => { + created += 1 + try { + ctx.agents.announce(agent) + } catch (error: unknown) { + reentrantError = String(error) + } + }) + ctx.on('agent/disposed', () => { disposed += 1 }) + + const agent = stubAgent('once') + const detach = ctx.agents.enter(agent) + ctx.agents.announce(agent) + expect(reentrantError).toMatch(/already announced/) + expect(() => { ctx.agents.announce(agent) }).toThrow(/already announced/) + detach() + expect({ created, disposed }).toEqual({ created: 1, disposed: 1 }) + }) +}) + +describe('agentEvents()', () => { + it('contains synchronous throws and returned-promise rejections per listener', async () => { + const ctx = new Context() + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const agent = stubAgent('contained') + const heard: string[] = [] + const hostile = { [Symbol.toPrimitive]() { throw new Error('cannot stringify') } } + + ctx.on('agent/status', () => { throw hostile }) + ctx.on('agent/status', () => Promise.reject(new Error('async listener')) as never) + ctx.on('agent/status', (_subject, status) => { heard.push(status) }) + + expect(() => { agentEvents(ctx, agent).emit('agent/status', 'running') }).not.toThrow() + await Promise.resolve() + await Promise.resolve() + + expect(heard).toEqual(['running']) + expect(warnings).toEqual([ + 'agent event "agent/status" listener threw: ', + 'agent event "agent/status" listener rejected: Error: async listener', + ]) + }) }) describe('AgentRegistry factory seam', () => { diff --git a/packages/core/scope/README.md b/packages/core/scope/README.md index f779dab57e..727acea4fb 100644 --- a/packages/core/scope/README.md +++ b/packages/core/scope/README.md @@ -9,7 +9,7 @@ Scoped-context registration primitive. `createScope(ctx, key)` mints a Cordis co - `Scope.rawDispose` The EXACT Cordis disposer for the backing fiber — a composite (generator) effect yields THIS function to nest the scope's teardown at that yield position (Cordis dedupes nested effects by function identity; yielding a wrapper leaves the scope disposing as a concurrent sibling). - `Scope.dispose(): Promise` Idempotent, shared quiescence boundary for every registration made through the scope. Racing/repeat calls await the same teardown, including when `rawDispose` invoked the underlying single-shot Cordis disposer first. - `scopeOf(ctx: Context): ScopeKey | undefined` The tag a context (or any context derived from it) carries; `undefined` = context-global. -- `scopeTarget(base: T, key?: ScopeKey): Scoped` Build the dispatch `thisArg` for a scope-filtered event: composes `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics). +- `scopeTarget(base: T, key: ScopeKey | undefined): Scoped` Build the dispatch `thisArg` for a scope-filtered event: capture and compose `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). The carrier uses a dedicated surrogate proxy target whose immutable filter slot cannot be replaced by a base property pinned before, during, or after construction; ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to `base`, and callable carriers match the base's constructable/non-constructable shape. For non-overlay base-owned properties, descriptor queries preserve values and flags except that configurable is normalized to `true`, as required to report those properties through an extensible surrogate. Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics). - `Scoped` The compile-time carrier brand: scope-filtered events demand it as their `this` type, so dispatching with a bare subject is a compile error. - `isScopeCarrier(value)` / `carrierKeyOf(value)` Runtime carrier marks, used by the dev invariants to assert every scope-filtered dispatch carries a carrier keyed to the subject its arguments name. - `scopeHost(ctx, services)` Test/tooling host that snapshots the requested service list before activation, fails loud with stable missing-service diagnostics, and whose shared `dispose()` waits for both the host fiber and every minted scope, including a child already tearing down through `rawDispose`. diff --git a/packages/core/scope/src/index.ts b/packages/core/scope/src/index.ts index 276b406dcd..9c917fc89d 100644 --- a/packages/core/scope/src/index.ts +++ b/packages/core/scope/src/index.ts @@ -171,6 +171,20 @@ export function scopeOf(ctx: Context): ScopeKey | undefined { return (ctx as Context & { [kScope]?: ScopeKey })[kScope] } +/** Whether a callable has JavaScript's internal construction capability. */ +function isConstructable(value: (...args: unknown[]) => unknown): boolean { + try { + // A Proxy has [[Construct]] iff its target does. Its trap returns before + // the engine invokes `value` or reads `value.prototype`, so a hostile but + // constructable callable cannot be mistaken for a non-constructor. + Reflect.construct(new Proxy(value, { construct: () => ({}) }), []) + return true + } catch { + // The harmless outer trap leaves lack of [[Construct]] as the only failure. + return false + } +} + /** * Build the dispatch carrier for a scope-filtered event: `base` overlaid with * a `Context.filter` that admits a listener iff @@ -206,7 +220,10 @@ export function scopeOf(ctx: Context): ScopeKey | undefined { * @returns the carrier to pass as the dispatch `thisArg`. */ export function scopeTarget(base: T, key: ScopeKey | undefined): Scoped { - const baseFilter = (base as { [CordisContext.filter]?: (ctx: Context) => boolean })[CordisContext.filter] + const baseFilter: unknown = (base as { [CordisContext.filter]?: unknown })[CordisContext.filter] + if (baseFilter !== undefined && typeof baseFilter !== 'function') { + throw new TypeError('scope target Context.filter must be a function when present') + } const filter = (ctx: Context): boolean => { if (baseFilter && !baseFilter.call(base, ctx)) return false const tag = scopeOf(ctx) @@ -214,34 +231,57 @@ export function scopeTarget(base: T, key: ScopeKey | undefined } const overlay: Record = { [CordisContext.filter]: filter, - [kCarrier]: { key }, + [kCarrier]: Object.freeze({ key }), } - // A hand-rolled proxy, NOT cordis withProps: withProps delegates gets with - // the PROXY as receiver, so a getter on `base` runs with proxy `this` and a - // method call through the carrier gets a proxy receiver — either one throws - // on a native `#private` field of the subject (TypeError: private member - // not declared). Cordis hands the carrier to listeners as `this`, and the - // event declarations type it `Scoped` — so subject method calls - // through it are a SUPPORTED shape and must reach the real object: gets - // delegate with `base` as receiver, functions come back bound to `base`, - // and sets land on `base` directly. - return new Proxy(base, { + // Use a dedicated extensible proxy TARGET, never `base` itself. Proxy get + // invariants force a trap to return a base's non-configurable/non-writable + // own value verbatim; if a caller pinned Context.filter during or after + // construction, a base-target proxy would therefore silently replace the + // composed scope predicate with the caller's filter. The surrogate owns the + // two immutable overlay slots, so later descriptor changes on `base` cannot + // affect isolation. It shares the base prototype and delegates ordinary + // reads/writes/keys to preserve the supported transparent shape. Callable + // targets use native bound built-ins so V8 contributes no user-code surface; + // the chosen built-in matches whether `base` has [[Construct]], and the traps + // below delegate the actual call/construction to `base`. + const callableBase = typeof base === 'function' + ? base as unknown as (...args: unknown[]) => unknown + : undefined + const constructable = callableBase !== undefined && isConstructable(callableBase) + const target: object = callableBase === undefined + ? {} + : constructable + ? Object.bind(undefined) + : Math.max.bind(undefined) + Reflect.setPrototypeOf(target, Reflect.getPrototypeOf(base)) + Object.defineProperties(target, { + [CordisContext.filter]: { + value: filter, + enumerable: false, + writable: false, + configurable: false, + }, + [kCarrier]: { + value: overlay[kCarrier], + enumerable: false, + writable: false, + configurable: false, + }, + }) + const carrier = new Proxy(target, { get(target, prop) { - // Proxy get invariants pin what this trap may report for a - // non-configurable OWN property of the base: a non-writable data prop - // must be reported AS-IS (neither overlaid nor bound), a getterless - // accessor as undefined — checked FIRST so even an overlay key - // colliding with a frozen own prop of a (pathological) base yields the - // base's value instead of an engine TypeError. Such a base forgoes - // scope filtering; no production base freezes these keys. + // The callable surrogate has engine-owned pinned properties (`prototype`, + // `caller`, …); honor those target invariants. For object carriers the + // only pinned target properties are the exact overlay values above. const own = Reflect.getOwnPropertyDescriptor(target, prop) const pinned = own !== undefined && own.configurable === false && own.get === undefined && own.writable !== true - // hasOwn, not `in`: the overlay literal inherits Object.prototype, so - // `in` would claim `toString`/`constructor` and shadow the subject's. - if (!pinned && Object.hasOwn(overlay, prop)) return overlay[prop] - const value: unknown = Reflect.get(target, prop, target) - if (typeof value !== 'function' || pinned) return value + if (pinned) { + const value: unknown = Reflect.get(target, prop, target) + return value + } + const value: unknown = Reflect.get(base, prop, base) + if (typeof value !== 'function') return value // `constructor` is looked up, never invoked as a subject method — keep // the real one (withProps special-cases it the same way), so // `carrier.constructor` still identifies the subject's class. @@ -249,12 +289,66 @@ export function scopeTarget(base: T, key: ScopeKey | undefined // `Function.prototype.bind` types as `any`; the value is structurally // T[prop] and the trap's contract is untyped (`any`), so unknown is the // honest safe return. - return value.bind(target) as unknown + return value.bind(base) as unknown }, - set(target, prop, value) { - return Reflect.set(target, prop, value, target) + set(_target, prop, value) { + if (Object.hasOwn(overlay, prop)) return false + return Reflect.set(base, prop, value, base) }, - }) as Scoped + has(_target, prop) { + // A Proxy may not hide a non-configurable target key. Configurable + // surrogate-only keys (bound-function name/length) are omitted; the + // base's own/inherited surface remains authoritative. + const own = Reflect.getOwnPropertyDescriptor(target, prop) + return own?.configurable === false || Reflect.has(base, prop) + }, + ownKeys(target) { + const requiredTargetKeys = Reflect.ownKeys(target).filter((prop) => { + return Reflect.getOwnPropertyDescriptor(target, prop)?.configurable === false + }) + return [...new Set([...requiredTargetKeys, ...Reflect.ownKeys(base)])] + }, + getOwnPropertyDescriptor(target, prop) { + const targetDescriptor = Reflect.getOwnPropertyDescriptor(target, prop) + if (targetDescriptor?.configurable === false) return targetDescriptor + const baseDescriptor = Reflect.getOwnPropertyDescriptor(base, prop) + if (baseDescriptor !== undefined) return { ...baseDescriptor, configurable: true } + // Configurable surrogate-only function metadata is intentionally hidden. + return undefined + }, + defineProperty(_target, prop, attributes) { + if (Object.hasOwn(overlay, prop)) return false + return Reflect.defineProperty(base, prop, attributes) + }, + deleteProperty(_target, prop) { + if (Object.hasOwn(overlay, prop)) return false + return Reflect.deleteProperty(base, prop) + }, + preventExtensions() { + // Keeping the surrogate extensible is required for ownKeys to report + // caller-owned base fields that may change over the carrier's lifetime. + return false + }, + setPrototypeOf() { + // The carrier prototype and base delegation must not be split. + return false + }, + apply(_target, thisArg, args) { + const callable = callableBase as (...values: unknown[]) => unknown + const result: unknown = Reflect.apply(callable, thisArg, args) + return result + }, + construct(_target, args, newTarget) { + const constructor = callableBase as unknown as new (...values: unknown[]) => object + const result: unknown = Reflect.construct( + constructor, + args, + newTarget === carrier ? constructor : newTarget, + ) + return result as object + }, + }) + return carrier as Scoped } /** @@ -266,10 +360,8 @@ export function scopeTarget(base: T, key: ScopeKey | undefined * @returns true iff `value` came from {@link scopeTarget}. */ export function isScopeCarrier(value: unknown): value is Scoped { - if (typeof value !== 'object' || value === null) return false - // A property READ, not an `in` check: the carrier overlays its marks in the - // get trap only (no `has` trap), so `kCarrier in carrier` would fall - // through to the wrapped base and always answer false. + if ((typeof value !== 'object' && typeof value !== 'function') || value === null) return false + // A property read checks the immutable marker owned by the surrogate target. return (value as { [kCarrier]?: { key: ScopeKey | undefined } })[kCarrier] !== undefined } diff --git a/packages/core/scope/tests/scope.spec.ts b/packages/core/scope/tests/scope.spec.ts index e572584fb1..5b379d15e5 100644 --- a/packages/core/scope/tests/scope.spec.ts +++ b/packages/core/scope/tests/scope.spec.ts @@ -232,7 +232,7 @@ describe('scopeTarget dispatch filtering', () => { expect(detached()).toBe(2) }) - it('delegates sets to the base and leaves frozen own function props unbound (proxy invariant)', () => { + it('delegates the ordinary reflective surface while keeping overlays immutable', () => { const frozenFn = (): string => 'frozen' const base: { mutable: number; pinned: () => string; toString: () => string } = { mutable: 0, @@ -243,25 +243,158 @@ describe('scopeTarget dispatch filtering', () => { const carrier = scopeTarget(base, undefined) carrier.mutable = 7 expect(base.mutable).toBe(7) // sets land on the base, not a detached overlay - // A non-configurable, non-writable own data prop must be reported - // unchanged (binding it would violate the proxy get invariant). - expect(carrier.pinned).toBe(frozenFn) + // The surrogate target frees reads from the base property's proxy + // invariant, so even a frozen own method can be safely bound to the base. + expect(carrier.pinned).not.toBe(frozenFn) + expect(carrier.pinned()).toBe('frozen') // The overlay literal inherits Object.prototype; hasOwn (not `in`) keeps // it from shadowing the subject's own prototype-surface members. expect(String(carrier)).toBe('base-str') + expect('mutable' in carrier).toBe(true) + expect(Object.hasOwn(carrier, 'mutable')).toBe(true) + expect(Object.keys(carrier)).toEqual(['mutable', 'pinned', 'toString']) + Object.defineProperty(carrier, 'extra', { value: 1, configurable: true }) + expect((base as typeof base & { extra?: number }).extra).toBe(1) + expect(delete (carrier as typeof carrier & { extra?: number }).extra).toBe(true) + expect(Reflect.preventExtensions(carrier)).toBe(false) + expect(Reflect.setPrototypeOf(carrier, null)).toBe(false) }) - it('honors the get invariant even when an overlay key collides with a frozen own prop of the base', () => { - // Pathological but engine-enforced: a base whose own [Context.filter] is - // a non-configurable, non-writable data prop pins what any proxy over it - // may report for that key. The carrier must yield the base's value (an - // overlay there would be a runtime TypeError from the engine, not a - // filtering choice). Such a base forgoes scope filtering by construction. + it('keeps isolation when the base filter is pinned before, during, or after construction', async () => { + const ctx = new Context() + const keyA = { name: 'A' } + const keyB = { name: 'B' } + const scopeA = await mintScope(ctx, keyA) + const scopeB = await mintScope(ctx, keyB) + const heard: string[] = [] + ctx.on('scope-test/ping', value => void heard.push(`global:${value}`)) + scopeA.ctx.on('scope-test/ping', value => void heard.push(`A:${value}`)) + scopeB.ctx.on('scope-test/ping', value => void heard.push(`B:${value}`)) const pinnedFilter = (): boolean => true - const base = {} - Object.defineProperty(base, Context.filter, { value: pinnedFilter, writable: false, configurable: false }) - const carrier = scopeTarget(base, { name: 'key' }) - expect((carrier as Record)[Context.filter]).toBe(pinnedFilter) + + const pinnedData = {} + Object.defineProperty(pinnedData, Context.filter, { + value: pinnedFilter, + writable: false, + configurable: false, + }) + const pinnedCarrier = scopeTarget(pinnedData, keyA) + ctx.emit(pinnedCarrier, 'scope-test/ping', 'before') + + const duringRead = {} + Object.defineProperty(duringRead, Context.filter, { + configurable: true, + get() { + Object.defineProperty(duringRead, Context.filter, { + value: pinnedFilter, + writable: false, + configurable: false, + }) + return pinnedFilter + }, + }) + ctx.emit(scopeTarget(duringRead, keyA), 'scope-test/ping', 'during') + + const pinnedAfter = { [Context.filter]: pinnedFilter } + const afterCarrier = scopeTarget(pinnedAfter, keyA) + Object.defineProperty(pinnedAfter, Context.filter, { + value: pinnedFilter, + writable: false, + configurable: false, + }) + ctx.emit(afterCarrier, 'scope-test/ping', 'after') + + const pinnedGetterless = {} + Object.defineProperty(pinnedGetterless, Context.filter, { set(_value: unknown) {}, configurable: false }) + ctx.emit(scopeTarget(pinnedGetterless, keyA), 'scope-test/ping', 'getterless') + + expect(heard).toEqual([ + 'global:before', 'A:before', + 'global:during', 'A:during', + 'global:after', 'A:after', + 'global:getterless', 'A:getterless', + ]) + expect((pinnedCarrier as Record)[Context.filter]).not.toBe(pinnedFilter) + expect(Reflect.set(pinnedCarrier, Context.filter, pinnedFilter)).toBe(false) + expect(Reflect.defineProperty(pinnedCarrier, Context.filter, { value: pinnedFilter })).toBe(false) + expect(Reflect.deleteProperty(pinnedCarrier, Context.filter)).toBe(false) + + expect(() => scopeTarget({ [Context.filter]: 1 }, { name: 'A' })).toThrow( + /Context\.filter must be a function/, + ) + }) + + it('preserves callable and constructable bases', () => { + function Subject(this: { value?: number }, value: number): number { + if (new.target) { + this.value = value + return value + } + return value * 2 + } + const carrier = scopeTarget(Subject as typeof Subject & (new (value: number) => { value: number }), { + name: 'callable', + }) + + const called: unknown = Reflect.apply(carrier, { value: 0 }, [3]) + expect(called).toBe(6) + const instance = new carrier(4) + expect(instance).toBeInstanceOf(Subject) + expect(instance.value).toBe(4) + const prototypeDescriptor = Object.getOwnPropertyDescriptor(carrier, 'prototype') + const subjectPrototype: unknown = Reflect.get(Subject, 'prototype') + expect(prototypeDescriptor?.configurable).toBe(true) + expect(prototypeDescriptor?.value).toBe(subjectPrototype) + class Derived extends carrier {} + const derived = new Derived(5) + expect(derived).toBeInstanceOf(Derived) + expect(derived).toBeInstanceOf(Subject) + expect(derived.value).toBe(5) + expect(isScopeCarrier(carrier)).toBe(true) + }) + + it('matches non-constructable and bound-constructor function shapes', () => { + const arrow = (value: number): number => value + 1 + const arrowCarrier = scopeTarget(arrow, { name: 'arrow' }) + const arrowResult: unknown = Reflect.apply(arrowCarrier, undefined, [2]) + expect(arrowResult).toBe(3) + expect('prototype' in arrowCarrier).toBe(false) + expect(Object.getOwnPropertyDescriptor(arrowCarrier, 'prototype')).toBeUndefined() + expect(() => { Reflect.construct(arrowCarrier, []) }).toThrow(TypeError) + + class Subject { + constructor(readonly value: number) {} + } + const bound = Subject.bind(undefined, 7) + const boundCarrier = scopeTarget(bound, { name: 'bound-constructor' }) + expect('prototype' in boundCarrier).toBe(false) + expect(Object.getOwnPropertyDescriptor(boundCarrier, 'prototype')).toBeUndefined() + const instance = new boundCarrier() + expect(instance).toBeInstanceOf(Subject) + expect(instance.value).toBe(7) + }) + + it('detects construction without reading a hostile base prototype', () => { + class Subject { + constructor(readonly value: number) {} + } + let prototypeReads = 0 + const hostile = new Proxy(Subject, { + get(target, prop, receiver) { + if (prop === 'prototype') { + prototypeReads += 1 + throw new Error('hostile prototype getter') + } + return Reflect.get(target, prop, receiver) as unknown + }, + }) + + const carrier = scopeTarget(hostile, { name: 'hostile-constructor' }) + expect(prototypeReads).toBe(0) + const instance: unknown = Reflect.construct(carrier, [9], Subject) + expect(instance).toBeInstanceOf(Subject) + expect(instance).toMatchObject({ value: 9 }) + expect(prototypeReads).toBe(0) }) it('keeps the real constructor: class identity survives the carrier', () => { diff --git a/packages/core/session/README.md b/packages/core/session/README.md index 36052d9e7a..29f89e35c8 100644 --- a/packages/core/session/README.md +++ b/packages/core/session/README.md @@ -4,7 +4,7 @@ Event-sourced session log and in-memory store. A `Session` is the append-only so ## Service: `SessionStore` (ctx key: `sessions`) -Creates and holds event-sourced `Session` instances. Persistence is intentionally not implemented here — plugins subscribe to `session/event` and flush on `session/flush`. +Creates and holds event-sourced `Session` instances. Persistence is intentionally not implemented here — plugins subscribe to `session/event`, flush on `session/flush`, and may mirror the paired `session/created`/`session/disposed` lifecycle. ### Public API @@ -16,17 +16,18 @@ Creates and holds event-sourced `Session` instances. Persistence is intentionall #### Advanced: ordered-teardown lifecycle primitives -`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before `onAppend` detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: +`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before the store-owned append observer detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: - `ctx.sessions.prepare(id?, options?): Session` — read `options.seed`/`options.meta` once, validate and detach the metadata/header, and construct the `Session` WITHOUT entering it into the store. Same options as `create`. -- `ctx.sessions.enter(session): () => void` — wire `onAppend` → `session/event`, capture its scope carrier, and add the session to the store; returns the idempotent DETACH disposer, which clears both notification and carrier state. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved; a stale prepared object must not overwrite a live same-id session. -- `ctx.sessions.announce(session): void` — emit `session/created` for an entered session. +- `ctx.sessions.reserve(id): SessionRegistrationReservation` — hold an unpublished id under the calling fiber and construct its one owned Session through `reservation.prepare(options?)`. Until `release()` or owner unload, bare `prepare`/`create`/`enter` calls for that id reject; the factory later presents the exact capability to `enter`, making setup-time publication structurally impossible without leaking an abandoned reservation across HMR disposal. +- `ctx.sessions.enter(session, reservation?): () => void` — install the module-private `session/event` observer, capture its scope carrier, and add the session under one accepted id; returns the idempotent DETACH disposer, which clears notification, carrier, and accepted-key state. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved; a stale prepared object must not overwrite a live same-id session. A factory passes the opaque capability from `reserve(id)` so setup cannot enter the reserved session or publish a same-id replacement before the owning transaction. +- `ctx.sessions.announce(session): void` — begin the one allowed `session/created` announcement for an entered session; repeat and reentrant calls reject before dispatch. Its detach emits `session/disposed` exactly once, including rollback after a partially delivered creation notification; a never-announced entry emits neither edge. `dsh-agent-loop` is the canonical consumer: after unpublished agent setup it enters both session and agent before announcing either, then nests loop stop, agent removal, session detach, and scope unwind in one ordered lifecycle. The final flush therefore settles before this package detaches the session, whether teardown starts from an `AgentHandle` or owner-fiber unload. ### Live service events -The store announces creation, publishes each append, and provides an awaited durability checkpoint. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md). Persistence consumers write behind from the append notification and drain on the store-owned flush entry point rather than dispatching the event directly. +The store pairs announced creation with disposal, publishes each append, and provides an awaited durability checkpoint. Disposal listener failures, including returned-promise rejections, are contained per observer so teardown cannot be interrupted. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md). Persistence consumers write behind from the append notification and drain on the store-owned flush entry point rather than dispatching the event directly. ### Class: `Session` @@ -37,8 +38,8 @@ Plain class (not a Cordis Service). Create via `ctx.sessions.create()`. - `session.deriveEventMessage(event): Message | null` — the per-event projection `deriveMessages()` folds: one event's derived message (an unfrozen clone), or `null` when it produces none (a non-surface event, or an empty-content `assistant/message` hosting only usage). External reconstructors and the dev invariant fold the same function over a log prefix's surface, so no two paths can disagree about what a request's messages were (the reconstructability RFC). - `session.surface: SurfaceManager` — the derived surface, lazily rebuilt from `surfaceOp` markers in the log. Processes only new events (delta) on each access — the log is append-only, so prior events never change. `surface.replaceGeneration` is the rewrite signal: bumped by every folded `replace` and by `invalidate()`, never reset, so an incremental consumer comparing generations cannot be fooled. - `session.events` — a cached, frozen array snapshot over deep-frozen events. Repeated reads without an append return the same array; an append invalidates the cache and the next read returns a new snapshot, while earlier snapshots stay unchanged. Neither a cast nor a retained reference can push into the live log or rewrite an accepted event. -- `session.seq`, `session.id` -- `session.header: SessionHeader` — detached, deep-frozen creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`). Construction validates its lossless-JSON shape and requires the header id to match `session.id`, so a caller cannot later mutate persistence routing or lineage through an aliased header. Kept out of the event log (a storage concern, not replayable state); a minimal header (stamped with the current `SESSION_FORMAT_VERSION`) is synthesized for bare `Session` construction. +- `session.seq`, `session.id` — `id` is a non-writable, non-configurable runtime identity slot, not merely TypeScript-readonly. +- `session.header: SessionHeader` — detached, deep-frozen creation metadata (`version`, `id`, `createdAt`, optional `cwd`/`parentSession`/`seedLength`) published through a non-writable, non-configurable slot. Construction validates its lossless-JSON shape and requires the header id to match `session.id`, so a caller cannot later replace or mutate persistence routing or lineage. Kept out of the event log (a storage concern, not replayable state); a minimal header (stamped with the current `SESSION_FORMAT_VERSION`) is synthesized for bare `Session` construction. ### Lossless JSON utilities diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts index 51500e9e1b..b000e7083b 100644 --- a/packages/core/session/src/index.ts +++ b/packages/core/session/src/index.ts @@ -34,7 +34,10 @@ declare module 'cordis' { interface Events { /** - * A session was created in the store. + * A session was created in the store. A synchronous listener throw vetoes + * publication and rollback emits the matching `session/disposed` edge; + * returned-promise rejection is observed and logged but cannot retroactively + * veto this synchronous boundary. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the * session's owner scope, captured when the session was ENTERED (an agent's * session is entered through `agent.ctx`, so its events dispatch in that @@ -45,6 +48,18 @@ declare module 'cordis' { * @mode emit */ 'session/created'(this: Scoped, session: Session): void + /** + * A previously announced session left the store. Emitted exactly once on + * normal detach or publication rollback, and never for a prepared/entered + * session whose `session/created` announcement did not begin. Listener + * failures (including returned-promise rejections) are logged and contained + * per listener so teardown always reaches quiescence. + * Scope-filtered dispatch uses the same owner carrier captured at entry; + * agent-scoped listeners hear only their own session's teardown. + * @param session - the session that is no longer live in the store. + * @mode emit + */ + 'session/disposed'(this: Scoped, session: Session): void /** * An event was appended to a session log (sync, fire-and-forget). This is * the per-append feed a UI or invariant plugin tails. @@ -253,6 +268,17 @@ function assertSessionEventEnvelope(value: Record, index: numbe } } +/** Render an arbitrary thrown value without allowing coercion to throw again. */ +function renderThrown(value: unknown): string { + try { + return value instanceof Error ? `${value.name}: ${value.message}` : String(value) + } catch { + return '' + } +} + +const appendObservers = new WeakMap void>() + /** * An event-sourced session: an append-only log of {@link SessionEvent}s. * @@ -261,8 +287,6 @@ function assertSessionEventEnvelope(value: Record, index: numbe */ export class Session { private log: SessionEvent[] = [] - /** Set by the store so appends are observable; undefined when detached. */ - onAppend: ((event: SessionEvent) => void) | undefined /** * Derived surface — a cached linked list of message-producing events. @@ -336,6 +360,14 @@ export class Session { }) } this.header = snapshotSessionHeader(id, header) + // TypeScript readonly prevents ordinary typed assignment only. Pin both + // public identity bindings at runtime too: setup/plugins receive the live + // Session object, and replacing either slot would split registry keys, + // persistence routing, and the already-validated header. + Object.defineProperties(this, { + id: { value: id, enumerable: true, writable: false, configurable: false }, + header: { value: this.header, enumerable: true, writable: false, configurable: false }, + }) } /** Cached immutable public snapshot of the private append-only log. */ @@ -359,8 +391,8 @@ export class Session { /** * Append one typed event to the log and synchronously notify observers via - * `onAppend`. The hot path never blocks on I/O — persistence plugins buffer - * asynchronously. + * the store-owned, module-private append observer. The hot path never blocks + * on I/O — persistence plugins buffer asynchronously. * * @param type - The event type (key of {@link SessionEventMap}). * @param data - The event payload; must be JSON-serializable. @@ -444,7 +476,7 @@ export class Session { const acceptedEvent = deepFreeze(event) this.log.push(acceptedEvent as unknown as SessionEvent) this.eventsSnapshot = undefined - this.onAppend?.(acceptedEvent as unknown as SessionEvent) + appendObservers.get(this)?.(acceptedEvent as unknown as SessionEvent) return acceptedEvent } @@ -599,6 +631,29 @@ export class SessionForkError extends Error { } } +/** + * Unforgeable ownership handle for one unpublished session id. A factory keeps + * this capability across load/setup, preventing setup code from entering the + * prepared Session or publishing a replacement under the same id. Obtain it + * only from {@link SessionStore.reserve}. + */ +export interface SessionRegistrationReservation { + /** The reserved store id. */ + readonly id: SessionId + /** + * Construct the one Session owned by this reservation. + * @param options - seed events and creation metadata. + * @returns the still-unpublished Session. + */ + prepare(options?: CreateSessionOptions): Session + /** + * Release the unpublished reservation; idempotent. The store also releases + * it automatically when the fiber that called `reserve` disposes. + * @returns nothing. + */ + release(): void +} + /** * In-memory session store (`ctx.sessions`). * @@ -607,6 +662,14 @@ export class SessionForkError extends Error { */ export class SessionStore extends Service { private store = new Map() + /** The one accepted map key for each live session; never reread caller state. */ + private acceptedIds = new WeakMap() + /** Sessions whose creation announcement began and therefore require a pair. */ + private announced = new WeakSet() + /** Unpublished identities held across factory load/setup transactions. */ + private reservations = new Map() + /** The exact prepared object owned by each reservation capability. */ + private reservedSessions = new WeakMap() /** * Each live session's dispatch carrier, captured at {@link enter} from the * ENTERING context's scope tag (an agent session is entered through @@ -621,6 +684,59 @@ export class SessionStore extends Service { super(ctx, 'sessions') } + /** + * Reserve one unpublished session id across an asynchronous factory + * transaction. Bare `prepare`/`create`/`enter` calls for the id reject until + * release; the capability constructs exactly one Session and is passed back + * to {@link enter} at publication. The reservation belongs to the calling + * fiber, so owner unload releases an abandoned id automatically. + * @param id - the session id the transaction will publish. + * @returns the opaque reservation capability. + * @throws if the id is malformed, live, or already reserved. + */ + reserve(id: SessionId): SessionRegistrationReservation { + if (typeof id !== 'string') throw new TypeError('session id must be a string') + if (this.store.has(id) || this.reservations.has(id)) { + throw new Error(`session "${id}" already exists or is reserved`) + } + let active = true + let prepared = false + const rawRelease = (): void => { + if (!active) return + active = false + this.reservedSessions.delete(reservation) + this.reservations.delete(id) + } + let disposeEffect!: () => Promise | void + const reservation: SessionRegistrationReservation = Object.freeze({ + id, + prepare: (options?: CreateSessionOptions) => { + if (!active) { + throw new Error(`session "${id}" reservation is no longer active`) + } + if (prepared) throw new Error(`session "${id}" reservation already prepared a session`) + prepared = true + const session = this.prepareReserved(id, options, reservation) + this.reservedSessions.set(reservation, session) + return session + }, + release: () => { + rawRelease() + // Remove the now-inert ownership effect on manual transaction settle; + // its cleanup is the exact idempotent raw release above. + void disposeEffect() + }, + }) + this.reservations.set(id, reservation) + try { + disposeEffect = this.ctx.effect(() => rawRelease, `sessions.reserve(${id})`) + } catch (error: unknown) { + rawRelease() + throw error + } + return reservation + } + /** * Create a session owned by the calling fiber: disposing that fiber stops * event notification and removes the session from the store. `options.seed` @@ -630,7 +746,7 @@ export class SessionStore extends Service { * fills `version`/`id`/`createdAt`). * * For an agent whose session must be torn down IN ORDER with its loop (so the - * loop's final flush is captured before `onAppend` detaches), do NOT use this + * loop's final flush is captured before the store-owned observer detaches), do NOT use this * — fold the session lifecycle into the agent's own effect via * {@link prepare} + {@link enter} + {@link announce} (see `dsh-agent-loop`'s * `startOwned`). @@ -647,7 +763,7 @@ export class SessionStore extends Service { // Single effect owned by the calling fiber. Yield the detach BEFORE // announcing so a throwing `session/created` listener rolls the attach back // (the generator effect disposes already-yielded disposers on a throw) - // instead of leaking the store entry + onAppend. + // instead of leaking the store entry + append observer. this.ctx.effect(function* (this: SessionStore) { yield this.enter(session) this.announce(session) @@ -661,7 +777,7 @@ export class SessionStore extends Service { * Pairs with {@link enter} + {@link announce}: a caller that owns a composite * `ctx.effect` (the agent factory) folds the session lifecycle into that ONE * effect so a fiber unload tears the session + agent down as a single ORDERED - * chain rather than as racing sibling effects — which would detach `onAppend` + * chain rather than as racing sibling effects — which would detach the append observer * before the loop's closing `session/flush`, dropping the closing events. * * @param id - the session id; omitted, the store mints `session-`. @@ -672,7 +788,27 @@ export class SessionStore extends Service { * non-absolute path. */ prepare(id?: SessionId, options?: CreateSessionOptions): Session { - const sessionId = SessionId(id ?? `session-${++this.counter}`) + return this.prepareReserved(id, options) + } + + /** Shared prepare implementation, optionally authorized by a reservation. */ + private prepareReserved( + id?: SessionId, + options?: CreateSessionOptions, + reservation?: SessionRegistrationReservation, + ): Session { + let sessionId: SessionId + if (id === undefined) { + do sessionId = SessionId(`session-${++this.counter}`) + while (this.store.has(sessionId) || this.reservations.has(sessionId)) + } else { + sessionId = SessionId(id) + } + if (typeof sessionId !== 'string') throw new TypeError('session id must be a string') + const held = this.reservations.get(sessionId) + if (reservation === undefined && held !== undefined) { + throw new Error(`session "${sessionId}" is reserved for unpublished creation`) + } if (this.store.has(sessionId)) throw new Error(`session "${sessionId}" already exists`) const seed = options?.seed const meta = snapshotSessionMeta(options?.meta) @@ -691,9 +827,9 @@ export class SessionStore extends Service { } /** - * Enter a {@link prepare}d session into the store: wire `onAppend` → - * `session/event` and add it to the store. Returns the DETACH disposer - * (`onAppend = undefined` + store removal). Does NOT emit `session/created` — + * Enter a {@link prepare}d session into the store: wire the module-private + * append observer to `session/event` and add it to the store. Returns the + * DETACH disposer (observer + store removal). Does NOT emit `session/created` — * the caller yields this disposer inside its effect and THEN calls * {@link announce}, so a throwing `session/created` listener rolls the attach * back instead of leaking it. @@ -707,11 +843,23 @@ export class SessionStore extends Service { * assume that. * * @param session - a {@link prepare}d session not yet in the store. - * @returns the detach disposer (`onAppend = undefined` + store removal). + * @param reservation - the exact unpublished-id capability when a factory + * reserved this session across setup. + * @returns the detach disposer (observer + store removal). * @throws if a session with this id is already in the store. */ - enter(session: Session): () => void { - if (this.store.has(session.id)) throw new Error(`session "${session.id}" already exists`) + enter(session: Session, reservation?: SessionRegistrationReservation): () => void { + const id = session.id + if (typeof id !== 'string') throw new TypeError('session id must be a string') + const held = this.reservations.get(id) + if (reservation === undefined) { + if (held !== undefined) throw new Error(`session "${id}" is reserved for unpublished creation`) + } else if (reservation.id !== id || held !== reservation + || this.reservedSessions.get(reservation) !== session) { + throw new Error(`session "${id}" registration reservation does not own this prepared session`) + } + if (this.store.has(id)) throw new Error(`session "${id}" already exists`) + if (appendObservers.has(session)) throw new Error(`session "${id}" is already attached to a store`) // The carrier is decided HERE, once, from the ENTERING context's scope tag // (`this.ctx` is the caller's context — the tracker mechanism): every // session/created|event|flush dispatch for this session uses it, so the @@ -720,24 +868,65 @@ export class SessionStore extends Service { const carrier = scopeTarget(session, scopeOf(this.ctx)) this.carriers.set(session, carrier) const emitCtx = this.ctx - session.onAppend = (event) => { emitCtx.emit(carrier, 'session/event', session, event) } - this.store.set(session.id, session) + appendObservers.set(session, (event) => { emitCtx.emit(carrier, 'session/event', session, event) }) + this.acceptedIds.set(session, id) + this.store.set(id, session) let entered = true return () => { if (!entered) return entered = false - session.onAppend = undefined + const wasAnnounced = this.announced.delete(session) + appendObservers.delete(session) + this.acceptedIds.delete(session) this.carriers.delete(session) - this.store.delete(session.id) + this.store.delete(id) + if (wasAnnounced) this.emitDisposed(session, carrier, id) } } - /** Emit `session/created` for an {@link enter}ed session (with the carrier - * {@link enter} captured). Separate from {@link enter} so the caller can - * yield the detach disposer first (rollback safety — see {@link enter}). - * @param session - the entered session to announce to listeners. */ + /** Emit `session/created` exactly once for an {@link enter}ed session (with + * the carrier {@link enter} captured). Separate from {@link enter} so the + * caller can yield the detach disposer first (rollback safety — see + * {@link enter}). + * @param session - the entered session to announce to listeners. + * @throws if the session is not live or its announcement already began, + * including a reentrant call from a creation listener. */ announce(session: Session): void { - this.ctx.emit(this.liveCarrierFor(session), 'session/created', session) + const carrier = this.liveCarrierFor(session) + if (this.announced.has(session)) { + throw new Error(`session "${session.id}" was already announced`) + } + // Mark before emit: Cordis emit may deliver to earlier listeners and then + // throw. Rollback must still pair that partial creation with disposal, and + // a listener cannot recursively create a second lifecycle edge. + this.announced.add(session) + const args: unknown[] = [carrier, 'session/created', session] + for (const callback of this.ctx.events.dispatch('emit', args)) { + // Synchronous throws intentionally propagate and veto publication; the + // yielded detach then emits the paired disposal edge. An async function + // is nevertheless assignable to a void listener, so observe its returned + // promise: rejection is too late to roll back and must be logged instead + // of becoming unhandled. + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`session "${session.id}": session/created listener rejected: ${renderThrown(error)}`) + }) + } + } + + /** Emit the paired teardown notification with per-listener containment. */ + private emitDisposed(session: Session, carrier: Scoped, id: SessionId): void { + const args: unknown[] = [carrier, 'session/disposed', session] + for (const callback of this.ctx.events.dispatch('emit', args)) { + try { + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`session "${id}": session/disposed listener rejected: ${renderThrown(error)}`) + }) + } catch (error: unknown) { + this.ctx.logger.warn(`session "${id}": session/disposed listener threw: ${renderThrown(error)}`) + } + } } /** @@ -756,8 +945,9 @@ export class SessionStore extends Service { /** Return the exact live session's carrier; detached/prepared objects reject. */ private liveCarrierFor(session: Session): Scoped { - if (this.store.get(session.id) !== session) { - throw new Error(`session "${session.id}" is not live in this store`) + const id = this.acceptedIds.get(session) + if (id === undefined || this.store.get(id) !== session) { + throw new Error(`session "${id ?? session.id}" is not live in this store`) } const carrier = this.carriers.get(session) // enter() installs store + carrier in one synchronous sequence; a live @@ -765,7 +955,7 @@ export class SessionStore extends Service { // to subject-less dispatch (that would silently cross scope boundaries). /* v8 ignore next -- enter installs store and carrier in one synchronous sequence */ if (carrier === undefined) { - throw new Error(`session "${session.id}" has no dispatch carrier`) + throw new Error(`session "${id}" has no dispatch carrier`) } return carrier } diff --git a/packages/core/session/tests/scoped.spec.ts b/packages/core/session/tests/scoped.spec.ts index ee1e710397..80dd8510d2 100644 --- a/packages/core/session/tests/scoped.spec.ts +++ b/packages/core/session/tests/scoped.spec.ts @@ -60,6 +60,23 @@ describe('session dispatch carriers', () => { bare.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) expect(heard).toEqual(['global:turn/start']) }) + + it('reuses the captured owner carrier for the paired disposal notification', async () => { + const ctx = await mount() + const owner = await mintScope(ctx, 'owner') + const other = await mintScope(ctx, 'other') + const heard: string[] = [] + ctx.on('session/disposed', (session) => { heard.push(`global:${session.id}`) }) + owner.ctx.on('session/disposed', (session) => { heard.push(`owner:${session.id}`) }) + other.ctx.on('session/disposed', (session) => { heard.push(`other:${session.id}`) }) + + const session = owner.ctx.sessions.prepare() + const detach = owner.ctx.sessions.enter(session) + owner.ctx.sessions.announce(session) + detach() + + expect(heard).toEqual([`global:${session.id}`, `owner:${session.id}`]) + }) }) describe('sessions.flush()', () => { diff --git a/packages/core/session/tests/session.spec.ts b/packages/core/session/tests/session.spec.ts index f7037609e6..ac0f06123c 100644 --- a/packages/core/session/tests/session.spec.ts +++ b/packages/core/session/tests/session.spec.ts @@ -578,6 +578,17 @@ describe('Session', () => { expect(session.header).not.toBe(input) expect(Object.isFrozen(session.header)).toBe(true) expect(Reflect.set(session.header, 'cwd', '/published-mutated')).toBe(false) + expect(Reflect.set(session, 'id', SessionId('redirected'))).toBe(false) + expect(Reflect.set(session, 'header', input)).toBe(false) + expect(Object.getOwnPropertyDescriptor(session, 'id')).toMatchObject({ + configurable: false, + writable: false, + }) + expect(Object.getOwnPropertyDescriptor(session, 'header')).toMatchObject({ + configurable: false, + writable: false, + }) + expect(session.id).toBe('header-owned') expect(session.header.cwd).toBe('/accepted') }) @@ -691,6 +702,10 @@ describe('SessionStore', () => { const session = ctx.sessions.create() expect(created).toEqual([session]) + // The store-owned append observer is module-private. A JavaScript caller + // may create an unrelated property with the old implementation's name, + // but cannot suppress the durable event feed. + expect(Reflect.set(session, 'onAppend', undefined)).toBe(true) session.append('user/message', { content: [{ type: 'text', text: 'x' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) expect(events).toHaveLength(1) expect(events[0]![0]).toBe(session) @@ -746,6 +761,114 @@ describe('SessionStore', () => { expect(ctx.sessions.get(SessionId('lifecycle'))).toBeUndefined() }) + it('captures the accepted id once and prevents simultaneous attachment to two stores', async () => { + const firstCtx = new Context() + const secondCtx = new Context() + await firstCtx.plugin(SessionStore) + await secondCtx.plugin(SessionStore) + const session = new Session(SessionId('owned-key')) + const detachFirst = firstCtx.sessions.enter(session) + + expect(Reflect.set(session, 'id', SessionId('redirected'))).toBe(false) + expect(() => secondCtx.sessions.enter(session)).toThrow(/already attached to a store/) + expect(firstCtx.sessions.get(SessionId('owned-key'))).toBe(session) + + detachFirst() + expect(firstCtx.sessions.get(SessionId('owned-key'))).toBeUndefined() + const detachSecond = secondCtx.sessions.enter(session) + expect(secondCtx.sessions.get(SessionId('owned-key'))).toBe(session) + detachSecond() + + expect(() => firstCtx.sessions.enter({ id: 42 } as unknown as Session)).toThrow(/id must be a string/) + }) + + it('uses an opaque one-session reservation to gate unpublished factory insertion', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const held = ctx.sessions.reserve(SessionId('held-session')) + + expect(() => ctx.sessions.reserve(SessionId('held-session'))).toThrow(/already exists or is reserved/) + expect(() => ctx.sessions.prepare(SessionId('held-session'))).toThrow(/reserved for unpublished creation/) + expect(() => ctx.sessions.create(SessionId('held-session'))).toThrow(/reserved for unpublished creation/) + const session = held.prepare({ meta: { cwd: '/held' } }) + expect(() => held.prepare()).toThrow(/already prepared/) + expect(() => ctx.sessions.enter(session)).toThrow(/reserved for unpublished creation/) + + const other = ctx.sessions.reserve(SessionId('other-session')) + expect(() => ctx.sessions.enter(session, other)).toThrow(/does not own this prepared session/) + expect(() => ctx.sessions.enter(new Session(SessionId('held-session')), held)) + .toThrow(/does not own this prepared session/) + + const detach = ctx.sessions.enter(session, held) + ctx.sessions.announce(session) + held.release() + held.release() + expect(ctx.sessions.get(SessionId('held-session'))).toBe(session) + expect(() => ctx.sessions.reserve(SessionId('held-session'))).toThrow(/already exists or is reserved/) + detach() + other.release() + + const expired = ctx.sessions.reserve(SessionId('expired-session')) + expired.release() + expect(() => expired.prepare()).toThrow(/no longer active/) + expect(() => ctx.sessions.enter(new Session(SessionId('expired-session')), expired)) + .toThrow(/does not own this prepared session/) + expect(() => ctx.sessions.reserve(42 as unknown as SessionId)).toThrow(/id must be a string/) + expect(() => ctx.sessions.prepare(42 as unknown as SessionId)).toThrow(/id must be a string/) + + // Auto-generated ids skip unpublished reservations just as they skip live + // store entries; no hidden collision can be published later. + const firstAuto = ctx.sessions.reserve(SessionId('session-1')) + expect(ctx.sessions.prepare().id).toBe('session-2') + firstAuto.release() + }) + + it('owns reservations by the calling fiber and rolls back failed ownership registration', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + let held!: import('@deepseek-ai/dsh-session').SessionRegistrationReservation + let scopedSessions!: SessionStore + const owner = await ctx.plugin(Object.assign((inner: Context) => { + scopedSessions = inner.sessions + held = inner.sessions.reserve(SessionId('fiber-held')) + }, { inject: ['sessions'] })) + + expect(() => ctx.sessions.reserve(SessionId('fiber-held'))).toThrow(/already exists or is reserved/) + await owner.dispose() + const reused = ctx.sessions.reserve(SessionId('fiber-held')) + reused.release() + held.release() // idempotent after the automatic owner-disposal release + + expect(() => scopedSessions.reserve(SessionId('inactive-owner'))).toThrow(/inactive context/) + const recovered = ctx.sessions.reserve(SessionId('inactive-owner')) + recovered.release() + }) + + it('rejects direct and reentrant repeat announcements to preserve one lifecycle pair', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + let created = 0 + let disposed = 0 + let reentrantError = '' + ctx.on('session/created', (session) => { + created += 1 + try { + ctx.sessions.announce(session) + } catch (error: unknown) { + reentrantError = String(error) + } + }) + ctx.on('session/disposed', () => { disposed += 1 }) + + const session = ctx.sessions.prepare(SessionId('once')) + const detach = ctx.sessions.enter(session) + ctx.sessions.announce(session) + expect(reentrantError).toMatch(/already announced/) + expect(() => { ctx.sessions.announce(session) }).toThrow(/already announced/) + detach() + expect({ created, disposed }).toEqual({ created: 1, disposed: 1 }) + }) + it('synthesizes a minimal current-version header for a bare-created session', async () => { const ctx = new Context() await ctx.plugin(SessionStore) @@ -864,11 +987,13 @@ describe('SessionStore', () => { expect(observed).toBe(0) }) - it('rolls back the session (and onAppend) when a session/created listener throws (P1-1)', async () => { + it('pairs a partial session/created announcement with disposal during rollback', async () => { const ctx = new Context() await ctx.plugin(SessionStore) let threw = false + const disposed: Session[] = [] + ctx.on('session/disposed', (session) => { disposed.push(session) }) ctx.on('session/created', () => { if (!threw) { threw = true; throw new Error('boom created listener') } }) @@ -876,9 +1001,10 @@ describe('SessionStore', () => { // The throwing emit must roll the store entry back, not leak it. expect(() => ctx.sessions.create(SessionId('fixed'))).toThrow('boom created listener') expect(ctx.sessions.get(SessionId('fixed'))).toBeUndefined() // rolled back, not leaked + expect(disposed.map(session => session.id)).toEqual(['fixed']) // A subsequent create of the SAME id succeeds (the already-exists check is - // not wedged) and its onAppend is correctly wired (events observable). + // not wedged) and its store-owned observer is correctly wired (events observable). const events: SessionEvent[] = [] ctx.on('session/event', (_session, event) => void events.push(event)) const session = ctx.sessions.create(SessionId('fixed')) @@ -886,6 +1012,59 @@ describe('SessionStore', () => { session.append('user/message', { content: [{ type: 'text', text: 'hi' }], source: { kind: 'user' } }, { surfaceOp: 'append' }) expect(events).toHaveLength(1) }) + + it('observes async session/created rejection without rolling back or starving peers', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const heard: string[] = [] + ctx.on('session/created', () => Promise.reject(new Error('late creation failure')) as never) + ctx.on('session/created', (session) => { heard.push(session.id) }) + + const session = ctx.sessions.create(SessionId('async-created')) + await Promise.resolve() + await Promise.resolve() + + expect(ctx.sessions.get(session.id)).toBe(session) + expect(heard).toEqual(['async-created']) + expect(warnings).toEqual([ + 'session "async-created": session/created listener rejected: Error: late creation failure', + ]) + }) + + it('contains synchronous and async session/disposed listener failures per observer', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const hostile = { [Symbol.toPrimitive]() { throw new Error('cannot stringify') } } + const printable = { toString: () => 'printable failure' } + const heard: string[] = [] + ctx.on('session/disposed', () => { throw hostile }) + ctx.on('session/disposed', () => Promise.reject(new Error('async disposed')) as never) + ctx.on('session/disposed', () => { throw printable }) + ctx.on('session/disposed', (session) => { heard.push(session.id) }) + + const unannounced = ctx.sessions.prepare(SessionId('never-announced')) + const detachUnannounced = ctx.sessions.enter(unannounced) + detachUnannounced() + expect(heard).toEqual([]) + + const announced = ctx.sessions.prepare(SessionId('contained-disposal')) + const detach = ctx.sessions.enter(announced) + ctx.sessions.announce(announced) + expect(() => { detach() }).not.toThrow() + await Promise.resolve() + await Promise.resolve() + + expect(heard).toEqual(['contained-disposal']) + expect(warnings).toEqual([ + 'session "contained-disposal": session/disposed listener threw: ', + 'session "contained-disposal": session/disposed listener threw: printable failure', + 'session "contained-disposal": session/disposed listener rejected: Error: async disposed', + ]) + }) }) describe('todo/write event', () => { diff --git a/packages/core/system-prompt/README.md b/packages/core/system-prompt/README.md index 439ebebfc7..dd395b3f88 100644 --- a/packages/core/system-prompt/README.md +++ b/packages/core/system-prompt/README.md @@ -13,10 +13,10 @@ System prompt assembly registry. Plugins contribute ordered text sections, tool- ### Public API -- `ctx.systemPrompt.section(section: PromptSection): () => Promise | void` Contribute a section. The registry snapshots `name`, `order`, and the text value/callback, so later caller-object mutation cannot rename a stored section. The layer is the CALLING context's scope: `agent.ctx` contributes to that agent alone, SHADOWING a same-named global section there (the per-agent persona mechanism — a scoped `deployment:persona`). Duplicate names within one layer throw, and a globally protected section name cannot be shadowed. Disposed with the calling fiber. -- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void` Contribute tool schemas, evaluated at each assembly with that assembly's context. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the same captured schemas' names) is the pre-restriction universe `toolOrder` validates against. Assembly reads the result, each schema field, and the optional known-name list once before detaching them, rejects non-string schema names/descriptions or known names, and uses those same accepted strings for validation and the model-visible collection. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber. -- `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise | void` Contribute a prompt variable, referenced from section text as `{{name}}`. Scoped variables (via `agent.ctx`) shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber. -- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Each input array is read once and snapshotted, empty protections throw, and disposal removes the protection. +- `ctx.systemPrompt.section(section: PromptSection): () => Promise | void` Contribute a section. The registry reads `name`, `order`, and the text value/callback once, validates their fixed string/finite-number/string-or-function types, and stores only that accepted record; later caller-object mutation cannot rename or reshape it. The layer is the CALLING context's scope: `agent.ctx` contributes to that agent alone, SHADOWING a same-named global section there (the per-agent persona mechanism — a scoped `deployment:persona`). Duplicate names within one layer throw, and a globally protected section name cannot be shadowed. Disposed with the calling fiber. +- `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void` Contribute tool schemas, evaluated at each assembly with that assembly's context; a non-function provider rejects before effect storage. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the same captured schemas' names) is the pre-restriction universe `toolOrder` validates against. Assembly reads the result, each schema field, and the optional known-name list once before detaching them, rejects non-string schema names/descriptions or known names, and uses those same accepted strings for validation and the model-visible collection. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber. +- `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise | void` Contribute a prompt variable, referenced from section text as `{{name}}`. The fixed string name and function provider types reject before effect storage. Scoped variables (via `agent.ctx`) shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber. +- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Each optional field and array slot is read once, non-array fields or non-string names reject before effect storage, and the accepted arrays are deduplicated and frozen. Finalization materializes each waterfall-produced entry name once, so a stateful getter cannot evade canonical replacement. Empty protections throw, and disposal removes the protection. - `ctx.systemPrompt.assemble(context?: AssembleContext): Promise` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer (scoped shadows global). Provider output becomes one coherent detached snapshot before `toolOrder` validation. Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores protected contributions from the pre-waterfall canonical assembly. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe (a restricted-away KNOWN tool is a normal absence), or when a provider returns the reserved rest-entry name. ### Live events diff --git a/packages/core/system-prompt/src/index.ts b/packages/core/system-prompt/src/index.ts index 8d3cc501a8..b810d07559 100644 --- a/packages/core/system-prompt/src/index.ts +++ b/packages/core/system-prompt/src/index.ts @@ -234,11 +234,41 @@ function orderTools(tools: ToolSchema[], toolOrder: string[] | undefined, knownN name === TOOL_ORDER_REST ? rest : tools.filter(tool => tool.name === name)) } +/** Snapshot one waterfall-produced named entry with a stable, own data `name`. */ +function snapshotNamedEntry(entry: T): { entry: T; name: string } { + // Read the name exactly once before protection matching. The waterfall owns + // its output and may return accessor-backed records; retaining such an entry + // would let a getter answer "unprotected" during filtering and the protected + // name later when a consumer reads the final assembly. + const name = entry.name + const snapshot: Record = {} + Object.defineProperty(snapshot, 'name', { + value: name, + enumerable: true, + configurable: true, + writable: true, + }) + // Copy every other enumerable field once while deliberately skipping name. + // defineProperty keeps a literal "__proto__" extension field ordinary data. + for (const key of Object.keys(entry)) { + if (key === 'name') continue + Object.defineProperty(snapshot, key, { + value: (entry as unknown as Record)[key], + enumerable: true, + configurable: true, + writable: true, + }) + } + return { entry: snapshot as T, name } +} + /** Restore protected named entries from `canonical`, anchored before their next unprotected canonical neighbor. */ function restoreProtected( canonical: readonly T[], result: readonly T[], protectedNames: ReadonlySet, ): T[] { - const restored = result.filter(entry => !protectedNames.has(entry.name)) + const restored = result + .map(snapshotNamedEntry) + .filter(record => !protectedNames.has(record.name)) for (const [index, entry] of canonical.entries()) { if (!protectedNames.has(entry.name)) continue // Protected entries are inserted in canonical order. Anchor each one @@ -251,9 +281,29 @@ function restoreProtected( .map(candidate => candidate.name), ) const next = restored.findIndex(candidate => following.has(candidate.name)) - restored.splice(next < 0 ? restored.length : next, 0, structuredClone(entry)) + restored.splice(next < 0 ? restored.length : next, 0, { + entry: structuredClone(entry), + name: entry.name, + }) } - return restored + return restored.map(record => record.entry) +} + +/** Validate and detach one protection-name array without rereading an element. */ +function snapshotProtectionNames(value: unknown, field: 'sections' | 'tools'): readonly string[] { + if (!Array.isArray(value)) { + throw new TypeError(`systemPrompt.protect() ${field} must be an array of strings`) + } + const names: string[] = [] + const length = value.length + for (let index = 0; index < length; index += 1) { + const name: unknown = value[index] + if (typeof name !== 'string') { + throw new TypeError(`systemPrompt.protect() ${field} must be an array of strings`) + } + names.push(name) + } + return Object.freeze([...new Set(names)]) } /** Lexicographic (code-unit) name comparison — locale-independent, so the order is identical on every machine. */ @@ -433,9 +483,10 @@ export class SystemPrompt extends Service { * `deployment:persona`) unless that global name is protected: global * protection reserves its section name against scoped shadows so the * registration owner—not a later scope—defines the canonical value. The - * registry snapshots `name`, `order`, and `text` before checking/storing, so - * later caller-object mutation cannot rename a contribution. Throws - * if the SAME layer already has the name (a + * registry reads `name`, `order`, and `text` once, validates their fixed + * string/finite-number/string-or-function types, and stores only that + * accepted record, so later caller-object mutation cannot rename or reshape + * a contribution. Throws if the SAME layer already has the name (a * duplicate would silently double prompt text — e.g. a double-loaded tool * plugin; the global-duplicate message names `agent.ctx` as the per-agent * alternative). Removed when the calling fiber is disposed. Emits @@ -446,12 +497,23 @@ export class SystemPrompt extends Service { * yield it directly — exact identity nests the teardown in order. */ section(section: PromptSection): () => Promise | void { - const scope = scopeOf(this.ctx) - const snapshot: PromptSection = { - name: section.name, - order: section.order, - text: section.text, + const input: unknown = section + if (typeof input !== 'object' || input === null) { + throw new TypeError('systemPrompt.section() requires a section object') } + const accepted = input as PromptSection + const name = accepted.name + const order = accepted.order + const text = accepted.text + if (typeof name !== 'string') throw new TypeError('prompt section name must be a string') + if (typeof order !== 'number' || !Number.isFinite(order)) { + throw new TypeError(`prompt section "${name}" order must be a finite number`) + } + if (typeof text !== 'string' && typeof text !== 'function') { + throw new TypeError(`prompt section "${name}" text must be a string or function`) + } + const scope = scopeOf(this.ctx) + const snapshot: PromptSection = { name, order, text } if (scope !== undefined && this.protections.some(record => record.sections?.includes(snapshot.name))) { throw new Error(`prompt section "${snapshot.name}" is globally protected and cannot be shadowed in an agent scope`) } @@ -498,7 +560,8 @@ export class SystemPrompt extends Service { * `schemas`/`knownNames` split). The layer is decided by the calling * context: a scoped provider (registered through `agent.ctx`) is consulted * only for that scope's assemblies. Removed when the calling fiber is - * disposed. A provider must not return a schema named + * disposed. A non-function provider is rejected before any effect is stored. + * A provider must not return a schema named * {@link TOOL_ORDER_REST}; that name is reserved for * {@link Config.toolOrder}'s rest entry and rejects the assembly. Emits * `system-prompt/change`. @@ -508,6 +571,9 @@ export class SystemPrompt extends Service { * yield it directly — exact identity nests the teardown in order. */ tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void { + if (typeof provider !== 'function') { + throw new TypeError('system prompt tool provider must be a function') + } const scope = scopeOf(this.ctx) const dispose = this.ctx.effect(function* (this: SystemPrompt) { const layer = scope === undefined @@ -545,10 +611,11 @@ export class SystemPrompt extends Service { * deployment must not claim facts it does not have). The layer is decided * by the calling context: a scoped variable (registered through * `agent.ctx`) resolves only for that scope's assemblies and SHADOWS a - * same-named global variable there. Throws on a name that does not match - * `[a-z][a-z0-9_]*` (it could never be referenced) or one already - * registered in the SAME layer. Removed when the calling fiber is disposed; - * emits `system-prompt/change` on register/unregister. + * same-named global variable there. The fixed name and callback types are + * validated before effect storage. Throws on a name that does not match + * `[a-z][a-z0-9_]*` (it could never be referenced) or one already registered + * in the SAME layer. Removed when the calling fiber is disposed; emits + * `system-prompt/change` on register/unregister. * @param name - the reference name (matches `[a-z][a-z0-9_]*`). * @param provider - evaluated at every {@link assemble} for the value. * @returns the disposer that removes the variable. The exact @@ -556,11 +623,16 @@ export class SystemPrompt extends Service { * yield it directly — exact identity nests the teardown in order. */ variable(name: string, provider: (context: AssembleContext) => string | undefined): () => Promise | void { + const inputName: unknown = name + if (typeof inputName !== 'string') throw new TypeError('prompt variable name must be a string') + if (!VARIABLE_NAME.test(inputName)) { + throw new Error(`invalid prompt variable name "${inputName}" (must match ${String(VARIABLE_NAME)})`) + } + if (typeof provider !== 'function') { + throw new TypeError(`prompt variable "${inputName}" provider must be a function`) + } const scope = scopeOf(this.ctx) const dispose = this.ctx.effect(function* (this: SystemPrompt) { - if (!VARIABLE_NAME.test(name)) { - throw new Error(`invalid prompt variable name "${name}" (must match ${String(VARIABLE_NAME)})`) - } const layer = scope === undefined ? this.variableProviders : this.scopedVariableProviders.get(scope) ?? (() => { @@ -599,9 +671,13 @@ export class SystemPrompt extends Service { * restored AFTER the whole waterfall, so listener registration order cannot * strip, replace, duplicate, or fabricate it. Canonical absence is restored * too: if the protected name is intentionally absent for an assembly, a - * listener-injected entry with that name is removed. Each input array is - * read once and snapshotted; an empty protection throws because it cannot - * affect output. + * listener-injected entry with that name is removed. Each optional field and + * array slot is read once; non-array fields or non-string names reject before + * effect storage, and the accepted deduplicated arrays are frozen. During + * finalization each waterfall-produced entry name is likewise read once into + * an owned data record, so a stateful getter cannot look unprotected during + * filtering and later impersonate a protected name. An empty protection + * throws because it cannot affect output. * Removed with the calling fiber and emits `system-prompt/change` on * registration/unregistration. A global section protection also reserves the * name against scoped section shadows; registering protection when such a @@ -610,13 +686,24 @@ export class SystemPrompt extends Service { * @returns the exact Cordis effect disposer that removes the protection. */ protect(protection: PromptProtection): () => Promise | void { - const scope = scopeOf(this.ctx) - const sections = protection.sections - const tools = protection.tools - const snapshot: PromptProtection = { - ...sections !== undefined ? { sections: [...new Set(sections)] } : {}, - ...tools !== undefined ? { tools: [...new Set(tools)] } : {}, + const input: unknown = protection + if (typeof input !== 'object' || input === null) { + throw new TypeError('systemPrompt.protect() requires a protection object') } + const accepted = input as PromptProtection + const inputSections = accepted.sections + const inputTools = accepted.tools + const sections = inputSections === undefined + ? undefined + : snapshotProtectionNames(inputSections, 'sections') + const tools = inputTools === undefined + ? undefined + : snapshotProtectionNames(inputTools, 'tools') + const scope = scopeOf(this.ctx) + const snapshot: PromptProtection = Object.freeze({ + ...sections !== undefined ? { sections } : {}, + ...tools !== undefined ? { tools } : {}, + }) if ((snapshot.sections?.length ?? 0) === 0 && (snapshot.tools?.length ?? 0) === 0) { throw new Error('systemPrompt.protect() requires at least one section or tool name') } diff --git a/packages/core/system-prompt/tests/system-prompt.spec.ts b/packages/core/system-prompt/tests/system-prompt.spec.ts index 9eef467a8e..c37ddd9c6c 100644 --- a/packages/core/system-prompt/tests/system-prompt.spec.ts +++ b/packages/core/system-prompt/tests/system-prompt.spec.ts @@ -111,6 +111,86 @@ describe('SystemPrompt', () => { expect(contributed(assembly).map(s => s.text)).toEqual(['first']) }) + it('rejects malformed fixed registration fields before storing an effect', async () => { + const ctx = new Context() + await ctx.plugin(SystemPrompt) + const badName = { value: 'name' } + const badText = { value: 'text' } + + expect(() => ctx.systemPrompt.section(null as unknown as Parameters[0])) + .toThrow('requires a section object') + expect(() => ctx.systemPrompt.section(1 as unknown as Parameters[0])) + .toThrow('requires a section object') + expect(() => ctx.systemPrompt.section({ name: badName as unknown as string, order: 1, text: 'x' })) + .toThrow('prompt section name must be a string') + expect(() => ctx.systemPrompt.section({ name: 'bad-order', order: '1' as unknown as number, text: 'x' })) + .toThrow('order must be a finite number') + expect(() => ctx.systemPrompt.section({ name: 'bad-order', order: Number.NaN, text: 'x' })) + .toThrow('order must be a finite number') + expect(() => ctx.systemPrompt.section({ name: 'bad-text', order: 1, text: badText as unknown as string })) + .toThrow('text must be a string or function') + expect(() => ctx.systemPrompt.tools(1 as unknown as Parameters[0])) + .toThrow('tool provider must be a function') + expect(() => ctx.systemPrompt.variable({} as unknown as string, () => 'x')) + .toThrow('prompt variable name must be a string') + expect(() => ctx.systemPrompt.variable('valid', 1 as unknown as Parameters[1])) + .toThrow('provider must be a function') + expect(() => ctx.systemPrompt.protect(null as unknown as Parameters[0])) + .toThrow('requires a protection object') + expect(() => ctx.systemPrompt.protect(1 as unknown as Parameters[0])) + .toThrow('requires a protection object') + expect(() => ctx.systemPrompt.protect({ sections: 'x' as unknown as string[] })) + .toThrow('sections must be an array of strings') + expect(() => ctx.systemPrompt.protect({ tools: 'x' as unknown as string[] })) + .toThrow('tools must be an array of strings') + expect(() => ctx.systemPrompt.protect({ sections: ['ok', {} as unknown as string] })) + .toThrow('sections must be an array of strings') + expect(() => ctx.systemPrompt.protect({ tools: [{} as unknown as string] })) + .toThrow('tools must be an array of strings') + + expect(Object.isFrozen(badName)).toBe(false) + expect(Object.isFrozen(badText)).toBe(false) + expect(contributed(await ctx.systemPrompt.assemble())).toEqual([]) + }) + + it('reads each section field and protection-name slot once at registration', async () => { + const ctx = new Context() + await ctx.plugin(SystemPrompt) + const reads = { name: 0, order: 0, text: 0, sections: 0, item: 0 } + const section = Object.defineProperties({}, { + name: { + enumerable: true, + get: () => (++reads.name === 1 ? 'stable' : 42), + }, + order: { + enumerable: true, + get: () => (++reads.order === 1 ? 10 : Number.NaN), + }, + text: { + enumerable: true, + get: () => (++reads.text === 1 ? 'stable text' : null), + }, + }) as unknown as Parameters[0] + const names = new Array(1) + Object.defineProperty(names, 0, { + enumerable: true, + get: () => (++reads.item === 1 ? 'stable' : 'drifted'), + }) + const protection = { + get sections(): string[] { + reads.sections += 1 + return reads.sections === 1 ? names : ['drifted'] + }, + } + + ctx.systemPrompt.section(section) + ctx.systemPrompt.protect(protection) + const assembly = await ctx.systemPrompt.assemble() + + expect(reads).toEqual({ name: 1, order: 1, text: 1, sections: 1, item: 1 }) + expect(assembly.sections).toContainEqual({ name: 'stable', order: 10, text: 'stable text' }) + }) + it('rolls back a section when a system-prompt/change listener throws (P1-1)', async () => { const ctx = new Context() await ctx.plugin(SystemPrompt) @@ -282,6 +362,56 @@ describe('SystemPrompt', () => { expect(assembly.sections).toContainEqual({ name: 'protected', order: 10, text: 'canonical' }) }) + it('materializes waterfall entry names once before restoring protected definitions', async () => { + const ctx = new Context() + await ctx.plugin(SystemPrompt) + ctx.systemPrompt.section({ name: 'protected', order: 10, text: 'canonical section' }) + ctx.systemPrompt.tools(() => ({ schemas: [{ name: 'protected', description: 'canonical tool', parameters: {} }] })) + ctx.systemPrompt.protect({ sections: ['protected'], tools: ['protected'] }) + let sectionNameReads = 0 + let toolNameReads = 0 + const hostileSection = { + get name(): string { + sectionNameReads += 1 + return sectionNameReads === 1 ? 'impostor-section' : 'protected' + }, + order: 999, + text: 'listener section', + } + const hostileTool = { + get name(): string { + toolNameReads += 1 + return toolNameReads === 1 ? 'impostor-tool' : 'protected' + }, + description: 'listener tool', + parameters: {}, + } + ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { + const result = await next() + result.sections = [ + ...result.sections.filter(section => section.name !== 'protected'), + hostileSection, + ] + result.tools = [ + ...result.tools.filter(tool => tool.name !== 'protected'), + hostileTool, + ] + return result + }) + + const assembly = await ctx.systemPrompt.assemble() + + expect(sectionNameReads).toBe(1) + expect(toolNameReads).toBe(1) + expect(assembly.sections.map(section => section.name)).toEqual([ + 'harness:identity', + 'deployment:persona', + 'impostor-section', + 'protected', + ]) + expect(assembly.tools.map(tool => tool.name)).toEqual(['impostor-tool', 'protected']) + }) + it('protects canonical absence and rejects an empty protection', async () => { const ctx = new Context() await ctx.plugin(SystemPrompt) diff --git a/packages/core/tools/README.md b/packages/core/tools/README.md index 0776ff39f6..74f1ff14c4 100644 --- a/packages/core/tools/README.md +++ b/packages/core/tools/README.md @@ -22,7 +22,7 @@ tools: - `ctx.tools.knownNames(scope?: ScopeKey): string[]` The PRE-restriction end-capability name universe `restrict` validates against: a typo fails loud while a restricted-away tool stays a normal absence. Presentation providers add reserved transport names separately when validating `toolOrder`. - `ctx.tools.schemas(scope?: ScopeKey): ToolSchema[]` Schemas of everything the scope can see (without the `execute` functions). The shipped tools' schemas are catalogued in [docs/tool-catalog.md](../../../docs/tool-catalog.md), generated by booting each tool plugin and harvesting this method (see [the tool-schema-catalog RFC](../../../docs/rfc/implemented/process/2026-07-02-tool-schema-catalog.md)). - `ctx.tools.guard(guard: ToolGuard): () => Promise | void` Register a monotonic synchronous execution guard after `tools/pre-execute`: returning a reason denies the call, while `undefined` leaves it unchanged. A plain-context guard applies globally; an `agent.ctx` guard applies only to that agent. Later waterfall listeners cannot turn a guard denial back into permission. Disposed with the calling fiber. -- `ctx.tools.execute(exec: ToolExecutionInput): Promise` Read each caller-owned top-level field once, snapshot the single-use call into a pipeline-owned execution, assign its opaque correlation token, materialize `arguments` through one lossless-JSON traversal, deep-freeze them, and protect identity before running `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`; optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove. After the required `callId`/`name` correlation identity is captured, the same captured optional fields build the normalized error shell if a later accessor or validation fails, so policy, dispatch, routing, and `tools/result` cannot observe different caller values. Every top-level result field is likewise captured once and the complete result or post-decision is losslessly materialized before final observation. Invalid input—including cloneable mutable exotics—and malformed or non-JSON listener/tool results normalize to `isError` outcomes rather than bypassing policy or failing later at the session log. A throwing `callId` or `name` accessor rejects because no trustworthy result identity exists yet. +- `ctx.tools.execute(exec: ToolExecutionInput): Promise` Read each caller-owned top-level field once, require `callId` and `name` to yield strings, snapshot the single-use call into a pipeline-owned execution, assign its opaque correlation token, materialize `arguments` through one lossless-JSON traversal, deep-freeze them, and protect identity before running `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute`; optional `signal` is the only operational field an around-dispatch wrapper may add, replace, or remove. After the required string correlation identity is captured, the same captured optional fields build the normalized error shell if a later accessor or validation fails, so policy, dispatch, routing, and `tools/result` cannot observe different caller values. Every top-level result field is likewise captured once and the complete result or post-decision is losslessly materialized before final observation. Invalid later input—including cloneable mutable exotics—and malformed or non-JSON listener/tool results normalize to `isError` outcomes rather than bypassing policy or failing later at the session log. A throwing accessor or non-string value in `callId` or `name` rejects before `tools/result` because no trustworthy result identity exists yet. ### Injected services @@ -35,7 +35,7 @@ The live registry pipeline has three transformable waterfalls followed by the ow ### Key types - `ToolDefinition` — `ToolSchema` + `execute(args, exec): Promise` (the bare array is the model-facing content; the object form additionally attaches an opaque, JSON-serializable `meta` presentation payload persisted on the `tool/result` event and handed back to `presentResult`), plus optional `presentCall(args)` / `presentResult(args, result)` for tool-owned UI presentation (see below). It also carries an optional cooperative timeout budget `timeoutMs?: number` (ms) enforced by `@deepseek-ai/dsh-timeout-policy`, never sent to the model. Registration stores a frozen snapshot with detached JSON parameters and once-bound callback identities. -- `ToolExecutionInput` — the caller-supplied call description: `{ callId, name, arguments, agent?, parent?, signal? }`; `arguments` must be losslessly JSON-serializable, and callers may pass an enclosing execution's opaque token as `parent` but never choose the new execution's own token. +- `ToolExecutionInput` — the caller-supplied call description: `{ callId, name, arguments, agent?, parent?, signal? }`; `callId` and `name` must be strings, `arguments` must be losslessly JSON-serializable, and callers may pass an enclosing execution's opaque token as `parent` but never choose the new execution's own token. - `ToolExecutionToken` — a frozen, property-free identity value assigned by the registry. It supports equality correlation only and exposes no live outer execution state. - `ToolExecution` — the pipeline-owned call: immutable `{ token, callId, name, arguments, agent?, parent? }` identity plus optional operational `signal`, which an around wrapper may add, replace, remove, and restore. A nested call's `parent` is a `ToolExecutionToken`, not an execution object. - `ToolExecutionResult` — losslessly JSON-serializable outcome: `{ callId, content, isError, error?, additionalContext?, meta? }`. The registry validates the complete post-policy value before final observation. On failure with a `HarnessError`, `error: { name, code }` carries the structured failure class alongside the model-facing text (the loop forwards it onto the `tool/result` session event for retry/sandbox plugins and replay). `additionalContext` (a `HookContext`) ferries any `tools/post-execute` context up to the loop, which buffers it and appends it as a `context/message` after all `tool/result`s in the step. `meta` is the tool's opaque presentation payload from a successful `execute` (the object return form); the loop forwards it onto the `tool/result` session event for result-card rendering. diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts index b466875c75..d757f6cffa 100644 --- a/packages/core/tools/src/index.ts +++ b/packages/core/tools/src/index.ts @@ -951,22 +951,33 @@ export class ToolRegistry extends Service { * Caller-owned arguments are validated and detached in one recursive * lossless-JSON traversal; a violation normalizes to an error before policy * or dispatch. - * @param exec - the single-use call input; every top-level field is read once - * and that identity snapshot is protected before policy runs (and reused by - * the normalized error shell if validation fails). - * @returns the final result after every waterfall. Once the required - * `callId` and `name` correlation identity has been captured, later - * accessor, validation, listener, and tool failures resolve as `isError` - * results rather than rejections. A throwing `callId` or `name` accessor - * rejects because no trustworthy result identity exists yet. + * @param exec - the single-use call input; every top-level field is read once. + * `callId` and `name` must each yield a string before that identity snapshot + * is protected and policy begins. + * @returns the final result after every waterfall. Once the required string + * `callId` and `name` correlation identity has been captured, later accessor, + * validation, listener, and tool failures resolve as `isError` results rather + * than rejections. A throwing accessor or non-string value in either identity + * field rejects because no trustworthy result correlation exists yet. */ async execute(exec: ToolExecutionInput): Promise { // callId/name are the minimum correlation identity needed to construct a - // result at all. Every other caller-controlled accessor is read once - // INSIDE the normalization boundary; if one throws, the error shell uses - // the fields captured before it and never rereads the hostile record. + // result at all. Capture each once, then validate the captured scalar before + // anything can treat it as a trustworthy identity. A JavaScript/casted + // caller that supplies another type rejects at this outer boundary: an error + // result carrying the same malformed value would not satisfy the correlation + // contract and might itself fail lossless-JSON materialization. Every other + // caller-controlled accessor is read once INSIDE the normalization boundary; + // if one throws, the error shell uses the fields captured before it and never + // rereads the hostile record. const callId = exec.callId const name = exec.name + if (typeof callId !== 'string') { + throw new TypeError('tool execution callId must be a string') + } + if (typeof name !== 'string') { + throw new TypeError('tool execution name must be a string') + } let agent: Agent | undefined let parent: ToolExecutionToken | undefined let signal: AbortSignal | undefined diff --git a/packages/core/tools/tests/tools.spec.ts b/packages/core/tools/tests/tools.spec.ts index 5bff94c960..1b83a8f633 100644 --- a/packages/core/tools/tests/tools.spec.ts +++ b/packages/core/tools/tests/tools.spec.ts @@ -7,7 +7,7 @@ import ApprovalService, { type ApprovalOutcome, type ApprovalRequest } from '@de import ToolRegistry, { defineTool, schemaSpecToJsonSchema, validateArgs, ToolArgsError, ToolNotFoundError, type DefineToolOptions, type InferArgs, type SchemaSpec, type PreToolDecision, type PostToolDecision, - type ToolDefinition, type ToolExecution, type ToolExecutionResult, type ToolGuard, + type ToolDefinition, type ToolExecution, type ToolExecutionInput, type ToolExecutionResult, type ToolGuard, } from '@deepseek-ai/dsh-tools' async function setup() { @@ -83,6 +83,95 @@ describe('ToolRegistry', () => { expect(result).toEqual({ callId: CallId('c1'), content: [{ type: 'text', text: 'hi' }], isError: false }) }) + it.each([ + { field: 'callId', value: 1n }, + { field: 'callId', value: 123 }, + { field: 'name', value: 1n }, + { field: 'name', value: 123 }, + ] as const)('rejects a non-string $field before final observation', async ({ field, value }) => { + const ctx = await setup() + let observed = 0 + ctx.on('tools/result', () => { observed += 1 }) + const input: Record = { + callId: CallId('valid-call'), + name: 'missing', + arguments: {}, + } + input[field] = value + + await expect(ctx.tools.execute(input as unknown as ToolExecutionInput)) + .rejects.toThrow(`tool execution ${field} must be a string`) + expect(observed).toBe(0) + }) + + it('reads correlation accessors once and normalizes a later hostile accessor', async () => { + const ctx = await setup() + const reads = { callId: 0, name: 0, arguments: 0 } + let observed: { callId: unknown; name: unknown; isError: boolean } | undefined + ctx.on('tools/result', (exec, result) => { + observed = { callId: exec.callId, name: exec.name, isError: result.isError } + }) + const input = Object.defineProperties({}, { + callId: { + enumerable: true, + get: () => { + reads.callId += 1 + if (reads.callId > 1) throw new Error('callId reread') + return CallId('one-read-call') + }, + }, + name: { + enumerable: true, + get: () => { + reads.name += 1 + if (reads.name > 1) throw new Error('name reread') + return 'missing' + }, + }, + arguments: { + enumerable: true, + get: () => { + reads.arguments += 1 + throw new Error('arguments accessor broke') + }, + }, + }) as unknown as ToolExecutionInput + + const result = await ctx.tools.execute(input) + + expect(reads).toEqual({ callId: 1, name: 1, arguments: 1 }) + expect(result).toMatchObject({ callId: CallId('one-read-call'), isError: true }) + expect(result.content[0]).toMatchObject({ text: 'Error: arguments accessor broke' }) + expect(observed).toEqual({ callId: CallId('one-read-call'), name: 'missing', isError: true }) + }) + + it('reads callId once before a hostile name accessor rejects correlation', async () => { + const ctx = await setup() + const reads = { callId: 0, name: 0 } + let observed = 0 + ctx.on('tools/result', () => { observed += 1 }) + const input = Object.defineProperties({ arguments: {} }, { + callId: { + enumerable: true, + get: () => { + reads.callId += 1 + return CallId('hostile-name') + }, + }, + name: { + enumerable: true, + get: () => { + reads.name += 1 + throw new Error('name accessor broke') + }, + }, + }) as unknown as ToolExecutionInput + + await expect(ctx.tools.execute(input)).rejects.toThrow('name accessor broke') + expect(reads).toEqual({ callId: 1, name: 1 }) + expect(observed).toBe(0) + }) + it('threads a tool-attached meta (object return form) onto the result', async () => { const ctx = await setup() ctx.tools.register({ diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md index e9f7beb540..e5b40ccfdc 100644 --- a/packages/subagent/subagent-inprocess/README.md +++ b/packages/subagent/subagent-inprocess/README.md @@ -9,11 +9,11 @@ The shared **in-process subagent run driver**. A library with no provider or imp Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`): 1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It computes child depth = `depthOf(parent) + 1`, rejects `request.maxDepth` overflow with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; -2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, and manual `run.dispose()` all dispose this exact node, preventing publication after it becomes inactive and awaiting the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child (and rejects if publication never happens), while cancellation during creation is recorded and applied when a child exists; +2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, manual `run.dispose()`, and cancellation before readiness all dispose this exact node, preventing publication after it becomes inactive and sharing the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child and rejects when pre-readiness cancellation rolls the transaction back; 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent; 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field). -`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope); `cancel()` records its request even before publication and cancels the child immediately once available. A cancel landing before any `turn/end` still settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`. +`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope). Before readiness, `cancel()` deactivates the unpublished owner so no agent, session, or lifecycle event can escape; after readiness it cancels the live child immediately. Either path records the cancellation, so a cancel landing before any `turn/end` settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`. ### `InProcessRunOptions` diff --git a/packages/subagent/subagent-inprocess/src/index.ts b/packages/subagent/subagent-inprocess/src/index.ts index 518ea6a8b4..511b686c13 100644 --- a/packages/subagent/subagent-inprocess/src/index.ts +++ b/packages/subagent/subagent-inprocess/src/index.ts @@ -110,7 +110,10 @@ async function quiesceFiber(fiber: Fiber): Promise { * before the turn starts). The final `assistant/message` is the result output, * the matching `turn/end.reason` the stop reason. `dispose()` delegates to the * factory's {@link AgentHandle.dispose} (stop loop → await quiescence → remove - * session); `cancel()` cancels the child's in-flight turn. + * session). `cancel()` cancels a published child's in-flight turn; before + * readiness it instead deactivates the unpublished run-owner transaction, so + * `started` rejects, no agent/session lifecycle is published, and `result` + * resolves `aborted`. * * Throws {@link SubagentDepthError} before creating anything when the child's * depth (parent depth + 1) would exceed `request.maxDepth`. @@ -219,9 +222,10 @@ export function startInProcessRun( // Install it after provider ownership succeeds but BEFORE awaiting creation, // so an inactive provider cannot leave an orphaned listener and abort/dispose // during async setup is still recorded and applied the moment a child exists. - // `cancelled` records that a cancel was requested at all, so the pre-turn - // cancel window — where the child clears the queued prompt before any - // `turn/end` is logged — settles as `aborted` (honoring the cancel contract) + // `cancelled` records that a cancel was requested at all. Before readiness, + // cancellation deactivates the unpublished run-owner transaction so the + // factory cannot publish an agent or session. After readiness, it cancels the + // live child. Either path settles as `aborted` (honoring the cancel contract) // rather than falling through to the no-turn `error` mapping. let cancelled = false // An accessor, not an inline read: `cancelled` mutates from closures (the @@ -230,13 +234,6 @@ export function startInProcessRun( const isCancelled = (): boolean => cancelled let child: Agent | undefined let handle: AgentHandle | undefined - let disposeRequested = false - const isDisposeRequested = (): boolean => disposeRequested - const requestCancel = (reason: string): void => { - cancelled = true - child?.cancel(reason) - } - const onAbort = (): void => { requestCancel('subagent cancelled') } // One run-owned Cordis fiber is the common ownership node. Install the // provider effect FIRST: a start racing an already-unloading provider fails @@ -250,11 +247,28 @@ export function startInProcessRun( let ownerFiber: (Fiber & PromiseLike) | undefined let ownerSetupError: unknown let ownerDisposing: Promise | undefined - const disposeOwner = (): Promise => (ownerDisposing ??= ownerFiber === undefined - ? Promise.resolve() - : quiesceFiber(ownerFiber)) - let manualDisposeRequested = false - const isManualDisposeRequested = (): boolean => manualDisposeRequested + const disposeOwner = (): Promise => { + if (ownerDisposing !== undefined) return ownerDisposing + // An already-aborted request is observed before the owner fiber is minted. + // Do not memoize that no-op: the post-plugin cancellation check below must + // still be able to claim and deactivate the real fiber. + if (ownerFiber === undefined) return Promise.resolve() + ownerDisposing = quiesceFiber(ownerFiber) + // Pre-readiness cancellation is synchronous fire-and-forget at the public + // `cancel()` boundary. Observe a teardown rejection here; dispose() still + // awaits the same memoized promise and reports it to an explicit caller. + void ownerDisposing.catch(() => undefined) + return ownerDisposing + } + const requestCancel = (reason: string): void => { + cancelled = true + if (child === undefined) { + if (ownerFiber !== undefined) void disposeOwner() + return + } + child.cancel(reason) + } + const onAbort = (): void => { requestCancel('subagent cancelled') } const unlinkProvider = ctx.effect(() => () => { requestCancel('subagent provider disposed') return disposeOwner() @@ -265,6 +279,10 @@ export function startInProcessRun( ownerFiber = parent.ctx.plugin(Object.assign(subagentRunOwner, { inject: ['agents', 'sessions', 'llm', 'tools', 'systemPrompt'], })) + // `signal.aborted` is checked before this fiber exists. Once it does, make + // that recorded cancellation effective immediately; awaiting creation must + // observe an inactive owner instead of reaching the publication boundary. + if (isCancelled()) void disposeOwner() } catch (error: unknown) { ownerSetupError = error } @@ -299,8 +317,6 @@ export function startInProcessRun( }) handle = created child = created.agent - - if (isCancelled()) created.agent.cancel('subagent cancelled') return created.agent })() @@ -322,10 +338,9 @@ export function startInProcessRun( // without manufacturing an unreachable runtime branch. liveChild = child as Agent } catch (error: unknown) { - if (isManualDisposeRequested()) return { output: [], stopReason: 'aborted' } + if (isCancelled()) return { output: [], stopReason: 'aborted' } throw error instanceof Error ? error : new Error('subagent child creation failed with a non-Error value', { cause: error }) } - if (isCancelled() || isDisposeRequested()) return { output: [], stopReason: 'aborted' } liveChild.send(prompt) await liveChild.whenIdle() // Deliberately NO re-prompt when a structured child finishes cleanly @@ -348,8 +363,6 @@ export function startInProcessRun( async dispose(): Promise { return (disposing ??= (async () => { signal?.removeEventListener('abort', onAbort) - disposeRequested = true - manualDisposeRequested = true requestCancel('subagent disposed during creation') // Removing provider ownership and disposing the common run-owner fiber // are the same quiescence transaction; parent disposal may already have diff --git a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts index f8e18ed572..cb394d8d95 100644 --- a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts +++ b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts @@ -269,6 +269,38 @@ describe('startInProcessRun', () => { await expect(run.result).resolves.toEqual({ output: [], stopReason: 'aborted' }) }) + it('observes detached pre-readiness teardown failure and reports it to explicit dispose', async () => { + const { ctx, parent } = await setup([]) + function inertOwner(): void {} + const ownerFiber = ctx.plugin(inertOwner) + await ownerFiber + const disposeFailure = new Error('owner dispose exploded') + const disposeSpy = vi.spyOn(ownerFiber, 'dispose').mockImplementation(() => { throw disposeFailure }) + const rejectingOwnerCtx = { + agents: { create: () => Promise.reject(new Error('creation stopped by cancellation')) }, + } as unknown as Context + const parentWithFailingTeardown = { + options: parent.options, + session: parent.session, + ctx: { + plugin(plugin: (inner: Context) => void) { + plugin(rejectingOwnerCtx) + return ownerFiber + }, + }, + } as unknown as Agent + const run = startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'must never start' }], + parent: parentWithFailingTeardown, + }, {}) + + run.cancel('cancel before readiness') + await expect(run.result).resolves.toEqual({ output: [], stopReason: 'aborted' }) + await expect(run.dispose()).rejects.toBe(disposeFailure) + disposeSpy.mockRestore() + await ownerFiber.dispose() + }) + it('does not attach an abort listener when provider ownership is already inactive', async () => { const { ctx, parent } = await setup([]) let providerCtx: Context | undefined diff --git a/packages/subagent/subagent-spawn/README.md b/packages/subagent/subagent-spawn/README.md index e411d44ab0..07c237b303 100644 --- a/packages/subagent/subagent-spawn/README.md +++ b/packages/subagent/subagent-spawn/README.md @@ -6,7 +6,7 @@ The run mechanics live in the shared [`@deepseek-ai/dsh-subagent-inprocess`](../ ## What it does -`start(request)` delegates to `startInProcessRun(ctx, request, {})` with no seed: a fresh child agent with the parent's `cwd`/`parentSession` lineage and (by default) the parent's model. The driver creates one run-owner fiber under `parent.ctx`; parent teardown, this provider's teardown, and manual disposal all converge there before child publication. Its `run.started` boundary resolves only after the fresh child is published, so `subagent/start` observers see a live registry entry. See the [driver README](../subagent-inprocess/README.md) for the full lifecycle (depth check, one-shot drive, result read, dispose). +`start(request)` delegates to `startInProcessRun(ctx, request, {})` with no seed: a fresh child agent with the parent's `cwd`/`parentSession` lineage and (by default) the parent's model. The driver creates one run-owner fiber under `parent.ctx`; parent teardown, this provider's teardown, manual disposal, and cancellation before readiness all converge there before child publication. Its `run.started` boundary resolves only after the fresh child is published, so `subagent/start` observers see a live registry entry; a same-tick cancel deactivates the unpublished transaction instead, rejects readiness, resolves the result as `aborted`, and emits no agent/session or subagent lifecycle. See the [driver README](../subagent-inprocess/README.md) for the full lifecycle (depth check, one-shot drive, result read, dispose). ## Capabilities diff --git a/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts b/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts index 3d23fca285..f00eddeb25 100644 --- a/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts +++ b/packages/subagent/subagent-spawn/tests/subagent-spawn.spec.ts @@ -163,20 +163,31 @@ describe('dsh-subagent-spawn', () => { await run.dispose() }) - it('cancelling BEFORE the child turn starts settles aborted, not error', async () => { - // Regression: a cancel landing in the pre-turn window clears the queued - // prompt before any `turn/end` is logged. Deriving the stop reason from - // `turn/end` alone then mis-maps the no-turn case to `error`; the run must - // honor the cancel contract and settle `aborted`. The cancel is synchronous - // (same tick as start, before the loop's queued-wait continuation runs), so - // the turn is dropped and the empty script is never consumed. + it('same-tick cancellation rejects readiness and prevents child publication', async () => { + // Regression: cancellation before readiness used to set a flag but let the + // async factory publish a child anyway, so `started` fulfilled and lifecycle + // observers saw an agent for an attempt the caller had already cancelled. + // The empty script also proves no model turn can run. const { ctx, parent } = await setup([]) + const beforeAgents = ctx.agents.list().length + const beforeSessions = ctx.sessions.list().length + const published: string[] = [] + ctx.on('session/created', () => void published.push('session/created')) + ctx.on('agent/created', () => void published.push('agent/created')) + ctx.on('agent/session-start', () => void published.push('agent/session-start')) + ctx.on('subagent/start', () => void published.push('subagent/start')) + ctx.on('subagent/end', () => void published.push('subagent/end')) const run = ctx.subagents.start('spawn', { prompt: [{ type: 'text', text: 'p' }], parent }) run.cancel('early') - const result = await run.result - expect(result.stopReason).toBe('aborted') - expect(result.output).toEqual([]) + + await expect(run.started).rejects.toThrow() + await expect(run.result).resolves.toEqual({ output: [], stopReason: 'aborted' }) await run.dispose() + await Promise.resolve() + expect(ctx.agents.get(run.id)).toBeUndefined() + expect(ctx.agents.list()).toHaveLength(beforeAgents) + expect(ctx.sessions.list()).toHaveLength(beforeSessions) + expect(published).toEqual([]) }) it('a cancel from agent/queued maps a no-turn child log to aborted', async () => { diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md index b068cfe79d..7e63f07376 100644 --- a/packages/subagent/subagent/README.md +++ b/packages/subagent/subagent/README.md @@ -18,23 +18,23 @@ Unlike the bash seam (one executor per context, second load throws), **multiple | Member | Semantics | |---|---| -| `registerProvider(provider)` | Register a frozen acceptance snapshot under `provider.name`; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. | +| `registerProvider(provider)` | Read and validate the name, capability object and four boolean flags, `inheritsParentContext`, and `start` callback exactly once, then register a frozen acceptance snapshot under the accepted name. Malformed fixed fields fail loud before registration; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. | | `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). | | `list()` | Registered provider names (insertion order). | -| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Return a frozen service-owned run wrapper whose provider fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | +| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Acquire and memoize the provider run's disposer before reading the rest of its handle, then return a frozen service-owned wrapper whose fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. Malformed handle access/binding starts rollback before the synchronous fault escapes; malformed terminal data rejects only after rollback reaches quiescence. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | ## Capabilities: two kinds, discovered two ways - **Start-time features** (`outputSchema`, `depthLimit`, `toolFilter/persona`) are a static `provider.capabilities` descriptor, checked by the service BEFORE a run exists. A request that needs one the provider lacks is **rejected loud** (`UNSUPPORTED_CAPABILITY`), never accepted-then-ignored. - **Runtime features** (steering, resume) are **optional methods** on `SubagentRun` (`sendMessage?`, `resume?`). The method's presence IS the capability; TS narrowing is the discovery mechanism — a consumer cannot call an absent method without narrowing first, so there is no silent degradation path. -Beside `capabilities` sits one DESCRIPTIVE fact, not validated by the service: `provider.inheritsParentContext` — whether a child sees the parent conversation (`fork`: true — seeded with the completed-turn prefix; `spawn`/`acp`: false). The model-facing consumer (`dsh-tool-subagent`) derives truthful tool wording from it. +Beside `capabilities` sits one DESCRIPTIVE fact: `provider.inheritsParentContext` — whether a child sees the parent conversation (`fork`: true — seeded with the completed-turn prefix; `spawn`/`acp`: false). The service validates that the descriptor is a boolean but does not interpret or enforce its meaning; the model-facing consumer (`dsh-tool-subagent`) derives truthful tool wording from it. ## Run lifecycle `provider.start(request)` returns a provider-owned `SubagentRun`; `SubagentService.start` captures that handle once and returns a frozen service-owned wrapper with `started` (the publication/readiness promise), a normalized `result` (the terminal outcome), bound `cancel()` and `dispose()`, and bound optional runtime methods. `started` resolves only after the provider has established a real child and rejects if the attempt fails or is cancelled first. `result` resolves with one detached, deeply frozen `SubagentResult` (`output`, optional `structured`, `stopReason`) that the service and caller share — it does **not** reject on a child-level failure (a model/transport failure resolves with `stopReason: 'error'`), but malformed provider data rejects as an infrastructure contract fault. The consumer maps a non-`completed` reason to an `isError` tool result and MUST `dispose()` on every path (success, error, abort) to reach child quiescence and avoid leaking an idle child / session. -The service also announces provider lifecycle: `subagent/provider-added` (the frozen registry snapshot) fires after a registration and `subagent/provider-removed` (the accepted name) after an unregistration, so a consumer deriving state from a named provider (the model-facing tool wording) mirrors registry membership instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier" does not mean "registered earlier". Run lifecycle is gated by provider readiness: the service captures the provider handle's public fields once, `subagent/start` (payload `SubagentRunInfo`) fires only after the accepted `started` promise fulfills, and `subagent/end` (payload `SubagentRunEndInfo`) uses the same accepted id and normalized result; readiness rejection emits neither. For spawn/fork, the start listener can resolve the published child via `ctx.agents.get(info.id)`; a remote provider need not have a local registry entry. Both events are **observe-only** plain emits whose service-owned payloads are deeply frozen before per-listener dispatch. The service observes the normalized `result` immediately even while readiness is pending and buffers that end payload until start has fired; a malformed provider result rejects the returned result promise and becomes contained `error` telemetry, a rejection cannot become an unhandled detached promise, start always precedes end, and one listener cannot corrupt either the caller or later listeners. `subagent/end` carries the same frozen output as `lastAssistantMessage` on a valid settle path and omits it on infrastructure or result-contract failure. Any run-affecting decision is out of scope for this observe-only surface. +The service also announces provider lifecycle: `subagent/provider-added` (the frozen registry snapshot) fires after a registration and `subagent/provider-removed` (the accepted name) after an unregistration, so a consumer deriving state from a named provider (the model-facing tool wording) mirrors registry membership instead of assuming load order — the cordis Loader starts sibling plugins concurrently, so "listed earlier" does not mean "registered earlier". Run lifecycle is gated by provider readiness: the service captures the provider handle's public fields once, `subagent/start` (payload `SubagentRunInfo`) fires only after the accepted `started` promise fulfills, and `subagent/end` (payload `SubagentRunEndInfo`) uses the same accepted id and normalized result; readiness rejection emits neither. For spawn/fork, the start listener can resolve the published child via `ctx.agents.get(info.id)`; a remote provider need not have a local registry entry. Both events are **observe-only** plain emits whose service-owned payloads are deeply frozen before per-listener dispatch. A synchronous listener throw or returned-promise rejection is logged per listener; later listeners still run synchronously, and async listeners remain concurrent fire-and-forget. The service observes the normalized `result` immediately even while readiness is pending and buffers that end payload until start has fired; a malformed provider result rejects the returned result promise and becomes contained `error` telemetry, a rejection cannot become an unhandled detached promise, start always precedes end, and one listener cannot corrupt either the caller or later listeners. `subagent/end` carries the same frozen output as `lastAssistantMessage` on a valid settle path and omits it on infrastructure or result-contract failure. Any run-affecting decision is out of scope for this observe-only surface. ## Scope (first cut) diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts index de376686fd..b319a7f31d 100644 --- a/packages/subagent/subagent/src/index.ts +++ b/packages/subagent/subagent/src/index.ts @@ -169,9 +169,11 @@ export class SubagentService extends Service { * Register a provider under its `provider.name`. Throws {@link SubagentError} * (`DUPLICATE_PROVIDER`) if the name is already taken. The registry snapshots * the name, static descriptors, and `start` callback identity at acceptance; - * later caller mutation cannot change lookup, capability validation, consumer - * wording, dispatch, or HMR cleanup. The callback remains bound to the - * original provider object, so provider-owned mutable state stays live. + * every fixed field and capability flag is read once and validated before + * registration, so malformed provider objects fail loud without entering the + * registry. Later caller mutation cannot change lookup, capability validation, + * consumer wording, dispatch, or HMR cleanup. The callback remains bound to + * the original provider object, so provider-owned mutable state stays live. * Effect-scoped: disposed with the calling fiber (HMR-safe). Emits * `subagent/provider-added` after the registration and * `subagent/provider-removed` on unregistration, so consumers can mirror @@ -187,18 +189,49 @@ export class SubagentService extends Service { // mutate or reuse the provider object before its old fiber unloads. Binding // preserves the provider method's receiver while making replacement of the // public callback field after registration inert. - const inputCapabilities = provider.capabilities + const name: unknown = provider.name + const inputCapabilities: unknown = provider.capabilities + const inheritsParentContext: unknown = provider.inheritsParentContext + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputStart: unknown = provider.start + if (typeof name !== 'string') { + throw new TypeError('subagent provider name must be a string') + } + if (inputCapabilities === null || typeof inputCapabilities !== 'object' || Array.isArray(inputCapabilities)) { + throw new TypeError(`subagent provider "${name}" capabilities must be an object`) + } + const inputCapabilityFields = inputCapabilities as Record + const outputSchema = inputCapabilityFields.outputSchema + const depthLimit = inputCapabilityFields.depthLimit + const toolFilter = inputCapabilityFields.toolFilter + const persona = inputCapabilityFields.persona + for (const [capability, value] of [ + ['outputSchema', outputSchema], + ['depthLimit', depthLimit], + ['toolFilter', toolFilter], + ['persona', persona], + ] as const) { + if (typeof value !== 'boolean') { + throw new TypeError(`subagent provider "${name}" capability "${capability}" must be a boolean`) + } + } + if (typeof inheritsParentContext !== 'boolean') { + throw new TypeError(`subagent provider "${name}" inheritsParentContext must be a boolean`) + } + if (typeof inputStart !== 'function') { + throw new TypeError(`subagent provider "${name}" start must be a function`) + } const capabilities: SubagentCapabilities = Object.freeze({ - outputSchema: inputCapabilities.outputSchema, - depthLimit: inputCapabilities.depthLimit, - toolFilter: inputCapabilities.toolFilter, - persona: inputCapabilities.persona, + outputSchema: outputSchema as boolean, + depthLimit: depthLimit as boolean, + toolFilter: toolFilter as boolean, + persona: persona as boolean, }) const snapshot: SubagentProvider = Object.freeze({ - name: provider.name, + name, capabilities, - inheritsParentContext: provider.inheritsParentContext, - start: provider.start.bind(provider), + inheritsParentContext, + start: Function.prototype.bind.call(inputStart, provider) as SubagentProvider['start'], }) const dispose = this.ctx.effect(function* (this: SubagentService) { if (this.providers.has(snapshot.name)) { @@ -255,7 +288,10 @@ export class SubagentService extends Service { * {@link SubagentProvider.start}. The returned handle is a service-owned, * frozen wrapper: provider fields are captured once, methods stay bound to the * provider handle, and `result` resolves to one detached, deeply frozen value - * shared by the caller and lifecycle telemetry. Emits `subagent/start` / + * shared by the caller and lifecycle telemetry. Once a provider returns a + * callable disposer, malformed handle access/binding starts rollback before + * the synchronous fault escapes; malformed terminal data rejects only after + * that same memoized disposal reaches quiescence. Emits `subagent/start` / * `subagent/end` only after the run's readiness boundary fulfills. A provider * that fails before establishing a child emits neither event. * @param name - the provider to run on. @@ -324,82 +360,176 @@ export class SubagentService extends Service { ...toolFilter !== undefined ? { toolFilter } : {}, ...input.persona !== undefined ? { persona: input.persona } : {}, } - const providerRun = provider.start(accepted) + const providerRun: unknown = provider.start(accepted) + if (providerRun === null || (typeof providerRun !== 'object' && typeof providerRun !== 'function')) { + throw new TypeError(`subagent provider "${name}" start must return a SubagentRun object`) + } + const acceptedRun = providerRun as SubagentRun + // Acquire the one rollback capability BEFORE touching any other provider-run + // field. Once start() returned a handle, the service owns an accepted live + // attempt; a hostile later accessor or bind must not make that attempt + // unreachable. The wrapper also memoizes provider disposal, so automatic + // rollback and a racing caller join one quiescence transaction even if a + // contract-violating provider forgot to make its own method idempotent. + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputDispose = acceptedRun.dispose + if (typeof inputDispose !== 'function') { + throw new TypeError(`subagent provider "${name}" run dispose must be a function`) + } + let disposal: Promise | undefined + const dispose = (): Promise => { + if (disposal === undefined) { + try { + // Invoke through the captured callable without reading its public + // `bind`/`length`/`name` properties. Disposal is the recovery + // capability itself; hostile function metadata must not prevent the + // seam from exercising it when a later handle field is malformed. + disposal = Promise.resolve(Reflect.apply(inputDispose, acceptedRun, [])) + } catch (error: unknown) { + disposal = Promise.reject(error instanceof Error + ? error + : new Error('subagent provider run dispose threw a non-Error value', { cause: error })) + } + } + return disposal + } // Provider-owned run objects can be accessor-backed too. Capture every // public field exactly once, bind methods to the provider's original handle, // and expose only this service-owned wrapper. The normalized result promise // is also the one lifecycle telemetry observes, so the caller and observers // cannot receive different values from stateful accessors. - const id = providerRun.id - const started = providerRun.started - const providerResult = providerRun.result - const cancel = providerRun.cancel.bind(providerRun) - const sendMessage = providerRun.sendMessage?.bind(providerRun) - const dispose = providerRun.dispose.bind(providerRun) - const resume = providerRun.resume?.bind(providerRun) - const result = providerResult.then(value => this.snapshotRunResult(value)) - const run: SubagentRun = Object.freeze({ - id, - started, - result, - cancel, - dispose, - ...sendMessage === undefined - ? {} - : { sendMessage }, - ...resume === undefined - ? {} - : { resume }, - }) - - // Observe result settlement IMMEDIATELY, before waiting on readiness. A - // provider may fail both promises in the same turn; deferring the rejection - // handler until `started` fulfilled would leave `result` transiently - // unhandled. The settled event is buffered until start has been announced, - // preserving start → end order even for an already-settled scripted run. - let readiness: 'pending' | 'started' | 'failed' = 'pending' - let pendingEnd: SubagentRunEndInfo | undefined - const deliverEnd = (info: SubagentRunEndInfo): void => { - if (readiness === 'started') this.emitLifecycle('subagent/end', info, parent) - else if (readiness === 'pending') pendingEnd = info - // A pre-publication readiness failure has no lifecycle pair; result - // remains observable by the run's consumer, but telemetry must not claim - // that a child started. - } - void result.then( - (value) => { - deliverEnd({ - provider: name, - id, - stopReason: value.stopReason, - lastAssistantMessage: value.output, - }) - }, - () => { deliverEnd({ provider: name, id, stopReason: 'error' }) }, - ) - - // Readiness is the publication boundary owned by the provider. For - // in-process runs, fulfillment means the agent registry already contains - // `run.id`; for ACP it means the remote session exists. Emit start with - // per-listener containment, then flush an outcome that settled unusually - // early. A readiness rejection is handled here and deliberately emits no - // false start/end pair; the result path above remains independently handled. - void started.then( - () => { - readiness = 'started' - this.emitLifecycle('subagent/start', { provider: name, id }, parent) - if (pendingEnd !== undefined) { - const info = pendingEnd - pendingEnd = undefined - this.emitLifecycle('subagent/end', info, parent) + try { + const id = acceptedRun.id + if (typeof id !== 'string') { + throw new TypeError(`subagent provider "${name}" run id must be a string`) + } + const started = acceptedRun.started + if (!(started instanceof Promise)) { + throw new TypeError(`subagent provider "${name}" run started must be a Promise`) + } + // Observe each accepted provider promise before reading the next hostile + // field. A later accessor/validation failure prevents a wrapper from being + // returned, but must not leave an already-rejected provider promise + // unhandled while rollback proceeds. + void started.catch(() => undefined) + const providerResult = acceptedRun.result + if (!(providerResult instanceof Promise)) { + throw new TypeError(`subagent provider "${name}" run result must be a Promise`) + } + void providerResult.catch(() => undefined) + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputCancel = acceptedRun.cancel + if (typeof inputCancel !== 'function') { + throw new TypeError(`subagent provider "${name}" run cancel must be a function`) + } + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputSendMessage = acceptedRun.sendMessage + if (inputSendMessage !== undefined && typeof inputSendMessage !== 'function') { + throw new TypeError(`subagent provider "${name}" run sendMessage must be a function when provided`) + } + // eslint-disable-next-line @typescript-eslint/unbound-method + const inputResume = acceptedRun.resume + if (inputResume !== undefined && typeof inputResume !== 'function') { + throw new TypeError(`subagent provider "${name}" run resume must be a function when provided`) + } + const cancel = Function.prototype.bind.call(inputCancel, acceptedRun) as SubagentRun['cancel'] + const sendMessage = inputSendMessage === undefined + ? undefined + : Function.prototype.bind.call(inputSendMessage, acceptedRun) as NonNullable + const resume = inputResume === undefined + ? undefined + : Function.prototype.bind.call(inputResume, acceptedRun) as NonNullable + const result = providerResult.then(async (value) => { + try { + return this.snapshotRunResult(value) + } catch (error: unknown) { + // A malformed terminal value is an infrastructure contract fault. The + // result rejects only after the accepted provider attempt has reached + // quiescence, so a caller cannot lose the only cleanup handle by merely + // observing the normalization failure. + await this.rollbackProviderRun(name, dispose) + throw error } - }, - () => { - readiness = 'failed' - pendingEnd = undefined - }, - ) - return run + }) + const run: SubagentRun = Object.freeze({ + id, + started, + result, + cancel, + dispose, + ...sendMessage === undefined + ? {} + : { sendMessage }, + ...resume === undefined + ? {} + : { resume }, + }) + + // Observe result settlement IMMEDIATELY, before waiting on readiness. A + // provider may fail both promises in the same turn; deferring the rejection + // handler until `started` fulfilled would leave `result` transiently + // unhandled. The settled event is buffered until start has been announced, + // preserving start → end order even for an already-settled scripted run. + let readiness: 'pending' | 'started' | 'failed' = 'pending' + let pendingEnd: SubagentRunEndInfo | undefined + const deliverEnd = (info: SubagentRunEndInfo): void => { + if (readiness === 'started') this.emitLifecycle('subagent/end', info, parent) + else if (readiness === 'pending') pendingEnd = info + // A pre-publication readiness failure has no lifecycle pair; result + // remains observable by the run's consumer, but telemetry must not claim + // that a child started. + } + void result.then( + (value) => { + deliverEnd({ + provider: name, + id, + stopReason: value.stopReason, + lastAssistantMessage: value.output, + }) + }, + () => { deliverEnd({ provider: name, id, stopReason: 'error' }) }, + ) + + // Readiness is the publication boundary owned by the provider. For + // in-process runs, fulfillment means the agent registry already contains + // `run.id`; for ACP it means the remote session exists. Emit start with + // per-listener containment, then flush an outcome that settled unusually + // early. A readiness rejection is handled here and deliberately emits no + // false start/end pair; the result path above remains independently handled. + void started.then( + () => { + readiness = 'started' + this.emitLifecycle('subagent/start', { provider: name, id }, parent) + if (pendingEnd !== undefined) { + const info = pendingEnd + pendingEnd = undefined + this.emitLifecycle('subagent/end', info, parent) + } + }, + () => { + readiness = 'failed' + pendingEnd = undefined + }, + ) + return run + } catch (error: unknown) { + // start() has already transferred a live attempt to the seam. Begin + // rollback synchronously before surfacing the malformed-handle failure; + // the contained cleanup promise prevents either a resource leak or an + // unhandled rejection even though this API cannot synchronously await it. + void this.rollbackProviderRun(name, dispose) + throw error + } + } + + /** Dispose one malformed provider attempt without letting cleanup mask the contract fault. */ + private async rollbackProviderRun(providerName: string, dispose: () => Promise): Promise { + try { + await dispose() + } catch (error: unknown) { + this.ctx.logger.warn(`subagent provider "${providerName}" malformed run rollback failed: ${renderThrown(error)}`) + } } /** Normalize one provider result into the immutable seam value. */ @@ -452,10 +582,12 @@ export class SubagentService extends Service { /** * Emit a `subagent/*` lifecycle event with PER-LISTENER containment: dispatch - * each subscriber individually and log (never propagate) a thrown one, so one - * bad subscriber can neither strand the already-live run, surface as an - * unhandled rejection on the detached settle hook, NOR starve the listeners - * registered after it. A single try/catch around `ctx.emit` would not do the + * each subscriber individually and log (never propagate) either a synchronous + * throw or a returned-promise rejection, so one bad subscriber can neither + * strand the already-live run, surface as an unhandled rejection on the + * detached settle hook, NOR starve the listeners registered after it. Async + * listeners remain concurrent fire-and-forget; dispatch does not await or + * serialize them. A single try/catch around `ctx.emit` would not do the * last part — cordis `emit` runs listeners in a `.map(cb => cb())` that halts * on the first throw — so this resolves the listener callbacks via * `ctx.events.dispatch` and contains each call, the same guarantee @@ -488,7 +620,14 @@ export class SubagentService extends Service { : [scopeTarget(this, parent), name, acceptedInfo] for (const callback of this.ctx.events.dispatch('emit', dispatchArgs)) { try { - callback(acceptedInfo) + const returned: unknown = callback(acceptedInfo) + // Plain emits remain fire-and-forget and every callback is still invoked + // synchronously in this loop. Observe a returned promise independently so + // an async listener rejection is contained without serializing listeners + // or delaying provider/run lifecycle. + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`subagent: ${name} listener rejected: ${renderThrown(error)}`) + }) } catch (error: unknown) { this.ctx.logger.warn(`subagent: ${name} listener threw: ${renderThrown(error)}`) } diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts index ba4b58c2fc..d1a531ca09 100644 --- a/packages/subagent/subagent/tests/service.spec.ts +++ b/packages/subagent/subagent/tests/service.spec.ts @@ -150,6 +150,93 @@ describe('SubagentService', () => { } }) + it.each([ + { label: 'a non-string name', patch: { name: 42 }, message: 'name must be a string' }, + { label: 'null capabilities', patch: { capabilities: null }, message: 'capabilities must be an object' }, + { label: 'primitive capabilities', patch: { capabilities: 42 }, message: 'capabilities must be an object' }, + { label: 'array capabilities', patch: { capabilities: [] }, message: 'capabilities must be an object' }, + { + label: 'a non-boolean outputSchema capability', + patch: { capabilities: { ...NO_CAPS, outputSchema: 'yes' } }, + message: 'capability "outputSchema" must be a boolean', + }, + { + label: 'a non-boolean depthLimit capability', + patch: { capabilities: { ...NO_CAPS, depthLimit: 'yes' } }, + message: 'capability "depthLimit" must be a boolean', + }, + { + label: 'a non-boolean toolFilter capability', + patch: { capabilities: { ...NO_CAPS, toolFilter: 'yes' } }, + message: 'capability "toolFilter" must be a boolean', + }, + { + label: 'a non-boolean persona capability', + patch: { capabilities: { ...NO_CAPS, persona: 'yes' } }, + message: 'capability "persona" must be a boolean', + }, + { label: 'a non-boolean context descriptor', patch: { inheritsParentContext: 'yes' }, message: 'inheritsParentContext must be a boolean' }, + { label: 'a non-callable start field', patch: { start: 42 }, message: 'start must be a function' }, + ])('rejects a provider registration with $label before entering the registry', async ({ patch, message }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const provider = Object.assign(new StubProvider('invalid'), patch) + + expect(() => ctx.subagents.registerProvider(provider as unknown as SubagentProvider)).toThrow(message) + expect(ctx.subagents.list()).toEqual([]) + expect(Object.isFrozen(provider)).toBe(false) + }) + + it('reads every registration field once and binds the accepted start callback to the provider', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const reads = { + name: 0, + capabilities: 0, + outputSchema: 0, + depthLimit: 0, + toolFilter: 0, + persona: 0, + inheritsParentContext: 0, + start: 0, + } + const capabilities = Object.defineProperties({}, { + outputSchema: { enumerable: true, get: () => { reads.outputSchema += 1; return false } }, + depthLimit: { enumerable: true, get: () => { reads.depthLimit += 1; return false } }, + toolFilter: { enumerable: true, get: () => { reads.toolFilter += 1; return false } }, + persona: { enumerable: true, get: () => { reads.persona += 1; return false } }, + }) as SubagentCapabilities + const acceptedStart = function (this: SubagentProvider, request: SubagentStartRequest): SubagentRun { + expect(this).toBe(provider) + return { + id: AgentId(`one-read:${request.parent.id}`), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel() {}, + async dispose() {}, + } + } + const provider = Object.defineProperties({}, { + name: { enumerable: true, get: () => { reads.name += 1; return 'one-read' } }, + capabilities: { enumerable: true, get: () => { reads.capabilities += 1; return capabilities } }, + inheritsParentContext: { enumerable: true, get: () => { reads.inheritsParentContext += 1; return false } }, + start: { enumerable: true, get: () => { reads.start += 1; return acceptedStart } }, + }) as SubagentProvider + + ctx.subagents.registerProvider(provider) + await expect(ctx.subagents.start('one-read', baseRequest()).result).resolves.toMatchObject({ stopReason: 'completed' }) + expect(reads).toEqual({ + name: 1, + capabilities: 1, + outputSchema: 1, + depthLimit: 1, + toolFilter: 1, + persona: 1, + inheritsParentContext: 1, + start: 1, + }) + }) + it('unregisters a provider when its owning fiber is disposed (HMR safety)', async () => { const ctx = new Context() await ctx.plugin(SubagentService) @@ -608,6 +695,178 @@ describe('SubagentService', () => { }) }) + it.each([ + { label: 'a non-string id', field: 'id', value: 42, message: 'run id must be a string' }, + { label: 'a non-Promise started field', field: 'started', value: undefined, message: 'run started must be a Promise' }, + { label: 'a non-Promise result field', field: 'result', value: undefined, message: 'run result must be a Promise' }, + { label: 'a non-callable cancel field', field: 'cancel', value: undefined, message: 'run cancel must be a function' }, + { label: 'a non-callable sendMessage field', field: 'sendMessage', value: 42, message: 'run sendMessage must be a function' }, + { label: 'a non-callable resume field', field: 'resume', value: 42, message: 'run resume must be a function' }, + ])('rolls back a provider run with $label', async ({ field, value, message }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const providerDispose = vi.fn(async () => {}) + const providerRun = { + id: AgentId('invalid-handle-child'), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' } satisfies SubagentResult), + cancel() {}, + dispose: providerDispose, + [field]: value, + } as unknown as SubagentRun + ctx.subagents.registerProvider({ + name: 'invalid-handle', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => providerRun, + }) + + expect(() => ctx.subagents.start('invalid-handle', baseRequest())).toThrow(message) + expect(providerDispose).toHaveBeenCalledOnce() + }) + + it.each([ + { label: 'null', value: null }, + { label: 'a primitive', value: 42 }, + ])('rejects $label returned by provider.start before reading a disposer', async ({ value }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + ctx.subagents.registerProvider({ + name: 'invalid-run-shell', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => value as unknown as SubagentRun, + }) + + expect(() => ctx.subagents.start('invalid-run-shell', baseRequest())).toThrow('must return a SubagentRun object') + }) + + it('rejects a run without a callable disposer before accepting ownership', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + ctx.subagents.registerProvider({ + name: 'invalid-dispose', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ dispose: 42 }) as unknown as SubagentRun, + }) + + expect(() => ctx.subagents.start('invalid-dispose', baseRequest())).toThrow('run dispose must be a function') + }) + + it('observes accepted provider promises when a later handle field is malformed', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const providerDispose = vi.fn(async () => {}) + ctx.subagents.registerProvider({ + name: 'rejected-malformed-handle', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('rejected-malformed-child'), + started: Promise.reject(new Error('readiness already rejected')), + result: Promise.reject(new Error('result already rejected')), + cancel: 42, + dispose: providerDispose, + }) as unknown as SubagentRun, + }) + + expect(() => ctx.subagents.start('rejected-malformed-handle', baseRequest())).toThrow('run cancel must be a function') + expect(providerDispose).toHaveBeenCalledOnce() + // Let both provider rejections run: the seam's immediate observers keep + // them from surfacing as unhandled after no wrapper was returned. + await Promise.resolve() + }) + + it('starts rollback before surfacing a hostile run accessor failure', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const disposalGate = Promise.withResolvers() + const order: string[] = [] + const providerRun = Object.defineProperties({}, { + dispose: { + get: () => { + order.push('dispose:get') + return async function (this: SubagentRun): Promise { + expect(this).toBe(providerRun) + order.push('dispose:call') + await disposalGate.promise + order.push('dispose:quiescent') + } + }, + }, + id: { get: () => { order.push('id:get'); return AgentId('hostile-handle-child') } }, + started: { get: () => { order.push('started:get'); return Promise.resolve() } }, + result: { get: () => { order.push('result:get'); throw new Error('result accessor exploded') } }, + }) as SubagentRun + ctx.subagents.registerProvider({ + name: 'hostile-handle', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => providerRun, + }) + + expect(() => ctx.subagents.start('hostile-handle', baseRequest())).toThrow('result accessor exploded') + expect(order).toEqual(['dispose:get', 'id:get', 'started:get', 'result:get', 'dispose:call']) + disposalGate.resolve(undefined) + await vi.waitFor(() => { expect(order).toContain('dispose:quiescent') }) + }) + + it('rolls back when binding a hostile optional run method fails', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const providerDispose = vi.fn(async () => {}) + const hostileCancel = new Proxy(() => {}, { + get(_target, property) { + if (property === 'length') throw new Error('cancel bind exploded') + return undefined + }, + }) + ctx.subagents.registerProvider({ + name: 'hostile-bind', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('hostile-bind-child'), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel: hostileCancel, + dispose: providerDispose, + }), + }) + + expect(() => ctx.subagents.start('hostile-bind', baseRequest())).toThrow('cancel bind exploded') + expect(providerDispose).toHaveBeenCalledOnce() + }) + + it.each([ + { label: 'an Error', thrown: new Error('cleanup exploded'), warning: 'cleanup exploded' }, + { label: 'a non-Error value', thrown: 'naked cleanup fault', warning: 'dispose threw a non-Error value' }, + ])('contains rollback failure from $label while preserving the malformed-handle fault', async ({ thrown, warning }) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + ctx.subagents.registerProvider({ + name: 'rollback-failure', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: 42, + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel() {}, + dispose: () => { + // Deliberately violate the seam contract to exercise normalization. + throw thrown + }, + }) as unknown as SubagentRun, + }) + + expect(() => ctx.subagents.start('rollback-failure', baseRequest())).toThrow('run id must be a string') + await vi.waitFor(() => { expect(warnings.some(message => message.includes(warning))).toBe(true) }) + }) + it('waits for provider readiness and observes an early result rejection without reordering lifecycle', async () => { const ctx = new Context() await ctx.plugin(SubagentService) @@ -811,6 +1070,8 @@ describe('SubagentService', () => { const ctx = new Context() await ctx.plugin(SubagentService) const nonJsonOutput = [{ type: 'text', text: 'x', evil: () => 0 }] as unknown as SubagentResult['output'] + const disposalGate = Promise.withResolvers() + const providerDispose = vi.fn(async () => { await disposalGate.promise }) ctx.subagents.registerProvider({ name: 'unclone', capabilities: NO_CAPS, @@ -820,16 +1081,23 @@ describe('SubagentService', () => { started: Promise.resolve(), result: Promise.resolve({ output: nonJsonOutput, stopReason: 'completed' } as SubagentResult), cancel() {}, - dispose: async () => {}, + dispose: providerDispose, }), }) const ended = vi.fn() ctx.on('subagent/end', ended) const run = ctx.subagents.start('unclone', baseRequest()) + let resultSettled = false + void run.result.catch(() => { resultSettled = true }) + await vi.waitFor(() => { expect(providerDispose).toHaveBeenCalledOnce() }) + expect(resultSettled).toBe(false) + disposalGate.resolve(undefined) await expect(run.result).rejects.toThrow('subagent result must be losslessly JSON-serializable') + await run.dispose() await Promise.resolve() + expect(providerDispose).toHaveBeenCalledOnce() const endInfo = ended.mock.calls[0]![0] as Record expect(endInfo.stopReason).toBe('error') expect('lastAssistantMessage' in endInfo).toBe(false) @@ -922,6 +1190,42 @@ describe('SubagentService', () => { await expect(run.result).resolves.toMatchObject({ stopReason: 'completed' }) }) + it('contains asynchronous lifecycle-listener rejections without serializing later listeners', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const laterStart = vi.fn() + const laterEnd = vi.fn() + const laterRemoved = vi.fn() + const asyncStart = (async () => { await Promise.resolve(); throw new Error('async start listener') }) as unknown as () => void + const asyncEnd = (async () => { await Promise.resolve(); throw new Error('async end listener') }) as unknown as () => void + const asyncRemoved = (async () => { await Promise.resolve(); throw new Error('async removed listener') }) as unknown as () => void + ctx.on('subagent/start', asyncStart) + ctx.on('subagent/start', laterStart) + ctx.on('subagent/end', asyncEnd) + ctx.on('subagent/end', laterEnd) + ctx.on('subagent/provider-removed', asyncRemoved) + ctx.on('subagent/provider-removed', laterRemoved) + const unregister = ctx.subagents.registerProvider(new StubProvider('async-listeners')) + + const run = ctx.subagents.start('async-listeners', baseRequest()) + await run.started + expect(laterStart).toHaveBeenCalledOnce() + await run.result + await vi.waitFor(() => { + expect(laterEnd).toHaveBeenCalledOnce() + expect(warnings.some(message => message.includes('async start listener'))).toBe(true) + expect(warnings.some(message => message.includes('async end listener'))).toBe(true) + }) + + await unregister() + expect(laterRemoved).toHaveBeenCalledWith('async-listeners') + await vi.waitFor(() => { + expect(warnings.some(message => message.includes('async removed listener'))).toBe(true) + }) + }) + it('contains a listener whose thrown value cannot be stringified', async () => { const ctx = new Context() await ctx.plugin(SubagentService) diff --git a/packages/support/invariants/src/index.ts b/packages/support/invariants/src/index.ts index 153d97a45c..8d8f52f3d7 100644 --- a/packages/support/invariants/src/index.ts +++ b/packages/support/invariants/src/index.ts @@ -367,6 +367,7 @@ export function apply(ctx: Context): void { 'tools/result': args => (args[0] as ToolExecution).agent, 'system-prompt/assemble': args => (args[1] as AssembleContext).scope, 'session/created': null, + 'session/disposed': null, 'session/event': null, 'session/flush': null, 'subagent/start': null, diff --git a/packages/ui/acp/src/index.ts b/packages/ui/acp/src/index.ts index a3ce9b5117..35ff870080 100644 --- a/packages/ui/acp/src/index.ts +++ b/packages/ui/acp/src/index.ts @@ -1010,7 +1010,7 @@ export function apply(ctx: Context, config: AcpConfig): void { * quiescence"): for each session settle any pending prompt `cancelled`, then * run that session's {@link AgentHandle} `dispose()` — which stops the loop * (sets `disposed`, aborts the in-flight step), AWAITS the loop's exit (the - * final `turn/end` + `session/flush` are captured while `onAppend` is still + * final `turn/end` + `session/flush` are captured while the store-owned append observer is still * attached), unregisters the agent, and removes its session from the store. * The per-session disposes run in parallel. Idempotent — clears the `sessions` * map first and memoizes, so a second call (close racing dispose) is a no-op. diff --git a/packages/ui/acp/tests/dispose.spec.ts b/packages/ui/acp/tests/dispose.spec.ts index 037d00f17e..9dbd72aa35 100644 --- a/packages/ui/acp/tests/dispose.spec.ts +++ b/packages/ui/acp/tests/dispose.spec.ts @@ -159,8 +159,8 @@ describe('acp bridge — disposal & HMR safety', () => { it('the final turn closing events are persisted across an AgentHandle dispose (durability)', async () => { // The teardown-ORDER guarantee: a per-agent dispose must stop the loop, // AWAIT its exit (so the loop's final `turn/end` + `session/flush` fire - // through the still-attached `session.onAppend` → `session/event`), and only - // THEN detach onAppend + remove the session. If the order were inverted + // through the still-attached store observer → `session/event`), and only + // THEN detach that observer + remove the session. If the order were inverted // (detach first), the closing events would never reach persistence. Drive a // CLEAN turn to completion, dispose JUST the bridge, then re-load the // persisted log from disk and assert the closing turn/end is on disk — the @@ -190,7 +190,7 @@ describe('acp bridge — disposal & HMR safety', () => { // produced BY the dispose itself. Here the model stream HANGS, so the turn is // still open when teardown runs: the composite agent effect stops the loop, // the loop unwinds and appends `turn/end {disposed}` + runs its final - // `session/flush` — all while `onAppend` is still attached (the session + // `session/flush` — all while the store-owned append observer is still attached (the session // detach is the LAST disposer in the same effect's LIFO chain) — and only // THEN is the session detached. If the order were inverted (or the session // were a racing SIBLING effect), the abort-produced `turn/end` would never @@ -255,7 +255,7 @@ describe('acp bridge — disposal & HMR safety', () => { // into ONE composite effect whose disposers run as a `.then()` chain. The // register disposer emits `agent/disposed`; if a listener throws and the // emit is UNCONTAINED, the rejected chain skips the LATER session-detach - // disposer — stranding the session in the store with `onAppend` attached (a + // disposer — stranding the session in the store with its append observer attached (a // leak AND a durability hole, since the new design relies on detach // running). The emit must be contained. Register a throwing listener, drive // a clean turn, dispose, and assert the session was STILL removed. diff --git a/packages/ui/user-approval/README.md b/packages/ui/user-approval/README.md index 821e98638f..1c573cdf3f 100644 --- a/packages/ui/user-approval/README.md +++ b/packages/ui/user-approval/README.md @@ -2,11 +2,11 @@ User-approval seam. Owns the `ctx.approval` service ([`ApprovalService`](src/index.ts)) and the one-shot permission vocabulary the harness shares: `ApprovalRequest` (agent + tool identity + reason + abort signal), the closed `ApprovalOutcome` union (`allowed-once` / `rejected` / `cancelled` / `unavailable`), the `ApprovalRequestId` brand pairing the two log-only audit events (`approval/asked` / `approval/decided`), and the `approval/request` waterfall the answerers listen on. It lives in the UI group because its purpose is human permission, while remaining channel-neutral: it depends only on Cordis and core vocabulary packages, never on a concrete UI. -The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and always resolves to an outcome, never rejects: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service shallow-freezes a detached request record before dispatch, preserving the exact `agent` and `AbortSignal` identities while making later caller mutation unable to redirect scope, payload, cancellation, or either audit event. Session observers run after an event enters the append-only log; if one throws, the service recognizes that the audit is already authoritative, contains the observer failure, and completes the pair. The one precondition: ask from inside an open turn — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask throws before appending anything. +The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its decision phase always resolves to an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service reads the request fields and `agent.session` binding once, requires object agent/session identities, a string `toolName`, optional string `callId`/`reason`, and an AbortSignal-shaped live capability, then shallow-freezes a detached request record while preserving the exact `agent` and signal identities. A malformed request rejects before any audit append; later caller mutation cannot redirect scope, payload, cancellation, policy lookup, or either audit event. The other precondition is an open turn on the captured session — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask also rejects before appending. Session observers run after an event enters the append-only log; if one throws, the service recognizes that the audit is already authoritative, contains the observer failure, and completes the pair. The service is the mechanism, answerers are the policy. Answerers are `approval/request` waterfall listeners occupying a single decision slot: answer for an agent you own by returning an outcome without calling `next()`, or delegate an agent you don't recognize by calling `next()` — the chain's built-in default is `unavailable`, so a deployment with no answerer (headless, CI) fails closed with zero configuration. Dispatch is keyed by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. Registration order across sibling plugins is not load-order deterministic; compose one terminal answerer per deployment and use `prepend` listeners only for decide-or-delegate gates. -The seam also owns the per-session POLICY tier ([the sandbox RFC § Per-session mode switching](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)): `ApprovalPolicy` is `'ask'` (delegate to the answerers) or `'never'` (deterministically reject without prompting anyone; the strict CI/unattended stance), with `effective = fold(the session's 'approval/policy' events, last one wins) ?? Config.policy` — the session log is the store, written only through `setApprovalPolicy(session, policy)`. The service decides `'never'` inside `request()` itself, before dispatching the waterfall (`'never'` → `'rejected'` with the audit pair still landing; no listener registration, including a later `prepend`, can precede it), states `'never'` — and only `'never'` in prose — in a per-agent prompt section, records either value with a source-owned header marker, and narrates a policy switch to the model in at most one coalesced `agent/pre-step` notice. The restart fallback reads the marker rather than deployment-controlled persona prose; attribution is positional (an override event after the last `request/header*` reads `changed by the user`, otherwise `changed by the operator/config`). +The seam also owns the per-session POLICY tier ([the sandbox RFC § Per-session mode switching](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)): `ApprovalPolicy` is `'ask'` (delegate to the answerers) or `'never'` (deterministically reject without prompting anyone; the strict CI/unattended stance), with `effective = fold(the session's 'approval/policy' events, last one wins) ?? Config.policy` — the session log is the store, written only through `setApprovalPolicy(session, policy)`, which rejects any value outside that closed vocabulary before appending. The service decides `'never'` inside `request()` itself, before dispatching the waterfall (`'never'` → `'rejected'` with the audit pair still landing; no listener registration, including a later `prepend`, can precede it), states `'never'` — and only `'never'` in prose — in a per-agent prompt section, records either value with a source-owned header marker, and narrates a policy switch to the model in at most one coalesced `agent/pre-step` notice. The restart fallback reads the marker rather than deployment-controlled persona prose; attribution is positional (an override event after the last `request/header*` reads `changed by the user`, otherwise `changed by the operator/config`). One seam serves both ask paths of [the sandbox RFC](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md): the `tools/pre-execute` `ask` decision (routed by [`@deepseek-ai/dsh-tools`](../../core/tools/) when this service is mounted; degrading to deny when it is not), and the sandbox post-denial escalated retry (the bash tool's `sandbox_permissions` gate in [`@deepseek-ai/dsh-tool-bash`](../../bash/tool-bash/) — [the sandbox RFC § Escalation](../../../docs/rfc/implemented/feature/2026-07-06-sandbox.md)). The full design: [the approval-seam RFC](../../../docs/rfc/implemented/feature/2026-07-06-approval-seam.md). diff --git a/packages/ui/user-approval/src/index.ts b/packages/ui/user-approval/src/index.ts index 4fb50ba23b..93ccd973c7 100644 --- a/packages/ui/user-approval/src/index.ts +++ b/packages/ui/user-approval/src/index.ts @@ -223,12 +223,16 @@ function hasOpenTurn(events: readonly SessionEvent[]): boolean { * THE write path for a session's approval-policy override: appends exactly * one `approval/policy` event — the switch IS its event; nothing mutates * policy state out of band. Takes effect on the session's next ask and next - * prompt assembly (the consumers fold on every read). + * prompt assembly (the consumers fold on every read). Rejects a value outside + * {@link APPROVAL_POLICIES} before appending anything. * @param session - the session the override belongs to. * @param policy - the policy every subsequent ask for this session resolves * under (until the next switch). */ export function setApprovalPolicy(session: Session, policy: ApprovalPolicy): void { + if (!APPROVAL_POLICIES.includes(policy)) { + throw new TypeError('approval policy must be one of "ask" or "never"') + } session.append('approval/policy', { policy }) } @@ -238,8 +242,10 @@ export function setApprovalPolicy(session: Session, policy: ApprovalPolicy): voi * was asked — it deliberately does NOT carry tool arguments: a UI answerer * attaches the prompt to the already-streamed tool call via `callId` instead * of re-rendering the call. `request()` synchronously copies and shallow-freezes - * this record before crossing an asynchronous boundary. Scalar fields are - * detached; the `agent` and `signal` identity capabilities are preserved. + * this record before crossing an asynchronous boundary. It reads each field + * and the agent's session binding once, validates the public fixed-field + * contract before audit, and detaches the scalar values; the `agent` and live + * `signal` identity capabilities are preserved rather than cloned or frozen. */ export interface ApprovalRequest { /** @@ -264,6 +270,13 @@ export interface ApprovalRequest { signal?: AbortSignal } +/** Live signal capability accepted at the synchronous request boundary. */ +interface AcceptedSignal { + signal: AbortSignal + addEventListener: AbortSignal['addEventListener'] + removeEventListener: AbortSignal['removeEventListener'] +} + /** Plugin config. All optional — `static Config` supplies the defaults. */ export interface Config { /** @@ -297,7 +310,7 @@ export class ApprovalService extends Service { constructor(ctx: Context, public config: Config) { super(ctx, 'approval') - const effective = (agent: Agent): ApprovalPolicy => this.effectivePolicy(agent) + const effective = (agent: Agent): ApprovalPolicy => this.effectivePolicy(agent.session) // Visibility layer 1, scoped on the prompt registry so headless // compositions mount the seam without it: state the one deterministic @@ -345,7 +358,7 @@ export class ApprovalService extends Service { } // Same fold effectivePolicy performs — override is scanned here anyway // for POSITIONAL attribution; the default lives once, in the method. - const current = this.effectivePolicy(agent) + const current = this.effectivePolicy(session) const header = session.requestHeader() const told = narrated.get(session) ?? toldApprovalPolicy(header?.system) narrated.set(session, current) @@ -361,17 +374,21 @@ export class ApprovalService extends Service { } /** - * Ask the composed answerers to decide one request. Requires an open turn - * on the requesting agent's session — the audit pair below is turn-enclosed - * by contract (the turn is the log's commit/replay boundary; an idle append - * would be dropped as crash tail on reload) — and throws before appending - * anything when called idle; asking outside a turn is a deferred design. - * Within that precondition it always resolves to an outcome, never rejects: - * an aborted signal yields `'cancelled'`, a missing or throwing answerer - * yields `'unavailable'` (fail closed), and a rogue non-vocabulary return - * value is normalized to `'unavailable'`. The caller-owned request is - * synchronously snapshotted, so later mutation cannot split routing, - * dispatch payload, cancellation, or the audit pair across agents/sessions. + * Ask the composed answerers to decide one request. Synchronously reads each + * request field and the agent's session binding once, validates the fixed + * agent/session, string, and live-signal contracts, and rejects before any + * audit append when malformed. The signal remains the caller's exact live + * identity capability; it is neither cloned nor frozen. Requires an open + * turn on the accepted session — the audit pair below is turn-enclosed by + * contract (the turn is the log's commit/replay boundary; an idle append + * would be dropped as crash tail on reload) — and likewise throws before + * appending anything when called idle; asking outside a turn is a deferred + * design. Once accepted it always resolves to an outcome, never rejects: an + * aborted signal yields `'cancelled'`, a missing or throwing answerer yields + * `'unavailable'` (fail closed), and a rogue non-vocabulary return value is + * normalized to `'unavailable'`. The caller-owned request is synchronously + * snapshotted, so later mutation cannot split routing, dispatch payload, + * cancellation, policy lookup, or the audit pair across agents/sessions. * Appends the * `approval/asked`/`approval/decided` audit pair (log-only) around the * decision regardless of outcome. A synchronous session observer failure @@ -385,20 +402,73 @@ export class ApprovalService extends Service { // Accept one immutable request shape before the first async boundary. The // caller retains its record and may mutate it as soon as this async method // returns; identity capabilities stay live, but the record is never reread. - const agent = req.agent - const toolName = req.toolName - const callId = req.callId - const reason = req.reason - const signal = req.signal + const input: unknown = req + if (typeof input !== 'object' || input === null) { + throw new TypeError('approval.request() requires a request object') + } + const source = input as Record + const agentInput = source['agent'] + const toolName = source['toolName'] + const callId = source['callId'] + const reason = source['reason'] + const signalInput = source['signal'] + if (typeof agentInput !== 'object' || agentInput === null) { + throw new TypeError('approval request agent must be an object') + } + if (typeof toolName !== 'string') { + throw new TypeError('approval request toolName must be a string') + } + if (callId !== undefined && typeof callId !== 'string') { + throw new TypeError('approval request callId must be a string when provided') + } + if (reason !== undefined && typeof reason !== 'string') { + throw new TypeError('approval request reason must be a string when provided') + } + let acceptedSignal: AcceptedSignal | undefined + if (signalInput !== undefined) { + if (typeof signalInput !== 'object' || signalInput === null) { + throw new TypeError('approval request signal must be an AbortSignal when provided') + } + const signalRecord = signalInput as unknown as Record + const aborted = signalRecord['aborted'] + const addEventListener = signalRecord['addEventListener'] + const removeEventListener = signalRecord['removeEventListener'] + if (typeof aborted !== 'boolean' + || typeof addEventListener !== 'function' + || typeof removeEventListener !== 'function') { + throw new TypeError('approval request signal must be an AbortSignal when provided') + } + acceptedSignal = { + signal: signalInput as AbortSignal, + addEventListener: addEventListener as AbortSignal['addEventListener'], + removeEventListener: removeEventListener as AbortSignal['removeEventListener'], + } + } + const sessionInput = (agentInput as unknown as Record)['session'] + if (typeof sessionInput !== 'object' || sessionInput === null) { + throw new TypeError('approval request agent session must be an object') + } + const sessionRecord = sessionInput as unknown as Record + const events = sessionRecord['events'] + const append = sessionRecord['append'] + if (!Array.isArray(events)) { + throw new TypeError('approval request session events must be an array') + } + if (typeof append !== 'function') { + throw new TypeError('approval request session append must be a function') + } + const agent = agentInput as Agent + const session = sessionInput as Session + const acceptedCallId = callId as CallId | undefined + const signal = signalInput as AbortSignal | undefined const accepted: Readonly = Object.freeze({ agent, toolName, - ...callId !== undefined ? { callId } : {}, + ...acceptedCallId !== undefined ? { callId: acceptedCallId } : {}, ...reason !== undefined ? { reason } : {}, ...signal !== undefined ? { signal } : {}, }) - const session = accepted.agent.session - if (!hasOpenTurn(session.events)) { + if (!hasOpenTurn(events)) { throw new Error( 'approval.request() outside an open turn: the approval/asked + approval/decided audit pair ' + 'must be turn-enclosed (a bare event between turns is crash-tail garbage on reload). ' @@ -407,16 +477,16 @@ export class ApprovalService extends Service { } const id = ApprovalRequestId(randomUUID()) this.appendAudit(session, 'approval/asked', id, () => { - session.append('approval/asked', { + Reflect.apply(append, session, ['approval/asked', { id, toolName: accepted.toolName, ...accepted.callId !== undefined ? { callId: accepted.callId } : {}, ...accepted.reason !== undefined ? { reason: accepted.reason } : {}, - }) + }]) }) - const outcome = await this.decide(accepted) + const outcome = await this.decide(accepted, session, acceptedSignal) this.appendAudit(session, 'approval/decided', id, () => { - session.append('approval/decided', { id, outcome }) + Reflect.apply(append, session, ['approval/decided', { id, outcome }]) }) return outcome } @@ -451,22 +521,30 @@ export class ApprovalService extends Service { * The session's effective policy: its own `approval/policy` fold, else the * configured default (the schema already defaulted an omitted policy to * `'ask'`; the `??` only narrows the optional-input TYPE). - * @param agent - the agent whose session's policy applies. - * @returns the policy every ask for this agent resolves under right now. + * @param session - the exact accepted session whose policy applies. + * @returns the policy every ask for this session resolves under right now. */ - private effectivePolicy(agent: Agent): ApprovalPolicy { - return effectiveApprovalPolicy(agent.session.events) ?? this.config.policy ?? 'ask' + private effectivePolicy(session: Session): ApprovalPolicy { + return effectiveApprovalPolicy(session.events) ?? this.config.policy ?? 'ask' } - /** Dispatch the waterfall, contained and raced against the accepted signal. */ - private async decide(req: Readonly): Promise { - if (req.signal?.aborted) return 'cancelled' + /** + * Dispatch the waterfall, contained and raced against the accepted signal. + * @param req - the detached public request snapshot. + * @param session - the captured session used for policy lookup. + * @param acceptedSignal - the validated live signal capability, if supplied. + * @returns the normalized closed outcome. + */ + private async decide( + req: Readonly, session: Session, acceptedSignal: AcceptedSignal | undefined, + ): Promise { + if (acceptedSignal?.signal.aborted) return 'cancelled' // The 'never' policy is decided HERE, before any dispatch: a listener // registered with `prepend: true` after this service mounts would sit // ahead of any gate LISTENER, so a listener-shaped gate cannot keep the // documented promise that 'never' rejects deterministically regardless // of registration order — only the service's own request path can. - if (this.effectivePolicy(req.agent) === 'never') return 'rejected' + if (this.effectivePolicy(session) === 'never') return 'rejected' // Enter the promise chain BEFORE dispatching: a listener that throws // SYNCHRONOUSLY (before its first await) must land in the same rejection // path as an async one — `Promise.resolve(call())` would let it escape @@ -484,13 +562,13 @@ export class ApprovalService extends Service { // tool call open — the seam contains its callbacks. () => 'unavailable', ) - const signal = req.signal - if (signal === undefined) return answer + if (acceptedSignal === undefined) return answer + const { signal, addEventListener, removeEventListener } = acceptedSignal return await new Promise((resolve) => { const onAbort = () => { resolve('cancelled') } - signal.addEventListener('abort', onAbort, { once: true }) + addEventListener.call(signal, 'abort', onAbort, { once: true }) void answer.then((outcome) => { - signal.removeEventListener('abort', onAbort) + removeEventListener.call(signal, 'abort', onAbort) // After an abort won the race this resolve is a settled-promise no-op: // the late answer is discarded by construction. resolve(outcome) diff --git a/packages/ui/user-approval/tests/approval.spec.ts b/packages/ui/user-approval/tests/approval.spec.ts index 0e69b8dfd7..831b50111b 100644 --- a/packages/ui/user-approval/tests/approval.spec.ts +++ b/packages/ui/user-approval/tests/approval.spec.ts @@ -39,6 +39,158 @@ function requestOf(agent: Agent, overrides: Partial = {}): Appr } describe('ApprovalService.request', () => { + it('rejects malformed fixed fields and identities before appending or dispatching', async () => { + const ctx = await mounted() + const consulted = vi.fn() + ctx.on('approval/request', () => { + consulted() + return Promise.resolve('allowed-once') + }) + const { agent, appended } = fakeAgent() + const badSessionAppends: Array> = [] + const badSession = (events: unknown, append: unknown): Agent => ({ + session: { events, append }, + }) as unknown as Agent + const appendSpy = (): ReturnType => { + const append = vi.fn() + badSessionAppends.push(append) + return append + } + const validSignalShape = { + aborted: false, + addEventListener: () => {}, + removeEventListener: () => {}, + } + const cases: Array<{ request: unknown; message: string }> = [ + { request: null, message: 'requires a request object' }, + { request: 1, message: 'requires a request object' }, + { request: { agent: null, toolName: 'echo' }, message: 'agent must be an object' }, + { request: { agent: 1, toolName: 'echo' }, message: 'agent must be an object' }, + { request: { agent, toolName: 1 }, message: 'toolName must be a string' }, + { request: { agent, toolName: 'echo', callId: 1 }, message: 'callId must be a string' }, + { request: { agent, toolName: 'echo', reason: 1 }, message: 'reason must be a string' }, + { request: { agent, toolName: 'echo', signal: null }, message: 'signal must be an AbortSignal' }, + { request: { agent, toolName: 'echo', signal: 1 }, message: 'signal must be an AbortSignal' }, + { + request: { agent, toolName: 'echo', signal: { ...validSignalShape, aborted: 'no' } }, + message: 'signal must be an AbortSignal', + }, + { + request: { agent, toolName: 'echo', signal: { ...validSignalShape, addEventListener: 1 } }, + message: 'signal must be an AbortSignal', + }, + { + request: { agent, toolName: 'echo', signal: { ...validSignalShape, removeEventListener: 1 } }, + message: 'signal must be an AbortSignal', + }, + { + request: { agent: { session: null }, toolName: 'echo' }, + message: 'agent session must be an object', + }, + { + request: { agent: { session: 1 }, toolName: 'echo' }, + message: 'agent session must be an object', + }, + { + request: { agent: badSession(null, appendSpy()), toolName: 'echo' }, + message: 'session events must be an array', + }, + { + request: { agent: badSession([{ type: 'turn/start' }], 1), toolName: 'echo' }, + message: 'session append must be a function', + }, + ] + + for (const { request, message } of cases) { + await expect(ctx.approval.request(request as ApprovalRequest)).rejects.toThrow(message) + } + + expect(appended).toEqual([]) + for (const append of badSessionAppends) expect(append).not.toHaveBeenCalled() + expect(consulted).not.toHaveBeenCalled() + }) + + it('reads request fields, the agent session, and the session append method once', async () => { + const ctx = await mounted() + const { agent: acceptedSessionOwner, appended: acceptedAudit } = fakeAgent() + const { agent: replacementAgent, appended: replacementAudit } = fakeAgent() + const acceptedSession = acceptedSessionOwner.session + const acceptedAppend = acceptedSession.append.bind(acceptedSession) + const signal = new AbortController().signal + const reads = { + agent: 0, + toolName: 0, + callId: 0, + reason: 0, + signal: 0, + session: 0, + append: 0, + } + const session = { + events: acceptedSession.events, + get append(): Session['append'] { + reads.append += 1 + return reads.append === 1 ? acceptedAppend : undefined as unknown as Session['append'] + }, + } as Session + const agent = Object.defineProperty({}, 'session', { + enumerable: true, + get: () => { + reads.session += 1 + return reads.session === 1 ? session : replacementAgent.session + }, + }) as Agent + const request = Object.defineProperties({}, { + agent: { + enumerable: true, + get: () => (++reads.agent === 1 ? agent : null), + }, + toolName: { + enumerable: true, + get: () => (++reads.toolName === 1 ? 'stable-tool' : 1), + }, + callId: { + enumerable: true, + get: () => (++reads.callId === 1 ? CallId('stable-call') : {}), + }, + reason: { + enumerable: true, + get: () => (++reads.reason === 1 ? 'stable reason' : {}), + }, + signal: { + enumerable: true, + get: () => (++reads.signal === 1 ? signal : {}), + }, + }) as ApprovalRequest + let received: ApprovalRequest | undefined + ctx.on('approval/request', (accepted) => { + received = accepted + return Promise.resolve('allowed-once') + }) + + await expect(ctx.approval.request(request)).resolves.toBe('allowed-once') + + expect(reads).toEqual({ + agent: 1, + toolName: 1, + callId: 1, + reason: 1, + signal: 1, + session: 1, + append: 1, + }) + expect(received).toMatchObject({ + agent, + toolName: 'stable-tool', + callId: 'stable-call', + reason: 'stable reason', + signal, + }) + expect(Object.isFrozen(received)).toBe(true) + expect(acceptedAudit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided']) + expect(replacementAudit).toEqual([]) + }) + it('throws before appending anything when no turn has ever opened (idle ask)', async () => { const ctx = await mounted() const { agent, appended } = fakeAgent([]) @@ -420,6 +572,15 @@ describe('approval policy (the approval/policy fold)', () => { expect(session.events.at(-1)).toMatchObject({ type: 'approval/policy', data: { policy: 'ask' } }) }) + it('rejects a policy outside the closed vocabulary before appending', () => { + const append = vi.fn() + const session = { append } as unknown as Session + + expect(() => { setApprovalPolicy(session, 'sometimes' as Parameters[1]) }) + .toThrow('approval policy must be one of "ask" or "never"') + expect(append).not.toHaveBeenCalled() + }) + it('defaults a schema-less construction to ask (the ?? narrows the optional TYPE)', async () => { // Direct construction bypasses the plugin schema (the SystemPrompt-test // precedent for covering a defaulted Config field's type-narrowing ??). diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md index d7cd9ed64c..2ea1a78c39 100644 --- a/packages/workflow/workflow-workerthread/README.md +++ b/packages/workflow/workflow-workerthread/README.md @@ -35,7 +35,7 @@ Values LEAVING the script (hook options/schemas, the script's return) are materi ## Cancellation, death, disposal -Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). Each provider-owned cancel callback is exception-contained independently, so a broken child cannot prevent peer cancellation or workflow settlement. The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`. +Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). Each provider-owned cancel callback is exception-contained independently, so a broken child cannot prevent peer cancellation or workflow settlement. The caller's optional start-signal callback is retained by exact identity only while the run is live and removed at the first settlement or teardown, so a long-lived signal cannot retain completed `WorkerRun` instances. The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`. A worker that dies unexpectedly (an OOM, a script reaching `process.exit` through the documented vm escape) settles the run `stopReason: 'error'` with the exit diagnostics — or `'cancelled'` when a cancel was in flight — and the host-side child registry is what winds every surviving child down. `dispose()` = cancel + immediate host-driven disposal of every registered child (a wedged worker can relay no dispose RPC, so child teardown overlaps the grace instead of starting after it; the worker's own dispose RPCs join the same per-child disposal) + bounded wait (result, then child-registry quiescence, capped by the grace) + unconditional `worker.terminate()`: the thread never outlives its run. Before an ordinary run settlement becomes observable, the host cancels every stray child on both channels too—even a fire-and-forget run still waiting on `started`, for which the worker has no handle yet—and `dispose()` then waits for their disposal (bounded by the grace) before returning. `agent-start`/`agent-end` pairing is host-guaranteed the same way: forwarded starts live in a ledger, worker-reported ends pair them on the graceful paths, and the termination paths (grace force-settle, worker death) synthesize the missing ends (outcome `cancelled`) before the run settles — a start still in flight across the force-settle can surface after `workflow/end`, immediately paired the same way. diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index b1d92ac1d0..e1c1a6542f 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -130,6 +130,9 @@ export class WorkerRun implements WorkflowRun { private readonly quiescenceWaiters: (() => void)[] = [] /** The per-run abort fanout every child start request carries. */ private readonly controller = new AbortController() + /** External start signal and the exact callback installed on it, retained only until first settle/teardown. */ + private inputSignal: AbortSignal | undefined + private inputSignalAbort: (() => void) | undefined private disposed: Promise | undefined constructor( @@ -159,8 +162,14 @@ export class WorkerRun implements WorkflowRun { }) if (signal?.aborted) { this.cancel('workflow start signal already aborted') - } else { - signal?.addEventListener('abort', () => { this.cancel('workflow signal aborted') }, { once: true }) + } else if (signal !== undefined) { + const onAbort = (): void => { + this.detachInputSignal() + this.cancel('workflow signal aborted') + } + this.inputSignal = signal + this.inputSignalAbort = onAbort + signal.addEventListener('abort', onAbort, { once: true }) } } @@ -217,6 +226,7 @@ export class WorkerRun implements WorkflowRun { */ dispose(): Promise { this.disposed ??= (async () => { + this.detachInputSignal() this.cancel('workflow disposed') for (const [callId, run] of [...this.children]) void this.disposeChild(callId, run) await Promise.race([ @@ -522,10 +532,21 @@ export class WorkerRun implements WorkflowRun { return { value: null, stopReason: 'cancelled', error: `workflow run cancelled: ${reason}`, agentsStarted } } - /** First settle wins; disarms the grace timer. */ + /** Remove the exact abort callback installed on the caller's start signal. */ + private detachInputSignal(): void { + const signal = this.inputSignal + const onAbort = this.inputSignalAbort + if (signal === undefined || onAbort === undefined) return + this.inputSignal = undefined + this.inputSignalAbort = undefined + signal.removeEventListener('abort', onAbort) + } + + /** First settle wins; disarms the grace timer and releases the caller signal. */ private settleResult(result: WorkflowResult): void { if (this.settled) return this.settled = true + this.detachInputSignal() clearTimeout(this.graceTimer) this.settleResolve(result) } diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 46a42e4036..d5b16a8e2f 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -585,6 +585,41 @@ describe('dsh-workflow-workerthread', () => { await second.dispose() }) + it('removes the exact external abort callback on first settlement or teardown', async () => { + const { ctx, parent } = await setup() + const settledController = new AbortController() + const settledAdd = vi.spyOn(settledController.signal, 'addEventListener') + const settledRemove = vi.spyOn(settledController.signal, 'removeEventListener') + const completed = ctx.workflows.start({ ...scripted('return 123'), parent, signal: settledController.signal }) + const settledAbort = settledAdd.mock.calls.find(([type]) => type === 'abort')?.[1] + expect(typeof settledAbort).toBe('function') + + await expect(completed.result).resolves.toMatchObject({ value: 123, stopReason: 'completed' }) + expect(settledRemove).toHaveBeenCalledWith('abort', settledAbort) + const cancelAfterSettle = vi.spyOn(completed, 'cancel') + settledController.abort() + expect(cancelAfterSettle).not.toHaveBeenCalled() + cancelAfterSettle.mockRestore() + await completed.dispose() + + const manual = await setup({ manual: true }) + const teardownController = new AbortController() + const teardownAdd = vi.spyOn(teardownController.signal, 'addEventListener') + const teardownRemove = vi.spyOn(teardownController.signal, 'removeEventListener') + const tornDown = manual.ctx.workflows.start({ + ...scripted("return await agent('job')"), + parent: manual.parent, + signal: teardownController.signal, + }) + await waitFor(() => { expect(manual.provider.runs).toHaveLength(1) }) + const teardownAbort = teardownAdd.mock.calls.find(([type]) => type === 'abort')?.[1] + expect(typeof teardownAbort).toBe('function') + + const disposing = tornDown.dispose() + expect(teardownRemove).toHaveBeenCalledWith('abort', teardownAbort) + await disposing + }) + it('a child-start racing the host cancel is refused: no child starts after cancellation', async () => { const { ctx, parent, provider } = await setup({ manual: true }) // Cancel from INSIDE the log listener: the worker has already posted diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts index 074cfd83d2..5459755be5 100644 --- a/scripts/gen-doc-graphs.ts +++ b/scripts/gen-doc-graphs.ts @@ -246,6 +246,13 @@ const SERVICE_ROLES: ServiceRole[] = [ ] const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: string }> = [ + // Creation notifications preserve synchronous veto/rollback but observe + // returned promises explicitly so async listener rejection is not unhandled. + { event: 'agent/created', pkg: 'agent', method: 'events.dispatch' }, + { event: 'session/created', pkg: 'session', method: 'events.dispatch' }, + // Session disposal uses direct callback resolution so teardown contains each + // synchronous throw and returned-promise rejection independently. + { event: 'session/disposed', pkg: 'session', method: 'events.dispatch' }, // tools/result uses ctx.events.dispatch directly so the registry can await // every observer while containing each callback independently. { event: 'tools/result', pkg: 'tools', method: 'events.dispatch' }, diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json index 4be54d89f4..e238583e69 100644 --- a/scripts/type-equiv.manifest.json +++ b/scripts/type-equiv.manifest.json @@ -17,6 +17,14 @@ { "doc": "docs/core-data-structures/core.md", "symbol": "ContinuationStop", "source": "packages/core/agent/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "SessionStartSource", "source": "packages/core/agent/src/types.ts" }, + { "doc": "docs/core-data-structures/scope.md", "symbol": "ScopeKey", "source": "packages/core/scope/src/index.ts" }, + { "doc": "docs/core-data-structures/scope.md", "symbol": "Scoped", "source": "packages/core/scope/src/index.ts" }, + { "doc": "docs/core-data-structures/scope.md", "symbol": "Scope", "source": "packages/core/scope/src/index.ts" }, + + { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "AssembleContext", "source": "packages/core/system-prompt/src/index.ts" }, + { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "ToolProviderResult", "source": "packages/core/system-prompt/src/index.ts" }, + { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "PromptProtection", "source": "packages/core/system-prompt/src/index.ts" }, + { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "StreamChunk", "source": "packages/llm/llm/src/types.ts" }, { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "TokenUsage", "source": "packages/llm/llm/src/types.ts" }, { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "ContentBlockMap", "source": "packages/llm/llm/src/types.ts" }, From 197f7237d2eb8889866759e5f48f801ba5d7197f Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 06:19:53 +0800 Subject: [PATCH 03/21] fix(workflow): bootstrap source worker transforms --- docs/development.i18n.yaml | 4 +- docs/development.md | 2 +- docs/development.zh.md | 2 +- .../process/2026-07-06-node-engine-floor.md | 4 +- .../2026-07-06-parallel-github-ci-gates.md | 6 +-- .../workflow/workflow-workerthread/README.md | 2 +- .../workflow-workerthread/src/host.ts | 48 ++++++++++++------- .../tests/source-worker.compat.spec.ts | 38 +++++++++++++++ .../tests/workflow-workerthread.spec.ts | 6 +-- scripts/run-gates.ts | 5 ++ 10 files changed, 85 insertions(+), 32 deletions(-) create mode 100644 packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts diff --git a/docs/development.i18n.yaml b/docs/development.i18n.yaml index c1e557170d..e2dd772eb0 100644 --- a/docs/development.i18n.yaml +++ b/docs/development.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write -development.md: bd6f6b561480419abea7a42a44b4078e2c59b1cb -development.zh.md: 54bf19765d2b4dc419e6b71684dbcfcd28230541 +development.md: ea5f2e5d08acbaf1dfce4661530218dbf1a051b9 +development.zh.md: 50877796f2ff47ad46cc67b35f3cd7b5704c8315 diff --git a/docs/development.md b/docs/development.md index bd6f6b5614..ea5f2e5d08 100644 --- a/docs/development.md +++ b/docs/development.md @@ -67,7 +67,7 @@ These hooks do not exactly mirror CI. Notably, `pre-push` runs unit tests withou ## CI gates -The keyless GitHub workflow has eight jobs: five Node 24 lanes run static gates, lint, coverage, snapshot replay, and artifact gates separately, and three compatibility jobs run `pnpm run check:node-compat` on Node 22.19, 24, and 26. The lane schedulers fan out independent gates from `package.json`: constraints, typecheck, lint, coverage, snapshot replay, `doc-sync` members, module-graph freshness, `knip`, and the echo-agent smoke test. +The keyless GitHub workflow has eight jobs: five Node 24 lanes run static gates, lint, coverage, snapshot replay, and artifact gates separately, and three compatibility jobs run `pnpm run check:node-compat` on Node 22.19, 24, and 26. The compatibility command runs the TypeScript typecheck and a keyless workflow-workerthread source-launch smoke on every runtime, so the matrix proves that the source graph typechecks and that a real unbuilt Worker loader path executes; the other lane schedulers fan out independent gates from `package.json`: constraints, lint, coverage, snapshot replay, `doc-sync` members, module-graph freshness, `knip`, and the echo-agent smoke test. `pnpm run build` feeds the artifact lane, and `publint`, `verify-node-next-types`, and built-bin smoke tests wait for build output. The separate real-API workflow runs `pnpm run test:e2e` with a secret and `DSH_E2E_MAX_WORKERS=14`. diff --git a/docs/development.zh.md b/docs/development.zh.md index 54bf19765d..50877796f2 100644 --- a/docs/development.zh.md +++ b/docs/development.zh.md @@ -67,7 +67,7 @@ vendor manifest 守卫检查 `vendor/*/src` 下的改动是否连同对应的 `v ## CI 门禁 -keyless GitHub 工作流有八个 job：五个 Node 24 lane 分别运行 static gates、lint、coverage、snapshot replay 和 artifact gates，三个兼容性 job 在 Node 22.19、24 和 26 上运行 `pnpm run check:node-compat`。各 lane 调度器并发运行来自 `package.json` 的独立门禁：constraints、typecheck、lint、coverage、snapshot replay、`doc-sync` 成员、module graph 新鲜度、`knip` 和 echo-agent 冒烟测试。 +keyless GitHub 工作流有八个 job：五个 Node 24 lane 分别运行 static gates、lint、coverage、snapshot replay 和 artifact gates，三个兼容性 job 在 Node 22.19、24 和 26 上运行 `pnpm run check:node-compat`。兼容性命令会在每个运行时上运行 TypeScript 类型检查和 keyless 的 workflow-workerthread 源码启动冒烟测试，因此该矩阵既证明源码图能通过类型检查，也会实际执行一条未构建的 Worker loader 路径；其他 lane 调度器并发运行来自 `package.json` 的独立门禁：constraints、lint、coverage、snapshot replay、`doc-sync` 成员、module graph 新鲜度、`knip` 和 echo-agent 冒烟测试。 `pnpm run build` 供给 artifact lane，`publint`、`verify-node-next-types` 和 built-bin 冒烟测试等待 build 输出。单独的真实 API 工作流带密钥运行 `pnpm run test:e2e`，并设置 `DSH_E2E_MAX_WORKERS=14`。 diff --git a/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md b/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md index 72c9f09eda..51328a5a1a 100644 --- a/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md +++ b/docs/rfc/implemented/process/2026-07-06-node-engine-floor.md @@ -8,7 +8,7 @@ The Node 22 branch of the root `engines.node` range is a contract for the instal ## Decision -Set `engines.node` to `^22.19.0 || >=24.0.0` and test the keyless CI compatibility matrix on `['22.19', 24, 26]`. The real-API e2e workflow stays on Node 24 because it exercises API integration rather than the runtime floor. +Set `engines.node` to `^22.19.0 || >=24.0.0` and test the keyless CI compatibility matrix on `['22.19', 24, 26]`. Every matrix leg runs the TypeScript typecheck plus a keyless source-mode worker smoke, so the floor is exercised through both a complete source typecheck and a real unbuilt runtime path. The real-API e2e workflow stays on Node 24 because it exercises API integration rather than the runtime floor. Two Node features gate the source runtime: @@ -22,7 +22,7 @@ Those source features clear on the 22.x line at **22.18**, but the installed Pi ## Consequences - The advertised LTS branch no longer undercuts the Pi adapter dependency floor. -- CI proves the Node 22 LTS floor directly with Node 22.19, keeps the Node 24 branch on `node: 24`, and keeps Node 26 for the next even line. +- CI proves the Node 22 LTS floor directly with Node 22.19, keeps the Node 24 branch on `node: 24`, and keeps Node 26 for the next even line; each leg typechecks the source graph and launches the unbuilt workflow worker for real. - The built-bin smoke needs no version-conditional flag: at 22.19 type-stripping is already the default, so the test stays the plain `node lib/bin.js` path it documents. - A future dependency or source API that raises the runtime floor must move `engines.node`, the compatibility matrix, and this RFC in the same change. diff --git a/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md b/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md index d63a8ad713..061d534b9b 100644 --- a/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md +++ b/docs/rfc/implemented/process/2026-07-06-parallel-github-ci-gates.md @@ -10,9 +10,9 @@ The hard part is the artifact boundary. `publint`, `verify-node-next-types`, and ## Decision -[CI](../../../../.github/workflows/ci.yml) keeps the keyless workflow to a few broad jobs instead of one job per gate. The Node 24 matrix has five lanes: static gates (`pnpm run check:ci:static`), lint (`pnpm run check:ci:lint`), coverage (`pnpm run check:ci:coverage`), snapshot replay (`pnpm run check:ci:snapshot`), and artifact gates (`pnpm run check:ci:artifacts`). The Node 26 compatibility job installs once and runs `pnpm run check:node-compat`. +[CI](../../../../.github/workflows/ci.yml) keeps the keyless workflow to a few broad jobs instead of one job per gate. The Node 24 matrix has five lanes: static gates (`pnpm run check:ci:static`), lint (`pnpm run check:ci:lint`), coverage (`pnpm run check:ci:coverage`), snapshot replay (`pnpm run check:ci:snapshot`), and artifact gates (`pnpm run check:ci:artifacts`). The compatibility matrix has Node 22.19, 24, and 26 jobs; each installs once and runs `pnpm run check:node-compat`. -Each lane delegates to [scripts/run-gates.ts](../../../../scripts/run-gates.ts), an in-process scheduler with bounded concurrency (`DSH_GATE_CONCURRENCY`). The static lane fans out constraints, the echo-agent demo smoke, `doc-sync` leaf gates, module-graph freshness, and `knip`; the lint lane runs ESLint with its own Node heap cap and a content-strategy ESLint cache; the coverage lane runs Vitest coverage with bounded file workers (`DSH_COVERAGE_MAX_WORKERS`); the snapshot lane isolates replay; the artifact lane builds once and then fans out the artifact consumers; the Node 26 compatibility job owns the TypeScript typecheck. The scheduler buffers each gate's output and prints a named result block with duration, so independent failures stay attributable inside each broad job log. +Each lane delegates to [scripts/run-gates.ts](../../../../scripts/run-gates.ts), an in-process scheduler with bounded concurrency (`DSH_GATE_CONCURRENCY`). The static lane fans out constraints, the echo-agent demo smoke, `doc-sync` leaf gates, module-graph freshness, and `knip`; the lint lane runs ESLint with its own Node heap cap and a content-strategy ESLint cache; the coverage lane runs Vitest coverage with bounded file workers (`DSH_COVERAGE_MAX_WORKERS`); the snapshot lane isolates replay; the artifact lane builds once and then fans out the artifact consumers. Every compatibility job runs the TypeScript typecheck and a keyless workflow-workerthread source-launch smoke, which starts a real unbuilt worker and therefore catches Node-version-specific loader/runtime failures that typechecking cannot. The scheduler buffers each gate's output and prints a named result block with duration, so independent failures stay attributable inside each broad job log. Generated `.sessions/` logs and `.doc-typecheck-*` temp directories are ignored by lint. The aggregate local CI mode still runs demo smoke after lint, while the split GitHub static lane can run demo smoke directly because lint is isolated in its own lane. @@ -36,4 +36,4 @@ The broad-lane split repeats checkout, setup, and install more often than a sing The split introduces a maintenance obligation: when `package.json` adds or removes a gate that belongs in CI, [scripts/run-gates.ts](../../../../scripts/run-gates.ts) needs the matching leaf. That obligation is intentional because the runner is the parallel execution plan for the same gate vocabulary, not a separate quality policy. -The Node 26 signal is narrower than the primary Node 24 signal. It proves the source graph on the newer runtime without doubling documentation, coverage, publication, snapshot, and smoke checks whose failures are not expected to vary by Node minor version. +The compatibility signal is narrower than the primary Node 24 signal. It proves that the source graph typechecks and that the real unbuilt workflow-worker launch path executes on every advertised runtime line without doubling documentation, coverage, publication, snapshot replay, and unrelated smoke checks whose failures are not expected to vary by Node version. diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md index 2ea1a78c39..0aba0eb680 100644 --- a/packages/workflow/workflow-workerthread/README.md +++ b/packages/workflow/workflow-workerthread/README.md @@ -21,7 +21,7 @@ What the seam guarantees regardless, because benign scripts hit these constantly ## How a run executes -`start()` shape-validates the meta DATA host-side and parse-checks the body with the identical wrapper the worker compiles (`new vm.Script`, discarded), preserving the seam's synchronous `META_INVALID`/`SCRIPT_PARSE` throws; one redundant parse per run is the deliberate price. It then spawns the worker (`src/worker.ts` unbuilt via an explicit tsx `execArgv`; the sibling `lib/worker.js` bundle when built) with the meta, body, `args`, and worker-side limits as `workerData`. +`start()` shape-validates the meta DATA host-side and parse-checks the body with the identical wrapper the worker compiles (`new vm.Script`, discarded), preserving the seam's synchronous `META_INVALID`/`SCRIPT_PARSE` throws; one redundant parse per run is the deliberate price. It then spawns the worker (unbuilt: a JavaScript data-URL bootstrap registers tsx's ESM and CommonJS transforms inside the worker before importing `src/worker.ts`, giving the whole mixed-module source graph full TypeScript and tsconfig-path transformation on every supported Node line; built: the sibling `lib/worker.js` bundle) with the meta, body, `args`, and worker-side limits as `workerData`. Inside the worker, `runWorkerSession` builds the execution core (hooks, combinators, concurrency semaphore, caps, fatal-error discipline) over a **child port**. `agent()` sends `child-start`, and the host starts the child on `ctx.subagents` with parent attribution, the shared per-run abort signal, and `outputSchema`/`model` pass-through. diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index e1c1a6542f..56c0e455f8 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -41,7 +41,6 @@ * @module @deepseek-ai/dsh-workflow-workerthread/host */ -import { fileURLToPath } from 'node:url' import { Worker } from 'node:worker_threads' import type { WorkerOptions } from 'node:worker_threads' import type { Context } from 'cordis' @@ -59,13 +58,16 @@ import type { ChildResult, ChildStartRequest, WorkerInit } from './types.ts' /** * Resolve the worker entry and spawn options for the current runtime shape. * Unbuilt (tsx demos, vitest — `import.meta.url` points into `src/`), the - * entry is the TypeScript sibling and the worker needs the tsx loader - * registered explicitly: a worker thread inherits no transform pipeline from - * vitest (vite transforms in-process, not via a node loader), and passing - * execArgv explicitly also shields the worker from any loader flags the - * parent was started with. Built (`lib/index.js`), the entry is the sibling - * bundle the package tsdown config emits and no loader is needed (execArgv - * pinned empty — hermetic, like the environment). + * entry is a JavaScript data-URL bootstrap. That bootstrap runs INSIDE the + * user worker, registers tsx's ESM AND CommonJS transforms there, and only + * then imports the TypeScript sibling. The whole mixed-module source graph + * therefore receives TypeScript transformation and the tsconfig paths map in + * the worker's own module-loader realm. A worker inherits no + * transform pipeline from vitest (vite transforms in-process), and a parent + * `--import tsx` registration is not a contract that user workers share on + * every supported Node line. Built (`lib/index.js`), the entry is the sibling + * bundle the package tsdown config emits and no loader is needed (`execArgv` + * pinned empty in both shapes — hermetic, like the environment). * * Both shapes spawn with an EMPTY environment (`env: {}`): the documented vm * escape reaches `process`, and the harness's ambient credentials @@ -85,19 +87,31 @@ function resolveWorkerSpawn(init: WorkerInit): { entry: URL; options: WorkerOpti if (!import.meta.url.endsWith('.ts')) { return { entry: new URL('./worker.js', import.meta.url), options: { workerData: init, env: {}, execArgv: [] } } } - // Lazy tsx resolution: only the unbuilt shape needs it, so the built - // bundle never requires tsx to be installed. TSX_TSCONFIG_PATH is the one - // variable forwarded through the scrub: tsx finds a tsconfig by searching - // UP from the worker's cwd, and a parent running with its cwd outside the - // repo (the ACP snapshot harness pins the tsconfig through this exact - // variable) would otherwise lose the dsh-* paths map and resolve workspace - // imports to unbuilt lib/ bundles. Loader plumbing, not a secret. + // Resolve tsx lazily: only the unbuilt shape executes this arm, so a built + // consumer never needs the dev-only loader installed. A JavaScript entry is + // essential — it can install tsx's ESM and CommonJS hooks from INSIDE the + // user worker before any TypeScript enters Node's native strip-only parser. + // Both hooks are load-bearing because the source graph crosses both module + // shapes on supported Node lines. TSX_TSCONFIG_PATH is + // the one variable forwarded through the scrub: a parent running outside + // the repo cwd (the ACP snapshot harness is the real case) pins the paths + // map through it. Loader plumbing, not a secret. + const workerEntry = new URL('./worker.ts', import.meta.url) + const tsxEsmApiEntry = import.meta.resolve('tsx/esm/api') + const tsxCjsApiEntry = import.meta.resolve('tsx/cjs/api') + const bootstrap = [ + `import { register as registerEsm } from ${JSON.stringify(tsxEsmApiEntry)}`, + `import { register as registerCjs } from ${JSON.stringify(tsxCjsApiEntry)}`, + 'registerCjs()', + 'registerEsm()', + `await import(${JSON.stringify(workerEntry.href)})`, + ].join('\n') return { - entry: new URL('./worker.ts', import.meta.url), + entry: new URL(`data:text/javascript,${encodeURIComponent(bootstrap)}`), options: { workerData: init, env: process.env.TSX_TSCONFIG_PATH === undefined ? {} : { TSX_TSCONFIG_PATH: process.env.TSX_TSCONFIG_PATH }, - execArgv: ['--import', fileURLToPath(import.meta.resolve('tsx'))], + execArgv: [], }, } } diff --git a/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts b/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts new file mode 100644 index 0000000000..7f34396d52 --- /dev/null +++ b/packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts @@ -0,0 +1,38 @@ +/** + * Keyless runtime smoke for the source-mode workflow worker. The Node + * compatibility matrix runs this WHOLE file, so renaming or removing its test + * cannot turn the runtime proof into a successful zero-match filter. + */ + +import { expect, it, vi } from 'vitest' +import { Context } from 'cordis' +import { AgentId } from '@deepseek-ai/dsh-agent' +import type { Agent } from '@deepseek-ai/dsh-agent' +import SubagentService from '@deepseek-ai/dsh-subagent' +import WorkerWorkflowEngine from '../src/index.ts' + +// A fresh thread compiles the source runtime. Leave contention headroom on +// shared CI runners without weakening any engine-level timeout assertion. +vi.setConfig({ testTimeout: 30_000 }) + +it('runs the default config through the source worker', async () => { + const ctx = new Context() + const subagents = await ctx.plugin(SubagentService) + const engine = await ctx.plugin(WorkerWorkflowEngine, {}) + const parent = { id: AgentId('workflow-compat-parent'), options: {} } as unknown as Agent + try { + const run = ctx.workflows.start({ + script: 'return 6 * 7', + meta: { name: 'source-worker-compat', description: 'exercise the unbuilt worker entry' }, + parent, + }) + try { + await expect(run.result).resolves.toMatchObject({ value: 42, stopReason: 'completed', agentsStarted: 0 }) + } finally { + await run.dispose() + } + } finally { + await engine.dispose() + await subagents.dispose() + } +}) diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index d5b16a8e2f..9ccbb17a4e 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -1226,15 +1226,11 @@ describe('dsh-workflow-workerthread', () => { await second.dispose() }) - it('unregisters ctx.workflows when the engine fiber is disposed (HMR safety), and default config runs (auto concurrency)', async () => { + it('unregisters ctx.workflows when the engine fiber is disposed (HMR safety)', async () => { const ctx = new Context() await ctx.plugin(SubagentService) const fiber = await ctx.plugin(WorkerWorkflowEngine, {}) expect(ctx.get('workflows')).toBeDefined() - // A zero-agent run through the DEFAULT config exercises the auto - // concurrency resolution (cores - 2, capped) in start(). - const result = await run(ctx, fakeParent(), scripted('return 6 * 7')) - expect(result.value).toBe(42) await fiber.dispose() expect(ctx.get('workflows')).toBeUndefined() }) diff --git a/scripts/run-gates.ts b/scripts/run-gates.ts index 2f98c74eea..b26e13a56c 100644 --- a/scripts/run-gates.ts +++ b/scripts/run-gates.ts @@ -143,6 +143,11 @@ function gatesForMode(selected: Mode): Gate[] { case 'node-compat': return [ pnpmScript('typecheck', 'typecheck'), + pnpmExec('source-worker-smoke', [ + 'vitest', + 'run', + 'packages/workflow/workflow-workerthread/tests/source-worker.compat.spec.ts', + ], { label: 'source worker smoke' }), ] case 'pre-push': return [ From c5b1a7941fa5b78c2992d8c7aac02909f1176116 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 08:57:05 +0800 Subject: [PATCH 04/21] fix(scope): harden lifecycle ownership foundation Make Cordis construction and teardown ownership reentrancy-safe, then carry caller and provider ownership through reservation, setup, publication, quiescence, and sentinel retirement. Stabilize registry carriers and factory/workflow boundaries, add adversarial lifecycle regressions, and align the rewritten RFC plus generated contracts with the enforced behavior. --- docs/architecture.md | 2 +- docs/config-catalog.md | 2 +- docs/cordis-catalog/events.md | 44 +- docs/cordis-catalog/services.md | 14 +- docs/cordis-primer.md | 2 +- docs/core-data-structures/core.md | 13 + docs/core-data-structures/session.md | 14 + docs/event-producer-consumer.md | 34 +- ...-18-agent-lifecycle-and-ownership-seams.md | 2 +- .../2026-07-08-agent-scope-contexts.md | 152 ++-- .../cordis/tool-cordis/src/api-catalog.ts | 8 +- .../tests/cordis-lifecycle.spec.ts | 287 ++++++++ packages/core/agent-loop/README.md | 6 +- packages/core/agent-loop/src/agent.ts | 106 +-- packages/core/agent-loop/src/index.ts | 657 ++++++++++++++---- packages/core/agent-loop/tests/agent.spec.ts | 33 + packages/core/agent-loop/tests/resume.spec.ts | 108 +++ .../agent-loop/tests/scope-lifecycle.spec.ts | 608 +++++++++++++++- packages/core/agent/README.md | 14 +- packages/core/agent/src/dispatch.ts | 17 +- packages/core/agent/src/index.ts | 287 ++++++-- packages/core/agent/src/types.ts | 28 +- packages/core/agent/tests/agent.spec.ts | 357 +++++++++- packages/core/scope/README.md | 2 +- packages/core/scope/src/index.ts | 34 +- packages/core/scope/tests/scope.spec.ts | 56 +- packages/core/session/README.md | 6 +- packages/core/session/src/index.ts | 135 ++-- packages/core/session/tests/session.spec.ts | 116 ++++ .../subagent/subagent-inprocess/README.md | 2 +- .../workflow/workflow-workerthread/README.md | 2 +- .../workflow-workerthread/src/host.ts | 17 +- .../workflow-workerthread/src/index.ts | 11 +- .../tests/workflow-workerthread.spec.ts | 32 +- scripts/gen-cordis-catalog.ts | 3 + scripts/gen-doc-graphs.ts | 3 + scripts/type-equiv.manifest.json | 2 + vendor/README.md | 1 + vendor/cordis/src/fiber.ts | 189 ++++- 39 files changed, 2945 insertions(+), 461 deletions(-) create mode 100644 packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts diff --git a/docs/architecture.md b/docs/architecture.md index 249765eb45..15a1142ac3 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -105,7 +105,7 @@ Every session event is turn-enclosed. Reloading a crashed session preserves the ### Agent Handles -`ctx.agents` owns live agents and returns an `AgentHandle { agent, dispose() }`. `Agent` is the API other plugins drive: `send()` queues work, `steer()` injects mid-turn content, `inject()` appends context and opens a one-shot injection turn when idle, `cancel()` is the public stop primitive, and `whenIdle()` observes quiescence. Lifecycle owners tear down with `await dispose()`. +`ctx.agents` owns live agents and returns an `AgentHandle { agent, dispose() }`. `Agent` is the API other plugins drive: `send()` queues work, `steer()` injects mid-turn content, `inject()` appends context and opens a one-shot injection turn when idle, `cancel()` is the public stop primitive, and `whenIdle()` observes quiescence. The caller fiber and concrete factory provider structurally co-own programmatic lifecycles; a consumer handle is the only non-structural teardown capability, and every owner reaches the same awaited disposer. ### Agent Scope diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 0a1c0289ae..dc766ae25f 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -144,7 +144,7 @@ export interface Config { Depends on: [`AgentId`](../packages/core/agent/src/index.ts) · [`AgentOptions`](../packages/core/agent/src/index.ts) · [`SessionId`](../packages/core/session/src/index.ts) -Source: [`packages/core/agent-loop/src/index.ts:44`](../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:119`](../packages/core/agent-loop/src/index.ts) ## `@deepseek-ai/dsh-bash-local` diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index cc450a782e..3e228405ee 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -15,7 +15,7 @@ Dispatch modes: **emit** (fire-and-forget), **waterfall** (each listener gets `n ### `agent/created` — emit -An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store, but concrete factories may keep driving verbs locked until the subsequent `agent/session-start` boundary; that event is the first supported place to inject or queue work during startup. A synchronous listener throw vetoes publication and rollback emits the matching disposal edges; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. +An agent's fully composed scoped world was published in the AgentRegistry. Its session is already live in the session store, but concrete factories may keep driving verbs locked until the subsequent `agent/session-start` boundary; that event is the first supported place to inject or queue work during startup. A synchronous listener throw vetoes publication and rollback emits the matching disposal edges; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. A synchronous listener that requests the advanced registry detach does not remove the entry immediately: removal and the paired `agent/disposed` edge wait until the creation dispatch unwinds, so no later creation listener observes a disposal that preceded its own creation callback. ```ts cordis-catalog 'agent/created'(this: Scoped, agent: Agent): void @@ -23,11 +23,11 @@ An agent's fully composed scoped world was published in the AgentRegistry. Its s Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:303`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:307`](../../packages/core/agent/src/types.ts) ### `agent/disposed` — emit -An agent was removed from the registry after its driver and any in-flight turn reached quiescence. Ordered teardown may still be detaching the session and unwinding the agent's scoped registrations when this notification runs. +An agent was removed from the registry. The concrete AgentLoop lifecycle emits this only after its driver and any in-flight turn reach quiescence; a custom agent registered through the public registry owns its own driver contract, which the registry cannot infer. Ordered teardown may still be detaching the session and unwinding scoped registrations when this runs. ```ts cordis-catalog 'agent/disposed'(this: Scoped, agent: Agent): void @@ -35,7 +35,7 @@ An agent was removed from the registry after its driver and any in-flight turn r Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:317`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:322`](../../packages/core/agent/src/types.ts) ### `agent/error` — emit @@ -47,7 +47,7 @@ A step or turn errored. The loop reports a failure here (plus the logger) even w Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:590`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:596`](../../packages/core/agent/src/types.ts) ### `agent/pre-step` — serial @@ -61,7 +61,7 @@ Serial (awaited in registration order), not a waterfall: a listener mutates the Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:422`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:428`](../../packages/core/agent/src/types.ts) ### `agent/prompt-submit` — waterfall @@ -73,7 +73,7 @@ Waterfall: decide what happens to ONE drained queued message before it becomes a Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:440`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:446`](../../packages/core/agent/src/types.ts) ### `agent/queued` — emit @@ -85,7 +85,7 @@ A message entered the agent's inbox (queued or steering). `source` is the resolv Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:345`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:350`](../../packages/core/agent/src/types.ts) ### `agent/request` — waterfall @@ -97,7 +97,7 @@ Waterfall: shape the step's call configuration — model switching, sampling ove Types: [Agent](../core-data-structures/core.md) · [LlmCallConfig](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:469`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:475`](../../packages/core/agent/src/types.ts) ### `agent/session-prefix` — waterfall @@ -113,19 +113,19 @@ The seed is a frozen empty list; a contributing listener returns a NEW array — Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:521`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:527`](../../packages/core/agent/src/types.ts) ### `agent/session-start` — emit -The agent's session lifecycle began, fired once before its first turn. `source` says why (SessionStartSource: fresh startup, a resumed persisted session, …). A pure NOTIFICATION (emit, not waterfall): it carries no veto — a session-start listener that wants to seed context does so via `agent.inject()` (a `context/message` the first request sees), not by returning a decision. Cannot block the session from starting; that gap is deliberate (a bridge logs/injects, it does not gate startup). +The agent's session lifecycle began, fired once before its first turn. `source` says why (SessionStartSource: fresh startup, a resumed persisted session, …). A pure NOTIFICATION (emit, not waterfall): a listener cannot veto by returning a decision or throwing. A listener that wants to seed context does so via `agent.inject()` (a `context/message` the first request sees). A lifecycle owner can still dispose its structural ownership edge during this notification; publication rechecks liveness and then aborts before the driver starts. ```ts cordis-catalog 'agent/session-start'(this: Scoped, agent: Agent, source: SessionStartSource): void ``` -Types: [Agent](../core-data-structures/core.md) +Types: [Agent](../core-data-structures/core.md) · [SessionStartSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:365`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:371`](../../packages/core/agent/src/types.ts) ### `agent/status` — emit @@ -137,7 +137,7 @@ Agent status changed (`idle` ⇄ `running`, or → `disposed`). Drive lifecycle Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:331`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:336`](../../packages/core/agent/src/types.ts) ### `agent/step-result` — waterfall @@ -149,7 +149,7 @@ Waterfall: post-process the assembled assistant Message before tool dispatch (va Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:536`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:542`](../../packages/core/agent/src/types.ts) ### `agent/turn-continuation` — waterfall @@ -161,7 +161,7 @@ Waterfall: override the turn-continuation decision via a typed ContinuationDecis Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:554`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:560`](../../packages/core/agent/src/types.ts) ### `agent/turn-stop` — serial @@ -173,7 +173,7 @@ Serial terminal-stop checkpoint after the ordinary `agent/turn-continuation` wat Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:573`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:579`](../../packages/core/agent/src/types.ts) ## `approval/*` @@ -245,13 +245,13 @@ Source: [`packages/llm/llm/src/index.ts:39`](../../packages/llm/llm/src/index.ts ### `session/created` — emit -A session was created in the store. A synchronous listener throw vetoes publication and rollback emits the matching `session/disposed` edge; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. +A session was created in the store. A synchronous listener throw vetoes publication and rollback emits the matching `session/disposed` edge; returned-promise rejection is observed and logged but cannot retroactively veto this synchronous boundary. A synchronous listener that requests the advanced detach does not remove the entry immediately: removal and the paired `session/disposed` edge wait until the creation dispatch unwinds. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. ```ts cordis-catalog 'session/created'(this: Scoped, session: Session): void ``` -Source: [`packages/core/session/src/index.ts:50`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:52`](../../packages/core/session/src/index.ts) ### `session/disposed` — emit @@ -261,7 +261,7 @@ A previously announced session left the store. Emitted exactly once on normal de 'session/disposed'(this: Scoped, session: Session): void ``` -Source: [`packages/core/session/src/index.ts:62`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:64`](../../packages/core/session/src/index.ts) ### `session/event` — emit @@ -273,7 +273,7 @@ An event was appended to a session log (sync, fire-and-forget). This is the per- Types: [SessionEvent](../core-data-structures/core.md) -Source: [`packages/core/session/src/index.ts:76`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:78`](../../packages/core/session/src/index.ts) ### `session/flush` — parallel @@ -283,7 +283,7 @@ Awaited durability checkpoint. The agent loop awaits `ctx.sessions.flush(session 'session/flush'(this: Scoped, session: Session): Promise | void ``` -Source: [`packages/core/session/src/index.ts:94`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:96`](../../packages/core/session/src/index.ts) ## `skill/*` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index b7caa6f842..1122137e1a 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -17,11 +17,11 @@ The loop itself is deliberately thin — every behavior beyond "call the model, ```ts cordis-catalog create(id: AgentId, options: AgentOptions = {}, meta: Pick = {}): ReactLoopAgent -async createAgent(options: CreateAgentOptions): Promise -async resume(options: ResumeAgentOptions): Promise +async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise +async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise ``` -Source: [`packages/core/agent-loop/src/index.ts:78`](../../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:153`](../../packages/core/agent-loop/src/index.ts) ## `ctx.agents` — `AgentRegistry` @@ -39,9 +39,9 @@ get(id: AgentId): Agent | undefined list(): Agent[] ``` -Types: [Agent](../core-data-structures/core.md) +Types: [Agent](../core-data-structures/core.md) · [AgentRegistrationReservation](../core-data-structures/core.md) -Source: [`packages/core/agent/src/index.ts:202`](../../packages/core/agent/src/index.ts) +Source: [`packages/core/agent/src/index.ts:250`](../../packages/core/agent/src/index.ts) ## `ctx.approval` — `ApprovalService` @@ -222,7 +222,9 @@ list(): Session[] fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Session ``` -Source: [`packages/core/session/src/index.ts:663`](../../packages/core/session/src/index.ts) +Types: [SessionRegistrationReservation](../core-data-structures/session.md) + +Source: [`packages/core/session/src/index.ts:667`](../../packages/core/session/src/index.ts) ## `ctx.skills` — `SkillService` diff --git a/docs/cordis-primer.md b/docs/cordis-primer.md index b59363eea7..5b14da901c 100644 --- a/docs/cordis-primer.md +++ b/docs/cordis-primer.md @@ -27,7 +27,7 @@ The mode is part of the event's public contract. New harness events document it `ctx.waterfall` is around-middleware. A listener receives `(...args, next)`. Call `next()` to delegate the possibly wrapped result to the next service; return without `next()` to short-circuit. Values propagate through `next()`'s return value. -Cooperative listeners usually mutate a shared request or decision object and then delegate. A listener can also choose to repalce the result entirely and downstream listeners will only see the result after replacement. Use `prepend: true` only when the listener must run before ordinary registrations. +Cooperative listeners usually mutate a shared request or decision object and then delegate. A listener can also choose to replace the result entirely and downstream listeners will only see the result after replacement. Use `prepend: true` only when the listener must run before ordinary registrations. For single-decision events, short-circuiting is the design. A policy listener can return without `next()` when it owns the decision, while a listener that only annotates or observes must delegate. diff --git a/docs/core-data-structures/core.md b/docs/core-data-structures/core.md index 76ec27e744..7937018b9f 100644 --- a/docs/core-data-structures/core.md +++ b/docs/core-data-structures/core.md @@ -346,6 +346,19 @@ interface Agent { `AgentStatus` is `'idle' | 'running' | 'disposed'`. `AgentId` is a branded string. `AgentOptions` (`model?`) is merge-extensible — plugins add creation options by declaration merging; the persona is NOT an agent option but the `dsh-system-prompt` plugin's `persona` config, shared context-wide. The `agent/*` event taxonomy (lifecycle emits incl. `agent/session-start`, serial `agent/pre-step`/`agent/turn-stop` checkpoints, and the `agent/prompt-submit`/`agent/request`/`agent/session-prefix`/`agent/step-result`/`agent/turn-continuation` waterfalls) is in [architecture.md § Event taxonomy](../architecture.md#event-taxonomy); turn/step boundaries are durable `session/event` records, not `agent/*` emits. +### `AgentRegistrationReservation` — unpublished identity ownership + +An agent factory reserves its public `AgentId` before awaiting setup, so setup code cannot publish either the intended agent or a replacement under that id ahead of the transaction. The opaque capability authorizes exactly the later `enter()` call. Its `release` function is the exact Cordis owner effect disposer, letting the lifecycle adopt it by identity and place release after scope quiescence while owner disposal remains the abandoned-transaction backstop. Ordinary plugins use `register()` and never hold this type. + +Source: [`packages/core/agent/src/index.ts`](../../packages/core/agent/src/index.ts) + +```ts type-equiv +interface AgentRegistrationReservation { + readonly id: AgentId + release(): void +} +``` + ## Interception decisions Each `agent/*` interception waterfall returns a small, seam-specific typed union — the unified Decision idiom (the tool seams' `PreToolDecision`/`PostToolDecision` in [tools.md](tools.md) follow the same shape). A CC/Codex hook bridge maps its `permissionDecision`/`decision`/`continue`/`additionalContext` fields onto these; a native plugin returns them directly. They share one envelope for model-facing context, `HookContext`, which is `inject()`ed as a `context/message` and so carries a REQUIRED `source` (a missing source would default to `{kind:'user'}` and mislabel plugin context as a user prompt). diff --git a/docs/core-data-structures/session.md b/docs/core-data-structures/session.md index 1b12c3fc48..3ed02b41a9 100644 --- a/docs/core-data-structures/session.md +++ b/docs/core-data-structures/session.md @@ -196,6 +196,20 @@ export interface SurfaceNode { } ``` +## `SessionRegistrationReservation` — unpublished identity and construction ownership + +A session factory reserves its public `SessionId` before awaiting persistence load or scoped setup, so concurrent code cannot create, prepare, or enter a session under that id ahead of the transaction. The opaque capability may construct exactly one unpublished `Session` and authorizes exactly that object at `enter()`. Its `release` function is the exact Cordis owner effect disposer, letting the lifecycle adopt it by identity and place release after scope quiescence while owner disposal remains the abandoned-transaction backstop. Ordinary session consumers use `create()` and never hold this type. + +Source: [`packages/core/session/src/index.ts`](../../packages/core/session/src/index.ts) + +```ts type-equiv +interface SessionRegistrationReservation { + readonly id: SessionId + prepare(options?: CreateSessionOptions): Session + release(): void +} +``` + ## Derived history: `deriveMessages()` and `deriveEventMessage()` `Session.deriveMessages()` projects the event log into the `Message[]` the model sees — cached (each surface node projected once, when first seen; a surface rewrite rebuilds) and frozen (a fresh array per call over shared, deep-frozen messages, so mutating logged history through a projection is unrepresentable). `deriveEventMessage(event)` is the per-node pure function the fold applies — public so external reconstructors and the dev invariant project a log prefix with exactly the same rules and cannot disagree with the cache. The projection rules: diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index 7b26f43b12..ec867aa709 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -7,28 +7,28 @@ This matrix shows which packages dispatch each harness-owned event and which pac | Event | Mode | Declared in | Dispatchers | Listeners | | --- | --- | --- | --- | --- | -| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:303`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:317`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`emit`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:590`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:422`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | -| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:440`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | -| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:345`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:469`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:521`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | -| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:365`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | -| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:331`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:536`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:554`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | -| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:573`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | +| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:307`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:322`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:596`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:428`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | +| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:446`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | +| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:350`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:475`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:527`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | +| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:371`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | +| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:336`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:542`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:560`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | +| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:579`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | | `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:72`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) | | `fs/edit-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:123`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) | | `fs/observed` | `emit` | [`packages/fs/fs/src/index.ts:138`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`emit`) | [`fs-policy`](../packages/fs/fs-policy) | | `fs/write-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:109`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) | | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:39`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`invariants`](../packages/support/invariants), [`llm-replay`](../packages/support/llm-replay) | -| `session/created` | `emit` | [`packages/core/session/src/index.ts:50`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | -| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:62`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | - | -| `session/event` | `emit` | [`packages/core/session/src/index.ts:76`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | -| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:94`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | +| `session/created` | `emit` | [`packages/core/session/src/index.ts:52`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | +| `session/disposed` | `emit` | [`packages/core/session/src/index.ts:64`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | - | +| `session/event` | `emit` | [`packages/core/session/src/index.ts:78`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | +| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:96`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | | `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:132`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:138`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:115`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | diff --git a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md index 8e1acd1638..b727e357ee 100644 --- a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md +++ b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md @@ -16,7 +16,7 @@ A new `cancel()` verb on the `Agent` interface — the single public stop primit ### 2. `AgentHandle` async disposer -`ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **capability** — only the holder can tear down exactly this agent: stop its loop, `await` the loop's exit (true quiescence, not just the `disposed` status flip), unregister it, and remove its session from the store. `ctx.agents.get(id)` still returns a bare `Agent`. Config-created agents stay owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw). +`ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **consumer capability** — a registry observer holding only the bare `Agent` cannot tear it down. The caller fiber and registered factory provider are structural co-owners: caller unload enforces structured ownership, while provider unload must stop old instances whose scoped dependency surface resolves through that provider. All three paths reach the same memoized teardown: stop the loop, `await` its exit (true quiescence, not just the `disposed` status flip), unregister it, remove its session from the store, unwind its scope, and only then release both public IDs. Config-created agents are already owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw). **Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race detaching the session store's private append observer against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The contained `agent/disposed` and `session/disposed` notifications cannot reject the chain or skip later teardown. diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 436a208be8..c29fb4f83b 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -27,18 +27,19 @@ The subagent API makes these requirements concrete. Two concurrent children can Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's world composable with normal plugin APIs while keeping authority, observation, and cleanup aligned. -The design has four parts: +The design has five parts: | Part | Rule | Purpose | |---|---|---| | Registration scope | A registration through a plain plugin context is global; the same registration through `agent.ctx` belongs to that agent | Reuse existing APIs for per-agent tools, prompt state, and listeners | -| Lifecycle transaction | Create and resume await scoped setup while the agent and session are unpublished, then publish them in an ordered rollback-covered sequence | No observer sees a partially composed agent, and every failure path owns cleanup | +| Lifecycle transaction | Caller and factory ownership cover create and resume from reservation or load through scoped setup, ordered publication, and teardown | No observer sees a partially composed agent, and caller or provider loss cannot orphan work | +| Lifecycle foundation | Effects become owner-visible before setup, child fibers become parent-owned before publication, and unloading fibers reject late effects | Reentrant HMR cannot strand a half-built or cleanup-time registration outside the unload snapshot | | Owner-final policy | Prompt protection, tool guards, final tool-result observation, and terminal turn stopping run at service-owned boundaries | Invariants do not depend on listener registration order | | Boundary ownership | Services capture fixed fields once, materialize lossless-JSON data once, and publish owner-controlled views | Validation, execution, persistence, and telemetry cannot observe different values from one call | Three domain terms recur below. A **Session** is one agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** means JSON primitives plus dense arrays and plain objects that can be copied without changing meaning; the boundary rejects sparse arrays, cycles, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols instead of coercing or erasing them. **Code Mode** presents the model with a generated software-development-kit interface and a reserved `run_code` transport, rather than advertising every end-capability as a native tool. -Ownership stays with the component that can enforce each fact. The scope package owns scope tags and carrier construction; each registry owns acceptance snapshots and resolution; the agent factory owns identity reservation, setup, and publication; the session owns accepted history; the tool and subagent services own their pipeline records; and the workflow host owns cancellation of the runs it started. A caller never validates a value that another component later rereads from the caller's mutable object. +Ownership stays with the component that can enforce each fact. The scope package owns scope tags and carrier construction; each registry owns acceptance snapshots and resolution; the caller owns the programmatic agent lifetime it requested; the concrete agent factory owns identity reservation, setup, publication, and structural invalidation of agents that still depend on it; the session owns accepted history; the tool and subagent services own their pipeline records; and each workflow run captures its holder-bound dependencies and owns its cancellation after the engine returns it. A caller never validates a value that another component later rereads from the caller's mutable object. The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without silently inheriting authority. @@ -54,10 +55,14 @@ A Cordis `Context` is the object through which a plugin reaches services such as A context also carries a capability view. A derived context reaches the services injected into the plugin that created it. Handing out `agent.ctx` therefore hands out the agent loop's injected service surface; it is not an ambient root context. +Factory delegation uses two contexts whose jobs must remain separate. The registry derives a caller-bound context carrying the fiber and scope from which `ctx.agents.create()` or `resume()` was called and passes it explicitly as `ownerCtx`; those facts identify the fiber and optional parent agent that own the requested lifetime. When the registered factory is itself a Cordis service, the registry also invokes it through a traced receiver, which preserves the factory's own injected dependency origin. A plain object that merely implements the factory methods receives the same explicit `ownerCtx` without depending on Cordis tracing. Conflating these roles would either attach the agent to the factory registrant instead of the caller or make the concrete loop resolve dependencies from the wrong service view. + ### Effects give registrations an owner A Cordis effect is work whose cleanup belongs to a runtime unit called a fiber. Tool registration, prompt contribution, and event subscription are effects, so disposing their fiber unwinds them on normal teardown, failure, or hot reload. +Ownership must exist before effect setup can call arbitrary code. The vendored Fiber implementation therefore places an effect's cleanup wrapper in the owner list before running its setup body; a reentrant unload sees that in-construction effect and waits for setup plus every cleanup it collected. A child fiber likewise receives its parent-owned disposer before `internal/plugin` announces the child. Teardown delivers that notification with per-observer failure containment so one callback cannot starve peers or interrupt cleanup. Effects remain legal while a fiber is pending or loading, because setup needs them, but a fiber already unloading rejects new effects: its cleanup snapshot has been taken, so accepting another registration would strand it in the old epoch. + `dsh-scope` mounts a no-op plugin fiber for each scope. The plugin contributes no behavior; its fiber is the ownership bucket for everything registered through the scoped context. ### A waterfall is ordered around-middleware @@ -125,7 +130,7 @@ The property is deliberately not treated as the authoritative scope tag. A neste | `Scope.dispose()` | Give ordinary callers an idempotent promise shared by repeat and racing calls until quiescence | | `Scope.rawDispose` | Expose the exact Cordis disposer so a larger generator lifecycle can nest it at a precise teardown position | -The two disposal forms solve different framework constraints. Cordis identifies nested effects by disposer-function identity, so an ordered composite lifecycle must yield `rawDispose` exactly. Cordis disposers are also single-shot, so a second raw call may not await the first asynchronous teardown; `Scope.dispose()` follows the backing fiber's in-flight lifecycle and gives all ordinary callers the same quiescence boundary, including a race in which `rawDispose` started first. The test/tooling `ScopeHost.dispose()` extends that shared boundary across its host fiber and every minted child scope. +The two disposal forms solve different framework constraints. Cordis identifies nested effects by disposer-function identity, so an ordered composite lifecycle must yield `rawDispose` exactly. Cordis disposers are also single-shot, so a second raw call may not await the first asynchronous teardown; `Scope.dispose()` follows the backing fiber's in-flight lifecycle and gives all ordinary callers the same quiescence boundary, including a race in which `rawDispose` started first. The test/tooling `ScopeHost.dispose()` extends that shared boundary across its host fiber and every minted child scope. Pre-registration of an effect wrapper solves a different race: it makes the first owner unload see construction in progress without changing this single-shot raw-disposer contract. The primitive itself is small. Its essential implementation shape is: @@ -245,72 +250,92 @@ The real helpers fuse values that must agree. `agentEvents(context, agent)` uses Function-style listeners receive the carrier as `this`, and agent event APIs allow them to call subject methods. The carrier is therefore a JavaScript proxy that reads and writes through to the real subject and binds methods to it. -Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The carrier therefore uses a dedicated surrogate proxy target with its own immutable composed-filter slot, while ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to the real subject; callable carriers also preserve whether the subject is constructable. For non-overlay properties owned by the subject, descriptor queries preserve values and flags except that `configurable` is reported as `true`, which is the Proxy-safe way for an extensible surrogate to expose a property it does not itself own. A filter property pinned on the subject before, during, or after construction cannot trigger the proxy invariant that would otherwise force delivery to use the subject's raw filter and silently drop scope isolation. The carrier is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. +Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The carrier therefore uses a dedicated surrogate proxy target with its own immutable composed-filter slot, while ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to the real subject; callable carriers also preserve whether the subject is constructable. + +The composed filter is an authorization boundary, not an ordinary exposed callback. It invokes a subject's pre-existing filter with stable references to the built-in `Reflect.apply` and `Function.prototype.call` operations, pins its own `.call` to that captured built-in, and freezes the callable. Code holding the subject or carrier therefore cannot replace either `.call` property to turn a scoped predicate into an always-allow predicate. Keeping the filter on the surrogate also means a filter property pinned on the subject before, during, or after carrier construction cannot trigger a Proxy invariant that silently replaces scope isolation with the subject's raw filter. + +The surrogate must remain extensible so its reported own-key view can follow the subject. For non-overlay properties owned by the subject, descriptor queries preserve values and flags except that `configurable` is reported as `true`, which is the only Proxy-safe description of a property the extensible surrogate does not itself own. For the same reason, defining a property through the carrier is supported only when the descriptor explicitly says `configurable: true`; an omitted or false flag is rejected before the subject is touched. The carrier is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. `Scoped` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime security, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches. ## Agent creation and teardown -An agent's scope, session, registry entry, and driver form one owned transaction. Setup finishes before publication, publication is synchronous and rollback-covered rather than magically atomic, and teardown reaches one ordered quiescent boundary. +An agent's scope, session, registry entry, and driver form one transaction with two ownership edges. The caller context owns the work it requested and receives the only consumer-facing teardown capability; the concrete `AgentLoop` provider is a structural co-owner because the live agent continues to use the provider's injected services. Either edge deactivates the transaction and converges on the same ordered, memoized quiescence boundary. Setup finishes before publication, and publication is synchronous and rollback-covered rather than magically atomic. ### Create and resume reserve identities before asynchronous work Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup. +The registry treats the factory seam as an untrusted runtime boundary. A TypeScript interface checks source code but does not constrain the JavaScript object received at runtime, which may expose stateful getters. `setFactory()` therefore claims the single factory slot before reading method accessors, canonicalizes an already traced Cordis service to its concrete target, then captures that target plus the `createAgent` and `resume` callback identities once. A getter cannot reenter `setFactory()` and replace the outer factory while it is being accepted, later method replacement cannot redirect calls, and a service proxy cannot accumulate a second trace layer that breaks raw-identity state. On each call, the registry passes a caller-bound context carrying the accessing fiber and scope as `ownerCtx`, retraces the concrete service target exactly once through that context, and invokes the captured callback with both pieces. The explicit argument binds ownership; the traced receiver preserves the factory's dependency origin. + The factory first captures the requested IDs, setup callback, and caller-owned agent options. Seed events and session metadata take a stricter route than a preliminary clone: cloning can erase an exotic prototype before validation sees it, so the factory reads each reference once and hands it synchronously to the session store's reservation-bound prepare operation. That boundary rejects exotic shells, reads accepted metadata fields once, and recursively materializes each seed record in one pass. Resume applies the same rule to persistence output by capturing the loaded header fields once before reconstruction. The transaction therefore cannot move to different identities, storage routing, or lineage after an asynchronous boundary. Before setup can observe the new objects, their ownership-bearing public properties become stable runtime data slots rather than TypeScript-only `readonly` promises. The concrete agent pins its ID, accepted options, and session; the factory binds its scope context exactly once. The session pins its ID and detached, deep-frozen header. Registry detach closures likewise close over their accepted map keys instead of rereading public properties during teardown. A JavaScript assignment or stateful accessor therefore cannot split registry lookup, dispatch, persistence, and the driver into different identities. The session owns the accepted log as described in [the session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md). Seed and append paths materialize lossless JSON once, validate both the event envelope and the metadata that places message-producing events into derived model history, and deep-freeze the exact accepted event. `session.events` returns a frozen snapshot that never grows later. The store keeps append notification and scope-carrier state in store-owned private tables instead of caller-writable `Session` fields, so outside JavaScript cannot suppress or redirect `session/event` dispatch. -Reservations prevent two concurrent factory transactions from composing different unpublished objects under the same public identities. Each reservation belongs both to the factory transaction and to the Cordis fiber that requested it: explicit release covers every success or failure path, while owner-fiber disposal is the backstop for an abandoned handle during plugin unload or HMR. The agent registry and session store recognize their own reserved keys: setup code that calls public reserve, prepare, create, register, or bare enter APIs with the same IDs fails. The session capability can prepare exactly one object, and publication succeeds only when both stores receive the factory-held exact capabilities; the session store additionally checks that the capability owns that exact prepared session. This closes the otherwise possible path in which setup publishes a substitute object under an ID that the factory merely tracked in a separate pending set, without letting a vanished owner wedge the ID forever. +Reservations prevent two concurrent factory transactions from composing different unpublished objects under the same public identities. Each capability's `release` is its exact Cordis effect disposer. Before asynchronous work, the owning sentinel adopts those functions by identity, removing them from the caller fiber's concurrent sibling list; teardown reaches them only after the transaction's driver, registry entries, session, and scope have quiesced. Explicit release covers pre-lifecycle failure and the ordered final step, while the owning fiber remains the backstop for an abandoned transaction. The concrete factory also tracks the whole create transaction before reservation and session preparation begin, and keeps that structural edge through reservation release. Provider unload first stops the factory from accepting work, then aborts or drains every tracked transaction before its dependency surface disappears. -Resume installs an owner-liveness sentinel before reserving IDs or starting persistence I/O, then races loading against owner disposal. If disposal wins, resume rejects and releases both reservations immediately; a backend promise that settles later cannot publish. After a successful load, the factory synchronously installs the full agent lifecycle before removing the sentinel, so ownership passes from load to setup without an unobserved disposal gap. +The agent registry and session store recognize their own reserved keys: setup code that calls public reserve, prepare, create, register, or bare enter APIs with the same IDs fails. The session capability can prepare exactly one object, and publication succeeds only when both stores receive the factory-held exact capabilities; the session store additionally checks that the capability owns that exact prepared session. This closes the otherwise possible path in which setup publishes a substitute object under an ID that the factory merely tracked in a separate pending set, without letting a vanished owner wedge the ID forever. -The sentinel exists only for the interval in which no agent lifecycle can exist yet: +Resume needs an ownership edge before an agent object exists. It reserves the identities, then installs a caller-liveness sentinel that adopts both exact reservation disposers before persistence I/O; a factory-tracked load transaction supplies the provider edge. If either owner wins, resume rejects, waits for the load transaction to settle, and only then releases both reservations; a backend promise that settles later cannot publish. After a successful load, `startOwned` synchronously returns both the complete lifecycle disposer and the asynchronous setup/publication result. Even a preparation failure is represented by a disposer-backed result, so the load sentinel can hand off to a real quiescence boundary instead of mistaking an async function's rejected promise for successful installation. The load tracker remains until the surrounding transaction settles, while the load and caller sentinels remain lifecycle-long followers, so no ownership or ID-release gap opens. Once the shared lifecycle quiesces, each sentinel first disarms its follower and then removes its owner-fiber effect; long-lived callers therefore do not retain completed agents, scopes, or reservation closures. + +The load sentinel changes what it follows at handoff but remains an owner-visible boundary: ```text -resume(request): +resume(ownerCtx, request): snapshot request ids, options, and setup callback - sentinel = owner.effect(onDispose => signal ownerDisposed) reservations = reserve agentId in AgentRegistry and sessionId in SessionStore + sentinel = ownerCtx.effect( + onDispose => abort and await load settlement before reservation release, + adopt exact reservation disposers) + loadTransaction = factory.track(onDispose => signal deactivated and await settlement) try: - persisted = await firstOf(persistence.load(sessionId), ownerDisposed) + persisted = await firstOf(persistence.load(sessionId), deactivated) session = reservations.session.prepare(reconstruct persisted data) - # This call installs the full lifecycle before its first await. - starting = startOwned(agentId, session, options, reservations, setup) - disarm and dispose sentinel - return await starting + # This synchronous call returns a lifecycle boundary even when preparation fails. + starting = startOwned(ownerCtx, agentId, session, options, reservations, setup) + sentinel.follow(starting.dispose) + return await starting.result finally: - release both reservation capabilities - settle the sentinel transaction + release directly only if no lifecycle boundary was established + settle and untrack the load transaction ``` -If `ownerDisposed` wins, the load promise may continue inside the backend, but it has no path back to publication. +If deactivation wins, the load promise may continue inside the backend, but it has no path back to publication. ### Setup composes an unpublished world The optional `setup(agentCtx)` callback receives the new agent context and may synchronously register contributions or await child-plugin activation. During setup, neither the session nor agent is visible through its global registry, but `agentCtx.agent` exposes the unpublished agent to the code composing it. -Setup may register scoped tools, prompt sections, variables, restrictions, listeners, protections, or child plugins. If it throws or rejects, the scope unwinds without publishing either object, and the reserved IDs become reusable. If the owner unloads during an await, the preinstalled teardown skeleton marks the transaction inactive; late setup completion cannot publish. +Setup may register scoped tools, prompt sections, variables, restrictions, listeners, protections, or child plugins. If it throws or rejects, the scope unwinds without publishing either object, and the reserved IDs become reusable. If either the caller owner or concrete factory unloads during an await, the preinstalled teardown skeleton marks the transaction inactive; late setup completion cannot publish. -After setup settles, the factory yields one microtask checkpoint and rechecks the lifecycle flag, owner-fiber state, and owning agent's disposed state. Cordis begins owner unload synchronously but may run nested effect disposers in the next microtask; the explicit owner checks and checkpoint let a same-turn unload win instead of allowing an immediately fulfilled setup to publish an already-doomed agent. +Both structural edges exist before driver preparation or scope minting. The provider uses a tracked placeholder, while the caller gets a lifecycle-long sentinel that adopts the reservation effects and resolves to the same memoized lifecycle disposer. If `internal/plugin` reentrantly unloads either owner while the scope fiber is being constructed, Cordis has already attached the child disposer to its parent and the sentinel waits until preparation publishes either the complete lifecycle or a rollback disposer. A failure halfway through preparation therefore leaves both owners with a quiescence boundary for the prepared driver, minted scope, and reservations. + +The factory checks liveness before invoking arbitrary setup. After setup settles, it yields one microtask checkpoint and checks the lifecycle flag, factory state, caller-fiber state, and the owner context's associated agent state again. Cordis begins owner unload synchronously but may run nested effect disposers in the next microtask; the explicit checks and checkpoint let a same-turn unload win instead of allowing an immediately fulfilled setup to publish an already-doomed agent. Setup composes but does not drive. The concrete agent rejects `send`, `steer`, `inject`, and `cancel` until publication reaches the session-start boundary, keeps its inbox in a JavaScript native-private field, and allows only one concrete driver to claim a session. Driver startup is absent from the package surface: the package exports neither its loop/inbox internals nor source subpaths, and only instance-bound controls held by the factory can enable and start the driver. JavaScript or a type cast therefore cannot bypass the lock by calling a public `start()` or writing directly into the queue. These boundaries prevent a turn from opening before lifecycle listeners know the session exists. The common create/resume tail makes the unpublished boundary explicit: ```text -startOwned(snapshot, preparedSession): - world = prepareLifecycle(snapshot, preparedSession) - # world now owns agent.ctx and the complete rollback/teardown skeleton - +startOwned(ownerCtx, snapshot, preparedSession): try: + world = prepareLifecycle(ownerCtx, snapshot, preparedSession) + # Factory placeholder, lifecycle-long caller sentinel, reservation adoption, + # and complete rollback/teardown skeleton all exist before the first await. + catch preparationError with rollbackBoundary: + return { dispose: rollbackBoundary, + result: await rollbackBoundary then reject original error } + + result = async: + require world.lifecycleActive await firstOf(snapshot.setup(world.agent.ctx), world.deactivated) await oneMicrotask() require world.lifecycleActive + require world.factoryActive require world.ownerFiberActive require world.ownerAgentNotDisposed @@ -319,60 +344,82 @@ startOwned(snapshot, preparedSession): catch error: await world.dispose() throw error + + return { dispose: world.dispose, result } ``` `setup` can await arbitrary plugin activation, but every exit still passes through the already-installed disposer. ### Publication is ordered and rollback-covered -After setup succeeds, the factory publishes in one synchronous sequence with no `await` between steps: +After setup succeeds, the factory publishes in one synchronous sequence with no `await` between steps. Each registry has already claimed its ID across every caller-code boundary needed to construct a stable entry: the agent registry pins the accepted ID and captures one lifecycle carrier while its claim is held, and the session store holds the same kind of claim while evaluating its filter and carrier. A Proxy trap or filter getter can therefore neither overwrite a reentrant same-ID entry nor create a stale detach capability that later deletes another object. Liveness checkpoints then divide publication into three notification phases, and an outer publication barrier keeps teardown from revoking either registry entry or the scope while one of those phases is on the stack: 1. Enter the session store and capture its scope carrier. 2. Enter the agent registry without announcing it. -3. Emit `session/created`. -4. Emit `agent/created`. -5. Enable driving. -6. Emit `agent/session-start`. -7. Start the driver loop. +3. Recheck caller and factory liveness; entering either registry may have evaluated a caller-owned getter that began teardown. +4. Emit `session/created`. +5. Recheck liveness; if teardown began, skip the agent announcement and roll back. +6. Emit `agent/created`. +7. Recheck liveness; if teardown began, keep driving locked and roll back. +8. Enable driving. +9. Emit `agent/session-start`. +10. Recheck liveness; if teardown began, roll back without starting the driver. +11. Start the driver loop. The implementation keeps publication synchronous and leaves rollback to the surrounding owned transaction: ```text publish(world): - world.detachSession = world.agent.ctx.sessions.enter(world.session, world.sessionReservation) - world.detachAgent = app.agents.enter(world.agent, world.agentReservation) - app.sessions.announce(world.session) - app.agents.announce(world.agent) - world.driver.enableDrivingVerbs() - emitNonVetoing(agent/session-start) - world.stopDriver = world.driver.start() + world.beginSynchronousPublication() + try: + world.detachSession = world.agent.ctx.sessions.enter(world.session, world.sessionReservation) + world.detachAgent = app.agents.enter(world.agent, world.agentReservation) + require world.callerAndFactoryActive + app.sessions.announce(world.session) + require world.callerAndFactoryActive + app.agents.announce(world.agent) + require world.callerAndFactoryActive + world.driver.enableDrivingVerbs() + emitNonVetoing(agent/session-start) + require world.callerAndFactoryActive + world.driver.start() + finally: + world.endSynchronousPublication() ``` -Both registry entries exist before the first creation listener runs, and setup-installed listeners receive both announcements. Driving opens immediately before `agent/session-start`, so that event remains the first supported place for a listener to inject or queue startup work. +Both registry entries exist before the first creation listener runs, and setup-installed listeners receive every announcement that publication reaches. Driving opens immediately before `agent/session-start`, so that event remains the first supported place for a listener to inject or queue startup work. A synchronous teardown request from any notification marks the lifecycle inactive immediately, which makes the next checkpoint abort, but actual loop, registry, session, and scope cleanup waits until the current synchronous notification phase and publication call stack unwind. Teardown itself therefore cannot make a later listener that still runs observe a different world; teardown from `session/created` prevents `agent/created`, teardown from `agent/created` prevents session start, and teardown from `agent/session-start` prevents the driver from starting. The sequence is not described as atomic because observers run between its steps. If a `session/created` or `agent/created` listener throws synchronously, the transaction rolls the registry entries and scope back, but effects already performed by an earlier listener cannot be retracted. Each store therefore marks its announcement as begun before invoking creation listeners and rejects a repeat or reentrant announcement before dispatch. Rollback emits `session/disposed` or `agent/disposed` exactly once for every corresponding creation announcement that began, including a partial emit in which an early listener observed creation before a later listener threw. An object entered but never announced has no disposal notification because no observer was told it existed. +Each registry also protects ordering inside its own creation phase. If a listener uses an advanced detach capability while `session/created` or `agent/created` is dispatching, removal and the paired disposal edge are deferred until that dispatch unwinds. The agent's creation and disposal edges reuse the carrier captured before commit instead of rebuilding it from a mutable filter getter. A detach request therefore cannot make a later listener observe `created` after `disposed`, find the just-created entry missing, or trigger disposal while creation is still constructing its receiver. Exact-object guards on both detach paths are the final defense against a stale capability deleting a later same-ID entry. The factory's outer publication barrier is the cross-registry complement: caller or provider teardown cannot remove the other entry or unwind `agent.ctx` while the current phase is still running. + Creation notification preserves that synchronous veto while also defending against JavaScript's asynchronous callback shape. A listener may return a promise even though the event type returns `void`; the dispatcher does not await it because publication has no asynchronous gap, but it observes and logs a later rejection. Such a rejection is too late to roll back, does not become unhandled, and does not starve the listeners invoked after that callback. -The disposal notifications and `agent/session-start` are deliberately non-vetoing. Their dispatchers invoke every listener synchronously and independently; they log and contain both a synchronous throw and a rejection from a returned promise. Returned promises are observed for failure but not awaited, so an asynchronous notification listener cannot delay rollback or teardown, veto driver startup, or starve a later listener. +The disposal notifications and `agent/session-start` do not treat return values or listener failures as vetoes. Their dispatchers invoke every listener synchronously and independently; they log and contain both a synchronous throw and a rejection from a returned promise. Completion or rejection of a returned promise is observed but not awaited, so it cannot delay rollback or teardown, veto driver startup, or starve a later listener. The callback's synchronous prefix remains ordinary code: if it holds and disposes a structural ownership edge, the next publication liveness check deliberately aborts startup. ### Teardown stops work before revoking its world -Every owner path uses the same reverse order: stop the loop and await its actual exit plus every agent-started durability checkpoint, remove the agent from the registry, detach the session, then unwind the scope. Final turn events, the turn-ending flush, and any outstanding idle-injection flush therefore settle while the session and scoped listeners are still live. +Every owner path reaches the same memoized reverse order: the consumer handle, caller-fiber disposal, and structural factory-provider unload first deactivate the lifecycle; wait for an in-progress synchronous publication phase; stop the loop and await its actual exit plus every agent-started durability checkpoint; remove the agent from the registry; detach the session; unwind the scope; and only then release both IDs. Final turn events, the turn-ending flush, and any outstanding idle-injection flush therefore settle while the session and scoped listeners are still live, and a replacement cannot reuse either identity while old scoped cleanup remains in flight. ```text disposeOwnedAgent(world): + mark world inactive + await world.synchronousPublicationIfRunning() await world.stopDriver() # waits for loop exit and all agent-started flushes world.detachAgent() # leaves registry; emits agent/disposed if announced world.detachSession() # stops event feed, leaves store; emits session/disposed if announced await world.scope.dispose() + world.releaseSessionReservation() + world.releaseAgentReservation() ``` The actual Cordis generator yields these disposers in reverse so its last-in-first-out teardown executes in the order shown. -`agent/disposed` means the driver is quiescent and the agent has left the registry; the session is still live during that notification. `session/disposed` follows after append notification has been detached and the session has left its store. The scope is still live when each disposal listener is selected and invoked, although returned asynchronous work is observed rather than awaited. Both notifications use the same scope key and delivery rule as their creation partners and occur exactly once only when those creation announcements began. +For the concrete AgentLoop transaction, `agent/disposed` runs after the driver is quiescent and the agent has left the registry; the session is still live during that notification. The public AgentRegistry alone promises only exact removal, because a custom registered `Agent` owns any stronger driver contract itself. `session/disposed` follows after append notification has been detached and the session has left its store. The scope is still live when each disposal listener is selected and invoked, although returned asynchronous work is observed rather than awaited. Both notifications use the stable scope key and delivery rule captured for their creation partners and occur exactly once only when those creation announcements began. -`AgentHandle.dispose()` is memoized so concurrent owners await the same full transaction, and `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races. +`AgentHandle.dispose()` is memoized so repeated consumer calls await the same full transaction. The lifecycle-long caller sentinel independently follows that memoized promise, so handle-first teardown cannot make a racing caller-fiber unload observe Cordis's inert second raw-disposer call and return early. Once the transaction reaches its final quiescent stage, retirement disarms and removes the sentinel before settling that shared promise. `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races. The provider's ownership ledger is internal rather than another public handle: it stops accepting new transactions, invokes every tracked disposer independently, and waits for all of them before the AgentLoop service surface disappears. + +Provider co-ownership is specific to resources that remain structurally dependent on their provider. An AgentLoop-created agent continues to resolve the loop's injected services, so loop unload must stop it. A worker workflow run instead captures its holder-bound `SubagentService` handle synchronously at `start()` and stores that independent dependency on the run; unloading `WorkerWorkflowEngine` removes the ability to start new runs but does not revoke an already returned run or prevent its later worker message from starting a child. The two lifetimes differ by dependency shape, not by a blanket rule that every service must own every value it creates. Parent-owned subagents use explicit ownership rather than capability inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped capabilities. @@ -564,7 +611,7 @@ Provider registration first freezes an acceptance snapshot of the provider name, Starting a run reads every top-level request field once before capability validation, then snapshots every accepted field before asynchronous owner setup. This order makes checked and delegated capabilities identical even for a JavaScript caller with stateful accessors. Fixed scalars are checked at the same boundary: `maxDepth` must be a non-negative safe integer and `persona` must be a string. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached through the one-pass lossless-JSON materializer. The exported in-process driver repeats this boundary for direct callers before it awaits run-owner activation, including taking one seed snapshot from which it derives both the child prefix and `seedLength`. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. -The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. The child factory runs through the owner fiber. Parent teardown, provider teardown, and manual run disposal all dispose this same node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. +The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. Calling `runOwner.ctx.agents.create()` gives the child factory an explicit `ownerCtx` carrying the run-owner fiber and scope, while the registry's traced factory receiver preserves AgentLoop's injected dependency origin. Parent teardown, provider teardown, and manual run disposal all dispose this same run-owner node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. @@ -624,7 +671,9 @@ Before publishing the workflow's own result: Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. -Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber, so the agent factory's liveness check fails, `started` rejects, and neither the child session nor agent can publish. The run's result still settles as `aborted`. Before the workflow's own result becomes observable, its host likewise drives both permitted cancellation channels: it aborts the shared request signal and calls each registered run's `cancel()`, including runs still waiting on readiness. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. +Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber. If cancellation lands before publication, the factory's liveness check prevents either creation edge. If it begins synchronously inside `session/created`, `agent/created`, or `agent/session-start`, the publication barrier lets the current notification phase unwind without revoking its world, the next liveness check prevents every later phase and driver start, and rollback pairs every creation edge that already began. In either case `started` rejects, no `subagent/start` or `subagent/end` is emitted, and the run result settles as `aborted`. + +Before the workflow's own result becomes observable, its host likewise drives both permitted cancellation channels: it aborts the shared request signal and calls each registered run's `cancel()`, including runs still waiting on readiness. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. Together these rules prevent an early result rejection from going unhandled, ensure `workflow/agent-start` never names an unpublished child, and prevent a child from publishing after its workflow has ended. @@ -758,9 +807,9 @@ The owner-final APIs express the actual strength required by each rule: restore Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Persona, tool filtering, and concurrent structured schemas would still require global mutation. -### Add scope semantics to vendored Cordis +### Put agent-scope policy inside vendored Cordis -Cordis already provides derived contexts, effect-owning fibers, and receiver-based listener filtering. The harness-level primitive combines those mechanisms without adding a framework fork whose synchronization cost would outlive this feature. +Cordis already provides derived contexts, effect-owning fibers, and receiver-based listener filtering, so the harness-level primitive composes those mechanisms instead of teaching the framework about agents, tools, prompts, or global-plus-scope resolution. The implementation does harden Cordis's domain-neutral lifecycle substrate: effects are owner-visible before setup callbacks, child fibers are parent-owned before publication, and an unloading fiber rejects registrations that missed its cleanup snapshot. Those rules are required by every plugin under reentrant HMR, not scope-specific policy pushed into the framework. ## Consequences @@ -772,8 +821,8 @@ The main benefit is one composition model across data, behavior, and lifetime: r - Plugin authors use the same registration APIs globally and per agent; only the context changes. - Registry-owned prompt schemas, executable lookup, Code Mode bindings, policy listeners, and UI presentation resolve from the same agent view. -- Create and resume expose no partially configured registry entry during awaited setup. -- Agent disposal revokes scoped contributions after the driver and all final or idle-injection session flushes have settled. +- Create and resume expose no partially configured registry entry during awaited setup, and overlapping caller/factory ownership leaves no gap between resume load, preparation failure, and the live lifecycle. +- Agent disposal revokes scoped contributions after the driver and all final or idle-injection session flushes have settled, and retains both public IDs until scope cleanup is quiescent. - Structured output composes per child without global mutation or listener-order assumptions. - Existing unscoped plugins remain deployment-wide contributors and observers. @@ -784,13 +833,14 @@ The costs are concentrated in dispatch discipline, per-scope registry state, and - Every scoped event dispatcher must carry the correct receiver; fused helpers, type markers, invariants, and gates exist because omission would otherwise deliver only to global listeners. - `agent.ctx` is capability-bearing. Its available services come from the agent loop's injected context, so holders receive that deliberate service surface. - Registries maintain per-scope maps and perform a global-plus-one-layer merge for the agent lifetime. -- The dispatch carrier is proxy-shaped and not identity-equal to its subject, even though method calls and property access behave like the subject. +- The dispatch carrier is proxy-shaped and not identity-equal to its subject, even though method calls and property access behave like the subject. Its composed filter is frozen, and defining a property through the carrier requires an explicitly configurable descriptor because the extensible surrogate cannot truthfully expose a new non-configurable subject property. - Flat scopes do not inherit parent capabilities; a desired child capability must be global or explicitly registered for the child. - `run_code` is protected transport infrastructure rather than a filterable end capability, so a policy that must forbid programs denies execution at the tool-policy layer instead of removing the transport from a Code Mode prompt. - Prompt protection restores named canonical contributions and their anchor placement, not the entire assembly; unprotected output remains extensible, while a globally protected section name is deliberately unavailable for scoped shadowing. - Terminal turn stopping has authority to discard pending steering. That power is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy. - Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The direct no-setup `ctx.agentLoop.create()` path, used by configuration and programmatic callers that already have complete options, remains synchronous. -- Ordered composition requires both an exact raw scope disposer and a shared public quiescence promise; the dual surface reflects two distinct Cordis lifecycle requirements. +- A programmatic agent is caller-owned but also structurally owned by its concrete AgentLoop provider. Reloading that provider tears the agent down even if a consumer still holds its handle, because the handle cannot keep the provider's dependency surface valid. +- Ordered composition requires exact raw effect identities plus shared public quiescence promises; the dual surfaces and lifecycle-long owner sentinels reflect distinct Cordis nesting and repeated-caller requirements. ### Deliberate boundaries diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts index af8e9905e4..942ec4efb4 100644 --- a/packages/cordis/tool-cordis/src/api-catalog.ts +++ b/packages/cordis/tool-cordis/src/api-catalog.ts @@ -57,8 +57,8 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ summary: 'The agent-loop plugin (`ctx.agentLoop`): creates ReactLoopAgents, runs their loops, and registers them in `ctx.agents`.', methods: [ 'create(id: AgentId, options: AgentOptions = {}, meta: Pick = {}): ReactLoopAgent', - 'async createAgent(options: CreateAgentOptions): Promise', - 'async resume(options: ResumeAgentOptions): Promise', + 'async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise', + 'async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise', ], }, { @@ -251,7 +251,7 @@ export const EVENT_API: readonly EventApiEntry[] = [ name: 'agent/disposed', mode: 'emit', signature: '\'agent/disposed\'(this: Scoped, agent: Agent): void', - summary: 'An agent was removed from the registry after its driver and any in-flight turn reached quiescence.', + summary: 'An agent was removed from the registry.', }, { name: 'agent/error', @@ -497,7 +497,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'AgentFactory', - declaration: 'export interface AgentFactory {\n createAgent(options: CreateAgentOptions): Promise;\n resume(options: ResumeAgentOptions): Promise;\n}', + declaration: 'export interface AgentFactory {\n createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise;\n resume(ownerCtx: Context, options: ResumeAgentOptions): Promise;\n}', }, { name: 'AgentHandle', diff --git a/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts b/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts new file mode 100644 index 0000000000..b290ae998e --- /dev/null +++ b/packages/cordis/tool-cordis/tests/cordis-lifecycle.spec.ts @@ -0,0 +1,287 @@ +import { Context, CordisError, FiberState, type Fiber } from 'cordis' +import { describe, expect, it } from 'vitest' + +/** + * Direct regressions for the vendored Cordis ownership substrate used by + * tool-cordis's dynamic plugin tree and every other harness plugin. + */ + +describe('Cordis effect ownership', () => { + it('makes an effect visible to a reentrant owner restart and awaits setup plus cleanup', async () => { + const ctx = new Context() + const setupGate = Promise.withResolvers() + const cleanupGate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let restarted!: Promise + let setupFinished = false + let cleanupFinished = false + + ctx.effect(async () => { + restarted = ctx.fiber.restart() + await setupGate.promise + setupFinished = true + return async () => { + cleanupStarted.resolve(undefined) + await cleanupGate.promise + cleanupFinished = true + } + }, 'reentrant-restart') + + let settled = false + void restarted.then(() => { settled = true }) + await Promise.resolve() + expect(settled).toBe(false) + + setupGate.resolve(undefined) + await cleanupStarted.promise + expect(setupFinished).toBe(true) + await Promise.resolve() + expect(settled).toBe(false) + + cleanupGate.resolve(undefined) + await restarted + expect(cleanupFinished).toBe(true) + expect(ctx.fiber.getEffects()).toEqual([]) + }) + + it('rolls back collected cleanup and its owner-list entry when setup throws synchronously', () => { + const ctx = new Context() + let cleanups = 0 + + expect(() => ctx.effect(function* () { + yield () => { cleanups += 1 } + throw new Error('setup failed') + }, 'throwing-setup')).toThrow('setup failed') + + expect(cleanups).toBe(1) + expect(ctx.fiber.getEffects()).toEqual([]) + }) + + it('makes a reentrant owner restart await asynchronous rollback after synchronous setup failure', async () => { + const ctx = new Context() + const cleanupGate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let restarted!: Promise + + expect(() => ctx.effect(function* () { + yield async () => { + cleanupStarted.resolve(undefined) + await cleanupGate.promise + } + restarted = ctx.fiber.restart() + throw new Error('setup failed after restart') + }, 'reentrant-throw')).toThrow('setup failed after restart') + + await cleanupStarted.promise + let settled = false + void restarted.then(() => { settled = true }) + await Promise.resolve() + expect(settled).toBe(false) + + cleanupGate.resolve(undefined) + await restarted + expect(ctx.fiber.getEffects()).toEqual([]) + }) + + it('keeps ordinary teardown synchronous and the public disposer single-shot', () => { + const ctx = new Context() + let cleanups = 0 + const dispose = ctx.effect(() => () => { cleanups += 1 }, 'sync-effect') + + expect(dispose()).toBeUndefined() + expect(cleanups).toBe(1) + expect(dispose()).toBeUndefined() + expect(cleanups).toBe(1) + expect(ctx.fiber.getEffects()).toEqual([]) + }) + + it('rejects cleanup-time registration while a restart is unloading', async () => { + const ctx = new Context() + let registrationError: unknown + + ctx.effect(() => () => { + try { + ctx.effect(() => () => {}, 'too-late') + } catch (error) { + registrationError = error + } + }, 'restart-cleanup') + + await ctx.fiber.restart() + expect(registrationError).toBeInstanceOf(CordisError) + expect((registrationError as CordisError).code).toBe('INACTIVE_EFFECT') + expect(ctx.fiber.state).toBe(FiberState.ACTIVE) + expect(ctx.fiber.getEffects()).toEqual([]) + }) + + it('keeps effect registration legal while child fibers are PENDING and LOADING', async () => { + const ctx = new Context() + let pendingCleanup = false + let loadingCleanup = false + + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'state-probe' || fiber.uid === null) return + expect(fiber.state).toBe(FiberState.PENDING) + fiber.ctx.effect(() => () => { pendingCleanup = true }, 'pending-effect') + }) + + const fiber = await ctx.plugin({ + name: 'state-probe', + apply(inner) { + expect(inner.fiber.state).toBe(FiberState.LOADING) + inner.effect(() => () => { loadingCleanup = true }, 'loading-effect') + }, + }) + await fiber.dispose() + + expect(pendingCleanup).toBe(true) + expect(loadingCleanup).toBe(true) + }) + + it('resolves dependencies that internal/plugin adds before child activation', async () => { + const ctx = new Context() + ctx.provide('late-inject', {}) + let applyCalls = 0 + + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'loader-shaped' || fiber.uid === null) return + fiber.inject['late-inject'] = {} + }) + + const fiber = await ctx.plugin({ + name: 'loader-shaped', + apply() { + applyCalls += 1 + }, + }) + + expect(applyCalls).toBe(1) + expect(fiber.state).toBe(FiberState.ACTIVE) + }) +}) + +describe('Cordis child publication ownership', () => { + it('rolls back parent and runtime ownership when internal/plugin publication throws', () => { + const ctx = new Context() + const plugin = { name: 'publication-failure', apply() {} } + ctx.on('internal/plugin', (fiber) => { + if (fiber.name === plugin.name) throw new Error('publication failed') + }) + + expect(() => ctx.plugin(plugin)).toThrow('publication failed') + expect(ctx.registry.has(plugin)).toBe(false) + }) + + it('contains teardown notification failures so ownership cleanup and peers complete', async () => { + const ctx = new Context() + const errors: unknown[] = [] + ctx.logger.error = ((error: unknown) => { errors.push(error) }) as typeof ctx.logger.error + const observed: string[] = [] + ctx.on('internal/plugin', (fiber) => { + if (fiber.name === 'contained-teardown' && fiber.uid === null) { + throw new Error('broken teardown observer') + } + }) + ctx.on('internal/plugin', (fiber) => { + if (fiber.name === 'contained-teardown' && fiber.uid === null) observed.push('disposed') + }) + const child = await ctx.plugin({ name: 'contained-teardown', apply() {} }) + + await expect(child.dispose()).resolves.toBeUndefined() + expect(observed).toEqual(['disposed']) + expect(errors).toHaveLength(1) + expect(errors[0]).toEqual(expect.objectContaining({ message: 'broken teardown observer' })) + expect(child.uid).toBeNull() + }) + + it('makes a LOADING parent join child cleanup started before its unload snapshot', async () => { + const ctx = new Context() + const cleanupGate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let ownerFiber!: Fiber + let ownerDisposal!: Promise + let childDisposal!: Promise + let childFiber!: Fiber + + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'loading-child' || fiber.uid === null) return + childFiber = fiber + fiber.ctx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await cleanupGate.promise + }, 'loading-child-cleanup') + ownerDisposal = ownerFiber.dispose() + childDisposal = Promise.resolve(fiber.dispose()) + }) + + const ownerMount = ctx.plugin({ + name: 'loading-owner', + apply(inner) { + ownerFiber = inner.fiber + inner.plugin({ name: 'loading-child', apply() {} }) + }, + }) + + await cleanupStarted.promise + let ownerSettled = false + void ownerDisposal.then(() => { ownerSettled = true }) + await Promise.resolve() + expect(ownerSettled).toBe(false) + + cleanupGate.resolve(undefined) + await Promise.all([ownerDisposal, childDisposal, ownerMount]) + expect(childFiber.uid).toBeNull() + expect(ownerFiber.uid).toBeNull() + }) + + it('lets parent disposal during internal/plugin await the unpublished child to quiescence', async () => { + const ctx = new Context() + let ownerCtx!: Context + const owner = await ctx.plugin({ + name: 'owner', + apply(inner) { + ownerCtx = inner + }, + }) + + const cleanupGate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let cleanupFinished = false + let childApplyCalls = 0 + let parentDisposal!: Promise + + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'child' || fiber.uid === null) return + expect(fiber.state).toBe(FiberState.PENDING) + fiber.ctx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await cleanupGate.promise + cleanupFinished = true + }, 'pending-child-cleanup') + }) + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'child' || fiber.uid === null) return + parentDisposal = owner.dispose() + }) + + const child = ownerCtx.plugin({ + name: 'child', + apply() { + childApplyCalls += 1 + }, + }) + + await cleanupStarted.promise + let settled = false + void parentDisposal.then(() => { settled = true }) + await Promise.resolve() + expect(settled).toBe(false) + + cleanupGate.resolve(undefined) + await parentDisposal + expect(cleanupFinished).toBe(true) + expect(childApplyCalls).toBe(0) + expect(child.uid).toBeNull() + expect(child.state).toBe(FiberState.DISPOSED) + }) +}) diff --git a/packages/core/agent-loop/README.md b/packages/core/agent-loop/README.md index a8da612305..daf7e10d76 100644 --- a/packages/core/agent-loop/README.md +++ b/packages/core/agent-loop/README.md @@ -8,7 +8,9 @@ This is the only package in the harness that contains concrete loop logic. Every ### Public API -Lifecycle (scoped): programmatic creation and resume snapshot caller-owned identity/configuration data, obtain registry/store-owned capabilities for both unpublished IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. The capabilities reject competing `register`/`enter`/`prepare`/`create` calls, so setup cannot publish the factory objects or same-id replacements. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume installs an owner-liveness sentinel before persistence load, captures each loaded metadata field once, then hands ownership directly to the full lifecycle. After setup resolves, the factory checks its lifecycle flag, owner-fiber state, and owning agent status around one microtask checkpoint so a same-turn Cordis unload wins before publication. Successful setup inserts both session and agent before announcing either, enables driving immediately before `agent/session-start`, then starts the loop. The concrete agent owns runtime-pinned `id`, frozen detached `options`, `session`, and `ctx` bindings. Load/setup rejection or owner unload publishes nothing; partial creation announcements are paired during rollback. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope. All non-vetoing `agent/*` notifications go through `agentEvents(ctx, agent)`, which contains sync/async listener failures per observer; per-step assembly goes through `assembleContextFor(agent)`; the turn-end durability checkpoint goes through `ctx.sessions.flush(session)`. +Lifecycle (scoped and dual-owned): programmatic creation and resume snapshot caller-owned identity/configuration data, obtain registry/store-owned capabilities for both unpublished IDs, mint `agent.ctx`, and install the ordered teardown skeleton before awaiting optional `setup`. `AgentFactory.createAgent(ownerCtx, options)` and `resume(ownerCtx, options)` receive caller ownership explicitly; the trace-bound `AgentLoop` receiver still supplies the dependency origin, so a caller that injects only `agents` can create an agent whose scope reaches the loop's `sessions`/`llm`/`tools`/`systemPrompt` surface. The caller owns cancellation and the returned handle, while AgentLoop remains a structural second owner because the live driver depends on that service surface: unloading the provider aborts pending load/setup, tears down live programmatic agents, and awaits the same quiescence and ID-release boundary before its dependencies disappear. + +The complete create transaction is factory-tracked before ID reservation/session validation, and both a factory placeholder and lifecycle-long caller sentinel exist before scope minting can reenter plugin lifecycle notifications. The caller sentinel adopts the exact reservation effects and always follows the memoized lifecycle boundary, including handle-first teardown followed by caller unload. Resume adds a load sentinel before persistence I/O; it waits for load settlement until `startOwned` synchronously returns a lifecycle/rollback disposer, then follows that disposer without a handoff gap. The ID capabilities reject competing `register`/`enter`/`prepare`/`create` calls and remain held through scope quiescence. A create hands one-read raw seed and metadata references synchronously to the session boundary, which rejects exotic shells and materializes accepted values in a single recursive pass; pre-cloning either value could incorrectly sanitize prototypes. Resume captures each loaded metadata field once. After setup resolves, the factory checks caller and provider liveness after constructing both registry entries but before the first announcement, after `session/created`, after `agent/created`, and again after `agent/session-start` before starting the driver, so synchronous getter- or listener-triggered teardown wins. A publication-wide barrier flips lifecycle liveness immediately but keeps both entries and `agent.ctx` intact until the current synchronous notification phase unwinds; only then does rollback revoke them. Registry/store entries claim IDs across caller-code commit windows, detach exact objects only, and reuse stable carriers for paired edges. Load/setup rejection or owner unload before announcement emits no creation edge; if teardown begins inside a creation or session-start listener, the already-started notifications are paired during rollback and no live or drivable publication survives. Teardown runs stop/drain (including outstanding idle-injection flushes) → unregister → detach session → unwind scope → release reservations. After quiescence, the caller sentinel and any resume-load sentinel disarm and remove their owner-fiber effects so a long-lived caller does not retain the completed agent and scope. Ordinary non-vetoing `agent/*` notifications go through `agentEvents(ctx, agent)`; the registry's paired disposal edge applies the same failure containment through its captured carrier. Per-step assembly goes through `assembleContextFor(agent)`, and the turn-end durability checkpoint goes through `ctx.sessions.flush(session)`. - `ctx.agentLoop.create(id: string, options?: AgentOptions, meta?: { cwd?: string }): ReactLoopAgent` — synchronous no-setup create, used directly by programs and by `cordis.yml`-configured agents. It creates a fresh per-run session id `${id}-session-` with optional metadata; the uuid avoids colliding with a prior durable log. Each call is a new session (a deliberate demo simplification — a real resume-or-create policy is a TODO). Disposed with the calling fiber. @@ -17,7 +19,7 @@ Lifecycle (scoped): programmatic creation and resume snapshot caller-owned ident - `ctx.agents.create({ agentId, sessionId, meta?, seed?, agentOptions?, setup? }): Promise` — programmatic create on a caller-supplied `sessionId`, NOT `${id}-session`. It awaits the unpublished setup transaction before returning; `meta` carries cwd/lineage/seed-boundary metadata and `seed` reconstructs a forked child prefix after the session boundary validates and detaches each raw value in one pass. The resolved [`AgentHandle`](../agent/README.md) owns exact teardown. - `ctx.agents.resume({ agentId, resumeSessionId, agentOptions?, setup? }): Promise` — load a persisted session via `ctx.sessionPersistence` ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), reconstruct its history, then await setup against a fresh unpublished agent scope before rollback-covered publication. The live session id is the resumed id; turn numbering and derived history continue from the loaded log. Requires a session-persistence backend (NOT hard-injected — non-persistent demos still work; `resume` rejects with a clear error when persistence is absent). Returns an `AgentHandle`. -The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle) — only the programmatic factory callers (the ACP bridge and in-process subagent backends) hold a handle and own per-agent teardown. +The config-driven `ctx.agentLoop.create()` path keeps its agent owned by the loop fiber (it discards the handle). For a programmatic agent, the handle holder is the only consumer-facing teardown capability; AgentLoop provider unload is the independent structural teardown edge, not another handle exposed to application code. ### Injected services diff --git a/packages/core/agent-loop/src/agent.ts b/packages/core/agent-loop/src/agent.ts index 3234a47939..6ea60c4958 100644 --- a/packages/core/agent-loop/src/agent.ts +++ b/packages/core/agent-loop/src/agent.ts @@ -25,18 +25,23 @@ const claimedDriverSessions = new WeakSet() /** Module-private driver entry: its symbol is absent from the package surface. */ const startDriver = Symbol('dsh.agent-loop.start-driver') +/** Module-private quiescent stop, valid both before and after driver start. */ +const stopDriver = Symbol('dsh.agent-loop.stop-driver') + /** Factory-owned controls that can operate only on the agent created with them. */ export interface PreparedReactLoopAgent { /** The unpublished concrete agent. */ agent: ReactLoopAgent /** Open its driving verbs at the rollback-covered publication boundary. */ enableDrive(): void + /** Stop the prepared instance even when publication has not started its loop. */ + dispose(): Promise | void /** * Start its driver after publication and session-start notification. * The returned disposer reaches quiescence for both the loop and every * fire-and-forget idle-injection flush the agent started. */ - startDriver(): () => Promise + startDriver(): () => Promise | void } /** @@ -56,12 +61,20 @@ export function prepareReactLoopAgent( if (claimedDriverSessions.has(session)) { throw new Error(`session "${session.id}" already has a concrete agent driver`) } - claimedDriverSessions.add(session) const agent = new ReactLoopAgent(ctx, id, options, session) + // Construction snapshots caller options and can throw. Claim only the fully + // initialized driver so the same prepared session remains retryable after a + // rejected caller value. + claimedDriverSessions.add(session) + const dispose = () => agent[stopDriver]() return { agent, enableDrive: () => { driveEnabledAgents.add(agent) }, - startDriver: () => agent[startDriver](), + dispose, + startDriver: () => { + agent[startDriver]() + return dispose + }, } } @@ -108,6 +121,8 @@ export class ReactLoopAgent implements Agent { private _status: AgentStatus = 'idle' private currentAbort: AbortController | undefined + /** Whether runLoop has been installed into {@link done}. */ + private driverStarted = false /** * Turn-scoped cancel marker, set by {@link cancel} and read/cleared by the * driver loop (via the LoopHandle) at every point a turn could start or @@ -361,17 +376,13 @@ export class ReactLoopAgent implements Agent { } /** - * Start the driver loop. Returns a disposer: calling it sets status to - * `disposed`, emits `agent/status('disposed')`, resolves the disposed - * promise (unblocking the idle wait), releases any `whenIdle` waiters, and - * aborts the current request if any. Its returned promise resolves only after - * the loop exits and every idle-injection flush started by this agent settles. - * @returns the disposer — idempotent, synchronously marks the agent disposed, - * and asynchronously reaches loop + flush quiescence without rejecting (it - * runs inside the fiber's LIFO disposal chain, where a rejection would skip - * later disposers). + * Start the driver loop. The prepared controller already owns its stable + * disposer, so teardown can mark the agent disposed even in the narrow + * publication window before this method runs. */ - [startDriver](): () => Promise { + [startDriver](): void { + if (this._status === 'disposed') return + this.driverStarted = true this.done = runLoop(this.loopCtx, this, { inbox: this.#inbox, setStatus: (status) => { this.setStatus(status) }, @@ -389,35 +400,50 @@ export class ReactLoopAgent implements Agent { // that would resolve a freshly-queued prompt as cancelled. settleIdle: () => { this.settleIdleWaiters() }, }) - // The disposer must be infallible: it runs inside the fiber's LIFO - // disposal chain, where a throw would skip later disposers (e.g. the - // registry unregistration) and leave `done` pending forever. - return async () => { - if (this._status !== 'disposed') { - this._status = 'disposed' - this.resolveDisposed() - // Release whenIdle waiters BEFORE the (guarded) event emit — they are - // internal state that must settle even if a listener throws below. Each - // waiter chains `done`, so it resolves only once the loop actually exits. - this.settleIdleWaiters() - this.currentAbort?.abort('disposed') - // setStatus refuses transitions out of 'disposed', so emit directly — - // 'disposed' is part of the agent/status contract. Guarded: a throwing - // listener must not break the disposal chain. + } + + /** + * Quiescent stop shared by pre-start rollback and live teardown. It marks the + * agent disposed synchronously, contains an unexpected loop rejection, and + * drains every idle-injection flush before resolving. + */ + private [stopDriver](): Promise | void { + if (this._status !== 'disposed') { + this._status = 'disposed' + this.resolveDisposed() + // Release whenIdle waiters BEFORE the (guarded) event emit — they are + // internal state that must settle even if a listener throws below. Each + // waiter chains `done`, so it resolves only once the loop actually exits. + this.settleIdleWaiters() + this.currentAbort?.abort('disposed') + // An unpublished rollback has no public status lifecycle to announce. + // Once driving is enabled, disposed is part of the agent/status contract. + if (driveEnabledAgents.has(this)) { agentEvents(this.loopCtx, this).emit('agent/status', 'disposed') } - // An unexpected driver rejection must not skip registry/session/scope - // cleanup. The normal loop contains turn failures itself; allSettled is the - // final lifecycle backstop for anything outside those boundaries. - await Promise.allSettled([this.done]) - // No new inject() can start after the synchronous disposed transition. - // Loop because settled tasks retire themselves in promise reactions that - // may run beside this continuation; either the set is empty or this waits - // the exact remaining quiescence boundary. allSettled keeps a failure in - // error reporting from skipping the registry/session/scope disposers. - while (this.pendingIdleFlushes.size > 0) { - await Promise.allSettled([...this.pendingIdleFlushes]) - } + } + // Before runLoop starts there is normally nothing asynchronous to drain; + // keep publication rollback synchronous so create() cannot throw while its + // session/agent entries are still briefly live. A session-start listener + // may have used the newly enabled inject() surface, however, so preserve + // its durability checkpoint as a real quiescence boundary. + if (!this.driverStarted && this.pendingIdleFlushes.size === 0) return + return this.drainDriver() + } + + /** Await the loop (when started) and every outstanding idle flush. */ + private async drainDriver(): Promise { + // An unexpected driver rejection must not skip registry/session/scope + // cleanup. The normal loop contains turn failures itself; allSettled is the + // final lifecycle backstop for anything outside those boundaries. + await Promise.allSettled([this.done]) + // No new inject() can start after the synchronous disposed transition. + // Loop because settled tasks retire themselves in promise reactions that + // may run beside this continuation; either the set is empty or this waits + // the exact remaining quiescence boundary. allSettled keeps a failure in + // error reporting from skipping registry/session/scope disposers. + while (this.pendingIdleFlushes.size > 0) { + await Promise.allSettled([...this.pendingIdleFlushes]) } } } diff --git a/packages/core/agent-loop/src/index.ts b/packages/core/agent-loop/src/index.ts index 902e1e2185..8722751962 100644 --- a/packages/core/agent-loop/src/index.ts +++ b/packages/core/agent-loop/src/index.ts @@ -7,7 +7,7 @@ * @module @deepseek-ai/dsh-agent-loop */ -import { Context, FiberState, Service } from 'cordis' +import { Context, CordisError, FiberState, Service, symbols } from 'cordis' import { randomUUID } from 'node:crypto' import z from 'schemastery' import { createScope } from '@deepseek-ai/dsh-scope' @@ -31,6 +31,81 @@ interface RegistrationReservations { release(): void } +/** A synchronously established ownership handoff plus its async publication result. */ +interface OwnedAgentStart { + result: Promise + dispose: () => Promise +} + +/** Internal carrier for a preparation error whose rollback still has to quiesce. */ +class LifecyclePreparationFailure extends Error { + constructor( + readonly reason: unknown, + readonly dispose: () => Promise, + ) { + super('agent lifecycle preparation failed', { cause: reason }) + this.name = 'LifecyclePreparationFailure' + } +} + +/** Stable construction-time state shared by every traceable AgentLoop receiver. */ +interface FactoryOwnership { + isActive(): boolean + track(dispose: () => Promise): () => void + dispose(): Promise +} + +/** Fiber states in which a concrete factory cannot safely serve dependencies. */ +const INACTIVE_FACTORY_STATES: ReadonlySet = new Set([ + FiberState.UNLOADING, + FiberState.DISPOSED, + FiberState.FAILED, +]) + +/** Build a tamper-resistant controller around one factory's private ledger. */ +function createFactoryOwnership(fiber: Context['fiber']): FactoryOwnership { + let accepting = true + const transactions = new Set<() => Promise>() + const isActive = (): boolean => accepting && !INACTIVE_FACTORY_STATES.has(fiber.state) + return Object.freeze({ + isActive, + track(dispose: () => Promise): () => void { + /* v8 ignore next -- every call site checks the same controller immediately + * before this synchronous, non-reentrant insertion; retain the guard as an invariant */ + if (!isActive()) throw new Error('agent loop is not active') + transactions.add(dispose) + return () => { transactions.delete(dispose) } + }, + async dispose(): Promise { + accepting = false + const disposers = [...transactions] + transactions.clear() + const results = await Promise.allSettled(disposers.map(dispose => Promise.resolve().then(dispose))) + /* v8 ignore next -- tracked lifecycle/load boundaries are deliberately + * infallible; keep reasons if that lower-level contract ever breaks */ + const errors = results.flatMap(result => result.status === 'rejected' ? [result.reason as unknown] : []) + /* v8 ignore next -- every tracked boundary is deliberately infallible; + * preserve an exact unexpected single failure as a defensive backstop */ + if (errors.length === 1) throw errors[0] + /* v8 ignore next -- multiple failures require multiple contract-breaking + * lifecycle disposers, but teardown must still retain every cause */ + if (errors.length > 1) throw new AggregateError(errors, 'agent loop transaction disposal failed') + }, + }) +} + +/** Private ownership controllers keyed by the concrete, unproxied service. */ +const factoryOwnerships = new WeakMap() + +/** Recover the stable controller when a Cordis trace proxy is the receiver. */ +function factoryOwnershipFor(loop: AgentLoop): FactoryOwnership { + const original = (loop as AgentLoop & { [symbols.original]?: AgentLoop })[symbols.original] ?? loop + // Installed immediately after Service construction, before AgentLoop starts + // any effect or config-driven transaction. + // eslint-disable-next-line @typescript-eslint/no-non-null-assertion + return factoryOwnerships.get(original)! +} + declare module 'cordis' { interface Context { agentLoop: AgentLoop @@ -94,6 +169,13 @@ export class AgentLoop extends Service implements AgentFactory { constructor(ctx: Context, public config: Config) { super(ctx, 'agentLoop') + const factoryOwnership = createFactoryOwnership(ctx.fiber) + factoryOwnerships.set(this, factoryOwnership) + // Programmatic agents are caller-owned, but this implementation is their + // dependency provider too. Retain a second ownership edge so unloading the + // loop aborts unpublished work and drains every live lifecycle before its + // service surface disappears. + ctx.effect(() => () => factoryOwnership.dispose(), 'agentLoop.factoryTransactions()') // Provide the agent-creation factory to the registry (effect-scoped: the // slot is cleared on dispose). ctx.effect(() => this.ctx.agents.setFactory(this), 'agentLoop.setFactory()') @@ -118,7 +200,11 @@ export class AgentLoop extends Service implements AgentFactory { // failed resume is contained + logged: startup must not crash. ctx.effect(() => { const fiber = this.ctx.inject(['sessionPersistence'], (childCtx: Context) => { - void this.resumeWith(childCtx.sessionPersistence, { agentId: id, resumeSessionId, agentOptions: options }) + void this.resumeWith(ctx, childCtx.sessionPersistence, { + agentId: id, + resumeSessionId, + agentOptions: options, + }) .catch((error: unknown) => { this.ctx.logger.warn(`agent "${id}": config-driven resume of "${resumeSessionId}" failed: ${String(error)}`) }) @@ -135,6 +221,22 @@ export class AgentLoop extends Service implements AgentFactory { } } + /** Whether this concrete factory may begin or publish more work. */ + private factoryIsActive(): boolean { + return factoryOwnershipFor(this).isActive() + } + + /** Reject a call that raced the concrete loop's unload boundary. */ + private assertFactoryActive(): void { + if (this.factoryIsActive()) return + throw new Error('agent loop is not active') + } + + /** Add one memoized quiescence boundary to the factory's ownership set. */ + private trackFactoryTransaction(dispose: () => Promise): () => void { + return factoryOwnershipFor(this).track(dispose) + } + /** * Config-driven create: an agent on a FRESH, non-colliding session id per run * (`${id}-session-`). Used for `cordis.yml`-configured agents and as @@ -162,13 +264,17 @@ export class AgentLoop extends Service implements AgentFactory { // lifecycle into the agent's composite effect (so a fiber unload tears the // session + agent down as one ordered chain, capturing the loop's closing // flush). The whole effect is owned by THIS fiber; no AgentHandle is needed. + let session: Session try { - const session = reservations.session.prepare({ meta }) - const { agent } = this.start(id, options, session, 'startup', reservations) - return agent - } finally { + session = reservations.session.prepare({ meta }) + } catch (error: unknown) { reservations.release() + throw error } + // start() accepts ownership of both reservation capabilities even when + // synchronous preparation fails; its rollback releases them at quiescence. + const { agent } = this.start(id, options, session, 'startup', reservations) + return agent } /** @@ -180,11 +286,13 @@ export class AgentLoop extends Service implements AgentFactory { * `seed` (a balanced completed-turn prefix of the parent's log) so the child * starts with the parent's context. Returns an {@link AgentHandle} the owner * disposes to tear down exactly this agent. + * @param ownerCtx - the caller context that owns setup and the live lifecycle. * @param options - agent id, caller-supplied session id, optional seed/meta, * and agent options. * @returns the handle whose dispose tears down exactly this agent. */ - async createAgent(options: CreateAgentOptions): Promise { + async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise { + this.assertFactoryActive() // Snapshot every caller-owned field before the first async setup boundary. // The callback itself is an identity capability. Agent options detach here; // seed and metadata stay raw only until sessions.prepare() synchronously @@ -196,16 +304,32 @@ export class AgentLoop extends Service implements AgentFactory { const agentOptions = structuredClone(options.agentOptions ?? {}) const seed = options.seed const meta = options.meta - const reservations = this.reserve(agentId, sessionId) + // Snapshot accessors can reenter plugin teardown; do not reserve identities + // after the dependency provider has begun unloading. + this.assertFactoryActive() + const { promise: transactionSettled, resolve: markTransactionSettled } = Promise.withResolvers() + const disposeCreateForFactory = (): Promise => transactionSettled + const untrackFactoryCreate = this.trackFactoryTransaction(disposeCreateForFactory) try { - const session = reservations.session.prepare({ - ...seed !== undefined ? { seed } : {}, - ...meta !== undefined ? { meta } : {}, - }) - // A seeded (forked) create is still a fresh start, NOT a resume. - return await this.startOwned(agentId, agentOptions, session, 'startup', reservations, setup) + const reservations = this.reserve(agentId, sessionId) + let lifecycleStarted = false + try { + const session = reservations.session.prepare({ + ...seed !== undefined ? { seed } : {}, + ...meta !== undefined ? { meta } : {}, + }) + // A seeded (forked) create is still a fresh start, NOT a resume. + lifecycleStarted = true + return await this.startOwned(ownerCtx, agentId, agentOptions, session, 'startup', reservations, setup).result + } finally { + // Once startOwned is invoked, even a preparation failure carries its + // own quiescent rollback boundary. Only failures before that handoff + // release directly here. + if (!lifecycleStarted) reservations.release() + } } finally { - reservations.release() + markTransactionSettled() + untrackFactoryCreate() } } @@ -220,10 +344,12 @@ export class AgentLoop extends Service implements AgentFactory { * configured. NOT hard-injected (that would make non-persistent demos pend * forever) — callers that need resume (ACP) inject `sessionPersistence`, so * by the time this runs the service exists. + * @param ownerCtx - the caller context that owns load, setup, and the live lifecycle. * @param options - the persisted session id to reload, plus agent id/options. * @returns the handle for the agent resumed on the reconstructed session. */ - async resume(options: ResumeAgentOptions): Promise { + async resume(ownerCtx: Context, options: ResumeAgentOptions): Promise { + this.assertFactoryActive() // Read the service through `ctx.get('sessionPersistence')` — a direct // global-store lookup keyed by the isolate symbol — NOT // `this.ctx.sessionPersistence`. AgentLoop deliberately does NOT inject @@ -243,7 +369,7 @@ export class AgentLoop extends Service implements AgentFactory { if (persistence === undefined) { throw new Error('cannot resume: session persistence is not configured (load a dsh-session-persistence backend)') } - return this.resumeWith(persistence, options) + return this.resumeWith(ownerCtx, persistence, options) } /** @@ -255,7 +381,7 @@ export class AgentLoop extends Service implements AgentFactory { * sessions store + registry are still read through `this.ctx` (both are in * AgentLoop's static inject, so they resolve fine). */ - private async resumeWith(persistence: SessionPersistence, options: ResumeAgentOptions): Promise { + private async resumeWith(ownerCtx: Context, persistence: SessionPersistence, options: ResumeAgentOptions): Promise { // Persistence is an async trust boundary. Reserve, load, reconstruct, and // publish only the identities/options accepted at entry—never fields // reread from a caller-owned object after the await. @@ -263,25 +389,65 @@ export class AgentLoop extends Service implements AgentFactory { const sessionId = options.resumeSessionId const agentOptions = structuredClone(options.agentOptions ?? {}) const setup = options.setup + // Caller-owned accessors above are a synchronous reentrancy boundary: one + // can begin factory unload while options are snapshotted. Re-check before + // installing either ownership sentinel, so a rejected transaction leaves + // no orphan effect or unresolved settlement promise. + this.assertFactoryActive() const { promise: ownerDisposed, resolve: markOwnerDisposed } = Promise.withResolvers() const { promise: transactionSettled, resolve: markTransactionSettled } = Promise.withResolvers() let observingOwner = true // Resume must observe its caller from BEFORE persistence I/O begins. The // full agent lifecycle does not exist until load returns, so without this // sentinel a never-settling backend outlives owner disposal and holds both - // public identities forever. `this.ctx.effect` retains the traceable caller - // ownership used by startOwned's lifecycle effect. Install it before even - // reserving the ids: an inactive owner cannot leak a reservation if effect - // registration fails. - const disposeLoadSentinel = this.ctx.effect(() => () => { - if (!observingOwner) return + // public identities forever. The caller-bound effect retains the same owner + // later used by startOwned's lifecycle effect and adopts both reservation + // disposers before persistence I/O begins. + let lifecycleBoundary: (() => Promise) | undefined + let disposingForFactory: Promise | undefined + const disposeLoadForFactory = (): Promise => (disposingForFactory ??= (async () => { markOwnerDisposed() - // Owner-triggered teardown does not reach quiescence until the resume - // transaction has observed disposal and released both reservations. - return transactionSettled - }, `agentLoop.resumeLoad(${agentId})`) + await transactionSettled + })()) + let untrackFactoryLoad: (() => void) | undefined + let disposeLoadSentinel: (() => Promise | void) | undefined + let loadSentinelRetired = false + const retireLoadSentinel = (): void => { + /* v8 ignore next -- every lifecycle/rollback boundary is memoized and + * invokes its after-quiescence hook once; retain idempotence defensively */ + if (loadSentinelRetired) return + // Disarm the follower before invoking its wrapper: retirement can happen + // from inside the lifecycle it used to follow, so recursing into that + // same boundary here would deadlock final teardown. + loadSentinelRetired = true + observingOwner = false + void disposeLoadSentinel?.() + } + let reservations: RegistrationReservations | undefined + let lifecycleStarted = false try { - const reservations = this.reserve(agentId, sessionId) + reservations = this.reserve(agentId, sessionId) + const ownedReservations = reservations + // Move both reservation effects under a sentinel BEFORE persistence I/O. + // Its first teardown stage either aborts/waits for the load transaction + // or follows the full lifecycle after handoff; only then do the exact + // reservation disposers run. They therefore cannot race ahead as owner + // siblings and reopen ids while load/setup/scope cleanup is still live. + disposeLoadSentinel = ownerCtx.effect(function* () { + // eslint-disable-next-line @typescript-eslint/unbound-method -- exact effect-disposer identity is the ownership contract + yield ownedReservations.agent.release + // eslint-disable-next-line @typescript-eslint/unbound-method -- exact effect-disposer identity is the ownership contract + yield ownedReservations.session.release + yield () => { + if (loadSentinelRetired) return + if (observingOwner) { + markOwnerDisposed() + return transactionSettled + } + return lifecycleBoundary?.() + } + }, `agentLoop.resumeLoad(${agentId})`) + untrackFactoryLoad = this.trackFactoryTransaction(disposeLoadForFactory) try { const loadTask = persistence.load(sessionId) const { meta, events } = await Promise.race([ @@ -309,16 +475,26 @@ export class AgentLoop extends Service implements AgentFactory { ...seedLength !== undefined ? { seedLength } : {}, }, }) - // Calling startOwned synchronously installs the complete lifecycle - // effect before it reaches its first setup await. Only then disarm the - // load sentinel: ownership passes directly from one effect to the other - // with no disposal gap. - const starting = this.startOwned(agentId, agentOptions, session, 'resume', reservations, setup) + // startOwned synchronously returns either the complete lifecycle or a + // preparation-rollback boundary before its result reaches the first + // setup await. Retarget the lifecycle-long load sentinel to that disposer; + // ownership overlaps instead of creating a gap. + lifecycleStarted = true + const starting = this.startOwned( + ownerCtx, + agentId, + agentOptions, + session, + 'resume', + reservations, + setup, + retireLoadSentinel, + ) + lifecycleBoundary = starting.dispose observingOwner = false - await disposeLoadSentinel() - return await starting + return await starting.result } finally { - reservations.release() + if (!lifecycleStarted) reservations.release() } } finally { try { @@ -327,10 +503,18 @@ export class AgentLoop extends Service implements AgentFactory { // owner already triggered cleanup, this idempotent second disposal is a // no-op and the owner's first cleanup remains parked on the shared // settlement promise. - observingOwner = false - await disposeLoadSentinel() + if (!lifecycleStarted) { + // Covers reserve succeeding but sentinel/factory tracking failing + // before the inner load transaction begins. + reservations?.release() + // A failed pre-lifecycle transaction has already released directly; + // retire the sentinel so it cannot remain as a stale owner effect. + retireLoadSentinel() + await disposeLoadSentinel?.() + } } finally { markTransactionSettled() + untrackFactoryLoad?.() } } } @@ -358,17 +542,20 @@ export class AgentLoop extends Service implements AgentFactory { /** * Construct an unpublished agent and synchronously install its complete - * teardown skeleton before any setup await. The closures are assigned their - * session/registry/loop disposers only at publication, while the exact scope - * disposer is nested immediately. Therefore owner unload during setup flips - * `active`, unwinds the scope, and wins the race without any late Cordis - * effect collection. + * teardown skeleton before any setup await. A lifecycle-long caller sentinel and + * factory placeholder exist before driver/scope construction; the closures + * receive their session/registry/loop disposers only at publication, while + * the exact scope disposer is nested as soon as construction returns. Owner + * unload during preparation or setup therefore follows a real rollback + * boundary, flips liveness, and wins without late Cordis effect collection. */ private prepareLifecycle( + ownerCtx: Context, id: AgentId, options: AgentOptions, session: Session, reservations: RegistrationReservations, + afterQuiescence?: () => void, ): { agent: ReactLoopAgent active: () => boolean @@ -381,77 +568,266 @@ export class AgentLoop extends Service implements AgentFactory { // than Cordis reaches nested scope effects. Include that signal in the // pre-publication liveness check so a same-turn parent dispose cannot race // an already-fulfilled setup promise into briefly publishing a child. - const ownerAgent = this.ctx.agent - const ownerFiber = this.ctx.fiber - const driver = prepareReactLoopAgent(this.ctx, id, options, session) - const { agent } = driver - const scope: Scope = createScope(this.ctx, agent) - bindReactLoopAgentContext(agent, scope.ctx.extend({ agent })) - - let active = true - let detachSession: (() => void) | undefined - let detachAgent: (() => void) | undefined - let stop: (() => Promise) | undefined - const { promise: deactivated, resolve: markDeactivated } = Promise.withResolvers() - const { promise: torndown, resolve: markTorndown } = Promise.withResolvers() - - const dispose = this.ctx.effect(function* () { - // First yielded, disposed last: every preceding teardown stage settled. - yield () => { markTorndown() } - // Exact identity moves the scope fiber out of the owner's concurrent - // sibling list and into this ordered transaction. - yield scope.rawDispose - yield () => { - detachSession?.() - detachSession = undefined - } - yield () => { - detachAgent?.() - detachAgent = undefined - } - // Last yielded, disposed first. Keep the pre-publication path - // synchronous: returning a Promise only after the loop actually began - // lets a failed announcement roll back registry/store before create's - // rejection is observed. - yield () => { - active = false - markDeactivated() - if (stop === undefined) return - return stop() - } - }, 'agentLoop.lifecycle()') - - let disposing: Promise | undefined - const disposeAgent = (): Promise => (disposing ??= (async () => { - await dispose() - await torndown - })()) - - const publish = (source: SessionStartSource): void => { - // Publication is one synchronous, rollback-covered sequence. Setup has - // already completed, so its scoped listeners observe both announcements. - detachSession = agent.ctx.sessions.enter(session, reservations.session) - detachAgent = this.ctx.agents.enter(agent, reservations.agent) - this.ctx.sessions.announce(session) - this.ctx.agents.announce(agent) - // Setup is over and both entries are live. Open the driving surface just - // before session-start so its listeners retain their supported ability to - // inject/queue, while setup itself can never drive an unpublished agent. - driver.enableDrive() - agentEvents(this.ctx, agent).emit('agent/session-start', source) - stop = driver.startDriver() + let ownerAgent: Context['agent'] + let ownerFiber: Context['fiber'] + try { + this.assertFactoryActive() + ownerCtx.fiber.assertActive() + ownerAgent = ownerCtx.agent + ownerFiber = ownerCtx.fiber + } catch (error: unknown) { + reservations.release() + afterQuiescence?.() + const dispose = (): Promise => Promise.resolve() + throw new LifecyclePreparationFailure(error, dispose) } - return { - agent, - active: () => active + // Establish BOTH ownership edges before driver preparation or scope + // minting can publish an internal lifecycle notification. The lifecycle-long + // caller sentinel also adopts the exact reservation effects: owner unload + // first waits for the memoized lifecycle boundary, then reaches those + // capabilities, so IDs cannot reopen while scope cleanup is still live. + const { promise: lifecycleReady, resolve: markLifecycleReady } + = Promise.withResolvers<() => Promise>() + const { promise: deactivated, resolve: markDeactivated } = Promise.withResolvers() + let ownerDisposed = false + const ownerIsDisposed = (): boolean => ownerDisposed + let ownerSentinelRetired = false + let disposeOwnerSentinel: () => Promise | void + try { + disposeOwnerSentinel = ownerCtx.effect(function* () { + // eslint-disable-next-line @typescript-eslint/unbound-method -- exact effect-disposer identity is the ownership contract + yield reservations.agent.release + // eslint-disable-next-line @typescript-eslint/unbound-method -- exact effect-disposer identity is the ownership contract + yield reservations.session.release + yield () => { + if (ownerSentinelRetired) return + ownerDisposed = true + markDeactivated() + return lifecycleReady.then(disposeLifecycle => disposeLifecycle()) + } + }, `agentLoop.ownerLifecycle(${id})`) + } catch (error: unknown) { + reservations.release() + afterQuiescence?.() + const dispose = (): Promise => Promise.resolve() + markLifecycleReady(dispose) + // The only callback-free effect-install failure is Cordis's inactive + // owner boundary; preserve the original value as cause for diagnostics. + const reportedError = new Error(`agent "${id}" setup aborted: owner disposed during setup`, { cause: error }) + throw new LifecyclePreparationFailure(reportedError, dispose) + } + let disposingForFactory: Promise | undefined + const disposeForFactory = (): Promise => (disposingForFactory ??= (async () => { + const disposeLifecycle = await lifecycleReady + await disposeLifecycle() + })()) + let untrackFactory: () => void + try { + untrackFactory = this.trackFactoryTransaction(disposeForFactory) + } catch (error: unknown) { + /* v8 ignore start -- no callback boundary exists between the active + * factory check, sentinel installation, and this synchronous ledger insert */ + let cleanupTask: Promise | undefined + const cleanup = (): Promise => (cleanupTask ??= Promise.resolve().then(() => { + reservations.release() + afterQuiescence?.() + })) + markLifecycleReady(cleanup) + void disposeOwnerSentinel() + throw new LifecyclePreparationFailure(error, cleanup) + /* v8 ignore stop */ + } + + let scope: Scope | undefined + let stopPrepared: (() => Promise | void) | undefined + let disposeAgent: (() => Promise) | undefined + try { + const driver = prepareReactLoopAgent(this.ctx, id, options, session) + stopPrepared = () => driver.dispose() + const { agent } = driver + scope = createScope(this.ctx, agent) + const lifecycleScope = scope + if (ownerIsDisposed() || !this.factoryIsActive() + || ownerFiber.state === FiberState.UNLOADING + || ownerFiber.state === FiberState.DISPOSED + || ownerFiber.state === FiberState.FAILED + || ownerAgent?.status === 'disposed') { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + bindReactLoopAgentContext(agent, lifecycleScope.ctx.extend({ agent })) + + let active = true + let detachSession: (() => void) | undefined + let detachAgent: (() => void) | undefined + const stop = stopPrepared + const { promise: torndown, resolve: markTorndown } = Promise.withResolvers() + const { promise: publicationSettled, resolve: markPublicationSettled } = Promise.withResolvers() + let publishing = false + + const dispose = ownerCtx.effect(function* () { + // First yielded, disposed last: every preceding teardown stage settled. + yield () => { + // Reservation ownership is part of lifecycle settlement: a factory + // unload that awaited this disposer may reuse both ids immediately. + reservations.release() + // Retire both follower effects only after quiescence reached this final + // stage. Their retired branches skip recursively disposing this same + // lifecycle while their exact reservation children are already inert. + ownerSentinelRetired = true + void disposeOwnerSentinel() + afterQuiescence?.() + untrackFactory() + markTorndown() + } + // Exact identity moves the scope fiber out of the owner's concurrent + // sibling list and into this ordered transaction. + yield lifecycleScope.rawDispose + yield () => { + detachSession?.() + detachSession = undefined + } + yield () => { + detachAgent?.() + detachAgent = undefined + } + // Last yielded, disposed first. Keep the pre-publication path + // synchronous: returning a Promise only after the loop actually began + // lets a failed announcement roll back registry/store before create's + // rejection is observed. + yield () => { + active = false + markDeactivated() + // A listener can begin owner teardown reentrantly. Flip liveness now + // so publish's next checkpoint aborts, but keep both registry entries + // and the scope intact until the current synchronous publication + // phase has unwound. + if (publishing) return publicationSettled.then(stop) + return stop() + } + }, 'agentLoop.lifecycle()') + + let disposing: Promise | undefined + disposeAgent = (): Promise => (disposing ??= (async () => { + await dispose() + await torndown + })()) + markLifecycleReady(disposeAgent) + + const isActive = (): boolean => active + && !ownerIsDisposed() + && this.factoryIsActive() && ownerFiber.state !== FiberState.UNLOADING && ownerFiber.state !== FiberState.DISPOSED && ownerFiber.state !== FiberState.FAILED - && ownerAgent?.status !== 'disposed', - deactivated, - publish, - disposeAgent, + && ownerAgent?.status !== 'disposed' + + const publish = (source: SessionStartSource): void => { + publishing = true + try { + /* v8 ignore next 3 -- both callers check active immediately before + * this callback-free synchronous publish entry */ + if (!isActive()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + // Publication is one synchronous, rollback-covered sequence. Setup has + // already completed, so its scoped listeners observe both announcements. + detachSession = agent.ctx.sessions.enter(session, reservations.session) + detachAgent = this.ctx.agents.enter(agent, reservations.agent) + // Both enter() calls capture stable dispatch carriers and therefore + // evaluate a caller-owned Context.filter. A getter can begin teardown; + // entries exist for rollback, but no creation edge may escape afterward. + if (!isActive()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + this.ctx.sessions.announce(session) + // Session listeners can dispose an owner. Finish that dispatch while + // both entries/scope remain live, then skip the agent edge entirely. + if (!isActive()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + this.ctx.agents.announce(agent) + // Creation listeners may synchronously dispose either owner. Cordis + // flips the relevant fiber state before it invokes nested effects, so + // re-check here and never unlock a driver after teardown began. + if (!isActive()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + // Setup is over and both entries are live. Open the driving surface just + // before session-start so its listeners retain their supported ability to + // inject/queue, while setup itself can never drive an unpublished agent. + driver.enableDrive() + agentEvents(this.ctx, agent).emit('agent/session-start', source) + // session-start is the final synchronous listener boundary before the + // loop begins. Teardown there must win just like teardown from either + // creation announcement; the prebuilt driver disposer makes rollback + // quiescent even though the loop never started. + if (!isActive()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } + driver.startDriver() + } finally { + publishing = false + markPublicationSettled() + } + } + + return { + agent, + active: isActive, + deactivated, + publish, + disposeAgent, + } + } catch (error: unknown) { + // Preparation failed before startOwned received a lifecycle object. Give + // a factory unload that already captured the placeholder a real boundary, + // and retire the entry only after the minted scope (if any) is quiescent. + const failedScope = scope + const ownershipInactive = ownerIsDisposed() || ownerFiber.uid === null || !this.factoryIsActive() + || ownerFiber.state === FiberState.UNLOADING + || ownerFiber.state === FiberState.DISPOSED + || ownerFiber.state === FiberState.FAILED + || ownerAgent?.status === 'disposed' + const reportedError = ownershipInactive && error instanceof CordisError + ? new Error(`agent "${id}" setup aborted: owner disposed during setup`, { cause: error }) + : error + let fallbackTask: Promise | undefined + const cleanup = disposeAgent ?? (() => (fallbackTask ??= (async () => { + try { + await stopPrepared?.() + } finally { + try { + await failedScope?.dispose() + } finally { + // Factory and caller quiescence include the prepared driver, + // minted scope, and both unpublished identities even when the + // complete lifecycle effect could not be installed. + reservations.release() + afterQuiescence?.() + } + } + })())) + markLifecycleReady(cleanup) + const cleanupTask = cleanup() + // Retire the provisional owner edge. If owner unload already claimed it, + // this is an inert repeat and that first caller is following cleanupTask. + void disposeOwnerSentinel() + void cleanupTask.then( + untrackFactory, + /* v8 ignore next -- Scope.dispose is specified to contain child + * failures; preserve diagnostics if that lower-level contract breaks */ + (cleanupError: unknown) => { + untrackFactory() + try { + this.ctx.logger.error(new AggregateError([reportedError, cleanupError], 'agent lifecycle preparation and rollback failed')) + } catch { + // Only a logger-export failure is swallowed: the original + // preparation error is already propagating to the caller. + } + }, + ) + throw new LifecyclePreparationFailure(reportedError, cleanup) } } @@ -463,7 +839,16 @@ export class AgentLoop extends Service implements AgentFactory { source: SessionStartSource, reservations: RegistrationReservations, ): { agent: ReactLoopAgent; disposeAgent: () => Promise } { - const lifecycle = this.prepareLifecycle(id, options, session, reservations) + let lifecycle: ReturnType + try { + lifecycle = this.prepareLifecycle(this.ctx, id, options, session, reservations) + } catch (error: unknown) { + /* v8 ignore next -- prepareLifecycle converts every failure into its + * rollback-bearing internal error before crossing this boundary */ + if (!(error instanceof LifecyclePreparationFailure)) throw error + void error.dispose() + throw error.reason + } try { lifecycle.publish(source) return { agent: lifecycle.agent, disposeAgent: lifecycle.disposeAgent } @@ -477,10 +862,10 @@ export class AgentLoop extends Service implements AgentFactory { * Build an {@link AgentHandle} for a PREPARED session + a fresh agent. The * handle's `dispose()` runs the composite effect's disposer (see * {@link start}) — which stops the loop, awaits its exit and outstanding - * idle-injection flushes, unregisters the agent, and detaches the session, in - * that order. - * The same composite effect is what a fiber unload disposes, so both teardown - * triggers honor the ordering identically. + * idle-injection flushes, unregisters the agent, detaches the session, + * unwinds the scope, and releases both ids, in that order. Caller-fiber unload + * also invokes an independent sentinel that follows this memoized boundary, + * so handle-first and owner-first races honor the same ordering. * * `dispose()` is MEMOIZED: the underlying cordis effect disposer is * single-shot (a second call returns immediately because the effect's epoch is @@ -491,13 +876,49 @@ export class AgentLoop extends Service implements AgentFactory { * `AgentHandle.dispose(): Promise` contract (mirrors the ACP `quiesce()` * helper). */ - private async startOwned( + private startOwned( + ownerCtx: Context, id: AgentId, options: AgentOptions, session: Session, source: SessionStartSource, reservations: RegistrationReservations, setup?: (agentCtx: Context) => Promise | void, - ): Promise { - const lifecycle = this.prepareLifecycle(id, options, session, reservations) + afterQuiescence?: () => void, + ): OwnedAgentStart { + let lifecycle: ReturnType try { + lifecycle = this.prepareLifecycle(ownerCtx, id, options, session, reservations, afterQuiescence) + } catch (error: unknown) { + /* v8 ignore next 1 -- prepareLifecycle wraps every synchronous failure */ + if (!(error instanceof LifecyclePreparationFailure)) throw error + return { + dispose: error.dispose, + result: (async () => { + await error.dispose() + throw error.reason + })(), + } + } + return { + dispose: lifecycle.disposeAgent, + result: this.finishOwnedStart(lifecycle, id, source, setup), + } + } + + /** Await setup and publish after {@link startOwned} established ownership synchronously. */ + private async finishOwnedStart( + lifecycle: ReturnType, + id: AgentId, + source: SessionStartSource, + setup?: (agentCtx: Context) => Promise | void, + ): Promise { + try { + // Scope minting emits Cordis's synchronous internal/plugin notification. + // A listener can unload either owner there; never run arbitrary setup in + // the already-doomed scope while the tracked disposer is catching up. + /* v8 ignore next 3 -- prepareLifecycle returns success only after its + * final synchronous liveness check; no callback runs before this line */ + if (!lifecycle.active()) { + throw new Error(`agent "${id}" setup aborted: owner disposed during setup`) + } // The owner-disposal branch makes a never-settling setup unable to hold // the transaction or its ID reservations forever. Promise.race installs // rejection observation on setup even if owner disposal wins first. diff --git a/packages/core/agent-loop/tests/agent.spec.ts b/packages/core/agent-loop/tests/agent.spec.ts index b2a4fe30d5..be1a0fe5b5 100644 --- a/packages/core/agent-loop/tests/agent.spec.ts +++ b/packages/core/agent-loop/tests/agent.spec.ts @@ -296,6 +296,39 @@ describe('ReactLoopAgent', () => { expect(agent.status).toBe('disposed') }) + it('a pre-start disposal makes a later driver-start attempt inert', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId('pre-start-dispose')) + const prepared = prepareReactLoopAgent(ctx, AgentId('pre-start-dispose'), { model: 'mock' }, session) + + await prepared.dispose() + expect(prepared.agent.status).toBe('disposed') + const dispose = prepared.startDriver() + await dispose() + await expect(prepared.agent.done).resolves.toBeUndefined() + expect(prepared.agent.session.events).toEqual([]) + await ctx.fiber.dispose() + }) + + it('does not claim a session when concrete-agent construction rejects options', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId('constructor-retry')) + const badOptions = { + get model(): string { + throw new Error('bad model getter') + }, + } + + expect(() => prepareReactLoopAgent(ctx, AgentId('bad-constructor'), badOptions, session)) + .toThrow('bad model getter') + const prepared = prepareReactLoopAgent(ctx, AgentId('constructor-retry'), { model: 'mock' }, session) + await prepared.dispose() + expect(prepared.agent.status).toBe('disposed') + await ctx.fiber.dispose() + }) + it('setting the same status does not emit agent/status again', async () => { const adapter = new MockAdapter([textResponse('ok')]) const ctx = await harness(adapter) diff --git a/packages/core/agent-loop/tests/resume.spec.ts b/packages/core/agent-loop/tests/resume.spec.ts index 8ed557faaf..d739ff0ed3 100644 --- a/packages/core/agent-loop/tests/resume.spec.ts +++ b/packages/core/agent-loop/tests/resume.spec.ts @@ -228,6 +228,27 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => { await ctx.fiber.dispose() }) + it('successful resume disposal retires both caller ownership sentinels', async () => { + const sessionId = SessionId('resume-retired-sentinels-s') + const agentId = AgentId('resume-retired-sentinels') + const root = await persistSession(sessionId) + const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')])) + const handle = await ctx.agents.resume({ + agentId, + resumeSessionId: sessionId, + agentOptions: { model: 'mock' }, + }) + const sentinelLabels = [ + `agentLoop.resumeLoad(${agentId})`, + `agentLoop.ownerLifecycle(${agentId})`, + ] + + expect(ctx.fiber.getEffects().map(effect => effect.label)).toEqual(expect.arrayContaining(sentinelLabels)) + await handle.dispose() + expect(ctx.fiber.getEffects().filter(effect => sentinelLabels.includes(effect.label))).toEqual([]) + await ctx.fiber.dispose() + }) + it('resume setup rejection publishes nothing, unwinds, and releases both identities', async () => { const sessionId = SessionId('resume-setup-reject') const root = await persistSession(sessionId) @@ -351,6 +372,93 @@ describe('the session-persistence RFC: AgentLoop factory create/resume', () => { await ctx.fiber.dispose() }) + it('AgentLoop unload aborts persistence load and awaits reservation release', async () => { + const sessionId = SessionId('resume-load-factory-unload') + const agentId = AgentId('resume-load-factory-race') + const root = await persistSession(sessionId) + const ctx = new Context() + await ctx.plugin(LlmService) + await ctx.plugin(SessionStore) + await ctx.plugin(SystemPrompt) + await ctx.plugin(ToolRegistry) + await ctx.plugin(AgentRegistry) + const loopFiber = await ctx.plugin(AgentLoop, { agents: [] }) + await ctx.plugin(SessionPersistenceJsonl, { root }) + ctx.llm.registerAdapter(['mock'], new MockAdapter([textResponse('next')])) + + const snapshot = await ctx.sessionPersistence.load(sessionId) + const lateLoad = Promise.withResolvers() + const loadStarted = Promise.withResolvers() + ctx.sessionPersistence.load = (id) => { + expect(id).toBe(sessionId) + loadStarted.resolve(undefined) + return lateLoad.promise + } + const published: string[] = [] + ctx.on('session/created', () => void published.push('session/created')) + ctx.on('agent/created', () => void published.push('agent/created')) + + const resuming = ctx.agents.resume({ agentId, resumeSessionId: sessionId, agentOptions: { model: 'mock' } }) + await loadStarted.promise + const rejection = expect(promptly(resuming)).rejects.toThrow(/owner disposed during persistence load/) + await promptly(loopFiber.dispose()) + await rejection + + expect(published).toEqual([]) + expect(ctx.agents.get(agentId)).toBeUndefined() + expect(ctx.sessions.get(sessionId)).toBeUndefined() + const agentReservation = ctx.agents.reserve(agentId) + const sessionReservation = ctx.sessions.reserve(sessionId) + sessionReservation.release() + agentReservation.release() + + lateLoad.resolve(structuredClone(snapshot)) + await Promise.resolve() + await Promise.resolve() + expect(published).toEqual([]) + await ctx.fiber.dispose() + }) + + it('option snapshot reentrancy cannot install a resume sentinel after factory unload begins', async () => { + const sessionId = SessionId('resume-snapshot-factory-unload') + const agentId = AgentId('resume-snapshot-factory-race') + const root = await persistSession(sessionId) + const ctx = new Context() + await ctx.plugin(LlmService) + await ctx.plugin(SessionStore) + await ctx.plugin(SystemPrompt) + await ctx.plugin(ToolRegistry) + await ctx.plugin(AgentRegistry) + const loopFiber = await ctx.plugin(AgentLoop, { agents: [] }) + await ctx.plugin(SessionPersistenceJsonl, { root }) + ctx.llm.registerAdapter(['mock'], new MockAdapter([textResponse('next')])) + + let loads = 0 + const load = ctx.sessionPersistence.load.bind(ctx.sessionPersistence) + ctx.sessionPersistence.load = (id) => { + loads += 1 + return load(id) + } + const options = { + agentId, + resumeSessionId: sessionId, + get agentOptions() { + void loopFiber.dispose() + return { model: 'mock' } + }, + } + + await expect(ctx.agents.resume(options)).rejects.toThrow('agent loop is not active') + await loopFiber.dispose() + expect(loads).toBe(0) + expect(ctx.fiber.getEffects().filter(effect => effect.label === `agentLoop.resumeLoad(${agentId})`)).toEqual([]) + const agentReservation = ctx.agents.reserve(agentId) + const sessionReservation = ctx.sessions.reserve(sessionId) + sessionReservation.release() + agentReservation.release() + await ctx.fiber.dispose() + }) + it('snapshots resume identities and agent options before persistence load', async () => { const sessionId = SessionId('resume-snapshot-source') const root = await persistSession(sessionId) diff --git a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts index 5ed11d396a..275fdadb5a 100644 --- a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts +++ b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts @@ -1,5 +1,5 @@ import { describe, expect, it } from 'vitest' -import { Context } from 'cordis' +import { Context, symbols, type EffectMeta, type Fiber } from 'cordis' import LlmService from '@deepseek-ai/dsh-llm' import SessionStore, { SessionId, type SessionEvent } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' @@ -12,16 +12,20 @@ import * as concreteAgentModule from '../src/agent.ts' import type { ContentBlock } from '@deepseek-ai/dsh-llm' import { MockAdapter, textResponse } from './mock-adapter.ts' -async function harness(adapter: MockAdapter = new MockAdapter([textResponse('ok')])) { +async function harnessWithLoop(adapter: MockAdapter = new MockAdapter([textResponse('ok')])): Promise<{ ctx: Context; loopFiber: Fiber }> { const ctx = new Context() await ctx.plugin(LlmService) await ctx.plugin(SessionStore) await ctx.plugin(SystemPrompt, { persona: 'You are the deployment.' }) await ctx.plugin(ToolRegistry) await ctx.plugin(AgentRegistry) - await ctx.plugin(AgentLoop, { agents: [] }) + const loopFiber = await ctx.plugin(AgentLoop, { agents: [] }) ctx.llm.registerAdapter(['mock'], adapter) - return ctx + return { ctx, loopFiber } +} + +async function harness(adapter: MockAdapter = new MockAdapter([textResponse('ok')])): Promise { + return (await harnessWithLoop(adapter)).ctx } function waitForIdle(ctx: Context, agent: ReactLoopAgent): Promise { @@ -37,6 +41,17 @@ function waitForIdle(ctx: Context, agent: ReactLoopAgent): Promise { const text = (t: string): ContentBlock[] => [{ type: 'text', text: t }] +/** Invoke the exact lifecycle effect to exercise same-stack reentrant teardown. */ +function disposeCurrentLifecycle(ownerCtx: Context): void { + const lifecycle = [...ownerCtx.fiber._disposables] + .find((dispose) => { + const effect = (dispose as typeof dispose & { [symbols.effect]?: EffectMeta })[symbols.effect] + return effect?.label === 'agentLoop.lifecycle()' + }) + if (lifecycle === undefined) throw new Error('agent lifecycle effect not found') + void lifecycle() +} + describe('agent scope lifecycle', () => { it('wires agent.ctx: tagged with the agent, DX field set, ctx.agent safe elsewhere', async () => { const ctx = await harness() @@ -312,6 +327,508 @@ describe('agent scope lifecycle', () => { expect(ctx.sessions.get(SessionId('owner-race-s-2'))).toBeUndefined() }) + it('an AgentLoop unload aborts pending setup, awaits cleanup, and releases both ids', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + const gate = Promise.withResolvers() + const setupStarted = Promise.withResolvers() + const published: string[] = [] + ctx.on('session/created', () => void published.push('session/created')) + ctx.on('agent/created', () => void published.push('agent/created')) + + const creating = ctx.agents.create({ + agentId: AgentId('factory-setup-race'), + sessionId: SessionId('factory-setup-race-s'), + agentOptions: { model: 'mock' }, + setup: async () => { + setupStarted.resolve(undefined) + await gate.promise + }, + }) + await setupStarted.promise + + await loopFiber.dispose() + await expect(creating).rejects.toThrow(/owner disposed during setup/) + expect(published).toEqual([]) + expect(ctx.agents.get(AgentId('factory-setup-race'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('factory-setup-race-s'))).toBeUndefined() + + // Factory unload itself reached the reservation-release boundary. + const agentReservation = ctx.agents.reserve(AgentId('factory-setup-race')) + const sessionReservation = ctx.sessions.reserve(SessionId('factory-setup-race-s')) + sessionReservation.release() + agentReservation.release() + gate.resolve(undefined) + await ctx.fiber.dispose() + }) + + it('factory unload during scope minting skips setup and awaits provisional cleanup', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + let unloaded = false + let setupCalls = 0 + ctx.on('internal/plugin', (fiber) => { + if (unloaded || fiber.name !== 'scope') return + unloaded = true + void loopFiber.dispose() + }) + + const creating = ctx.agents.create({ + agentId: AgentId('factory-scope-race'), + sessionId: SessionId('factory-scope-race-s'), + agentOptions: { model: 'mock' }, + setup: () => { setupCalls += 1 }, + }) + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await loopFiber.dispose() + expect(setupCalls).toBe(0) + expect(ctx.agents.get(AgentId('factory-scope-race'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('factory-scope-race-s'))).toBeUndefined() + + const agentReservation = ctx.agents.reserve(AgentId('factory-scope-race')) + const sessionReservation = ctx.sessions.reserve(SessionId('factory-scope-race-s')) + sessionReservation.release() + agentReservation.release() + await ctx.fiber.dispose() + }) + + it('caller unload during scope minting owns and drains the half-built child', async () => { + const ctx = await harness() + const gate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let ownerFiber!: Fiber + let ownerDisposal!: Promise + let scopeFiber: Fiber | undefined + let creating!: ReturnType + ctx.on('internal/plugin', (fiber) => { + if (fiber.name !== 'scope' || scopeFiber !== undefined) return + scopeFiber = fiber + fiber.ctx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await gate.promise + }) + ownerDisposal = ownerFiber.dispose() + }) + + const owner = ctx.plugin(Object.assign((inner: Context) => { + ownerFiber = inner.fiber + creating = inner.agents.create({ + agentId: AgentId('caller-scope-race'), + sessionId: SessionId('caller-scope-race-s'), + agentOptions: { model: 'mock' }, + }) + }, { inject: ['agents'] })) + + await cleanupStarted.promise + let ownerSettled = false + void ownerDisposal.then(() => { ownerSettled = true }) + await Promise.resolve() + expect(ownerSettled).toBe(false) + gate.resolve(undefined) + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await ownerDisposal + await owner + expect(scopeFiber?.uid).toBeNull() + expect(ctx.agents.get(AgentId('caller-scope-race'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('caller-scope-race-s'))).toBeUndefined() + await owner.dispose() + await ctx.fiber.dispose() + }) + + it('synchronous create rechecks provider liveness before its first publication edge', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + const sessionsBefore = ctx.sessions.list().length + let unloaded = false + ctx.on('internal/plugin', (fiber) => { + if (unloaded || fiber.name !== 'scope') return + unloaded = true + void loopFiber.dispose() + }) + + expect(() => ctx.agentLoop.create(AgentId('config-scope-race'), { model: 'mock' })) + .toThrow(/owner disposed during setup/) + await loopFiber.dispose() + expect(ctx.agents.get(AgentId('config-scope-race'))).toBeUndefined() + expect(ctx.sessions.list()).toHaveLength(sessionsBefore) + await ctx.fiber.dispose() + }) + + it('synchronous create releases both reservations when session preparation fails', async () => { + const ctx = await harness() + const id = AgentId('config-prepare-failure') + + expect(() => ctx.agentLoop.create(id, { model: 'mock' }, { cwd: 'relative' })) + .toThrow(/absolute path/) + const replacement = ctx.agentLoop.create(id, { model: 'mock' }, { cwd: '/recovered' }) + expect(ctx.agents.get(id)).toBe(replacement) + await replacement.whenIdle() + await ctx.fiber.dispose() + }) + + it('turns owner disposal from the caller association getter into a rollback boundary', async () => { + const ctx = await harness() + let creating!: ReturnType + let getterCalls = 0 + const creationStarted = Promise.withResolvers() + const owner = ctx.plugin(Object.assign((inner: Context) => { + Object.defineProperty(inner, 'agent', { + configurable: true, + get() { + getterCalls += 1 + void inner.fiber.dispose() + return undefined + }, + }) + creating = inner.agents.create({ + agentId: AgentId('association-dispose'), + sessionId: SessionId('association-dispose-s'), + agentOptions: { model: 'mock' }, + }) + creationStarted.resolve(undefined) + }, { inject: ['agents'] })) + + await creationStarted.promise + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner + expect(getterCalls).toBe(1) + expect(ctx.agents.get(AgentId('association-dispose'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('association-dispose-s'))).toBeUndefined() + const replacement = await ctx.agents.create({ + agentId: AgentId('association-dispose'), + sessionId: SessionId('association-dispose-s'), + agentOptions: { model: 'mock' }, + }) + await replacement.dispose() + await ctx.fiber.dispose() + }) + + it('factory unload awaits reservations when reentrant scope preparation throws', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + let triggered = false + ctx.on('internal/plugin', (fiber) => { + if (triggered || fiber.name !== 'scope') return + triggered = true + void loopFiber.dispose() + throw new Error('scope preparation failed') + }) + + await expect(ctx.agents.create({ + agentId: AgentId('factory-scope-throw'), + sessionId: SessionId('factory-scope-throw-s'), + agentOptions: { model: 'mock' }, + })).rejects.toThrow('scope preparation failed') + await loopFiber.dispose() + expect(ctx.agents.get(AgentId('factory-scope-throw'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('factory-scope-throw-s'))).toBeUndefined() + + const agentReservation = ctx.agents.reserve(AgentId('factory-scope-throw')) + const sessionReservation = ctx.sessions.reserve(SessionId('factory-scope-throw-s')) + sessionReservation.release() + agentReservation.release() + await ctx.fiber.dispose() + }) + + it('factory unload during session preparation awaits create reservation release', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + let unloading!: Promise + const meta = { + get cwd() { + unloading = loopFiber.dispose() + return '/factory-unload' + }, + } + + const creating = ctx.agents.create({ + agentId: AgentId('factory-prepare-race'), + sessionId: SessionId('factory-prepare-race-s'), + agentOptions: { model: 'mock' }, + meta, + }) + await unloading + await expect(creating).rejects.toThrow('agent loop is not active') + + const agentReservation = ctx.agents.reserve(AgentId('factory-prepare-race')) + const sessionReservation = ctx.sessions.reserve(SessionId('factory-prepare-race-s')) + sessionReservation.release() + agentReservation.release() + await ctx.fiber.dispose() + }) + + it('AgentLoop unload is a structural co-owner of every live programmatic agent', async () => { + const { ctx, loopFiber } = await harnessWithLoop() + const loop = ctx.agentLoop + const agentId = AgentId('factory-live') + const handle = await ctx.agents.create({ + agentId, + sessionId: SessionId('factory-live-s'), + agentOptions: { model: 'mock' }, + }) + + await loopFiber.dispose() + expect(handle.agent.status).toBe('disposed') + expect(ctx.agents.get(agentId)).toBeUndefined() + expect(ctx.sessions.get(SessionId('factory-live-s'))).toBeUndefined() + expect(ctx.fiber.getEffects().filter(effect => effect.label === `agentLoop.ownerLifecycle(${agentId})`)).toEqual([]) + // The consumer handle shares the provider's completed quiescence boundary. + await handle.dispose() + + const agentReservation = ctx.agents.reserve(agentId) + const sessionReservation = ctx.sessions.reserve(SessionId('factory-live-s')) + sessionReservation.release() + agentReservation.release() + await expect(loop.createAgent(ctx, { + agentId: AgentId('factory-inactive'), + sessionId: SessionId('factory-inactive-s'), + })).rejects.toThrow('agent loop is not active') + await ctx.fiber.dispose() + }) + + it('keeps AgentLoop dependencies available when the caller injects only agents', async () => { + const ctx = await harness() + let creating!: ReturnType + const owner = await ctx.plugin(Object.assign((inner: Context) => { + creating = inner.agents.create({ + agentId: AgentId('dependency-origin'), + sessionId: SessionId('dependency-origin-s'), + agentOptions: { model: 'mock' }, + setup: (agentCtx) => { + agentCtx.tools.register({ + name: 'dependency-origin-tool', + description: 'proves AgentLoop dependency origin', + parameters: {}, + execute: () => Promise.resolve(text('ok')), + }) + agentCtx.systemPrompt.section({ + name: 'dependency-origin-section', + order: 1, + text: 'factory dependency surface', + }) + }, + }) + }, { inject: ['agents'] })) + + const handle = await creating + const assembly = await ctx.systemPrompt.assemble(assembleContextFor(handle.agent)) + expect(assembly.tools.map(tool => tool.name)).toContain('dependency-origin-tool') + expect(assembly.sections.map(section => section.name)).toContain('dependency-origin-section') + await handle.dispose() + await owner.dispose() + await ctx.fiber.dispose() + }) + + it('keeps both entries and the scope live through a reentrant session/created teardown', async () => { + const ctx = await harness() + let ownerCtx!: Context + let creating!: ReturnType + const lifecycle: string[] = [] + ctx.on('session/created', (session) => { + if (session.id !== SessionId('session-created-barrier-s')) return + lifecycle.push('session-created:dispose') + disposeCurrentLifecycle(ownerCtx) + }) + ctx.on('session/created', (session) => { + if (session.id !== SessionId('session-created-barrier-s')) return + const agent = ctx.agents.get(AgentId('session-created-barrier'))! + expect(ctx.sessions.get(session.id)).toBe(session) + expect(agent.session).toBe(session) + agent.ctx.effect(() => () => { lifecycle.push('scope-disposed') }) + lifecycle.push('session-created:observer') + }) + ctx.on('agent/created', () => void lifecycle.push('agent-created')) + ctx.on('agent/disposed', () => void lifecycle.push('agent-disposed')) + ctx.on('session/disposed', (session) => { + if (session.id === SessionId('session-created-barrier-s')) lifecycle.push('session-disposed') + }) + + const owner = await ctx.plugin(Object.assign((inner: Context) => { + ownerCtx = inner + creating = inner.agents.create({ + agentId: AgentId('session-created-barrier'), + sessionId: SessionId('session-created-barrier-s'), + agentOptions: { model: 'mock' }, + }) + }, { inject: ['agents'] })) + + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner.dispose() + expect(lifecycle).toEqual([ + 'session-created:dispose', + 'session-created:observer', + 'session-disposed', + 'scope-disposed', + ]) + expect(ctx.agents.get(AgentId('session-created-barrier'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('session-created-barrier-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('keeps both entries and the scope live through a reentrant agent/created teardown', async () => { + const ctx = await harness() + let ownerCtx!: Context + let creating!: ReturnType + const lifecycle: string[] = [] + ctx.on('session/created', (session) => { + if (session.id === SessionId('agent-created-barrier-s')) lifecycle.push('session-created') + }) + ctx.on('agent/created', (agent) => { + if (agent.id !== AgentId('agent-created-barrier')) return + lifecycle.push('agent-created:dispose') + disposeCurrentLifecycle(ownerCtx) + }) + ctx.on('agent/created', (agent) => { + if (agent.id !== AgentId('agent-created-barrier')) return + expect(ctx.agents.get(agent.id)).toBe(agent) + expect(ctx.sessions.get(agent.session.id)).toBe(agent.session) + agent.ctx.effect(() => () => { lifecycle.push('scope-disposed') }) + lifecycle.push('agent-created:observer') + }) + ctx.on('agent/disposed', (agent) => { + if (agent.id === AgentId('agent-created-barrier')) lifecycle.push('agent-disposed') + }) + ctx.on('session/disposed', (session) => { + if (session.id === SessionId('agent-created-barrier-s')) lifecycle.push('session-disposed') + }) + + const owner = await ctx.plugin(Object.assign((inner: Context) => { + ownerCtx = inner + creating = inner.agents.create({ + agentId: AgentId('agent-created-barrier'), + sessionId: SessionId('agent-created-barrier-s'), + agentOptions: { model: 'mock' }, + }) + }, { inject: ['agents'] })) + + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner.dispose() + expect(lifecycle).toEqual([ + 'session-created', + 'agent-created:dispose', + 'agent-created:observer', + 'agent-disposed', + 'session-disposed', + 'scope-disposed', + ]) + expect(ctx.agents.get(AgentId('agent-created-barrier'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('agent-created-barrier-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('rechecks owner liveness after carrier capture before the first creation edge', async () => { + const ctx = await harness() + let ownerCtx!: Context + const owner = await ctx.plugin(Object.assign((inner: Context) => { ownerCtx = inner }, { inject: ['agents'] })) + const agentId = AgentId('carrier-owner-race') + const sessionId = SessionId('carrier-owner-race-s') + const lifecycle: string[] = [] + let filterReads = 0 + ctx.on('session/created', (session) => { + if (session.id === sessionId) lifecycle.push('session-created') + }) + ctx.on('session/disposed', (session) => { + if (session.id === sessionId) lifecycle.push('session-disposed') + }) + ctx.on('agent/created', (agent) => { + if (agent.id === agentId) lifecycle.push('agent-created') + }) + ctx.on('agent/disposed', (agent) => { + if (agent.id === agentId) lifecycle.push('agent-disposed') + }) + + const creating = ownerCtx.agents.create({ + agentId, + sessionId, + agentOptions: { model: 'mock' }, + setup(agentCtx) { + Object.defineProperty(agentCtx.agent!.session, Context.filter, { + configurable: true, + get() { + filterReads += 1 + void owner.dispose() + return undefined + }, + }) + }, + }) + + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner.dispose() + expect(filterReads).toBe(1) + expect(lifecycle).toEqual([]) + expect(ctx.agents.get(agentId)).toBeUndefined() + expect(ctx.sessions.get(sessionId)).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('rechecks caller liveness after creation listeners before unlocking the driver', async () => { + const ctx = await harness() + const starts: string[] = [] + let ownerCtx!: Context + let creating!: ReturnType + ctx.on('agent/session-start', agent => void starts.push(agent.id)) + ctx.on('agent/created', (agent) => { + if (agent.id === AgentId('listener-dispose')) void ownerCtx.fiber.dispose() + }) + + const owner = await ctx.plugin(Object.assign((inner: Context) => { + ownerCtx = inner + creating = inner.agents.create({ + agentId: AgentId('listener-dispose'), + sessionId: SessionId('listener-dispose-s'), + agentOptions: { model: 'mock' }, + }) + }, { inject: ['agents'] })) + + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner.dispose() + expect(starts).toEqual([]) + expect(ctx.agents.get(AgentId('listener-dispose'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('listener-dispose-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('rechecks caller liveness after session-start before starting the driver', async () => { + const ctx = await harness() + let ownerCtx!: Context + let creating!: ReturnType + let announced!: ReactLoopAgent + const statuses: string[] = [] + let scopeDisposed = false + let observerSawLive = false + ctx.on('agent/status', (agent, status) => { + if (agent.id === AgentId('session-start-dispose')) statuses.push(status) + }) + ctx.on('agent/session-start', (agent) => { + if (agent.id !== AgentId('session-start-dispose')) return + announced = agent as ReactLoopAgent + disposeCurrentLifecycle(ownerCtx) + }) + ctx.on('agent/session-start', (agent) => { + if (agent.id !== AgentId('session-start-dispose')) return + expect(ctx.agents.get(agent.id)).toBe(agent) + expect(ctx.sessions.get(agent.session.id)).toBe(agent.session) + agent.ctx.effect(() => () => { scopeDisposed = true }) + observerSawLive = true + }) + + const owner = await ctx.plugin(Object.assign((inner: Context) => { + ownerCtx = inner + creating = inner.agents.create({ + agentId: AgentId('session-start-dispose'), + sessionId: SessionId('session-start-dispose-s'), + agentOptions: { model: 'mock' }, + }) + }, { inject: ['agents'] })) + + await expect(creating).rejects.toThrow(/owner disposed during setup/) + await owner.dispose() + expect(announced.status).toBe('disposed') + expect(statuses).toEqual(['disposed']) + expect(observerSawLive).toBe(true) + expect(scopeDisposed).toBe(true) + expect(announced.session.events).toEqual([]) + expect(ctx.agents.get(AgentId('session-start-dispose'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('session-start-dispose-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + it('a rejecting setup publishes nothing and unwinds the unpublished scope', async () => { const ctx = await harness() const published: string[] = [] @@ -527,6 +1044,89 @@ describe('agent scope lifecycle', () => { await unload }) + it('successful handle disposal retires its caller ownership sentinel', async () => { + const ctx = await harness() + const agentId = AgentId('retired-owner-sentinel') + const handle = await ctx.agents.create({ + agentId, + sessionId: SessionId('retired-owner-sentinel-s'), + agentOptions: { model: 'mock' }, + }) + + expect(ctx.fiber.getEffects().map(effect => effect.label)).toContain(`agentLoop.ownerLifecycle(${agentId})`) + await handle.dispose() + expect(ctx.fiber.getEffects().filter(effect => effect.label === `agentLoop.ownerLifecycle(${agentId})`)).toEqual([]) + await ctx.fiber.dispose() + }) + + it('owner unload after handle-first teardown follows the same in-flight boundary', async () => { + const ctx = await harness() + const gate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + let handle!: Awaited> + const owner = await ctx.plugin(Object.assign(async (inner: Context) => { + handle = await inner.agents.create({ + agentId: AgentId('manual-first'), + sessionId: SessionId('manual-first-s'), + agentOptions: { model: 'mock' }, + setup(agentCtx) { + agentCtx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await gate.promise + }) + }, + }) + }, { inject: ['agents'] })) + + const disposing = handle.dispose() + await cleanupStarted.promise + let ownerSettled = false + const unloading = owner.dispose().then(() => { ownerSettled = true }) + await Promise.resolve() + expect(ownerSettled).toBe(false) + gate.resolve(undefined) + await Promise.all([disposing, unloading]) + expect(ctx.agents.get(AgentId('manual-first'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('manual-first-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('retains both identity reservations until scope teardown reaches quiescence', async () => { + const ctx = await harness() + const gate = Promise.withResolvers() + const cleanupStarted = Promise.withResolvers() + const sessionDisposed = Promise.withResolvers() + const agentId = AgentId('quiescent-reservation') + const sessionId = SessionId('quiescent-reservation-s') + ctx.on('session/disposed', (session) => { + if (session.id === sessionId) sessionDisposed.resolve(undefined) + }) + const first = await ctx.agents.create({ + agentId, + sessionId, + agentOptions: { model: 'mock' }, + setup(agentCtx) { + agentCtx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await gate.promise + }) + }, + }) + + const disposing = first.dispose() + await Promise.all([sessionDisposed.promise, cleanupStarted.promise]) + expect(ctx.agents.get(agentId)).toBeUndefined() + expect(ctx.sessions.get(sessionId)).toBeUndefined() + await expect(ctx.agents.create({ agentId, sessionId, agentOptions: { model: 'mock' } })) + .rejects.toThrow(/reserved/) + + gate.resolve(undefined) + await disposing + const replacement = await ctx.agents.create({ agentId, sessionId, agentOptions: { model: 'mock' } }) + await replacement.dispose() + await ctx.fiber.dispose() + }) + it('handle.dispose() awaits an idle-injection flush before unregistering or detaching', async () => { const ctx = await harness() const handle = await ctx.agents.create({ diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md index 1b1e65a289..84a3877298 100644 --- a/packages/core/agent/README.md +++ b/packages/core/agent/README.md @@ -8,28 +8,28 @@ Tracks live agents so UI, hook, and orchestrator plugins can find them without i ### Public API -The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher every agent-subject event goes through (carrier + injected subject in one move); its notification mode invokes every listener and contains both synchronous throws and returned-promise rejections. `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while registry/store-owned reservation capabilities keep both identities unpublished; creation awaits setup and a same-turn owner-unload checkpoint before either creation notification or the first assembly. Setup composes, it never drives or publishes: driving verbs and ordinary agent/session insertion both reject until the owning publication boundary. +The scoped-registration surface: `Agent.ctx` is the agent's scope context (`dsh-scope`, key = the agent) — register tools/sections/variables/listeners through it for that agent alone, all unwound on disposal. `agentEvents(ctx, agent)` is the fused dispatcher for ordinary agent-subject operations (carrier + injected subject in one move); its notification mode invokes every listener and contains both synchronous throws and returned-promise rejections. The registry lifecycle pair deliberately reuses the stable carrier captured before entry commit and applies the same per-listener containment directly. `assembleContextFor(agent)` builds the per-agent assembly context (`agent` + `scope` together). `CreateAgentOptions.setup(agentCtx)` and `ResumeAgentOptions.setup(agentCtx)` compose a fresh or resumed agent's scoped world while registry/store-owned reservation capabilities keep both identities unpublished; creation awaits setup and a same-turn owner-unload checkpoint before either creation notification or the first assembly. Setup composes, it never drives or publishes: driving verbs and ordinary agent/session insertion both reject until the owning publication boundary. - `ctx.agents.register(agent: Agent): () => Promise | void` — record an **already-constructed** agent. Disposed with the calling fiber. -- Advanced ordered lifecycle: `reserve(id)` returns an opaque unpublished-identity capability owned by the calling fiber (owner unload releases an abandoned reservation); `enter(agent, reservation?): () => void` inserts under one captured, runtime-pinned id without announcing; and `announce(agent)` emits `agent/created` exactly once for that exact live entry, rejecting repeat or reentrant announcement. While reserved, bare `register`/`enter` calls for the id reject, including from setup. The factory uses this split; ordinary plugins use `register()`. +- Advanced ordered lifecycle: `reserve(id)` returns an opaque unpublished-identity capability whose `release` is the exact owner effect disposer, allowing the factory to place ID release after scope quiescence instead of racing owner unload as a sibling. `enter(agent, reservation?): () => void` claims the ID across runtime pinning and stable lifecycle-carrier construction, then inserts without announcing; a Proxy trap or filter getter cannot reentrantly overwrite the commit. `announce(agent)` reuses that carrier and emits `agent/created` exactly once for the exact live entry, rejecting repeat or reentrant announcement. A detach requested synchronously by a creation listener is deferred until that dispatch unwinds, and every detach is exact-object guarded, so a later listener cannot observe inverted lifecycle edges and a stale capability cannot delete a replacement. While reserved, bare `register`/`enter` calls for the id reject, including from setup. The factory uses this split; ordinary plugins use `register()`. - `ctx.agents.get(id: AgentId): Agent | undefined` - `ctx.agents.list(): Agent[]` #### Factory seam (creation) -Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package. +Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-agent-loop`), registered via `setFactory`. This keeps creation on the `dsh-agent` interface so consumers (UI, the ACP bridge) program against `ctx.agents` without depending on the concrete loop package. The registry canonicalizes an already traced Service to its concrete target, captures and validates the factory's `createAgent` and `resume` callbacks once at registration, retains that target as their intentional receiver, and passes each call an explicit caller-bound `ownerCtx`; later method replacement cannot redirect a transaction, double tracing cannot break raw-identity state, and a plain non-Cordis factory receives enough context to implement caller ownership. - `ctx.agents.setFactory(factory: AgentFactory): () => Promise | void` — register the creation factory (the loop calls this on construction). Throws on a second factory; the slot clears on dispose. -- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata and hand the one-read raw seed synchronously to the session boundary for one-pass lossless-JSON materialization, construct and await optional setup while unpublished, insert and announce both session and agent, open the `agent/session-start` driving boundary, then start a new loop on the caller-supplied `sessionId`. Registry/store reservation capabilities block every competing public insertion across setup; seed rejection, setup rejection, or owner unload publishes nothing. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; any creation announcement that began is paired by `agent/disposed` or `session/disposed`. Rejects if no factory is registered. -- `ctx.agents.resume(options: ResumeAgentOptions): Promise` — snapshot caller-owned IDs/options, load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh agent scope, await optional setup while unpublished, then follow the same insert → announce → session-start → loop-start boundary. The IDs are reserved across persistence load and setup; load/setup rejection or owner unload publishes nothing. Rejects if no factory is registered or session persistence is unconfigured. +- `ctx.agents.create(options: CreateAgentOptions): Promise` — snapshot caller-owned IDs/options/metadata and hand the one-read raw seed synchronously to the session boundary for one-pass lossless-JSON materialization, construct and await optional setup while unpublished, insert both session and agent, then recheck caller and factory liveness before the first creation announcement and after each later notification boundary. Only a still-live transaction opens `agent/session-start` and starts a new loop on the caller-supplied `sessionId`. Registry/store reservation capabilities block every competing public insertion across setup; seed rejection, setup rejection, caller unload, factory unload, or cancellation from a creation listener publishes no drivable agent. Publication is rollback-covered: if a creation listener throws, entries and scope unwind but effects of already-delivered notifications remain observable; any creation announcement that began is paired by `agent/disposed` or `session/disposed`. Rejects if no factory is registered. +- `ctx.agents.resume(options: ResumeAgentOptions): Promise` — snapshot caller-owned IDs/options, load a persisted session ([session persistence](../../../docs/rfc/implemented/architecture/2026-06-14-session-persistence.md)), mint a fresh agent scope, await optional setup while unpublished, then follow the same insert both → pre-announcement liveness check → session announcement → liveness check → agent announcement → liveness check → session-start → final liveness check → loop-start boundary. The IDs are reserved across persistence load, setup, and teardown quiescence; load/setup rejection, caller unload, or factory unload leaves no drivable or live publication, while any creation edge that already began is paired during rollback. Rejects if no factory is registered or session persistence is unconfigured. -`AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **capability** — only the holder can tear this agent down. `dispose()` stops the loop, `await`s its exit plus every outstanding idle-injection flush (quiescence — NOT just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent` — the handle is only for the OWNER that created it. The ACP bridge and in-process subagent backends are production consumers; config-created agents are owned by the loop fiber and never need a handle. +`AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **consumer capability** — no observer holding the bare registry entry can tear the agent down. The caller fiber and the registered factory provider are structural co-owners: caller unload enforces structured ownership, while factory unload must stop old instances because their scoped dependency surface belongs to that provider. `dispose()` from any owner reaches one memoized quiescence boundary: it stops the loop, `await`s its exit plus every outstanding idle-injection flush (not just the `disposed` status flip), unregisters the agent, removes its session from the store, and finally unwinds its scoped world. This order captures every agent-started `session/flush` before the session is detached and keeps scoped listeners alive through those checkpoints. `ctx.agents.get(id)` still returns a bare `Agent`; the ACP bridge and in-process subagent backends hold consumer handles, while config-created agents are already owned by the loop fiber. ### Live events `dsh-agent` declares the live `agent/*` coordination vocabulary so plugins do not depend on the concrete loop. Exact signatures, dispatch modes, scope-filtering rules, and payload contracts live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the [architecture turn flow](../../../docs/architecture.md#turn-flow) shows their order relative to durable session events. -The lifecycle edges have two important local caveats. `agent/created` runs after scoped setup and after both session and agent registry entries exist, but concrete driving remains locked until the immediately following `agent/session-start`; that non-vetoing notification is the first supported startup injection point. `agent/disposed` runs after the driver is quiescent and the agent leaves the registry, while ordered teardown may still be detaching its session and unwinding its scope. +The lifecycle edges have two important local caveats. `agent/created` runs after scoped setup and after both session and agent registry entries exist, but concrete driving remains locked until the immediately following `agent/session-start`; that non-vetoing notification is the first supported startup injection point. `agent/disposed` always means the exact agent has left the registry. AgentLoop emits it after its driver is quiescent, while ordered teardown may still be detaching the session and unwinding the scope; custom agents registered directly own any stronger driver-ordering contract themselves. Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the owner-final exception: it runs after ordinary continuation and steering folding, and its terminal state remains through turn close and flush so steering from those later listeners cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#owner-final-policy-boundaries). diff --git a/packages/core/agent/src/dispatch.ts b/packages/core/agent/src/dispatch.ts index 881faa675f..f8726c50cc 100644 --- a/packages/core/agent/src/dispatch.ts +++ b/packages/core/agent/src/dispatch.ts @@ -1,12 +1,13 @@ /** - * Fused scope-carrier dispatch for agent-subject events, plus the assembly - * context builder. The ONE sanctioned spelling for dispatching `agent/*` - * events: `agentEvents(ctx, agent).waterfall('agent/request', …)` builds the - * scope carrier ({@link scopeTarget} keyed by the agent) AND injects the - * subject as the first event argument in one move, so the correct dispatch is - * also the shortest — a dispatch site cannot pass a carrier keyed to one - * agent while naming another as the subject, which is the invariant the - * dev-mode scoped-dispatch check asserts at runtime. + * Fused scope-carrier dispatch for agent-subject operations, plus the assembly + * context builder. The sanctioned ordinary spelling is + * `agentEvents(ctx, agent).waterfall('agent/request', …)`: it builds the scope + * carrier ({@link scopeTarget} keyed by the agent) AND injects the subject as + * the first argument in one move, so a site cannot name a different subject. + * The registry lifecycle pair is the deliberate exception: `enter()` captures + * one stable carrier before commit and `announce()`/detach dispatch through it + * directly, preventing a mutable filter getter from changing or reentering the + * paired edges. The dev scoped-dispatch invariant checks both shapes. * * @module @deepseek-ai/dsh-agent/dispatch */ diff --git a/packages/core/agent/src/index.ts b/packages/core/agent/src/index.ts index be7bb02c67..5526006796 100644 --- a/packages/core/agent/src/index.ts +++ b/packages/core/agent/src/index.ts @@ -5,11 +5,11 @@ * @module @deepseek-ai/dsh-agent */ -import { Context, Service } from 'cordis' +import { Context, getTraceable, Service, symbols } from 'cordis' import { scopeTarget } from '@deepseek-ai/dsh-scope' +import type { Scoped } from '@deepseek-ai/dsh-scope' import type { SessionEvent, SessionId } from '@deepseek-ai/dsh-session' import type { Agent, AgentId, AgentOptions } from './types.ts' -import { agentEvents } from './dispatch.ts' export * from './types.ts' export { agentEvents, assembleContextFor } from './dispatch.ts' @@ -112,17 +112,21 @@ export interface ResumeAgentOptions { /** * An owned agent plus its disposer, returned by {@link AgentRegistry.create} / - * {@link AgentRegistry.resume}. The disposer is a CAPABILITY: only the holder - * can tear this agent down. `dispose()` stops the loop, awaits its exit and - * every outstanding idle-injection flush (quiescence — NOT just the `disposed` + * {@link AgentRegistry.resume}. The disposer is a CAPABILITY: among consumers, + * only the holder can tear this agent down. The registered factory provider is + * also a structural owner because the scoped agent depends on that provider's + * service surface; provider unload stops and drains every live handle it made. + * `dispose()` stops the loop, awaits its exit and every outstanding + * idle-injection flush (quiescence — NOT just the `disposed` * status flip), unregisters the agent, removes its session from the store, and * finally unwinds its scoped world. This order captures every agent-started * `session/flush` before the session is detached and keeps scoped listeners * alive through those checkpoints. * - * `ctx.agents.get(id)` still returns a bare {@link Agent} — the handle is only - * for the OWNER that created it. Config-created agents (the loop's own startup) - * are owned by the loop fiber and never need a handle. + * `ctx.agents.get(id)` still returns a bare {@link Agent} — the handle is + * exposed only to the consumer owner that created it; the structural provider + * reaches the same teardown internally. Config-created agents (the loop's own + * startup) are owned by the loop fiber and never need a handle. */ export interface AgentHandle { agent: Agent @@ -146,20 +150,62 @@ export interface AgentFactory { * that began is paired by `agent/disposed` or `session/disposed` during * rollback. The owner disposes the resolved handle to stop/drain, * unregister, remove the session, and unwind the scope. + * The registry passes a context carrying the `create()` caller's fiber and + * scope as `ownerCtx`. The implementation attaches the unpublished + * transaction and resulting lifecycle to that owner; it must not infer + * ownership from the factory object's registration context. + * @param ownerCtx - caller-bound context that owns the transaction and live handle. * @param options - agent/session identity, configuration, and optional setup. * @returns the owned handle after setup, both announcements, and loop start complete. */ - createAgent(options: CreateAgentOptions): Promise + createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise /** * Load a persisted session and resume an agent on it. Async because it awaits * both `ctx.sessionPersistence.load` and the optional unpublished setup * transaction; must be called after that service exists (consumers inject * `sessionPersistence`). Publication and drive unlocking follow the same * ordered boundary as {@link createAgent}. + * @param ownerCtx - caller-bound context that owns load, setup, and the live handle. * @param options - persisted identity, configuration, and optional setup. * @returns the owned handle after setup, both announcements, and loop start complete. */ - resume(options: ResumeAgentOptions): Promise + resume(ownerCtx: Context, options: ResumeAgentOptions): Promise +} + +/** One accepted factory target plus the callback identities captured at registration. */ +interface AcceptedAgentFactory { + target: AgentFactory + createAgent: AgentFactory['createAgent'] + resume: AgentFactory['resume'] +} + +/** Slot reservation while callback accessors are being captured. */ +const ACCEPTING_FACTORY = Symbol('accepting agent factory') + +/** Capture and validate the complete factory contract exactly once. */ +function acceptAgentFactory(factory: unknown): AcceptedAgentFactory { + if ((typeof factory !== 'object' && typeof factory !== 'function') || factory === null) { + throw new TypeError('agent factory must be a non-null object or function') + } + // A service read through ctx is already a Cordis trace proxy. Retaining that + // proxy and tracing it again for each create() caller produces two shadow + // layers; raw-identity state (AgentLoop's private ownership controller is + // one example) then unwraps only to the inner proxy instead of its service. + // Canonicalize the one framework-produced layer at acceptance and capture + // callbacks from the concrete target. Plain objects expose no original. + const original: unknown = Reflect.get(factory, symbols.original) + const target = ((typeof original === 'object' || typeof original === 'function') && original !== null) + ? original + : factory + const createAgent: unknown = Reflect.get(target, 'createAgent') + const resume: unknown = Reflect.get(target, 'resume') + if (typeof createAgent !== 'function') throw new TypeError('agent factory createAgent must be a function') + if (typeof resume !== 'function') throw new TypeError('agent factory resume must be a function') + return Object.freeze({ + target: target as AgentFactory, + createAgent: createAgent as AgentFactory['createAgent'], + resume: resume as AgentFactory['resume'], + }) } /** Thrown when create/resume is called before an agent factory is registered. */ @@ -187,6 +233,8 @@ export interface AgentRegistrationReservation { /** * Release the unpublished reservation; idempotent. The registry also * releases it automatically when the fiber that called `reserve` disposes. + * This function is that exact Cordis effect disposer, so an ordered + * lifecycle may yield it by identity and place release after quiescence. * @returns nothing. */ release(): void @@ -201,13 +249,21 @@ export interface AgentRegistrationReservation { */ export class AgentRegistry extends Service { private store = new Map() + /** Ids claimed across caller-code boundaries before their exact entry commits. */ + private enteringIds = new Set() /** The one accepted registry key for each live agent; never reread caller state. */ private acceptedIds = new WeakMap() /** Unpublished identities held across factory setup/load transactions. */ private reservations = new Map() /** Entries whose `agent/created` announcement phase began. */ private announced = new WeakSet() - private factory: AgentFactory | undefined + /** Entries currently dispatching `agent/created`; detach waits for that dispatch to unwind. */ + private announcing = new WeakSet() + /** A detach requested reentrantly from `agent/created`. */ + private pendingDetach = new WeakSet() + /** Stable lifecycle dispatch carrier captured before an entry commits. */ + private carriers = new WeakMap>() + private factory: AcceptedAgentFactory | typeof ACCEPTING_FACTORY | undefined constructor(ctx: Context) { super(ctx, 'agents') @@ -234,39 +290,27 @@ export class AgentRegistry extends Service { */ reserve(id: AgentId): AgentRegistrationReservation { if (typeof id !== 'string') throw new TypeError('agent id must be a string') - if (this.store.has(id) || this.reservations.has(id)) { + if (this.store.has(id) || this.reservations.has(id) || this.enteringIds.has(id)) { throw new Error(`agent "${id}" is already registered or reserved`) } - let active = true const rawRelease = (): void => { - if (!active) return - active = false this.reservations.delete(id) } - let disposeEffect!: () => Promise | void - const reservation: AgentRegistrationReservation = Object.freeze({ - id, - release: () => { - rawRelease() - // Remove the now-inert ownership effect on manual transaction settle; - // its cleanup is the exact idempotent raw release above. - void disposeEffect() - }, - }) + // `release` is the exact effect disposer. A composite lifecycle can yield + // it by identity, moving automatic owner cleanup from a racing sibling to + // the transaction's final ordered position. + const release = this.ctx.effect(() => rawRelease, `agents.reserve(${id})`) + const reservation: AgentRegistrationReservation = Object.freeze({ id, release }) this.reservations.set(id, reservation) - try { - disposeEffect = this.ctx.effect(() => rawRelease, `agents.reserve(${id})`) - } catch (error: unknown) { - rawRelease() - throw error - } return reservation } /** * Register the agent-creation factory (the loop calls this on construction, - * effect-scoped). Throws if a factory is already registered. Returns the - * disposer; on dispose the factory slot is cleared. + * effect-scoped). The registry captures both callback identities once and + * later invokes them against the retained target receiver. Throws if a + * factory is already registered. Returns the disposer; on dispose the + * factory slot is cleared. * @param factory - the loop-owned factory {@link create}/{@link resume} delegate to. * @returns the disposer that clears the factory slot. The exact * Cordis effect disposer (single-shot): composite (generator) effects may @@ -275,7 +319,17 @@ export class AgentRegistry extends Service { setFactory(factory: AgentFactory): () => Promise | void { const dispose = this.ctx.effect(() => { if (this.factory !== undefined) throw new Error('an agent factory is already registered') - this.factory = factory + // Claim the slot before reading caller-controlled method accessors. A + // getter may synchronously re-enter setFactory(); it must observe the + // registration in progress instead of installing a nested factory that + // the outer call would silently overwrite. + this.factory = ACCEPTING_FACTORY + try { + this.factory = acceptAgentFactory(factory) + } catch (error: unknown) { + this.factory = undefined + throw error + } return () => { this.factory = undefined } }, 'agents.setFactory()') // The exact cordis effect disposer (the agents.register() convention): a @@ -285,6 +339,13 @@ export class AgentRegistry extends Service { return dispose } + /** Return the accepted factory, excluding absence and reentrant acceptance. */ + private requireFactory(): AcceptedAgentFactory { + const accepted = this.factory + if (accepted === undefined || accepted === ACCEPTING_FACTORY) throw new Error(NO_FACTORY_MESSAGE) + return accepted + } + /** * Create and publish a new agent through the registered factory. * Distinct from {@link register} (which records an already-constructed @@ -295,8 +356,14 @@ export class AgentRegistry extends Service { * @returns the handle after setup, rollback-covered publication, and loop start complete. */ async create(options: CreateAgentOptions): Promise { - if (this.factory === undefined) throw new Error(NO_FACTORY_MESSAGE) - return this.factory.createAgent(options) + const accepted = this.requireFactory() + const ownerCtx = this.ctx + // Re-trace a Service-backed factory through the accessing context + // explicitly. This preserves AgentLoop's dependency origin while binding + // its effects to ownerCtx; plain factories receive ownerCtx as an explicit + // capability and need no Cordis tracker magic. + const receiver = getTraceable(ownerCtx, accepted.target) + return Reflect.apply(accepted.createAgent, receiver, [ownerCtx, options]) } /** @@ -307,8 +374,10 @@ export class AgentRegistry extends Service { * @returns the handle after setup, rollback-covered publication, and loop start complete. */ async resume(options: ResumeAgentOptions): Promise { - if (this.factory === undefined) throw new Error(NO_FACTORY_MESSAGE) - return this.factory.resume(options) + const accepted = this.requireFactory() + const ownerCtx = this.ctx + const receiver = getTraceable(ownerCtx, accepted.target) + return Reflect.apply(accepted.resume, receiver, [ownerCtx, options]) } /** @@ -347,7 +416,9 @@ export class AgentRegistry extends Service { * @param reservation - the exact unpublished-id capability, when a factory * reserved this id across setup. * @returns an idempotent closure that removes this exact entry and emits - * `agent/disposed` with listener failures contained. + * `agent/disposed` with listener failures contained. When called from a + * synchronous `agent/created` listener, removal and disposal wait until + * that creation dispatch unwinds. */ enter(agent: Agent, reservation?: AgentRegistrationReservation): () => void { const id = agent.id @@ -361,39 +432,108 @@ export class AgentRegistry extends Service { if (this.acceptedIds.has(agent)) { throw new Error(`agent "${id}" is already registered`) } - if (this.store.has(id)) { + if (this.store.has(id) || this.enteringIds.has(id)) { throw new Error(`agent "${id}" is already registered`) } + this.enteringIds.add(id) + let carrier: Scoped try { // Registration accepts ownership of the public identity contract. Pin an // own data slot from the one captured value so a custom JavaScript Agent // with a getter or writable field cannot later present a different id to // event listeners while the registry still owns the accepted key. - Object.defineProperty(agent, 'id', { - value: id, - enumerable: true, - writable: false, - configurable: false, - }) - } catch { - // Only the engine's property-definition failure is swallowed; the stable - // public error below is the registration contract exposed to callers. - throw new TypeError('agent id must be installable as a stable own property') + try { + Object.defineProperty(agent, 'id', { + value: id, + enumerable: true, + writable: false, + configurable: false, + }) + } catch { + // Only the engine's property-definition failure is normalized; filter + // construction below retains its own precise failure. + throw new TypeError('agent id must be installable as a stable own property') + } + // Capture one carrier for the paired lifecycle edges. Constructing it + // reads a custom Agent's Context.filter and is therefore caller code; + // the id claim above makes a same-id reentrant enter lose deterministically. + carrier = scopeTarget(agent, agent) + } finally { + // Kept through the entire caller-code window; the final commit below is + // synchronous and callback-free. + this.enteringIds.delete(id) + } + const currentReservation = this.reservations.get(id) + if (reservation === undefined) { + /* v8 ignore next 2 -- reserve() rejects enteringIds, so no callback in + * carrier construction can install a new same-id reservation */ + if (currentReservation !== undefined) { + throw new Error(`agent "${id}" is reserved for unpublished creation`) + } + } else if (currentReservation !== reservation) { + throw new Error(`agent "${id}" registration reservation is not active for this id`) + } + /* v8 ignore next 2 -- the enteringIds claim blocks every public same-id + * commit until this callback-free final check has completed */ + if (this.acceptedIds.has(agent) || this.store.has(id)) { + throw new Error(`agent "${id}" is already registered`) } this.store.set(id, agent) this.acceptedIds.set(agent, id) + this.carriers.set(agent, carrier) let entered = true - return () => { + const detach = (): void => { if (!entered) return entered = false - this.store.delete(id) - this.acceptedIds.delete(agent) - // An insertion rolled back before announce was never externally created, - // so emitting disposed would invent an impossible lifecycle edge. Marking - // happens before the created emit: if a later created listener throws, - // earlier listeners may already have observed it and must see disposal. - if (!this.announced.delete(agent)) return - agentEvents(this.ctx, agent).emit('agent/disposed') + // Every callback reached by this creation dispatch must observe the same + // live entry, and disposal must follow creation. A listener may own + // the advanced detach capability, so make that ordering structural: + // visibility and the paired disposal are deferred until announce()'s + // synchronous dispatch has unwound. + if (this.announcing.has(agent)) { + this.pendingDetach.add(agent) + return + } + this.detachEntered(agent, id) + } + return detach + } + + /** Remove one exact entered agent and emit its paired disposal when announced. */ + private detachEntered(agent: Agent, id: AgentId): void { + this.pendingDetach.delete(agent) + // A stale capability can never delete a later same-id lifecycle. The + // commit claim prevents this mismatch in normal operation; retain the + // exact-object guard as the final identity boundary. + /* v8 ignore next 1 -- the commit claim makes replacement impossible; this + * remains the exact-identity backstop against future mutation paths */ + if (this.store.get(id) !== agent || this.acceptedIds.get(agent) !== id) return + this.store.delete(id) + this.acceptedIds.delete(agent) + const carrier = this.carriers.get(agent) + this.carriers.delete(agent) + // An insertion rolled back before announce was never externally created, + // so emitting disposed would invent an impossible lifecycle edge. Marking + // happens before the created emit: if a later created listener throws, + // earlier listeners may already have observed it and must see disposal. + if (!this.announced.delete(agent)) return + /* v8 ignore next -- enter commits the carrier with the exact store entry */ + if (carrier === undefined) throw new Error(`agent "${id}" has no dispatch carrier`) + this.emitDisposed(agent, carrier, id) + } + + /** Emit the paired disposal edge through the entry's stable carrier. */ + private emitDisposed(agent: Agent, carrier: Scoped, id: AgentId): void { + const args: unknown[] = [carrier, 'agent/disposed', agent] + for (const callback of this.ctx.events.dispatch('emit', args)) { + try { + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`agent "${id}": agent/disposed listener rejected: ${renderThrown(error)}`) + }) + } catch (error: unknown) { + this.ctx.logger.warn(`agent "${id}": agent/disposed listener threw: ${renderThrown(error)}`) + } } } @@ -409,21 +549,30 @@ export class AgentRegistry extends Service { if (id === undefined || this.store.get(id) !== agent) { throw new Error(`agent "${id ?? ''}" is not live in this registry`) } - if (this.announced.has(agent)) { + if (this.announced.has(agent) || this.announcing.has(agent)) { throw new Error(`agent "${id}" was already announced`) } + const carrier = this.carriers.get(agent) + /* v8 ignore next -- enter commits the carrier with the exact store entry */ + if (carrier === undefined) throw new Error(`agent "${id}" has no dispatch carrier`) // Mark before dispatch so a listener cannot recursively create a second // lifecycle edge; detach still pairs a partially delivered first edge. + this.announcing.add(agent) this.announced.add(agent) - const args: unknown[] = [scopeTarget(agent, agent), 'agent/created', agent] - for (const callback of this.ctx.events.dispatch('emit', args)) { - // A synchronous creation failure vetoes publication and rolls back. - // Returned-promise rejection happens after this synchronous boundary, so - // observe and report it instead of leaking an unhandled rejection. - const returned: unknown = callback(...args) - void Promise.resolve(returned).catch((error: unknown) => { - this.ctx.logger.warn(`agent "${id}": agent/created listener rejected: ${renderThrown(error)}`) - }) + const args: unknown[] = [carrier, 'agent/created', agent] + try { + for (const callback of this.ctx.events.dispatch('emit', args)) { + // A synchronous creation failure vetoes publication and rolls back. + // Returned-promise rejection happens after this synchronous boundary, so + // observe and report it instead of leaking an unhandled rejection. + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`agent "${id}": agent/created listener rejected: ${renderThrown(error)}`) + }) + } + } finally { + this.announcing.delete(agent) + if (this.pendingDetach.has(agent)) this.detachEntered(agent, id) } } diff --git a/packages/core/agent/src/types.ts b/packages/core/agent/src/types.ts index b6a32fa050..0e914888b9 100644 --- a/packages/core/agent/src/types.ts +++ b/packages/core/agent/src/types.ts @@ -291,7 +291,11 @@ declare module 'cordis' { * to inject or queue work during startup. A synchronous listener throw * vetoes publication and rollback emits the matching disposal edges; * returned-promise rejection is observed and logged but cannot - * retroactively veto this synchronous boundary. + * retroactively veto this synchronous boundary. A synchronous listener + * that requests the advanced registry detach does not remove the entry + * immediately: removal and the paired `agent/disposed` edge wait until the + * creation dispatch unwinds, so no later creation listener observes a + * disposal that preceded its own creation callback. * @param agent - the newly registered agent with its live session and completed setup. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered * through `agent.ctx` fires only for that agent's dispatches; a listener on a @@ -302,11 +306,12 @@ declare module 'cordis' { */ 'agent/created'(this: Scoped, agent: Agent): void /** - * An agent was removed from the registry after its driver and any in-flight - * turn reached quiescence. Ordered teardown may still be detaching the - * session and unwinding the agent's scoped registrations when this - * notification runs. - * @param agent - the deregistered agent; its driving handle is now inert. + * An agent was removed from the registry. The concrete AgentLoop lifecycle + * emits this only after its driver and any in-flight turn reach quiescence; + * a custom agent registered through the public registry owns its own driver + * contract, which the registry cannot infer. Ordered teardown may still be + * detaching the session and unwinding scoped registrations when this runs. + * @param agent - the exact agent removed from the registry. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered * through `agent.ctx` fires only for that agent's dispatches; a listener on a * plain plugin context fires for every agent. The dispatch `this` is the @@ -348,11 +353,12 @@ declare module 'cordis' { /** * The agent's session lifecycle began, fired once before its first turn. * `source` says why ({@link SessionStartSource}: fresh startup, a resumed - * persisted session, …). A pure NOTIFICATION (emit, not waterfall): it - * carries no veto — a session-start listener that wants to seed context does - * so via `agent.inject()` (a `context/message` the first request sees), not - * by returning a decision. Cannot block the session from starting; that gap - * is deliberate (a bridge logs/injects, it does not gate startup). + * persisted session, …). A pure NOTIFICATION (emit, not waterfall): a + * listener cannot veto by returning a decision or throwing. A listener that + * wants to seed context does so via `agent.inject()` (a `context/message` the + * first request sees). A lifecycle owner can still dispose its structural + * ownership edge during this notification; publication rechecks liveness and + * then aborts before the driver starts. * @param agent - the agent whose session lifecycle began. * @param source - why the session started (fresh startup, resume, …). * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered diff --git a/packages/core/agent/tests/agent.spec.ts b/packages/core/agent/tests/agent.spec.ts index 87a0e51e9d..ab3202a297 100644 --- a/packages/core/agent/tests/agent.spec.ts +++ b/packages/core/agent/tests/agent.spec.ts @@ -1,7 +1,8 @@ import { describe, expect, it } from 'vitest' -import { Context } from 'cordis' +import { Context, Service, symbols } from 'cordis' import { Session, SessionId } from '@deepseek-ai/dsh-session' import AgentRegistry, { Agent, AgentId, agentEvents } from '@deepseek-ai/dsh-agent' +import type { AgentFactory, CreateAgentOptions, ResumeAgentOptions } from '@deepseek-ai/dsh-agent' function stubAgent(rawId: string): Agent { const id = AgentId(rawId) @@ -178,6 +179,96 @@ describe('AgentRegistry', () => { expect(() => ctx.agents.enter(pinnedAccessor)).toThrow(/installable as a stable own property/) }) + it('claims an id across a Proxy defineProperty trap before committing the exact entry', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const id = AgentId('reentrant-enter') + const nested = stubAgent(id) + let nestedError = '' + let attempted = false + const target = stubAgent(id) + const outer = new Proxy(target, { + defineProperty(inner, property, descriptor) { + if (property === 'id' && !attempted) { + attempted = true + try { + ctx.agents.enter(nested) + } catch (error: unknown) { + nestedError = String(error) + } + } + return Reflect.defineProperty(inner, property, descriptor) + }, + }) + + const detach = ctx.agents.enter(outer) + expect(nestedError).toMatch(/already registered/) + expect(ctx.agents.get(id)).toBe(outer) + detach() + expect(ctx.agents.get(id)).toBeUndefined() + }) + + it('captures one lifecycle carrier before commit so a filter getter cannot invert edges', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const events: string[] = [] + const agent = stubAgent('reentrant-carrier') + let detach = (): void => {} + Object.defineProperty(agent, Context.filter, { + configurable: true, + get() { + events.push('filter-getter') + detach() + return undefined + }, + }) + detach = ctx.agents.enter(agent) + ctx.on('agent/created', () => { events.push('created') }) + ctx.on('agent/disposed', () => { events.push('disposed') }) + + ctx.agents.announce(agent) + expect(events).toEqual(['filter-getter', 'created']) + expect(ctx.agents.get(agent.id)).toBe(agent) + detach() + expect(events).toEqual(['filter-getter', 'created', 'disposed']) + expect(ctx.agents.get(agent.id)).toBeUndefined() + }) + + it('revalidates an exact reservation after carrier construction runs caller code', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const reservation = ctx.agents.reserve(AgentId('released-during-enter')) + const agent = stubAgent('released-during-enter') + Object.defineProperty(agent, Context.filter, { + configurable: true, + get() { + reservation.release() + return undefined + }, + }) + + expect(() => ctx.agents.enter(agent, reservation)).toThrow(/reservation is not active/) + expect(ctx.agents.get(agent.id)).toBeUndefined() + }) + + it('observes an async agent/disposed rejection through the stable carrier', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + ctx.on('agent/disposed', () => Promise.reject(new Error('late disposal failure')) as never) + const agent = stubAgent('async-disposed') + const detach = ctx.agents.enter(agent) + ctx.agents.announce(agent) + + detach() + await Promise.resolve() + await Promise.resolve() + expect(warnings).toEqual([ + 'agent "async-disposed": agent/disposed listener rejected: Error: late disposal failure', + ]) + }) + it('uses an opaque one-id reservation to gate unpublished factory insertion', async () => { const ctx = new Context() await ctx.plugin(AgentRegistry) @@ -251,6 +342,34 @@ describe('AgentRegistry', () => { detach() expect({ created, disposed }).toEqual({ created: 1, disposed: 1 }) }) + + it('defers a reentrant detach until the creation dispatch unwinds', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const order: string[] = [] + const agent = stubAgent('reentrant-detach') + const detach = ctx.agents.enter(agent) + + ctx.on('agent/created', (created) => { + order.push('created:first') + detach() + expect(ctx.agents.get(created.id)).toBe(created) + }) + ctx.on('agent/created', (created) => { + order.push('created:second') + expect(ctx.agents.get(created.id)).toBe(created) + }) + ctx.on('agent/disposed', (disposed) => { + order.push('disposed') + expect(ctx.agents.get(disposed.id)).toBeUndefined() + }) + + ctx.agents.announce(agent) + + expect(order).toEqual(['created:first', 'created:second', 'disposed']) + expect(ctx.agents.get(agent.id)).toBeUndefined() + detach() + }) }) describe('agentEvents()', () => { @@ -281,14 +400,17 @@ describe('agentEvents()', () => { describe('AgentRegistry factory seam', () => { /** A stub AgentFactory that records calls and returns a stub agent. */ function stubFactory() { - const calls: { create: unknown[]; resume: unknown[] } = { create: [], resume: [] } - const factory: import('@deepseek-ai/dsh-agent').AgentFactory = { - async createAgent(options) { - calls.create.push(options) + const calls: { + create: Array<{ ownerCtx: Context; options: CreateAgentOptions }> + resume: Array<{ ownerCtx: Context; options: ResumeAgentOptions }> + } = { create: [], resume: [] } + const factory: AgentFactory = { + async createAgent(ownerCtx, options) { + calls.create.push({ ownerCtx, options }) return { agent: stubAgent(options.agentId), dispose: () => Promise.resolve() } }, - resume(options) { - calls.resume.push(options) + resume(ownerCtx, options) { + calls.resume.push({ ownerCtx, options }) return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }) }, } @@ -310,11 +432,151 @@ describe('AgentRegistry factory seam', () => { const created = await ctx.agents.create({ agentId: AgentId('c1'), sessionId: SessionId('sess-1'), meta: { cwd: '/w' } }) expect(created.agent.id).toBe('c1') - expect(calls.create).toEqual([{ agentId: AgentId('c1'), sessionId: SessionId('sess-1'), meta: { cwd: '/w' } }]) + expect(calls.create).toHaveLength(1) + expect(calls.create[0]!.ownerCtx.fiber).toBe(ctx.fiber) + expect(calls.create[0]!.options) + .toEqual({ agentId: AgentId('c1'), sessionId: SessionId('sess-1'), meta: { cwd: '/w' } }) const resumed = await ctx.agents.resume({ agentId: AgentId('r1'), resumeSessionId: SessionId('old-sess') }) expect(resumed.agent.id).toBe('r1') - expect(calls.resume).toEqual([{ agentId: AgentId('r1'), resumeSessionId: SessionId('old-sess') }]) + expect(calls.resume).toHaveLength(1) + expect(calls.resume[0]!.ownerCtx.fiber).toBe(ctx.fiber) + expect(calls.resume[0]!.options).toEqual({ agentId: AgentId('r1'), resumeSessionId: SessionId('old-sess') }) + }) + + it('passes the calling fiber to a plain factory for create and resume ownership', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const { factory, calls } = stubFactory() + ctx.agents.setFactory(factory) + let callerFiber: Context['fiber'] | undefined + + const owner = await ctx.plugin(Object.assign(async (inner: Context) => { + callerFiber = inner.fiber + await inner.agents.create({ agentId: AgentId('owned-create'), sessionId: SessionId('owned-session') }) + await inner.agents.resume({ agentId: AgentId('owned-resume'), resumeSessionId: SessionId('persisted') }) + }, { inject: ['agents'] })) + + expect(calls.create[0]!.ownerCtx.fiber).toBe(callerFiber) + expect(calls.resume[0]!.ownerCtx.fiber).toBe(callerFiber) + await owner.dispose() + }) + + it('captures factory callbacks once while retaining the intentional target receiver', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const reads = { create: 0, resume: 0 } + const receivers: unknown[] = [] + const replacements: string[] = [] + const target = { label: 'accepted-target' } as { label: string } & AgentFactory + + Object.defineProperties(target, { + createAgent: { + configurable: true, + get() { + reads.create += 1 + return function (this: typeof target, _ownerCtx: Context, options: CreateAgentOptions) { + receivers.push(this) + return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }) + } + }, + }, + resume: { + configurable: true, + get() { + reads.resume += 1 + return function (this: typeof target, _ownerCtx: Context, options: ResumeAgentOptions) { + receivers.push(this) + return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }) + } + }, + }, + }) + + ctx.agents.setFactory(target) + Object.defineProperties(target, { + createAgent: { + value: () => { + replacements.push('create') + return Promise.resolve({ agent: stubAgent('replacement'), dispose: () => Promise.resolve() }) + }, + }, + resume: { + value: () => { + replacements.push('resume') + return Promise.resolve({ agent: stubAgent('replacement'), dispose: () => Promise.resolve() }) + }, + }, + }) + + await ctx.agents.create({ agentId: AgentId('captured-create'), sessionId: SessionId('captured-session') }) + await ctx.agents.resume({ agentId: AgentId('captured-resume'), resumeSessionId: SessionId('captured-persisted') }) + + expect(reads).toEqual({ create: 1, resume: 1 }) + expect(receivers).toEqual([target, target]) + expect(replacements).toEqual([]) + }) + + it('reserves the factory slot before reading reentrant callback accessors', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const nested = stubFactory().factory + const reads: string[] = [] + const reentrantCreate: Promise[] = [] + const target = {} as AgentFactory + + Object.defineProperties(target, { + createAgent: { + get() { + reads.push('createAgent') + expect(() => ctx.agents.setFactory(nested)).toThrow(/already registered/) + reentrantCreate.push(ctx.agents.create({ + agentId: AgentId('during-acceptance'), + sessionId: SessionId('during-acceptance-session'), + })) + return (_ownerCtx: Context, options: CreateAgentOptions) => Promise.resolve({ + agent: stubAgent(options.agentId), + dispose: () => Promise.resolve(), + }) + }, + }, + resume: { + get() { + reads.push('resume') + return (_ownerCtx: Context, options: ResumeAgentOptions) => Promise.resolve({ + agent: stubAgent(options.agentId), + dispose: () => Promise.resolve(), + }) + }, + }, + }) + + ctx.agents.setFactory(target) + expect(reentrantCreate).toHaveLength(1) + await expect(Promise.all(reentrantCreate)).rejects.toThrow(/no agent factory/) + await expect(ctx.agents.create({ + agentId: AgentId('after-acceptance'), + sessionId: SessionId('after-acceptance-session'), + })).resolves.toMatchObject({ agent: { id: 'after-acceptance' } }) + expect(reads).toEqual(['createAgent', 'resume']) + }) + + it('validates the complete factory shape when accepting it', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + + expect(() => ctx.agents.setFactory(null as unknown as AgentFactory)).toThrow(/non-null object or function/) + expect(() => ctx.agents.setFactory(42 as unknown as AgentFactory)).toThrow(/non-null object or function/) + expect(() => ctx.agents.setFactory({ resume() { return Promise.resolve() } } as unknown as AgentFactory)) + .toThrow(/createAgent must be a function/) + expect(() => ctx.agents.setFactory({ createAgent() { return Promise.resolve() } } as unknown as AgentFactory)) + .toThrow(/resume must be a function/) + + const callable = Object.assign(() => undefined, stubFactory().factory) + const dispose = ctx.agents.setFactory(callable) + await expect(ctx.agents.create({ agentId: AgentId('callable'), sessionId: SessionId('callable-session') })) + .resolves.toBeDefined() + await dispose() }) it('setFactory rejects a second factory', async () => { @@ -337,4 +599,81 @@ describe('AgentRegistry factory seam', () => { // factory slot cleared → create throws again await expect(ctx.agents.create({ agentId: AgentId('a2'), sessionId: SessionId('s2') })).rejects.toThrow(/no agent factory/) }) + + it('canonicalizes an already traced Service factory before caller retracing', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + const states = new WeakMap() + class TracedFactory extends Service implements AgentFactory { + constructor(inner: Context) { + super(inner, 'tracedFactory') + states.set(this, []) + } + + private calls(): string[] { + const original = (this as unknown as { [symbols.original]?: TracedFactory })[symbols.original] ?? this + const calls = states.get(original) + if (calls === undefined) throw new Error('factory receiver did not canonicalize to the raw service') + return calls + } + + createAgent(_ownerCtx: Context, options: CreateAgentOptions) { + this.calls().push('create') + return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }) + } + + resume(_ownerCtx: Context, options: ResumeAgentOptions) { + this.calls().push('resume') + return Promise.resolve({ agent: stubAgent(options.agentId), dispose: () => Promise.resolve() }) + } + } + await ctx.plugin(TracedFactory) + const traced = (ctx as Context & { tracedFactory: TracedFactory }).tracedFactory + ctx.agents.setFactory(traced) + + await ctx.agents.create({ agentId: AgentId('traced-create'), sessionId: SessionId('traced-session') }) + await ctx.agents.resume({ agentId: AgentId('traced-resume'), resumeSessionId: SessionId('traced-persisted') }) + const raw = (traced as unknown as { [symbols.original]?: TracedFactory })[symbols.original] + expect(states.get(raw!)).toEqual(['create', 'resume']) + }) + + it('rolls back register and factory acceptance when their owner unloads reentrantly', async () => { + const ctx = new Context() + await ctx.plugin(AgentRegistry) + let ownerCtx!: Context + const owner = await ctx.plugin(Object.assign((inner: Context) => { ownerCtx = inner }, { inject: ['agents'] })) + const agent = stubAgent('register-unload-race') + ctx.on('agent/created', (created) => { + if (created === agent) void owner.dispose() + }) + + ownerCtx.agents.register(agent) + await owner.dispose() + expect(ctx.agents.get(agent.id)).toBeUndefined() + + let factoryOwnerCtx!: Context + const factoryOwner = await ctx.plugin(Object.assign((inner: Context) => { factoryOwnerCtx = inner }, { inject: ['agents'] })) + const target = {} as AgentFactory + Object.defineProperties(target, { + createAgent: { + get() { + void factoryOwner.dispose() + return (_inner: Context, options: CreateAgentOptions) => Promise.resolve({ + agent: stubAgent(options.agentId), + dispose: () => Promise.resolve(), + }) + }, + }, + resume: { + value: (_inner: Context, options: ResumeAgentOptions) => Promise.resolve({ + agent: stubAgent(options.agentId), + dispose: () => Promise.resolve(), + }), + }, + }) + factoryOwnerCtx.agents.setFactory(target) + await factoryOwner.dispose() + await expect(ctx.agents.create({ agentId: AgentId('after-owner'), sessionId: SessionId('after-owner-s') })) + .rejects.toThrow(/no agent factory/) + }) }) diff --git a/packages/core/scope/README.md b/packages/core/scope/README.md index 727acea4fb..1813ff5071 100644 --- a/packages/core/scope/README.md +++ b/packages/core/scope/README.md @@ -9,7 +9,7 @@ Scoped-context registration primitive. `createScope(ctx, key)` mints a Cordis co - `Scope.rawDispose` The EXACT Cordis disposer for the backing fiber — a composite (generator) effect yields THIS function to nest the scope's teardown at that yield position (Cordis dedupes nested effects by function identity; yielding a wrapper leaves the scope disposing as a concurrent sibling). - `Scope.dispose(): Promise` Idempotent, shared quiescence boundary for every registration made through the scope. Racing/repeat calls await the same teardown, including when `rawDispose` invoked the underlying single-shot Cordis disposer first. - `scopeOf(ctx: Context): ScopeKey | undefined` The tag a context (or any context derived from it) carries; `undefined` = context-global. -- `scopeTarget(base: T, key: ScopeKey | undefined): Scoped` Build the dispatch `thisArg` for a scope-filtered event: capture and compose `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). The carrier uses a dedicated surrogate proxy target whose immutable filter slot cannot be replaced by a base property pinned before, during, or after construction; ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to `base`, and callable carriers match the base's constructable/non-constructable shape. For non-overlay base-owned properties, descriptor queries preserve values and flags except that configurable is normalized to `true`, as required to report those properties through an extensible surrogate. Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics). +- `scopeTarget(base: T, key: ScopeKey | undefined): Scoped` Build the dispatch `thisArg` for a scope-filtered event: capture and compose `base`'s own `Context.filter` with the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key; `key === undefined` ⇒ untagged only). The captured base filter and the exposed composed filter are invoked through captured JavaScript primordials, and the composed filter's frozen invocation surface cannot be replaced or tampered with. The carrier uses a dedicated surrogate proxy target; ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to `base`, and callable carriers match the base's constructable/non-constructable shape. For non-overlay base-owned properties, descriptor queries preserve values and flags except that configurable is normalized to `true`, as required to report those properties through an extensible surrogate; defining through the carrier is therefore supported only with an explicit `configurable: true` descriptor, while an omitted or false flag is rejected before the base is touched. Listener `this` stays `base`-shaped. `{ global: true }` listeners bypass filtering (Cordis semantics). - `Scoped` The compile-time carrier brand: scope-filtered events demand it as their `this` type, so dispatching with a bare subject is a compile error. - `isScopeCarrier(value)` / `carrierKeyOf(value)` Runtime carrier marks, used by the dev invariants to assert every scope-filtered dispatch carries a carrier keyed to the subject its arguments name. - `scopeHost(ctx, services)` Test/tooling host that snapshots the requested service list before activation, fails loud with stable missing-service diagnostics, and whose shared `dispose()` waits for both the host fiber and every minted scope, including a child already tearing down through `rawDispose`. diff --git a/packages/core/scope/src/index.ts b/packages/core/scope/src/index.ts index 9c917fc89d..158d6d37d8 100644 --- a/packages/core/scope/src/index.ts +++ b/packages/core/scope/src/index.ts @@ -25,6 +25,14 @@ import type { Context, Fiber } from 'cordis' import { Context as CordisContext } from 'cordis' +// Capture the invocation primordials once. A carrier holder can reach the +// composed Context.filter function, so neither that function's mutable +// property surface nor a base filter's own `.call` may choose how isolation +// predicates are invoked. +const reflectApply = Reflect.apply +// eslint-disable-next-line @typescript-eslint/unbound-method +const functionCall = Function.prototype.call + /** * The identity a scope is keyed by. Opaque and compared by object identity — * never inspected. The harness convention: a live `Agent` is the key of its @@ -194,8 +202,11 @@ function isConstructable(value: (...args: unknown[]) => unknown): boolean { * - its tag IS `key` (a scoped listener seeing exactly its own subject), * * AND `base`'s own filter (a Cordis `Service`'s isolation check) also admits - * it. Dispatching with `key === undefined` — a subject-less dispatch, e.g. a - * tool call with no calling agent or a bare (agent-less) session's events — + * it. Both the captured base filter and the composed filter are invoked + * through captured JavaScript primordials, so mutating either function's + * public `.call` property cannot bypass either predicate. Dispatching with + * `key === undefined` — a subject-less dispatch, e.g. a tool call with no + * calling agent or a bare (agent-less) session's events — * admits only untagged listeners: a scoped listener never fires for someone * else's (or nobody's) subject. Listeners registered `{ global: true }` * bypass all filtering (Cordis semantics). @@ -211,7 +222,11 @@ function isConstructable(value: (...args: unknown[]) => unknown): boolean { * subject always travels in the event's arguments. The returned carrier is * branded {@link Scoped} and runtime-marked ({@link isScopeCarrier} / * {@link carrierKeyOf}) so both the type system and the dev invariants can - * tell a carrier from a bare subject. + * tell a carrier from a bare subject. Defining an ordinary property through + * the carrier is supported only when its descriptor explicitly says + * `configurable: true`; an omitted or false flag is rejected before touching + * `base`, because the extensible surrogate cannot truthfully report a new + * non-configurable base property. * @param base - the object the event is dispatched on behalf of (the owning * service, or the subject agent itself); its own `Context.filter` is * preserved and composed. @@ -225,10 +240,19 @@ export function scopeTarget(base: T, key: ScopeKey | undefined throw new TypeError('scope target Context.filter must be a function when present') } const filter = (ctx: Context): boolean => { - if (baseFilter && !baseFilter.call(base, ctx)) return false + if (baseFilter && !reflectApply(functionCall, baseFilter, [base, ctx])) return false const tag = scopeOf(ctx) return tag === undefined || tag === key } + // Cordis invokes a dispatch filter as `filter.call(thisArg, listenerCtx)`. + // Pin that property to the captured primordial, then freeze the callable so + // a carrier holder cannot replace it with an always-true scope bypass. + Object.defineProperty(filter, 'call', { + value: functionCall, + writable: false, + configurable: false, + }) + Object.freeze(filter) const overlay: Record = { [CordisContext.filter]: filter, [kCarrier]: Object.freeze({ key }), @@ -317,7 +341,7 @@ export function scopeTarget(base: T, key: ScopeKey | undefined return undefined }, defineProperty(_target, prop, attributes) { - if (Object.hasOwn(overlay, prop)) return false + if (Object.hasOwn(overlay, prop) || attributes.configurable !== true) return false return Reflect.defineProperty(base, prop, attributes) }, deleteProperty(_target, prop) { diff --git a/packages/core/scope/tests/scope.spec.ts b/packages/core/scope/tests/scope.spec.ts index 5b379d15e5..7242aa942d 100644 --- a/packages/core/scope/tests/scope.spec.ts +++ b/packages/core/scope/tests/scope.spec.ts @@ -189,10 +189,54 @@ describe('scopeTarget dispatch filtering', () => { ctx.emit(scopeTarget(vetoBase, keyA), 'scope-test/ping', 'vetoed') expect(heard).toEqual([]) - // A base whose filter accepts delegates to the scope predicate. - const openBase = { [Context.filter]: () => true } + // A base whose filter accepts delegates to the scope predicate, with the + // real base preserved as its `this` receiver. + let baseReceiverWasOpen = false + const openBase = { + [Context.filter](this: object): boolean { + baseReceiverWasOpen = this === openBase + return true + }, + } ctx.emit(scopeTarget(openBase, keyA), 'scope-test/ping', 'open') expect(heard).toEqual(['global:open', 'A:open']) + expect(baseReceiverWasOpen).toBe(true) + + // A function's public `.call` property is not its invocation semantics. + // An always-true replacement must not override the base predicate's veto. + const tamperedVeto = (): boolean => false + Object.defineProperty(tamperedVeto, 'call', { value: () => true }) + ctx.emit(scopeTarget({ [Context.filter]: tamperedVeto }, keyA), 'scope-test/ping', 'tampered-veto') + expect(heard).toEqual(['global:open', 'A:open']) + }) + + it('pins the exposed composed filter invocation so a carrier holder cannot bypass isolation', async () => { + const ctx = new Context() + const keyA = { name: 'A' } + const keyB = { name: 'B' } + const scopeA = await mintScope(ctx, keyA) + const scopeB = await mintScope(ctx, keyB) + const heard: string[] = [] + ctx.on('scope-test/ping', value => void heard.push(`global:${value}`)) + scopeA.ctx.on('scope-test/ping', value => void heard.push(`A:${value}`)) + scopeB.ctx.on('scope-test/ping', value => void heard.push(`B:${value}`)) + + const carrier = scopeTarget(ctx, keyA) + const exposedFilter: unknown = Reflect.get(carrier, Context.filter) + expect(typeof exposedFilter).toBe('function') + const filter = exposedFilter as ((ctx: Context) => boolean) & { call: (...args: unknown[]) => unknown } + const primordialCall: unknown = Reflect.get(Function.prototype, 'call') + expect(Object.getOwnPropertyDescriptor(filter, 'call')).toMatchObject({ + value: primordialCall, + writable: false, + configurable: false, + }) + expect(Object.isFrozen(filter)).toBe(true) + expect(Reflect.set(filter, 'call', () => true)).toBe(false) + expect(Reflect.defineProperty(filter, 'call', { value: () => true })).toBe(false) + + ctx.emit(carrier, 'scope-test/ping', 'still-A-only') + expect(heard).toEqual(['global:still-A-only', 'A:still-A-only']) }) it('keeps listener `this` base-shaped through the carrier (waterfall)', async () => { @@ -256,6 +300,14 @@ describe('scopeTarget dispatch filtering', () => { Object.defineProperty(carrier, 'extra', { value: 1, configurable: true }) expect((base as typeof base & { extra?: number }).extra).toBe(1) expect(delete (carrier as typeof carrier & { extra?: number }).extra).toBe(true) + + // A non-configurable property cannot be reflected truthfully through the + // extensible surrogate. Reject before mutating the delegated base; an + // omitted `configurable` has JavaScript's false default and is rejected too. + expect(Reflect.defineProperty(carrier, 'sealed', { value: 1, configurable: false })).toBe(false) + expect(Object.hasOwn(base, 'sealed')).toBe(false) + expect(Reflect.defineProperty(carrier, 'default-sealed', { value: 2 })).toBe(false) + expect(Object.hasOwn(base, 'default-sealed')).toBe(false) expect(Reflect.preventExtensions(carrier)).toBe(false) expect(Reflect.setPrototypeOf(carrier, null)).toBe(false) }) diff --git a/packages/core/session/README.md b/packages/core/session/README.md index 29f89e35c8..7389d6fade 100644 --- a/packages/core/session/README.md +++ b/packages/core/session/README.md @@ -19,9 +19,9 @@ Creates and holds event-sourced `Session` instances. Persistence is intentionall `create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before the store-owned append observer detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: - `ctx.sessions.prepare(id?, options?): Session` — read `options.seed`/`options.meta` once, validate and detach the metadata/header, and construct the `Session` WITHOUT entering it into the store. Same options as `create`. -- `ctx.sessions.reserve(id): SessionRegistrationReservation` — hold an unpublished id under the calling fiber and construct its one owned Session through `reservation.prepare(options?)`. Until `release()` or owner unload, bare `prepare`/`create`/`enter` calls for that id reject; the factory later presents the exact capability to `enter`, making setup-time publication structurally impossible without leaking an abandoned reservation across HMR disposal. -- `ctx.sessions.enter(session, reservation?): () => void` — install the module-private `session/event` observer, capture its scope carrier, and add the session under one accepted id; returns the idempotent DETACH disposer, which clears notification, carrier, and accepted-key state. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved; a stale prepared object must not overwrite a live same-id session. A factory passes the opaque capability from `reserve(id)` so setup cannot enter the reserved session or publish a same-id replacement before the owning transaction. -- `ctx.sessions.announce(session): void` — begin the one allowed `session/created` announcement for an entered session; repeat and reentrant calls reject before dispatch. Its detach emits `session/disposed` exactly once, including rollback after a partially delivered creation notification; a never-announced entry emits neither edge. +- `ctx.sessions.reserve(id): SessionRegistrationReservation` — hold an unpublished id under the calling fiber and construct its one owned Session through `reservation.prepare(options?)`. `release` is the exact owner effect disposer, so the agent lifecycle can adopt it and keep the ID reserved until scope cleanup quiesces. Until that release, bare `prepare`/`create`/`enter` calls for the id reject; the factory later presents the exact capability to `enter`, making setup-time publication structurally impossible without leaking an abandoned reservation across HMR disposal. +- `ctx.sessions.enter(session, reservation?): () => void` — claim the ID across caller-controlled filter/carrier evaluation, then install the module-private `session/event` observer and add the exact session under its accepted key; a reentrant same-ID entry cannot be overwritten. Returns the idempotent, exact-object-guarded DETACH disposer, which clears notification, carrier, and accepted-key state without letting a stale capability delete a replacement. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved. A factory passes the opaque capability from `reserve(id)` so setup cannot enter the reserved session or publish a same-id replacement before the owning transaction. +- `ctx.sessions.announce(session): void` — begin the one allowed `session/created` announcement for an entered session; repeat and reentrant calls reject before dispatch. A detach requested synchronously by a creation listener is deferred until that dispatch unwinds, so another creation listener cannot observe `session/disposed` before its own `session/created` callback. Detach emits `session/disposed` exactly once, including rollback after a partially delivered creation notification; a never-announced entry emits neither edge. `dsh-agent-loop` is the canonical consumer: after unpublished agent setup it enters both session and agent before announcing either, then nests loop stop, agent removal, session detach, and scope unwind in one ordered lifecycle. The final flush therefore settles before this package detaches the session, whether teardown starts from an `AgentHandle` or owner-fiber unload. diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts index b000e7083b..d8b3afb139 100644 --- a/packages/core/session/src/index.ts +++ b/packages/core/session/src/index.ts @@ -37,7 +37,9 @@ declare module 'cordis' { * A session was created in the store. A synchronous listener throw vetoes * publication and rollback emits the matching `session/disposed` edge; * returned-promise rejection is observed and logged but cannot retroactively - * veto this synchronous boundary. + * veto this synchronous boundary. A synchronous listener that requests the + * advanced detach does not remove the entry immediately: removal and the + * paired `session/disposed` edge wait until the creation dispatch unwinds. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the * session's owner scope, captured when the session was ENTERED (an agent's * session is entered through `agent.ctx`, so its events dispatch in that @@ -648,7 +650,9 @@ export interface SessionRegistrationReservation { prepare(options?: CreateSessionOptions): Session /** * Release the unpublished reservation; idempotent. The store also releases - * it automatically when the fiber that called `reserve` disposes. + * it automatically when the fiber that called `reserve` disposes. This + * function is that exact Cordis effect disposer, so an ordered lifecycle may + * yield it by identity and place release after quiescence. * @returns nothing. */ release(): void @@ -662,10 +666,16 @@ export interface SessionRegistrationReservation { */ export class SessionStore extends Service { private store = new Map() + /** Ids claimed across caller-code boundaries before their exact entry commits. */ + private enteringIds = new Set() /** The one accepted map key for each live session; never reread caller state. */ private acceptedIds = new WeakMap() /** Sessions whose creation announcement began and therefore require a pair. */ private announced = new WeakSet() + /** Entries currently dispatching `session/created`; detach waits for dispatch to unwind. */ + private announcing = new WeakSet() + /** A detach requested reentrantly from `session/created`. */ + private pendingDetach = new WeakSet() /** Unpublished identities held across factory load/setup transactions. */ private reservations = new Map() /** The exact prepared object owned by each reservation capability. */ @@ -696,18 +706,19 @@ export class SessionStore extends Service { */ reserve(id: SessionId): SessionRegistrationReservation { if (typeof id !== 'string') throw new TypeError('session id must be a string') - if (this.store.has(id) || this.reservations.has(id)) { + if (this.store.has(id) || this.reservations.has(id) || this.enteringIds.has(id)) { throw new Error(`session "${id}" already exists or is reserved`) } let active = true let prepared = false const rawRelease = (): void => { - if (!active) return active = false this.reservedSessions.delete(reservation) this.reservations.delete(id) } - let disposeEffect!: () => Promise | void + // `release` is the exact effect disposer, so an ordered composite can + // adopt the automatic owner cleanup instead of racing it as a sibling. + const release = this.ctx.effect(() => rawRelease, `sessions.reserve(${id})`) const reservation: SessionRegistrationReservation = Object.freeze({ id, prepare: (options?: CreateSessionOptions) => { @@ -720,20 +731,9 @@ export class SessionStore extends Service { this.reservedSessions.set(reservation, session) return session }, - release: () => { - rawRelease() - // Remove the now-inert ownership effect on manual transaction settle; - // its cleanup is the exact idempotent raw release above. - void disposeEffect() - }, + release, }) this.reservations.set(id, reservation) - try { - disposeEffect = this.ctx.effect(() => rawRelease, `sessions.reserve(${id})`) - } catch (error: unknown) { - rawRelease() - throw error - } return reservation } @@ -845,7 +845,9 @@ export class SessionStore extends Service { * @param session - a {@link prepare}d session not yet in the store. * @param reservation - the exact unpublished-id capability when a factory * reserved this session across setup. - * @returns the detach disposer (observer + store removal). + * @returns the detach disposer (observer + store removal). When called from + * a synchronous `session/created` listener, removal and disposal wait until + * that creation dispatch unwinds. * @throws if a session with this id is already in the store. */ enter(session: Session, reservation?: SessionRegistrationReservation): () => void { @@ -858,30 +860,71 @@ export class SessionStore extends Service { || this.reservedSessions.get(reservation) !== session) { throw new Error(`session "${id}" registration reservation does not own this prepared session`) } - if (this.store.has(id)) throw new Error(`session "${id}" already exists`) + if (this.store.has(id) || this.enteringIds.has(id)) { + throw new Error(`session "${id}" already exists`) + } if (appendObservers.has(session)) throw new Error(`session "${id}" is already attached to a store`) + this.enteringIds.add(id) // The carrier is decided HERE, once, from the ENTERING context's scope tag // (`this.ctx` is the caller's context — the tracker mechanism): every // session/created|event|flush dispatch for this session uses it, so the // session's whole event feed is scope-filtered consistently. The base is // the session itself (scoped listeners' `this` is the session). - const carrier = scopeTarget(session, scopeOf(this.ctx)) + let carrier: Scoped + try { + carrier = scopeTarget(session, scopeOf(this.ctx)) + } finally { + this.enteringIds.delete(id) + } + const currentReservation = this.reservations.get(id) + if (reservation === undefined) { + /* v8 ignore next 2 -- reserve() rejects enteringIds, so carrier + * construction cannot install a new same-id reservation */ + if (currentReservation !== undefined) { + throw new Error(`session "${id}" is reserved for unpublished creation`) + } + } else if (currentReservation !== reservation + || this.reservedSessions.get(reservation) !== session) { + throw new Error(`session "${id}" registration reservation does not own this prepared session`) + } + /* v8 ignore next 1 -- enteringIds prevents a same-store commit during carrier construction */ + if (this.store.has(id)) throw new Error(`session "${id}" already exists`) + if (appendObservers.has(session)) throw new Error(`session "${id}" is already attached to a store`) this.carriers.set(session, carrier) const emitCtx = this.ctx appendObservers.set(session, (event) => { emitCtx.emit(carrier, 'session/event', session, event) }) this.acceptedIds.set(session, id) this.store.set(id, session) let entered = true - return () => { + const detach = (): void => { if (!entered) return entered = false - const wasAnnounced = this.announced.delete(session) - appendObservers.delete(session) - this.acceptedIds.delete(session) - this.carriers.delete(session) - this.store.delete(id) - if (wasAnnounced) this.emitDisposed(session, carrier, id) + // A creation listener may own the advanced detach capability. Keep the + // entry and its event observer live until the synchronous creation + // dispatch unwinds, then publish the paired disposal edge. + if (this.announcing.has(session)) { + this.pendingDetach.add(session) + return + } + this.detachEntered(session, id, carrier) } + return detach + } + + /** Remove one exact entered session and emit its paired disposal when announced. */ + private detachEntered(session: Session, id: SessionId, carrier: Scoped): void { + this.pendingDetach.delete(session) + // A stale capability cannot remove observers or storage belonging to a + // later same-id lifecycle. + /* v8 ignore next 1 -- the commit claim makes replacement impossible; this + * remains the exact-identity backstop against future mutation paths */ + if (this.store.get(id) !== session || this.acceptedIds.get(session) !== id) return + const wasAnnounced = this.announced.delete(session) + appendObservers.delete(session) + this.acceptedIds.delete(session) + this.carriers.delete(session) + this.store.delete(id) + if (wasAnnounced) this.emitDisposed(session, carrier, id) } /** Emit `session/created` exactly once for an {@link enter}ed session (with @@ -892,25 +935,31 @@ export class SessionStore extends Service { * @throws if the session is not live or its announcement already began, * including a reentrant call from a creation listener. */ announce(session: Session): void { - const carrier = this.liveCarrierFor(session) + const { carrier, id } = this.liveEntryFor(session) if (this.announced.has(session)) { - throw new Error(`session "${session.id}" was already announced`) + throw new Error(`session "${id}" was already announced`) } // Mark before emit: Cordis emit may deliver to earlier listeners and then // throw. Rollback must still pair that partial creation with disposal, and // a listener cannot recursively create a second lifecycle edge. this.announced.add(session) const args: unknown[] = [carrier, 'session/created', session] - for (const callback of this.ctx.events.dispatch('emit', args)) { - // Synchronous throws intentionally propagate and veto publication; the - // yielded detach then emits the paired disposal edge. An async function - // is nevertheless assignable to a void listener, so observe its returned - // promise: rejection is too late to roll back and must be logged instead - // of becoming unhandled. - const returned: unknown = callback(...args) - void Promise.resolve(returned).catch((error: unknown) => { - this.ctx.logger.warn(`session "${session.id}": session/created listener rejected: ${renderThrown(error)}`) - }) + this.announcing.add(session) + try { + for (const callback of this.ctx.events.dispatch('emit', args)) { + // Synchronous throws intentionally propagate and veto publication; the + // yielded detach then emits the paired disposal edge. An async function + // is nevertheless assignable to a void listener, so observe its returned + // promise: rejection is too late to roll back and must be logged instead + // of becoming unhandled. + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + this.ctx.logger.warn(`session "${id}": session/created listener rejected: ${renderThrown(error)}`) + }) + } + } finally { + this.announcing.delete(session) + if (this.pendingDetach.has(session)) this.detachEntered(session, id, carrier) } } @@ -940,11 +989,11 @@ export class SessionStore extends Service { * @returns resolves when every flush listener has settled; rejects if one rejects. */ async flush(session: Session): Promise { - await this.ctx.parallel(this.liveCarrierFor(session), 'session/flush', session) + await this.ctx.parallel(this.liveEntryFor(session).carrier, 'session/flush', session) } - /** Return the exact live session's carrier; detached/prepared objects reject. */ - private liveCarrierFor(session: Session): Scoped { + /** Return the exact live session's accepted id and carrier; detached/prepared objects reject. */ + private liveEntryFor(session: Session): { id: SessionId; carrier: Scoped } { const id = this.acceptedIds.get(session) if (id === undefined || this.store.get(id) !== session) { throw new Error(`session "${id ?? session.id}" is not live in this store`) @@ -957,7 +1006,7 @@ export class SessionStore extends Service { if (carrier === undefined) { throw new Error(`session "${id}" has no dispatch carrier`) } - return carrier + return { id, carrier } } /** diff --git a/packages/core/session/tests/session.spec.ts b/packages/core/session/tests/session.spec.ts index ac0f06123c..6edeac0084 100644 --- a/packages/core/session/tests/session.spec.ts +++ b/packages/core/session/tests/session.spec.ts @@ -740,6 +740,79 @@ describe('SessionStore', () => { expect(ctx.sessions.get(SessionId('racy'))).toBe(live) }) + it('claims an id across Context.filter evaluation before committing the exact session', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const id = SessionId('reentrant-enter') + const nested = new Session(id) + const outer = new Session(id) + let nestedError = '' + let attempted = false + Object.defineProperty(outer, Context.filter, { + configurable: true, + get() { + if (!attempted) { + attempted = true + try { + ctx.sessions.enter(nested) + } catch (error: unknown) { + nestedError = String(error) + } + } + return undefined + }, + }) + + const detach = ctx.sessions.enter(outer) + expect(nestedError).toMatch(/already exists/) + expect(ctx.sessions.get(id)).toBe(outer) + detach() + expect(ctx.sessions.get(id)).toBeUndefined() + }) + + it('revalidates reservation ownership after carrier construction runs caller code', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const id = SessionId('released-during-enter') + const reservation = ctx.sessions.reserve(id) + const session = reservation.prepare() + Object.defineProperty(session, Context.filter, { + configurable: true, + get() { + reservation.release() + return undefined + }, + }) + + expect(() => ctx.sessions.enter(session, reservation)).toThrow(/does not own this prepared session/) + expect(ctx.sessions.get(id)).toBeUndefined() + }) + + it('rejects when carrier construction attaches the same session to another store', async () => { + const firstCtx = new Context() + const secondCtx = new Context() + await firstCtx.plugin(SessionStore) + await secondCtx.plugin(SessionStore) + const session = new Session(SessionId('cross-store-carrier')) + let attempted = false + let detachSecond = (): void => {} + Object.defineProperty(session, Context.filter, { + configurable: true, + get() { + if (!attempted) { + attempted = true + detachSecond = secondCtx.sessions.enter(session) + } + return undefined + }, + }) + + expect(() => firstCtx.sessions.enter(session)).toThrow(/already attached to a store/) + expect(firstCtx.sessions.get(session.id)).toBeUndefined() + expect(secondCtx.sessions.get(session.id)).toBe(session) + detachSecond() + }) + it('prepare() + enter() + announce() register a session and emit session/created', async () => { const ctx = new Context() await ctx.plugin(SessionStore) @@ -869,6 +942,49 @@ describe('SessionStore', () => { expect({ created, disposed }).toEqual({ created: 1, disposed: 1 }) }) + it('defers a reentrant detach until the creation dispatch unwinds', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const order: string[] = [] + const session = ctx.sessions.prepare(SessionId('reentrant-detach')) + const detach = ctx.sessions.enter(session) + + ctx.on('session/created', (created) => { + order.push('created:first') + detach() + expect(ctx.sessions.get(created.id)).toBe(created) + }) + ctx.on('session/created', (created) => { + order.push('created:second') + expect(ctx.sessions.get(created.id)).toBe(created) + }) + ctx.on('session/disposed', (disposed) => { + order.push('disposed') + expect(ctx.sessions.get(disposed.id)).toBeUndefined() + }) + + ctx.sessions.announce(session) + + expect(order).toEqual(['created:first', 'created:second', 'disposed']) + expect(ctx.sessions.get(session.id)).toBeUndefined() + detach() + }) + + it('rolls back create when its owner unloads from session/created', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + let ownerCtx!: Context + const owner = await ctx.plugin(Object.assign((inner: Context) => { ownerCtx = inner }, { inject: ['sessions'] })) + const id = SessionId('create-unload-race') + ctx.on('session/created', (session) => { + if (session.id === id) void owner.dispose() + }) + + ownerCtx.sessions.create(id) + await owner.dispose() + expect(ctx.sessions.get(id)).toBeUndefined() + }) + it('synthesizes a minimal current-version header for a bare-created session', async () => { const ctx = new Context() await ctx.plugin(SessionStore) diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md index e5b40ccfdc..1e812ce60d 100644 --- a/packages/subagent/subagent-inprocess/README.md +++ b/packages/subagent/subagent-inprocess/README.md @@ -13,7 +13,7 @@ Runs a child as a child [`Agent`](../../core/agent) on the same cordis context ( 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent; 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field). -`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope). Before readiness, `cancel()` deactivates the unpublished owner so no agent, session, or lifecycle event can escape; after readiness it cancels the live child immediately. Either path records the cancellation, so a cancel landing before any `turn/end` settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`. +`SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope). Before readiness, `cancel()` deactivates the creation owner: before creation notification begins, no agent/session lifecycle edge escapes; if cancellation is triggered synchronously by a creation observer, every begun edge is paired by rollback and the driver never unlocks or starts. After readiness, cancellation reaches the live child immediately. Either path records the cancellation, so a cancel landing before any `turn/end` settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`. ### `InProcessRunOptions` diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md index 0aba0eb680..1879e60e7e 100644 --- a/packages/workflow/workflow-workerthread/README.md +++ b/packages/workflow/workflow-workerthread/README.md @@ -23,7 +23,7 @@ What the seam guarantees regardless, because benign scripts hit these constantly `start()` shape-validates the meta DATA host-side and parse-checks the body with the identical wrapper the worker compiles (`new vm.Script`, discarded), preserving the seam's synchronous `META_INVALID`/`SCRIPT_PARSE` throws; one redundant parse per run is the deliberate price. It then spawns the worker (unbuilt: a JavaScript data-URL bootstrap registers tsx's ESM and CommonJS transforms inside the worker before importing `src/worker.ts`, giving the whole mixed-module source graph full TypeScript and tsconfig-path transformation on every supported Node line; built: the sibling `lib/worker.js` bundle) with the meta, body, `args`, and worker-side limits as `workerData`. -Inside the worker, `runWorkerSession` builds the execution core (hooks, combinators, concurrency semaphore, caps, fatal-error discipline) over a **child port**. `agent()` sends `child-start`, and the host starts the child on `ctx.subagents` with parent attribution, the shared per-run abort signal, and `outputSchema`/`model` pass-through. +Inside the worker, `runWorkerSession` builds the execution core (hooks, combinators, concurrency semaphore, caps, fatal-error discipline) over a **child port**. `agent()` sends `child-start`, and the host starts the child through the holder-bound `SubagentService` handle captured synchronously by `start()`, with parent attribution, the shared per-run abort signal, and `outputSchema`/`model` pass-through. This capture is part of the seam's holder-owned lifetime: unloading the engine removes `ctx.workflows` for new calls but does not invalidate an already returned run whose worker starts another child afterward. The host observes `run.result` immediately but buffers its snapshotted wire projection until `run.started` fulfills. It then replies `child-started` with the child id before forwarding settlement, so `workflow/agent-start` always names a ready child and precedes its end. A readiness rejection replies `child-start-error`, emits no workflow agent pair, and makes the host dispose the attempt because the worker never received a handle; the worker classifies it as fatal `AGENT_START` unless cancellation already owns the run. If readiness fulfills, an infrastructure result rejection crosses as `child-failed`/`AGENT_RESULT` regardless of whether that rejection settled before or after readiness. Child disposal acknowledgements complete the RPC. diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index 56c0e455f8..8c839fbccb 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -1,9 +1,10 @@ /** * The host half of one worker-engine run: spawn the Worker, bridge its child - * RPC onto `ctx.subagents`, fan its observer messages into the engine's - * events, and own cancellation, the settle-within-grace guarantee, and child - * cleanup. The worker's lifetime IS the run's lifetime: `dispose()` always - * ends with `worker.terminate()`, so no thread outlives its run. + * RPC onto the holder-bound subagent service, fan its observer messages into + * the engine's events, and own cancellation, the settle-within-grace + * guarantee, and child cleanup. The worker's lifetime IS the run's lifetime: + * `dispose()` always ends with `worker.terminate()`, so no thread outlives its + * run. * * The run's `result` promise settles exactly once, from whichever of these * lands first: the worker's `result` message (a host-side cancellation in @@ -47,6 +48,7 @@ import type { Context } from 'cordis' import type { Agent } from '@deepseek-ai/dsh-agent' import { assertNever } from '@deepseek-ai/dsh-llm' import { snapshotJsonValue } from '@deepseek-ai/dsh-session' +import type SubagentService from '@deepseek-ai/dsh-subagent' import type { SubagentRun } from '@deepseek-ai/dsh-subagent' import type { WorkflowAgentEndInfo, WorkflowAgentInfo, WorkflowMeta, WorkflowResult, WorkflowRun, WorkflowRunId } from '@deepseek-ai/dsh-workflow' import { renderThrown } from './realm.ts' @@ -121,7 +123,9 @@ function resolveWorkerSpawn(init: WorkerInit): { entry: URL; options: WorkerOpti * `start()` directly. Owns the Worker, the child registry, and the result * settlement; `result` never rejects. `meta` is this handle's OWN clone * (event payloads carry separate clones), so a consumer mutating it corrupts - * nothing. + * nothing. The holder-bound SubagentService handle is captured before the + * engine returns this run, so unloading the engine removes only the ability to + * start another workflow; this run can still start and clean up its children. */ export class WorkerRun implements WorkflowRun { /** Settles exactly once with the run's outcome; never rejects. */ @@ -151,6 +155,7 @@ export class WorkerRun implements WorkflowRun { constructor( private readonly ctx: Context, + private readonly subagents: SubagentService, readonly id: WorkflowRunId, readonly meta: WorkflowMeta, private readonly parent: Agent, @@ -329,7 +334,7 @@ export class WorkerRun implements WorkflowRun { this.hostStarted += 1 let run: SubagentRun try { - run = this.ctx.subagents.start(this.provider, { + run = this.subagents.start(this.provider, { prompt: [{ type: 'text', text: request.prompt }], parent: this.parent, signal: this.controller.signal, diff --git a/packages/workflow/workflow-workerthread/src/index.ts b/packages/workflow/workflow-workerthread/src/index.ts index e0b8caf3fb..8a21847cd5 100644 --- a/packages/workflow/workflow-workerthread/src/index.ts +++ b/packages/workflow/workflow-workerthread/src/index.ts @@ -168,8 +168,17 @@ export class WorkerWorkflowEngine extends WorkflowService { ...request.args !== undefined ? { args: request.args } : {}, limits, } + // Capture the dependency while this service call is still traced through + // the start() holder. Cordis strips the engine-provider shadow when it + // returns the SubagentService handle, so an already-returned run can keep + // starting children after an engine HMR unload removes ctx.workflows. + // Re-resolving `this.ctx.subagents` later from WorkerRun would instead walk + // the now-inactive engine fiber and break the seam's holder-owned lifetime. + const runCtx = this.ctx + const subagents = runCtx.subagents const workerRun = new WorkerRun( - this.ctx, + runCtx, + subagents, id, structuredClone(meta), request.parent, diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 9ccbb17a4e..641b26518d 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -148,8 +148,8 @@ async function setup(options?: SetupOptions) { // A fixed concurrency ceiling: the auto-resolved default is machine-derived // (cores - 2, floored at 1), so tests that expect N children in flight // would wedge on small CI runners. - await ctx.plugin(WorkerWorkflowEngine, { provider: 'stub', maxConcurrentAgents: 8, ...options?.config }) - return { ctx, provider, parent: fakeParent() } + const engineFiber = await ctx.plugin(WorkerWorkflowEngine, { provider: 'stub', maxConcurrentAgents: 8, ...options?.config }) + return { ctx, provider, parent: fakeParent(), engineFiber } } /** The standard test meta plus a body, spread into a start request. */ @@ -1235,6 +1235,34 @@ describe('dsh-workflow-workerthread', () => { expect(ctx.get('workflows')).toBeUndefined() }) + it('keeps a holder-owned run usable when the engine unloads before its child starts', async () => { + const { ctx, parent, provider, engineFiber } = await setup({ reply: () => text('survived reload') }) + let handle!: ReturnType + const holder = await ctx.plugin(Object.assign((inner: Context) => { + handle = inner.workflows.start({ ...scripted("return await agent('after reload')"), parent }) + }, { inject: ['workflows'] })) + + try { + // A real worker cannot deliver child-start in the synchronous start() + // slice. Unload the provider before that message arrives: the returned + // run belongs to `holder`, not to the engine fiber being reloaded. + expect(provider.runs).toHaveLength(0) + await engineFiber.dispose() + expect(ctx.get('workflows')).toBeUndefined() + + await expect(handle.result).resolves.toEqual({ + value: 'survived reload', + stopReason: 'completed', + agentsStarted: 1, + }) + expect(provider.runs).toHaveLength(1) + } finally { + await handle.dispose() + await holder.dispose() + await ctx.fiber.dispose() + } + }) + it('has the class-plugin export shape (default = the engine service class)', () => { expect(workerEngineModule.default).toBe(WorkerWorkflowEngine) const loader = Object.create(Loader.prototype) as Loader diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts index 32ea8539c6..ae1fa8d170 100644 --- a/scripts/gen-cordis-catalog.ts +++ b/scripts/gen-cordis-catalog.ts @@ -81,12 +81,15 @@ const FENCE = 'ts cordis-catalog' */ export const LINK_MAP: Record = { Agent: 'core.md', + AgentRegistrationReservation: 'core.md', ContentBlock: 'core.md', Message: 'core.md', MessageSource: 'core.md', GenerateOptions: 'core.md', LlmCallConfig: 'core.md', SessionEvent: 'core.md', + SessionStartSource: 'core.md', + SessionRegistrationReservation: 'session.md', StreamChunk: 'llm-streaming.md', TurnEndReason: 'session.md', ToolDefinition: 'tools.md', diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts index 5459755be5..048ce58937 100644 --- a/scripts/gen-doc-graphs.ts +++ b/scripts/gen-doc-graphs.ts @@ -249,6 +249,9 @@ const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: str // Creation notifications preserve synchronous veto/rollback but observe // returned promises explicitly so async listener rejection is not unhandled. { event: 'agent/created', pkg: 'agent', method: 'events.dispatch' }, + // Registry disposal reuses the stable carrier captured before entry commit + // and contains each listener directly rather than rebuilding via agentEvents. + { event: 'agent/disposed', pkg: 'agent', method: 'events.dispatch' }, { event: 'session/created', pkg: 'session', method: 'events.dispatch' }, // Session disposal uses direct callback resolution so teardown contains each // synchronous throw and returned-promise rejection independently. diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json index e238583e69..62111d1551 100644 --- a/scripts/type-equiv.manifest.json +++ b/scripts/type-equiv.manifest.json @@ -11,6 +11,7 @@ { "doc": "docs/core-data-structures/core.md", "symbol": "LlmCallConfig", "source": "packages/llm/llm/src/call-config.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "SessionEvent", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "Agent", "source": "packages/core/agent/src/types.ts" }, + { "doc": "docs/core-data-structures/core.md", "symbol": "AgentRegistrationReservation", "source": "packages/core/agent/src/index.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "HookContext", "source": "packages/core/agent/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "PromptDecision", "source": "packages/core/agent/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "ContinuationDecision", "source": "packages/core/agent/src/types.ts" }, @@ -40,6 +41,7 @@ { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceOp", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceIntent", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceNode", "source": "packages/core/session/src/surface.ts" }, + { "doc": "docs/core-data-structures/session.md", "symbol": "SessionRegistrationReservation", "source": "packages/core/session/src/index.ts" }, { "doc": "docs/core-data-structures/persistence.md", "symbol": "SessionHeader", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/persistence.md", "symbol": "CreateSessionOptions", "source": "packages/core/session/src/types.ts" }, diff --git a/vendor/README.md b/vendor/README.md index bf0f0b5a8c..0a709495db 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -35,6 +35,7 @@ Keep this log exhaustive — every divergence from upstream must be listed. 3. **All `tsconfig.json` files**: regenerated to extend the repo-root `tsconfig.base.json`, emit TypeScript intermediates to `lib/types`, and declare project references. 4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`. 5. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under `lib/types` and then write the publish runtime entries under `lib/`. Like the regenerated tsconfigs, they are not part of the upstream sync surface. +6. **`cordis/src/fiber.ts` lifecycle hardening**: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is `UNLOADING` (while `PENDING` and `LOADING` remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before `internal/plugin` publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, skip plugin execution when reentrant disposal invalidates the load epoch before its first checkpoint, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup. ## Sync procedure diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts index fd472e7733..7e7766b48d 100644 --- a/vendor/cordis/src/fiber.ts +++ b/vendor/cordis/src/fiber.ts @@ -80,6 +80,35 @@ interface EffectRunner { getOuterStack: () => string[] } +// Public effect disposers remain single-shot, but structural owners and outer +// effects must still be able to join a cleanup that another caller started. +const effectInertia = new WeakMap void | Promise>() + +function runDisposable(dispose: Disposable) { + const result = dispose() + return effectInertia.get(dispose)?.() ?? result +} + +/** Notify plugin teardown without allowing one observer to break ownership cleanup. */ +function emitPluginDisposed(context: Context, fiber: Fiber) { + const args: any[] = ['internal/plugin', fiber] + let callbacks: Function[] + try { + callbacks = context.events.dispatch('emit', args) + } catch (error) { + context.logger.error(error) + return + } + for (const callback of callbacks) { + try { + const returned = callback(...args) + void Promise.resolve(returned).catch(error => context.logger.error(error)) + } catch (error) { + context.logger.error(error) + } + } +} + /** Lifecycle state for one plugin fiber. */ export const enum FiberState { PENDING, @@ -175,24 +204,19 @@ export class Fiber { collect, } - this.context.emit('internal/plugin', this) - - for (const name of Object.keys(this.inject)) { - this._checkImpl(name) - } - + let shouldRefresh = false this.dispose = parent.fiber.effect(() => { const remove = runtime.fibers.push(this) try { this.config = resolveConfig(runtime, config) - this._refresh() + shouldRefresh = true } catch (error) { this.ctx.logger.error(error) this._error = error } return async () => { this.uid = null - this.context.emit('internal/plugin', this) + emitPluginDisposed(this.context, this) if (this.ctx.registry.has(runtime.callback)) { remove() if (!runtime.fibers.length) { @@ -200,6 +224,16 @@ export class Fiber { } } this._setEpoch(INACTIVE) + // A PENDING fiber can already own effects registered by an + // internal/plugin observer. Its epoch is still INACTIVE, so + // _setEpoch() has no transition to drive; explicitly unload that + // pre-activation work before reporting disposal complete. + if (!this.inertia) { + this._updateState(() => { + this.inertia = this._unload() + return FiberState.UNLOADING + }) + } // `this.inertia` itself should never reject — both `_reload` and // `_unload` swallow their own work errors via `ctx.logger.error`. // If it *does* reject, the only remaining cause is the logger @@ -211,6 +245,28 @@ export class Fiber { } } }, 'ctx.plugin()') + + try { + // Publish only after the parent owns a fully assigned disposer. A + // synchronous observer may dispose either this fiber or its parent. + this.context.emit('internal/plugin', this) + } catch (error) { + // Publication failed synchronously. The disposer removes the child + // from both the parent and runtime before control escapes. + void Promise.resolve(this.dispose()).catch(reason => this.ctx.logger.error(reason)) + throw error + } + + // Keep the initial notification's historical PENDING view. The loader + // may also extend `inject` in that notification, so resolve dependencies + // only after publication. A reentrant parent unload makes the child + // disposer responsible for draining any PENDING effects instead. + if (this.uid !== null && parent.fiber.state !== FiberState.UNLOADING) { + for (const name of Object.keys(this.inject)) { + this._checkImpl(name) + } + if (shouldRefresh) this._refresh() + } } else { this.uid = 0 this.ctx = this.context = parent @@ -292,21 +348,28 @@ export class Fiber { effect(execute: () => Effect, label?: string): AsyncDisposable> effect(execute: () => Effect, label = 'anonymous'): any { this.assertActive() + if (this.state === FiberState.UNLOADING) { + throw new CordisError('INACTIVE_EFFECT') + } const disposables: Disposable[] = [] + let disposing = false + let disposalTask: void | Promise const dispose = () => { + if (disposing) return disposalTask + disposing = true let task!: void | Promise - for (const dispose of disposables.splice(0).reverse()) { + for (const disposable of disposables.splice(0).reverse()) { if (task) { - task = task.then(dispose) + task = task.then(() => runDisposable(disposable)) } else { - const result = dispose() + const result = runDisposable(disposable) if (isObject(result) && 'then' in result) { task = result as any } } } - return task + return disposalTask = task } const meta: EffectMeta = { label, children: [] } @@ -324,34 +387,107 @@ export class Fiber { } let task: void | Promise + let executing = true + let resolveSetup: (() => void) | undefined + let rejectSetup: ((reason: unknown) => void) | undefined + let setupBarrier: Promise | undefined + let setupFailed = false + let inFlight: void | Promise + let removeWrapper = () => false + + const waitForSetup = () => { + setupBarrier ??= new Promise((resolve, reject) => { + resolveSetup = resolve + rejectSetup = reject + }) + return setupBarrier + } + + const disposeAfter = (setup: PromiseLike) => { + return Promise.resolve(setup).then( + () => dispose(), + async (reason) => { + await dispose() + throw reason + }, + ) + } + + const finalizeDisposal = (callback: () => void | Promise) => { + let result: void | Promise + try { + result = callback() + } catch (error) { + removeWrapper() + throw error + } + if (isObject(result) && 'then' in result) { + const pending = Promise.resolve(result).finally(() => { + removeWrapper() + if (inFlight === pending) inFlight = undefined + }) + return inFlight = pending + } + removeWrapper() + return result + } + + const wrapper = defineProperty(() => { + // A synchronous setup failure can race an owner unload that already + // captured this wrapper but has not invoked it yet. The failed effect is + // never returned publicly, so let that internal caller await rollback. + if (!runner.epoch) return setupFailed ? inFlight : undefined + runner.epoch = false + return finalizeDisposal(() => { + if (executing) return disposeAfter(waitForSetup()) + return task ? disposeAfter(task) : dispose() + }) + }, symbols.effect, meta) as AsyncDisposable + effectInertia.set(wrapper, () => inFlight) + + // Make the effect visible to a reentrant owner unload before execute() + // runs any plugin code. Async teardown stays owner-visible until it + // settles, allowing an outer effect to join cleanup another caller began. + removeWrapper = this._disposables.push(wrapper) try { task = this._execute(runner) } catch (reason) { - dispose() + executing = false + setupFailed = true + runner.epoch = false + let cleanup: void | Promise + try { + cleanup = finalizeDisposal(dispose) + } finally { + rejectSetup?.(reason) + } + if (isObject(cleanup) && 'then' in cleanup) { + cleanup.catch(error => this.ctx.logger.error(error)) + } throw reason } + executing = false + if (setupBarrier) { + Promise.resolve(task).then(resolveSetup, rejectSetup) + } // prevent unhandled rejection — both from `task` itself and from the // disposer chain if it fails to settle cleanly. - task?.catch(dispose).catch((error) => this.ctx.logger.error(error)) - - const wrapper = defineProperty(() => { - if (!runner.epoch) return - runner.epoch = false - return task ? task.then(dispose) : dispose() - }, symbols.effect, meta) as AsyncDisposable + task?.catch(() => { + if (!runner.epoch) return dispose() + return finalizeDisposal(dispose) + }).catch((error) => this.ctx.logger.error(error)) const disposeAsync = () => { if (!runner.epoch) return runner.epoch = false - return dispose() + return finalizeDisposal(dispose) } wrapper.then = async (onFulfilled, onRejected) => { return Promise.resolve(task) .then(() => disposeAsync) .then(onFulfilled, onRejected) } - disposables.push(this._disposables.push(wrapper)) return wrapper } @@ -434,7 +570,12 @@ export class Fiber { const oldEpoch = this._runner.epoch try { await Promise.resolve() - await this._execute(this._runner) + // A disposer queued before this checkpoint may already have invalidated + // the load. Do not run plugin code for a stale epoch; the state update + // below will drain any effects collected while the fiber was PENDING. + if (this._runner.epoch === oldEpoch) { + await this._execute(this._runner) + } } catch (reason) { // impl guarantees that the error is non-null (?) this.ctx.logger.error(reason) @@ -457,7 +598,7 @@ export class Fiber { await composeError(async (info) => { await Promise.resolve() info.error = new Error() - await dispose() + await runDisposable(dispose) }, this._runner.getOuterStack) } catch (reason) { this.ctx.logger.error(reason) From 9fc2260bb638621205658b9cdab1eb3f6a6d6d7a Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 10:17:31 +0800 Subject: [PATCH 05/21] fix(workflow): harden terminal cleanup races Queue worker results before settlement cleanup, claim terminal and death boundaries before provider callbacks, and close late-message admission. Make child cancellation and disposal reentrancy-safe across the workflow bridge and generic subagent wrapper, with adversarial regression coverage and RFC documentation. --- .../2026-07-08-agent-scope-contexts.md | 57 ++- packages/subagent/subagent/README.md | 2 +- packages/subagent/subagent/src/index.ts | 20 +- .../subagent/subagent/tests/service.spec.ts | 51 +++ .../workflow/workflow-workerthread/README.md | 12 +- .../workflow-workerthread/src/host.ts | 264 ++++++++--- .../workflow-workerthread/src/runtime.ts | 28 +- .../workflow-workerthread/src/session.ts | 14 +- .../tests/session.spec.ts | 30 ++ .../tests/workflow-workerthread.spec.ts | 423 +++++++++++++++++- 10 files changed, 803 insertions(+), 98 deletions(-) diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index c29fb4f83b..df6433dd26 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -613,7 +613,7 @@ Starting a run reads every top-level request field once before capability valida The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. Calling `runOwner.ctx.agents.create()` gives the child factory an explicit `ownerCtx` carrying the run-owner fiber and scope, while the registry's traced factory receiver preserves AgentLoop's injected dependency origin. Parent teardown, provider teardown, and manual run disposal all dispose this same run-owner node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. -The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. +The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. The wrapper installs its shared disposal promise before invoking the raw provider callback, so synchronous reentry through the returned wrapper and ordinary repeat calls join one provider disposal rather than slipping through a not-yet-assigned memo. If the raw disposer directly returns that same reentrant wrapper promise, the service rejects the cyclic provider contract instead of awaiting a promise that depends on itself forever. The wrapper's `result` promise captures `output`, optional `structured`, and `stopReason` once and resolves to one detached, deeply frozen lossless-JSON value shared by the caller and lifecycle telemetry. Malformed terminal data is an infrastructure fault; it rejects only after the service has started rollback of the provider attempt. The service observes the normalized result immediately, before waiting for readiness, so an early rejection is never temporarily unhandled. @@ -658,24 +658,57 @@ SubagentService.start(...): Workflow worker bridge after receiving returnedRun: register the run so cancellation can reach pre-publication work attach result settlement handlers immediately and snapshot the outcome - if returnedRun.started fulfills: - send ChildStarted; then send the buffered or eventual outcome - else: - send ChildStartError and dispose the attempt + re-check terminal admission after provider start returns + if admission closed: + if the exact run remains registered: cancel once and dispose it + if worker-message admission remains open: send ChildStartError + else wait for returnedRun.started: + on fulfillment: + re-check terminal admission + if closed: apply the same identity-guarded refusal + else: send ChildStarted; then send the buffered or eventual outcome + on rejection: + if worker-message admission remains open: send ChildStartError + if the exact run remains registered: dispose it -Before publishing the workflow's own result: - abort the shared child-request signal - call cancel("workflow settled") on every host-registered run - only then settle the workflow result +Worker after choosing its result: + queue Result on the worker-to-host port + only then reap stray child handles + +Host at workflow Result receipt: + cancellationWasRequested = external cancellation is already in flight + atomically claim chosen = + if cancellationWasRequested and result is not cancelled: + cancelledResult + else: + result + + if not cancellationWasRequested: + abort the shared child-request signal + call cancel("workflow settled") on every host-registered run + + settle chosen + +Host at the first worker death signal: + close worker-message admission + claim death or preserve an earlier cancellation/Result/grace outcome + cancel and dispose every registered child + synthesize missing lifecycle ends + +Host at physical worker exit: + perform a final disposal-only sweep + do not repeat explicit child cancellation ``` -Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, sends `ChildStarted` only after `started` fulfills, and sends `ChildStartError` plus host-driven disposal when readiness rejects. +Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, and sends `ChildStarted` only after `started` fulfills while admission remains open. A readiness rejection is refused and host-disposed; `ChildStartError` is sent while worker-message admission remains open, and an already-retired exact run is not cleaned twice. Provider `start()` is itself arbitrary code and may synchronously reenter workflow cancellation before its returned run reaches that registry. The bridge attaches both promise observers, re-checks terminal admission immediately after `start()` returns and again at readiness, and turns a closed boundary into identity-guarded cancellation, disposal, and refusal rather than late worker admission or lifecycle announcement. An arbitrary provider may still fulfill its own `started` promise after the workflow boundary; the bridge refuses and cleans up that attempt instead of claiming it can undo provider-side publication. Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber. If cancellation lands before publication, the factory's liveness check prevents either creation edge. If it begins synchronously inside `session/created`, `agent/created`, or `agent/session-start`, the publication barrier lets the current notification phase unwind without revoking its world, the next liveness check prevents every later phase and driver start, and rollback pairs every creation edge that already began. In either case `started` rejects, no `subagent/start` or `subagent/end` is emitted, and the run result settles as `aborted`. -Before the workflow's own result becomes observable, its host likewise drives both permitted cancellation channels: it aborts the shared request signal and calls each registered run's `cancel()`, including runs still waiting on readiness. Provider cancel callbacks are contained independently so one broken implementation cannot prevent peers from receiving cancellation or wedge the workflow result. +Receipt of the worker's `Result` message is the workflow host's atomic first-wins boundary. The worker queues that message before its own settlement-reap `ChildCancel` messages, so same-port FIFO prevents an internal child callback from masquerading as earlier run cancellation. Each contender records its claim before its own callback fanout: external `cancel()` records its reason first, while Result receipt snapshots any earlier cancellation and claims the resulting terminal outcome before invoking settlement-cleanup provider code. A caller, signal, or dispose cancellation already in flight therefore overrides a non-cancelled worker report, while the report wins otherwise. Before exposing that chosen result, the host drives both permitted child-cancellation channels by aborting the shared request signal and calling every registered run's `cancel()`, including runs still waiting on readiness. Those calls are settlement-only cleanup, and the terminal claim makes a reentrant `WorkerRun.cancel()` a side-effect-free loser rather than merely repairing its result afterward. Host fanout and the worker's FIFO-later `ChildCancel` can both reach the explicit channel, so a per-call gate invokes each provider `cancel()` at most once; the seam does not require that callback to be idempotent. Explicit child cancel callbacks are contained independently so one throwing callback cannot starve peers or alter settlement. -Together these rules prevent an early result rejection from going unhandled, ensure `workflow/agent-start` never names an unpublished child, and prevent a child from publishing after its workflow has ended. +Unexpected worker death uses the same terminal-claim rule, but terminal ownership, message admission, and exit cleanup are separate state. The host snapshots whether external cancellation was already accepted, claims either `cancelled` or the death error, closes inbound worker messages, and only then reaps children and synthesizes missing lifecycle events. Closing admission is necessary because Node may emit `error`, deliver an already-queued `message`, and only then emit `exit`; without the logical barrier, that message could start a child or narrate after `workflow/end`. Provider code reentering cancellation during cleanup cannot rewrite a death-first error; conversely, a cancellation accepted before death remains the winner. If Result or grace already claimed the outcome, death preserves it while still reaping promptly. Physical exit then performs a final disposal-only sweep without repeating explicit provider cancellation. `handle.dispose()` claims its public promise before that traversal invokes cancellation or disposal callbacks, and every `disposeChild` path independently claims the call ID promise before invoking the wrapped child disposer. Public-first reentry returns the existing holder promise; worker-first reentry may begin holder disposal, whose child traversal joins the already-claimed call ID promise. This distinction is necessary because grace settlement precedes `worker.terminate()` and its exit event: suppressing a duplicate outcome, late message, or repeated cleanup request must not suppress disposal of survivors in the host registry. + +Together these rules prevent an early result rejection from going unhandled, ensure `workflow/agent-start` never names an unready child, and prevent the bridge from admitting or announcing a child after its workflow has ended. Parent teardown reaches `runOwner` by nesting; the provider and returned run handle reach the same node through their explicit disposers. diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md index 7e63f07376..e29706bd8b 100644 --- a/packages/subagent/subagent/README.md +++ b/packages/subagent/subagent/README.md @@ -21,7 +21,7 @@ Unlike the bash seam (one executor per context, second load throws), **multiple | `registerProvider(provider)` | Read and validate the name, capability object and four boolean flags, `inheritsParentContext`, and `start` callback exactly once, then register a frozen acceptance snapshot under the accepted name. Malformed fixed fields fail loud before registration; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. | | `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). | | `list()` | Registered provider names (insertion order). | -| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Acquire and memoize the provider run's disposer before reading the rest of its handle, then return a frozen service-owned wrapper whose fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. Malformed handle access/binding starts rollback before the synchronous fault escapes; malformed terminal data rejects only after rollback reaches quiescence. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | +| `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Acquire the provider run's disposer before reading the rest of its handle, then return a frozen service-owned wrapper whose fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. The wrapper claims its shared disposal promise before invoking raw provider code, so synchronous reentry and ordinary repeats join one provider call; a raw disposer that directly returns that same reentrant wrapper promise is rejected as a cyclic provider contract instead of hanging forever. Malformed handle access/binding starts rollback before the synchronous fault escapes; malformed terminal data rejects only after rollback reaches quiescence. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | ## Capabilities: two kinds, discovered two ways diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts index b319a7f31d..74b7df171b 100644 --- a/packages/subagent/subagent/src/index.ts +++ b/packages/subagent/subagent/src/index.ts @@ -379,14 +379,30 @@ export class SubagentService extends Service { let disposal: Promise | undefined const dispose = (): Promise => { if (disposal === undefined) { + // Claim the shared transaction before invoking provider code: a raw + // disposer can synchronously reenter this wrapper through a reference + // retained by its caller, and both calls must join one provider call. + const claimed = Promise.withResolvers() + disposal = claimed.promise try { // Invoke through the captured callable without reading its public // `bind`/`length`/`name` properties. Disposal is the recovery // capability itself; hostile function metadata must not prevent the // seam from exercising it when a later handle field is malformed. - disposal = Promise.resolve(Reflect.apply(inputDispose, acceptedRun, [])) + const returned: unknown = Reflect.apply(inputDispose, acceptedRun, []) + // A raw disposer can reenter the service wrapper and directly return + // that same shared promise. Awaiting it here would make the promise + // depend on itself forever; reject the cyclic provider contract loud. + if (returned === claimed.promise) { + claimed.reject(new TypeError(`subagent provider "${name}" run dispose returned its own wrapper disposal promise`)) + return disposal + } + void Promise.resolve(returned).then( + () => { claimed.resolve(undefined) }, + (error: unknown) => { claimed.reject(error) }, + ) } catch (error: unknown) { - disposal = Promise.reject(error instanceof Error + claimed.reject(error instanceof Error ? error : new Error('subagent provider run dispose threw a non-Error value', { cause: error })) } diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts index d1a531ca09..e9b66ce158 100644 --- a/packages/subagent/subagent/tests/service.spec.ts +++ b/packages/subagent/subagent/tests/service.spec.ts @@ -150,6 +150,57 @@ describe('SubagentService', () => { } }) + it('claims wrapper disposal before a raw provider disposer can reenter it', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const observed: { reentrant?: Promise } = {} + const providerDispose = vi.fn(() => { + observed.reentrant = run.dispose() + return Promise.resolve() + }) + ctx.subagents.registerProvider({ + name: 'dispose-reentry', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('dispose-reentry-child'), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel() {}, + dispose: providerDispose, + }), + }) + const run = ctx.subagents.start('dispose-reentry', baseRequest()) + + const disposal = run.dispose() + + expect(observed.reentrant).toBe(disposal) + await disposal + expect(providerDispose).toHaveBeenCalledOnce() + }) + + it('rejects a raw disposer that directly returns its reentrant wrapper promise instead of hanging', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const providerDispose = vi.fn(() => run.dispose()) + ctx.subagents.registerProvider({ + name: 'dispose-self-cycle', + capabilities: NO_CAPS, + inheritsParentContext: false, + start: () => ({ + id: AgentId('dispose-self-cycle-child'), + started: Promise.resolve(), + result: Promise.resolve({ output: [], stopReason: 'completed' }), + cancel() {}, + dispose: providerDispose, + }), + }) + const run = ctx.subagents.start('dispose-self-cycle', baseRequest()) + + await expect(run.dispose()).rejects.toThrow('run dispose returned its own wrapper disposal promise') + expect(providerDispose).toHaveBeenCalledOnce() + }) + it.each([ { label: 'a non-string name', patch: { name: 42 }, message: 'name must be a string' }, { label: 'null capabilities', patch: { capabilities: null }, message: 'capabilities must be an object' }, diff --git a/packages/workflow/workflow-workerthread/README.md b/packages/workflow/workflow-workerthread/README.md index 1879e60e7e..409ab57132 100644 --- a/packages/workflow/workflow-workerthread/README.md +++ b/packages/workflow/workflow-workerthread/README.md @@ -25,7 +25,7 @@ What the seam guarantees regardless, because benign scripts hit these constantly Inside the worker, `runWorkerSession` builds the execution core (hooks, combinators, concurrency semaphore, caps, fatal-error discipline) over a **child port**. `agent()` sends `child-start`, and the host starts the child through the holder-bound `SubagentService` handle captured synchronously by `start()`, with parent attribution, the shared per-run abort signal, and `outputSchema`/`model` pass-through. This capture is part of the seam's holder-owned lifetime: unloading the engine removes `ctx.workflows` for new calls but does not invalidate an already returned run whose worker starts another child afterward. -The host observes `run.result` immediately but buffers its snapshotted wire projection until `run.started` fulfills. It then replies `child-started` with the child id before forwarding settlement, so `workflow/agent-start` always names a ready child and precedes its end. A readiness rejection replies `child-start-error`, emits no workflow agent pair, and makes the host dispose the attempt because the worker never received a handle; the worker classifies it as fatal `AGENT_START` unless cancellation already owns the run. If readiness fulfills, an infrastructure result rejection crosses as `child-failed`/`AGENT_RESULT` regardless of whether that rejection settled before or after readiness. Child disposal acknowledgements complete the RPC. +The host observes `run.result` immediately but buffers its snapshotted wire projection until `run.started` fulfills. Provider `start()` is arbitrary code and can synchronously reenter workflow cancellation before its returned run reaches the host registry, so the host registers the run, attaches both promise observers, and re-checks admission after `start()` returns and again at readiness. A closed boundary never admits or announces the run to the worker: while the exact run remains registered, the host invokes explicit cancel once and disposes it; `child-start-error` is sent only while worker-message admission remains open. If the run was already retired, the identity guard sends no cleanup through the deleted call ID. An ordinary readiness rejection sends `child-start-error` while possible and disposes the provider attempt without adding an explicit cancellation. Otherwise the host replies `child-started` with the child id before forwarding settlement, so `workflow/agent-start` always names a ready child and precedes its end. The worker classifies a start error as fatal `AGENT_START` unless cancellation already owns the run. If readiness fulfills, an infrastructure result rejection crosses as `child-failed`/`AGENT_RESULT` regardless of whether that rejection settled before or after readiness. Child disposal acknowledgements complete the RPC. Observer narration (`phase`/`log`/`agent-start`/`agent-end`) crosses as messages and re-emits as the seam's `workflow/*` events. A **ready→go handshake** gates the body: a cancellation racing worker boot arrives before `go`, so a run cancelled before start never executes the body at all. @@ -35,9 +35,15 @@ Values LEAVING the script (hook options/schemas, the script's return) are materi ## Cancellation, death, disposal -Per-run limits: a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` posts the cancel to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels** — the shared request signal aborts AND each registered child's explicit `cancel()` is called host-side, because the seam leaves a provider free to honor either channel and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs (those later land as idempotent no-ops). Each provider-owned cancel callback is exception-contained independently, so a broken child cannot prevent peer cancellation or workflow settlement. The caller's optional start-signal callback is retained by exact identity only while the run is live and removed at the first settlement or teardown, so a long-lived signal cannot retain completed `WorkerRun` instances. The grace then arms: a run still unsettled `disposeGraceMs` later force-settles `cancelled` and the worker is **terminated**. A cancellation that lands before the body runs (the ready→go handshake) reports `cancelled` without executing anything; a worker `result` racing an in-flight host cancellation reports `cancelled` too (first-wins settlement — the seam-visible result had not settled when cancellation was requested); post-cancel `phase`/`log` narration is suppressed host-side, while cancelled children still deliver their paired `agent-end`. +Cancellation is bounded and host-driven. Per-run limits are a concurrency semaphore (`maxConcurrentAgents`), a total-`agent()` cap (`maxTotalAgents`), and a per-call item cap (`maxItemsPerCall`), all config. `cancel()` first records its reason, then posts to the worker (its hooks start throwing `CANCELLED`; the script dies at its next await) and cancels every host-side child NOW on **both seam channels**: the shared request signal aborts and each registered child's explicit `cancel()` runs host-side. The seam leaves a provider free to honor either channel, and a worker wedged in a synchronous spin could not relay its own per-child cancel RPCs. A host-side per-call gate turns the worker's later explicit-cancel relay into a no-op, because the seam does not require `SubagentRun.cancel()` to be idempotent. Each explicit child `cancel()` callback is exception-contained independently, post-cancel `phase`/`log` narration is suppressed host-side, and cancelled children still deliver paired `agent-end` events. The caller's optional start-signal callback is retained by exact identity only while the run is live and removed at the first settlement or teardown. -A worker that dies unexpectedly (an OOM, a script reaching `process.exit` through the documented vm escape) settles the run `stopReason: 'error'` with the exit diagnostics — or `'cancelled'` when a cancel was in flight — and the host-side child registry is what winds every surviving child down. `dispose()` = cancel + immediate host-driven disposal of every registered child (a wedged worker can relay no dispose RPC, so child teardown overlaps the grace instead of starting after it; the worker's own dispose RPCs join the same per-child disposal) + bounded wait (result, then child-registry quiescence, capped by the grace) + unconditional `worker.terminate()`: the thread never outlives its run. Before an ordinary run settlement becomes observable, the host cancels every stray child on both channels too—even a fire-and-forget run still waiting on `started`, for which the worker has no handle yet—and `dispose()` then waits for their disposal (bounded by the grace) before returning. `agent-start`/`agent-end` pairing is host-guaranteed the same way: forwarded starts live in a ledger, worker-reported ends pair them on the graceful paths, and the termination paths (grace force-settle, worker death) synthesize the missing ends (outcome `cancelled`) before the run settles — a start still in flight across the force-settle can surface after `workflow/end`, immediately paired the same way. +Terminal arbitration is first-wins at explicit host-side claim points. A cancellation before ready→go reports `cancelled` without executing the body. For a later race, the worker queues Result before its settlement-reap `ChildCancel` messages; external `cancel()` records its reason before its fanout, while Result receipt snapshots any earlier cancellation and records the terminal outcome before settlement-cleanup fanout. Same-port FIFO and those claim points mean earlier caller/signal/dispose cancellation overrides a non-cancelled report, while an arrived report cannot be rewritten by a cleanup callback. Once Result has won, a losing reentrant `cancel()` has no state, message, child-fanout, or grace-timer effect. If no earlier terminal source settles the run, the grace callback claims `cancelled`, synthesizes missing lifecycle ends, settles the result, and terminates the worker after `disposeGraceMs`. + +Worker death separates outcome ownership, message admission, and resource cleanup. An unexpected OOM, `error`, message failure, or premature exit claims `stopReason: 'error'` with diagnostics—or preserves an external cancellation already in flight—before reaping children or synthesizing observer events. Reentrant provider cancellation therefore cannot turn a death-first error into cancellation. The first death signal also closes worker-message admission because Node may deliver a queued `message` between `error` and `exit`; late protocol data cannot start a child, emit narration, or compete with the outcome. If Result or grace already claimed the outcome, death preserves it while still reaping promptly. The eventual `exit` then performs a final disposal-only sweep, joining any in-flight disposal without repeating explicit child cancellation. This separation lets grace settlement become observable before `worker.terminate()` reports exit without leaking the host-side registry. + +Disposal is the holder's bounded resource guarantee: cancel, begin host-driven disposal of every registered child immediately, wait for result plus child-registry quiescence up to the same grace, and unconditionally terminate the worker. `handle.dispose()` claims its public promise before that traversal invokes cancellation or disposal callbacks. Independently, every `disposeChild` path claims the call ID's promise before invoking the wrapped child disposer. Public-first reentry therefore returns the existing holder promise; worker-first reentry may begin holder disposal, whose child traversal joins the already-claimed call ID promise. Neither order can start a second provider disposal. A wedged worker can relay no dispose RPC, so host-driven teardown overlaps the grace; any later worker RPC joins the same per-child disposal. Before ordinary settlement becomes observable, the host also cancels every stray on both channels, including a fire-and-forget run still waiting on readiness. That work is settlement-only cleanup after the terminal claim, so provider reentry cannot rewrite the chosen result; `dispose()` then waits for its completion within the bound. + +Lifecycle pairing is host-guaranteed independently of outcome arbitration. Forwarded starts live in a ledger and worker-reported ends pair them on graceful paths. When death or grace is the terminal source, the host synthesizes missing ends with outcome `cancelled` before `workflow/end`. If Result settled first, later death cleanup may synthesize a survivor's end afterward; a start already crossing force-settlement may likewise surface after `workflow/end`. The same ledger still pairs every forwarded start exactly once. **Engine-specific limitations**: worker startup is paid per run; on a termination path `agentsStarted` reports the HOST-observed count (accepted `child-start`s — calls still queued worker-side for a concurrency slot are unknowable then); and a returned promise or thenable resolves per JavaScript semantics BEFORE materialization — that is what makes an un-awaited `return agent('x')` work — with the value-boundary guard applying to the resolution. diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index 8c839fbccb..7e87c14fae 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -7,19 +7,31 @@ * run. * * The run's `result` promise settles exactly once, from whichever of these - * lands first: the worker's `result` message (a host-side cancellation in - * flight overrides a non-cancelled report — the seam-visible result had not - * settled when cancellation was requested), an unexpected worker death - * (`error`/`messageerror`/premature `exit` → `stopReason: 'error'`, or - * `'cancelled'` when a cancel was in flight), or the post-cancel grace timer - * (a script that never settles is force-settled `cancelled` and its worker - * terminated — the real kill an in-process engine could not perform). + * lands first: receipt of the worker's `result` message, an unexpected worker + * death (`error`/`messageerror`/premature `exit` → `stopReason: 'error'`, or + * `'cancelled'` when a cancel was in flight), or the post-cancel grace timer (a + * script that never settles is force-settled `cancelled` and its worker + * terminated — the real kill an in-process engine could not perform). At + * `result` receipt the host snapshots whether caller/signal/dispose + * cancellation is already in flight: an earlier cancellation overrides a + * non-cancelled report; otherwise the report wins before settlement-only child + * cleanup invokes arbitrary provider callbacks. Worker death uses the same + * boundary: it claims `error` (or a previously requested `cancelled`) before + * reaping children, so cleanup callbacks cannot rewrite the outcome. That + * first signal also closes inbound message admission: Node may emit `error`, + * then deliver queued messages, then emit `exit`, but those late messages may + * neither create work nor narrate after settlement. If Result or grace already + * owns the outcome, death preserves it while still cleaning resources; the + * eventual exit performs a final disposal-only sweep without repeating child + * cancellation. * * Children live in a host-side registry (callId → run) as soon as the provider * accepts them, so cancellation reaches even a pre-publication attempt. Both * explicit run cancellation and the shared request signal are driven when the * workflow is cancelled OR normally settles, so a fire-and-forget child cannot - * survive merely by honoring only one channel. The host observes `result` + * survive merely by honoring only one channel. A per-call gate invokes each + * explicit provider `cancel()` at most once even though host fanout and the + * worker's later relay can both request it. The host observes `result` * immediately but acknowledges the child to the worker only after `started` * fulfills; readiness failure is a start error and the host disposes the * attempt because the worker never received a handle. The @@ -31,10 +43,12 @@ * paths share ONE disposal per child (memoized by callId; the seam's * dispose() is idempotent anyway, the memo keeps the bookkeeping and the * containment warn single). Lifecycle pairing is host-guaranteed the same - * way: every forwarded `agent-start` lives in a ledger, and a start the - * dead or terminated worker never paired is closed by a synthesized - * `agent-end` (outcome `'cancelled'`) before the run settles. On a - * termination path `agentsStarted` reports the + * way: every forwarded `agent-start` lives in a ledger, and a start the dead + * or terminated worker never paired is closed exactly once by a synthesized + * `agent-end` (outcome `'cancelled'`). When death or grace is the terminal + * source, already-known pairs close before the run settles; cleanup after an + * earlier Result can close a survivor afterward. On a termination path + * `agentsStarted` reports the * HOST-observed count (accepted `child-start` messages) — `agent()` calls * still queued worker-side for a concurrency slot are unknowable then; the * worker's own count rides the result message on every graceful path. @@ -132,6 +146,10 @@ export class WorkerRun implements WorkflowRun { readonly result: Promise private settleResolve!: (result: WorkflowResult) => void private settled = false + /** A Result/death/grace outcome atomically won before teardown callbacks. */ + private terminalClaimed = false + /** The first death signal closes worker-message admission and owns failure-time cleanup. */ + private workerDeathObserved = false private cancelReason: string | undefined private graceTimer: NodeJS.Timeout | undefined private readonly worker: Worker @@ -143,6 +161,8 @@ export class WorkerRun implements WorkflowRun { private readonly children = new Map() /** In-flight child disposals by callId — the memo that gives every path (worker RPC, dispose(), reap) ONE shared disposal per child. */ private readonly childDisposals = new Map>() + /** callIds whose explicit provider cancel callback has already been invoked. */ + private readonly childCancellations = new Set() /** Started-but-not-ended agents by seq — the pairing ledger the HOST guarantees (see {@link endAgent}). */ private readonly liveAgents = new Map() private readonly quiescenceWaiters: (() => void)[] = [] @@ -172,12 +192,12 @@ export class WorkerRun implements WorkflowRun { const { entry, options } = resolveWorkerSpawn(init) this.worker = new Worker(entry, options) this.worker.on('message', (message: WorkerToHostMessage) => { this.onMessage(message) }) - this.worker.on('error', (error) => { this.onWorkerDeath(`workflow worker failed: ${renderThrown(error)}`) }) + this.worker.on('error', (error) => { this.onWorkerDeath(`workflow worker failed: ${renderThrown(error)}`, false) }) /* v8 ignore next -- messageerror: not constructible from the engine's own protocol (every payload is JSON data) */ - this.worker.on('messageerror', (error) => { this.onWorkerDeath(`workflow worker message failed to deserialize: ${renderThrown(error)}`) }) + this.worker.on('messageerror', (error) => { this.onWorkerDeath(`workflow worker message failed to deserialize: ${renderThrown(error)}`, false) }) this.worker.on('exit', (code) => { this.workerGone = true - this.onWorkerDeath(`workflow worker exited before the run settled (exit code ${code})`) + this.onWorkerDeath(`workflow worker exited before the run settled (exit code ${code})`, true) }) if (signal?.aborted) { this.cancel('workflow start signal already aborted') @@ -205,18 +225,24 @@ export class WorkerRun implements WorkflowRun { * @param reason - human-readable cause (default `'workflow cancelled'`). */ cancel(reason?: string): void { - // A settled run has nothing left to cancel: without this guard the + // A settled run has nothing left to cancel, and a terminal source claimed + // before its cleanup callbacks must exclude cancellation reentered by one + // of those callbacks. Without the settled guard the // ordinary consumer path (await result, then dispose -> cancel) would arm // a grace timer nothing ever clears, pinning the run and its Worker // closure until the grace expires - a bounded leak per completed run. - if (this.settled || this.cancelReason !== undefined) return + if (this.settled || this.terminalClaimed || this.cancelReason !== undefined) return this.cancelReason = reason ?? 'workflow cancelled' this.post(HostToWorkerType.Cancel, { reason: this.cancelReason }) // The explicit channel is driven host-side, not left to the worker: a // provider honoring only run.cancel() must not wait on a wedged worker's - // ChildCancel relay (those later RPCs land as idempotent no-ops). + // ChildCancel relay (the per-call cancellation gate makes those later + // RPCs no-ops without imposing idempotence on the provider). this.cancelChildren(this.cancelReason) this.graceTimer = setTimeout(() => { + // Cancellation already owns the race through cancelReason; close the + // terminal boundary explicitly before observer teardown callbacks. + this.terminalClaimed = true // The worker may no longer speak (it is about to be terminated): pair // every stranded start before the run settles, so ends precede // workflow/end. @@ -244,7 +270,13 @@ export class WorkerRun implements WorkflowRun { * @returns resolves when the run's resources are released or abandoned. */ dispose(): Promise { - this.disposed ??= (async () => { + if (this.disposed !== undefined) return this.disposed + // Claim the public transaction BEFORE its body invokes child/provider + // disposal. A raw provider callback can reenter handle.dispose(); it must + // join this promise rather than start a second traversal. + const claimed = Promise.withResolvers() + this.disposed = claimed.promise + void (async () => { this.detachInputSignal() this.cancel('workflow disposed') for (const [callId, run] of [...this.children]) void this.disposeChild(callId, run) @@ -257,13 +289,17 @@ export class WorkerRun implements WorkflowRun { ]) await this.worker.terminate() this.reapChildren('workflow disposed') - })() + })().then( + () => { claimed.resolve(undefined) }, + /* v8 ignore next -- result/quiescence never reject and Worker.terminate is the only external promise */ + (error: unknown) => { claimed.reject(error) }, + ) return this.disposed } /** Post one message to the worker (payload looked up from the tag's map entry), tolerating a thread that is already gone. */ private post(type: T, payload: HostToWorkerPayloads[T]): void { - if (this.workerGone) return + if (this.workerGone || this.workerDeathObserved) return try { this.worker.postMessage({ type, ...payload }) } catch (error: unknown) { @@ -276,6 +312,11 @@ export class WorkerRun implements WorkflowRun { } private onMessage(message: WorkerToHostMessage): void { + // Node may emit `error`, then deliver an already-queued `message`, then + // emit `exit`. The first death signal is the host's logical delivery + // barrier: nothing arriving afterward may create a child, narrate after + // workflow/end, or compete with the chosen outcome. + if (this.workerDeathObserved) return switch (message.type) { case WorkerToHostType.Ready: this.post(HostToWorkerType.Go, {}) @@ -308,7 +349,7 @@ export class WorkerRun implements WorkflowRun { case WorkerToHostType.ChildCancel: { const run = this.children.get(message.callId) - if (run !== undefined) this.cancelChild(run, message.reason) + if (run !== undefined) this.cancelChild(message.callId, run, message.reason) } break case WorkerToHostType.ChildDispose: @@ -323,12 +364,27 @@ export class WorkerRun implements WorkflowRun { } } - private onChildStart(callId: number, request: ChildStartRequest): void { + /** Why a child may no longer cross the provider readiness boundary. */ + private childAdmissionFailure(): { reason: string; rendered: string } | undefined { if (this.cancelReason !== undefined) { - // The worker's start raced our cancel: refuse — a child must never - // start on an already-aborted signal (a provider subscribing only to - // future abort events would never observe it). - this.post(HostToWorkerType.ChildStartError, { callId, rendered: `workflow run cancelled: ${this.cancelReason}` }) + return { reason: this.cancelReason, rendered: `workflow run cancelled: ${this.cancelReason}` } + } + if (this.workerDeathObserved) { + return { reason: 'workflow worker gone', rendered: 'workflow worker is no longer available' } + } + if (this.terminalClaimed) { + return { reason: 'workflow settled', rendered: 'workflow run already settled' } + } + return undefined + } + + private onChildStart(callId: number, request: ChildStartRequest): void { + const initialFailure = this.childAdmissionFailure() + if (initialFailure !== undefined) { + // Refuse after a terminal boundary: a child must never start on an + // already-aborted signal (a provider subscribing only to future abort + // events would never observe it). + this.post(HostToWorkerType.ChildStartError, { callId, rendered: initialFailure.rendered }) return } this.hostStarted += 1 @@ -382,22 +438,54 @@ export class WorkerRun implements WorkflowRun { }, ) - // The provider owns the publication boundary. Only acknowledge the child - // after it is real, then flush any result that settled unusually early. A - // readiness rejection is a START failure, not AGENT_RESULT: the worker - // never receives a handle, so the host must also dispose the registered - // attempt. A concurrent host disposal may already have removed it; the - // identity guard preserves the one-disposal memo in that race. + // The provider owns the publication boundary. Observe both promises before + // invoking cancellation/disposal below: provider.start() itself is + // arbitrary code and may have reentered handle.cancel() before the returned + // run reached our registry. Exactly one branch answers this ChildStart. + let startReplySent = false + const refusePublication = (failure: { reason: string; rendered: string }): void => { + startReplySent = true + this.post(HostToWorkerType.ChildStartError, { callId, rendered: failure.rendered }) + // A prior dispose/death can finish and remove this run while readiness + // is still pending. In that case teardown already owned cancellation and + // disposal; touching the retired callId would repeat cancel and orphan a + // fresh gate entry after finishChild deleted it. + if (this.children.get(callId) !== run) return + this.cancelChild(callId, run, failure.reason) + void this.disposeChild(callId, run) + } + + // Only acknowledge the child after it is real, then flush any result that + // settled unusually early. Re-check admission at that exact boundary: a + // cancellation while readiness was pending is a refusal, not a late + // publication into a terminal workflow. A readiness rejection is a START + // failure, not AGENT_RESULT; the worker never receives a handle, so the + // host disposes the registered attempt. Identity guards preserve the one + // disposal memo against concurrent host teardown. void run.started.then( () => { + if (startReplySent) return + const failure = this.childAdmissionFailure() + if (failure !== undefined) { + refusePublication(failure) + return + } + startReplySent = true this.post(HostToWorkerType.ChildStarted, { callId, childId }) void forwardResult.then((forward) => { forward() }) }, (error: unknown) => { + if (startReplySent) return + startReplySent = true this.post(HostToWorkerType.ChildStartError, { callId, rendered: renderThrown(error) }) if (this.children.get(callId) === run) void this.disposeChild(callId, run) }, ) + + // Close the synchronous hole around provider.start(): cancel()/dispose() + // can run before the returned run is visible to their children loop. + const reentrantFailure = this.childAdmissionFailure() + if (reentrantFailure !== undefined) refusePublication(reentrantFailure) } private onChildDispose(callId: number): void { @@ -427,17 +515,26 @@ export class WorkerRun implements WorkflowRun { private disposeChild(callId: number, run: SubagentRun): Promise { let disposal = this.childDisposals.get(callId) if (disposal === undefined) { + // Claim before run.dispose() invokes provider code. Reentrant holder + // disposal then joins this exact child transaction instead of entering + // the provider wrapper twice before either memo is installed. + const claimed = Promise.withResolvers() + disposal = claimed.promise + this.childDisposals.set(callId, disposal) // The seam promises a Promise, but invoke inside an async boundary so a // contract-violating synchronous throw is contained exactly like a // rejected disposal and cannot break host quiescence. - disposal = (async () => { await run.dispose() })().then( - () => { this.finishChild(callId) }, + void (async () => { await run.dispose() })().then( + () => { + this.finishChild(callId) + claimed.resolve(undefined) + }, (error: unknown) => { this.ctx.logger.warn(`workflow-workerthread: child dispose failed: ${renderThrown(error)}`) this.finishChild(callId) + claimed.resolve(undefined) }, ) - this.childDisposals.set(callId, disposal) } return disposal } @@ -446,6 +543,7 @@ export class WorkerRun implements WorkflowRun { private finishChild(callId: number): void { this.children.delete(callId) this.childDisposals.delete(callId) + this.childCancellations.delete(callId) if (this.children.size === 0) { for (const waiter of this.quiescenceWaiters.splice(0)) waiter() } @@ -469,11 +567,16 @@ export class WorkerRun implements WorkflowRun { /** Drive both cancellation channels for every child already accepted by the host. */ private cancelChildren(reason: string): void { this.controller.abort(reason) - for (const run of this.children.values()) this.cancelChild(run, reason) + for (const [callId, run] of this.children) this.cancelChild(callId, run, reason) } - /** Contain one provider-owned cancel callback so every peer still receives cancellation. */ - private cancelChild(run: SubagentRun, reason?: string): void { + /** Invoke one provider-owned cancel callback at most once and contain its exception. */ + private cancelChild(callId: number, run: SubagentRun, reason?: string): void { + // Host fanout and the worker's FIFO-later ChildCancel relay are two paths + // to the same provider callback. The seam does not require cancel() to be + // idempotent, so claim the callId before invoking arbitrary provider code. + if (this.childCancellations.has(callId)) return + this.childCancellations.add(callId) try { run.cancel(reason) } catch (error: unknown) { @@ -482,12 +585,30 @@ export class WorkerRun implements WorkflowRun { } private onResult(result: WorkflowResult): void { + // The owned worker session sends one Result. Keep a late duplicate or a + // Result queued behind another terminal source completely side-effect-free. + if (this.terminalClaimed) return + // First-wins is decided when the Result message reaches the host. If no + // external cancellation was already in flight, this result won. Reaping a + // stray child below may synchronously reenter cancel() through provider + // callbacks, but that internal post-result cleanup must not retroactively + // rewrite the worker result that arrived first. + const cancellationWasRequested = this.cancelReason !== undefined + // Claim before either settlement-cleanup cancellation channel invokes + // provider code. A provider callback can reenter cancel() synchronously or + // from a queued microtask; once Result won, that losing cancellation must + // have no state, message, child-fanout, or grace-timer side effects. + this.terminalClaimed = true // The worker cancels handles it already received, but a fire-and-forget // child may still be waiting on readiness and therefore have no worker // handle. Drive BOTH provider-permitted channels from the host before the // workflow becomes externally settled. - if (this.cancelReason === undefined) this.cancelChildren('workflow settled') - if (this.cancelReason !== undefined && result.stopReason !== 'cancelled') { + if (!cancellationWasRequested) { + this.cancelChildren('workflow settled') + this.settleResult(result) + return + } + if (result.stopReason !== 'cancelled') { // The script settled while our cancel was crossing the thread boundary // — the seam-visible result had NOT settled when cancellation was // requested, so report cancelled (the vm drive()'s post-settle check, @@ -498,21 +619,39 @@ export class WorkerRun implements WorkflowRun { this.settleResult(result) } - /** An unexpected worker death (or the expected exit after termination). */ - private onWorkerDeath(message: string): void { - // Whatever the worker left behind must not leak — abort + dispose it all. - if (this.children.size > 0) this.reapChildren('workflow worker gone') - // The thread is gone: no more worker-authored agent-ends can arrive — - // pair every stranded start (a start that crossed between the grace - // force-settle and this exit included) before the run settles. - this.endStrandedAgents() - // settleResult no-ops on an already-settled run (the expected exit after - // a dispose's terminate lands here too). - if (this.cancelReason !== undefined) { - this.settleResult(this.cancelledResult(this.hostStarted)) - return + /** Process an error/messageerror/exit signal; `exit` also performs the final disposal sweep. */ + private onWorkerDeath(message: string, isExit: boolean): void { + if (!this.workerDeathObserved) { + // Close message admission BEFORE cleanup callbacks: Node can deliver a + // message queued before the crash after its `error` event. Treating the + // first death signal as a logical barrier prevents that late message + // from creating work or narrating after workflow/end. + this.workerDeathObserved = true + const outcomeWasClaimed = this.terminalClaimed + const cancellationWasRequested = this.cancelReason !== undefined + // When death is itself the terminal source, claim BEFORE child reap or + // synthesized observer callbacks. Either can reenter cancel(); a death + // that arrived first remains an error, while a cancellation already + // accepted before death remains cancelled. If Result/grace already won, + // preserve it while still performing prompt failure-time cleanup. + if (!outcomeWasClaimed) this.terminalClaimed = true + if (this.children.size > 0) this.reapChildren('workflow worker gone') + this.endStrandedAgents() + if (!outcomeWasClaimed) { + if (cancellationWasRequested) { + this.settleResult(this.cancelledResult(this.hostStarted)) + } else { + this.settleResult({ value: null, stopReason: 'error', error: message, agentsStarted: this.hostStarted }) + } + } } - this.settleResult({ value: null, stopReason: 'error', error: message, agentsStarted: this.hostStarted }) + if (!isExit) return + // `error` is not Node's physical delivery barrier: a queued message may + // precede `exit`. Admission is already closed, so this final sweep only + // joins/starts disposal for registry survivors; it deliberately does not + // repeat explicit provider cancellation. + for (const [callId, run] of [...this.children]) void this.disposeChild(callId, run) + this.endStrandedAgents() } /** @@ -531,11 +670,14 @@ export class WorkerRun implements WorkflowRun { /** * Synthesize the missing `agent-end` for every started-but-unpaired agent, * outcome `'cancelled'`: the reap cancels every child, and a real - * settlement racing the force-settle loses to the cancellation — the same - * first-wins override {@link onResult} applies to the run's own result. + * settlement racing the force-settle loses to that already-started external + * cancellation. The atomic terminal boundaries in {@link onResult} and + * {@link onWorkerDeath} deliberately exclude teardown callbacks as contenders. * Called where the worker can no longer speak (the grace force-settle, - * worker death), BEFORE settleResult, so the paired ends reach observers - * before `workflow/end`. + * worker death, physical exit). When grace/death is the terminal source it + * runs before settleResult, so already-known pairs precede `workflow/end`; + * after an earlier Result, exit cleanup may close a survivor afterward. + * The ledger preserves exactly-once pairing in both orders. */ private endStrandedAgents(): void { for (const info of [...this.liveAgents.values()]) { @@ -563,7 +705,11 @@ export class WorkerRun implements WorkflowRun { /** First settle wins; disarms the grace timer and releases the caller signal. */ private settleResult(result: WorkflowResult): void { + // Every current terminal source claims ownership before calling here; keep + // the fallback local so a future caller cannot resolve twice. + /* v8 ignore next -- defensive fallback outside the claimed state machine */ if (this.settled) return + this.terminalClaimed = true this.settled = true this.detachInputSignal() clearTimeout(this.graceTimer) diff --git a/packages/workflow/workflow-workerthread/src/runtime.ts b/packages/workflow/workflow-workerthread/src/runtime.ts index 2add6d537c..9b324c1118 100644 --- a/packages/workflow/workflow-workerthread/src/runtime.ts +++ b/packages/workflow/workflow-workerthread/src/runtime.ts @@ -83,7 +83,9 @@ function defaultLabel(prompt: string): string { /** * One live script execution inside the worker. Constructed per run by the * session; `drive()` is called exactly once and NEVER rejects — every failure - * becomes a {@link WorkflowResult} with a non-`completed` stop reason. + * becomes a {@link WorkflowResult} with a non-`completed` stop reason. After + * the session publishes that result it calls {@link reapAfterResult} exactly + * once to cancel any dropped child work without racing terminal publication. */ export class WorkflowExecution { /** 1-based count of `agent()` calls started (the `agentsStarted` result field). */ @@ -171,7 +173,8 @@ export class WorkflowExecution { * worker. Idempotent; the first reason wins. * @param reason - human-readable cause, carried on the CANCELLED error and * into child cancel RPCs. Required: every caller (the session's cancel - * message, drive()'s settle-reap) has a concrete reason. + * message and its post-result {@link reapAfterResult} call) has a concrete + * reason. */ cancel(reason: string): void { if (this.cancelReason !== undefined) return @@ -185,8 +188,9 @@ export class WorkflowExecution { * Run the script to settlement. Resolves — never rejects — with the run's * {@link WorkflowResult}: the materialized return value on `completed`, the * failure message on `error`, and `cancelled` when the script died of - * cancellation. After settlement, any stray children a script fired without - * awaiting are cancelled (their `agent()` wrappers dispose them via RPC). + * cancellation. This method only chooses the result; the session must publish + * it and then call {@link reapAfterResult}, so the terminal message precedes + * settlement-only child cancellation on the worker-to-host FIFO channel. * @returns the settled outcome — this promise NEVER rejects (the seam's * `result`-never-rejects contract); every failure maps to a variant. */ @@ -214,15 +218,19 @@ export class WorkflowExecution { // cannot throw — drive() resolving is the `result` never-rejects seam // contract. return { value: null, stopReason: 'error', error: renderThrown(error), agentsStarted: this.started } - } finally { - // Reap strays: a script that fired agent() calls without awaiting them - // leaves live children behind after settlement — cancel them all. (The - // per-call wrappers dispose each child; the contain() consumer keeps - // their rejections from going unhandled.) - if (this.cancelReason === undefined) this.cancel('workflow settled') } } + /** + * Reap strays only after the caller publishes the chosen terminal result. + * Aborting the controller synchronously sends child-cancel RPCs, so calling + * this before publication would let a provider callback reenter host + * cancellation and misclassify a result the script had already chosen. + */ + reapAfterResult(): void { + if (this.cancelReason === undefined) this.cancel('workflow settled') + } + /** * Attach a no-op rejection consumer WITHOUT changing what the caller * receives: if the script drops the promise (no await), cancellation cannot diff --git a/packages/workflow/workflow-workerthread/src/session.ts b/packages/workflow/workflow-workerthread/src/session.ts index b159892021..f6b14f0fca 100644 --- a/packages/workflow/workflow-workerthread/src/session.ts +++ b/packages/workflow/workflow-workerthread/src/session.ts @@ -14,6 +14,11 @@ * A `cancel` arriving instead of `go` still releases the gate: `drive()` * sees the cancelled state and settles without running the body. * + * Terminal ordering is Result first, settlement cleanup second. The session + * queues the Result message before asking the execution to reap stray children; + * MessagePort FIFO therefore lets the host atomically claim the result before a + * cleanup ChildCancel can invoke arbitrary provider code. + * * @module @deepseek-ai/dsh-workflow-workerthread/session */ @@ -208,5 +213,12 @@ export async function runWorkerSession(port: MessagePort, init: WorkerInit): Pro post(WorkerToHostType.Ready, {}) await gate.promise const result = await execution.drive() - post(WorkerToHostType.Result, { result }) + try { + // This post is the worker's terminal claim. Queue it BEFORE aborting stray + // children: MessagePort FIFO then guarantees the host claims Result before + // any settlement-only ChildCancel can invoke arbitrary provider callbacks. + post(WorkerToHostType.Result, { result }) + } finally { + execution.reapAfterResult() + } } diff --git a/packages/workflow/workflow-workerthread/tests/session.spec.ts b/packages/workflow/workflow-workerthread/tests/session.spec.ts index 00051ad56a..e2dab8948f 100644 --- a/packages/workflow/workflow-workerthread/tests/session.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/session.spec.ts @@ -281,6 +281,36 @@ describe('runWorkerSession over an in-process MessageChannel', () => { } }) + it('queues Result before settlement-only cancellation of a ready stray', async () => { + const host = fakeHost({ manual: true }) + const session = runWorkerSession(host.port, init(` + agent('ready stray') + return await agent('gate') + `)) + await vi.waitFor(() => { expect(host.ofType(WorkerToHostType.ChildStart)).toHaveLength(2) }) + const starts = host.ofType(WorkerToHostType.ChildStart) + const stray = starts.find(message => message.request.prompt === 'ready stray')! + const gate = starts.find(message => message.request.prompt === 'gate')! + host.send({ type: HostToWorkerType.ChildStarted, callId: stray.callId, childId: 'stray-child' }) + host.send({ type: HostToWorkerType.ChildStarted, callId: gate.callId, childId: 'gate-child' }) + host.send({ type: HostToWorkerType.ChildSettled, callId: gate.callId, result: text('gate completed') }) + + const result = await host.result() + await session + await vi.waitFor(() => { + expect(host.ofType(WorkerToHostType.ChildCancel).map(message => message.callId)).toContain(stray.callId) + }) + + expect(result).toMatchObject({ value: 'gate completed', stopReason: 'completed', agentsStarted: 2 }) + const resultIndex = host.messages.findIndex(message => message.type === WorkerToHostType.Result) + const strayCancelIndex = host.messages.findIndex(message => + message.type === WorkerToHostType.ChildCancel && message.callId === stray.callId) + expect(resultIndex).toBeGreaterThanOrEqual(0) + expect(strayCancelIndex).toBeGreaterThan(resultIndex) + host.send({ type: HostToWorkerType.ChildSettled, callId: stray.callId, result: { output: [], stopReason: 'aborted' } }) + host.close() + }) + it('an unparseable body settles an error result instead of dying without one (host pre-parse skew guard)', async () => { const host = fakeHost() await runWorkerSession(host.port, init('return (((')) diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 641b26518d..9e37e0bbed 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -1,5 +1,6 @@ import { describe, expect, it, vi } from 'vitest' import { fileURLToPath } from 'node:url' +import type { Worker } from 'node:worker_threads' import { Context } from 'cordis' import Loader from '@cordisjs/plugin-loader' import { AgentId } from '@deepseek-ai/dsh-agent' @@ -8,7 +9,7 @@ import SubagentService from '@deepseek-ai/dsh-subagent' import type { SubagentCapabilities, SubagentProvider, SubagentResult, SubagentRun, SubagentStartRequest } from '@deepseek-ai/dsh-subagent' import type { WorkflowMeta, WorkflowResult, WorkflowResultInfo, WorkflowRunInfo } from '@deepseek-ai/dsh-workflow' import * as workerEngineModule from '../src/index.ts' -import WorkerWorkflowEngine, { HostToWorkerType, type Config } from '../src/index.ts' +import WorkerWorkflowEngine, { HostToWorkerType, WorkerToHostType, type Config } from '../src/index.ts' /** A minimal parent stand-in: the engine only threads it through to the provider. */ function fakeParent(): Agent { @@ -74,6 +75,8 @@ class StubProvider implements SubagentProvider { private readonly reply?: (request: SubagentStartRequest, index: number) => SubagentResult, private readonly disposeDelayMs = 0, private readonly deferStart = false, + private readonly onCancel?: (reason: string | undefined, index: number) => void, + private readonly onSignalAbort?: (reason: unknown, index: number) => void, ) {} start(request: SubagentStartRequest): SubagentRun { @@ -91,7 +94,10 @@ class StubProvider implements SubagentProvider { } this.runs.push(controlled) const index = this.runs.length - 1 - request.signal?.addEventListener('abort', () => { terminal.resolve({ output: [], stopReason: 'aborted' }) }, { once: true }) + request.signal?.addEventListener('abort', () => { + this.onSignalAbort?.(request.signal?.reason, index) + terminal.resolve({ output: [], stopReason: 'aborted' }) + }, { once: true }) if (!this.deferStart) readiness.resolve(undefined) if (this.reply) { const reply = this.reply @@ -103,6 +109,7 @@ class StubProvider implements SubagentProvider { result: terminal.promise, cancel: (reason?: string) => { controlled.cancelled = reason ?? 'cancelled' + this.onCancel?.(reason, index) terminal.resolve({ output: [], stopReason: 'aborted' }) }, dispose: () => { @@ -133,6 +140,8 @@ interface SetupOptions { manual?: boolean disposeDelayMs?: number deferStart?: boolean + onChildCancel?: (reason: string | undefined, index: number) => void + onChildSignalAbort?: (reason: unknown, index: number) => void } async function setup(options?: SetupOptions) { @@ -143,6 +152,8 @@ async function setup(options?: SetupOptions) { options?.manual ? undefined : options?.reply ?? (() => text('stub reply')), options?.disposeDelayMs ?? 0, options?.deferStart ?? false, + options?.onChildCancel, + options?.onChildSignalAbort, ) ctx.subagents.registerProvider(provider) // A fixed concurrency ceiling: the auto-resolved default is machine-derived @@ -821,6 +832,153 @@ describe('dsh-workflow-workerthread', () => { expect(provider.runs[0]!.disposeCalls).toBe(1) }) + it('post-result child cleanup cannot reentrantly rewrite a completed workflow as cancelled', async () => { + let cancelCallbacks = 0 + let signalCallbacks = 0 + const { ctx, parent, provider } = await setup({ + manual: true, + deferStart: true, + onChildCancel: () => { + cancelCallbacks += 1 + // The first callback is host cleanup for the already-arrived Result. + // Reentering cancel() here is later than that message and must not + // retroactively win the result race. Its nested child cancel is + // intentionally ignored to keep the adversarial callback finite. + if (cancelCallbacks === 1) handle.cancel('reentrant child cleanup') + }, + onChildSignalAbort: () => { + signalCallbacks += 1 + handle.cancel('reentrant signal cleanup') + }, + }) + const handle = ctx.workflows.start({ + ...scripted(` + agent('readiness-pending stray') + return 'completed first' + `), + parent, + }) + + const result = await handle.result + + expect(result).toMatchObject({ value: 'completed first', stopReason: 'completed', agentsStarted: 1 }) + expect(signalCallbacks).toBe(1) + expect(cancelCallbacks).toBe(1) + // Readiness crossing after Result is a terminal-admission refusal: no + // ChildStarted/lifecycle publication, and host-owned disposal begins. + provider.runs[0]!.publish() + await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000) + expect(cancelCallbacks).toBe(1) + await handle.dispose() + await ctx.fiber.dispose() + }) + + it('late readiness after completed disposal cannot cancel or dispose the retired child twice', async () => { + let explicitCancels = 0 + const lifecycle: string[] = [] + const { ctx, parent, provider } = await setup({ + manual: true, + deferStart: true, + onChildCancel: () => { explicitCancels += 1 }, + }) + ctx.on('workflow/agent-start', () => { lifecycle.push('start') }) + ctx.on('workflow/agent-end', () => { lifecycle.push('end') }) + const handle = ctx.workflows.start({ + ...scripted("agent('retired readiness')\nreturn 'done'"), + parent, + }) + + await expect(handle.result).resolves.toMatchObject({ stopReason: 'completed' }) + expect(explicitCancels).toBe(1) + await handle.dispose() + expect(provider.runs[0]!.disposed).toBe(true) + expect(provider.runs[0]!.disposeCalls).toBe(1) + + // The Promise may still fulfill after its run left every host ledger. + // Refusal replies once but must not recreate the deleted cancel gate. + provider.runs[0]!.publish() + await Promise.resolve() + await Promise.resolve() + expect(explicitCancels).toBe(1) + expect(provider.runs[0]!.disposeCalls).toBe(1) + expect(lifecycle).toEqual([]) + await ctx.fiber.dispose() + }) + + it.each([ + ['synchronous', (cancel: () => void) => { cancel() }], + ['microtask', (cancel: () => void) => { queueMicrotask(cancel) }], + ])('a ready stray %s cleanup callback cannot beat the earlier worker result claim', async (_mode, reenter) => { + let reentered = false + const explicitCancels = new Map() + const { ctx, parent, provider } = await setup({ + manual: true, + onChildCancel: (_reason, index) => { + explicitCancels.set(index, (explicitCancels.get(index) ?? 0) + 1) + if (index !== 0 || reentered) return + reentered = true + reenter(() => { handle.cancel('reentered from child cleanup') }) + }, + }) + const handle = ctx.workflows.start({ + ...scripted(` + agent('ready stray') + return await agent('gate') + `), + parent, + }) + const cancelChildSpy = vi.spyOn(handle as unknown as { + cancelChild(callId: number, run: SubagentRun, reason?: string): void + }, 'cancelChild') + await waitFor(() => { expect(provider.runs).toHaveLength(2) }) + provider.runs[1]!.settle(text('gate completed')) + + const result = await handle.result + await Promise.resolve() + + expect(result).toMatchObject({ value: 'gate completed', stopReason: 'completed', agentsStarted: 2 }) + expect(reentered).toBe(true) + // The host claim and worker's FIFO-later ChildCancel both reach the + // routing gate, but the provider callback is not an idempotent seam: + // invoke it exactly once for this callId. + await waitFor(() => { + expect(cancelChildSpy.mock.calls.filter(([callId]) => callId === 1)).toHaveLength(2) + }, 1000) + expect(explicitCancels.get(0)).toBe(1) + cancelChildSpy.mockRestore() + await handle.dispose() + await ctx.fiber.dispose() + }) + + it('a duplicate Result after the terminal claim cannot repeat cleanup or rewrite the outcome', async () => { + let explicitCancels = 0 + const { ctx, parent, provider } = await setup({ + manual: true, + onChildCancel: (_reason, index) => { if (index === 0) explicitCancels += 1 }, + }) + const handle = ctx.workflows.start({ + ...scripted("agent('stray')\nawait new Promise(() => {})"), + parent, + }) + await waitFor(() => { expect(provider.runs).toHaveLength(1) }) + const worker = (handle as unknown as { worker: Worker }).worker + + worker.emit('message', { + type: WorkerToHostType.Result, + result: { value: 'first', stopReason: 'completed', agentsStarted: 1 }, + }) + worker.emit('message', { + type: WorkerToHostType.Result, + result: { value: 'late', stopReason: 'completed', agentsStarted: 1 }, + }) + + await expect(handle.result).resolves.toMatchObject({ value: 'first', stopReason: 'completed' }) + expect(explicitCancels).toBe(1) + await handle.dispose() + expect(explicitCancels).toBe(1) + await ctx.fiber.dispose() + }) + it('contains a throwing child cancel and still settles after cancelling peer strays', async () => { const ctx = new Context() await ctx.plugin(SubagentService) @@ -918,6 +1076,198 @@ describe('dsh-workflow-workerthread', () => { await handle.dispose() }, 15_000) + it.each(['fulfills', 'rejects'] as const)('provider.start() reentrant cancellation refuses the run when readiness later %s', async (readinessOutcome) => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const readiness = Promise.withResolvers() + let starts = 0 + let explicitCancels = 0 + let disposals = 0 + let sawAbortedSignal = false + const lifecycle: string[] = [] + const provider: SubagentProvider = { + name: 'start-reentry', + capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, + inheritsParentContext: false, + start: (request) => { + starts += 1 + // This arbitrary provider callback runs before onChildStart can put + // the returned run in its registry. Cancellation must be rechecked + // after return instead of trusting the pre-start admission check. + handle.cancel('provider start reentered cancellation') + sawAbortedSignal = request.signal?.aborted === true + return { + id: AgentId('start-reentry-child'), + started: readiness.promise, + result: new Promise(() => { /* refusal owns teardown */ }), + // Deliberately honors only the explicit channel. It must still be + // reached promptly even though the first host fanout saw no run. + cancel: () => { explicitCancels += 1 }, + dispose: () => { + disposals += 1 + return Promise.resolve() + }, + } + }, + } + ctx.subagents.registerProvider(provider) + await ctx.plugin(WorkerWorkflowEngine, { + provider: 'start-reentry', + maxConcurrentAgents: 2, + disposeGraceMs: 30_000, + }) + ctx.on('workflow/agent-start', () => { lifecycle.push('start') }) + ctx.on('workflow/agent-end', () => { lifecycle.push('end') }) + const handle = ctx.workflows.start({ + ...scripted("await agent('reentrant provider')\nreturn 'unreachable'"), + parent: fakeParent(), + }) + + await waitFor(() => { expect(starts).toBe(1) }) + // Either later readiness settlement must not answer the already-refused + // start again or emit a workflow lifecycle pair. + if (readinessOutcome === 'fulfills') readiness.resolve(undefined) + else readiness.reject(new Error('late readiness rejection after refusal')) + let result: WorkflowResult | undefined + void handle.result.then((value) => { result = value }) + await waitFor(() => { + expect(explicitCancels).toBe(1) + expect(disposals).toBe(1) + expect(result?.stopReason).toBe('cancelled') + }, 1000) + expect(sawAbortedSignal).toBe(true) + expect(lifecycle).toEqual([]) + await handle.dispose() + expect(explicitCancels).toBe(1) + expect(disposals).toBe(1) + await ctx.fiber.dispose() + }) + + it('claims workflow and child disposal before a raw provider disposer reenters handle.dispose()', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const terminal = Promise.withResolvers() + const observed: { reentrant?: Promise } = {} + let starts = 0 + let rawDisposeCalls = 0 + const provider: SubagentProvider = { + name: 'dispose-reentry', + capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, + inheritsParentContext: false, + start: () => { + starts += 1 + return { + id: AgentId('dispose-reentry-child'), + started: Promise.resolve(), + result: terminal.promise, + cancel: () => { terminal.resolve({ output: [], stopReason: 'aborted' }) }, + dispose: () => { + rawDisposeCalls += 1 + observed.reentrant = handle.dispose() + return Promise.resolve() + }, + } + }, + } + ctx.subagents.registerProvider(provider) + await ctx.plugin(WorkerWorkflowEngine, { provider: 'dispose-reentry', maxConcurrentAgents: 2 }) + const handle = ctx.workflows.start({ + ...scripted("await agent('live child')\nreturn 'unreachable'"), + parent: fakeParent(), + }) + await waitFor(() => { expect(starts).toBe(1) }) + + const disposal = handle.dispose() + + expect(observed.reentrant).toBe(disposal) + await disposal + expect(rawDisposeCalls).toBe(1) + await expect(handle.result).resolves.toMatchObject({ stopReason: 'cancelled' }) + await ctx.fiber.dispose() + }) + + it('claims worker-originated child disposal before its raw disposer reenters holder disposal', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const terminal = Promise.withResolvers() + const observed: { reentrant?: Promise } = {} + let starts = 0 + let rawDisposeCalls = 0 + const provider: SubagentProvider = { + name: 'child-dispose-reentry', + capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, + inheritsParentContext: false, + start: () => { + starts += 1 + return { + id: AgentId('child-dispose-reentry-child'), + started: Promise.resolve(), + result: terminal.promise, + cancel: () => { terminal.resolve({ output: [], stopReason: 'aborted' }) }, + dispose: () => { + rawDisposeCalls += 1 + // This begins holder disposal from the worker's ChildDispose + // callback, before any public handle.dispose() call exists. + observed.reentrant = handle.dispose() + return Promise.resolve() + }, + } + }, + } + ctx.subagents.registerProvider(provider) + await ctx.plugin(WorkerWorkflowEngine, { provider: 'child-dispose-reentry', maxConcurrentAgents: 2 }) + const handle = ctx.workflows.start({ + ...scripted("return await agent('settling child')"), + parent: fakeParent(), + }) + const finishChildSpy = vi.spyOn(handle as unknown as { + finishChild(callId: number): void + }, 'finishChild') + await waitFor(() => { expect(starts).toBe(1) }) + + terminal.resolve({ output: [{ type: 'text', text: 'done' }], stopReason: 'completed' }) + + await waitFor(() => { expect(observed.reentrant).toBeDefined() }, 1000) + await observed.reentrant + expect(rawDisposeCalls).toBe(1) + expect(finishChildSpy.mock.calls.filter(([callId]) => callId === 1)).toHaveLength(1) + finishChildSpy.mockRestore() + await expect(handle.result).resolves.toMatchObject({ stopReason: 'cancelled' }) + await ctx.fiber.dispose() + }) + + it('a grace-terminated worker reaps its child on exit without waiting for consumer dispose()', async () => { + const { ctx, parent, provider } = await setup({ + manual: true, + config: { provider: 'stub', maxConcurrentAgents: 2, disposeGraceMs: 100 }, + }) + const handle = ctx.workflows.start({ + // Let child-start cross, then make the worker unable to process its + // Cancel message. Grace settles the result and terminates the thread; + // that exit must independently own the host registry's disposal pass. + ...scripted(` + agent('survives until exit reap') + for (let i = 0; i < 20; i++) await null + const end = Date.now() + 1500 + while (Date.now() < end) {} + return 'unreachable' + `), + parent, + }) + await waitFor(() => { expect(provider.runs).toHaveLength(1) }) + + handle.cancel('force termination') + const result = await handle.result + + expect(result.stopReason).toBe('cancelled') + // Deliberately assert before handle.dispose(): host-owned worker exit, + // not consumer courtesy, is responsible for this resource guarantee. + await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000) + expect(provider.runs[0]!.disposeCalls).toBe(1) + await handle.dispose() + await ctx.fiber.dispose() + }, 15_000) + it('dispose() on a wedged worker host-drives child disposal inside the grace: it returns with the children DISPOSED, not with their teardown still in flight', async () => { const { ctx, parent, provider } = await setup({ manual: true, @@ -1045,23 +1395,71 @@ describe('dsh-workflow-workerthread', () => { }) describe('worker death', () => { + it('the first death signal closes admission to messages Node delivers before exit', async () => { + const { ctx, parent, provider } = await setup({ manual: true }) + const phases: string[] = [] + ctx.on('workflow/phase', (_info, title) => { phases.push(title) }) + const handle = ctx.workflows.start({ + ...scripted('await new Promise(() => {})'), + parent, + }) + const worker = (handle as unknown as { worker: Worker }).worker + + // Node may physically emit error -> queued message -> exit. Reproduce + // that ordering deterministically at the Worker event boundary: the + // late protocol data must not create work, narrate, or rewrite error. + worker.emit('error', new Error('synthetic error-before-message')) + worker.emit('message', { type: WorkerToHostType.Phase, title: 'late phase' }) + worker.emit('message', { + type: WorkerToHostType.ChildStart, + callId: 999, + request: { prompt: 'late child' }, + }) + worker.emit('message', { + type: WorkerToHostType.Result, + result: { value: 'late', stopReason: 'completed', agentsStarted: 1 }, + }) + + const result = await handle.result + expect(result.stopReason).toBe('error') + expect(result.error).toContain('synthetic error-before-message') + expect(provider.runs).toHaveLength(0) + expect(phases).toEqual([]) + await handle.dispose() + await ctx.fiber.dispose() + }) + it('a worker that exits before settling reports an error result and reaps its children', async () => { const ctx = new Context() await ctx.plugin(SubagentService) // The child's dispose() REJECTS on top of the worker death: the reap // must contain it (warn, not crash) while still emptying the registry. const cancelled: string[] = [] + const signalAborts: unknown[] = [] const provider: SubagentProvider = { name: 'doomed', capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, inheritsParentContext: false, - start: () => ({ - id: AgentId('doomed-child'), - started: Promise.resolve(), - result: new Promise(() => { /* never settles; the reap is the teardown */ }), - cancel: (reason?: string) => { cancelled.push(reason ?? 'cancelled') }, - dispose: () => Promise.reject(new Error('dispose exploded during reap')), - }), + start: (request) => { + request.signal?.addEventListener('abort', () => { + signalAborts.push(request.signal?.reason) + // The death claim precedes the shared-signal fanout. This + // synchronous callback cannot turn death into cancellation. + handle.cancel('reentered from worker-death signal cleanup') + }, { once: true }) + return { + id: AgentId('doomed-child'), + started: Promise.resolve(), + result: new Promise(() => { /* never settles; the reap is the teardown */ }), + cancel: (reason?: string) => { + cancelled.push(reason ?? 'cancelled') + // Exercise the later microtask case too: terminal ownership + // remains closed after the death callback returns. + queueMicrotask(() => { handle.cancel('reentered from worker-death child cleanup') }) + }, + dispose: () => Promise.reject(new Error('dispose exploded during reap')), + } + }, } ctx.subagents.registerProvider(provider) await ctx.plugin(WorkerWorkflowEngine, { provider: 'doomed', maxConcurrentAgents: 2 }) @@ -1089,7 +1487,12 @@ describe('dsh-workflow-workerthread', () => { expect(runEnds).toEqual([{ stopReason: 'error', error: result.error, agentsStarted: 1 }]) // Result already settled — this is the reap's promptness, not a // cold-start race; tight explicit bound (see the helper's doc comment). - await waitFor(() => { expect(cancelled.length).toBe(1) }, 1000) + await waitFor(() => { + expect(signalAborts).toEqual(['workflow worker gone']) + expect(cancelled).toEqual(['workflow worker gone']) + }, 1000) + await Promise.resolve() + expect(result.stopReason).toBe('error') await handle.dispose() }, 15_000) From 48067c3a7a2c7ca274af47c6ea4f684e80573a7b Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 10:33:29 +0800 Subject: [PATCH 06/21] fix(subagent): validate depth config at load --- docs/config-catalog.md | 5 +++-- packages/subagent/tool-subagent/README.md | 2 +- packages/subagent/tool-subagent/src/index.ts | 21 ++++++++++++++++--- .../tool-subagent/tests/tool-subagent.spec.ts | 10 +++++++++ 4 files changed, 32 insertions(+), 6 deletions(-) diff --git a/docs/config-catalog.md b/docs/config-catalog.md index dc766ae25f..30a4c8a1a3 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -893,8 +893,9 @@ export interface Config { * Recursion cap applied to every child this tool spawns (see * `SubagentStartRequest.maxDepth`): a spawn whose child would sit deeper * than this in the delegation tree is rejected. Requires the provider's - * `depthLimit` capability. Omitted ⇒ unbounded (bound it in deployments - * that expose this tool to children). + * `depthLimit` capability. Must be a non-negative safe integer and is + * validated when the plugin loads. Omitted ⇒ unbounded (bound it in + * deployments that expose this tool to children). */ maxDepth?: number } diff --git a/packages/subagent/tool-subagent/README.md b/packages/subagent/tool-subagent/README.md index 715fb0b9db..9aed426ac0 100644 --- a/packages/subagent/tool-subagent/README.md +++ b/packages/subagent/tool-subagent/README.md @@ -17,7 +17,7 @@ The tool description and the `prompt` parameter description are DERIVED from the | `agentOptions` | Default per-child `{ model? }` applied to every spawned child. | | `persona` | Per-child persona that shadows the deployment persona; requires the provider's `persona` capability. | | `toolFilter` | Per-child `{ allow?, deny? }` restriction over global tools; requires the provider's `toolFilter` capability. | -| `maxDepth` | Maximum delegation depth; requires the provider's `depthLimit` capability. | +| `maxDepth` | Maximum delegation depth; a non-negative safe integer validated when this plugin loads. Requires the provider's `depthLimit` capability. | ## Lifecycle (synchronous collect) diff --git a/packages/subagent/tool-subagent/src/index.ts b/packages/subagent/tool-subagent/src/index.ts index 4f2a1bc33d..c6dc808068 100644 --- a/packages/subagent/tool-subagent/src/index.ts +++ b/packages/subagent/tool-subagent/src/index.ts @@ -84,8 +84,9 @@ export interface Config { * Recursion cap applied to every child this tool spawns (see * `SubagentStartRequest.maxDepth`): a spawn whose child would sit deeper * than this in the delegation tree is rejected. Requires the provider's - * `depthLimit` capability. Omitted ⇒ unbounded (bound it in deployments - * that expose this tool to children). + * `depthLimit` capability. Must be a non-negative safe integer and is + * validated when the plugin loads. Omitted ⇒ unbounded (bound it in + * deployments that expose this tool to children). */ maxDepth?: number } @@ -115,9 +116,20 @@ export const Config: z = z.object({ allow: z.array(z.string()).default(undefined as unknown as string[]), deny: z.array(z.string()).default(undefined as unknown as string[]), }).default(undefined as unknown as { allow: string[]; deny: string[] }), - maxDepth: z.number(), + maxDepth: z.natural().max(Number.MAX_SAFE_INTEGER), }) +/** Reject a recursion cap that cannot represent an exact delegation depth. */ +function assertMaxDepth(maxDepth: number | undefined): void { + if (maxDepth !== undefined && ( + !Number.isSafeInteger(maxDepth) + || maxDepth < 0 + || Object.is(maxDepth, -0) + )) { + throw new Error('tool-subagent: `maxDepth` must be a non-negative safe integer') + } +} + /** * Flatten a child's final output blocks to text for the tool result. The child * may return non-text blocks; this cut surfaces the text content (the common @@ -188,6 +200,9 @@ export function providerWording(inherits: boolean): { description: string; promp } export function apply(ctx: Context, config: Config): void { + // Keep misconfiguration at plugin load even when a caller invokes apply() + // directly and bypasses Schemastery's natural/max metadata. + assertMaxDepth(config.maxDepth) // Misconfiguration fails loud AT LOAD (the check is self-contained): an // explicit `toolFilter: {}` would otherwise pass the capability gate and // kill every delegation later, in the child-setup `restrict({})` throw. diff --git a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts index 95d26dabdf..194c63997c 100644 --- a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts +++ b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts @@ -493,6 +493,16 @@ describe('dsh-tool-subagent', () => { expect(seen?.maxDepth).toBe(2) }) + it.each([ + { label: 'a negative integer', value: -1 }, + { label: 'a fractional number', value: 1.5 }, + { label: 'negative zero', value: -0 }, + { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 }, + ])('rejects maxDepth=$label when the plugin loads', async ({ value }) => { + await expect(setup({ provider: 'mock', maxDepth: value })) + .rejects.toThrow() + }) + it('a partial toolFilter (deny only) does not materialize an empty allow-list (deny-all trap)', async () => { let seen: { toolFilter?: { allow?: string[]; deny?: string[] } } | undefined const ctx = new Context() From 875c3d62d8fff24fb1a2754a99a2b2b946f4be67 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 10:39:55 +0800 Subject: [PATCH 07/21] fix(workflow): reap children after settled dispose --- .../workflow-workerthread/src/host.ts | 7 +++- .../tests/workflow-workerthread.spec.ts | 32 +++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index 7e87c14fae..ef5fdcbfac 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -279,7 +279,12 @@ export class WorkerRun implements WorkflowRun { void (async () => { this.detachInputSignal() this.cancel('workflow disposed') - for (const [callId, run] of [...this.children]) void this.disposeChild(callId, run) + // cancel() deliberately becomes a no-op after terminal settlement, but + // disposal still owns every registered child. Reap independently so an + // already-settled workflow cannot wait on child quiescence before it has + // started the surviving children's disposals. On an unsettled run this + // joins the cancel path through the per-call cancellation/disposal gates. + this.reapChildren('workflow disposed') await Promise.race([ (async () => { await this.result diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 9e37e0bbed..ec2f458d45 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -755,6 +755,38 @@ describe('dsh-workflow-workerthread', () => { expect(provider.runs[0]!.disposed).toBe(true) }) + it('dispose() reaps a registered stray after result settlement even when the worker cannot relay disposal', async () => { + const { ctx, parent, provider } = await setup({ + manual: true, + config: { provider: 'stub', disposeGraceMs: 30_000 }, + }) + const handle = ctx.workflows.start({ + ...scripted("agent('stray')\nawait new Promise(() => {})"), + parent, + }) + await waitFor(() => { expect(provider.runs).toHaveLength(1) }) + + // Claim the host result while the real worker remains wedged, so it can + // send neither ChildDispose nor an exit. This leaves the accepted child + // in the host registry when public disposal begins. + const worker = (handle as unknown as { worker: Worker }).worker + worker.emit('message', { + type: WorkerToHostType.Result, + result: { value: 'synthetic completion', stopReason: 'completed', agentsStarted: 1 }, + }) + await expect(handle.result).resolves.toMatchObject({ stopReason: 'completed' }) + expect(provider.runs[0]!.disposed).toBe(false) + + const disposal = handle.dispose() + // A 30-second grace makes this assertion mutation-sensitive: without the + // settled-path host reap, no worker message can start child disposal and + // this bounded wait fails long before the grace fallback. + await waitFor(() => { expect(provider.runs[0]!.disposed).toBe(true) }, 1000) + await disposal + expect(provider.runs[0]!.disposeCalls).toBe(1) + await ctx.fiber.dispose() + }) + it('the settle-reap fires the request signal too: a provider honoring ONLY the signal winds its stray down promptly', async () => { const ctx = new Context() await ctx.plugin(SubagentService) From d427478c44df4dcbd0a85aa8b69069927a02d1a3 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 10:48:20 +0800 Subject: [PATCH 08/21] fix(subagent): validate direct depth boundaries --- docs/config-catalog.md | 2 +- docs/cordis-catalog/events.md | 8 ++--- docs/cordis-catalog/services.md | 2 +- docs/event-producer-consumer.md | 8 ++--- .../subagent/subagent-inprocess/README.md | 2 +- .../subagent/subagent-inprocess/src/index.ts | 16 +++++++--- .../tests/subagent-inprocess.spec.ts | 32 +++++++++++++++++++ packages/subagent/subagent/README.md | 1 + packages/subagent/subagent/src/index.ts | 27 ++++++++++++---- packages/subagent/subagent/src/types.ts | 5 +-- .../subagent/subagent/tests/service.spec.ts | 4 +++ packages/subagent/tool-subagent/src/index.ts | 14 ++------ .../tool-subagent/tests/tool-subagent.spec.ts | 3 ++ 13 files changed, 88 insertions(+), 36 deletions(-) diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 30a4c8a1a3..8fd8e3379b 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -903,7 +903,7 @@ export interface Config { Depends on: [`AgentOptions`](../packages/core/agent/src/index.ts) -Source: [`packages/subagent/tool-subagent/src/index.ts:44`](../packages/subagent/tool-subagent/src/index.ts) +Source: [`packages/subagent/tool-subagent/src/index.ts:45`](../packages/subagent/tool-subagent/src/index.ts) ## `@deepseek-ai/dsh-tool-web` diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index 3e228405ee..d13f88bc2d 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -317,7 +317,7 @@ A started subagent run settled — emitted when SubagentRun.result resolves (any 'subagent/end'(this: Scoped, info: SubagentRunEndInfo): void ``` -Source: [`packages/subagent/subagent/src/index.ts:115`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:134`](../../packages/subagent/subagent/src/index.ts) ### `subagent/provider-added` — emit @@ -327,7 +327,7 @@ A provider became resolvable in the SubagentService registry. Consumers that der 'subagent/provider-added'(provider: SubagentProvider): void ``` -Source: [`packages/subagent/subagent/src/index.ts:76`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:95`](../../packages/subagent/subagent/src/index.ts) ### `subagent/provider-removed` — emit @@ -337,7 +337,7 @@ A provider left the registry (its plugin's fiber was disposed — an unload or a 'subagent/provider-removed'(name: string): void ``` -Source: [`packages/subagent/subagent/src/index.ts:87`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:106`](../../packages/subagent/subagent/src/index.ts) ### `subagent/start` — emit @@ -347,7 +347,7 @@ A subagent run started — emitted only after SubagentRun.started fulfills, when 'subagent/start'(this: Scoped, info: SubagentRunInfo): void ``` -Source: [`packages/subagent/subagent/src/index.ts:102`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:121`](../../packages/subagent/subagent/src/index.ts) ## `system-prompt/*` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index 1122137e1a..f5946a7e4d 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -250,7 +250,7 @@ list(): string[] start(name: string, request: SubagentStartRequest): SubagentRun ``` -Source: [`packages/subagent/subagent/src/index.ts:161`](../../packages/subagent/subagent/src/index.ts) +Source: [`packages/subagent/subagent/src/index.ts:180`](../../packages/subagent/subagent/src/index.ts) ## `ctx.systemPrompt` — `SystemPrompt` diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index ec867aa709..b8bcde4c9a 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -31,10 +31,10 @@ This matrix shows which packages dispatch each harness-owned event and which pac | `session/flush` | `parallel` | [`packages/core/session/src/index.ts:96`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | | `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:132`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:138`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | -| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:115`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | -| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:76`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) | -| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:87`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) | -| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:102`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | +| `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:134`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | +| `subagent/provider-added` | `emit` | [`packages/subagent/subagent/src/index.ts:95`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`emit`) | [`tool-subagent`](../packages/subagent/tool-subagent) | +| `subagent/provider-removed` | `emit` | [`packages/subagent/subagent/src/index.ts:106`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`tool-subagent`](../packages/subagent/tool-subagent) | +| `subagent/start` | `emit` | [`packages/subagent/subagent/src/index.ts:121`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | | `system-prompt/assemble` | `waterfall` | [`packages/core/system-prompt/src/index.ts:46`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`waterfall`) | - | | `system-prompt/change` | `emit` | [`packages/core/system-prompt/src/index.ts:56`](../packages/core/system-prompt/src/index.ts) | [`system-prompt`](../packages/core/system-prompt) (`emit`) | - | | `tools/change` | `emit` | [`packages/core/tools/src/index.ts:176`](../packages/core/tools/src/index.ts) | [`tools`](../packages/core/tools) (`emit`) | - | diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md index 1e812ce60d..b96cc811ad 100644 --- a/packages/subagent/subagent-inprocess/README.md +++ b/packages/subagent/subagent-inprocess/README.md @@ -8,7 +8,7 @@ The shared **in-process subagent run driver**. A library with no provider or imp Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`): -1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It computes child depth = `depthOf(parent) + 1`, rejects `request.maxDepth` overflow with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; +1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It rejects a malformed `request.maxDepth`, validates the parent's `subagentDepth`, computes child depth = `depthOf(parent) + 1`, rejects cap overflow with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; 2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, manual `run.dispose()`, and cancellation before readiness all dispose this exact node, preventing publication after it becomes inactive and sharing the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child and rejects when pre-readiness cancellation rolls the transaction back; 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent; 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field). diff --git a/packages/subagent/subagent-inprocess/src/index.ts b/packages/subagent/subagent-inprocess/src/index.ts index 511b686c13..e0ad53c486 100644 --- a/packages/subagent/subagent-inprocess/src/index.ts +++ b/packages/subagent/subagent-inprocess/src/index.ts @@ -21,6 +21,7 @@ import { AgentId, type Agent, type AgentHandle, type AgentOptions } from '@deeps import { SessionId, snapshotJsonValue, type SessionEvent, type TurnEndReason } from '@deepseek-ai/dsh-session' import type { ContentBlock } from '@deepseek-ai/dsh-llm' import { assertSupportedOutputSchema, OutputSchemaError } from '@deepseek-ai/dsh-tools' +import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent' import type { SubagentResult, SubagentRun, SubagentStartRequest, SubagentStopReason } from '@deepseek-ai/dsh-subagent' import { attachStructuredRuntime, @@ -42,20 +43,26 @@ declare module '@deepseek-ai/dsh-agent' { * (config/ACP-created) agent, parent depth + 1 for a subagent. Set by the * in-process backends on every child they create so a nested spawn reads its * parent's depth from `parent.options.subagentDepth` and the `depthLimit` - * capability can cap the tree. Merge-extensible field (the seam owns it; the - * loop neither sets nor reads it). + * capability can cap the tree. When present it is a non-negative safe + * integer. Merge-extensible field (the seam owns it; the loop neither sets + * nor reads it). */ subagentDepth?: number } } /** - * Read an agent's delegation depth (absent ⇒ a top-level agent, depth 0). + * Read an agent's delegation depth (absent ⇒ a top-level agent, depth 0), + * rejecting a malformed stored value instead of letting it disable comparison. * @param agent - the agent whose options may carry `subagentDepth`. * @returns 0 for a top-level agent, its parent's depth + 1 for a subagent. */ export function depthOf(agent: Agent): number { - return agent.options.subagentDepth ?? 0 + const depth = agent.options.subagentDepth ?? 0 + if (!Number.isSafeInteger(depth) || depth < 0 || Object.is(depth, -0)) { + throw new TypeError('agent subagentDepth must be a non-negative safe integer') + } + return depth } /** Thrown when a spawn would exceed the request's `maxDepth` cap. */ @@ -139,6 +146,7 @@ export function startInProcessRun( const inputPrompt = request.prompt const inputAgentOptions = request.agentOptions const inputSeed = options.seed + assertSubagentMaxDepth(inputMaxDepth) const toolFilter = inputToolFilter === undefined ? undefined : snapshotJsonValue(inputToolFilter) if (inputToolFilter !== undefined && toolFilter === undefined) { throw new TypeError('subagent tool filter must be losslessly JSON-serializable') diff --git a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts index cb394d8d95..db37c974b3 100644 --- a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts +++ b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts @@ -46,9 +46,41 @@ describe('depthOf', () => { const withDepth = { options: { subagentDepth: 3 } } as unknown as Agent expect(depthOf(withDepth)).toBe(3) }) + + it.each([ + { label: 'a string', value: '1' as unknown as number }, + { label: 'NaN', value: Number.NaN }, + { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, + { label: 'negative infinity', value: Number.NEGATIVE_INFINITY }, + { label: 'a fraction', value: 1.5 }, + { label: 'a negative integer', value: -1 }, + { label: 'negative zero', value: -0 }, + { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 }, + ])('rejects subagentDepth=$label', ({ value }) => { + const agent = { options: { subagentDepth: value } } as unknown as Agent + expect(() => depthOf(agent)).toThrow('agent subagentDepth must be a non-negative safe integer') + }) }) describe('startInProcessRun', () => { + it.each([ + { label: 'a string', value: '1' as unknown as number }, + { label: 'NaN', value: Number.NaN }, + { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, + { label: 'negative infinity', value: Number.NEGATIVE_INFINITY }, + { label: 'a fraction', value: 1.5 }, + { label: 'a negative integer', value: -1 }, + { label: 'negative zero', value: -0 }, + { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 }, + ])('rejects maxDepth=$label before acquiring run ownership', async ({ value }) => { + const { ctx, parent } = await setup([]) + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'must never start' }], + parent, + maxDepth: value, + }, {})).toThrow('subagent maxDepth must be a non-negative safe integer') + }) + it('rejects a non-JSON prompt before acquiring any run ownership', async () => { const { ctx, parent } = await setup([]) expect(() => startInProcessRun(ctx, { diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md index e29706bd8b..e98d8cd8de 100644 --- a/packages/subagent/subagent/README.md +++ b/packages/subagent/subagent/README.md @@ -19,6 +19,7 @@ Unlike the bash seam (one executor per context, second load throws), **multiple | Member | Semantics | |---|---| | `registerProvider(provider)` | Read and validate the name, capability object and four boolean flags, `inheritsParentContext`, and `start` callback exactly once, then register a frozen acceptance snapshot under the accepted name. Malformed fixed fields fail loud before registration; later caller mutation cannot change registry behavior or HMR cleanup, while `start` stays bound to the original provider receiver. Throws `SubagentError('DUPLICATE_PROVIDER')` on a name clash. Effect-scoped (HMR-safe); returns the disposer. | +| `assertSubagentMaxDepth(value)` | Shared runtime boundary for recursion caps. Accepts absence or a non-negative safe integer; rejects fractions, non-finite numbers, negative values, negative zero, and unsafe integers. The service, direct in-process driver, and model-facing config adapter all use it. | | `getProvider(name)` | Look up the frozen registry snapshot (`undefined` if absent). | | `list()` | Registered provider names (insertion order). | | `start(name, request)` | Resolve the provider (`NO_PROVIDER` if absent), read every caller field once into one acceptance snapshot, validate every requested START-TIME capability and scalar value before any child is created, and materialize prompt/schema/options/filter data through a single-pass lossless-JSON snapshot before delegating to `provider.start`. Acquire the provider run's disposer before reading the rest of its handle, then return a frozen service-owned wrapper whose fields are captured once, whose methods remain bound to the provider handle, and whose `result` is one detached, deeply frozen normalization shared by the caller and telemetry. The wrapper claims its shared disposal promise before invoking raw provider code, so synchronous reentry and ordinary repeats join one provider call; a raw disposer that directly returns that same reentrant wrapper promise is rejected as a cyclic provider contract instead of hanging forever. Malformed handle access/binding starts rollback before the synchronous fault escapes; malformed terminal data rejects only after rollback reaches quiescence. Emit `subagent/start` only after `run.started` fulfills and the paired `subagent/end` after that started run settles; a pre-publication readiness rejection emits neither. | diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts index 74b7df171b..ba44354358 100644 --- a/packages/subagent/subagent/src/index.ts +++ b/packages/subagent/subagent/src/index.ts @@ -58,6 +58,25 @@ export type { SubagentStopReasonMap, } from './types.ts' +/** + * Reject a recursion cap that cannot represent an exact delegation depth. + * Undefined means the caller did not request a cap and is accepted. The + * service, direct in-process driver, and model-facing config adapter share this + * boundary so no entry path can turn a fractional or non-finite value into an + * ineffective limit. + * @param maxDepth - the optional runtime value to validate. + */ +export function assertSubagentMaxDepth(maxDepth: unknown): void { + if (maxDepth !== undefined && ( + typeof maxDepth !== 'number' + || !Number.isSafeInteger(maxDepth) + || maxDepth < 0 + || Object.is(maxDepth, -0) + )) { + throw new TypeError('subagent maxDepth must be a non-negative safe integer') + } +} + declare module 'cordis' { interface Context { subagents: SubagentService @@ -309,13 +328,7 @@ export class SubagentService extends Service { const input = this.snapshotStartRequest(request) const parent = input.parent this.assertCapabilities(provider, input) - if (input.maxDepth !== undefined && ( - !Number.isSafeInteger(input.maxDepth) - || input.maxDepth < 0 - || Object.is(input.maxDepth, -0) - )) { - throw new TypeError('subagent maxDepth must be a non-negative safe integer') - } + assertSubagentMaxDepth(input.maxDepth) if (input.persona !== undefined && typeof input.persona !== 'string') { throw new TypeError('subagent persona must be a string') } diff --git a/packages/subagent/subagent/src/types.ts b/packages/subagent/subagent/src/types.ts index 003d6a6a3d..97efd4661f 100644 --- a/packages/subagent/subagent/src/types.ts +++ b/packages/subagent/subagent/src/types.ts @@ -69,8 +69,9 @@ export interface SubagentStartRequest { */ outputSchema?: StructuredOutputSchema /** - * Optional recursion cap (max delegation depth below this child). Requires - * {@link SubagentCapabilities.depthLimit}; rejected at start otherwise. + * Optional recursion cap (max delegation depth below this child). Must be a + * non-negative safe integer. Requires {@link SubagentCapabilities.depthLimit}; + * rejected at start otherwise. */ maxDepth?: number /** diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts index e9b66ce158..faf4bb00b3 100644 --- a/packages/subagent/subagent/tests/service.spec.ts +++ b/packages/subagent/subagent/tests/service.spec.ts @@ -431,10 +431,14 @@ describe('SubagentService', () => { }) it.each([ + { label: 'a string', value: '1' as unknown as number }, { label: 'NaN', value: Number.NaN }, + { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, + { label: 'negative infinity', value: Number.NEGATIVE_INFINITY }, { label: 'a fraction', value: 1.5 }, { label: 'a negative integer', value: -1 }, { label: 'negative zero', value: -0 }, + { label: 'an unsafe integer', value: Number.MAX_SAFE_INTEGER + 1 }, ])('rejects maxDepth=$label before the provider starts', async ({ value }) => { const ctx = new Context() await ctx.plugin(SubagentService) diff --git a/packages/subagent/tool-subagent/src/index.ts b/packages/subagent/tool-subagent/src/index.ts index c6dc808068..ca7f20d23d 100644 --- a/packages/subagent/tool-subagent/src/index.ts +++ b/packages/subagent/tool-subagent/src/index.ts @@ -35,6 +35,7 @@ import z from 'schemastery' import { defineTool } from '@deepseek-ai/dsh-tools' import type { AgentOptions } from '@deepseek-ai/dsh-agent' import type { ContentBlock } from '@deepseek-ai/dsh-llm' +import { assertSubagentMaxDepth } from '@deepseek-ai/dsh-subagent' import type { SubagentProvider, SubagentResult, SubagentRun, SubagentStartRequest } from '@deepseek-ai/dsh-subagent' export const name = 'tool-subagent' @@ -119,17 +120,6 @@ export const Config: z = z.object({ maxDepth: z.natural().max(Number.MAX_SAFE_INTEGER), }) -/** Reject a recursion cap that cannot represent an exact delegation depth. */ -function assertMaxDepth(maxDepth: number | undefined): void { - if (maxDepth !== undefined && ( - !Number.isSafeInteger(maxDepth) - || maxDepth < 0 - || Object.is(maxDepth, -0) - )) { - throw new Error('tool-subagent: `maxDepth` must be a non-negative safe integer') - } -} - /** * Flatten a child's final output blocks to text for the tool result. The child * may return non-text blocks; this cut surfaces the text content (the common @@ -202,7 +192,7 @@ export function providerWording(inherits: boolean): { description: string; promp export function apply(ctx: Context, config: Config): void { // Keep misconfiguration at plugin load even when a caller invokes apply() // directly and bypasses Schemastery's natural/max metadata. - assertMaxDepth(config.maxDepth) + assertSubagentMaxDepth(config.maxDepth) // Misconfiguration fails loud AT LOAD (the check is self-contained): an // explicit `toolFilter: {}` would otherwise pass the capability gate and // kill every delegation later, in the child-setup `restrict({})` throw. diff --git a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts index 194c63997c..4e125d24e1 100644 --- a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts +++ b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts @@ -494,6 +494,9 @@ describe('dsh-tool-subagent', () => { }) it.each([ + { label: 'NaN', value: Number.NaN }, + { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, + { label: 'negative infinity', value: Number.NEGATIVE_INFINITY }, { label: 'a negative integer', value: -1 }, { label: 'a fractional number', value: 1.5 }, { label: 'negative zero', value: -0 }, From cb03c8c2844790230a2ee1de24f72c7cf4bac742 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 11:17:57 +0800 Subject: [PATCH 09/21] fix(scope): align trust and input boundaries Rewrite the agent-scope RFC with executable examples and an explicit security non-goal. Harden subagent scalar and depth validation, and pin live tool-filter semantics across code, tests, and generated docs. --- CONTEXT.md | 8 +- docs/config-catalog.md | 10 +- docs/cordis-catalog/events.md | 2 +- docs/cordis-catalog/services.md | 4 +- docs/core-data-structures/subagent.md | 6 +- docs/core-data-structures/tools.md | 2 +- ...t-variables-and-tool-guidance-ownership.md | 4 +- .../2026-07-08-agent-scope-contexts.md | 403 ++++++++++++++++-- .../cordis/tool-cordis/src/api-catalog.ts | 2 +- packages/core/scope/README.md | 4 +- packages/core/scope/src/index.ts | 10 +- packages/core/system-prompt/README.md | 4 +- packages/core/system-prompt/src/index.ts | 12 +- packages/core/tools/README.md | 2 +- packages/core/tools/src/index.ts | 26 +- packages/core/tools/tests/scoped.spec.ts | 27 +- packages/subagent/subagent-fork/README.md | 2 +- .../subagent/subagent-inprocess/README.md | 8 +- .../subagent/subagent-inprocess/src/index.ts | 12 +- .../tests/structured.spec.ts | 2 +- .../tests/subagent-inprocess.spec.ts | 23 + packages/subagent/subagent/README.md | 2 +- packages/subagent/subagent/src/types.ts | 13 +- .../subagent/subagent/tests/service.spec.ts | 3 +- packages/subagent/tool-subagent/README.md | 8 +- packages/subagent/tool-subagent/src/index.ts | 21 +- .../tool-subagent/tests/tool-subagent.spec.ts | 20 +- packages/support/subagent-mock/README.md | 2 +- packages/support/subagent-mock/src/index.ts | 8 +- 29 files changed, 545 insertions(+), 105 deletions(-) diff --git a/CONTEXT.md b/CONTEXT.md index 7fd11ae59e..2b3584aff4 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -4,12 +4,12 @@ Domain vocabulary for the DeepSeek Harness SDK — one canonical term per concep ## agent-scope -- **scope** — the unit of per-agent registration: a contribution (tool, prompt section, variable, restriction, listener) is either *global* (visible to every agent) or *scoped* (owned by exactly one [[scope-key]]). Two levels, flat: nothing inherits down to subagents; subtree behavior is expressed with [[lineage]] data, never structure. +- **scope** — the unit of per-agent registration: a contribution (tool, prompt section, variable, restriction, listener) is either *global* (visible to every agent) or *scoped* (owned by exactly one [[scope-key]]). Two levels, flat: scoped registrations do not inherit down to subagents; subtree behavior is expressed with [[lineage]] data, never scope structure. - **scope key** — the opaque identity a scope is keyed by, compared by object identity. The harness convention: a live agent is the key of its own scope. -- **agent context (`agent.ctx`)** — the agent's scoped context; registrations through it are scope-visible AND scope-lifetime (one fact drives both), and listeners on it hear only that agent's dispatches. +- **agent context (`agent.ctx`)** — the agent's scoped context; registrations through it are scope-visible AND scope-lifetime (one fact drives both), and listeners on it participate in that agent's scope-filtered dispatches. Registry-subject events may remain deliberately unfiltered under their own event contracts. - **scope carrier** — the `thisArg` a scope-filtered dispatch carries (built by `scopeTarget`); its filter admits untagged listeners plus the subject's own. A *subject-less* carrier (no key) admits untagged listeners only. - **scoped dispatch** — the rule: an event about one agent's activity dispatches with that agent's carrier. Events about a registry itself (a tool was added) are *registry-subject* and stay unfiltered. - **shadowing** — most-specific-wins name resolution: a scoped tool/section/variable replaces its same-named global twin for that scope alone. The per-agent persona and per-agent tool-variant mechanism. -- **restriction / grant** — a restriction (`tools.restrict`) masks the GLOBAL tool surface for one scope (compose by intersection); a scoped registration is an explicit grant that bypasses restrictions. A restricted-away tool is absent from the prompt AND refuses execution, indistinguishably from a nonexistent one. -- **setup window** — the creation slot where a creator composes an agent's scoped world (`CreateAgentOptions.setup`): after the scope exists and the agent is registered, before `agent/session-start` and the first prompt assembly. Setup registers; it never drives the agent. +- **restriction / scope-local registration** — a restriction (`tools.restrict`) filters the GLOBAL tool surface for one scope (compose by intersection); scope-local registrations are merged after that filter. A filtered-away global tool is absent from the prompt AND refuses execution, indistinguishably from a nonexistent one. +- **setup window** — the creation slot where a creator composes an agent's scoped world (`CreateAgentOptions.setup`): after the scope and agent object exist but before the agent or session is published, `agent/session-start` fires, or the first prompt is assembled. Setup registers; it never drives the agent. - **lineage** — parent/child facts carried as data (`parentSession`, `subagentDepth`); never affects visibility. diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 8fd8e3379b..57f8bc961a 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -712,9 +712,11 @@ export interface Config { /** Which start-time capabilities to advertise (default: all `true`). */ capabilities?: Partial /** - * The context contract to declare ({@link SubagentProvider.inheritsParentContext}); - * default `false` (spawn-like). Set `true` to exercise the fork-shaped tool - * wording in consumer tests. + * The conversation-history descriptor to declare + * ({@link SubagentProvider.inheritsParentContext}); default `false` (fresh + * conversation). Set `true` to exercise seeded/fork wording in consumer + * tests. This flag says nothing about tool, service, scope, or authority + * inheritance. */ inheritsParentContext?: boolean /** @@ -903,7 +905,7 @@ export interface Config { Depends on: [`AgentOptions`](../packages/core/agent/src/index.ts) -Source: [`packages/subagent/tool-subagent/src/index.ts:45`](../packages/subagent/tool-subagent/src/index.ts) +Source: [`packages/subagent/tool-subagent/src/index.ts:47`](../packages/subagent/tool-subagent/src/index.ts) ## `@deepseek-ai/dsh-tool-web` diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index d13f88bc2d..d59bc617d0 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -385,7 +385,7 @@ Source: [`packages/core/tools/src/index.ts:176`](../../packages/core/tools/src/i ### `tools/execute` — waterfall -Around-dispatch waterfall wrapping the registry's core tool dispatch, between the `tools/pre-execute` gate and the `tools/post-execute` seam. A listener receives `(exec, next)`: call `next()` to delegate to dispatch (returning its ToolExecutionResult, optionally wrapped), or return a replacement result without calling `next()` to short-circuit dispatch. The base `next()` IS the dispatch-with-normalization thunk — a thrown tool (or unknown tool) is already normalized to an `isError` result by the time a listener's `await next()` returns, so a wrapper never sees a raw throw from the tool body. This is the seam a timeout/retry/metrics plugin wraps: it can set or replace the one mutable field, `exec.signal` (e.g. with a per-call deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the pipeline so a wrapper cannot change which capability or scope was authorized. (Cordis `next()` ignores passed arguments and re-invokes downstream with the shared payload, so a wrapper changes `exec.signal` in place rather than passing a new object to `next()`.) Multiple listeners compose by registration order — an outer one wraps the inner ones plus dispatch. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by `exec.agent` — a listener registered through `agent.ctx` wraps only that agent's calls; a plain plugin listener wraps every call (including agent-less ones, which dispatch subject-less). +Around-dispatch waterfall wrapping the registry's core tool dispatch, between the `tools/pre-execute` gate and the `tools/post-execute` seam. A listener receives `(exec, next)`: call `next()` to delegate to dispatch (returning its ToolExecutionResult, optionally wrapped), or return a replacement result without calling `next()` to short-circuit dispatch. The base `next()` IS the dispatch-with-normalization thunk — a thrown tool (or unknown tool) is already normalized to an `isError` result by the time a listener's `await next()` returns, so a wrapper never sees a raw throw from the tool body. This is the seam a timeout/retry/metrics plugin wraps: it can set or replace the one mutable field, `exec.signal` (e.g. with a per-call deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the pipeline so a wrapper cannot change which tool and scope the pipeline accepted. (Cordis `next()` ignores passed arguments and re-invokes downstream with the shared payload, so a wrapper changes `exec.signal` in place rather than passing a new object to `next()`.) Multiple listeners compose by registration order — an outer one wraps the inner ones plus dispatch. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is keyed by `exec.agent` — a listener registered through `agent.ctx` wraps only that agent's calls; a plain plugin listener wraps every call (including agent-less ones, which dispatch subject-less). ```ts cordis-catalog 'tools/execute'(this: Scoped, exec: ToolExecution, next: () => Promise): Promise diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index f5946a7e4d..877c10e080 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -254,7 +254,7 @@ Source: [`packages/subagent/subagent/src/index.ts:180`](../../packages/subagent/ ## `ctx.systemPrompt` — `SystemPrompt` -Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative contribution protections; the agent loop calls `assemble(context)` once per step. Registers the harness-owned `harness:identity` and `deployment:persona` sections itself (see Config.persona). +Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contribution protections; the agent loop calls `assemble(context)` once per step. Registers the harness-owned `harness:identity` and `deployment:persona` sections itself (see Config.persona). ```ts cordis-catalog section(section: PromptSection): () => Promise | void @@ -285,7 +285,7 @@ async execute(exec: ToolExecutionInput): Promise Types: [ToolDefinition](../core-data-structures/tools.md) · [ToolExecutionInput](../core-data-structures/tools.md) · [ToolExecutionResult](../core-data-structures/tools.md) -Source: [`packages/core/tools/src/index.ts:481`](../../packages/core/tools/src/index.ts) +Source: [`packages/core/tools/src/index.ts:484`](../../packages/core/tools/src/index.ts) ## `ctx.userInteraction` — `UserInteractionService` diff --git a/docs/core-data-structures/subagent.md b/docs/core-data-structures/subagent.md index 3de6b5861e..2f3e089a22 100644 --- a/docs/core-data-structures/subagent.md +++ b/docs/core-data-structures/subagent.md @@ -78,7 +78,7 @@ interface SubagentRun { ## The provider seam: `SubagentProvider` -One transport for running a child agent. Implementations register under a unique name via `SubagentService.registerProvider`; multiple coexist in one context. The service validates every requested start-time capability before calling `start`, so an implementation may assume e.g. `request.maxDepth` is honorable when present. `inheritsParentContext` is a DESCRIPTIVE fact beside the capabilities (nothing validates against it): whether a child sees the parent conversation (`fork`: true, `spawn`/`acp`: false) — the model-facing consumer derives truthful tool wording from it. +One transport for running a child agent. Implementations register under a unique name via `SubagentService.registerProvider`; multiple coexist in one context. The service validates every requested start-time capability before calling `start`, so an implementation may assume e.g. `request.maxDepth` is honorable when present. `inheritsParentContext` is a DESCRIPTIVE fact beside the capabilities (nothing validates against it): whether a child sees the parent conversation (`fork`: true, `spawn`/`acp`: false) — the model-facing consumer derives truthful tool wording from it. It describes conversation history only, not tool registrations, injected services, or authority inheritance. ```ts type-equiv interface SubagentProvider { @@ -93,7 +93,7 @@ The service (`ctx.subagents`) emits `subagent/start` only after `run.started` fu ## In-process backends: depth and seed -The two in-process backends ([dsh-subagent-spawn](../../packages/subagent/subagent-spawn) fresh, [dsh-subagent-fork](../../packages/subagent/subagent-fork) seeded) run the child as a child `Agent` on the same application. They synchronously snapshot caller-owned data, install provider ownership before attaching the abort listener, create one run-owner fiber under `parent.ctx`, and invoke the factory through that fiber: parent teardown, provider teardown, and manual run disposal share the same pre-publication ownership and quiescence boundary, while the child still receives a flat new scope rather than inheriting the parent's capabilities. Their `started` promise projects the factory's successful publication and the result driver awaits that same promise before sending the prompt. Two pieces of vocabulary ride on the existing agent/session types rather than new core types: +The two in-process backends ([dsh-subagent-spawn](../../packages/subagent/subagent-spawn) fresh, [dsh-subagent-fork](../../packages/subagent/subagent-fork) seeded) run the child as a child `Agent` on the same application. They synchronously snapshot caller-owned data, install provider ownership before attaching the abort listener, create one run-owner fiber under `parent.ctx`, and invoke the factory through that fiber: parent teardown, provider teardown, and manual run disposal share the same pre-publication ownership and quiescence boundary, while the child still receives a flat new scope rather than inheriting the parent's registrations. Their `started` promise projects the factory's successful publication and the result driver awaits that same promise before sending the prompt. Two pieces of vocabulary ride on the existing agent/session types rather than new core types: -- **Delegation depth** is a merge-extensible `AgentOptions.subagentDepth` field (`0` for a top-level agent, parent + 1 for a child). The seam owns it — the loop neither sets nor reads it — so a nested spawn reads its parent's depth from `parent.options.subagentDepth` and the `depthLimit` capability caps the tree by refusing a child whose depth would exceed `request.maxDepth`. +- **Delegation depth** is a merge-extensible `AgentOptions.subagentDepth` field (`0` for a top-level agent, parent + 1 for a child). Only `undefined` means top level; every stored present value must be a non-negative safe integer. The seam owns it — the loop neither sets nor reads it — so a nested spawn validates its parent's stored depth, rejects a derived child depth outside the safe-integer domain, and applies a defined absolute `request.maxDepth` cap to that child. - **Fork seeding** uses `CreateAgentOptions.seed` (a `SessionEvent[]` prefix threaded through `AgentLoop.createAgent` → `ctx.sessions.prepare({ seed })`, the same primitive `resume` uses). The fork backend passes a *balanced completed-turn prefix* of the parent's log — the parent's events up to and including its last `turn/end` — so the seed is contiguous-from-0 and the [invariants](../../packages/support/invariants) replay accepts it (the in-flight, unbalanced turn is excluded). diff --git a/docs/core-data-structures/tools.md b/docs/core-data-structures/tools.md index 5c11f1a07c..1766b4c9ce 100644 --- a/docs/core-data-structures/tools.md +++ b/docs/core-data-structures/tools.md @@ -118,7 +118,7 @@ interface ToolExecution extends ToolExecutionInput { } ``` -`ToolExecutionToken` is a compile-time opaque type and a frozen, property-free object at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` reads each caller-owned field once, materializes `arguments` as detached lossless JSON in one recursive pass, assigns a fresh token, and deep-freezes the accepted arguments. A mutable exotic such as `Map` is rejected and normalized to an error before policy; one-pass materialization prevents a stateful getter from supplying different values to validation and storage. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are non-writable throughout all waterfalls, so a listener cannot change which capability or scope was authorized or reach a live enclosing execution; an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers, where the execution remains usable as a `WeakMap` key without mutation races. +`ToolExecutionToken` is a compile-time opaque type and a frozen, property-free object at runtime; identity comparison is its only operation. Before policy runs, `ctx.tools.execute()` reads each caller-owned field once, materializes `arguments` as detached lossless JSON in one recursive pass, assigns a fresh token, and deep-freezes the accepted arguments. A mutable exotic such as `Map` is rejected and normalized to an error before policy; one-pass materialization prevents a stateful getter from supplying different values to validation and storage. `token`, `callId`, `name`, `arguments`, `agent`, and the optional `parent` token are non-writable throughout all waterfalls, so a listener cannot change which tool or scope the pipeline accepted or reach a live enclosing execution; an around-dispatch wrapper may add, replace, or remove only optional `signal`. After the complete pipeline the registry freezes the execution and exposes its stable identity to `tools/result` observers, where the execution remains usable as a `WeakMap` key without mutation races. A `ToolGuard` is scope-aware final pre-dispatch policy. Its shape deliberately has no allow result: `undefined` preserves the waterfall decision, while a returned reason can only reduce permission, so a later listener cannot undo it. diff --git a/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md b/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md index 24a525307e..53d3e63cdb 100644 --- a/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md +++ b/docs/rfc/implemented/architecture/2026-07-05-prompt-variables-and-tool-guidance-ownership.md @@ -36,9 +36,9 @@ Plugins contribute named values via `ctx.systemPrompt.variable(name, provider)`; Per-tool semantics and when-to-use live in tool DESCRIPTIONS, which already ship in every request — the YAML prose was ~fully redundant with them. Sections carry only the cross-call habits a single call's description cannot: `dsh-tool-bash` contributes `tool:bash` (order 105) — check the `[exit code: N]` marker on every result; `dsh-tool-fs`'s read section gains the "not shell commands like cat" contrast. `todo_write` and the subagent tools need NO section — their descriptions already carry the whole contract. The leaf personas shrink to identity + behavior (verify your work; keep answers brief), and the welcome banner stops enumerating tools. -### The subagent context contract +### The subagent conversation-history descriptor -`SubagentProvider` gains `readonly inheritsParentContext: boolean` — a DESCRIPTIVE fact beside `capabilities`, not in it (capabilities are start-time validation; nothing validates against this flag). Spawn and ACP declare `false`, fork declares `true`. `dsh-tool-subagent` derives both the tool description and the `prompt` parameter description from the flag (`providerWording`): the fork instance now tells the model the child inherits the conversation's completed turns (not the in-flight turn) and that its prompt should state only what is new. Deriving the description from a provider that arrives on its own fiber is what forced the provider-lifecycle events and the tool's reactive registration — that mechanism, its Loader-concurrency rationale, and its rejected alternatives are recorded in [the provider-lifecycle-events RFC](2026-07-05-subagent-provider-lifecycle-events.md). +`SubagentProvider` gains `readonly inheritsParentContext: boolean` — a DESCRIPTIVE conversation-history fact beside `capabilities`, not in it (capabilities are start-time validation; nothing validates against this flag). Spawn and ACP declare `false`, fork declares `true`. The name refers only to conversation seeding, not Cordis scope, services, tools, or authority. `dsh-tool-subagent` derives both the tool description and the `prompt` parameter description from the flag (`providerWording`): the fork instance now tells the model the child is seeded with the conversation's completed turns (not the in-flight turn) and that its prompt should state only what is new. Deriving the description from a provider that arrives on its own fiber is what forced the provider-lifecycle events and the tool's reactive registration — that mechanism, its Loader-concurrency rationale, and its rejected alternatives are recorded in [the provider-lifecycle-events RFC](2026-07-05-subagent-provider-lifecycle-events.md). ## Alternatives considered diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index df6433dd26..9162273c72 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -6,26 +6,48 @@ Status: implemented One application can run many agents that share infrastructure but must not share every capability or policy. A child agent may need a different persona, fewer tools, its own structured-result schema, and listeners that govern only its work, while still using the deployment's model adapters, persistence backend, tool implementations, and user interface. -This is a composition problem, not an application-isolation problem. Starting a separate service graph for every child would isolate too much; putting every registration in one global graph isolates too little. +This is a composition problem, not an application-isolation or security-confinement problem. Starting a separate service graph for every child would isolate too much; putting every registration in one global graph isolates too little. | Surface | What varies by agent | Failure when it is only global | |---|---|---| -| Tools | Available capabilities, a child-only tool, or a scoped replacement for one implementation | The model receives excess authority, or a child-specific tool leaks into every prompt | +| Tools | Available capabilities, a child-only tool, or a scoped replacement for one implementation | The model receives the wrong tool view, or a child-specific tool leaks into every prompt | | Prompt state | Persona, instructions, variables, and [Code Mode](../feature/2026-06-15-code-mode.md) SDK declarations | Every agent receives the same instructions or runtime facts | | Live policy | Hooks, execution guards, result observers, and continuation rules | A listener intended for one agent can alter another agent's work | | Lifetime | Cleanup when the agent fails, is cancelled, is disposed, or loses its owner | Registrations outlive the agent or disappear before its final work settles | -Two consistency requirements make the problem deeper than filtering a list. First, the model-visible and executable views must agree: a hidden tool must not remain callable, and an advertised tool must not fail merely because execution used a different registry view. This agreement must also cover Code Mode bindings and UI presentation. +Three consistency requirements make the problem deeper than filtering a list. First, the model-visible and executable views must agree: a hidden tool must not remain callable, and an advertised tool must not fail merely because execution used a different registry view. This agreement must also cover Code Mode bindings and UI presentation. Second, some rules are invariants rather than cooperative extensions. An ordinary middleware listener may replace a prompt assembly, turn an allow into a deny, rewrite a result, force another model step, or short-circuit listeners registered after it. Structured output therefore cannot rely on being “first” or “last” in an extensible listener chain; the owning service needs a final boundary for rules that later listeners must not undo. Third, accepting a value must transfer ownership of the exact value that was checked. TypeScript `readonly` annotations disappear at runtime, callers and providers may expose stateful accessors, and a validation pass followed by a clone reads mutable input twice. Identity fields, schemas, session data, requests, and results therefore need runtime boundaries that capture each caller-owned field once, materialize data once, and expose only owner-controlled snapshots. Otherwise the checked, executed, logged, and observed views can diverge even when scope resolution itself is correct. +The failure does not require TypeScript or threads. One JavaScript getter is enough to make a two-read boundary validate one name and store another: + +```js +let reads = 0 +const input = { + get name() { + reads += 1 + return reads === 1 ? 'safe_tool' : 'different_tool' + }, +} + +// Wrong: validation and storage observe different values. +validateName(input.name) +storeName(input.name) + +// Right: capture once, then validate and store that capture. +reads = 0 +const acceptedName = input.name +validateName(acceptedName) +storeName(acceptedName) +``` + The subagent API makes these requirements concrete. Two concurrent children can request different personas, tool filters, and output schemas. Those requests are honest only when each child receives an independently owned view and when its terminal-output protocol survives unrelated plugins. ## Decision -Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's world composable with normal plugin APIs while keeping authority, observation, and cleanup aligned. +Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's registration view composable with normal plugin APIs while keeping visibility, observation, and cleanup aligned. The design has five parts: @@ -37,11 +59,90 @@ The design has five parts: | Owner-final policy | Prompt protection, tool guards, final tool-result observation, and terminal turn stopping run at service-owned boundaries | Invariants do not depend on listener registration order | | Boundary ownership | Services capture fixed fields once, materialize lossless-JSON data once, and publish owner-controlled views | Validation, execution, persistence, and telemetry cannot observe different values from one call | +### One public call shows the composition model + +The common case uses ordinary registration APIs through the setup context. Code blocks in this RFC are focused examples and start from a fresh initialized application unless one explicitly continues another. Here `ctx` is a plugin's service context, `setup(agentCtx)` receives the unpublished agent's scoped context, and helpers such as `AgentId`, `SessionId`, and `CallId` construct opaque IDs. Assume the deployment already registered global `read` and `bash` tools; this creates a reviewer whose persona, global-tool filter, and extra reporting tool exist only for that agent and disappear with its handle: + +```js +const reviewSummaryTool = { + name: 'review_summary', + description: 'Return the review summary.', + parameters: { type: 'object', properties: {} }, + async execute() { + return [{ type: 'text', text: 'review complete' }] + }, +} + +const handle = await ctx.agents.create({ + agentId: AgentId('reviewer'), + sessionId: SessionId('reviewer-session'), + agentOptions: { model: 'model-name' }, + setup(agentCtx) { + agentCtx.systemPrompt.section({ + name: 'deployment:persona', + order: 0, + text: 'Review code, but do not modify files.', + }) + agentCtx.tools.restrict({ allow: ['read'] }) + agentCtx.tools.register(reviewSummaryTool) + }, +}) + +const reviewer = handle.agent +ctx.tools.get('read', reviewer) // global tool, visible +ctx.tools.get('bash', reviewer) // undefined: filtered global tool +ctx.tools.get('review_summary') // undefined: not global +ctx.tools.get('review_summary', reviewer) // child-only definition + +await handle.dispose() +ctx.tools.get('review_summary', reviewer) // undefined: scope was unwound +``` + +The rest of this RFC explains why the short setup above needs scope-aware resolution, unpublished construction, ordered teardown, and owner-final policy. + +### Security and authority are explicit non-goals + +Scoped contexts are trusted in-process registration composition, not a sandbox, authorization ledger, or parent-to-child authority lattice. A plugin with a Cordis context executes in the same process and can call the services injected into that context. Scope filtering decides which registered contribution participates in one operation and who cleans it up; it does not prove that a child can do no more than its parent. + +#### Flat scopes do not enforce a parent-to-child subset + +Flat lookup makes that boundary visible. Parent lifetime ownership does not cause the child to inherit the parent's restriction, and a child-local registration is merged after the global filter: + +```text +global tools = { read, bash } +parent restriction = allow { read } +parent scoped registrations = { delegate } +child restriction = none +child scoped registrations = { deploy } + +visible(parent) = { read, delegate } +visible(child) = { read, bash, deploy } +``` + +Through `delegate`, a parent can deliberately start this child and indirectly obtain work performed with `bash` or `deploy`. This RFC neither prevents nor blesses that arrangement; deployments that need a non-escalation guarantee require a separate authority design and enforcement boundary. + +#### Restrictions are live views, not grant snapshots + +Restrictions also resolve against a live global registry rather than an immutable authorization snapshot. A deny-list names removals, while an allow-list names the complete retained global set: + +```text +at time 0: + global tools = { read, bash } + deny { bash } view = { read } + allow { read } view = { read } + +after registering global tool web: + deny { bash } view = { read, web } + allow { read } view = { read } +``` + +Scope-local tools are merged after either filter. There is no separate authority-versus-visibility ledger, frozen creation-time grant snapshot, parent-subset rule, future-tool grant API, or generic capability/output/terminal tag system here. `run_code` and `structured_output` have explicit protocol-owned treatment described below; they do not imply a general security taxonomy. Those questions are separate design work rather than hidden promises of scoped contexts. + Three domain terms recur below. A **Session** is one agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** means JSON primitives plus dense arrays and plain objects that can be copied without changing meaning; the boundary rejects sparse arrays, cycles, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols instead of coercing or erasing them. **Code Mode** presents the model with a generated software-development-kit interface and a reserved `run_code` transport, rather than advertising every end-capability as a native tool. Ownership stays with the component that can enforce each fact. The scope package owns scope tags and carrier construction; each registry owns acceptance snapshots and resolution; the caller owns the programmatic agent lifetime it requested; the concrete agent factory owns identity reservation, setup, publication, and structural invalidation of agents that still depend on it; the session owns accepted history; the tool and subagent services own their pipeline records; and each workflow run captures its holder-bound dependencies and owns its cancellation after the engine returns it. A caller never validates a value that another component later rereads from the caller's mutable object. -The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without silently inheriting authority. +The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without inheriting registrations. The core implementation lives in [`dsh-scope`](../../../../packages/core/scope/README.md), [`dsh-agent`](../../../../packages/core/agent/README.md), [`dsh-agent-loop`](../../../../packages/core/agent-loop/README.md), [`dsh-session`](../../../../packages/core/session/README.md), [`dsh-system-prompt`](../../../../packages/core/system-prompt/README.md), and [`dsh-tools`](../../../../packages/core/tools/README.md). The composition example spans [`dsh-subagent`](../../../../packages/subagent/subagent/README.md), [`dsh-subagent-inprocess`](../../../../packages/subagent/subagent-inprocess/README.md), and [`dsh-workflow-workerthread`](../../../../packages/workflow/workflow-workerthread/README.md). The [generated Cordis event catalog](../../../cordis-catalog/events.md) is the exhaustive event-signature reference; this RFC explains why the contracts have their current shape. @@ -53,10 +154,29 @@ The design relies on four framework ideas: contexts, effects, waterfall events, A Cordis `Context` is the object through which a plugin reaches services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service method can recover the context through which it was accessed, so the service can tell whether a call came from an ordinary plugin context or from an agent's scoped context without adding a `scope` parameter to every registration API. -A context also carries a capability view. A derived context reaches the services injected into the plugin that created it. Handing out `agent.ctx` therefore hands out the agent loop's injected service surface; it is not an ambient root context. +A context also carries an injected dependency view. A derived context reaches the services injected into the plugin that created it. Handing out `agent.ctx` therefore hands out the agent loop's injected service surface; it is not an ambient root context or a security confinement boundary. Factory delegation uses two contexts whose jobs must remain separate. The registry derives a caller-bound context carrying the fiber and scope from which `ctx.agents.create()` or `resume()` was called and passes it explicitly as `ownerCtx`; those facts identify the fiber and optional parent agent that own the requested lifetime. When the registered factory is itself a Cordis service, the registry also invokes it through a traced receiver, which preserves the factory's own injected dependency origin. A plain object that merely implements the factory methods receives the same explicit `ownerCtx` without depending on Cordis tracing. Conflating these roles would either attach the agent to the factory registrant instead of the caller or make the concrete loop resolve dependencies from the wrong service view. +The object before a service or event method selects the registration origin. The method itself does not need an extra agent parameter: + +```js +ctx.tools.register(globalTool) +agent.ctx.tools.register(agentOnlyTool) + +ctx.on('tools/result', globalObserver) +agent.ctx.on('tools/result', agentObserver) +``` + +Factory calls preserve caller ownership and factory dependency lookup as separate values: + +```text +callerCtx.agents.create(options) + ownerCtx = context carrying callerCtx's fiber and scope + factoryThis = concrete factory traced through ownerCtx + Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) +``` + ### Effects give registrations an owner A Cordis effect is work whose cleanup belongs to a runtime unit called a fiber. Tool registration, prompt contribution, and event subscription are effects, so disposing their fiber unwinds them on normal teardown, failure, or hot reload. @@ -65,12 +185,39 @@ Ownership must exist before effect setup can call arbitrary code. The vendored F `dsh-scope` mounts a no-op plugin fiber for each scope. The plugin contributes no behavior; its fiber is the ownership bucket for everything registered through the scoped context. +In its simplest form, an effect is a setup function that returns its cleanup. Cordis also supports generator effects that compose child effects in a chosen order. In either form Cordis records the wrapper before calling setup, so even setup-triggered reentrant teardown can find and await it: + +```js +ctx.effect(() => { + const resource = openResource() + return async () => { + await resource.close() + } +}) +``` + ### A waterfall is ordered around-middleware A Cordis waterfall is an extensible middleware chain. A listener calls `next()` to delegate, can inspect or replace the downstream result, and can return without calling `next()` to short-circuit everything inside it. This flexibility is useful for cooperative transformations, but registration order is not an invariant boundary. A later plugin can prepend another listener, a wrapper can replace the downstream result after `next()` returns, and a short-circuit can prevent inner listeners from running at all. +The code shape is ordinary around-middleware. Calling `next()` includes downstream work; returning directly skips that listener's downstream listeners and base implementation: + +```js +ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { + const downstream = await next() + return { + ...downstream, + sections: [...downstream.sections, extraSection], + } +}) + +ctx.on('system-prompt/assemble', async () => replacementAssembly) +// This listener skips its downstream/base. An outer listener that already +// awaited next() still resumes around replacementAssembly. +``` + ### The dispatch receiver selects scoped listeners Cordis filters event listeners using the dispatch receiver, the object exposed as `this` inside a function-style listener. `dsh-scope` supplies a receiver carrying the operation's scope key, so the event system can admit global listeners plus listeners registered for that key and reject listeners belonging to other agents. @@ -118,6 +265,18 @@ The scope key is an opaque object compared by identity. The harness uses the liv The property is deliberately not treated as the authoritative scope tag. A nested scope can install a nearer scope key while still inheriting the original `ctx.agent` association, so lower-level services resolve layers with `scopeOf(context)`. In normal agent composition the two point at the same live agent; the separation keeps the generic scope primitive independent of the agent package. +The distinction appears when a plugin deliberately nests another scope: + +```js +const auditKey = {} +const auditScope = createScope(agent.ctx, auditKey) + +auditScope.ctx.agent === agent // true: inherited ergonomic association +scopeOf(auditScope.ctx) === auditKey // true: authoritative nearest scope tag + +await auditScope.dispose() +``` + ### The scope primitive has separate public and composite disposal forms `dsh-scope` exposes the minimum operations needed to create a layer, read it, target events, and dispose it. “Quiescent” here means that every asynchronous cleanup registered in the scope has settled and no teardown work remains in flight. @@ -190,15 +349,32 @@ registerTool(context, definition): The reserved Code Mode transport uses the same frozen-definition contract even though it lives outside the ordinary layers. -### Tool restrictions reduce end capabilities without removing transport +### Tool restrictions filter the global view without removing transport -A tool restriction masks the global end-capability layer for one agent, while tools registered in that agent's own layer are explicit grants. Multiple restrictions intersect, so separately installed policies can only reduce the global surface. +A tool restriction masks the global end-capability layer for one agent, while tools registered in that agent's own layer are merged afterward. Multiple restrictions intersect, so separately installed filters can only reduce the global part of the view; they do not filter scope-local registrations. The restriction reads `allow` and `deny` once, snapshots those exact values, rejects an empty filter, and validates named tools against the pre-restriction capability universe. The same captured arrays are then enforced, so a stateful accessor cannot pass one policy through validation and install another. A restricted-away tool behaves like an unknown tool at execution, avoiding disclosure of a hidden global implementation. [Code Mode](../feature/2026-06-15-code-mode.md)'s `run_code` is not an end capability. It is a reserved presentation transport that carries calls to the visible end capabilities, so the registry keeps it outside both global and scoped registration layers: restrictions cannot remove it, a scoped tool cannot shadow it, and configuration cannot explicitly allow or deny it. Without this exception, a restriction could leave the generated SDK in the prompt but remove the only way to invoke it. -The registry still uses one executable visibility view. It first resolves restricted global capabilities plus scoped grants, then appends the reserved transport in non-native modes; registry-owned prompt schemas, lookup, execution, Code Mode SDK bindings, timeout lookup, inspection, and UI presentation all consume that view. +The registry still uses one executable visibility view. It first resolves filtered global capabilities plus scope-local registrations, then appends the reserved transport in non-native modes; registry-owned prompt schemas, lookup, execution, Code Mode SDK bindings, timeout lookup, inspection, and UI presentation all consume that view. + +The public lookup API exposes the exact same resolution used for prompt schemas and execution: + +```js +ctx.tools.register(readTool) +ctx.tools.register(bashTool) + +agent.ctx.tools.restrict({ allow: ['read'] }) +agent.ctx.tools.register(reviewSummaryTool) + +ctx.tools.get('read', agent) // visible global definition +ctx.tools.get('bash', agent) // undefined: filtered global definition +ctx.tools.get('review_summary', agent) // visible scope-local definition +ctx.tools.get('review_summary') // undefined: absent from global view +``` + +Executing `bash` for this agent follows the same lookup and produces the ordinary unknown-tool error; it does not bypass the filter through a separate execution registry. The [security non-goal](#security-and-authority-are-explicit-non-goals) explains why later global registrations and scope-local registrations are not an authorization snapshot. The guarantee covers the tool registry's contribution. A plugin can deliberately use the lower-level `systemPrompt.tools()` API or assembly waterfall to add an unrelated wire schema; that plugin owns the matching executable behavior and any ordering it introduces. Owner protection preserves reserved named infrastructure without turning the system-prompt service into a validator for unrelated contributions. @@ -227,6 +403,24 @@ The operation being described determines the key; callers cannot attach an unrel | `session/created`, `session/disposed`, `session/event`, `session/flush` | The owner scope captured when the session enters the store | | `subagent/start`, `subagent/end` | The delegating parent agent | +The observable rule is global plus matching, not global plus every scoped listener. This example drives a real tool execution so routing and notification use the same accepted `agent` subject: + +```js +const seen = [] +ctx.tools.register(readTool) +ctx.on('tools/result', () => seen.push('global')) +agentA.ctx.on('tools/result', () => seen.push('A')) +agentB.ctx.on('tools/result', () => seen.push('B')) + +await ctx.tools.execute({ + callId: CallId('read-1'), + name: 'read', + arguments: {}, + agent: agentA, +}) +seen // ['global', 'A'] +``` + Approval requests cross an asynchronous answer boundary, so the service snapshots the accepted record synchronously. It preserves the exact agent and abort-signal identities but copies the scalar fields, captures the agent's session once, and uses that one snapshot for `approval/asked`, scoped dispatch, cancellation, policy, and `approval/decided`. Mutating the caller-owned record after `request()` returns therefore cannot split the audit pair or redirect the question to another agent's listeners. The dispatch rule can be read independently of Cordis internals: @@ -252,16 +446,65 @@ Function-style listeners receive the carrier as `this`, and agent event APIs all Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The carrier therefore uses a dedicated surrogate proxy target with its own immutable composed-filter slot, while ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to the real subject; callable carriers also preserve whether the subject is constructable. -The composed filter is an authorization boundary, not an ordinary exposed callback. It invokes a subject's pre-existing filter with stable references to the built-in `Reflect.apply` and `Function.prototype.call` operations, pins its own `.call` to that captured built-in, and freezes the callable. Code holding the subject or carrier therefore cannot replace either `.call` property to turn a scoped predicate into an always-allow predicate. Keeping the filter on the surrogate also means a filter property pinned on the subject before, during, or after carrier construction cannot trigger a Proxy invariant that silently replaces scope isolation with the subject's raw filter. +A minimal JavaScript example shows why method binding is observable rather than a TypeScript detail: + +```js +class Subject { + #count = 0 + increment() { this.#count += 1 } +} + +const subject = new Subject() +new Proxy(subject, {}).increment() // TypeError: proxy lacks Subject's private identity + +const carrier = scopeTarget(subject, subject) +carrier.increment() // works: method is bound to subject +carrier === subject // false: dispatch carrier has distinct identity +``` + +The composed filter is a listener-selection correctness boundary, not an ordinary exposed callback. It invokes a subject's pre-existing filter with stable references to the built-in `Reflect.apply` and `Function.prototype.call` operations, pins its own `.call` to that captured built-in, and freezes the callable. Code holding the subject or carrier therefore cannot accidentally replace either `.call` property and turn the scoped predicate into an always-admit predicate. Keeping the filter on the surrogate also means a filter property pinned on the subject before, during, or after carrier construction cannot trigger a Proxy invariant that silently replaces scope filtering with the subject's raw filter. The surrogate must remain extensible so its reported own-key view can follow the subject. For non-overlay properties owned by the subject, descriptor queries preserve values and flags except that `configurable` is reported as `true`, which is the only Proxy-safe description of a property the extensible surrogate does not itself own. For the same reason, defining a property through the carrier is supported only when the descriptor explicitly says `configurable: true`; an omitted or false flag is rejected before the subject is touched. The carrier is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. -`Scoped` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime security, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches. +`Scoped` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime enforcement by itself, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches. These checks detect routing mistakes; they do not confine a hostile in-process plugin. ## Agent creation and teardown An agent's scope, session, registry entry, and driver form one transaction with two ownership edges. The caller context owns the work it requested and receives the only consumer-facing teardown capability; the concrete `AgentLoop` provider is a structural co-owner because the live agent continues to use the provider's injected services. Either edge deactivates the transaction and converges on the same ordered, memoized quiescence boundary. Setup finishes before publication, and publication is synchronous and rollback-covered rather than magically atomic. +The public contract is simple: setup may await while both identities remain absent from their registries; fulfillment publishes the complete agent; disposal removes it again. + +```js +const setupGate = Promise.withResolvers() +const agentId = AgentId('reviewer') +const sessionId = SessionId('reviewer-session') +const creating = ctx.agents.create({ + agentId, + sessionId, + agentOptions: { model: 'model-name' }, + async setup(agentCtx) { + await setupGate.promise + agentCtx.systemPrompt.section({ + name: 'deployment:persona', + order: 0, + text: 'Review the change.', + }) + }, +}) + +ctx.agents.get(agentId) // undefined while setup is pending +ctx.sessions.get(sessionId) // undefined while setup is pending +setupGate.resolve() + +const handle = await creating +ctx.agents.get(agentId) === handle.agent // true after publication +ctx.sessions.get(sessionId) === handle.agent.session // true after publication + +await handle.dispose() +ctx.agents.get(agentId) // undefined after quiescent teardown +ctx.sessions.get(sessionId) // undefined after quiescent teardown +``` + ### Create and resume reserve identities before asynchronous work Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup. @@ -421,7 +664,7 @@ For the concrete AgentLoop transaction, `agent/disposed` runs after the driver i Provider co-ownership is specific to resources that remain structurally dependent on their provider. An AgentLoop-created agent continues to resolve the loop's injected services, so loop unload must stop it. A worker workflow run instead captures its holder-bound `SubagentService` handle synchronously at `start()` and stores that independent dependency on the run; unloading `WorkerWorkflowEngine` removes the ability to start new runs but does not revoke an already returned run or prevent its later worker message from starting a child. The two lifetimes differ by dependency shape, not by a blanket rule that every service must own every value it creates. -Parent-owned subagents use explicit ownership rather than capability inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped capabilities. +Parent-owned subagents use explicit ownership rather than registration inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped registrations. ## Owner-final policy boundaries @@ -475,7 +718,7 @@ The registry materializes `arguments` in one lossless-JSON traversal and deep-fr The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution is identity-stable, not fully immutable, while the pipeline runs: its `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field; an around-dispatch wrapper may add, replace, or remove it. The registry freezes the complete execution before outcome observation. -Stable identity prevents a listener from changing which capability or scope was authorized after policy ran. It also gives commit-style observers a safe `WeakMap` key even when an adapter reuses a model call ID. +Stable identity prevents a listener from changing which tool or scope the pipeline accepted after policy ran. It also gives commit-style observers a safe `WeakMap` key even when an adapter reuses a model call ID. For a nested transport dispatch, `parent` carries only the enclosing execution's opaque token rather than its live object. Code Mode sets an SDK sub-call's `parent` to the outer `run_code` execution's `token`, so an observer can correlate the two outcomes without receiving a reference that could mutate the still-running outer wrapper. @@ -512,6 +755,24 @@ prepareExecution(input): This one-way result makes the boundary monotonic. Pre-execution hooks can still compose ordinary allow, deny, and ask decisions; an ask resolves through the optional `ctx.approval` seam, where only `allowed-once` becomes allow and an absent channel or any non-grant becomes deny before guards run. No listener ordering can convert a guard denial back into dispatched work. A denied call still continues through result transformation and final observation as an error outcome. +The two APIs have deliberately different strength. A waterfall listener may return an allow decision, but the later guard has no corresponding allow result: + +```js +agent.ctx.on( + 'tools/pre-execute', + async () => ({ kind: 'allow' }), + { prepend: true }, +) + +agent.ctx.tools.guard(execution => + execution.name === 'bash' + ? 'reviewer agents are read-only' + : undefined, +) +``` + +Even a later prepended allow listener cannot bypass this guard because the registry evaluates guards after the complete waterfall. + ### `tools/result` observes the authoritative live outcome The complete live pipeline is `tools/pre-execute` → monotonic guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first three named events are transformable waterfalls; `tools/result` is an awaited, observe-only notification after all transforms and the registry's outer error normalization. At each untrusted result boundary, the registry captures every top-level field once and materializes the complete authoritative outcome as detached lossless JSON. Immediately before observation it materializes that owned outcome again and deep-freezes the shared listener snapshot. An invalid tool or listener result becomes a normal JSON-safe `isError` outcome instead of reaching observers as apparent success and failing later at the session log. @@ -520,7 +781,7 @@ Every `tools/result` listener receives the same frozen execution and deep-frozen `tools/result` is not the durable session event `tool/result`. The live notification belongs to the registry and also fires for direct programmatic executions; the agent loop subsequently appends `tool/result` to the session log for replay, UI reconstruction, and model history. A policy that needs the final in-process verdict uses the former, while a consumer that needs persisted transcript state uses the latter. -The entire registry method reads like one authority ladder: +The entire registry method reads like one execution-decision pipeline: ```text execute(input): @@ -575,7 +836,7 @@ Ordinary continuation remains extensible. The loop computes a default, runs the The scoped serial `agent/turn-stop` checkpoint runs after that folding. Its strict serial helper consults listeners in order until one returns a non-`undefined` value; a listener returns `{ action: 'stop' }` or abstains with `undefined`. The dedicated helper exists because ordinary Cordis serial dispatch treats `null` and `false` as framework abstentions, while this public contract has exactly one abstention value. A stop is terminal, so later listeners and pending steering cannot restore continuation. A malformed result, including `null` or `false`, or a throwing policy closes the current turn with an error while leaving the driver available for later work. -Terminal stop deliberately discards steering while preserving ordinary queued prompts. Its terminal state remains in force through `turn/end` and the durability flush, so steering added by continuation, turn-close, or flush listeners cannot escape through the loop's late-steering fallback into another step or turn. This is the explicit exception to the normal rule that leftover steering becomes input for another turn. The authority is reserved for protocols, such as a completed structured child, where further model work would violate the result contract. +Terminal stop deliberately discards steering while preserving ordinary queued prompts. Its terminal state remains in force through `turn/end` and the durability flush, so steering added by continuation, turn-close, or flush listeners cannot escape through the loop's late-steering fallback into another step or turn. This is the explicit exception to the normal rule that leftover steering becomes input for another turn. The stronger terminal control is reserved for protocols, such as a completed structured child, where further model work would violate the result contract. ```text afterSuccessfulStep(turn): @@ -605,13 +866,67 @@ The queued-prompt FIFO is separate and is never drained by terminal stop. In-process subagents demonstrate how the scope, lifecycle, and final-policy pieces compose. A provider builds the child's world during unpublished setup, then lets the ordinary agent lifecycle own it. +The caller-facing seam separates acceptance, readiness, result settlement, cancellation, and disposal. This example assumes the spawn backend is loaded under its configurable default provider name, `spawn`, `parent` is top-level (depth 0), and a global `read` tool has already been registered. A caller observes readiness before treating the child as live and always disposes the run: + +```js +const run = ctx.subagents.start('spawn', { + parent, + prompt: [{ type: 'text', text: 'Review this change.' }], + persona: 'You are a careful code reviewer.', + toolFilter: { allow: ['read'] }, + maxDepth: 2, + outputSchema: { + type: 'object', + properties: { summary: { type: 'string' } }, + required: ['summary'], + additionalProperties: false, + }, +}) + +try { + await run.started + const result = await run.result + // result.structured exists only after a successful committed capture. +} finally { + await run.dispose() +} +``` + ### Inputs and ownership are fixed before asynchronous creation +This section follows a child from provider/request acceptance through the service wrapper and then through the workflow bridge. Each layer captures its boundary before arbitrary asynchronous work and owns the cleanup it may need to start. + +#### Provider and request acceptance own the child boundary + Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider object so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and hot-reload cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key. Starting a run reads every top-level request field once before capability validation, then snapshots every accepted field before asynchronous owner setup. This order makes checked and delegated capabilities identical even for a JavaScript caller with stateful accessors. Fixed scalars are checked at the same boundary: `maxDepth` must be a non-negative safe integer and `persona` must be a string. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached through the one-pass lossless-JSON materializer. The exported in-process driver repeats this boundary for direct callers before it awaits run-owner activation, including taking one seed snapshot from which it derives both the child prefix and `seedLength`. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. -The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. Calling `runOwner.ctx.agents.create()` gives the child factory an explicit `ownerCtx` carrying the run-owner fiber and scope, while the registry's traced factory receiver preserves AgentLoop's injected dependency origin. Parent teardown, provider teardown, and manual run disposal all dispose this same run-owner node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat capability view. +Depth validation is intentionally repeated at every public entry path, while one seam-owned helper keeps the accepted domain identical: + +```text +tool-subagent plugin load: + schema requires natural <= Number.MAX_SAFE_INTEGER + assertSubagentMaxDepth(config.maxDepth) + +SubagentService.start(request): + capture request.maxDepth once + assertSubagentMaxDepth(captured maxDepth) + +startInProcessRun(request): + capture request.maxDepth once + assertSubagentMaxDepth(captured maxDepth) + parentDepth = depthOf(parent) # also a non-negative safe integer + childDepth = parentDepth + 1 + if childDepth is not a safe integer: throw RangeError + if maxDepth is defined and childDepth > maxDepth: throw SubagentDepthError +``` + +The derived-value check is separate from validating either input: `Number.MAX_SAFE_INTEGER` is a valid stored parent depth, but adding one cannot produce a contract-valid child depth. The driver rejects that overflow even when no request-level `maxDepth` cap was supplied. + +The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. Calling `runOwner.ctx.agents.create()` gives the child factory an explicit `ownerCtx` carrying the run-owner fiber and scope, while the registry's traced factory receiver preserves AgentLoop's injected dependency origin. Parent teardown, provider teardown, and manual run disposal all dispose this same run-owner node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat registration view. + +#### The service wrapper orders readiness, results, and lifecycle The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. The wrapper installs its shared disposal promise before invoking the raw provider callback, so synchronous reentry through the returned wrapper and ordinary repeat calls join one provider disposal rather than slipping through a not-yet-assigned memo. If the raw disposer directly returns that same reentrant wrapper promise, the service rejects the cyclic provider contract instead of awaiting a promise that depends on itself forever. @@ -654,7 +969,13 @@ SubagentService.start(...): on fulfillment, emit subagent/start and then buffered or eventual subagent/end on rejection, discard buffered lifecycle telemetry return serviceRun immediately +``` +#### The workflow bridge closes readiness and settlement races + +Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, and sends `ChildStarted` only after `started` fulfills while admission remains open. A readiness rejection is refused and host-disposed; `ChildStartError` is sent while worker-message admission remains open, and an already-retired exact run is not cleaned twice. Provider `start()` is itself arbitrary code and may synchronously reenter workflow cancellation before its returned run reaches that registry. The bridge attaches both promise observers, re-checks terminal admission immediately after `start()` returns and again at readiness, and turns a closed boundary into identity-guarded cancellation, disposal, and refusal rather than late worker admission or lifecycle announcement. An arbitrary provider may still fulfill its own `started` promise after the workflow boundary; the bridge refuses and cleans up that attempt instead of claiming it can undo provider-side publication. + +```text Workflow worker bridge after receiving returnedRun: register the run so cancellation can reach pre-publication work attach result settlement handlers immediately and snapshot the outcome @@ -700,8 +1021,6 @@ Host at physical worker exit: do not repeat explicit child cancellation ``` -Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, and sends `ChildStarted` only after `started` fulfills while admission remains open. A readiness rejection is refused and host-disposed; `ChildStartError` is sent while worker-message admission remains open, and an already-retired exact run is not cleaned twice. Provider `start()` is itself arbitrary code and may synchronously reenter workflow cancellation before its returned run reaches that registry. The bridge attaches both promise observers, re-checks terminal admission immediately after `start()` returns and again at readiness, and turns a closed boundary into identity-guarded cancellation, disposal, and refusal rather than late worker admission or lifecycle announcement. An arbitrary provider may still fulfill its own `started` promise after the workflow boundary; the bridge refuses and cleans up that attempt instead of claiming it can undo provider-side publication. - Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber. If cancellation lands before publication, the factory's liveness check prevents either creation edge. If it begins synchronously inside `session/created`, `agent/created`, or `agent/session-start`, the publication barrier lets the current notification phase unwind without revoking its world, the next liveness check prevents every later phase and driver start, and rollback pairs every creation edge that already began. In either case `started` rejects, no `subagent/start` or `subagent/end` is emitted, and the run result settles as `aborted`. Receipt of the worker's `Result` message is the workflow host's atomic first-wins boundary. The worker queues that message before its own settlement-reap `ChildCancel` messages, so same-port FIFO prevents an internal child callback from masquerading as earlier run cancellation. Each contender records its claim before its own callback fanout: external `cancel()` records its reason first, while Result receipt snapshots any earlier cancellation and claims the resulting terminal outcome before invoking settlement-cleanup provider code. A caller, signal, or dispose cancellation already in flight therefore overrides a non-cancelled worker report, while the report wins otherwise. Before exposing that chosen result, the host drives both permitted child-cancellation channels by aborting the shared request signal and calling every registered run's `cancel()`, including runs still waiting on readiness. Those calls are settlement-only cleanup, and the terminal claim makes a reentrant `WorkerRun.cancel()` a side-effect-free loser rather than merely repairing its result afterward. Host fanout and the worker's FIFO-later `ChildCancel` can both reach the explicit channel, so a per-call gate invokes each provider `cancel()` at most once; the seam does not require that callback to be idempotent. Explicit child cancel callbacks are contained independently so one throwing callback cannot starve peers or alter settlement. @@ -716,7 +1035,26 @@ Parent teardown reaches `runOwner` by nesting; the provider and returned run han A child persona is a scoped `deployment:persona` section that shadows the deployment-wide section. A child tool filter is a scoped restriction over global end capabilities. Omitted filters remain omitted; a materialized empty `allow` list means “allow nothing” and is not confused with absence. -The child's persona, filter, and structured runtime are installed inside factory setup. The common run-owner fiber gives structured-concurrency-style teardown without importing the parent's capability layer into the child. +The child's persona, filter, and structured runtime are installed inside factory setup. Persona and filtering use public registration methods directly. The package-internal structured helper groups the public tool, prompt, protection, guard, and listener registrations that form one terminal protocol: + +```js +let structured +const setup = childCtx => { + if (persona !== undefined) { + childCtx.systemPrompt.section({ + name: 'deployment:persona', + order: 0, + text: persona, + }) + } + if (toolFilter !== undefined) childCtx.tools.restrict(toolFilter) + if (schema !== undefined) { + structured = attachStructuredRuntime(childCtx, schema) + } +} +``` + +The common run-owner fiber gives structured-concurrency-style teardown without importing the parent's registration layer into the child. The filter affects the child's global tool view; it is not a parent-derived authority ceiling. ### Structured output is a child-owned terminal protocol @@ -784,6 +1122,17 @@ Scope mistakes are fail-open if they merely omit a carrier, so the implementatio `agentEvents(context, agent)` couples the dispatch carrier to the agent argument, `assembleContextFor(agent)` couples prompt facts to the scope selector, and `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered the store. These helpers make a mismatched subject harder to express than the correct spelling. +Their essential construction makes the coupling explicit: + +```text +assembleContextFor(agent): + return { agent, scope: agent } + +agentEvents(context, agent): + carrier = scopeTarget(agent, agent) + return dispatcher that always injects agent as the event subject +``` + ### Type markers cover every scoped event declaration Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript therefore rejects a bare subject at typed dispatch sites, including the `subagent/start` and `subagent/end` paths whose scope is the delegating parent. @@ -814,9 +1163,9 @@ Service isolation chooses one registry instance for a context, while agent compo Isolation remains appropriate for independent applications. It is too coarse for collaborating agents inside one deployment. -### Inherit the parent's scope into a child +### Inherit the parent's registrations into a child -Hierarchical capability inheritance makes lifetime convenient but silently grants every child the parent's scoped tools and policies. A flat view plus an explicit parent-owned disposer separates the two questions: the parent owns the child without conferring its authority. +Hierarchical registration inheritance makes lifetime convenient but silently copies every parent-scoped tool and policy into each child. A flat view plus an explicit parent-owned disposer separates lifetime from registration composition: the parent owns the child without importing the parent's layer. As the [security non-goal](#security-and-authority-are-explicit-non-goals) states, flat lookup does not by itself impose a child-within-parent authority relationship. ### Publish the agent before running setup @@ -832,7 +1181,7 @@ Awaited setup makes the transaction explicit and keeps the first assembly behind ### Enforce invariants with prepended waterfall listeners -A prepended listener is not necessarily outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace the result after delegation. The same issue appears in prompt assembly, tool authorization, result commit, and turn continuation. +A prepended listener is not necessarily outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace the result after delegation. The same issue appears in prompt assembly, tool decisions, result commit, and turn continuation. The owner-final APIs express the actual strength required by each rule: restore named canonical data, deny monotonically, observe the immutable final outcome, or stop after all ordinary continuation inputs are folded. @@ -861,16 +1210,16 @@ The main benefit is one composition model across data, behavior, and lifetime: r ### Costs and constraints -The costs are concentrated in dispatch discipline, per-scope registry state, and explicit authority boundaries that are intentionally stronger than ordinary middleware. +The costs are concentrated in dispatch discipline, per-scope registry state, and owner-final decision boundaries that are intentionally stronger than ordinary middleware. - Every scoped event dispatcher must carry the correct receiver; fused helpers, type markers, invariants, and gates exist because omission would otherwise deliver only to global listeners. -- `agent.ctx` is capability-bearing. Its available services come from the agent loop's injected context, so holders receive that deliberate service surface. +- `agent.ctx` is service-bearing. Its available services come from the agent loop's injected context, so holders receive that deliberate dependency surface; this is not confinement. - Registries maintain per-scope maps and perform a global-plus-one-layer merge for the agent lifetime. - The dispatch carrier is proxy-shaped and not identity-equal to its subject, even though method calls and property access behave like the subject. Its composed filter is frozen, and defining a property through the carrier requires an explicitly configurable descriptor because the extensible surrogate cannot truthfully expose a new non-configurable subject property. -- Flat scopes do not inherit parent capabilities; a desired child capability must be global or explicitly registered for the child. +- Flat scopes do not inherit parent registrations; a desired child-local contribution must be global or explicitly registered for the child. - `run_code` is protected transport infrastructure rather than a filterable end capability, so a policy that must forbid programs denies execution at the tool-policy layer instead of removing the transport from a Code Mode prompt. - Prompt protection restores named canonical contributions and their anchor placement, not the entire assembly; unprotected output remains extensible, while a globally protected section name is deliberately unavailable for scoped shadowing. -- Terminal turn stopping has authority to discard pending steering. That power is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy. +- Terminal turn stopping can discard pending steering. That control is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy. - Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The direct no-setup `ctx.agentLoop.create()` path, used by configuration and programmatic callers that already have complete options, remains synchronous. - A programmatic agent is caller-owned but also structurally owned by its concrete AgentLoop provider. Reloading that provider tears the agent down even if a consumer still holds its handle, because the handle cannot keep the provider's dependency surface valid. - Ordered composition requires exact raw effect identities plus shared public quiescence promises; the dual surfaces and lifecycle-long owner sentinels reflect distinct Cordis nesting and repeated-caller requirements. @@ -878,3 +1227,5 @@ The costs are concentrated in dispatch discipline, per-scope registry state, and ### Deliberate boundaries The scope primitive is generic, but this decision applies it only where one agent needs a coherent registration view: tools, prompt state, scoped events, sessions, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and other registries retain their existing seams until their own designs explicitly adopt the context rule. + +Security hardening remains separate design work; the [security and authority non-goals](#security-and-authority-are-explicit-non-goals) define this RFC's trust boundary without turning registration scope into an authorization model. diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts index 942ec4efb4..88b89f5d3b 100644 --- a/packages/cordis/tool-cordis/src/api-catalog.ts +++ b/packages/cordis/tool-cordis/src/api-catalog.ts @@ -189,7 +189,7 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ }, { key: 'systemPrompt', - summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative contribution protections; the agent loop calls `assemble(context)` once per step.', + summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contribution protections; the agent loop calls `assemble(context)` once per step.', methods: [ 'section(section: PromptSection): () => Promise | void', 'tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void', diff --git a/packages/core/scope/README.md b/packages/core/scope/README.md index 1813ff5071..06d06ba59e 100644 --- a/packages/core/scope/README.md +++ b/packages/core/scope/README.md @@ -16,6 +16,6 @@ Scoped-context registration primitive. `createScope(ctx, key)` mints a Cordis co ## Design contract -Ownership and visibility derive from ONE fact — which context a registration went through. An explicit `{ scope }` registration parameter could express "visible to X, disposed with Y", which is almost always a bug; the scoped context makes it unrepresentable. Rationale and alternatives: [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md). +Ownership and visibility derive from ONE fact — which context a registration went through. An explicit `{ scope }` registration parameter could express "visible to X, disposed with Y", which is almost always a bug; the scoped context makes it unrepresentable. This is trusted registration and listener routing, not sandboxing or an authority hierarchy: a same-process plugin is not confined, and a child scope need not be a subset of its parent's view. Rationale, alternatives, and the security non-goal: [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals). -Handing out a scoped context hands out the minting plugin's service-resolution capability (resolution walks the minting fiber's dependency chain, not the holder's) — mint scopes from a plugin whose `inject` surface is what scope holders should reach. +Handing out a scoped context hands out the minting plugin's service-resolution surface (resolution walks the minting fiber's dependency chain, not the holder's) — mint it from the plugin whose dependencies the scoped registrations need to resolve. diff --git a/packages/core/scope/src/index.ts b/packages/core/scope/src/index.ts index 158d6d37d8..526dffbb51 100644 --- a/packages/core/scope/src/index.ts +++ b/packages/core/scope/src/index.ts @@ -27,8 +27,8 @@ import { Context as CordisContext } from 'cordis' // Capture the invocation primordials once. A carrier holder can reach the // composed Context.filter function, so neither that function's mutable -// property surface nor a base filter's own `.call` may choose how isolation -// predicates are invoked. +// property surface nor a base filter's own `.call` may choose how listener- +// selection predicates are invoked. const reflectApply = Reflect.apply // eslint-disable-next-line @typescript-eslint/unbound-method const functionCall = Function.prototype.call @@ -131,7 +131,7 @@ function scope(): void {} * Service resolution through the scoped context flows through the minting * plugin's dependency chain (the fiber walk), regardless of what the eventual * holder's own fiber injected — handing out the scoped context hands out that - * capability; see `Agent.ctx` in `@deepseek-ai/dsh-agent` for the harness's + * dependency surface; see `Agent.ctx` in `@deepseek-ai/dsh-agent` for the harness's * contract. * @param ctx - the context to mount the scope under; its fiber must be active * (a disposing owner throws Cordis's INACTIVE_EFFECT), and its plugin's @@ -201,7 +201,7 @@ function isConstructable(value: (...args: unknown[]) => unknown): boolean { * compatibility default: plain plugin listeners see every subject), or * - its tag IS `key` (a scoped listener seeing exactly its own subject), * - * AND `base`'s own filter (a Cordis `Service`'s isolation check) also admits + * AND `base`'s own filter (a Cordis `Service`'s listener-filter check) also admits * it. Both the captured base filter and the composed filter are invoked * through captured JavaScript primordials, so mutating either function's * public `.call` property cannot bypass either predicate. Dispatching with @@ -263,7 +263,7 @@ export function scopeTarget(base: T, key: ScopeKey | undefined // construction, a base-target proxy would therefore silently replace the // composed scope predicate with the caller's filter. The surrogate owns the // two immutable overlay slots, so later descriptor changes on `base` cannot - // affect isolation. It shares the base prototype and delegates ordinary + // affect listener selection. It shares the base prototype and delegates ordinary // reads/writes/keys to preserve the supported transparent shape. Callable // targets use native bound built-ins so V8 contributes no user-code surface; // the chosen built-in matches whether `base` has [[Construct]], and the traps diff --git a/packages/core/system-prompt/README.md b/packages/core/system-prompt/README.md index dd395b3f88..06d735e271 100644 --- a/packages/core/system-prompt/README.md +++ b/packages/core/system-prompt/README.md @@ -1,6 +1,6 @@ # dsh-system-prompt -System prompt assembly registry. Plugins contribute ordered text sections, tool-schema providers, named prompt variables, and authoritative named protections; the agent loop calls `assemble(context)` once per step, and `renderPrompt(assembly)` is the full system prompt the model sees. The plugin registers the harness-owned openers itself — the static `harness:identity` section and the deployment's `deployment:persona` section — so they exist for every agent regardless of which loop plugin drives it. +System prompt assembly registry. Plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final named protections; the agent loop calls `assemble(context)` once per step, and `renderPrompt(assembly)` is the full system prompt the model sees. The plugin registers the harness-owned openers itself — the static `harness:identity` section and the deployment's `deployment:persona` section — so they exist for every agent regardless of which loop plugin drives it. ## Config @@ -16,7 +16,7 @@ System prompt assembly registry. Plugins contribute ordered text sections, tool- - `ctx.systemPrompt.section(section: PromptSection): () => Promise | void` Contribute a section. The registry reads `name`, `order`, and the text value/callback once, validates their fixed string/finite-number/string-or-function types, and stores only that accepted record; later caller-object mutation cannot rename or reshape it. The layer is the CALLING context's scope: `agent.ctx` contributes to that agent alone, SHADOWING a same-named global section there (the per-agent persona mechanism — a scoped `deployment:persona`). Duplicate names within one layer throw, and a globally protected section name cannot be shadowed. Disposed with the calling fiber. - `ctx.systemPrompt.tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void` Contribute tool schemas, evaluated at each assembly with that assembly's context; a non-function provider rejects before effect storage. `ToolProviderResult` = `{ schemas, knownNames? }`: `schemas` is the post-restriction visible set for `context.scope`; `knownNames` (defaulting to the same captured schemas' names) is the pre-restriction universe `toolOrder` validates against. Assembly reads the result, each schema field, and the optional known-name list once before detaching them, rejects non-string schema names/descriptions or known names, and uses those same accepted strings for validation and the model-visible collection. A provider must not return a schema named `TOOL_ORDER_REST`. Scoped providers are consulted only for their scope's assemblies. Disposed with the calling fiber. - `ctx.systemPrompt.variable(name: string, provider: (context) => string | undefined): () => Promise | void` Contribute a prompt variable, referenced from section text as `{{name}}`. The fixed string name and function provider types reject before effect storage. Scoped variables (via `agent.ctx`) shadow a same-named global for that agent. Duplicate-in-layer or unreferenceable names throw; `undefined` means "no value for this assembly". Disposed with the calling fiber. -- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions authoritative after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is authoritative too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Each optional field and array slot is read once, non-array fields or non-string names reject before effect storage, and the accepted arrays are deduplicated and frozen. Finalization materializes each waterfall-produced entry name once, so a stateful getter cannot evade canonical replacement. Empty protections throw, and disposal removes the protection. +- `ctx.systemPrompt.protect(protection: PromptProtection): () => Promise | void` Make named section/tool contributions owner-final after the assembly waterfall. Protection restores canonical registry/provider presence and definition; restored entries keep canonical order with one another and anchor before their first surviving later unprotected canonical neighbor (or at the end), without undoing listener reordering of unprotected entries. Canonical absence is owner-final too, so a mode-hidden tool cannot be fabricated by a listener. Calling through `agent.ctx` protects only that agent's assemblies. A global section protection additionally reserves its name against scoped shadows; registering either side of that conflict fails loudly instead of treating the shadow as canonical. Each optional field and array slot is read once, non-array fields or non-string names reject before effect storage, and the accepted arrays are deduplicated and frozen. Finalization materializes each waterfall-produced entry name once, so a stateful getter cannot evade canonical replacement. Empty protections throw, and disposal removes the protection. - `ctx.systemPrompt.assemble(context?: AssembleContext): Promise` Assemble the prompt for one caller: the global layer merged with `context.scope`'s layer (scoped shadows global). Provider output becomes one coherent detached snapshot before `toolOrder` validation. Runs through the scope-filtered `system-prompt/assemble` waterfall, then restores protected contributions from the pre-waterfall canonical assembly. Rejects when a configured `toolOrder` names a tool outside the providers' `knownNames` universe (a restricted-away KNOWN tool is a normal absence), or when a provider returns the reserved rest-entry name. ### Live events diff --git a/packages/core/system-prompt/src/index.ts b/packages/core/system-prompt/src/index.ts index b810d07559..40eddc7ba1 100644 --- a/packages/core/system-prompt/src/index.ts +++ b/packages/core/system-prompt/src/index.ts @@ -1,6 +1,6 @@ /** * System prompt assembly registry. Plugins contribute ordered text sections, - * tool schema providers, named prompt variables, and authoritative named + * tool schema providers, named prompt variables, and owner-final named * protections; `assemble(context)` collates them through a waterfall that * runs once per step, restores protected contributions, and `renderPrompt` * interpolates `{{variable}}` references into the final text. @@ -138,9 +138,9 @@ export interface ToolProviderResult { * off the wire in Code Mode). */ export interface PromptProtection { - /** Section names whose canonical registry output is authoritative. */ + /** Section names whose canonical presence and definition are restored after the waterfall. */ sections?: readonly string[] - /** Tool names whose canonical provider output is authoritative. */ + /** Tool names whose canonical presence and definition are restored after the waterfall. */ tools?: readonly string[] } @@ -422,7 +422,7 @@ function interpolate(section: AssembledSection, variables: Record Promise | void { @@ -736,7 +736,7 @@ export class SystemPrompt extends Service { return dispose } - /** Resolve the authoritative names registered for one assembly scope. */ + /** Resolve the owner-final names registered for one assembly scope. */ private protectedNames(scope: ScopeKey | undefined): { sections: Set; tools: Set } { const records = [ ...this.protections, diff --git a/packages/core/tools/README.md b/packages/core/tools/README.md index 74f1ff14c4..39874a41bd 100644 --- a/packages/core/tools/README.md +++ b/packages/core/tools/README.md @@ -16,7 +16,7 @@ tools: ### Public API - `ctx.tools.register(definition: ToolDefinition): () => Promise | void` Register a tool as a frozen snapshot. Every top-level caller field is read once into one coherent acceptance record; `name`/`description` must be strings and `timeoutMs`, when present, must be positive and finite before the snapshot can own them. Parameters are validated and detached by one recursive lossless-JSON traversal, so a stateful getter cannot show one value to a check and another to a prototype-erasing clone. Execute/presentation callbacks are bound once to the original definition as their method receiver, so later caller mutation cannot change the executable definition. The layer is the CALLING context's scope (`dsh-scope`): a plain plugin context registers globally; an agent's `agent.ctx` registers for that agent alone, SHADOWING a same-named global tool there (per-agent tool variants). Duplicate names within one layer throw; non-native modes also reject the reserved `run_code` transport name. Disposed with the calling fiber (= the agent, for scoped registrations). -- `ctx.tools.restrict(filter: ToolRestriction): () => Promise | void` Scoped-only (throws on a plain context): mask the GLOBAL end-capability surface for the calling agent — `allow` keeps only the listed tools, `deny` removes them; multiple restrictions intersect; scoped registrations bypass restriction as explicit grants. The registry reads `allow`/`deny` once, so the values checked for an empty filter and unknown names are exactly the values enforced. The reserved `run_code` transport remains available automatically and cannot be named explicitly. Snapshot-at-registration, loud unknown-name validation, `restrict({})` rejects (the materialized-empty-config trap). +- `ctx.tools.restrict(filter: ToolRestriction): () => Promise | void` Scoped-only (throws on a plain context): mask the GLOBAL end-capability surface for the calling agent — `allow` keeps only the listed tools, `deny` removes them; multiple restrictions intersect; scope-local registrations are merged after the global filter. The registry reads `allow`/`deny` once, so the values checked for an empty filter and unknown names are exactly the values enforced. A deny-list admits a later global tool unless it names that tool; an allow-list excludes later names; neither filters a later scope-local registration. The reserved `run_code` transport remains available automatically and cannot be named explicitly. Filter-value snapshot at registration, loud unknown-name validation, `restrict({})` rejects (the materialized-empty-config trap). This is live registration composition, not a parent-derived authority ceiling; see the [agent-scope security non-goal](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals). - `ctx.tools.get(name: string, scope?: ScopeKey): ToolDefinition | undefined` Resolution as one scope sees it (shadowing applied; a restricted-away global reads as absent) — presenters pass the calling agent so the card matches what executed. Returned definitions are the registry's frozen snapshots. - `ctx.tools.visible(scope?: ScopeKey): ToolDefinition[]` The canonical executable view — restricted global layer ∪ the scope's own layer, plus the reserved transport in non-native modes — feeding prompt assembly, `get`, and `execute`, so presentation and dispatch resolve the same frozen definitions. - `ctx.tools.knownNames(scope?: ScopeKey): string[]` The PRE-restriction end-capability name universe `restrict` validates against: a typo fails loud while a restricted-away tool stays a normal absence. Presentation providers add reserved transport names separately when validating `toolOrder`. diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts index d757f6cffa..4dd59efb8c 100644 --- a/packages/core/tools/src/index.ts +++ b/packages/core/tools/src/index.ts @@ -115,8 +115,8 @@ declare module 'cordis' { * set or replace the one mutable field, `exec.signal` (e.g. with a per-call * deadline), BEFORE `next()`, restore/delete it afterward, and inspect the result AFTER. Call identity * (`token`, `callId`, `name`, `arguments`, `agent`, and `parent`) is immutable throughout the - * pipeline so a wrapper cannot change which capability or scope was - * authorized. (Cordis `next()` ignores passed arguments and re-invokes + * pipeline so a wrapper cannot change which tool and scope the pipeline + * accepted. (Cordis `next()` ignores passed arguments and re-invokes * downstream with the shared payload, so a wrapper changes `exec.signal` in * place rather than passing a new object to `next()`.) * Multiple listeners compose by registration order — an outer one wraps the @@ -429,8 +429,11 @@ export interface Config { * {@link ToolRegistry.restrict}. `allow` keeps only the listed global tools; * `deny` removes the listed ones; both present = allow first, then deny. * Restrictions never touch scoped registrations — a tool registered through - * the same scope is an explicit grant that bypasses them (which is what keeps - * e.g. a structured-output capture tool alive under an allow-list). The + * the same scope is merged after the global filter (which is what keeps e.g. a + * structured-output capture tool alive under an allow-list). The filter values + * are snapshotted at registration, but resolution uses the live global registry: + * a later global name passes a deny-only filter unless explicitly denied and + * fails an allow-list unless explicitly allowed. The * reserved `run_code` presentation transport is likewise outside capability * filtering, and naming it explicitly is rejected. Multiple restrictions on * one scope compose by intersection: every one must admit. @@ -705,11 +708,14 @@ export class ToolRegistry extends Service { * this). A non-native mode's reserved `run_code` presentation transport is * not a filterable capability; naming it explicitly throws, while omitting * it from an allow-list cannot remove it. `allow` and `deny` are each read - * once, then the filter is SNAPSHOT at registration: the values checked are - * the values enforced, and later caller mutation of the arrays changes nothing. - * Multiple restrictions compose by intersection. Scoped registrations - * bypass restrictions (explicit grants win). Disposed with the calling - * fiber (revocable independently); emits `tools/change`. + * once, then the filter VALUES are snapshotted at registration: the values + * checked are the values enforced, and later caller mutation of the arrays + * changes nothing. Resolution still uses the live global registry, so a later + * global name passes a deny-only filter unless named and fails an allow-list + * unless named. Multiple restrictions compose by intersection. Scoped + * registrations are merged after restrictions and therefore remain visible. + * Disposed with the calling fiber (revocable independently); emits + * `tools/change`. * @param filter - global-surface mask: `allow` (keep only) and/or `deny` (remove). * @returns the disposer that lifts this restriction. The exact * Cordis effect disposer (single-shot): composite (generator) effects may @@ -863,7 +869,7 @@ export class ToolRegistry extends Service { if (this.admits(scope, name)) result.set(name, definition) } // Scoped layer second: same-name entries REPLACE (shadow) the global ones, - // and grants bypass restrictions by construction (never filtered above). + // and scope-local registrations are never part of the global filter above. for (const [name, definition] of layer ?? []) result.set(name, definition) // Presentation infrastructure is resolved last and outside capability // filtering. Registration rejects this reserved name, so this set is an diff --git a/packages/core/tools/tests/scoped.spec.ts b/packages/core/tools/tests/scoped.spec.ts index ea4ef57ddd..40671ae6fc 100644 --- a/packages/core/tools/tests/scoped.spec.ts +++ b/packages/core/tools/tests/scoped.spec.ts @@ -101,7 +101,7 @@ describe('scoped tool registration', () => { }) describe('restrict()', () => { - it('masks global tools for the scope; grants bypass; assembly and execute agree', async () => { + it('masks global tools, merges scope-local tools afterward, and keeps assembly with execution', async () => { const ctx = await mount() const { scope, key } = await mintAgentScope(ctx, 'a') ctx.tools.register(tool('read')) @@ -109,7 +109,7 @@ describe('restrict()', () => { scope.ctx.tools.register(tool('capture')) scope.ctx.tools.restrict({ allow: ['read'] }) - // The scoped grant survives the allow-list; the unlisted global is gone. + // The scope-local registration survives the allow-list; the unlisted global is gone. expect(ctx.tools.schemas(key).map(t => t.name).sort()).toEqual(['capture', 'read']) expect(await run(ctx, 'bash', key)).toBe('Error: unknown tool "bash"') expect(await run(ctx, 'read', key)).toBe('ran:read') @@ -118,6 +118,29 @@ describe('restrict()', () => { expect(ctx.tools.schemas().map(t => t.name).sort()).toEqual(['bash', 'read']) }) + it('applies snapshotted filters to the live global registry before merging later scope-local tools', async () => { + const ctx = await mount() + const denied = await mintAgentScope(ctx, 'denied') + const allowed = await mintAgentScope(ctx, 'allowed') + ctx.tools.register(tool('read')) + ctx.tools.register(tool('bash')) + denied.scope.ctx.tools.restrict({ deny: ['bash'] }) + allowed.scope.ctx.tools.restrict({ allow: ['read'] }) + + ctx.tools.register(tool('web')) + denied.scope.ctx.tools.register(tool('denied-local')) + allowed.scope.ctx.tools.register(tool('allowed-local')) + + expect(ctx.tools.schemas(denied.key).map(t => t.name).sort()) + .toEqual(['denied-local', 'read', 'web']) + expect(ctx.tools.schemas(allowed.key).map(t => t.name).sort()) + .toEqual(['allowed-local', 'read']) + expect(await run(ctx, 'web', denied.key)).toBe('ran:web') + expect(await run(ctx, 'web', allowed.key)).toBe('Error: unknown tool "web"') + expect(await run(ctx, 'denied-local', denied.key)).toBe('ran:denied-local') + expect(await run(ctx, 'allowed-local', allowed.key)).toBe('ran:allowed-local') + }) + it('composes multiple restrictions by intersection and lifts each independently', async () => { const ctx = await mount() const { scope, key } = await mintAgentScope(ctx, 'a') diff --git a/packages/subagent/subagent-fork/README.md b/packages/subagent/subagent-fork/README.md index 1434601c8e..2aef651839 100644 --- a/packages/subagent/subagent-fork/README.md +++ b/packages/subagent/subagent-fork/README.md @@ -1,6 +1,6 @@ # @deepseek-ai/dsh-subagent-fork -The in-process **fork** subagent backend: a [`SubagentProvider`](../subagent/README.md) that runs each child as a child [`Agent`](../../core/agent) **seeded with a prefix of the parent's session log** — so the child inherits the parent's conversation context instead of starting fresh. Shares the run driver (`startInProcessRun`) with [`dsh-subagent-spawn`](../subagent-spawn/README.md); the only difference is the seed. The shared `run.started` boundary resolves only after the seeded child is published, so `subagent/start` observers see a live registry entry. +The in-process **fork** subagent backend: a [`SubagentProvider`](../subagent/README.md) that runs each child as a child [`Agent`](../../core/agent) **seeded with a prefix of the parent's session log** instead of starting with an empty conversation. The seed affects conversation history only. Tool registrations and restrictions follow the child's fresh flat scope; no parent/child authority relation is defined. Fork shares the run driver (`startInProcessRun`) with [`dsh-subagent-spawn`](../subagent-spawn/README.md); the only difference is the seed. The shared `run.started` boundary resolves only after the seeded child is published, so `subagent/start` observers see a live registry entry. ## The seed boundary (the crux) diff --git a/packages/subagent/subagent-inprocess/README.md b/packages/subagent/subagent-inprocess/README.md index b96cc811ad..0980d85aa9 100644 --- a/packages/subagent/subagent-inprocess/README.md +++ b/packages/subagent/subagent-inprocess/README.md @@ -8,13 +8,15 @@ The shared **in-process subagent run driver**. A library with no provider or imp Runs a child as a child [`Agent`](../../core/agent) on the same cordis context (`ctx.agents`): -1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It rejects a malformed `request.maxDepth`, validates the parent's `subagentDepth`, computes child depth = `depthOf(parent) + 1`, rejects cap overflow with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; +1. reads every public request and seed field once before asynchronous owner setup: the parent and signal remain identity capabilities, while tool filter, seed, agent options, output schema, and prompt are each materialized by the shared one-pass lossless-JSON snapshot. It rejects malformed `request.maxDepth` and `persona` values, validates the parent's `subagentDepth`, computes child depth = `depthOf(parent) + 1`, rejects a child depth outside the safe-integer domain with `RangeError`, rejects a defined `maxDepth` cap breach with `SubagentDepthError`, reports an invalid schema as `OutputSchemaError`, and derives both the child prefix and `seedLength` from the same detached seed; 2. first installs provider ownership, then attaches the request abort listener and creates one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves no child or orphaned listener. Async child creation goes through that fiber's `ctx.agents` service with fresh IDs, lineage/seed, inherited model, and an unpublished setup transaction for persona, tool restriction, and structured output. Parent teardown, provider teardown, manual `run.dispose()`, and cancellation before readiness all dispose this exact node, preventing publication after it becomes inactive and sharing the same quiescence boundary. `startInProcessRun` still returns its `SubagentRun` immediately: `run.started` resolves only after `ctx.agents.create()` has published the child and rejects when pre-readiness cancellation rolls the transaction back; 3. drives the one-shot: `child.send(prompt)` then `await child.whenIdle()` (ordering matters — `send` enqueues synchronously, so `whenIdle` observes the queued work and resolves on the child's `running → idle` transition, never before the turn starts); there is deliberately NO re-prompt for a structured child that finished cleanly without calling `structured_output` — the shortfall maps to an `error` result for the parent; 4. reads the result, scoped to the child's OWN events (everything at or after `seedLength`, so a seeded child that produced no message of its own never returns the seeded parent's last message): the last `assistant/message` content (deep-cloned — the log is frozen) and the last `turn/end.reason` mapped to a `SubagentStopReason`. A structured run surfaces the captured value as `result.structured`; a structured child that finished cleanly WITHOUT ever capturing settles `error` (a clean finish without the demanded result is a failure, not a success with a missing field). `SubagentService` waits for `run.started` before emitting `subagent/start`, so a synchronous start observer can resolve the published child with `ctx.agents.get(run.id)`; the result driver awaits the same boundary before sending the prompt. An attempt that never publishes rejects readiness and emits no false start/end pair; its result reports a deliberate cancel/dispose as `aborted` and propagates an infrastructure fault. `dispose()` awaits creation or rollback and then delegates to `AgentHandle.dispose()` (stop and drain → remove agent → detach session → unwind scope). Before readiness, `cancel()` deactivates the creation owner: before creation notification begins, no agent/session lifecycle edge escapes; if cancellation is triggered synchronously by a creation observer, every begun edge is paired by rollback and the driver never unlocks or starts. After readiness, cancellation reaches the live child immediately. Either path records the cancellation, so a cancel landing before any `turn/end` settles `aborted`, honoring the cancel contract rather than the generic no-turn `error`. +The child receives a fresh flat registration scope. Its `toolFilter` masks the live global tool layer and scope-local registrations are merged afterward; parent ownership does not import the parent's tool restrictions or establish an authority subset. The [agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals) owns that explicit non-goal. + ### `InProcessRunOptions` `{ seed?: SessionEvent[] }` — the optional child-session seed: absent for spawn, or the parent's balanced completed-turn prefix for fork. @@ -32,8 +34,8 @@ Runs a child as a child [`Agent`](../../core/agent) on the same cordis context ( ### `depthOf(agent): number` -Delegation depth rides on a merge-extensible `AgentOptions.subagentDepth` field (0 for a top-level agent, parent + 1 for a child), so a nested spawn reads its parent's depth from `parent.options.subagentDepth`. `depthOf` reads it (absent ⇒ 0). +Delegation depth rides on a merge-extensible `AgentOptions.subagentDepth` field (0 for a top-level agent, parent + 1 for a child), so a nested spawn reads its parent's depth from `parent.options.subagentDepth`. `depthOf` treats only `undefined` as absent (top-level depth 0) and rejects every malformed present value instead of letting it disable the cap comparison. ### `SubagentDepthError` -Thrown by `startInProcessRun` when a spawn would exceed the request's `maxDepth` cap; carries `attemptedDepth` and `maxDepth`. +Thrown by `startInProcessRun` when a spawn would exceed the request's defined `maxDepth` cap; carries `attemptedDepth` and `maxDepth`. A valid parent at `Number.MAX_SAFE_INTEGER` instead produces `RangeError`, because its child depth cannot be represented within the stored safe-integer domain even when `maxDepth` is omitted. diff --git a/packages/subagent/subagent-inprocess/src/index.ts b/packages/subagent/subagent-inprocess/src/index.ts index e0ad53c486..3ccb08fda9 100644 --- a/packages/subagent/subagent-inprocess/src/index.ts +++ b/packages/subagent/subagent-inprocess/src/index.ts @@ -58,7 +58,8 @@ declare module '@deepseek-ai/dsh-agent' { * @returns 0 for a top-level agent, its parent's depth + 1 for a subagent. */ export function depthOf(agent: Agent): number { - const depth = agent.options.subagentDepth ?? 0 + const depth = agent.options.subagentDepth + if (depth === undefined) return 0 if (!Number.isSafeInteger(depth) || depth < 0 || Object.is(depth, -0)) { throw new TypeError('agent subagentDepth must be a non-negative safe integer') } @@ -123,7 +124,8 @@ async function quiesceFiber(fiber: Fiber): Promise { * resolves `aborted`. * * Throws {@link SubagentDepthError} before creating anything when the child's - * depth (parent depth + 1) would exceed `request.maxDepth`. + * depth (parent depth + 1) would exceed `request.maxDepth`, and throws a + * `RangeError` when a valid parent depth has no safe-integer successor. * @param ctx - the provider context that owns the live run as a second * structured-concurrency boundary alongside the parent agent. * @param request - the start request (prompt, parent, signal, per-child options). @@ -147,6 +149,9 @@ export function startInProcessRun( const inputAgentOptions = request.agentOptions const inputSeed = options.seed assertSubagentMaxDepth(inputMaxDepth) + if (persona !== undefined && typeof persona !== 'string') { + throw new TypeError('subagent persona must be a string') + } const toolFilter = inputToolFilter === undefined ? undefined : snapshotJsonValue(inputToolFilter) if (inputToolFilter !== undefined && toolFilter === undefined) { throw new TypeError('subagent tool filter must be losslessly JSON-serializable') @@ -156,6 +161,9 @@ export function startInProcessRun( throw new TypeError('subagent seed must be losslessly JSON-serializable') } const childDepth = depthOf(parent) + 1 + if (!Number.isSafeInteger(childDepth)) { + throw new RangeError('subagent child depth exceeds the safe-integer range') + } if (inputMaxDepth !== undefined && childDepth > inputMaxDepth) { throw new SubagentDepthError(childDepth, inputMaxDepth) } diff --git a/packages/subagent/subagent-inprocess/tests/structured.spec.ts b/packages/subagent/subagent-inprocess/tests/structured.spec.ts index 1e63617154..54ac968f4b 100644 --- a/packages/subagent/subagent-inprocess/tests/structured.spec.ts +++ b/packages/subagent/subagent-inprocess/tests/structured.spec.ts @@ -36,7 +36,7 @@ const SCHEMA: StructuredOutputSchema = { } /** - * Real loop + scripted mock model + an INLINE spawn-shaped provider over the + * Real loop + scripted mock model + an INLINE fresh-conversation provider over the * shared driver. The concrete backend plugins are deliberately NOT loaded — * they would devDep-cycle this package (spawn/fork already depend on the * driver), and the runtime under test is the driver's; plugin-level structured diff --git a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts index db37c974b3..8f710237ab 100644 --- a/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts +++ b/packages/subagent/subagent-inprocess/tests/subagent-inprocess.spec.ts @@ -48,6 +48,7 @@ describe('depthOf', () => { }) it.each([ + { label: 'null', value: null as unknown as number }, { label: 'a string', value: '1' as unknown as number }, { label: 'NaN', value: Number.NaN }, { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, @@ -64,6 +65,7 @@ describe('depthOf', () => { describe('startInProcessRun', () => { it.each([ + { label: 'null', value: null as unknown as number }, { label: 'a string', value: '1' as unknown as number }, { label: 'NaN', value: Number.NaN }, { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, @@ -81,6 +83,27 @@ describe('startInProcessRun', () => { }, {})).toThrow('subagent maxDepth must be a non-negative safe integer') }) + it('rejects a non-string persona before acquiring run ownership', async () => { + const { ctx, parent } = await setup([]) + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'must never start' }], + parent, + persona: 42 as unknown as string, + }, {})).toThrow('subagent persona must be a string') + }) + + it('rejects a child depth with no safe-integer representation before acquiring run ownership', async () => { + const { ctx } = await setup([]) + const parent = { + options: { subagentDepth: Number.MAX_SAFE_INTEGER }, + } as unknown as Agent + + expect(() => startInProcessRun(ctx, { + prompt: [{ type: 'text', text: 'must never start' }], + parent, + }, {})).toThrow(RangeError) + }) + it('rejects a non-JSON prompt before acquiring any run ownership', async () => { const { ctx, parent } = await setup([]) expect(() => startInProcessRun(ctx, { diff --git a/packages/subagent/subagent/README.md b/packages/subagent/subagent/README.md index e98d8cd8de..6470b64ee5 100644 --- a/packages/subagent/subagent/README.md +++ b/packages/subagent/subagent/README.md @@ -29,7 +29,7 @@ Unlike the bash seam (one executor per context, second load throws), **multiple - **Start-time features** (`outputSchema`, `depthLimit`, `toolFilter/persona`) are a static `provider.capabilities` descriptor, checked by the service BEFORE a run exists. A request that needs one the provider lacks is **rejected loud** (`UNSUPPORTED_CAPABILITY`), never accepted-then-ignored. - **Runtime features** (steering, resume) are **optional methods** on `SubagentRun` (`sendMessage?`, `resume?`). The method's presence IS the capability; TS narrowing is the discovery mechanism — a consumer cannot call an absent method without narrowing first, so there is no silent degradation path. -Beside `capabilities` sits one DESCRIPTIVE fact: `provider.inheritsParentContext` — whether a child sees the parent conversation (`fork`: true — seeded with the completed-turn prefix; `spawn`/`acp`: false). The service validates that the descriptor is a boolean but does not interpret or enforce its meaning; the model-facing consumer (`dsh-tool-subagent`) derives truthful tool wording from it. +Beside `capabilities` sits one DESCRIPTIVE fact: `provider.inheritsParentContext` — whether a child sees the parent conversation (`fork`: true — seeded with the completed-turn prefix; `spawn`/`acp`: false). “Context” here means conversation history only; it says nothing about tool registrations, injected services, or authority inheritance. The service validates that the descriptor is a boolean but does not interpret or enforce its meaning; the model-facing consumer (`dsh-tool-subagent`) derives truthful tool wording from it. ## Run lifecycle diff --git a/packages/subagent/subagent/src/types.ts b/packages/subagent/subagent/src/types.ts index 97efd4661f..42f55b300d 100644 --- a/packages/subagent/subagent/src/types.ts +++ b/packages/subagent/subagent/src/types.ts @@ -69,9 +69,10 @@ export interface SubagentStartRequest { */ outputSchema?: StructuredOutputSchema /** - * Optional recursion cap (max delegation depth below this child). Must be a - * non-negative safe integer. Requires {@link SubagentCapabilities.depthLimit}; - * rejected at start otherwise. + * Optional absolute delegation-depth cap for the child being started: its + * computed depth must be less than or equal to this non-negative safe + * integer. Requires {@link SubagentCapabilities.depthLimit}; rejected at + * start otherwise. */ maxDepth?: number /** @@ -195,13 +196,15 @@ export interface SubagentProvider { /** The start-time features this provider supports (see {@link SubagentCapabilities}). */ readonly capabilities: SubagentCapabilities /** - * The provider's context contract: `true` when a child SEES the parent + * The provider's conversation-history descriptor: `true` when a child SEES the parent * conversation (fork — the child is seeded with the parent's completed-turn * prefix), `false` when it starts fresh (spawn, ACP). A DESCRIPTIVE fact, * not a start-time capability: the service validates nothing against it — * the model-facing consumer (`dsh-tool-subagent`) derives truthful tool * wording from it, so a tool bound to a fork provider stops telling the - * model the child "does not see this conversation". + * model the child "does not see this conversation". This descriptor concerns + * conversation history only; it says nothing about tool registrations, + * injected services, or authority inheritance. */ readonly inheritsParentContext: boolean /** diff --git a/packages/subagent/subagent/tests/service.spec.ts b/packages/subagent/subagent/tests/service.spec.ts index faf4bb00b3..182ee7ac8b 100644 --- a/packages/subagent/subagent/tests/service.spec.ts +++ b/packages/subagent/subagent/tests/service.spec.ts @@ -226,7 +226,7 @@ describe('SubagentService', () => { patch: { capabilities: { ...NO_CAPS, persona: 'yes' } }, message: 'capability "persona" must be a boolean', }, - { label: 'a non-boolean context descriptor', patch: { inheritsParentContext: 'yes' }, message: 'inheritsParentContext must be a boolean' }, + { label: 'a non-boolean conversation-history descriptor', patch: { inheritsParentContext: 'yes' }, message: 'inheritsParentContext must be a boolean' }, { label: 'a non-callable start field', patch: { start: 42 }, message: 'start must be a function' }, ])('rejects a provider registration with $label before entering the registry', async ({ patch, message }) => { const ctx = new Context() @@ -431,6 +431,7 @@ describe('SubagentService', () => { }) it.each([ + { label: 'null', value: null as unknown as number }, { label: 'a string', value: '1' as unknown as number }, { label: 'NaN', value: Number.NaN }, { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, diff --git a/packages/subagent/tool-subagent/README.md b/packages/subagent/tool-subagent/README.md index 9aed426ac0..2163d4c884 100644 --- a/packages/subagent/tool-subagent/README.md +++ b/packages/subagent/tool-subagent/README.md @@ -6,9 +6,9 @@ The model-facing `subagent` tool: delegate a self-contained task to a child agen This plugin binds to **exactly one** provider (`Config.provider`). The model sees only `{ description, prompt }` — there is no provider/type parameter in the schema. To expose more than one transport, load the plugin more than once, each bound to a different provider **and a distinct `toolName`** (the tool registry rejects a duplicate name, so a second load that kept the default `subagent` name would throw). Keeping selection in config (not the schema) is the deliberate split: the *service* holds a multi-provider registry; the *tool* picks one. -## The description states the provider's context contract +## The description states the provider's conversation-history descriptor -The tool description and the `prompt` parameter description are DERIVED from the bound provider's `inheritsParentContext` (`providerWording`): a fresh-context provider (spawn, ACP) gets the standalone-prompt wording ("it does not see this conversation"), an inheriting provider (fork) tells the model the child already sees the conversation's completed turns and its prompt should state only what is new. Because the description is fixed at tool registration, the tool **mirrors the provider's lifecycle** (`subagent/provider-added`/`-removed`): it registers when the bound provider is (or becomes) available and unregisters when the provider goes away — no load-order requirement (the cordis Loader starts sibling entries concurrently, so "listed first" never guaranteed "registered first"), and an HMR reload of the backend re-derives the wording from the fresh provider. While the provider is absent the tool simply does not exist (a `ctx.logger` note records the wait; a typo'd provider name shows up as a tool that never materializes). +The tool description and the `prompt` parameter description are DERIVED from the bound provider's `inheritsParentContext` (`providerWording`): a fresh-conversation provider (spawn, ACP) gets the standalone-prompt wording ("it does not see this conversation"), while fork tells the model the child is seeded with the conversation's completed turns and its prompt should state only what is new. The descriptor concerns conversation history only, not tool or authority inheritance. Because the description is fixed at tool registration, the tool **mirrors the provider's lifecycle** (`subagent/provider-added`/`-removed`): it registers when the bound provider is (or becomes) available and unregisters when the provider goes away — no load-order requirement (the cordis Loader starts sibling plugins concurrently, so "listed first" never guaranteed "registered first"), and an HMR reload of the backend re-derives the wording from the fresh provider. While the provider is absent the tool simply does not exist (a `ctx.logger` note records the wait; a typo'd provider name shows up as a tool that never materializes). | Config key | Meaning | |---|---| @@ -17,7 +17,9 @@ The tool description and the `prompt` parameter description are DERIVED from the | `agentOptions` | Default per-child `{ model? }` applied to every spawned child. | | `persona` | Per-child persona that shadows the deployment persona; requires the provider's `persona` capability. | | `toolFilter` | Per-child `{ allow?, deny? }` restriction over global tools; requires the provider's `toolFilter` capability. | -| `maxDepth` | Maximum delegation depth; a non-negative safe integer validated when this plugin loads. Requires the provider's `depthLimit` capability. | +| `maxDepth` | Maximum absolute delegation-tree depth for every child this tool starts; a non-negative safe integer validated when this plugin loads. Requires the provider's `depthLimit` capability. | + +`toolFilter` uses [`ToolRegistry.restrict()`](../../core/tools/README.md)'s live global-view semantics and is not a parent-derived authority ceiling; see the [agent-scope security non-goal](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals). ## Lifecycle (synchronous collect) diff --git a/packages/subagent/tool-subagent/src/index.ts b/packages/subagent/tool-subagent/src/index.ts index ca7f20d23d..25bd5e3acf 100644 --- a/packages/subagent/tool-subagent/src/index.ts +++ b/packages/subagent/tool-subagent/src/index.ts @@ -11,10 +11,12 @@ * — there is no provider/type parameter in the model-facing schema. The model * sees only `{ description, prompt }`. * - * The tool DESCRIPTION is derived from the bound provider's context contract - * ({@link providerWording}): a fresh-context provider (spawn, ACP) gets the - * standalone-prompt wording, an inheriting provider (fork) tells the model the - * child already sees the conversation's completed turns. The tool MIRRORS the + * The tool DESCRIPTION is derived from the bound provider's conversation-history + * descriptor ({@link providerWording}): a fresh-conversation provider (spawn, + * ACP) gets the standalone-prompt wording, while a seeded-conversation provider + * (fork) tells the model the child already sees the conversation's completed + * turns. This descriptor says nothing about Cordis scope, services, tools, or + * authority. The tool MIRRORS the * provider's lifecycle via `subagent/provider-added`/`-removed` — it registers * when the provider is (or becomes) available and unregisters when the * provider goes away — so no load-order requirement exists and an HMR reload @@ -154,16 +156,19 @@ function stopReasonError(result: SubagentResult): string | undefined { } /** - * Model-facing wording per context contract ({@link SubagentProvider.inheritsParentContext}). + * Model-facing wording from the provider's conversation-history descriptor + * ({@link SubagentProvider.inheritsParentContext}). * A fresh child needs a standalone prompt; a forked child already sees the * conversation's completed turns — telling the model to restate everything * (or, worse, that the child "does not see this conversation") would be false * for a fork. Exported for tests. - * @param inherits - the bound provider's context contract. + * @param inheritsConversation - whether the child's conversation is seeded + * with the parent's completed turns; this says nothing about tool, service, + * scope, or authority inheritance. * @returns the tool `description` and the `prompt` parameter description. */ -export function providerWording(inherits: boolean): { description: string; promptDescription: string } { - if (inherits) { +export function providerWording(inheritsConversation: boolean): { description: string; promptDescription: string } { + if (inheritsConversation) { return { description: 'Delegate a task to a subagent that INHERITS this conversation: a child agent seeded with all ' diff --git a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts index 4e125d24e1..701a4dc667 100644 --- a/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts +++ b/packages/subagent/tool-subagent/tests/tool-subagent.spec.ts @@ -220,7 +220,7 @@ describe('dsh-tool-subagent', () => { await ctx.plugin(SystemPrompt) await ctx.plugin(ToolRegistry) await ctx.plugin(SubagentService) - const backend = await ctx.plugin(mock, { name: 'mock' }) // spawn-shaped (inherits: false) + const backend = await ctx.plugin(mock, { name: 'mock' }) // fresh conversation (descriptor: false) await ctx.plugin(tool, { provider: 'mock' }) expect(ctx.tools.schemas().find(s => s.name === 'subagent')!.description).toContain('does not see this conversation') @@ -228,7 +228,7 @@ describe('dsh-tool-subagent', () => { await backend.dispose() expect(ctx.tools.schemas().some(s => s.name === 'subagent')).toBe(false) - // Backend reloads with a DIFFERENT contract: the wording is re-derived + // Backend reloads with a DIFFERENT conversation-history descriptor: the wording is re-derived // from the fresh provider, not served stale from the first mount. await ctx.plugin(mock, { name: 'mock', inheritsParentContext: true }) expect(ctx.tools.schemas().find(s => s.name === 'subagent')!.description).toContain('INHERITS this conversation') @@ -273,7 +273,7 @@ describe('dsh-tool-subagent', () => { expect(ctx.tools.schemas().some(s => s.name === 'subagent')).toBe(true) }) - it('derives spawn-shaped wording from a fresh-context provider (default mock)', async () => { + it('derives spawn-shaped wording from a fresh-conversation provider (default mock)', async () => { const ctx = await setup({ provider: 'mock' }) const schema = ctx.tools.schemas().find(s => s.name === 'subagent')! expect(schema.description).toContain('does not see this conversation') @@ -281,7 +281,7 @@ describe('dsh-tool-subagent', () => { expect(props['prompt']!.description).toContain('include everything it needs') }) - it('derives fork-shaped wording from an inheriting provider (the description stops lying)', async () => { + it('derives fork-shaped wording from a seeded-conversation provider (the description stops lying)', async () => { const ctx = await setup({ provider: 'mock', toolName: 'subagent' }, { inheritsParentContext: true }) const schema = ctx.tools.schemas().find(s => s.name === 'subagent')! expect(schema.description).toContain('INHERITS this conversation') @@ -494,6 +494,8 @@ describe('dsh-tool-subagent', () => { }) it.each([ + { label: 'null', value: null as unknown as number }, + { label: 'a string', value: '1' as unknown as number }, { label: 'NaN', value: Number.NaN }, { label: 'positive infinity', value: Number.POSITIVE_INFINITY }, { label: 'negative infinity', value: Number.NEGATIVE_INFINITY }, @@ -506,6 +508,16 @@ describe('dsh-tool-subagent', () => { .rejects.toThrow() }) + it('validates maxDepth when apply() is invoked directly without Schemastery', () => { + const ctx = new Context() + expect(() => { + tool.apply(ctx, { + provider: 'unused', + maxDepth: Number.NaN, + }) + }).toThrow('subagent maxDepth must be a non-negative safe integer') + }) + it('a partial toolFilter (deny only) does not materialize an empty allow-list (deny-all trap)', async () => { let seen: { toolFilter?: { allow?: string[]; deny?: string[] } } | undefined const ctx = new Context() diff --git a/packages/support/subagent-mock/README.md b/packages/support/subagent-mock/README.md index af169ed4c2..6114bdf2c9 100644 --- a/packages/support/subagent-mock/README.md +++ b/packages/support/subagent-mock/README.md @@ -14,7 +14,7 @@ Load it as a plugin (functional shape: `name`/`inject`/`Config`/`apply`, no defa | `reply` | `mock subagent reply` | The scripted child's final answer text. | | `stopReason` | `completed` | The stop reason `result` settles with. | | `capabilities` | all `true` | Which start-time capabilities (`outputSchema`/`depthLimit`/`toolFilter`) the provider advertises. | -| `inheritsParentContext` | `false` | The context contract to declare; `true` exercises the fork-shaped tool wording in consumer tests. | +| `inheritsParentContext` | `false` | Conversation-history descriptor: `false` means fresh, while `true` exercises seeded/fork wording. It says nothing about tool, service, scope, or authority inheritance. | | `structured` | `{ reply }` | Structured value surfaced when a request carries an `outputSchema` and the capability is on. | A `cancel()` issued before `result` settles flips the stop reason to `aborted`, so the cancellation path is observable. diff --git a/packages/support/subagent-mock/src/index.ts b/packages/support/subagent-mock/src/index.ts index 715c7451d7..554889db71 100644 --- a/packages/support/subagent-mock/src/index.ts +++ b/packages/support/subagent-mock/src/index.ts @@ -94,9 +94,11 @@ export interface Config { /** Which start-time capabilities to advertise (default: all `true`). */ capabilities?: Partial /** - * The context contract to declare ({@link SubagentProvider.inheritsParentContext}); - * default `false` (spawn-like). Set `true` to exercise the fork-shaped tool - * wording in consumer tests. + * The conversation-history descriptor to declare + * ({@link SubagentProvider.inheritsParentContext}); default `false` (fresh + * conversation). Set `true` to exercise seeded/fork wording in consumer + * tests. This flag says nothing about tool, service, scope, or authority + * inheritance. */ inheritsParentContext?: boolean /** From c6d012109f00a01cd91887159b15e1747f04e30f Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 12:22:19 +0800 Subject: [PATCH 10/21] docs(scope): restructure RFC top-down --- .../2026-07-08-agent-scope-contexts.md | 1522 ++++++++--------- 1 file changed, 734 insertions(+), 788 deletions(-) diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 9162273c72..9707d550f2 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -4,64 +4,41 @@ Status: implemented ## Problem -One application can run many agents that share infrastructure but must not share every capability or policy. A child agent may need a different persona, fewer tools, its own structured-result schema, and listeners that govern only its work, while still using the deployment's model adapters, persistence backend, tool implementations, and user interface. +One application needs to share infrastructure across many agents while giving each agent a coherent local world. Model adapters, persistence, user interfaces, and most tool implementations belong to the deployment; personas, visible tools, live policy, and cleanup often belong to one agent. -This is a composition problem, not an application-isolation or security-confinement problem. Starting a separate service graph for every child would isolate too much; putting every registration in one global graph isolates too little. +This is a composition problem, not an application-isolation problem. A separate service graph per agent duplicates too much shared infrastructure, while one global registration graph lets agent-specific contributions leak across agents. -| Surface | What varies by agent | Failure when it is only global | +| Question | Required behavior | Failure without it | |---|---|---| -| Tools | Available capabilities, a child-only tool, or a scoped replacement for one implementation | The model receives the wrong tool view, or a child-specific tool leaks into every prompt | -| Prompt state | Persona, instructions, variables, and [Code Mode](../feature/2026-06-15-code-mode.md) SDK declarations | Every agent receives the same instructions or runtime facts | -| Live policy | Hooks, execution guards, result observers, and continuation rules | A listener intended for one agent can alter another agent's work | -| Lifetime | Cleanup when the agent fails, is cancelled, is disposed, or loses its owner | Registrations outlive the agent or disappear before its final work settles | +| What participates? | Each operation sees deployment-global contributions plus the contributions for its agent | A child-only tool, prompt, or listener affects unrelated agents | +| When does that world exist? | The complete agent world appears only after setup and remains until work and cleanup reach quiescence | Observers see partial setup, or final work loses its scoped policy | +| Which value is authoritative? | Validation, execution, logging, and observation use the same accepted data | Mutable inputs pass one check and produce different behavior later | +| What may extensions override? | Ordinary middleware stays extensible, while a few protocol invariants finish at owner-controlled boundaries | Listener order removes required prompt state, re-allows denied work, commits a failed result, or forces an extra model step | -Three consistency requirements make the problem deeper than filtering a list. First, the model-visible and executable views must agree: a hidden tool must not remain callable, and an advertised tool must not fail merely because execution used a different registry view. This agreement must also cover Code Mode bindings and UI presentation. - -Second, some rules are invariants rather than cooperative extensions. An ordinary middleware listener may replace a prompt assembly, turn an allow into a deny, rewrite a result, force another model step, or short-circuit listeners registered after it. Structured output therefore cannot rely on being “first” or “last” in an extensible listener chain; the owning service needs a final boundary for rules that later listeners must not undo. - -Third, accepting a value must transfer ownership of the exact value that was checked. TypeScript `readonly` annotations disappear at runtime, callers and providers may expose stateful accessors, and a validation pass followed by a clone reads mutable input twice. Identity fields, schemas, session data, requests, and results therefore need runtime boundaries that capture each caller-owned field once, materialize data once, and expose only owner-controlled snapshots. Otherwise the checked, executed, logged, and observed views can diverge even when scope resolution itself is correct. - -The failure does not require TypeScript or threads. One JavaScript getter is enough to make a two-read boundary validate one name and store another: - -```js -let reads = 0 -const input = { - get name() { - reads += 1 - return reads === 1 ? 'safe_tool' : 'different_tool' - }, -} - -// Wrong: validation and storage observe different values. -validateName(input.name) -storeName(input.name) - -// Right: capture once, then validate and store that capture. -reads = 0 -const acceptedName = input.name -validateName(acceptedName) -storeName(acceptedName) -``` - -The subagent API makes these requirements concrete. Two concurrent children can request different personas, tool filters, and output schemas. Those requests are honest only when each child receives an independently owned view and when its terminal-output protocol survives unrelated plugins. +In-process subagents expose all four requirements at once. Two concurrent children can request different personas, tool filters, and structured-result schemas; each child must receive its own complete view, publish only after that view exists, preserve the exact accepted request, and keep terminal structured-output rules stronger than unrelated middleware. ## Decision -Each live agent owns a registration context named `agent.ctx`, and services expose narrow owner-final policy boundaries where ordinary middleware ordering is not strong enough. Together these choices make one agent's registration view composable with normal plugin APIs while keeping visibility, observation, and cleanup aligned. +Every live agent owns one flat registration layer through `agent.ctx`. Four matching rules make that layer coherent: registration and dispatch select the agent view, lifecycle publishes and revokes the view transactionally, acceptance transfers caller data into owner-controlled records, and four narrow owner-final checkpoints preserve invariants after extensible middleware. -The design has five parts: - -| Part | Rule | Purpose | +| Governing question | Decision | Guarantee | |---|---|---| -| Registration scope | A registration through a plain plugin context is global; the same registration through `agent.ctx` belongs to that agent | Reuse existing APIs for per-agent tools, prompt state, and listeners | -| Lifecycle transaction | Caller and factory ownership cover create and resume from reservation or load through scoped setup, ordered publication, and teardown | No observer sees a partially composed agent, and caller or provider loss cannot orphan work | -| Lifecycle foundation | Effects become owner-visible before setup, child fibers become parent-owned before publication, and unloading fibers reject late effects | Reentrant HMR cannot strand a half-built or cleanup-time registration outside the unload snapshot | -| Owner-final policy | Prompt protection, tool guards, final tool-result observation, and terminal turn stopping run at service-owned boundaries | Invariants do not depend on listener registration order | -| Boundary ownership | Services capture fixed fields once, materialize lossless-JSON data once, and publish owner-controlled views | Validation, execution, persistence, and telemetry cannot observe different values from one call | +| What participates? | Resolve deployment globals plus exactly one agent layer; route scoped events by the operation's real agent | Data and behavior use the same flat agent view | +| When does it exist? | Treat scope, session, registry entry, and driver as one caller- and agent-factory-owned transaction | Setup is unpublished; teardown drains before revocation | +| Which value is authoritative? | Read caller-owned fields once, validate that capture, and retain only owner-controlled identities or snapshots | Checked, executed, logged, and observed values cannot diverge | +| What may extensions override? | Keep waterfalls for cooperation, then place prompt protection, monotonic guards, final result observation, and terminal turn stopping at service-owned boundaries | Extension ordering cannot undo protocol invariants | -### One public call shows the composition model +The scope is deliberately flat. An agent resolves deployment-global registrations plus its own registrations; it never traverses parent or sibling scopes. Parent ownership links lifetimes without importing the parent's registration layer. -The common case uses ordinary registration APIs through the setup context. Code blocks in this RFC are focused examples and start from a fresh initialized application unless one explicitly continues another. Here `ctx` is a plugin's service context, `setup(agentCtx)` receives the unpublished agent's scoped context, and helpers such as `AgentId`, `SessionId`, and `CallId` construct opaque IDs. Assume the deployment already registered global `read` and `bash` tools; this creates a reviewer whose persona, global-tool filter, and extra reporting tool exist only for that agent and disappear with its handle: +This is a composition boundary, not an authority boundary. Agent scopes compose trusted in-process registrations; they do not sandbox plugins or define a parent-to-child authority lattice. A plugin holding a Cordis context runs in the same process and can call the services injected into that context. Scope selection answers which registered contribution participates and who cleans it up, not whether a child can do no more than its parent. + +The detailed consequences for tool filters, future global registrations, and child-local tools appear under [the tool-view contract](#the-tool-view-is-live-and-executable). Security hardening requires a separate authority representation and enforcement boundary. + +### Worked example: one agent-local reviewer + +Agent setup uses ordinary registration methods through `agent.ctx`; the context determines visibility and cleanup together. In these focused examples, `ctx` is a plugin service context, `setup(agentCtx)` receives the unpublished agent's scoped context, and helpers such as `AgentId`, `SessionId`, and `CallId` construct opaque IDs. + +Assume the deployment already registered global `read` and `bash` tools. This creates a reviewer whose persona, filtered global tools, and reporting tool exist only for that agent and disappear with its handle: ```js const reviewSummaryTool = { @@ -92,21 +69,214 @@ const reviewer = handle.agent ctx.tools.get('read', reviewer) // global tool, visible ctx.tools.get('bash', reviewer) // undefined: filtered global tool ctx.tools.get('review_summary') // undefined: not global -ctx.tools.get('review_summary', reviewer) // child-only definition +ctx.tools.get('review_summary', reviewer) // reviewer-only definition await handle.dispose() ctx.tools.get('review_summary', reviewer) // undefined: scope was unwound ``` -The rest of this RFC explains why the short setup above needs scope-aware resolution, unpublished construction, ordered teardown, and owner-final policy. +The remaining sections descend from this contract. -### Security and authority are explicit non-goals +## Reader model: domain terms and Cordis mechanics -Scoped contexts are trusted in-process registration composition, not a sandbox, authorization ledger, or parent-to-child authority lattice. A plugin with a Cordis context executes in the same process and can call the services injected into that context. Scope filtering decides which registered contribution participates in one operation and who cleans it up; it does not prove that a child can do no more than its parent. +Readers need four domain terms and four Cordis mechanics to follow the implementation. Readers already familiar with this codebase and Cordis can skim this section. -#### Flat scopes do not enforce a parent-to-child subset +### Recurring domain terms -Flat lookup makes that boundary visible. Parent lifetime ownership does not cause the child to inherit the parent's restriction, and a child-local registration is merged after the global filter: +Four domain terms keep the rest of the RFC compact. A **Session** is an agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** is the JSON subset that can be copied without changing meaning: primitives, dense arrays, and plain objects; cycles, sparse arrays, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols are rejected. An **end capability** is an actual callable tool implementation, whether the model sees it as a native schema or a Code Mode binding. **Code Mode** gives the model a generated SDK and a reserved `run_code` transport instead of advertising every end capability as a native wire tool. + +### Four Cordis mechanics + +Contexts select service access and registration origin, fibers own effects, waterfalls provide cooperative transformation, and dispatch receivers select listeners. + +| Cordis concept | Meaning in this RFC | +|---|---| +| Context | The object through which a plugin reaches services and registers contributions; a derived context can carry a different registration scope | +| Fiber and effect | The runtime owner and one owned piece of setup/cleanup; disposing the fiber unwinds its effects | +| Waterfall | Ordered around-middleware whose listener calls `next()` to include downstream work and may transform or short-circuit the result | +| Dispatch receiver | The `this` object used by Cordis listener filtering; a scope carrier encodes the operation's agent key | + +#### Context selects both service access and registration origin + +A Cordis `Context` is the object through which code calls services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service can recover the context through which it was accessed, so the same method can register globally from a plain plugin context or locally from `agent.ctx` without adding an `agent` option to every registration API. Cordis implements contextual service access with a **traced receiver**: a proxy that carries the accessing context while forwarding calls to the concrete service object. + +```js +ctx.tools.register(globalTool) +agent.ctx.tools.register(agentOnlyTool) + +ctx.on('tools/result', globalObserver) +agent.ctx.on('tools/result', agentObserver) +``` + +A context also exposes the dependency view injected into the plugin that minted it. `agent.ctx` therefore carries the agent loop's deliberate service surface; it is not an ambient root context or a security boundary. + +#### Effects make cleanup follow ownership + +An effect is setup whose cleanup belongs to a fiber. Tool registration, prompt contribution, event subscription, and an agent scope are effects, so normal disposal, failure, and hot module reload all follow the same ownership graph. + +```js +ctx.effect(() => { + const resource = openResource() + return async () => { + await resource.close() + } +}) +``` + +Cordis also supports generator effects that nest child effects in a chosen teardown order. The lifecycle section explains why construction must become owner-visible before arbitrary callbacks run. + +#### Waterfalls remain cooperative extension points + +A waterfall listener wraps downstream work. Calling `next()` includes the remaining listeners and base implementation; returning directly skips that downstream portion. + +```js +ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { + const downstream = await next() + return { + ...downstream, + sections: [...downstream.sections, extraSection], + } +}) + +ctx.on('system-prompt/assemble', async () => replacementAssembly) +// The direct return skips this listener's downstream/base. An outer listener +// that already awaited next() still resumes around replacementAssembly. +``` + +This flexibility is intentional for ordinary policy, but it cannot express a fact that must remain true after every wrapper and short-circuit. [Owner-final policy](#owner-final-policy-four-narrow-boundaries) adds only the four final checkpoints that need stronger semantics. + +#### Dispatch receivers select scoped listeners + +Cordis filters listeners using the dispatch receiver, the object visible as `this` inside a function-style listener. `dsh-scope` builds a receiver carrying the operation's scope key, allowing global listeners plus listeners registered for that exact key while rejecting other agents' listeners. + +The receiver is live coordination state, not durable session data. For example, `tools/result` is a live final-outcome notification, while `tool/result` is an append-only session event used for replay and model history. + +## Registration and delivery: global plus exactly one agent layer + +One scope key controls both registered data and registered behavior. Reads combine the deployment-global layer with exactly one agent layer, while scoped event dispatch admits global listeners plus the listeners for that same agent. + +Scope keys are opaque objects compared by identity; a live `Agent` is its own registration key. There is no name-based equality or parent traversal. + +### Scope mechanism: context, key, and lifetime + +The registration context selects the layer, the scope primitive binds that layer to cleanup, and the nearest scope tag—not an inherited convenience property—selects the key. + +#### The calling context selects visibility and cleanup + +A contribution made through a plain plugin context is visible to every agent and disposed with that plugin. A contribution made through `agent.ctx` is visible only to that agent and disposed with its scope. + +| Registration origin | Visible to | Disposed with | +|---|---|---| +| Plain plugin context | Every agent | Registering plugin | +| `agent.ctx` | That agent only | Agent scope | + +The table describes ordinary registrations. Cordis listeners alone have an explicit `{ global: true }` bypass: it suppresses contextual filtering, so a listener registered through `agent.ctx` can receive other agents' and subjectless dispatches while its cleanup still belongs to that agent scope. Cross-scope observation must opt into this bypass deliberately. + +Named scoped contributions shadow same-named global contributions. This is how a child persona replaces `deployment:persona` and how one agent can use a different implementation under the same tool name. Duplicate names within one layer still fail loudly. + +```text +resolveLayer(agentA): + visible = copy(global registrations) + visible.overlay(registrations from agentA.ctx) + return visible +``` + +There is no ancestor loop. Resolving for agent A never reads parent or sibling layers. + +#### The scope primitive keeps layer and owner together + +`dsh-scope` exposes only the operations needed to mint a tagged ownership layer, read its key, target dispatch, and reach quiescent cleanup. A separate `{ scope }` option on each registry could express “visible to A, disposed with B”; the scoped context makes that mismatch unrepresentable. + +| Operation | Responsibility | +|---|---| +| `createScope(context, key)` | Mount an ownership fiber and return its tagged context | +| `scopeOf(context)` | Read the nearest inherited scope key | +| `scopeTarget(subject, key)` | Build the receiver for scope-filtered dispatch | +| `Scope.dispose()` | Return one shared idempotent promise that reaches cleanup quiescence | +| `Scope.rawDispose` | Expose the exact Cordis disposer for ordered generator composition | + +`Scope.dispose()` and `rawDispose` serve different callers. Cordis raw disposers are single-shot, so a repeated raw call need not wait for an earlier asynchronous teardown; the public method follows the backing fiber's in-flight cleanup and gives racing callers the same completion promise. Generator lifecycles use `rawDispose` because Cordis recognizes nested ownership by exact disposer identity. + +The primitive has one essential shape: + +```text +createScope(parentContext, key): + fiber = mount no-op plugin under parentContext + scopedContext = derive fiber.context with nearest-scope-tag = key + + rawDispose = fiber's exact disposer + dispose = memoized operation that: + invoke rawDispose if teardown has not started + follow fiber's in-flight cleanup until quiescent + + return { ctx: scopedContext, rawDispose, dispose } +``` + +Derived contexts inherit the nearest tag. Mounting a plugin under `agent.ctx` preserves the agent scope; deliberately creating another scope replaces the tag below it. + +#### `ctx.agent` is an association; `scopeOf()` selects the layer + +`agent.ctx.agent` gives setup code convenient access to the associated agent, but the nearest scope tag remains authoritative for resolution. A nested scope can inherit the ergonomic `agent` property while replacing the registration key. + +```js +const auditKey = {} +const auditScope = createScope(agent.ctx, auditKey) + +auditScope.ctx.agent === agent // true: inherited association +scopeOf(auditScope.ctx) === auditKey // true: nearest registration key + +await auditScope.dispose() +``` + +This separation keeps the generic scope package independent of the agent package. + +### Resolution contracts preserve domain semantics + +The shared scope selects two layers, but each registry retains its own merge rules and must keep presentation, lookup, and execution coherent within the view it owns. + +#### Registries retain domain-specific merge rules + +The shared primitive answers “which layer?” and “who owns cleanup?”; each service still defines how its values combine. Prompt sections, variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive. Tool lookup and execution receive an agent or scope explicitly, while prompt assembly receives an `AssembleContext` whose `scope` selects the layer. + +Calling a read method through `agent.ctx` does not silently choose an agent subject. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global view. Registration origin and operation subject remain explicit, allowing one shared service to act for any agent. + +#### The tool view is live and executable + +Within `ToolRegistry`'s contribution, presentation, lookup, execution, Code Mode bindings, timeouts, inspection, and UI rendering all consume one resolved view. The registry filters the live global layer, overlays scope-local tools, and then adds reserved presentation transport when the configured mode requires it. + +```js +ctx.tools.register(readTool) +ctx.tools.register(bashTool) + +agent.ctx.tools.restrict({ allow: ['read'] }) +agent.ctx.tools.register(reviewSummaryTool) + +ctx.tools.get('read', agent) // visible global definition +ctx.tools.get('bash', agent) // undefined: filtered global definition +ctx.tools.get('review_summary', agent) // visible scope-local definition +ctx.tools.get('review_summary') // undefined: absent globally +``` + +Executing `bash` for this agent follows the same lookup and returns the ordinary unknown-tool error. A hidden global implementation therefore cannot remain callable through a second registry. + +Final prompt assembly remains extensible beyond `ToolRegistry`. A lower-level `systemPrompt.tools()` provider or assembly listener may add an unrelated wire schema; that extension then owns the matching executable behavior and ordering. The one-view guarantee covers the registry-owned schemas, SDK bindings, lookup, execution, and presentation—not arbitrary schemas contributed elsewhere. + +A restriction filters only the global end-capability layer. `allow` keeps named global tools, `deny` removes named global tools, multiple restrictions intersect, and scope-local tools are merged afterward. The filter values are captured when registered, but resolution uses the live global registry: + +Filter presence is explicit: omitting a filter installs no restriction, `restrict({})` rejects as ambiguous, and `allow: []` deliberately hides every global end capability. + +```text +at time 0: + global tools = { read, bash } + deny { bash } view = { read } + allow { read } view = { read } + +after registering global tool web: + deny { bash } view = { read, web } + allow { read } view = { read } +``` + +The flat child relationship follows directly: ```text global tools = { read, bash } @@ -119,291 +289,30 @@ visible(parent) = { read, delegate } visible(child) = { read, bash, deploy } ``` -Through `delegate`, a parent can deliberately start this child and indirectly obtain work performed with `bash` or `deploy`. This RFC neither prevents nor blesses that arrangement; deployments that need a non-escalation guarantee require a separate authority design and enforcement boundary. +Through `delegate`, the parent can ask the child to perform work with `bash` or `deploy`. This is why registration scope is not an authority ceiling. A deployment that needs parent-to-child non-escalation requires a separate authorization model, including authority representation, propagation, and execution checks. -#### Restrictions are live views, not grant snapshots +`run_code` is a reserved presentation transport rather than an end capability. Restrictions cannot remove it, scope-local tools cannot shadow it, and configuration cannot explicitly allow or deny it. In Code Mode the transport remains available while its generated SDK contains only the end capabilities visible to the agent. Without that exception, a filter could leave SDK declarations in the prompt but remove the only invocation path. -Restrictions also resolve against a live global registry rather than an immutable authorization snapshot. A deny-list names removals, while an allow-list names the complete retained global set: +Two similarly named checks use different universes. `ToolRegistry.knownNames()` exposes the pre-restriction end-capability set so a misspelled restriction fails loudly. The system-prompt provider validates `toolOrder` against a mode-specific set: native mode accepts end capabilities, both mode accepts end capabilities plus `run_code`, and code mode accepts only `run_code`. Filtering one agent's view does not turn a valid deployment-wide order into a configuration error. -```text -at time 0: - global tools = { read, bash } - deny { bash } view = { read } - allow { read } view = { read } +### Dispatch contract follows the operation subject -after registering global tool web: - deny { bash } view = { read, web } - allow { read } view = { read } -``` +The operation supplies the scope key, and a carrier composes that key with the subject's existing dispatch behavior. Callers cannot provide an independent routing value that might disagree with the payload. -Scope-local tools are merged after either filter. There is no separate authority-versus-visibility ledger, frozen creation-time grant snapshot, parent-subset rule, future-tool grant API, or generic capability/output/terminal tag system here. `run_code` and `structured_output` have explicit protocol-owned treatment described below; they do not imply a general security taxonomy. Those questions are separate design work rather than hidden promises of scoped contexts. +#### The operation subject selects the listener set -Three domain terms recur below. A **Session** is one agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** means JSON primitives plus dense arrays and plain objects that can be copied without changing meaning; the boundary rejects sparse arrays, cycles, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols instead of coercing or erasing them. **Code Mode** presents the model with a generated software-development-kit interface and a reserved `run_code` transport, rather than advertising every end-capability as a native tool. - -Ownership stays with the component that can enforce each fact. The scope package owns scope tags and carrier construction; each registry owns acceptance snapshots and resolution; the caller owns the programmatic agent lifetime it requested; the concrete agent factory owns identity reservation, setup, publication, and structural invalidation of agents that still depend on it; the session owns accepted history; the tool and subagent services own their pipeline records; and each workflow run captures its holder-bound dependencies and owns its cancellation after the engine returns it. A caller never validates a value that another component later rereads from the caller's mutable object. - -The scope is flat. An agent resolves the deployment-global layer plus its own layer; a child does not inherit registrations from its parent's scope. Parent/child lineage remains explicit session data, and parent-owned disposal links lifetimes without inheriting registrations. - -The core implementation lives in [`dsh-scope`](../../../../packages/core/scope/README.md), [`dsh-agent`](../../../../packages/core/agent/README.md), [`dsh-agent-loop`](../../../../packages/core/agent-loop/README.md), [`dsh-session`](../../../../packages/core/session/README.md), [`dsh-system-prompt`](../../../../packages/core/system-prompt/README.md), and [`dsh-tools`](../../../../packages/core/tools/README.md). The composition example spans [`dsh-subagent`](../../../../packages/subagent/subagent/README.md), [`dsh-subagent-inprocess`](../../../../packages/subagent/subagent-inprocess/README.md), and [`dsh-workflow-workerthread`](../../../../packages/workflow/workflow-workerthread/README.md). The [generated Cordis event catalog](../../../cordis-catalog/events.md) is the exhaustive event-signature reference; this RFC explains why the contracts have their current shape. - -## Background: the small Cordis vocabulary used here - -The design relies on four framework ideas: contexts, effects, waterfall events, and dispatch receivers. This section gives the complete mental model needed for the rest of the RFC; the [Cordis primer](../../../cordis-primer.md) covers the framework more broadly. - -### A context is both a service view and a registration origin - -A Cordis `Context` is the object through which a plugin reaches services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service method can recover the context through which it was accessed, so the service can tell whether a call came from an ordinary plugin context or from an agent's scoped context without adding a `scope` parameter to every registration API. - -A context also carries an injected dependency view. A derived context reaches the services injected into the plugin that created it. Handing out `agent.ctx` therefore hands out the agent loop's injected service surface; it is not an ambient root context or a security confinement boundary. - -Factory delegation uses two contexts whose jobs must remain separate. The registry derives a caller-bound context carrying the fiber and scope from which `ctx.agents.create()` or `resume()` was called and passes it explicitly as `ownerCtx`; those facts identify the fiber and optional parent agent that own the requested lifetime. When the registered factory is itself a Cordis service, the registry also invokes it through a traced receiver, which preserves the factory's own injected dependency origin. A plain object that merely implements the factory methods receives the same explicit `ownerCtx` without depending on Cordis tracing. Conflating these roles would either attach the agent to the factory registrant instead of the caller or make the concrete loop resolve dependencies from the wrong service view. - -The object before a service or event method selects the registration origin. The method itself does not need an extra agent parameter: - -```js -ctx.tools.register(globalTool) -agent.ctx.tools.register(agentOnlyTool) - -ctx.on('tools/result', globalObserver) -agent.ctx.on('tools/result', agentObserver) -``` - -Factory calls preserve caller ownership and factory dependency lookup as separate values: - -```text -callerCtx.agents.create(options) - ownerCtx = context carrying callerCtx's fiber and scope - factoryThis = concrete factory traced through ownerCtx - Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) -``` - -### Effects give registrations an owner - -A Cordis effect is work whose cleanup belongs to a runtime unit called a fiber. Tool registration, prompt contribution, and event subscription are effects, so disposing their fiber unwinds them on normal teardown, failure, or hot reload. - -Ownership must exist before effect setup can call arbitrary code. The vendored Fiber implementation therefore places an effect's cleanup wrapper in the owner list before running its setup body; a reentrant unload sees that in-construction effect and waits for setup plus every cleanup it collected. A child fiber likewise receives its parent-owned disposer before `internal/plugin` announces the child. Teardown delivers that notification with per-observer failure containment so one callback cannot starve peers or interrupt cleanup. Effects remain legal while a fiber is pending or loading, because setup needs them, but a fiber already unloading rejects new effects: its cleanup snapshot has been taken, so accepting another registration would strand it in the old epoch. - -`dsh-scope` mounts a no-op plugin fiber for each scope. The plugin contributes no behavior; its fiber is the ownership bucket for everything registered through the scoped context. - -In its simplest form, an effect is a setup function that returns its cleanup. Cordis also supports generator effects that compose child effects in a chosen order. In either form Cordis records the wrapper before calling setup, so even setup-triggered reentrant teardown can find and await it: - -```js -ctx.effect(() => { - const resource = openResource() - return async () => { - await resource.close() - } -}) -``` - -### A waterfall is ordered around-middleware - -A Cordis waterfall is an extensible middleware chain. A listener calls `next()` to delegate, can inspect or replace the downstream result, and can return without calling `next()` to short-circuit everything inside it. - -This flexibility is useful for cooperative transformations, but registration order is not an invariant boundary. A later plugin can prepend another listener, a wrapper can replace the downstream result after `next()` returns, and a short-circuit can prevent inner listeners from running at all. - -The code shape is ordinary around-middleware. Calling `next()` includes downstream work; returning directly skips that listener's downstream listeners and base implementation: - -```js -ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { - const downstream = await next() - return { - ...downstream, - sections: [...downstream.sections, extraSection], - } -}) - -ctx.on('system-prompt/assemble', async () => replacementAssembly) -// This listener skips its downstream/base. An outer listener that already -// awaited next() still resumes around replacementAssembly. -``` - -### The dispatch receiver selects scoped listeners - -Cordis filters event listeners using the dispatch receiver, the object exposed as `this` inside a function-style listener. `dsh-scope` supplies a receiver carrying the operation's scope key, so the event system can admit global listeners plus listeners registered for that key and reject listeners belonging to other agents. - -This receiver is live coordination state, not a durable session fact. The distinction matters later: `tools/result` is a live final-outcome notification, while the similarly named `tool/result` is an append-only session event stored for replay and model history. - -## Agent-scoped registrations - -An agent scope couples two facts that must not drift apart: who can see a registration and who disposes it. The calling context determines both facts, leaving the domain-specific merge rules to each registry. - -### The resolution model is global plus exactly one scope - -Every scope-aware registry keeps a global layer and per-scope layers. Resolving for agent A combines the global layer with A's layer only; it does not walk A's parent lineage or combine sibling scopes. - -| Registration origin | Visible to | Disposed with | -|---|---|---| -| Plain plugin context | Every agent | The registering plugin | -| `agent.ctx` | That agent only | That agent's scope | - -Named scoped contributions shadow a same-named global contribution. A child persona is therefore a scoped `deployment:persona` section, and a per-agent tool implementation can keep the same model-facing name. Duplicate names within one layer still fail loudly. The deliberate exception is a globally protected prompt-section name, whose owner reserves it against scoped shadowing. - -The plugin-facing mechanism is the same API called through a different context. In language-neutral pseudocode: - -```text -# Deployment-wide contribution -appContext.tools.register(readTool) - -# Contribution visible only to agent A and disposed with A -agentA.ctx.tools.register(childOnlyTool) - -resolveTools(agent A): - visible = copy(globalTools allowed by A's restrictions) - visible.overlay(tools registered through A.ctx) - visible.append(reserved presentation transport, when configured) - return visible -``` - -There is no `for each ancestor` step. Resolving for A never reads the parent or sibling layers. - -The scope key is an opaque object compared by identity. The harness uses the live `Agent` object as its own key, so event payloads, tool executions, and prompt assemblies that already carry the agent can select the correct layer without translating through a string ID that may later be reused. - -### `agent.ctx.agent` is an association, not the scope resolver - -`agent.ctx` carries an own `agent` property for setup code and plugin ergonomics. Contexts derived from it inherit that association, while a plain context reads `undefined`. - -The property is deliberately not treated as the authoritative scope tag. A nested scope can install a nearer scope key while still inheriting the original `ctx.agent` association, so lower-level services resolve layers with `scopeOf(context)`. In normal agent composition the two point at the same live agent; the separation keeps the generic scope primitive independent of the agent package. - -The distinction appears when a plugin deliberately nests another scope: - -```js -const auditKey = {} -const auditScope = createScope(agent.ctx, auditKey) - -auditScope.ctx.agent === agent // true: inherited ergonomic association -scopeOf(auditScope.ctx) === auditKey // true: authoritative nearest scope tag - -await auditScope.dispose() -``` - -### The scope primitive has separate public and composite disposal forms - -`dsh-scope` exposes the minimum operations needed to create a layer, read it, target events, and dispose it. “Quiescent” here means that every asynchronous cleanup registered in the scope has settled and no teardown work remains in flight. - -| Operation | Responsibility | -|---|---| -| `createScope(context, key)` | Mount the ownership fiber and return its tagged derived context | -| `scopeOf(context)` | Read the nearest inherited scope key | -| `scopeTarget(subject, key)` | Build the receiver used for scope-filtered dispatch | -| `Scope.dispose()` | Give ordinary callers an idempotent promise shared by repeat and racing calls until quiescence | -| `Scope.rawDispose` | Expose the exact Cordis disposer so a larger generator lifecycle can nest it at a precise teardown position | - -The two disposal forms solve different framework constraints. Cordis identifies nested effects by disposer-function identity, so an ordered composite lifecycle must yield `rawDispose` exactly. Cordis disposers are also single-shot, so a second raw call may not await the first asynchronous teardown; `Scope.dispose()` follows the backing fiber's in-flight lifecycle and gives all ordinary callers the same quiescence boundary, including a race in which `rawDispose` started first. The test/tooling `ScopeHost.dispose()` extends that shared boundary across its host fiber and every minted child scope. Pre-registration of an effect wrapper solves a different race: it makes the first owner unload see construction in progress without changing this single-shot raw-disposer contract. - -The primitive itself is small. Its essential implementation shape is: - -```text -createScope(parentContext, key): - fiber = mount no-op plugin under parentContext - scopedContext = derive fiber.context with nearest-scope-tag = key - - rawDispose = fiber's exact disposer - dispose = memoized operation that: - invoke rawDispose if it has not started - follow fiber's in-flight teardown until quiescent - - return { ctx: scopedContext, rawDispose, dispose } -``` - -Derived contexts inherit the nearest scope tag. Mounting an ordinary plugin under `agent.ctx` therefore preserves the agent's scope, while deliberately creating another scope replaces the tag for registrations below it. - -### Registry resolution stays domain-specific - -The shared primitive answers “which layer?” and “who owns cleanup?” but does not force every service to merge data the same way. Tools, prompt sections, variables, and tool-schema providers retain rules appropriate to their domains. - -Prompt sections, prompt variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive, but a provider registered through `agent.ctx` participates only in that agent's assemblies. Read operations name the subject explicitly: tool lookup and execution receive an agent or scope, and prompt assembly receives an `AssembleContext` whose `scope` selects the layer. - -Calling a service through `agent.ctx` does not implicitly make every later read agent-scoped. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global layer. This keeps shared services able to operate on behalf of any subject and makes the subject visible at the read or execution call site. - -### Tool registrations are frozen snapshots - -The tool view must not change because a caller kept the object it passed to `register()` or received a definition from `get()` or `visible()`. Registration therefore creates the stored identity once; future changes happen through explicit unregister/register effects. - -Tool parameters cross the model and log boundary, so the registry materializes them with `snapshotJsonValue`: one recursive traversal reads each property once, rejects anything outside lossless JSON, and constructs the detached value that is actually stored. A check followed by `structuredClone` is not equivalent—a getter could return plain JSON to the check and a class instance to the clone, which would erase its prototype and silently accept different data. - -The first-party `defineTool()` helper closes the authoring boundary with the same primitive. It reads every top-level option once, materializes the `SchemaSpec`, and derives an independent wire schema plus all later execute and presentation validation from that accepted snapshot. Without that split, mutating an author-owned spec after definition could make the model call a schema that the tool no longer accepts. - -Registration then reads every top-level definition field exactly once, validates, binds, and stores only those captured values; a stateful `parameters` or callback accessor therefore cannot make the checked definition differ from the executable one. It snapshots the scalar fields, binds each callback once to the original definition as its method receiver, and deep-freezes the stored record. Replacing `definition.execute` after registration therefore has no effect, while a callback can still deliberately read mutable state from its closure or original receiver. `get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached schema projections. - -```text -defineTool(options): - accepted = read each top-level option exactly once - parameterSpec = snapshotLosslessJson(accepted.parameters) - wireParameters = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) - build execute and presentation validators over parameterSpec - -registerTool(context, definition): - accepted = read each top-level definition field exactly once - parameters = snapshotLosslessJson(accepted.parameters) - - stored = deepFreeze({ - accepted name, description, timeout, - parameters, - execute: bind accepted.execute to definition, - presentation callbacks: bind once when present - }) - - layerFor(scopeOf(context)).add(stored.name, stored) -``` - -The reserved Code Mode transport uses the same frozen-definition contract even though it lives outside the ordinary layers. - -### Tool restrictions filter the global view without removing transport - -A tool restriction masks the global end-capability layer for one agent, while tools registered in that agent's own layer are merged afterward. Multiple restrictions intersect, so separately installed filters can only reduce the global part of the view; they do not filter scope-local registrations. - -The restriction reads `allow` and `deny` once, snapshots those exact values, rejects an empty filter, and validates named tools against the pre-restriction capability universe. The same captured arrays are then enforced, so a stateful accessor cannot pass one policy through validation and install another. A restricted-away tool behaves like an unknown tool at execution, avoiding disclosure of a hidden global implementation. - -[Code Mode](../feature/2026-06-15-code-mode.md)'s `run_code` is not an end capability. It is a reserved presentation transport that carries calls to the visible end capabilities, so the registry keeps it outside both global and scoped registration layers: restrictions cannot remove it, a scoped tool cannot shadow it, and configuration cannot explicitly allow or deny it. Without this exception, a restriction could leave the generated SDK in the prompt but remove the only way to invoke it. - -The registry still uses one executable visibility view. It first resolves filtered global capabilities plus scope-local registrations, then appends the reserved transport in non-native modes; registry-owned prompt schemas, lookup, execution, Code Mode SDK bindings, timeout lookup, inspection, and UI presentation all consume that view. - -The public lookup API exposes the exact same resolution used for prompt schemas and execution: - -```js -ctx.tools.register(readTool) -ctx.tools.register(bashTool) - -agent.ctx.tools.restrict({ allow: ['read'] }) -agent.ctx.tools.register(reviewSummaryTool) - -ctx.tools.get('read', agent) // visible global definition -ctx.tools.get('bash', agent) // undefined: filtered global definition -ctx.tools.get('review_summary', agent) // visible scope-local definition -ctx.tools.get('review_summary') // undefined: absent from global view -``` - -Executing `bash` for this agent follows the same lookup and produces the ordinary unknown-tool error; it does not bypass the filter through a separate execution registry. The [security non-goal](#security-and-authority-are-explicit-non-goals) explains why later global registrations and scope-local registrations are not an authorization snapshot. - -The guarantee covers the tool registry's contribution. A plugin can deliberately use the lower-level `systemPrompt.tools()` API or assembly waterfall to add an unrelated wire schema; that plugin owns the matching executable behavior and any ordering it introduces. Owner protection preserves reserved named infrastructure without turning the system-prompt service into a validator for unrelated contributions. - -`knownNames` serves a narrower configuration purpose: it is the pre-restriction end-capability universe used to distinguish a typo from a deliberately hidden tool. The system-prompt provider adds presentation names when validating `toolOrder`: `code` mode accepts only `run_code`, `both` accepts end capabilities plus `run_code`, and a per-agent restriction may remove a known capability from one assembly without turning the deployment's order configuration into an error. - -## Scoped event delivery - -Scoped registration is incomplete unless behavior follows the same boundary. An event about agent A reaches global listeners and A-scoped listeners, never listeners installed for B. - -### Delivery is global plus the matching scope - -The dispatch receiver carries the operation's scope key. Its filter admits an unscoped listener or a listener registered through the matching scoped context, while a subject-less dispatch admits unscoped listeners only. Cordis's explicit `{ global: true }` listener option remains the intentional bypass for infrastructure that must observe every dispatch. - -Registry-membership notifications remain unfiltered. Events such as `tools/change`, `system-prompt/change`, `skill/provider-*`, and `subagent/provider-*` describe shared registry state rather than one agent's activity, so a scoped subscriber still observes those global changes. - -### Each event family derives its key from its real subject - -The operation being described determines the key; callers cannot attach an unrelated scope. Fused helpers and store-owned carriers keep the payload subject and delivery subject together. +An event about agent A ordinarily reaches unscoped listeners and A-scoped listeners, never B-scoped listeners. An agent-less dispatch admits only unscoped listeners. A listener registered with `{ global: true }` is the deliberate Cordis filtering bypass described above. The operation itself supplies the key; callers do not attach an independent scope that could disagree with the payload. | Event family | Scope source | |---|---| -| `agent/*`, including `agent/turn-stop` | The event's agent | +| `agent/*`, including `agent/turn-stop` | Event's agent | | `approval/request` | `ApprovalRequest.agent` | -| `tools/pre-execute`, `tools/execute`, `tools/post-execute`, `tools/result` | `ToolExecution.agent`, or no key for an agent-less call | +| Tool execution events | `ToolExecution.agent`, or no key for an agent-less call | | `system-prompt/assemble` | `AssembleContext.scope` | -| `session/created`, `session/disposed`, `session/event`, `session/flush` | The owner scope captured when the session enters the store | -| `subagent/start`, `subagent/end` | The delegating parent agent | +| Session lifecycle/events | Owner scope captured when the session enters the store | +| `subagent/start`, `subagent/end` | Delegating parent agent | -The observable rule is global plus matching, not global plus every scoped listener. This example drives a real tool execution so routing and notification use the same accepted `agent` subject: +Registry-membership events such as `tools/change`, `system-prompt/change`, and `SubagentProvider` added/removed events remain unfiltered because they describe shared registry state rather than one agent operation. ```js const seen = [] @@ -421,32 +330,15 @@ await ctx.tools.execute({ seen // ['global', 'A'] ``` -Approval requests cross an asynchronous answer boundary, so the service snapshots the accepted record synchronously. It preserves the exact agent and abort-signal identities but copies the scalar fields, captures the agent's session once, and uses that one snapshot for `approval/asked`, scoped dispatch, cancellation, policy, and `approval/decided`. Mutating the caller-owned record after `request()` returns therefore cannot split the audit pair or redirect the question to another agent's listeners. +Fused helpers keep values that must agree together. `agentEvents(context, agent)` uses one agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` sets both prompt facts and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur without the original agent context. -The dispatch rule can be read independently of Cordis internals: +#### The carrier preserves subject behavior -```text -dispatchScoped(subject, scopeKey, event, arguments): - carrier = proxy(subject, tag = scopeKey) +Function-style listeners receive the carrier as `this`, and agent listeners may call subject methods. The carrier is therefore a proxy that selects listeners while reading, writing, and invoking through the real subject. - for listener in listeners(event): - if listener has no scope tag or requests the explicit global bypass: - call listener with this = carrier - else if listener.scopeTag == scopeKey: - call listener with this = carrier - else: - skip listener -``` +The implementation uses a dedicated surrogate proxy target with an immutable composed-filter slot. It combines the subject context's existing `Context.filter` with the scope predicate instead of replacing it. Methods bind to the real subject; callable carriers preserve call and construct shape; descriptor queries normalize configurable flags as required by Proxy invariants; and definitions through the carrier require an explicitly configurable descriptor. Stable built-in references protect the composed filter from accidental `.call` replacement. -The real helpers fuse values that must agree. `agentEvents(context, agent)` uses the same agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` similarly sets both the agent-facing field and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur where the original agent context is no longer available. - -### The carrier behaves like the subject but has distinct identity - -Function-style listeners receive the carrier as `this`, and agent event APIs allow them to call subject methods. The carrier is therefore a JavaScript proxy that reads and writes through to the real subject and binds methods to it. - -Binding matters for classes with JavaScript private fields: a method called with the proxy itself as receiver would fail the runtime private-field identity check. The carrier therefore uses a dedicated surrogate proxy target with its own immutable composed-filter slot, while ordinary property access, writes, own-key visibility, methods, invocation, and construction delegate to the real subject; callable carriers also preserve whether the subject is constructable. - -A minimal JavaScript example shows why method binding is observable rather than a TypeScript detail: +Those mechanics preserve observable JavaScript behavior, including private-field method identity: ```js class Subject { @@ -455,24 +347,32 @@ class Subject { } const subject = new Subject() -new Proxy(subject, {}).increment() // TypeError: proxy lacks Subject's private identity +new Proxy(subject, {}).increment() // TypeError: proxy lacks Subject's private identity const carrier = scopeTarget(subject, subject) -carrier.increment() // works: method is bound to subject -carrier === subject // false: dispatch carrier has distinct identity +carrier.increment() // works: method is bound to subject +carrier === subject // false: carrier has distinct identity ``` -The composed filter is a listener-selection correctness boundary, not an ordinary exposed callback. It invokes a subject's pre-existing filter with stable references to the built-in `Reflect.apply` and `Function.prototype.call` operations, pins its own `.call` to that captured built-in, and freezes the callable. Code holding the subject or carrier therefore cannot accidentally replace either `.call` property and turn the scoped predicate into an always-admit predicate. Keeping the filter on the surrogate also means a filter property pinned on the subject before, during, or after carrier construction cannot trigger a Proxy invariant that silently replaces scope filtering with the subject's raw filter. +Together these constraints keep listener selection correct while preserving the subject behavior listeners expect. -The surrogate must remain extensible so its reported own-key view can follow the subject. For non-overlay properties owned by the subject, descriptor queries preserve values and flags except that `configurable` is reported as `true`, which is the only Proxy-safe description of a property the extensible surrogate does not itself own. For the same reason, defining a property through the carrier is supported only when the descriptor explicitly says `configurable: true`; an omitted or false flag is rejected before the subject is touched. The carrier is intentionally not identity-equal to the subject; event arguments carry the real object whenever identity matters. +The TypeScript-only `Scoped` marker requires a carrier at typed dispatch sites. Runtime marks and development invariants cover JavaScript, casts, and direct Cordis dispatch; they detect routing mistakes but do not confine hostile same-process code. -`Scoped` is a TypeScript-only marker that requires this carrier at declared scoped dispatch sites. It improves authoring but adds no runtime enforcement by itself, so runtime marks and development invariants check the same contract for JavaScript, casts, and hand-written dispatches. These checks detect routing mistakes; they do not confine a hostile in-process plugin. +## Lifecycle: compose privately, publish once, tear down in reverse -## Agent creation and teardown +Scope, session, registry entry, and driver form one transaction with two owners. Request fields are captured first; AgentLoop tracking and both identity reservations precede asynchronous work; the caller owns the prepared lifecycle before setup; publication proceeds in synchronous observable phases; and every teardown path reaches one reverse-order quiescence boundary. -An agent's scope, session, registry entry, and driver form one transaction with two ownership edges. The caller context owns the work it requested and receives the only consumer-facing teardown capability; the concrete `AgentLoop` provider is a structural co-owner because the live agent continues to use the provider's injected services. Either edge deactivates the transaction and converges on the same ordered, memoized quiescence boundary. Setup finishes before publication, and publication is synchronous and rollback-covered rather than magically atomic. +Two services split the public API from the implementation. `AgentRegistry`, reached as `ctx.agents`, stores live agents and is the front door for `create()` and `resume()`. Its registered `AgentFactory` is concretely implemented by `AgentLoop`, which constructs and drives agents using its own injected dependencies. The rest of this section calls that concrete co-owner the **AgentLoop factory**. -The public contract is simple: setup may await while both identities remain absent from their registries; fulfillment publishes the complete agent; disposal removes it again. +| Phase | Public state | Ownership fact | +|---|---|---| +| Reserve | IDs unavailable to competitors | AgentLoop tracking and exact reservations cover the next await | +| Prepare or load | Persistence data is loading, or session, scope, and driver exist privately | Resume's load sentinel covers persistence; the complete caller lifecycle covers setup | +| Setup | `setup(agent.ctx)` may await and register | Neither ID is published | +| Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | +| Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | + +The public lifecycle is simple: ```js const setupGate = Promise.withResolvers() @@ -492,270 +392,333 @@ const creating = ctx.agents.create({ }, }) -ctx.agents.get(agentId) // undefined while setup is pending -ctx.sessions.get(sessionId) // undefined while setup is pending +ctx.agents.get(agentId) // undefined during setup +ctx.sessions.get(sessionId) // undefined during setup setupGate.resolve() const handle = await creating -ctx.agents.get(agentId) === handle.agent // true after publication -ctx.sessions.get(sessionId) === handle.agent.session // true after publication +ctx.agents.get(agentId) === handle.agent +ctx.sessions.get(sessionId) === handle.agent.session await handle.dispose() ctx.agents.get(agentId) // undefined after quiescent teardown ctx.sessions.get(sessionId) // undefined after quiescent teardown ``` -### Create and resume reserve identities before asynchronous work +### Reservations precede awaiting; lifecycle ownership precedes setup -Programmatic create and resume reserve both the agent ID and session ID before work that can await. Create prepares a fresh or seeded session; resume first loads and reconstructs the persisted session. Both paths then construct the agent, mint `agent.ctx`, and install the complete teardown skeleton before awaiting setup. +AgentLoop tracking and exact identity reservations precede the first await. Resume adds a caller sentinel across persistence loading; create and resume both establish the complete caller-owned lifecycle before invoking setup. -The registry treats the factory seam as an untrusted runtime boundary. A TypeScript interface checks source code but does not constrain the JavaScript object received at runtime, which may expose stateful getters. `setFactory()` therefore claims the single factory slot before reading method accessors, canonicalizes an already traced Cordis service to its concrete target, then captures that target plus the `createAgent` and `resume` callback identities once. A getter cannot reenter `setFactory()` and replace the outer factory while it is being accepted, later method replacement cannot redirect calls, and a service proxy cannot accumulate a second trace layer that breaks raw-identity state. On each call, the registry passes a caller-bound context carrying the accessing fiber and scope as `ownerCtx`, retraces the concrete service target exactly once through that context, and invokes the captured callback with both pieces. The explicit argument binds ownership; the traced receiver preserves the factory's dependency origin. +#### The prepared lifecycle is owned before setup callbacks -The factory first captures the requested IDs, setup callback, and caller-owned agent options. Seed events and session metadata take a stricter route than a preliminary clone: cloning can erase an exotic prototype before validation sees it, so the factory reads each reference once and hands it synchronously to the session store's reservation-bound prepare operation. That boundary rejects exotic shells, reads accepted metadata fields once, and recursively materializes each seed record in one pass. Resume applies the same rule to persistence output by capturing the loaded header fields once before reconstruction. The transaction therefore cannot move to different identities, storage routing, or lineage after an asynchronous boundary. +The caller context owns the work it requested and receives the consumer-facing `AgentHandle`. The AgentLoop factory is a structural co-owner because a live agent continues to depend on its injected services. Either owner can deactivate the transaction; both converge on the same lifecycle disposer. -Before setup can observe the new objects, their ownership-bearing public properties become stable runtime data slots rather than TypeScript-only `readonly` promises. The concrete agent pins its ID, accepted options, and session; the factory binds its scope context exactly once. The session pins its ID and detached, deep-frozen header. Registry detach closures likewise close over their accepted map keys instead of rereading public properties during teardown. A JavaScript assignment or stateful accessor therefore cannot split registry lookup, dispatch, persistence, and the driver into different identities. +| Owner mechanism | Covers | Retires when | +|---|---|---| +| Caller lifecycle sentinel | Caller-fiber loss from lifecycle preparation through live lifecycle | Shared lifecycle reaches quiescence | +| Resume load sentinel | Caller-fiber loss across persistence load and lifecycle handoff | Load rollback or the adopted lifecycle reaches quiescence | +| AgentLoop tracker | AgentLoop unload and structural dependency loss | Transaction and lifecycle settle | +| ID reservations | Competing agent/session insertion | Ordered teardown releases both IDs | -The session owns the accepted log as described in [the session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md). Seed and append paths materialize lossless JSON once, validate both the event envelope and the metadata that places message-producing events into derived model history, and deep-freeze the exact accepted event. `session.events` returns a frozen snapshot that never grows later. The store keeps append notification and scope-carrier state in store-owned private tables instead of caller-writable `Session` fields, so outside JavaScript cannot suppress or redirect `session/event` dispatch. +A **sentinel** is an owner-visible effect that follows work whose final disposer is not yet available. It adopts the exact reservation disposers immediately, then follows the complete lifecycle disposer once preparation establishes it. -Reservations prevent two concurrent factory transactions from composing different unpublished objects under the same public identities. Each capability's `release` is its exact Cordis effect disposer. Before asynchronous work, the owning sentinel adopts those functions by identity, removing them from the caller fiber's concurrent sibling list; teardown reaches them only after the transaction's driver, registry entries, session, and scope have quiesced. Explicit release covers pre-lifecycle failure and the ordered final step, while the owning fiber remains the backstop for an abandoned transaction. The concrete factory also tracks the whole create transaction before reservation and session preparation begin, and keeps that structural edge through reservation release. Provider unload first stops the factory from accepting work, then aborts or drains every tracked transaction before its dependency surface disappears. +Cordis must make construction owner-visible before setup can reenter teardown. An effect's cleanup wrapper enters its owner list before its setup body runs, a child fiber receives its parent-owned disposer before Cordis's child-plugin notification (`internal/plugin`) announces it, and a fiber already unloading rejects new effects after taking its cleanup snapshot. Teardown observers are contained independently so one callback cannot starve peers or interrupt cleanup. These are domain-neutral lifecycle rules; `dsh-scope` uses them by mounting a no-op plugin fiber as the ownership bucket for one scope. -The agent registry and session store recognize their own reserved keys: setup code that calls public reserve, prepare, create, register, or bare enter APIs with the same IDs fails. The session capability can prepare exactly one object, and publication succeeds only when both stores receive the factory-held exact capabilities; the session store additionally checks that the capability owns that exact prepared session. This closes the otherwise possible path in which setup publishes a substitute object under an ID that the factory merely tracked in a separate pending set, without letting a vanished owner wedge the ID forever. +#### Caller ownership and factory dependency lookup stay separate -Resume needs an ownership edge before an agent object exists. It reserves the identities, then installs a caller-liveness sentinel that adopts both exact reservation disposers before persistence I/O; a factory-tracked load transaction supplies the provider edge. If either owner wins, resume rejects, waits for the load transaction to settle, and only then releases both reservations; a backend promise that settles later cannot publish. After a successful load, `startOwned` synchronously returns both the complete lifecycle disposer and the asynchronous setup/publication result. Even a preparation failure is represented by a disposer-backed result, so the load sentinel can hand off to a real quiescence boundary instead of mistaking an async function's rejected promise for successful installation. The load tracker remains until the surrounding transaction settles, while the load and caller sentinels remain lifecycle-long followers, so no ownership or ID-release gap opens. Once the shared lifecycle quiesces, each sentinel first disarms its follower and then removes its owner-fiber effect; long-lived callers therefore do not retain completed agents, scopes, or reservation closures. +Factory delegation carries two contexts because ownership and dependency origin are different facts. `ownerCtx` is the caller-bound context whose fiber and optional scope own the requested lifecycle. The factory method receiver is the accepted factory traced through that access so the concrete service retains its own injected dependency view. -The load sentinel changes what it follows at handoff but remains an owner-visible boundary: +```text +callerCtx.agents.create(options) + ownerCtx = context carrying callerCtx's fiber and scope + factoryThis = concrete accepted factory traced through ownerCtx + Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) +``` + +`setFactory()` captures the concrete target and its `createAgent` and `resume` callbacks once. It canonicalizes an already traced service before retracing, avoiding a second proxy layer that would break raw-identity state. Plain factory objects receive the explicit `ownerCtx` without depending on Cordis tracing. + +#### Create and resume reserve identities before awaiting + +Programmatic create and resume reserve both agent and session IDs before any operation can await. Create prepares a new or seeded session; resume loads persisted data while a caller sentinel and AgentLoop load tracker already own the interval in which no `Agent` object exists. + +Reservations are capabilities, not advisory sets. Setup code cannot reserve, prepare, create, register, or enter a substitute under the same IDs. A session reservation prepares at most one exact object, and publication requires the matching factory-held capabilities. A failed or abandoned transaction therefore cannot publish a substitute or wedge an ID indefinitely. + +Resume transfers ownership rather than opening a gap: ```text resume(ownerCtx, request): - snapshot request ids, options, and setup callback - reservations = reserve agentId in AgentRegistry and sessionId in SessionStore - sentinel = ownerCtx.effect( - onDispose => abort and await load settlement before reservation release, - adopt exact reservation disposers) - loadTransaction = factory.track(onDispose => signal deactivated and await settlement) + snapshot request identity, options, and setup callback + reserve agentId and sessionId + install caller sentinel adopting both reservation disposers + track load under AgentLoop - try: - persisted = await firstOf(persistence.load(sessionId), deactivated) - session = reservations.session.prepare(reconstruct persisted data) - - # This synchronous call returns a lifecycle boundary even when preparation fails. - starting = startOwned(ownerCtx, agentId, session, options, reservations, setup) - sentinel.follow(starting.dispose) - return await starting.result - finally: - release directly only if no lifecycle boundary was established - settle and untrack the load transaction + persisted = await firstOf(persistence.load(sessionId), deactivated) + session = sessionReservation.prepare(reconstruct persisted data) + starting = startOwned(ownerCtx, session, reservations, setup) + caller sentinel follows starting.dispose + return await starting.result ``` -If deactivation wins, the load promise may continue inside the backend, but it has no path back to publication. +If deactivation wins, a backend load may still settle internally but has no path back to publication. Preparation failure still returns a rollback-backed lifecycle result, so both owners can wait for actual cleanup instead of mistaking a rejected async result for successful installation. ### Setup composes an unpublished world -The optional `setup(agentCtx)` callback receives the new agent context and may synchronously register contributions or await child-plugin activation. During setup, neither the session nor agent is visible through its global registry, but `agentCtx.agent` exposes the unpublished agent to the code composing it. +`setup(agentCtx)` may register tools, prompt state, restrictions, listeners, protections, or child plugins and may await their activation. The new agent is available as `agentCtx.agent`, but neither agent nor session is visible in its global registry. -Setup may register scoped tools, prompt sections, variables, restrictions, listeners, protections, or child plugins. If it throws or rejects, the scope unwinds without publishing either object, and the reserved IDs become reusable. If either the caller owner or concrete factory unloads during an await, the preinstalled teardown skeleton marks the transaction inactive; late setup completion cannot publish. +The complete rollback skeleton exists before setup runs. If setup throws, rejects, or loses either owner, the scope and prepared resources unwind and the IDs become reusable. After setup settles, a microtask checkpoint and liveness checks let a same-turn owner unload win before publication. -Both structural edges exist before driver preparation or scope minting. The provider uses a tracked placeholder, while the caller gets a lifecycle-long sentinel that adopts the reservation effects and resolves to the same memoized lifecycle disposer. If `internal/plugin` reentrantly unloads either owner while the scope fiber is being constructed, Cordis has already attached the child disposer to its parent and the sentinel waits until preparation publishes either the complete lifecycle or a rollback disposer. A failure halfway through preparation therefore leaves both owners with a quiescence boundary for the prepared driver, minted scope, and reservations. - -The factory checks liveness before invoking arbitrary setup. After setup settles, it yields one microtask checkpoint and checks the lifecycle flag, factory state, caller-fiber state, and the owner context's associated agent state again. Cordis begins owner unload synchronously but may run nested effect disposers in the next microtask; the explicit checks and checkpoint let a same-turn unload win instead of allowing an immediately fulfilled setup to publish an already-doomed agent. - -Setup composes but does not drive. The concrete agent rejects `send`, `steer`, `inject`, and `cancel` until publication reaches the session-start boundary, keeps its inbox in a JavaScript native-private field, and allows only one concrete driver to claim a session. Driver startup is absent from the package surface: the package exports neither its loop/inbox internals nor source subpaths, and only instance-bound controls held by the factory can enable and start the driver. JavaScript or a type cast therefore cannot bypass the lock by calling a public `start()` or writing directly into the queue. These boundaries prevent a turn from opening before lifecycle listeners know the session exists. - -The common create/resume tail makes the unpublished boundary explicit: +Setup composes but cannot drive. `send`, `steer`, `inject`, and `cancel` reject until publication reaches the session-start boundary. The driver lock and inbox use runtime-private state, and only factory-held controls enable and start the loop; JavaScript casts cannot call a public start method or write directly into the queue. ```text startOwned(ownerCtx, snapshot, preparedSession): - try: - world = prepareLifecycle(ownerCtx, snapshot, preparedSession) - # Factory placeholder, lifecycle-long caller sentinel, reservation adoption, - # and complete rollback/teardown skeleton all exist before the first await. - catch preparationError with rollbackBoundary: - return { dispose: rollbackBoundary, - result: await rollbackBoundary then reject original error } + world = prepareLifecycleWithCompleteRollback(ownerCtx, snapshot, preparedSession) result = async: - require world.lifecycleActive + require world active await firstOf(snapshot.setup(world.agent.ctx), world.deactivated) await oneMicrotask() - require world.lifecycleActive - require world.factoryActive - require world.ownerFiberActive - require world.ownerAgentNotDisposed - + require caller, factory, owner fiber, and owner agent still active world.publish(snapshot.source) return handle(world.agent, world.dispose) - catch error: - await world.dispose() - throw error - return { dispose: world.dispose, result } + on any error: + await world.dispose() + rethrow ``` -`setup` can await arbitrary plugin activation, but every exit still passes through the already-installed disposer. +### Publication is ordered, observable, and rollback-covered -### Publication is ordered and rollback-covered - -After setup succeeds, the factory publishes in one synchronous sequence with no `await` between steps. Each registry has already claimed its ID across every caller-code boundary needed to construct a stable entry: the agent registry pins the accepted ID and captures one lifecycle carrier while its claim is held, and the session store holds the same kind of claim while evaluating its filter and carrier. A Proxy trap or filter getter can therefore neither overwrite a reentrant same-ID entry nor create a stale detach capability that later deletes another object. Liveness checkpoints then divide publication into three notification phases, and an outer publication barrier keeps teardown from revoking either registry entry or the scope while one of those phases is on the stack: +Publication is one synchronous sequence with liveness checks between three observable notification phases. Both registry entries exist before the first listener runs, but driving stays locked until immediately before `agent/session-start`. 1. Enter the session store and capture its scope carrier. 2. Enter the agent registry without announcing it. -3. Recheck caller and factory liveness; entering either registry may have evaluated a caller-owned getter that began teardown. +3. Recheck caller and factory liveness. 4. Emit `session/created`. -5. Recheck liveness; if teardown began, skip the agent announcement and roll back. +5. Recheck liveness. 6. Emit `agent/created`. -7. Recheck liveness; if teardown began, keep driving locked and roll back. +7. Recheck liveness. 8. Enable driving. 9. Emit `agent/session-start`. -10. Recheck liveness; if teardown began, roll back without starting the driver. -11. Start the driver loop. - -The implementation keeps publication synchronous and leaves rollback to the surrounding owned transaction: +10. Recheck liveness. +11. Start the driver. ```text publish(world): world.beginSynchronousPublication() try: - world.detachSession = world.agent.ctx.sessions.enter(world.session, world.sessionReservation) - world.detachAgent = app.agents.enter(world.agent, world.agentReservation) - require world.callerAndFactoryActive - app.sessions.announce(world.session) - require world.callerAndFactoryActive - app.agents.announce(world.agent) - require world.callerAndFactoryActive + world.detachSession = sessions.enter(world.session, sessionReservation) + world.detachAgent = agents.enter(world.agent, agentReservation) + require callerAndFactoryActive + sessions.announce(world.session) + require callerAndFactoryActive + agents.announce(world.agent) + require callerAndFactoryActive world.driver.enableDrivingVerbs() emitNonVetoing(agent/session-start) - require world.callerAndFactoryActive + require callerAndFactoryActive world.driver.start() finally: world.endSynchronousPublication() ``` -Both registry entries exist before the first creation listener runs, and setup-installed listeners receive every announcement that publication reaches. Driving opens immediately before `agent/session-start`, so that event remains the first supported place for a listener to inject or queue startup work. A synchronous teardown request from any notification marks the lifecycle inactive immediately, which makes the next checkpoint abort, but actual loop, registry, session, and scope cleanup waits until the current synchronous notification phase and publication call stack unwind. Teardown itself therefore cannot make a later listener that still runs observe a different world; teardown from `session/created` prevents `agent/created`, teardown from `agent/created` prevents session start, and teardown from `agent/session-start` prevents the driver from starting. +#### Creation is paired, not atomic -The sequence is not described as atomic because observers run between its steps. If a `session/created` or `agent/created` listener throws synchronously, the transaction rolls the registry entries and scope back, but effects already performed by an earlier listener cannot be retracted. Each store therefore marks its announcement as begun before invoking creation listeners and rejects a repeat or reentrant announcement before dispatch. Rollback emits `session/disposed` or `agent/disposed` exactly once for every corresponding creation announcement that began, including a partial emit in which an early listener observed creation before a later listener threw. An object entered but never announced has no disposal notification because no observer was told it existed. +Observers run between publication steps, so the sequence is not described as atomic. Effects already performed by an earlier listener cannot be retracted if a later listener throws. Instead, each registry marks a creation announcement as begun before dispatch and emits exactly one matching disposal edge during rollback. An entered object that was never announced has no disposal notification because no observer was told it existed. -Each registry also protects ordering inside its own creation phase. If a listener uses an advanced detach capability while `session/created` or `agent/created` is dispatching, removal and the paired disposal edge are deferred until that dispatch unwinds. The agent's creation and disposal edges reuse the carrier captured before commit instead of rebuilding it from a mutable filter getter. A detach request therefore cannot make a later listener observe `created` after `disposed`, find the just-created entry missing, or trigger disposal while creation is still constructing its receiver. Exact-object guards on both detach paths are the final defense against a stale capability deleting a later same-ID entry. The factory's outer publication barrier is the cross-registry complement: caller or provider teardown cannot remove the other entry or unwind `agent.ctx` while the current phase is still running. +A detach requested during `session/created` or `agent/created` is deferred until that dispatch unwinds. Stable captured carriers and exact-object guards prevent a later listener from observing `disposed` before `created` or a stale detach from deleting a replacement with the same ID. The outer publication barrier likewise prevents caller or AgentLoop teardown from removing the other registry entry or unwinding `agent.ctx` while an announcement remains on the stack. -Creation notification preserves that synchronous veto while also defending against JavaScript's asynchronous callback shape. A listener may return a promise even though the event type returns `void`; the dispatcher does not await it because publication has no asynchronous gap, but it observes and logs a later rejection. Such a rejection is too late to roll back, does not become unhandled, and does not starve the listeners invoked after that callback. +Creation listener synchronous throws remain vetoes. Returned promise rejections are observed and logged but not awaited: publication has no asynchronous gap in which such a result could roll back safely. Disposal notifications and `agent/session-start` are non-vetoing and independently contain both synchronous throws and returned-promise rejections so one listener cannot block cleanup or later observers. -The disposal notifications and `agent/session-start` do not treat return values or listener failures as vetoes. Their dispatchers invoke every listener synchronously and independently; they log and contain both a synchronous throw and a rejection from a returned promise. Completion or rejection of a returned promise is observed but not awaited, so it cannot delay rollback or teardown, veto driver startup, or starve a later listener. The callback's synchronous prefix remains ordinary code: if it holds and disposes a structural ownership edge, the next publication liveness check deliberately aborts startup. +### Teardown stops work before revoking registrations -### Teardown stops work before revoking its world +Every owner path reaches one memoized reverse-order transaction. It marks the lifecycle inactive, waits for an in-progress synchronous publication phase, stops the driver through actual exit and final durability work, detaches the agent and session, unwinds the scope, and releases IDs last. -Every owner path reaches the same memoized reverse order: the consumer handle, caller-fiber disposal, and structural factory-provider unload first deactivate the lifecycle; wait for an in-progress synchronous publication phase; stop the loop and await its actual exit plus every agent-started durability checkpoint; remove the agent from the registry; detach the session; unwind the scope; and only then release both IDs. Final turn events, the turn-ending flush, and any outstanding idle-injection flush therefore settle while the session and scoped listeners are still live, and a replacement cannot reuse either identity while old scoped cleanup remains in flight. +Final turn events, the turn-ending flush, and any outstanding session flush started while the agent was idle therefore run while the session and scoped listeners still exist. `agent/disposed` observes an already quiescent and unregistered concrete agent while its session remains live; `session/disposed` follows after event feed detachment and store removal. Both use the stable carrier captured for their matching creation edge. ```text disposeOwnedAgent(world): mark world inactive await world.synchronousPublicationIfRunning() - await world.stopDriver() # waits for loop exit and all agent-started flushes - world.detachAgent() # leaves registry; emits agent/disposed if announced - world.detachSession() # stops event feed, leaves store; emits session/disposed if announced + await world.stopDriver() # loop exit plus agent-started flushes + world.detachAgent() + world.detachSession() await world.scope.dispose() world.releaseSessionReservation() world.releaseAgentReservation() ``` -The actual Cordis generator yields these disposers in reverse so its last-in-first-out teardown executes in the order shown. +`AgentHandle.dispose()` gives repeated and racing consumers the same completion promise. The lifecycle-long caller sentinel follows that promise even when handle disposal wins first, while the AgentLoop ledger independently stops new transactions and waits for every structurally dependent agent before the service disappears. -For the concrete AgentLoop transaction, `agent/disposed` runs after the driver is quiescent and the agent has left the registry; the session is still live during that notification. The public AgentRegistry alone promises only exact removal, because a custom registered `Agent` owns any stronger driver contract itself. `session/disposed` follows after append notification has been detached and the session has left its store. The scope is still live when each disposal listener is selected and invoked, although returned asynchronous work is observed rather than awaited. Both notifications use the stable scope key and delivery rule captured for their creation partners and occur exactly once only when those creation announcements began. +AgentLoop co-ownership follows dependency shape, not a blanket “creator owns every returned value” rule. An AgentLoop-created agent continues to depend on the loop's services, so AgentLoop unload stops it. -`AgentHandle.dispose()` is memoized so repeated consumer calls await the same full transaction. The lifecycle-long caller sentinel independently follows that memoized promise, so handle-first teardown cannot make a racing caller-fiber unload observe Cordis's inert second raw-disposer call and return early. Once the transaction reaches its final quiescent stage, retirement disarms and removes the sentinel before settling that shared promise. `Scope.dispose()` provides the corresponding shared boundary for direct scope disposal and raw-disposer races. The provider's ownership ledger is internal rather than another public handle: it stops accepting new transactions, invokes every tracked disposer independently, and waits for all of them before the AgentLoop service surface disappears. +## Boundary ownership: accept once and own the accepted value -Provider co-ownership is specific to resources that remain structurally dependent on their provider. An AgentLoop-created agent continues to resolve the loop's injected services, so loop unload must stop it. A worker workflow run instead captures its holder-bound `SubagentService` handle synchronously at `start()` and stores that independent dependency on the run; unloading `WorkerWorkflowEngine` removes the ability to start new runs but does not revoke an already returned run or prevent its later worker message from starting a child. The two lifetimes differ by dependency shape, not by a blanket rule that every service must own every value it creates. +Acceptance-sensitive boundaries that cross asynchronous, reentrant, model-visible, or durable-log code read caller-owned fields once and retain only owner-controlled identities or snapshots. This rule is independent of TypeScript: `readonly` annotations vanish at runtime, and JavaScript accessors can return a different value on every read. -Parent-owned subagents use explicit ownership rather than registration inheritance. The driver creates one run-owner fiber under `parent.ctx` and invokes the child factory through that fiber, so lifecycle ownership exists before setup or publication begins; disposing a parent reaches its descendants even if a delegating tool never reaches its own `finally`. The child still receives a newly minted scope and resolves only global plus child-scoped registrations. - -## Owner-final policy boundaries - -Cooperative waterfalls remain the general extension mechanism, but an invariant belongs after the last transformable point. The design adds four narrow boundaries, each owned by the service that can define what “final” means. - -### Prompt protection restores named canonical contributions - -`systemPrompt.protect({ sections, tools })` declares that selected names must match the canonical registry/provider assembly after the complete `system-prompt/assemble` waterfall. It reads each caller array once before deduplication, so the names checked for an empty protection are the names actually installed. Protections registered globally and for the current scope compose by set union, so callback order cannot weaken them. Protection finalizes a returned assembly rather than recovering from listener failure; if the waterfall throws, assembly still fails. - -For each protected name, the service restores the canonical presence and definition. If the canonical assembly omitted the name, protection removes a listener-fabricated entry; this makes mode-dependent absence enforceable as well as presence. Tool providers receive the same coherence treatment: assembly reads `schemas`, optional `knownNames`, and every schema field once, detaches that record, and uses its captured names for both `toolOrder` validation and the model-visible collection. A stateful provider therefore cannot validate a phantom name while showing a different tool. - -A global section protection also reserves the registry name against scoped shadowing. Registering a scoped section under an already protected global name throws, and adding global protection throws if any scoped shadow already exists. Section registration copies `name`, `order`, and the text value or callback before the check and stores that record, so later mutation of the caller's object cannot rename a safe section into a reserved one. This check must happen before assembly: otherwise the ordinary scoped-over-global merge would make the shadow itself look canonical, leaving post-waterfall restoration with the wrong owner's value. Tool-schema protection does not impose a blanket schema-name reservation because providers are additive and may deliberately contribute unrelated executable schemas. - -Restoration is intentionally not a whole-assembly reset. The service first removes protected names from the waterfall result, then reinserts protected canonical entries in their canonical order immediately before the first surviving later unprotected canonical neighbor, or at the end when no such neighbor survives. Unprotected entries keep the ordering and definitions chosen by the waterfall. This anchor rule preserves the protected contribution's meaningful local placement without claiming that protection restores every global relative position after arbitrary listener reordering. - -Only the restoration inputs are detached before dispatch: the canonical section array when section protection is active and the canonical tool array when tool protection is active. The waterfall receives the original mutable assembly, not a clone, and variables and other merge-extensible fields remain entirely under ordinary waterfall semantics. +The shared shape distinguishes identity-bearing references from data. Agent objects and abort signals are retained by identity after one read. Boundaries whose contract requires lossless JSON—such as session events and subagent payloads—validate and materialize it in one traversal; other boundaries use their own owned representation, such as `structuredClone` for agent options. Scalars and callbacks are captured once, then each boundary applies the validation promised by its API before downstream use. ```text -registerSection(input, scope): - stored = copy(input.name, input.order, input.text) - if scope exists and stored.name is globally protected: - fail before registration - sectionLayer(scope).add(stored) - -assemble(context): - assembly = assemble registries for context.scope - canonicalSections = active section protection ? clone(assembly.sections) : absent - canonicalTools = active tool protection ? clone(assembly.tools) : absent - transformed = await systemPromptAssembleWaterfall(assembly) - - for each protected name in the corresponding canonical array: - remove every transformed entry with that name - if the canonical array contains the name: - if a later unprotected canonical neighbor survived: - insert the canonical entry before that neighbor - else: - append the canonical entry - - return transformed +accept(input): + read every relevant top-level field exactly once + retain identity-bearing references without rereading them + validate acceptance-time fields from those captures + copy or pin data in the representation owned by this boundary + bind accepted callbacks once when method receiver state is intentional + expose only owner-controlled identities, frozen records, or detached results ``` -This algorithm restores a protected entry's definition, presence or absence, and useful local anchor without erasing unrelated listener output. +Capture does not imply uniform eager callback type-checking. Agent `setup` is captured once and any invocation failure enters rollback; a tool guard is likewise captured, and an invalid cast becomes a normalized execution error. The invariant is that later work never rereads caller fields to choose a different value. -Code Mode uses global protection for the `tools:sdk` section and reserved `run_code` schema. Structured output adds scoped protection for its instruction and capture schema. These are named guarantees: unrelated listeners may still contribute unrelated sections or tools. +| Boundary | Identity retained | Data detached or pinned | +|---|---|---| +| Tool and `SubagentProvider` registration | Original callback receiver | Name, flags, schemas, scalar config | +| Agent create/resume | Caller context, setup callback | IDs, options, session metadata and seed | +| Approval request | Agent and abort signal | Tool name, call ID, and reason | +| Tool execution | Agent, signal, registry-minted parent token | Call identity and arguments | +| Session append/load | Session identity | Header and event envelopes | +| Subagent start/result | Parent and signal | Prompt, filters, schema, options, result | -### Tool executions have stable identity +Before agent setup can run, the concrete agent pins its accepted ID, options, and session and binds `ctx` once. Registry detach closures likewise close over their accepted keys instead of rereading mutable public fields. -`ctx.tools.execute(input)` accepts a caller-owned `ToolExecutionInput` and snapshots it into a distinct pipeline-owned `ToolExecution`. It reads `callId` and `name` once and requires each value to be a string before treating the pair as trustworthy correlation identity. A throwing accessor or non-string value rejects before `tools/result`, because even an error result could not carry a valid identity. After that boundary, the registry reads every other top-level caller field once, and any later accessor or validation failure becomes one normalized final error notification built from the already accepted strings and captured optional fields. +A stateful getter shows why validation and ownership must use the same capture: -The registry materializes `arguments` in one lossless-JSON traversal and deep-freezes the result, so parent-token validation, scope routing, policy, dispatch, and final observation receive exactly the value that passed validation. A cloneable but mutable exotic such as `Map` or a class instance is rejected before policy rather than smuggled through an apparently frozen wrapper. +```js +let reads = 0 +const input = { + get name() { + reads += 1 + return reads === 1 ? 'safe_tool' : 'different_tool' + }, +} -The registry assigns each pipeline trip a frozen, property-free `ToolExecutionToken`; callers cannot choose that token. The execution is identity-stable, not fully immutable, while the pipeline runs: its `token`, `callId`, `name`, `agent`, optional opaque `parent` token, and detached `arguments` are non-writable and non-configurable from the first policy listener onward. `signal` is the only operational field; an around-dispatch wrapper may add, replace, or remove it. The registry freezes the complete execution before outcome observation. +// Wrong: validation and storage observe different values. +validateName(input.name) +storeName(input.name) -Stable identity prevents a listener from changing which tool or scope the pipeline accepted after policy ran. It also gives commit-style observers a safe `WeakMap` key even when an adapter reuses a model call ID. +// Right: one accepted value drives both. +reads = 0 +const acceptedName = input.name +validateName(acceptedName) +storeName(acceptedName) +``` -For a nested transport dispatch, `parent` carries only the enclosing execution's opaque token rather than its live object. Code Mode sets an SDK sub-call's `parent` to the outer `run_code` execution's `token`, so an observer can correlate the two outcomes without receiving a reference that could mutate the still-running outer wrapper. +### Registered definitions are frozen snapshots -The input-to-execution conversion is intentionally one-way: +Tool registration creates the stored definition identity once; changes occur through explicit unregister/register effects rather than mutation of a caller-retained object. Parameters are materialized in one traversal, callbacks bind once to the accepted definition receiver, and the stored record is deep-frozen. + +The first-party `defineTool()` helper applies the same boundary before registration. It captures each option once, materializes the authoring `SchemaSpec`, and derives both the wire schema and later execution/presentation validation from that owned spec. + +```text +defineTool(options): + accepted = read each option exactly once + parameterSpec = snapshotLosslessJson(accepted.parameters) + wireSchema = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) + build execute and presentation validation over parameterSpec + +registerTool(context, definition): + accepted = read each definition field exactly once + stored = deepFreeze({ + accepted name, description, timeout, + parameters: snapshotLosslessJson(accepted.parameters), + execute: bind accepted.execute to definition, + presentation callbacks: bind accepted callbacks when present + }) + layerFor(scopeOf(context)).add(stored.name, stored) +``` + +`get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached projections. Replacing `definition.execute` after registration has no effect, while a callback can deliberately read live state from its closure or original receiver. + +Factory and backend registration use different reentrancy orderings around the same ownership rule. `AgentFactory` registration claims its single slot before reading callback accessors. `SubagentProvider` registration first snapshots the provider fields, then its effect checks and enters the accepted name. Both capture callback identity and intentional receiver state once, and hot-reload cleanup closes over the accepted slot or key instead of rereading a mutable public property. + +### Durable session data belongs to the session + +The session pins its ID and detached, deep-frozen header. Seed and append paths materialize lossless JSON once, validate the event envelope and message-history metadata against that owned record, and deep-freeze the exact accepted event. `session.events` returns a frozen snapshot that never grows later. + +The store keeps append observers, accepted registry IDs, and scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session, redirect `session/event`, or mutate an earlier snapshot into newer history. + +Approval requests follow the same async boundary at smaller scale: one capture preserves exact agent/signal identities, copies scalar fields, captures the session once, and drives `approval/asked`, scoped policy, cancellation, and `approval/decided` from that record. + +### Tool execution has pipeline-owned identity + +`ctx.tools.execute(input)` turns caller-owned input into one pipeline-owned `ToolExecution`. It first reads `callId` and `name` once and requires strings; a failure there rejects because even an error result would lack trustworthy correlation identity. Once those strings are accepted, later input failures can become normal final error outcomes. + +Arguments are materialized once and deep-frozen. The registry assigns a frozen property-free `ToolExecutionToken`; callers cannot choose it. `token`, `callId`, `name`, `arguments`, `agent`, and optional opaque `parent` token become non-writable and non-configurable before policy. `signal` is the only operational field an around-dispatch wrapper may replace or remove. ```text prepareExecution(input): callId = read input.callId exactly once name = read input.name exactly once - require callId and name are strings - # A failure above rejects: no trustworthy correlation identity exists. + require both are strings accepted = read arguments, agent, parent, and signal exactly once - require accepted.parent is absent or a registry-minted token - detachedArguments = snapshotLosslessJson(accepted.arguments) + require parent is absent or a registry-minted token + arguments = deepFreeze(snapshotLosslessJson(accepted.arguments)) execution = { token: new frozen property-free object, - callId, - name, - arguments: deepFreeze(detachedArguments), + callId, name, arguments, agent: accepted.agent, parent: accepted.parent, signal: accepted.signal } - - make every field except signal non-writable and non-configurable + protect every field except signal return execution ``` -### Tool guards can deny but never re-allow +Stable execution identity prevents middleware from changing which tool or scope policy accepted. It also gives structured-output commit a safe `WeakMap` key when an adapter reuses a string call ID. Code Mode correlates an SDK sub-call with its enclosing `run_code` using only the outer execution's opaque token, never a mutable reference to the live outer object. -`ctx.tools.guard()` installs a synchronous global or scope-specific guard after the extensible `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result. +Result boundaries apply the same ownership rule. Each transform returns data that is captured field-by-field, validated, materialized, and ultimately deep-frozen for final observers; malformed outcomes normalize to JSON-safe error results rather than reaching the session log as apparent success. -This one-way result makes the boundary monotonic. Pre-execution hooks can still compose ordinary allow, deny, and ask decisions; an ask resolves through the optional `ctx.approval` seam, where only `allowed-once` becomes allow and an absent channel or any non-grant becomes deny before guards run. No listener ordering can convert a guard denial back into dispatched work. A denied call still continues through result transformation and final observation as an error outcome. +## Owner-final policy: four narrow boundaries -The two APIs have deliberately different strength. A waterfall listener may return an allow decision, but the later guard has no corresponding allow result: +Waterfalls remain the ordinary extension mechanism; each of four protocol invariants runs after the last extension point capable of violating that specific invariant. Each owner-final API has the weakest one-way power that can preserve its guarantee. + +Here **canonical** means the named registry or tool-schema-provider output assembled before the waterfall—not “all output the service approves.” Protection restores only the names its owner declares. + +| Invariant | Cooperative extension point | Owner-final boundary | Guarantee | +|---|---|---|---| +| Named prompt/tool contribution | `system-prompt/assemble` waterfall | `systemPrompt.protect()` finalization | Canonical presence, absence, definition, and local anchor survive | +| Non-overridable tool denial | `tools/pre-execute` allow/deny/ask waterfall | Synchronous `tools.guard()` | A denial cannot become allow | +| Authoritative live outcome | Execute and post-execute waterfalls | Awaited `tools/result` notification | Observers receive one immutable final result | +| Terminal protocol completion | Continuation waterfall and pending steering | Serial `agent/turn-stop` | No middleware or late steering creates another step | + +### Prompt protection restores named canonical contributions + +`systemPrompt.protect({ sections, tools })` snapshots the requested names and restores their canonical registry or tool-schema-provider output after the complete assembly waterfall. Global and matching scoped protections compose by set union; a waterfall failure still fails assembly rather than triggering recovery. + +Protection covers both presence and absence. If the canonical assembly omits a protected name, finalization removes a listener-fabricated entry; this is how Code Mode keeps a native schema absent while preserving the SDK/transport form. Tool providers likewise expose one captured coherent record for schemas and optional known names, so a stateful getter cannot validate one name and display another. + +#### Global section protection reserves its name + +A globally protected section name cannot be shadowed by a scoped section. Scoped registration under an already protected name fails, and adding protection fails if a scoped shadow already exists. This check occurs before assembly because scoped-over-global merge would otherwise make the shadow itself appear canonical. + +Tool-schema protection does not create a blanket reservation for unrelated schema names. Providers are additive and may deliberately contribute other executable schemas; the owner-final guarantee covers only the named canonical contribution. + +#### Restoration preserves a useful local anchor + +Protection does not reset the whole assembly. It removes protected names from the waterfall result and reinserts each canonical entry before the first surviving later unprotected canonical neighbor, or at the end if none survives. Unprotected entries retain the order and definitions chosen by middleware. + +```text +assemble(context): + assembly = assemble registries for context.scope + canonical = snapshot protected section/tool inputs + transformed = await systemPromptAssembleWaterfall(assembly) + + for each protected canonical name: + remove every transformed entry with that name + if canonical includes the name: + insert before first surviving later canonical neighbor, else append + + return transformed +``` + +Code Mode globally protects `tools:sdk` and reserved `run_code`; structured output adds scoped protection for its instruction and capture schema. + +### Tool guards deny monotonically + +`ctx.tools.guard()` installs a global or scoped synchronous check after the complete `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result. + +Pre-execute hooks still compose ordinary allow, deny, and ask decisions. An ask resolves through the optional approval service, where only `allowed-once` becomes allow and absence or any non-grant becomes deny. Guards run afterward, so listener order cannot convert their denial into dispatched work. ```js agent.ctx.on( @@ -771,72 +734,56 @@ agent.ctx.tools.guard(execution => ) ``` -Even a later prepended allow listener cannot bypass this guard because the registry evaluates guards after the complete waterfall. +Even a later prepended allow listener cannot bypass the guard. A denied call still becomes an error outcome that flows through result transformation and final observation. -### `tools/result` observes the authoritative live outcome +### `tools/result` observes the final live outcome -The complete live pipeline is `tools/pre-execute` → monotonic guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first three named events are transformable waterfalls; `tools/result` is an awaited, observe-only notification after all transforms and the registry's outer error normalization. At each untrusted result boundary, the registry captures every top-level field once and materializes the complete authoritative outcome as detached lossless JSON. Immediately before observation it materializes that owned outcome again and deep-freezes the shared listener snapshot. An invalid tool or listener result becomes a normal JSON-safe `isError` outcome instead of reaching observers as apparent success and failing later at the session log. +The live pipeline is `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first, execute, and post stages are transformable waterfalls; `tools/result` is an awaited observe-only notification after every transform and outer error normalization. -Every `tools/result` listener receives the same frozen execution and deep-frozen result snapshot. Listener failures are contained independently, so they cannot change the caller's result or starve peer observers. Scope filtering derives from `execution.agent`. +Every observer receives the same frozen execution and a separate deep-frozen snapshot of the owned result returned to the caller. Listener failures are contained independently, so they cannot change that returned result or starve peers. Routing uses `execution.agent`. -`tools/result` is not the durable session event `tool/result`. The live notification belongs to the registry and also fires for direct programmatic executions; the agent loop subsequently appends `tool/result` to the session log for replay, UI reconstruction, and model history. A policy that needs the final in-process verdict uses the former, while a consumer that needs persisted transcript state uses the latter. - -The entire registry method reads like one execution-decision pipeline: +`tools/result` is not the durable `tool/result` session event. The live notification also fires for direct programmatic executions and is the source of truth for in-process commit logic. The agent loop later appends the durable event for replay, UI reconstruction, and model history. ```text execute(input): - callId = read input.callId exactly once - name = read input.name exactly once - require callId and name are strings + accept trustworthy callId and name + try to prepare pipeline-owned execution + on preparation failure: + create an identity-bearing error shell + ownedResult = owned error result + freeze execution + observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) + await every tools/result observer independently with observerResult + return ownedResult - try: - execution = prepareExecutionFromTrustedIdentity(input, callId, name) - catch invalidInput: - execution = frozen identity shell with arguments = undefined - result = errorResult(invalidInput) - await tools/result observers with independent failure containment - return result + gate = await tools/pre-execute(execution) + resolve ask through approval when needed + denial = policy denial or first guard denial - try: - gate = await tools/pre-execute(execution) - decision = gate - if gate asks: - decision = await resolveWithApproval(gate, execution.agent) - # approval absence and every non-grant resolve to deny + if denied: + result = errorResult(denial) + else: + result = await tools/execute(execution, dispatchRegisteredTool) - if decision allows: - denial = firstRegisteredGuardDenial(execution) - else: - denial = decision.denial - - if denial exists: - result = errorResult(denial) - else: - result = await tools/execute(execution, next = dispatchRegisteredTool) - result = requireValidExecutionResult(result) - - result = await tools/post-execute(execution, result) - result = snapshotLosslessJson(result) - catch pipelineFailure: - result = errorResult(pipelineFailure) - - freeze(execution) - frozenResult = deepFreeze(snapshotLosslessJson(result)) - await every tools/result observer independently, containing each failure - return result + result = await tools/post-execute(execution, result) + ownedResult = normalize into owned lossless JSON + freeze execution + observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) + await every tools/result observer independently with observerResult + return ownedResult ``` -Waterfalls can transform only at their named stages. Guards can only deny, and the final observers can only observe. +Waterfalls transform only at their named stages; guards only deny; final observers only observe. -### `agent/turn-stop` makes a composed continuation terminal +### `agent/turn-stop` makes continuation terminal -Steering is input injected into an already running turn for the next model step; ordinary queued prompts wait for a future turn. The loop normally preserves that distinction by moving leftover steering into another step while leaving the queued-prompt FIFO alone. +Steering is input for another model step inside the current turn; queued prompts wait for a future turn. Ordinary continuation remains extensible: the loop computes a default, runs `agent/turn-continuation`, records any force-continue reason as steering, and treats pending steering as a reason to continue. -Ordinary continuation remains extensible. The loop computes a default, runs the `agent/turn-continuation` waterfall, records any force-continue reason as steering, and folds pending steering into the decision because steering normally demands another model step. +The scoped serial `agent/turn-stop` checkpoint runs after that folding. A listener returns `{ action: 'stop' }` or abstains with `undefined`; malformed values and throws close the current turn with an error. A stop is terminal, so later listeners and steering cannot restore continuation. -The scoped serial `agent/turn-stop` checkpoint runs after that folding. Its strict serial helper consults listeners in order until one returns a non-`undefined` value; a listener returns `{ action: 'stop' }` or abstains with `undefined`. The dedicated helper exists because ordinary Cordis serial dispatch treats `null` and `false` as framework abstentions, while this public contract has exactly one abstention value. A stop is terminal, so later listeners and pending steering cannot restore continuation. A malformed result, including `null` or `false`, or a throwing policy closes the current turn with an error while leaving the driver available for later work. +The loop uses `strictSerial` because ordinary Cordis serial dispatch treats `null` and `false` as abstentions. This terminal protocol permits only `undefined` to abstain, making accidental return values fail closed. -Terminal stop deliberately discards steering while preserving ordinary queued prompts. Its terminal state remains in force through `turn/end` and the durability flush, so steering added by continuation, turn-close, or flush listeners cannot escape through the loop's late-steering fallback into another step or turn. This is the explicit exception to the normal rule that leftover steering becomes input for another turn. The stronger terminal control is reserved for protocols, such as a completed structured child, where further model work would violate the result contract. +Terminal state remains active through `turn/end` and the durability flush. Steering added by continuation, turn-close, or flush listeners is discarded after a terminal stop, while the ordinary queued-prompt FIFO remains untouched. ```text afterSuccessfulStep(turn): @@ -845,7 +792,6 @@ afterSuccessfulStep(turn): if steering is pending: decision = continue terminal = await strictSerial(agent/turn-stop) - # undefined means abstain; null, false, malformed values, and throws are errors if terminal == stop: discard steering terminalStopped = true @@ -860,13 +806,27 @@ afterSuccessfulStep(turn): move leftover steering to the next-turn queue ``` -The queued-prompt FIFO is separate and is never drained by terminal stop. +This stronger control is reserved for terminal protocols such as a completed structured child; ordinary continuation policy remains cooperative. -## Subagent composition +## Subagents: the composition proof -In-process subagents demonstrate how the scope, lifecycle, and final-policy pieces compose. A provider builds the child's world during unpublished setup, then lets the ordinary agent lifecycle own it. +In-process subagents add no second scoping model. They create a fresh flat child scope during unpublished setup, install ordinary scoped persona/filter/protocol registrations, own the child through a run handle, and use the same owner-final checkpoints for structured output. -The caller-facing seam separates acceptance, readiness, result settlement, cancellation, and disposal. This example assumes the spawn backend is loaded under its configurable default provider name, `spawn`, `parent` is top-level (depth 0), and a global `read` tool has already been registered. A caller observes readiness before treating the child as live and always disposes the run: +The roles and phases are explicit: + +| Role | Responsibility | +|---|---| +| Caller | Supplies parent, prompt, optional child configuration, and eventual disposal | +| `SubagentService` | Validates capabilities, owns the public wrapper, normalizes result and lifecycle telemetry | +| `SubagentProvider` backend | Chooses transport and creates one run | +| In-process driver | Owns child creation, setup, prompt drive, result read, cancellation, and teardown | +| Child `Agent` | Uses the ordinary agent lifecycle and its fresh `agent.ctx` | + +```text +accepted start -> started (published) -> result (settled) -> dispose (quiescent) +``` + +Assume the in-process `spawn` backend uses its default name, `parent` is top-level, and global `read` exists: ```js const run = ctx.subagents.start('spawn', { @@ -886,156 +846,15 @@ const run = ctx.subagents.start('spawn', { try { await run.started const result = await run.result - // result.structured exists only after a successful committed capture. + // result.structured exists only after successful final commit. } finally { await run.dispose() } ``` -### Inputs and ownership are fixed before asynchronous creation +### The child world uses ordinary registrations -This section follows a child from provider/request acceptance through the service wrapper and then through the workflow bridge. Each layer captures its boundary before arbitrary asynchronous work and owns the cleanup it may need to start. - -#### Provider and request acceptance own the child boundary - -Provider registration first freezes an acceptance snapshot of the provider name, capability flags, parent-context descriptor, and `start` callback; the callback is bound to the original provider object so its intentional internal state stays live. Lookup, validation, model-facing wording, dispatch, lifecycle notifications, and hot-reload cleanup all use that snapshot. Mutating or reusing the caller's provider object later therefore cannot rename a live entry, change its advertised powers, replace its callback, or make its disposer delete the wrong key. - -Starting a run reads every top-level request field once before capability validation, then snapshots every accepted field before asynchronous owner setup. This order makes checked and delegated capabilities identical even for a JavaScript caller with stateful accessors. Fixed scalars are checked at the same boundary: `maxDepth` must be a non-negative safe integer and `persona` must be a string. The parent and abort signal are retained as identity capabilities but never reread from the mutable request record; tool filters, seed events, agent options, output schema, and prompt are detached through the one-pass lossless-JSON materializer. The exported in-process driver repeats this boundary for direct callers before it awaits run-owner activation, including taking one seed snapshot from which it derives both the child prefix and `seedLength`. Later caller mutation therefore cannot change lifecycle scope, configuration, the schema enforced by the capture tool, or the prompt eventually logged and sent. - -Depth validation is intentionally repeated at every public entry path, while one seam-owned helper keeps the accepted domain identical: - -```text -tool-subagent plugin load: - schema requires natural <= Number.MAX_SAFE_INTEGER - assertSubagentMaxDepth(config.maxDepth) - -SubagentService.start(request): - capture request.maxDepth once - assertSubagentMaxDepth(captured maxDepth) - -startInProcessRun(request): - capture request.maxDepth once - assertSubagentMaxDepth(captured maxDepth) - parentDepth = depthOf(parent) # also a non-negative safe integer - childDepth = parentDepth + 1 - if childDepth is not a safe integer: throw RangeError - if maxDepth is defined and childDepth > maxDepth: throw SubagentDepthError -``` - -The derived-value check is separate from validating either input: `Number.MAX_SAFE_INTEGER` is a valid stored parent depth, but adding one cannot produce a contract-valid child depth. The driver rejects that overflow even when no request-level `maxDepth` cap was supplied. - -The driver first installs provider ownership. Only after that succeeds does it attach the request's abort listener and create one run-owner Cordis fiber under `parent.ctx`; an already-unloading provider therefore leaves neither a child nor an orphaned listener. Calling `runOwner.ctx.agents.create()` gives the child factory an explicit `ownerCtx` carrying the run-owner fiber and scope, while the registry's traced factory receiver preserves AgentLoop's injected dependency origin. Parent teardown, provider teardown, and manual run disposal all dispose this same run-owner node; moving it out of the active state synchronously prevents an unpublished setup from publishing afterward, while all three paths follow one quiescence promise. This structured ownership does not change the child's flat registration view. - -#### The service wrapper orders readiness, results, and lifecycle - -The provider's run separates acceptance from publication with `started: Promise`, but the service does not expose that caller-owned handle directly. It captures `id`, `started`, `result`, and each method once, binds methods to the provider-owned run handle, and returns a frozen service-owned wrapper. Capturing `dispose` first also preserves a rollback capability if a later accessor or method check reveals a malformed handle. The wrapper installs its shared disposal promise before invoking the raw provider callback, so synchronous reentry through the returned wrapper and ordinary repeat calls join one provider disposal rather than slipping through a not-yet-assigned memo. If the raw disposer directly returns that same reentrant wrapper promise, the service rejects the cyclic provider contract instead of awaiting a promise that depends on itself forever. - -The wrapper's `result` promise captures `output`, optional `structured`, and `stopReason` once and resolves to one detached, deeply frozen lossless-JSON value shared by the caller and lifecycle telemetry. Malformed terminal data is an infrastructure fault; it rejects only after the service has started rollback of the provider attempt. The service observes the normalized result immediately, before waiting for readiness, so an early rejection is never temporarily unhandled. - -For spawn and fork, the accepted `started` promise fulfills only after the child factory returns a published handle. The service can then emit `subagent/start` with `ctx.agents.get(id)` already live and release any buffered terminal event; if readiness rejects, it emits neither start nor end. Lifecycle notification is fire-and-forget and non-vetoing: each listener receives the same deeply frozen payload, and synchronous throws or returned-promise rejections are logged and contained per listener without awaiting them. The child result driver awaits the same readiness boundary before sending the prompt. - -```text -startInProcessRun(providerContext, acceptedRequest): - snapshot all request data, including parent identity - - providerLink = providerContext.effect(onDispose => disposeRunOwner()) - attach snapshot.abortSignal listener - runOwner = mount no-op plugin under snapshot.parent.ctx - - returnedRun.dispose = () =>: - dispose providerLink - await disposeRunOwner() - - creation = runOwner.ctx.agents.create({ - fresh ids and lineage, - detached options and optional seed, - setup(childCtx) => install persona, tool restriction, structured runtime - }) - - returnedRun.started = creation.then(childHandle => publication complete) - returnedRun.result = async: - await returnedRun.started - send the child prompt, await idle, derive the terminal result - -SubagentService.start(...): - providerRun = provider.start(detached request) - serviceRun = freeze({ - id, started, and methods captured once from providerRun, - methods bound to providerRun, - result: normalize once into detached, deeply frozen lossless JSON - }) - attach settlement handlers to serviceRun.result immediately - attach handlers to serviceRun.started: - on fulfillment, emit subagent/start and then buffered or eventual subagent/end - on rejection, discard buffered lifecycle telemetry - return serviceRun immediately -``` - -#### The workflow bridge closes readiness and settlement races - -Every downstream protocol that announces a subagent must honor the same boundary. The workflow worker bridge therefore registers the returned run before waiting, observes and snapshots `result` immediately, and sends `ChildStarted` only after `started` fulfills while admission remains open. A readiness rejection is refused and host-disposed; `ChildStartError` is sent while worker-message admission remains open, and an already-retired exact run is not cleaned twice. Provider `start()` is itself arbitrary code and may synchronously reenter workflow cancellation before its returned run reaches that registry. The bridge attaches both promise observers, re-checks terminal admission immediately after `start()` returns and again at readiness, and turns a closed boundary into identity-guarded cancellation, disposal, and refusal rather than late worker admission or lifecycle announcement. An arbitrary provider may still fulfill its own `started` promise after the workflow boundary; the bridge refuses and cleans up that attempt instead of claiming it can undo provider-side publication. - -```text -Workflow worker bridge after receiving returnedRun: - register the run so cancellation can reach pre-publication work - attach result settlement handlers immediately and snapshot the outcome - re-check terminal admission after provider start returns - if admission closed: - if the exact run remains registered: cancel once and dispose it - if worker-message admission remains open: send ChildStartError - else wait for returnedRun.started: - on fulfillment: - re-check terminal admission - if closed: apply the same identity-guarded refusal - else: send ChildStarted; then send the buffered or eventual outcome - on rejection: - if worker-message admission remains open: send ChildStartError - if the exact run remains registered: dispose it - -Worker after choosing its result: - queue Result on the worker-to-host port - only then reap stray child handles - -Host at workflow Result receipt: - cancellationWasRequested = external cancellation is already in flight - atomically claim chosen = - if cancellationWasRequested and result is not cancelled: - cancelledResult - else: - result - - if not cancellationWasRequested: - abort the shared child-request signal - call cancel("workflow settled") on every host-registered run - - settle chosen - -Host at the first worker death signal: - close worker-message admission - claim death or preserve an earlier cancellation/Result/grace outcome - cancel and dispose every registered child - synthesize missing lifecycle ends - -Host at physical worker exit: - perform a final disposal-only sweep - do not repeat explicit child cancellation -``` - -Cancellation before readiness is a publication decision, not merely a flag for later result mapping. The in-process run synchronously deactivates its owner fiber. If cancellation lands before publication, the factory's liveness check prevents either creation edge. If it begins synchronously inside `session/created`, `agent/created`, or `agent/session-start`, the publication barrier lets the current notification phase unwind without revoking its world, the next liveness check prevents every later phase and driver start, and rollback pairs every creation edge that already began. In either case `started` rejects, no `subagent/start` or `subagent/end` is emitted, and the run result settles as `aborted`. - -Receipt of the worker's `Result` message is the workflow host's atomic first-wins boundary. The worker queues that message before its own settlement-reap `ChildCancel` messages, so same-port FIFO prevents an internal child callback from masquerading as earlier run cancellation. Each contender records its claim before its own callback fanout: external `cancel()` records its reason first, while Result receipt snapshots any earlier cancellation and claims the resulting terminal outcome before invoking settlement-cleanup provider code. A caller, signal, or dispose cancellation already in flight therefore overrides a non-cancelled worker report, while the report wins otherwise. Before exposing that chosen result, the host drives both permitted child-cancellation channels by aborting the shared request signal and calling every registered run's `cancel()`, including runs still waiting on readiness. Those calls are settlement-only cleanup, and the terminal claim makes a reentrant `WorkerRun.cancel()` a side-effect-free loser rather than merely repairing its result afterward. Host fanout and the worker's FIFO-later `ChildCancel` can both reach the explicit channel, so a per-call gate invokes each provider `cancel()` at most once; the seam does not require that callback to be idempotent. Explicit child cancel callbacks are contained independently so one throwing callback cannot starve peers or alter settlement. - -Unexpected worker death uses the same terminal-claim rule, but terminal ownership, message admission, and exit cleanup are separate state. The host snapshots whether external cancellation was already accepted, claims either `cancelled` or the death error, closes inbound worker messages, and only then reaps children and synthesizes missing lifecycle events. Closing admission is necessary because Node may emit `error`, deliver an already-queued `message`, and only then emit `exit`; without the logical barrier, that message could start a child or narrate after `workflow/end`. Provider code reentering cancellation during cleanup cannot rewrite a death-first error; conversely, a cancellation accepted before death remains the winner. If Result or grace already claimed the outcome, death preserves it while still reaping promptly. Physical exit then performs a final disposal-only sweep without repeating explicit provider cancellation. `handle.dispose()` claims its public promise before that traversal invokes cancellation or disposal callbacks, and every `disposeChild` path independently claims the call ID promise before invoking the wrapped child disposer. Public-first reentry returns the existing holder promise; worker-first reentry may begin holder disposal, whose child traversal joins the already-claimed call ID promise. This distinction is necessary because grace settlement precedes `worker.terminate()` and its exit event: suppressing a duplicate outcome, late message, or repeated cleanup request must not suppress disposal of survivors in the host registry. - -Together these rules prevent an early result rejection from going unhandled, ensure `workflow/agent-start` never names an unready child, and prevent the bridge from admitting or announcing a child after its workflow has ended. - -Parent teardown reaches `runOwner` by nesting; the provider and returned run handle reach the same node through their explicit disposers. - -### Persona, filtering, and lifetime use ordinary registrations - -A child persona is a scoped `deployment:persona` section that shadows the deployment-wide section. A child tool filter is a scoped restriction over global end capabilities. Omitted filters remain omitted; a materialized empty `allow` list means “allow nothing” and is not confused with absence. - -The child's persona, filter, and structured runtime are installed inside factory setup. Persona and filtering use public registration methods directly. The package-internal structured helper groups the public tool, prompt, protection, guard, and listener registrations that form one terminal protocol: +A child persona is a scoped `deployment:persona` section. Its tool filter is a scoped restriction over the live global tool layer. Structured output is a bundle of scoped tool, prompt, protection, guard, and listener registrations. ```js let structured @@ -1054,30 +873,31 @@ const setup = childCtx => { } ``` -The common run-owner fiber gives structured-concurrency-style teardown without importing the parent's registration layer into the child. The filter affects the child's global tool view; it is not a parent-derived authority ceiling. +The driver creates one run-owner fiber under `parent.ctx` and calls the child factory through it. Parent teardown, `spawn` backend teardown, and manual run disposal reach the same node, but the child still receives a new registration key. Lifetime inheritance therefore does not imply registration inheritance. ### Structured output is a child-owned terminal protocol -A structured child registers a real-schema `structured_output` tool and its instruction through its own context. Concurrent children can use different schemas because each scope resolves its own definition, with no global placeholder, reference count, or remove-for-everyone-else pass. +A structured child registers a real-schema `structured_output` tool and instruction in its own scope. Concurrent children can use different schemas without a global placeholder, reference count, or remove-for-everyone pass. -Presentation mode changes where the model invokes the capture capability, but not which child owns it: +Presentation mode changes the invocation route, not ownership: -| Tool mode | Registry's canonical wire contribution | Generated SDK | Structured-output guarantee | -|---|---|---|---| -| `native` | Visible end-capability schemas, including scoped `structured_output` | None | Protection restores the capture schema and instruction | -| `code` | Reserved `run_code` transport | Visible end-capability bindings, including `structured_output` | Protection keeps `run_code` and the SDK present, keeps native `structured_output` absent from the wire, and restores the instruction | -| `both` | Visible native schemas plus reserved `run_code` | Visible end-capability bindings, including `structured_output` | The model may call the protected capture capability natively or through the protected transport | +| Mode | Advertised invocation route | Canonical wire contribution | Generated SDK | Owner-final guarantee | +|---|---|---|---|---| +| `native` | Native `structured_output` | Visible native schemas, including scoped capture | None | Restore the capture schema and instruction | +| `code` | The `structured_output` SDK binding inside `run_code` | Reserved `run_code`; native capture remains absent | Visible end-capability bindings, including capture | Restore the transport, SDK, native absence, and instruction | +| `both` | Either native capture or its SDK binding | Visible native schemas plus `run_code` | Visible end-capability bindings, including capture | Restore both invocation routes and the instruction | -The table describes the registry's named canonical contribution. An unrelated assembly listener may deliberately add another schema; protection does not erase unrelated names. +Tool mode controls presentation, not an execution allowlist. In code mode, an adapter or direct caller that emits the unadvertised `structured_output` name can still resolve the scoped end capability and takes the native one-stage commit path; a deployment that must forbid that route needs an execution guard. -### Capture uses stage, final commit, monotonic denial, and terminal stop +An unrelated assembly listener may deliberately add another schema; named protection does not erase unrelated contributions. -The capture tool validates its arguments and stages the cloned value in a JavaScript `WeakMap` keyed by the identity-stable `ToolExecution`. This is an object-identity table whose key does not keep an abandoned execution alive. Validation failure becomes the ordinary `INVALID_ARGS` error that the model can correct within the turn. +#### Native commits once; Code Mode commits twice -The scoped `tools/result` observer commits a direct native capture only when that exact execution's authoritative final result succeeds. A later call with a reused string call ID cannot reach the weak-keyed stage, and a post-execution block cannot promote it. +The capture body validates and stages a cloned value by stable `ToolExecution` identity. The scoped final-result observer commits a native capture only if that exact execution's final result succeeds. + +A schema-validation failure becomes the ordinary `INVALID_ARGS` tool result, so the model can correct the value and call the capture tool again within the same turn. ```text -# Native structured-output call structured_output.body(value, execution): validate value against this child's schema staged[execution] = clone(value) @@ -1090,10 +910,9 @@ on tools/result(execution, finalResult): captured = value ``` -For a Code Mode SDK call, successful inner observation records a pending value against the child execution's opaque `parent` token instead of committing immediately. When the enclosing `run_code` reaches its own `tools/result`, the observer compares that pending token with the outer execution's `token` and commits only on success. A program error or outer post-policy block discards the pending value. This extra boundary is necessary because an inner side effect can succeed while the transport that is supposed to deliver the structured answer still fails. +For a Code Mode SDK call, successful inner observation records a pending value against the opaque outer `run_code` token. Commit waits for the outer transport's own successful final result because an inner side effect can succeed while the program or its post-policy still fails. ```text -# Code Mode adds an outer transport commit on tools/result(innerStructuredCall, innerResult): if innerStructuredCall is staged: value = staged.remove(innerStructuredCall) @@ -1108,21 +927,139 @@ on tools/result(outerRunCodeCall, outerResult): captured = value ``` -The native path has one final-result commit; Code Mode has two because the inner capability and outer transport can fail independently. +Once capture is staged against an outer transport or committed, the scoped guard denies later calls in that response. After commit, `agent/turn-stop` ends the turn after ordinary continuation and steering fold. A child that otherwise completes cleanly without a committed capture returns an error rather than being re-prompted; requesting a schema makes output mandatory, not guaranteed. -Once a value is captured or pending on its outer transport, the scoped `ToolGuard` denies later calls in the same response. After a committed capture, the scoped `agent/turn-stop` ends the turn after ordinary continuation and steering have been folded. Together these boundaries prevent post-capture side effects and prevent a successful tool call from purchasing an otherwise automatic extra model step. +### The run protocol separates acceptance, readiness, result, and disposal -The provider does not re-prompt a child that finishes without a committed capture. Such a run returns an error result with no `structured` value; requesting an output schema creates a requirement, not a guarantee that a failed child produces a value. +`SubagentService.start()` returns synchronously, but `run.started` is the publication boundary. Callers treat the child as live only after readiness, consume `result`, and always dispose the run. + +Pre-readiness cancellation of an in-process run deactivates the run-owner fiber, prevents publication, rejects `started`, resolves `result` as `aborted`, and emits neither subagent lifecycle edge. + +`SubagentProvider` registration captures name, capability flags, the `inheritsParentContext` conversation-history descriptor, and the bound start callback once. The descriptor says whether completed parent turns seed the child's conversation; it says nothing about scope, services, tools, or authority. + +Starting a run captures every request field once. Parent and abort signal remain identity references; prompt, filter, schema, and options are detached lossless JSON; fixed `persona` and absolute `maxDepth` values validate before backend ownership. The in-process backend separately snapshots its optional session seed, and the service snapshots the terminal result when it settles. + +Depth validation repeats at each public entry while one helper owns the accepted domain: + +```text +tool-subagent plugin load: + assertSubagentMaxDepth(config.maxDepth) + +SubagentService.start(request): + capture and validate request.maxDepth + +startInProcessRun(request): + capture and validate request.maxDepth + parentDepth = validated depthOf(parent) + childDepth = parentDepth + 1 + reject if childDepth is not a safe integer + reject if maxDepth exists and childDepth > maxDepth +``` + +Only `undefined` means parent depth zero. Present depth and cap values must be non-negative safe integers and must not be negative zero; derived overflow rejects even when no request cap exists. + +The service does not expose the backend-owned run handle directly. It captures `id`, `started`, `result`, and methods once; binds methods to that handle; wraps result in one detached frozen record; and installs a shared disposal promise before calling untrusted backend cleanup. Once a callable backend disposer has been captured, a malformed later field triggers rollback; if no callable disposer exists, rollback is impossible and acceptance fails immediately. A backend disposer that directly returns the wrapper's reentrant promise is rejected as a cycle instead of hanging. + +```text +startInProcessRun(backendContext, acceptedRequest): + install backend ownership + attach accepted abort signal + create run-owner fiber under accepted parent.ctx + create child through runOwner.ctx.agents with unpublished setup + + started = child creation publication + result = after started: + send accepted prompt + await child idle + derive owned terminal result + dispose = dispose run owner and await quiescence + +SubagentService.start(...): + backendRun = backend.start(detached request) + serviceRun = freeze accepted id, readiness, bound methods, normalized result + observe result immediately + after readiness: + emit subagent/start, then buffered/eventual subagent/end + on readiness failure: + emit neither lifecycle edge +``` + +The service observes result settlement immediately even while readiness is pending, preventing an early rejection from becoming temporarily unhandled. Lifecycle listeners receive one frozen payload; their throws and returned-promise rejections are contained independently and cannot veto the run. + +## Workflow integration preserves the subagent contract + +The worker workflow bridge preserves the same readiness, terminal-claim, and bounded-cleanup boundaries across a message port. It never announces an unready child, never lets cleanup rewrite an already chosen result, and never suppresses disposal merely because another terminal fact already won. + +The worker executes the workflow script and exchanges protocol messages; the host owns `SubagentService`, which invokes `SubagentProvider` backends and returns normalized run wrappers that the host retains. Their lifetimes follow dependency shape: an AgentLoop-created agent stops when its loop unloads, while a workflow run captures its holder-bound `SubagentService` at start, so unloading the workflow engine prevents new runs without revoking an already returned run. + +Three state dimensions remain separate: + +| Dimension | Question | Winning rule | +|---|---|---| +| Admission | May a worker message still start or announce a child? | Closed admission refuses the exact run and cleans it up | +| Terminal claim | Which external result does the workflow expose? | Earlier accepted external cancellation wins; otherwise first result/death claim wins | +| Physical cleanup | Which registered children and worker resources remain? | Every path may still dispose survivors through per-call gates | + +### Child admission waits for readiness + +After `SubagentService.start()` returns its normalized wrapper, the host registers that exact wrapper before awaiting, attaches result observers immediately, and rechecks admission both then and when `started` settles. A closed boundary claims cancellation and disposal for that exact entry, removes it only when disposal settles, and reports `ChildStartError` only while the worker reply channel remains open. + +The backend's nested `start()` may synchronously reenter workflow cancellation before the service wrapper reaches the host registry. The immediate post-start check and exact-wrapper identity guard close that interval; a backend that later fulfills its own readiness cannot resurrect workflow admission. + +```text +after subagents.start returns its run wrapper: + register exact wrapper for cancellation + observe and snapshot result immediately + if admission closed: refuse and clean exact wrapper + else await run.started + + on ready: + if admission closed: refuse and clean exact run + else send ChildStarted, then buffered/eventual outcome + + on readiness failure: + send ChildStartError only if the worker reply channel remains open + dispose exact wrapper if still registered +``` + +### Each terminal contender claims before its own callbacks + +Each terminal path records the state it owns before invoking its own callback fanout. External `cancel()` records the accepted cancellation reason before invoking child cancellation. On the Result path, the worker queues its `Result` message before settlement cleanup messages on the same port, and the host records the winning result before any Result-triggered abort or cancellation. Reentry therefore observes the fact that already won instead of rewriting it. + +```text +on workflow Result: + cancellationWasAlreadyAccepted = external cancellation is in flight + claim chosen result: + if earlier external cancellation and result is not cancelled: + cancelled result + else: + worker result + + if not cancellationWasAlreadyAccepted: + abort shared child-request signal + cancel every registered child through its at-most-once gate + settle chosen result +``` + +The worker may also send a later `ChildCancel`; host fanout and the worker message share one per-call cancellation gate, so an arbitrary backend's `cancel()` need not be idempotent. Each callback is contained independently. + +### Worker death, exit, and disposal remain separate + +The first worker death signal closes message admission, claims a death result unless an earlier terminal fact won, cancels and disposes registered children, and synthesizes missing lifecycle ends. A queued message can arrive between Node's `error` and `exit`, so the logical admission barrier—not physical exit—prevents late child creation or narration. + +Physical exit performs a final disposal-only sweep without repeating explicit cancellation. A cancellation grace period bounds how long the host waits for cooperative settlement before terminating the worker; a grace result can already be chosen while exit cleanup still needs to dispose surviving child handles. The bound is real: after grace expires, public disposal may return after invoking child disposal and reaping host resources even if a slow backend disposer has not reached quiescence. + +Public `handle.dispose()` claims its shared promise before invoking cancellation or child callbacks. Each `disposeChild` likewise claims its call-ID promise before invoking the backend disposer. Public-first reentry joins the public promise; worker-first reentry lets the holder traversal join the already claimed child promise. Settled `dispose()` still drives a host-side reap before awaiting quiescence, so a fire-and-forget child cannot remain alive merely because workflow result settlement already occurred. + +Together these rules ensure `workflow/agent-start` names only ready children, external result precedence is stable, and every surviving child reaches disposal. ## Correctness enforcement -Scope mistakes are fail-open if they merely omit a carrier, so the implementation checks the contract at API, type, runtime, and repository-gate boundaries. None of these checks substitutes for using the correct runtime carrier. +The runtime rule is checked at four escape boundaries: API shape couples related subjects, TypeScript marks typed dispatch, development invariants inspect actual dispatch, and repository gates keep declarations aligned with enforcement. -### API shape couples subjects that must agree +### API shape couples values that must agree -`agentEvents(context, agent)` couples the dispatch carrier to the agent argument, `assembleContextFor(agent)` couples prompt facts to the scope selector, and `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered the store. These helpers make a mismatched subject harder to express than the correct spelling. - -Their essential construction makes the coupling explicit: +`agentEvents(context, agent)` couples carrier, subject, and first event argument. `assembleContextFor(agent)` couples prompt facts with scope selection. `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered. ```text assembleContextFor(agent): @@ -1133,99 +1070,108 @@ agentEvents(context, agent): return dispatcher that always injects agent as the event subject ``` +These helpers make a mismatch harder to express than the correct spelling. + ### Type markers cover every scoped event declaration -Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript therefore rejects a bare subject at typed dispatch sites, including the `subagent/start` and `subagent/end` paths whose scope is the delegating parent. +Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript rejects a bare subject at typed dispatch sites, including subagent lifecycle events scoped to the delegating parent. -The marker is compile-time only. JavaScript callers, casts, and direct use of Cordis's dispatch APIs can bypass it, which is why the runtime checks remain necessary. +The marker is compile-time only; JavaScript, casts, and direct Cordis dispatch can bypass it. -### Development invariants check actual dispatch +### Development invariants inspect actual dispatch -The invariants plugin observes Cordis's internal dispatch path before listener delivery. For each scope-filtered event it requires a marked carrier and, where the event arguments expose the subject, verifies that the carrier key is the same object. +The invariants plugin observes Cordis's internal dispatch before listener delivery. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. -Session and subagent payloads do not expose the owner key directly, so their invariant proves carrier presence while their service centralizes how the correct key is chosen. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. +Session and subagent payloads do not expose their owner key directly, so their service centralizes key selection and the invariant proves carrier presence. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. + +Dedicated `dsh-scope` unit tests cover the carrier's advanced Proxy behavior: private-field method binding, call/construct shape, primordial filter invocation, own-key/descriptor consistency, and explicit configurable definitions. These are implementation tests, not checks performed by the invariants plugin. ### Repository gates keep declarations and dispatchers aligned -`verify-scoped-dispatch` compares the declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to have a recognized dispatcher. Source JSDoc is regenerated into the [event catalog](../../../cordis-catalog/events.md), keeping the exhaustive signature and mode reference in one place. +`verify-scoped-dispatch` compares declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to name a recognized dispatcher. Source JSDoc generates the [event catalog](../../../cordis-catalog/events.md), which remains the exhaustive signature and mode reference. ## Alternatives considered -The rejected designs either split visibility from ownership, isolate the wrong boundary, or depend on extension ordering for correctness. +The rejected designs fail one of the four governing questions: they separate visibility from ownership, choose the wrong isolation unit, expose partial lifecycle, leave accepted values mutable, or rely on extension order for invariants. ### Pass an agent option to every registration -An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and requires parallel scope plumbing in every registry. It also allows “visible to agent A, disposed with unrelated plugin B,” which the scoped context makes unrepresentable. - -### Create one isolated service graph per agent - -Service isolation chooses one registry instance for a context, while agent composition needs a merged view of deployment-global contributions plus one agent's additions. Per-agent graphs would duplicate shared adapters and force infrastructure such as persistence and UI bridges to discover every new instance. - -Isolation remains appropriate for independent applications. It is too coarse for collaborating agents inside one deployment. - -### Inherit the parent's registrations into a child - -Hierarchical registration inheritance makes lifetime convenient but silently copies every parent-scoped tool and policy into each child. A flat view plus an explicit parent-owned disposer separates lifetime from registration composition: the parent owns the child without importing the parent's layer. As the [security non-goal](#security-and-authority-are-explicit-non-goals) states, flat lookup does not by itself impose a child-within-parent authority relationship. - -### Publish the agent before running setup - -Early publication lets setup resolve the agent from global registries, but observers can see and act on a partially configured world. Rollback can remove entries but cannot retract external effects from already-run listeners. - -The unpublished callback already receives both the agent context and its `ctx.agent` association, so early global lookup is unnecessary. - -### Allow only synchronous setup - -Synchronous setup is simpler but cannot honestly compose a child plugin whose activation is asynchronous. In TypeScript, a callback returning a promise can also be assigned to a void-returning callback type, so declaring setup as synchronous would not reliably prevent accidental escape from the rollback boundary. - -Awaited setup makes the transaction explicit and keeps the first assembly behind it. - -### Enforce invariants with prepended waterfall listeners - -A prepended listener is not necessarily outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace the result after delegation. The same issue appears in prompt assembly, tool decisions, result commit, and turn continuation. - -The owner-final APIs express the actual strength required by each rule: restore named canonical data, deny monotonically, observe the immutable final outcome, or stop after all ordinary continuation inputs are folded. +An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and repeats scope plumbing in every registry. It can also express “visible to A, disposed with unrelated plugin B,” which `agent.ctx` prevents. ### Filter events while keeping registries global Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Persona, tool filtering, and concurrent structured schemas would still require global mutation. +### Create one isolated service graph per agent + +Service isolation chooses one registry instance, while agent composition needs a merged view of deployment globals plus one agent layer. Per-agent graphs duplicate adapters and force shared persistence and UI infrastructure to discover every instance. + +Independent applications still deserve separate graphs; collaborating agents inside one deployment do not. + +### Inherit the parent's registrations into a child + +Hierarchical registration inheritance silently copies every parent-scoped tool and policy into the child. A flat child layer plus a parent-owned disposer separates lifetime from composition: the parent owns the child without importing its registrations. + +This choice does not create a parent-subset authority guarantee; registration scope and authorization are different designs. + +### Publish the agent before running setup + +Early publication lets setup find the agent in global registries but lets observers act on a partially configured world. Rollback can remove entries but cannot retract external effects from listeners that already ran. + +The unpublished setup callback already receives `agent.ctx` and `ctx.agent`, so early global lookup is unnecessary. + +### Allow only synchronous setup + +Synchronous setup cannot honestly compose child plugins whose activation is asynchronous. TypeScript also permits a promise-returning callback where a void return is expected, so a synchronous-looking type would not reliably contain accidental async work. + +Awaited setup makes the transaction explicit and keeps first publication and prompt assembly behind it. + +### Validate caller data, then clone it + +Validation followed by a separate clone rereads accessors, so it can approve one value and retain another. A generic JSON clone can also erase or coerce exotic prototypes and unsupported values. The lossless-JSON traversal validates and materializes one captured value in the same operation. + +### Enforce invariants with prepended waterfall listeners + +A prepended listener is not permanently outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace a downstream result. The same defect appears in prompt assembly, tool decisions, result commit, and turn continuation. + +The four owner-final APIs express the exact one-way power required: restore named canonical data, deny monotonically, observe immutable final outcome, or stop after ordinary continuation folding. + ### Put agent-scope policy inside vendored Cordis -Cordis already provides derived contexts, effect-owning fibers, and receiver-based listener filtering, so the harness-level primitive composes those mechanisms instead of teaching the framework about agents, tools, prompts, or global-plus-scope resolution. The implementation does harden Cordis's domain-neutral lifecycle substrate: effects are owner-visible before setup callbacks, child fibers are parent-owned before publication, and an unloading fiber rejects registrations that missed its cleanup snapshot. Those rules are required by every plugin under reentrant HMR, not scope-specific policy pushed into the framework. +Cordis already supplies derived contexts, effect ownership, and receiver-based filtering. The harness-level primitive composes those domain-neutral mechanisms rather than teaching Cordis about agents, tools, prompts, or global-plus-agent merge rules. + +The lifecycle hardening remains correctly inside Cordis because effect pre-registration, parent ownership before child publication, and rejection of late effects protect every plugin under reentrant hot reload, not only agent scopes. ## Consequences -The design makes per-agent composition ordinary and lifecycle-safe at the cost of a small scope runtime and several deliberately narrow final-policy APIs. The complexity is concentrated in services and dispatch helpers rather than repeated in every plugin. +The design buys one composition model across data, behavior, and lifetime. Its cost is per-scope state, transactional lifecycle machinery, owned runtime snapshots, disciplined dispatch, and four deliberately narrow owner-final APIs. ### Benefits -The main benefit is one composition model across data, behavior, and lifetime: registrations follow their context, while service-owned finalizers protect only the invariants that require stronger ordering. +The main benefit is that plugin authors change context, not API. Registries and dispatchers then apply the same agent key across presentation, execution, observation, and cleanup. -- Plugin authors use the same registration APIs globally and per agent; only the context changes. -- Registry-owned prompt schemas, executable lookup, Code Mode bindings, policy listeners, and UI presentation resolve from the same agent view. -- Create and resume expose no partially configured registry entry during awaited setup, and overlapping caller/factory ownership leaves no gap between resume load, preparation failure, and the live lifecycle. -- Agent disposal revokes scoped contributions after the driver and all final or idle-injection session flushes have settled, and retains both public IDs until scope cleanup is quiescent. -- Structured output composes per child without global mutation or listener-order assumptions. -- Existing unscoped plugins remain deployment-wide contributors and observers. +- Global plugins remain deployment-wide contributors and observers. +- Per-agent tools, prompt state, restrictions, and listeners use ordinary registration methods through `agent.ctx`. +- Model-visible schemas, executable lookup, Code Mode bindings, policy, and UI presentation resolve from one agent view. +- Create and resume expose no partially configured registry entry, while caller and AgentLoop ownership cover every await and rollback path. +- Agent teardown preserves the session and scoped listeners through loop exit and final flush, then releases IDs only after scope quiescence. +- Structured output composes independently per child without global mutation or middleware-order assumptions. ### Costs and constraints -The costs are concentrated in dispatch discipline, per-scope registry state, and owner-final decision boundaries that are intentionally stronger than ordinary middleware. +The costs correspond to the four governing questions rather than one hidden framework abstraction. -- Every scoped event dispatcher must carry the correct receiver; fused helpers, type markers, invariants, and gates exist because omission would otherwise deliver only to global listeners. -- `agent.ctx` is service-bearing. Its available services come from the agent loop's injected context, so holders receive that deliberate dependency surface; this is not confinement. -- Registries maintain per-scope maps and perform a global-plus-one-layer merge for the agent lifetime. -- The dispatch carrier is proxy-shaped and not identity-equal to its subject, even though method calls and property access behave like the subject. Its composed filter is frozen, and defining a property through the carrier requires an explicitly configurable descriptor because the extensible surrogate cannot truthfully expose a new non-configurable subject property. -- Flat scopes do not inherit parent registrations; a desired child-local contribution must be global or explicitly registered for the child. -- `run_code` is protected transport infrastructure rather than a filterable end capability, so a policy that must forbid programs denies execution at the tool-policy layer instead of removing the transport from a Code Mode prompt. -- Prompt protection restores named canonical contributions and their anchor placement, not the entire assembly; unprotected output remains extensible, while a globally protected section name is deliberately unavailable for scoped shadowing. -- Terminal turn stopping can discard pending steering. That control is appropriate for owner-enforced terminal protocols and too strong for ordinary cooperative continuation policy. -- Programmatic `ctx.agents.create()` and `ctx.agents.resume()` are asynchronous because they await setup. The direct no-setup `ctx.agentLoop.create()` path, used by configuration and programmatic callers that already have complete options, remains synchronous. -- A programmatic agent is caller-owned but also structurally owned by its concrete AgentLoop provider. Reloading that provider tears the agent down even if a consumer still holds its handle, because the handle cannot keep the provider's dependency surface valid. -- Ordered composition requires exact raw effect identities plus shared public quiescence promises; the dual surfaces and lifecycle-long owner sentinels reflect distinct Cordis nesting and repeated-caller requirements. +- **Registration and delivery:** registries maintain global and per-scope state; every scoped dispatcher must carry the real subject's key; the carrier is proxy-shaped and not identity-equal to its subject. +- **Lifecycle:** programmatic `create()` and `resume()` are asynchronous; caller sentinels, AgentLoop trackers, reservations, publication barriers, and shared quiescence promises cover construction and teardown races. +- **Boundary ownership:** public values are copied, frozen, bound, or retained by identity at their acceptance boundary; data that the boundary's owned representation cannot preserve fails instead of being coerced. +- **Owner-final policy:** prompt protection can reserve names, guards can only deny, final result observers cannot transform, and terminal stop may discard steering. +- **Flat scope:** a desired child-local contribution must be global or registered explicitly for the child; parent ownership alone does not import registrations. +- **Code Mode:** `run_code` remains protected transport infrastructure, so policy that forbids programs denies execution rather than removing the transport from an SDK-based prompt. + +The direct no-setup `ctx.agentLoop.create()` path remains synchronous for configuration and callers that already have complete options. Programmatic registry create/resume use the full unpublished transaction. ### Deliberate boundaries -The scope primitive is generic, but this decision applies it only where one agent needs a coherent registration view: tools, prompt state, scoped events, sessions, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and other registries retain their existing seams until their own designs explicitly adopt the context rule. +The decision applies registration scope to tools, prompt state, scoped events, sessions, approvals, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and other registries retain their existing subject or policy seams until their own designs adopt the rule. -Security hardening remains separate design work; the [security and authority non-goals](#security-and-authority-are-explicit-non-goals) define this RFC's trust boundary without turning registration scope into an authorization model. +Security hardening remains separate work. This design does not sandbox same-process plugins, derive child authorization from a parent, freeze a grant set at agent creation, or introduce generic capability/output/termination tags. Those requirements need an explicit authority model rather than additional meaning attached to registration scope. From 7e3d46a3ceb0b0b32a42d2de843d770ed24ec967 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 13:25:04 +0800 Subject: [PATCH 11/21] docs(scope): split contract from runtime design --- docs/core-data-structures/scope.md | 2 +- docs/rfc/INDEX.md | 1 + .../2026-07-08-agent-scope-contexts.md | 1140 +---------------- .../2026-07-12-agent-scope-runtime-design.md | 969 ++++++++++++++ .../feature/2026-07-05-dynamic-workflows.md | 11 +- packages/core/agent/README.md | 2 +- 6 files changed, 1045 insertions(+), 1080 deletions(-) create mode 100644 docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md diff --git a/docs/core-data-structures/scope.md b/docs/core-data-structures/scope.md index d2a2fc47d4..9ccbfcc1fe 100644 --- a/docs/core-data-structures/scope.md +++ b/docs/core-data-structures/scope.md @@ -1,6 +1,6 @@ # Scoped Registration -The [scope package](../../packages/core/scope) supplies the identity and carrier vocabulary that makes one registration context mean both per-agent visibility and shared lifetime ownership. It is a library primitive rather than a Cordis service; the [agent-scope RFC](../rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md) owns the design rationale, while the package [README](../../packages/core/scope/README.md) owns the callable API and filtering semantics. +The [scope package](../../packages/core/scope) supplies the identity and carrier vocabulary that makes one registration context mean both per-agent visibility and shared lifetime ownership. It is a library primitive rather than a Cordis service; the [agent-scope runtime-design RFC](../rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md#scope-mechanism-context-key-and-lifetime) owns the implementation rationale, while the package [README](../../packages/core/scope/README.md) owns the callable API and filtering semantics. Source: [`packages/core/scope/src/index.ts`](../../packages/core/scope/src/index.ts). diff --git a/docs/rfc/INDEX.md b/docs/rfc/INDEX.md index 454997ef1f..5e508344fa 100644 --- a/docs/rfc/INDEX.md +++ b/docs/rfc/INDEX.md @@ -133,6 +133,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand; | [A shared timeout/deadline primitive, with hard-kill left to each capability](implemented/architecture/2026-07-06-timeout-deadline-library.md) | 2026-07-06 | | [Tool-call timeout policy as a plugin](implemented/architecture/2026-07-07-tool-call-timeout-policy.md) | 2026-07-07 | | [The agent is a registration scope](implemented/architecture/2026-07-08-agent-scope-contexts.md) | 2026-07-08 | +| [Agent-scope runtime design and correctness](implemented/architecture/2026-07-12-agent-scope-runtime-design.md) | 2026-07-12 | ### Process diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 9707d550f2..9f380e6dc1 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -4,41 +4,43 @@ Status: implemented ## Problem -One application needs to share infrastructure across many agents while giving each agent a coherent local world. Model adapters, persistence, user interfaces, and most tool implementations belong to the deployment; personas, visible tools, live policy, and cleanup often belong to one agent. +One application needs to share infrastructure across many agents while giving each agent a coherent local world. Model adapters, persistence, user interfaces, and most tool implementations belong to the deployment; personas, visible tools, live policy, event listeners, and cleanup often belong to one agent. -This is a composition problem, not an application-isolation problem. A separate service graph per agent duplicates too much shared infrastructure, while one global registration graph lets agent-specific contributions leak across agents. +A separate service graph per agent duplicates shared infrastructure. One global registration graph has the opposite failure: an agent-specific tool, prompt section, restriction, or listener can leak into unrelated agents. Contributors need one way to compose local behavior without learning a different registration API for every service. -| Question | Required behavior | Failure without it | -|---|---|---| -| What participates? | Each operation sees deployment-global contributions plus the contributions for its agent | A child-only tool, prompt, or listener affects unrelated agents | -| When does that world exist? | The complete agent world appears only after setup and remains until work and cleanup reach quiescence | Observers see partial setup, or final work loses its scoped policy | -| Which value is authoritative? | Validation, execution, logging, and observation use the same accepted data | Mutable inputs pass one check and produce different behavior later | -| What may extensions override? | Ordinary middleware stays extensible, while a few protocol invariants finish at owner-controlled boundaries | Listener order removes required prompt state, re-allows denied work, commits a failed result, or forces an extra model step | - -In-process subagents expose all four requirements at once. Two concurrent children can request different personas, tool filters, and structured-result schemas; each child must receive its own complete view, publish only after that view exists, preserve the exact accepted request, and keep terminal structured-output rules stronger than unrelated middleware. +The mechanism also needs a clear lifetime. An agent must not become visible before its local registrations exist, and final loop work must not lose those registrations before it settles. Parent-owned subagents make both failures easy to trigger because several differently configured agents can exist concurrently inside one application. ## Decision -Every live agent owns one flat registration layer through `agent.ctx`. Four matching rules make that layer coherent: registration and dispatch select the agent view, lifecycle publishes and revokes the view transactionally, acceptance transfers caller data into owner-controlled records, and four narrow owner-final checkpoints preserve invariants after extensible middleware. +Every live agent owns one flat registration layer through `agent.ctx`. Code registers through the context that owns the contribution; scope-aware services resolve deployment-global registrations plus exactly one matching agent layer; scoped events route by the operation's real agent; and the layer is published and revoked with the agent lifecycle. -| Governing question | Decision | Guarantee | +A Cordis **context** is the object through which code accesses services and registers owned effects. The [Cordis primer](../../../cordis-primer.md) explains the framework beyond that concept. + +The contract has four parts: + +| Contributor question | Contract | +|---|---| +| Where do I register agent-local behavior? | Use the ordinary service API through `agent.ctx` | +| What does an agent see? | Deployment globals plus its own layer, with service-specific merge rules | +| Which scoped listeners run? | By default, unscoped listeners plus listeners for the operation's agent; an explicit global-listener exception is described below | +| How long does local behavior exist? | Assembled during unpublished setup, observable only after creation succeeds, and retained through quiescent teardown | + +The scope is deliberately flat. Resolution never walks parent or sibling scopes. Parent ownership links lifetimes without importing registrations. + +The companion [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains how the implementation preserves this contract under Cordis dispatch, JavaScript mutation and reentrancy, asynchronous setup, rollback, and racing disposal. + +### Registration origin selects visibility and cleanup + +A contribution made through a plain plugin context is deployment-global and is disposed with that plugin. The same method called through `agent.ctx` contributes only to that agent and is disposed with the agent scope. + +| Registration origin | Registration layer and default audience | Disposed with | |---|---|---| -| What participates? | Resolve deployment globals plus exactly one agent layer; route scoped events by the operation's real agent | Data and behavior use the same flat agent view | -| When does it exist? | Treat scope, session, registry entry, and driver as one caller- and agent-factory-owned transaction | Setup is unpublished; teardown drains before revocation | -| Which value is authoritative? | Read caller-owned fields once, validate that capture, and retain only owner-controlled identities or snapshots | Checked, executed, logged, and observed values cannot diverge | -| What may extensions override? | Keep waterfalls for cooperation, then place prompt protection, monotonic guards, final result observation, and terminal turn stopping at service-owned boundaries | Extension ordering cannot undo protocol invariants | +| Plain plugin context | Deployment-global; eligible for every agent view, subject to service merge and restriction rules | Registering plugin | +| `agent.ctx` | Agent-local; visible to that agent by default | Agent scope | -The scope is deliberately flat. An agent resolves deployment-global registrations plus its own registrations; it never traverses parent or sibling scopes. Parent ownership links lifetimes without importing the parent's registration layer. +This applies to tools, prompt sections and variables, restrictions, protections, guards, and scoped event listeners. Named scoped values ordinarily shadow same-named global values; an owning service may reserve a protected name and reject the shadow instead. Duplicate names within one layer fail. Event listeners have the explicit `{ global: true }` audience exception described below. -This is a composition boundary, not an authority boundary. Agent scopes compose trusted in-process registrations; they do not sandbox plugins or define a parent-to-child authority lattice. A plugin holding a Cordis context runs in the same process and can call the services injected into that context. Scope selection answers which registered contribution participates and who cleans it up, not whether a child can do no more than its parent. - -The detailed consequences for tool filters, future global registrations, and child-local tools appear under [the tool-view contract](#the-tool-view-is-live-and-executable). Security hardening requires a separate authority representation and enforcement boundary. - -### Worked example: one agent-local reviewer - -Agent setup uses ordinary registration methods through `agent.ctx`; the context determines visibility and cleanup together. In these focused examples, `ctx` is a plugin service context, `setup(agentCtx)` receives the unpublished agent's scoped context, and helpers such as `AgentId`, `SessionId`, and `CallId` construct opaque IDs. - -Assume the deployment already registered global `read` and `bash` tools. This creates a reviewer whose persona, filtered global tools, and reporting tool exist only for that agent and disappear with its handle: +The public pattern is ordinary registration inside `setup`: ```js const reviewSummaryTool = { @@ -66,204 +68,50 @@ const handle = await ctx.agents.create({ }) const reviewer = handle.agent -ctx.tools.get('read', reviewer) // global tool, visible -ctx.tools.get('bash', reviewer) // undefined: filtered global tool +ctx.tools.get('read', reviewer) // global and allowed +ctx.tools.get('bash', reviewer) // undefined: filtered global ctx.tools.get('review_summary') // undefined: not global -ctx.tools.get('review_summary', reviewer) // reviewer-only definition +ctx.tools.get('review_summary', reviewer) // reviewer-local await handle.dispose() -ctx.tools.get('review_summary', reviewer) // undefined: scope was unwound +ctx.tools.get('review_summary', reviewer) // undefined: scope is gone ``` -The remaining sections descend from this contract. +### The operation selects the view -## Reader model: domain terms and Cordis mechanics +Registration origin and operation subject are separate facts. Calling a read method through `agent.ctx` does not implicitly select that agent; lookup, execution, prompt assembly, and event dispatch still receive the agent or scope they act for. -Readers need four domain terms and four Cordis mechanics to follow the implementation. Readers already familiar with this codebase and Cordis can skim this section. +For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope requests the global view. `ctx.tools.get(name, agent)` and `ctx.tools.execute({ ..., agent })` select that agent's tool view explicitly. This lets one shared service act for any agent without binding the service instance itself to one scope. -### Recurring domain terms +`agent.ctx.agent` is the associated agent for setup code, but it is not a general scope-selection shortcut. Contributors creating nested generic scopes use the nearest scope tag as the registration key; inheriting an `agent` property does not import the outer registration layer. -Four domain terms keep the rest of the RFC compact. A **Session** is an agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** is the JSON subset that can be copied without changing meaning: primitives, dense arrays, and plain objects; cycles, sparse arrays, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols are rejected. An **end capability** is an actual callable tool implementation, whether the model sees it as a native schema or a Code Mode binding. **Code Mode** gives the model a generated SDK and a reserved `run_code` transport instead of advertising every end capability as a native wire tool. +### Scoped events follow the operation's real subject -### Four Cordis mechanics +By default, an event about agent A reaches unscoped listeners and A-scoped listeners, not B-scoped listeners; agent-less dispatch reaches only unscoped listeners. Product helpers and service-owned paths couple the routing key to the value the operation already owns—such as `ToolExecution.agent`, `ApprovalRequest.agent`, the prompt assembly scope, or the session's captured owner. Advanced code that constructs a low-level carrier or assembly context directly must keep its subject and scope fields aligned; development invariants detect mismatches, but the low-level types do not make every mismatch unrepresentable. -Contexts select service access and registration origin, fibers own effects, waterfalls provide cooperative transformation, and dispatch receivers select listeners. +Cordis listeners have one explicit exception. `{ global: true }` bypasses contextual filtering, so a listener registered through `agent.ctx` can observe other agents and subjectless dispatches while its cleanup still belongs to that agent scope. Use it only for deliberate cross-scope observation. -| Cordis concept | Meaning in this RFC | -|---|---| -| Context | The object through which a plugin reaches services and registers contributions; a derived context can carry a different registration scope | -| Fiber and effect | The runtime owner and one owned piece of setup/cleanup; disposing the fiber unwinds its effects | -| Waterfall | Ordered around-middleware whose listener calls `next()` to include downstream work and may transform or short-circuit the result | -| Dispatch receiver | The `this` object used by Cordis listener filtering; a scope carrier encodes the operation's agent key | +Registry-membership notifications remain unfiltered because they describe shared registry state rather than an operation for one agent. The generated [event catalog](../../../cordis-catalog/events.md) is the exhaustive reference for event signatures and modes. -#### Context selects both service access and registration origin +### Creation publishes after setup; disposal revokes after work stops -A Cordis `Context` is the object through which code calls services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service can recover the context through which it was accessed, so the same method can register globally from a plain plugin context or locally from `agent.ctx` without adding an `agent` option to every registration API. Cordis implements contextual service access with a **traced receiver**: a proxy that carries the accessing context while forwarding calls to the concrete service object. +`ctx.agents.create()` and `resume()` construct an unpublished agent. Their optional `setup(agentCtx)` callback may await child-plugin activation and register the complete local world. During setup, neither the agent nor its session is visible in the public registries, and driving methods reject. -```js -ctx.tools.register(globalTool) -agent.ctx.tools.register(agentOnlyTool) +The returned promise resolves only after setup, ordered lifecycle notification, and loop start succeed. Setup failure or owner loss rolls the unpublished world back and releases its IDs. A caller therefore never receives a handle to a partially configured agent. -ctx.on('tools/result', globalObserver) -agent.ctx.on('tools/result', agentObserver) -``` +`AgentHandle.dispose()` performs the reverse boundary. It stops and drains the loop, preserves the session and scoped listeners through final events and flushes, detaches the agent and session, unwinds the scope, and releases IDs. Repeated or racing calls join the same completion promise. -A context also exposes the dependency view injected into the plugin that minted it. `agent.ctx` therefore carries the agent loop's deliberate service surface; it is not an ambient root context or a security boundary. +The calling Cordis context and AgentLoop are structural co-owners. Unloading either disposes the agent, so creation through a short-lived plugin context intentionally gives the agent that shorter lifetime. -#### Effects make cleanup follow ownership +Contributors should put agent-local activation inside `setup` and always dispose the returned handle. Code that needs to observe a live agent waits for `create()`/`resume()` to resolve rather than polling the registries during setup. -An effect is setup whose cleanup belongs to a fiber. Tool registration, prompt contribution, event subscription, and an agent scope are effects, so normal disposal, failure, and hot module reload all follow the same ownership graph. +## Tool restrictions resolve against a live flat view -```js -ctx.effect(() => { - const resource = openResource() - return async () => { - await resource.close() - } -}) -``` +A tool restriction filters the live deployment-global end-capability layer, after which scope-local tools are added. `allow` retains named globals, `deny` removes named globals, multiple restrictions intersect, and a hidden global tool is absent from both registry presentation and executable lookup. -Cordis also supports generator effects that nest child effects in a chosen teardown order. The lifecycle section explains why construction must become owner-visible before arbitrary callbacks run. +Filter presence is explicit: omitting a filter installs no restriction, `restrict({})` rejects, and `allow: []` deliberately hides every global end capability. -#### Waterfalls remain cooperative extension points - -A waterfall listener wraps downstream work. Calling `next()` includes the remaining listeners and base implementation; returning directly skips that downstream portion. - -```js -ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { - const downstream = await next() - return { - ...downstream, - sections: [...downstream.sections, extraSection], - } -}) - -ctx.on('system-prompt/assemble', async () => replacementAssembly) -// The direct return skips this listener's downstream/base. An outer listener -// that already awaited next() still resumes around replacementAssembly. -``` - -This flexibility is intentional for ordinary policy, but it cannot express a fact that must remain true after every wrapper and short-circuit. [Owner-final policy](#owner-final-policy-four-narrow-boundaries) adds only the four final checkpoints that need stronger semantics. - -#### Dispatch receivers select scoped listeners - -Cordis filters listeners using the dispatch receiver, the object visible as `this` inside a function-style listener. `dsh-scope` builds a receiver carrying the operation's scope key, allowing global listeners plus listeners registered for that exact key while rejecting other agents' listeners. - -The receiver is live coordination state, not durable session data. For example, `tools/result` is a live final-outcome notification, while `tool/result` is an append-only session event used for replay and model history. - -## Registration and delivery: global plus exactly one agent layer - -One scope key controls both registered data and registered behavior. Reads combine the deployment-global layer with exactly one agent layer, while scoped event dispatch admits global listeners plus the listeners for that same agent. - -Scope keys are opaque objects compared by identity; a live `Agent` is its own registration key. There is no name-based equality or parent traversal. - -### Scope mechanism: context, key, and lifetime - -The registration context selects the layer, the scope primitive binds that layer to cleanup, and the nearest scope tag—not an inherited convenience property—selects the key. - -#### The calling context selects visibility and cleanup - -A contribution made through a plain plugin context is visible to every agent and disposed with that plugin. A contribution made through `agent.ctx` is visible only to that agent and disposed with its scope. - -| Registration origin | Visible to | Disposed with | -|---|---|---| -| Plain plugin context | Every agent | Registering plugin | -| `agent.ctx` | That agent only | Agent scope | - -The table describes ordinary registrations. Cordis listeners alone have an explicit `{ global: true }` bypass: it suppresses contextual filtering, so a listener registered through `agent.ctx` can receive other agents' and subjectless dispatches while its cleanup still belongs to that agent scope. Cross-scope observation must opt into this bypass deliberately. - -Named scoped contributions shadow same-named global contributions. This is how a child persona replaces `deployment:persona` and how one agent can use a different implementation under the same tool name. Duplicate names within one layer still fail loudly. - -```text -resolveLayer(agentA): - visible = copy(global registrations) - visible.overlay(registrations from agentA.ctx) - return visible -``` - -There is no ancestor loop. Resolving for agent A never reads parent or sibling layers. - -#### The scope primitive keeps layer and owner together - -`dsh-scope` exposes only the operations needed to mint a tagged ownership layer, read its key, target dispatch, and reach quiescent cleanup. A separate `{ scope }` option on each registry could express “visible to A, disposed with B”; the scoped context makes that mismatch unrepresentable. - -| Operation | Responsibility | -|---|---| -| `createScope(context, key)` | Mount an ownership fiber and return its tagged context | -| `scopeOf(context)` | Read the nearest inherited scope key | -| `scopeTarget(subject, key)` | Build the receiver for scope-filtered dispatch | -| `Scope.dispose()` | Return one shared idempotent promise that reaches cleanup quiescence | -| `Scope.rawDispose` | Expose the exact Cordis disposer for ordered generator composition | - -`Scope.dispose()` and `rawDispose` serve different callers. Cordis raw disposers are single-shot, so a repeated raw call need not wait for an earlier asynchronous teardown; the public method follows the backing fiber's in-flight cleanup and gives racing callers the same completion promise. Generator lifecycles use `rawDispose` because Cordis recognizes nested ownership by exact disposer identity. - -The primitive has one essential shape: - -```text -createScope(parentContext, key): - fiber = mount no-op plugin under parentContext - scopedContext = derive fiber.context with nearest-scope-tag = key - - rawDispose = fiber's exact disposer - dispose = memoized operation that: - invoke rawDispose if teardown has not started - follow fiber's in-flight cleanup until quiescent - - return { ctx: scopedContext, rawDispose, dispose } -``` - -Derived contexts inherit the nearest tag. Mounting a plugin under `agent.ctx` preserves the agent scope; deliberately creating another scope replaces the tag below it. - -#### `ctx.agent` is an association; `scopeOf()` selects the layer - -`agent.ctx.agent` gives setup code convenient access to the associated agent, but the nearest scope tag remains authoritative for resolution. A nested scope can inherit the ergonomic `agent` property while replacing the registration key. - -```js -const auditKey = {} -const auditScope = createScope(agent.ctx, auditKey) - -auditScope.ctx.agent === agent // true: inherited association -scopeOf(auditScope.ctx) === auditKey // true: nearest registration key - -await auditScope.dispose() -``` - -This separation keeps the generic scope package independent of the agent package. - -### Resolution contracts preserve domain semantics - -The shared scope selects two layers, but each registry retains its own merge rules and must keep presentation, lookup, and execution coherent within the view it owns. - -#### Registries retain domain-specific merge rules - -The shared primitive answers “which layer?” and “who owns cleanup?”; each service still defines how its values combine. Prompt sections, variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive. Tool lookup and execution receive an agent or scope explicitly, while prompt assembly receives an `AssembleContext` whose `scope` selects the layer. - -Calling a read method through `agent.ctx` does not silently choose an agent subject. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global view. Registration origin and operation subject remain explicit, allowing one shared service to act for any agent. - -#### The tool view is live and executable - -Within `ToolRegistry`'s contribution, presentation, lookup, execution, Code Mode bindings, timeouts, inspection, and UI rendering all consume one resolved view. The registry filters the live global layer, overlays scope-local tools, and then adds reserved presentation transport when the configured mode requires it. - -```js -ctx.tools.register(readTool) -ctx.tools.register(bashTool) - -agent.ctx.tools.restrict({ allow: ['read'] }) -agent.ctx.tools.register(reviewSummaryTool) - -ctx.tools.get('read', agent) // visible global definition -ctx.tools.get('bash', agent) // undefined: filtered global definition -ctx.tools.get('review_summary', agent) // visible scope-local definition -ctx.tools.get('review_summary') // undefined: absent globally -``` - -Executing `bash` for this agent follows the same lookup and returns the ordinary unknown-tool error. A hidden global implementation therefore cannot remain callable through a second registry. - -Final prompt assembly remains extensible beyond `ToolRegistry`. A lower-level `systemPrompt.tools()` provider or assembly listener may add an unrelated wire schema; that extension then owns the matching executable behavior and ordering. The one-view guarantee covers the registry-owned schemas, SDK bindings, lookup, execution, and presentation—not arbitrary schemas contributed elsewhere. - -A restriction filters only the global end-capability layer. `allow` keeps named global tools, `deny` removes named global tools, multiple restrictions intersect, and scope-local tools are merged afterward. The filter values are captured when registered, but resolution uses the live global registry: - -Filter presence is explicit: omitting a filter installs no restriction, `restrict({})` rejects as ambiguous, and `allow: []` deliberately hides every global end capability. +Because globals are live, allow- and deny-lists intentionally differ when a new global tool appears: ```text at time 0: @@ -276,902 +124,48 @@ after registering global tool web: allow { read } view = { read } ``` -The flat child relationship follows directly: +Scope-local tools are merged after the filter. A local tool can therefore exist even when it is absent from an allow-list over globals. This is composition behavior, not an authorization promise. -```text -global tools = { read, bash } -parent restriction = allow { read } -parent scoped registrations = { delegate } -child restriction = none -child scoped registrations = { deploy } +Reserved Code Mode presentation is not part of the filterable end-capability layer. The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns the `run_code`, SDK, `toolOrder`, and presentation-versus-execution contracts; contributors changing Code Mode behavior follow that decision rather than inferring new authority semantics from agent scope. -visible(parent) = { read, delegate } -visible(child) = { read, bash, deploy } -``` +## Security and authority are explicit non-goals -Through `delegate`, the parent can ask the child to perform work with `bash` or `deploy`. This is why registration scope is not an authority ceiling. A deployment that needs parent-to-child non-escalation requires a separate authorization model, including authority representation, propagation, and execution checks. +Agent scopes compose trusted in-process registrations. They do not sandbox plugins, define a parent-to-child authority lattice, freeze a creation-time grant set, or guarantee that a child can do no more than its parent. A plugin holding a Cordis context runs in the same process and can call the services injected into that context. -`run_code` is a reserved presentation transport rather than an end capability. Restrictions cannot remove it, scope-local tools cannot shadow it, and configuration cannot explicitly allow or deny it. In Code Mode the transport remains available while its generated SDK contains only the end capabilities visible to the agent. Without that exception, a filter could leave SDK declarations in the prompt but remove the only invocation path. +A parent can own a child whose visible tool set is wider than its own. For example, a parent restricted to global `read` can spawn a child with no restriction; the child then sees later global tools plus its own local registrations. The parent owns the child's lifetime but does not donate or cap the child's registration layer. -Two similarly named checks use different universes. `ToolRegistry.knownNames()` exposes the pre-restriction end-capability set so a misspelled restriction fails loudly. The system-prompt provider validates `toolOrder` against a mode-specific set: native mode accepts end capabilities, both mode accepts end capabilities plus `run_code`, and code mode accepts only `run_code`. Filtering one agent's view does not turn a valid deployment-wide order into a configuration error. +Deployments that need non-escalation require a separate authority representation, propagation rule, and execution check. Authority-versus-visibility ledgers, parent-subset grants, explicit future-grant APIs, and generic capability/output/termination tags are outside this decision. -### Dispatch contract follows the operation subject +## Subagents use the same composition rule -The operation supplies the scope key, and a carrier composes that key with the subject's existing dispatch behavior. Callers cannot provide an independent routing value that might disagree with the payload. +In-process subagents are a consumer of agent scope, not a second scoping model. A child gets a fresh flat layer during unpublished setup; its persona, tool filter, structured-output protocol, and listeners are ordinary registrations through the child's context. Parent teardown, backend teardown, and manual run disposal own the child lifetime without importing the parent's registrations. -#### The operation subject selects the listener set - -An event about agent A ordinarily reaches unscoped listeners and A-scoped listeners, never B-scoped listeners. An agent-less dispatch admits only unscoped listeners. A listener registered with `{ global: true }` is the deliberate Cordis filtering bypass described above. The operation itself supplies the key; callers do not attach an independent scope that could disagree with the payload. - -| Event family | Scope source | -|---|---| -| `agent/*`, including `agent/turn-stop` | Event's agent | -| `approval/request` | `ApprovalRequest.agent` | -| Tool execution events | `ToolExecution.agent`, or no key for an agent-less call | -| `system-prompt/assemble` | `AssembleContext.scope` | -| Session lifecycle/events | Owner scope captured when the session enters the store | -| `subagent/start`, `subagent/end` | Delegating parent agent | - -Registry-membership events such as `tools/change`, `system-prompt/change`, and `SubagentProvider` added/removed events remain unfiltered because they describe shared registry state rather than one agent operation. - -```js -const seen = [] -ctx.tools.register(readTool) -ctx.on('tools/result', () => seen.push('global')) -agentA.ctx.on('tools/result', () => seen.push('A')) -agentB.ctx.on('tools/result', () => seen.push('B')) - -await ctx.tools.execute({ - callId: CallId('read-1'), - name: 'read', - arguments: {}, - agent: agentA, -}) -seen // ['global', 'A'] -``` - -Fused helpers keep values that must agree together. `agentEvents(context, agent)` uses one agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` sets both prompt facts and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur without the original agent context. - -#### The carrier preserves subject behavior - -Function-style listeners receive the carrier as `this`, and agent listeners may call subject methods. The carrier is therefore a proxy that selects listeners while reading, writing, and invoking through the real subject. - -The implementation uses a dedicated surrogate proxy target with an immutable composed-filter slot. It combines the subject context's existing `Context.filter` with the scope predicate instead of replacing it. Methods bind to the real subject; callable carriers preserve call and construct shape; descriptor queries normalize configurable flags as required by Proxy invariants; and definitions through the carrier require an explicitly configurable descriptor. Stable built-in references protect the composed filter from accidental `.call` replacement. - -Those mechanics preserve observable JavaScript behavior, including private-field method identity: - -```js -class Subject { - #count = 0 - increment() { this.#count += 1 } -} - -const subject = new Subject() -new Proxy(subject, {}).increment() // TypeError: proxy lacks Subject's private identity - -const carrier = scopeTarget(subject, subject) -carrier.increment() // works: method is bound to subject -carrier === subject // false: carrier has distinct identity -``` - -Together these constraints keep listener selection correct while preserving the subject behavior listeners expect. - -The TypeScript-only `Scoped` marker requires a carrier at typed dispatch sites. Runtime marks and development invariants cover JavaScript, casts, and direct Cordis dispatch; they detect routing mistakes but do not confine hostile same-process code. - -## Lifecycle: compose privately, publish once, tear down in reverse - -Scope, session, registry entry, and driver form one transaction with two owners. Request fields are captured first; AgentLoop tracking and both identity reservations precede asynchronous work; the caller owns the prepared lifecycle before setup; publication proceeds in synchronous observable phases; and every teardown path reaches one reverse-order quiescence boundary. - -Two services split the public API from the implementation. `AgentRegistry`, reached as `ctx.agents`, stores live agents and is the front door for `create()` and `resume()`. Its registered `AgentFactory` is concretely implemented by `AgentLoop`, which constructs and drives agents using its own injected dependencies. The rest of this section calls that concrete co-owner the **AgentLoop factory**. - -| Phase | Public state | Ownership fact | -|---|---|---| -| Reserve | IDs unavailable to competitors | AgentLoop tracking and exact reservations cover the next await | -| Prepare or load | Persistence data is loading, or session, scope, and driver exist privately | Resume's load sentinel covers persistence; the complete caller lifecycle covers setup | -| Setup | `setup(agent.ctx)` may await and register | Neither ID is published | -| Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | -| Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | - -The public lifecycle is simple: - -```js -const setupGate = Promise.withResolvers() -const agentId = AgentId('reviewer') -const sessionId = SessionId('reviewer-session') -const creating = ctx.agents.create({ - agentId, - sessionId, - agentOptions: { model: 'model-name' }, - async setup(agentCtx) { - await setupGate.promise - agentCtx.systemPrompt.section({ - name: 'deployment:persona', - order: 0, - text: 'Review the change.', - }) - }, -}) - -ctx.agents.get(agentId) // undefined during setup -ctx.sessions.get(sessionId) // undefined during setup -setupGate.resolve() - -const handle = await creating -ctx.agents.get(agentId) === handle.agent -ctx.sessions.get(sessionId) === handle.agent.session - -await handle.dispose() -ctx.agents.get(agentId) // undefined after quiescent teardown -ctx.sessions.get(sessionId) // undefined after quiescent teardown -``` - -### Reservations precede awaiting; lifecycle ownership precedes setup - -AgentLoop tracking and exact identity reservations precede the first await. Resume adds a caller sentinel across persistence loading; create and resume both establish the complete caller-owned lifecycle before invoking setup. - -#### The prepared lifecycle is owned before setup callbacks - -The caller context owns the work it requested and receives the consumer-facing `AgentHandle`. The AgentLoop factory is a structural co-owner because a live agent continues to depend on its injected services. Either owner can deactivate the transaction; both converge on the same lifecycle disposer. - -| Owner mechanism | Covers | Retires when | -|---|---|---| -| Caller lifecycle sentinel | Caller-fiber loss from lifecycle preparation through live lifecycle | Shared lifecycle reaches quiescence | -| Resume load sentinel | Caller-fiber loss across persistence load and lifecycle handoff | Load rollback or the adopted lifecycle reaches quiescence | -| AgentLoop tracker | AgentLoop unload and structural dependency loss | Transaction and lifecycle settle | -| ID reservations | Competing agent/session insertion | Ordered teardown releases both IDs | - -A **sentinel** is an owner-visible effect that follows work whose final disposer is not yet available. It adopts the exact reservation disposers immediately, then follows the complete lifecycle disposer once preparation establishes it. - -Cordis must make construction owner-visible before setup can reenter teardown. An effect's cleanup wrapper enters its owner list before its setup body runs, a child fiber receives its parent-owned disposer before Cordis's child-plugin notification (`internal/plugin`) announces it, and a fiber already unloading rejects new effects after taking its cleanup snapshot. Teardown observers are contained independently so one callback cannot starve peers or interrupt cleanup. These are domain-neutral lifecycle rules; `dsh-scope` uses them by mounting a no-op plugin fiber as the ownership bucket for one scope. - -#### Caller ownership and factory dependency lookup stay separate - -Factory delegation carries two contexts because ownership and dependency origin are different facts. `ownerCtx` is the caller-bound context whose fiber and optional scope own the requested lifecycle. The factory method receiver is the accepted factory traced through that access so the concrete service retains its own injected dependency view. - -```text -callerCtx.agents.create(options) - ownerCtx = context carrying callerCtx's fiber and scope - factoryThis = concrete accepted factory traced through ownerCtx - Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) -``` - -`setFactory()` captures the concrete target and its `createAgent` and `resume` callbacks once. It canonicalizes an already traced service before retracing, avoiding a second proxy layer that would break raw-identity state. Plain factory objects receive the explicit `ownerCtx` without depending on Cordis tracing. - -#### Create and resume reserve identities before awaiting - -Programmatic create and resume reserve both agent and session IDs before any operation can await. Create prepares a new or seeded session; resume loads persisted data while a caller sentinel and AgentLoop load tracker already own the interval in which no `Agent` object exists. - -Reservations are capabilities, not advisory sets. Setup code cannot reserve, prepare, create, register, or enter a substitute under the same IDs. A session reservation prepares at most one exact object, and publication requires the matching factory-held capabilities. A failed or abandoned transaction therefore cannot publish a substitute or wedge an ID indefinitely. - -Resume transfers ownership rather than opening a gap: - -```text -resume(ownerCtx, request): - snapshot request identity, options, and setup callback - reserve agentId and sessionId - install caller sentinel adopting both reservation disposers - track load under AgentLoop - - persisted = await firstOf(persistence.load(sessionId), deactivated) - session = sessionReservation.prepare(reconstruct persisted data) - starting = startOwned(ownerCtx, session, reservations, setup) - caller sentinel follows starting.dispose - return await starting.result -``` - -If deactivation wins, a backend load may still settle internally but has no path back to publication. Preparation failure still returns a rollback-backed lifecycle result, so both owners can wait for actual cleanup instead of mistaking a rejected async result for successful installation. - -### Setup composes an unpublished world - -`setup(agentCtx)` may register tools, prompt state, restrictions, listeners, protections, or child plugins and may await their activation. The new agent is available as `agentCtx.agent`, but neither agent nor session is visible in its global registry. - -The complete rollback skeleton exists before setup runs. If setup throws, rejects, or loses either owner, the scope and prepared resources unwind and the IDs become reusable. After setup settles, a microtask checkpoint and liveness checks let a same-turn owner unload win before publication. - -Setup composes but cannot drive. `send`, `steer`, `inject`, and `cancel` reject until publication reaches the session-start boundary. The driver lock and inbox use runtime-private state, and only factory-held controls enable and start the loop; JavaScript casts cannot call a public start method or write directly into the queue. - -```text -startOwned(ownerCtx, snapshot, preparedSession): - world = prepareLifecycleWithCompleteRollback(ownerCtx, snapshot, preparedSession) - - result = async: - require world active - await firstOf(snapshot.setup(world.agent.ctx), world.deactivated) - await oneMicrotask() - require caller, factory, owner fiber, and owner agent still active - world.publish(snapshot.source) - return handle(world.agent, world.dispose) - - on any error: - await world.dispose() - rethrow -``` - -### Publication is ordered, observable, and rollback-covered - -Publication is one synchronous sequence with liveness checks between three observable notification phases. Both registry entries exist before the first listener runs, but driving stays locked until immediately before `agent/session-start`. - -1. Enter the session store and capture its scope carrier. -2. Enter the agent registry without announcing it. -3. Recheck caller and factory liveness. -4. Emit `session/created`. -5. Recheck liveness. -6. Emit `agent/created`. -7. Recheck liveness. -8. Enable driving. -9. Emit `agent/session-start`. -10. Recheck liveness. -11. Start the driver. - -```text -publish(world): - world.beginSynchronousPublication() - try: - world.detachSession = sessions.enter(world.session, sessionReservation) - world.detachAgent = agents.enter(world.agent, agentReservation) - require callerAndFactoryActive - sessions.announce(world.session) - require callerAndFactoryActive - agents.announce(world.agent) - require callerAndFactoryActive - world.driver.enableDrivingVerbs() - emitNonVetoing(agent/session-start) - require callerAndFactoryActive - world.driver.start() - finally: - world.endSynchronousPublication() -``` - -#### Creation is paired, not atomic - -Observers run between publication steps, so the sequence is not described as atomic. Effects already performed by an earlier listener cannot be retracted if a later listener throws. Instead, each registry marks a creation announcement as begun before dispatch and emits exactly one matching disposal edge during rollback. An entered object that was never announced has no disposal notification because no observer was told it existed. - -A detach requested during `session/created` or `agent/created` is deferred until that dispatch unwinds. Stable captured carriers and exact-object guards prevent a later listener from observing `disposed` before `created` or a stale detach from deleting a replacement with the same ID. The outer publication barrier likewise prevents caller or AgentLoop teardown from removing the other registry entry or unwinding `agent.ctx` while an announcement remains on the stack. - -Creation listener synchronous throws remain vetoes. Returned promise rejections are observed and logged but not awaited: publication has no asynchronous gap in which such a result could roll back safely. Disposal notifications and `agent/session-start` are non-vetoing and independently contain both synchronous throws and returned-promise rejections so one listener cannot block cleanup or later observers. - -### Teardown stops work before revoking registrations - -Every owner path reaches one memoized reverse-order transaction. It marks the lifecycle inactive, waits for an in-progress synchronous publication phase, stops the driver through actual exit and final durability work, detaches the agent and session, unwinds the scope, and releases IDs last. - -Final turn events, the turn-ending flush, and any outstanding session flush started while the agent was idle therefore run while the session and scoped listeners still exist. `agent/disposed` observes an already quiescent and unregistered concrete agent while its session remains live; `session/disposed` follows after event feed detachment and store removal. Both use the stable carrier captured for their matching creation edge. - -```text -disposeOwnedAgent(world): - mark world inactive - await world.synchronousPublicationIfRunning() - await world.stopDriver() # loop exit plus agent-started flushes - world.detachAgent() - world.detachSession() - await world.scope.dispose() - world.releaseSessionReservation() - world.releaseAgentReservation() -``` - -`AgentHandle.dispose()` gives repeated and racing consumers the same completion promise. The lifecycle-long caller sentinel follows that promise even when handle disposal wins first, while the AgentLoop ledger independently stops new transactions and waits for every structurally dependent agent before the service disappears. - -AgentLoop co-ownership follows dependency shape, not a blanket “creator owns every returned value” rule. An AgentLoop-created agent continues to depend on the loop's services, so AgentLoop unload stops it. - -## Boundary ownership: accept once and own the accepted value - -Acceptance-sensitive boundaries that cross asynchronous, reentrant, model-visible, or durable-log code read caller-owned fields once and retain only owner-controlled identities or snapshots. This rule is independent of TypeScript: `readonly` annotations vanish at runtime, and JavaScript accessors can return a different value on every read. - -The shared shape distinguishes identity-bearing references from data. Agent objects and abort signals are retained by identity after one read. Boundaries whose contract requires lossless JSON—such as session events and subagent payloads—validate and materialize it in one traversal; other boundaries use their own owned representation, such as `structuredClone` for agent options. Scalars and callbacks are captured once, then each boundary applies the validation promised by its API before downstream use. - -```text -accept(input): - read every relevant top-level field exactly once - retain identity-bearing references without rereading them - validate acceptance-time fields from those captures - copy or pin data in the representation owned by this boundary - bind accepted callbacks once when method receiver state is intentional - expose only owner-controlled identities, frozen records, or detached results -``` - -Capture does not imply uniform eager callback type-checking. Agent `setup` is captured once and any invocation failure enters rollback; a tool guard is likewise captured, and an invalid cast becomes a normalized execution error. The invariant is that later work never rereads caller fields to choose a different value. - -| Boundary | Identity retained | Data detached or pinned | -|---|---|---| -| Tool and `SubagentProvider` registration | Original callback receiver | Name, flags, schemas, scalar config | -| Agent create/resume | Caller context, setup callback | IDs, options, session metadata and seed | -| Approval request | Agent and abort signal | Tool name, call ID, and reason | -| Tool execution | Agent, signal, registry-minted parent token | Call identity and arguments | -| Session append/load | Session identity | Header and event envelopes | -| Subagent start/result | Parent and signal | Prompt, filters, schema, options, result | - -Before agent setup can run, the concrete agent pins its accepted ID, options, and session and binds `ctx` once. Registry detach closures likewise close over their accepted keys instead of rereading mutable public fields. - -A stateful getter shows why validation and ownership must use the same capture: - -```js -let reads = 0 -const input = { - get name() { - reads += 1 - return reads === 1 ? 'safe_tool' : 'different_tool' - }, -} - -// Wrong: validation and storage observe different values. -validateName(input.name) -storeName(input.name) - -// Right: one accepted value drives both. -reads = 0 -const acceptedName = input.name -validateName(acceptedName) -storeName(acceptedName) -``` - -### Registered definitions are frozen snapshots - -Tool registration creates the stored definition identity once; changes occur through explicit unregister/register effects rather than mutation of a caller-retained object. Parameters are materialized in one traversal, callbacks bind once to the accepted definition receiver, and the stored record is deep-frozen. - -The first-party `defineTool()` helper applies the same boundary before registration. It captures each option once, materializes the authoring `SchemaSpec`, and derives both the wire schema and later execution/presentation validation from that owned spec. - -```text -defineTool(options): - accepted = read each option exactly once - parameterSpec = snapshotLosslessJson(accepted.parameters) - wireSchema = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) - build execute and presentation validation over parameterSpec - -registerTool(context, definition): - accepted = read each definition field exactly once - stored = deepFreeze({ - accepted name, description, timeout, - parameters: snapshotLosslessJson(accepted.parameters), - execute: bind accepted.execute to definition, - presentation callbacks: bind accepted callbacks when present - }) - layerFor(scopeOf(context)).add(stored.name, stored) -``` - -`get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached projections. Replacing `definition.execute` after registration has no effect, while a callback can deliberately read live state from its closure or original receiver. - -Factory and backend registration use different reentrancy orderings around the same ownership rule. `AgentFactory` registration claims its single slot before reading callback accessors. `SubagentProvider` registration first snapshots the provider fields, then its effect checks and enters the accepted name. Both capture callback identity and intentional receiver state once, and hot-reload cleanup closes over the accepted slot or key instead of rereading a mutable public property. - -### Durable session data belongs to the session - -The session pins its ID and detached, deep-frozen header. Seed and append paths materialize lossless JSON once, validate the event envelope and message-history metadata against that owned record, and deep-freeze the exact accepted event. `session.events` returns a frozen snapshot that never grows later. - -The store keeps append observers, accepted registry IDs, and scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session, redirect `session/event`, or mutate an earlier snapshot into newer history. - -Approval requests follow the same async boundary at smaller scale: one capture preserves exact agent/signal identities, copies scalar fields, captures the session once, and drives `approval/asked`, scoped policy, cancellation, and `approval/decided` from that record. - -### Tool execution has pipeline-owned identity - -`ctx.tools.execute(input)` turns caller-owned input into one pipeline-owned `ToolExecution`. It first reads `callId` and `name` once and requires strings; a failure there rejects because even an error result would lack trustworthy correlation identity. Once those strings are accepted, later input failures can become normal final error outcomes. - -Arguments are materialized once and deep-frozen. The registry assigns a frozen property-free `ToolExecutionToken`; callers cannot choose it. `token`, `callId`, `name`, `arguments`, `agent`, and optional opaque `parent` token become non-writable and non-configurable before policy. `signal` is the only operational field an around-dispatch wrapper may replace or remove. - -```text -prepareExecution(input): - callId = read input.callId exactly once - name = read input.name exactly once - require both are strings - - accepted = read arguments, agent, parent, and signal exactly once - require parent is absent or a registry-minted token - arguments = deepFreeze(snapshotLosslessJson(accepted.arguments)) - - execution = { - token: new frozen property-free object, - callId, name, arguments, - agent: accepted.agent, - parent: accepted.parent, - signal: accepted.signal - } - protect every field except signal - return execution -``` - -Stable execution identity prevents middleware from changing which tool or scope policy accepted. It also gives structured-output commit a safe `WeakMap` key when an adapter reuses a string call ID. Code Mode correlates an SDK sub-call with its enclosing `run_code` using only the outer execution's opaque token, never a mutable reference to the live outer object. - -Result boundaries apply the same ownership rule. Each transform returns data that is captured field-by-field, validated, materialized, and ultimately deep-frozen for final observers; malformed outcomes normalize to JSON-safe error results rather than reaching the session log as apparent success. - -## Owner-final policy: four narrow boundaries - -Waterfalls remain the ordinary extension mechanism; each of four protocol invariants runs after the last extension point capable of violating that specific invariant. Each owner-final API has the weakest one-way power that can preserve its guarantee. - -Here **canonical** means the named registry or tool-schema-provider output assembled before the waterfall—not “all output the service approves.” Protection restores only the names its owner declares. - -| Invariant | Cooperative extension point | Owner-final boundary | Guarantee | -|---|---|---|---| -| Named prompt/tool contribution | `system-prompt/assemble` waterfall | `systemPrompt.protect()` finalization | Canonical presence, absence, definition, and local anchor survive | -| Non-overridable tool denial | `tools/pre-execute` allow/deny/ask waterfall | Synchronous `tools.guard()` | A denial cannot become allow | -| Authoritative live outcome | Execute and post-execute waterfalls | Awaited `tools/result` notification | Observers receive one immutable final result | -| Terminal protocol completion | Continuation waterfall and pending steering | Serial `agent/turn-stop` | No middleware or late steering creates another step | - -### Prompt protection restores named canonical contributions - -`systemPrompt.protect({ sections, tools })` snapshots the requested names and restores their canonical registry or tool-schema-provider output after the complete assembly waterfall. Global and matching scoped protections compose by set union; a waterfall failure still fails assembly rather than triggering recovery. - -Protection covers both presence and absence. If the canonical assembly omits a protected name, finalization removes a listener-fabricated entry; this is how Code Mode keeps a native schema absent while preserving the SDK/transport form. Tool providers likewise expose one captured coherent record for schemas and optional known names, so a stateful getter cannot validate one name and display another. - -#### Global section protection reserves its name - -A globally protected section name cannot be shadowed by a scoped section. Scoped registration under an already protected name fails, and adding protection fails if a scoped shadow already exists. This check occurs before assembly because scoped-over-global merge would otherwise make the shadow itself appear canonical. - -Tool-schema protection does not create a blanket reservation for unrelated schema names. Providers are additive and may deliberately contribute other executable schemas; the owner-final guarantee covers only the named canonical contribution. - -#### Restoration preserves a useful local anchor - -Protection does not reset the whole assembly. It removes protected names from the waterfall result and reinserts each canonical entry before the first surviving later unprotected canonical neighbor, or at the end if none survives. Unprotected entries retain the order and definitions chosen by middleware. - -```text -assemble(context): - assembly = assemble registries for context.scope - canonical = snapshot protected section/tool inputs - transformed = await systemPromptAssembleWaterfall(assembly) - - for each protected canonical name: - remove every transformed entry with that name - if canonical includes the name: - insert before first surviving later canonical neighbor, else append - - return transformed -``` - -Code Mode globally protects `tools:sdk` and reserved `run_code`; structured output adds scoped protection for its instruction and capture schema. - -### Tool guards deny monotonically - -`ctx.tools.guard()` installs a global or scoped synchronous check after the complete `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result. - -Pre-execute hooks still compose ordinary allow, deny, and ask decisions. An ask resolves through the optional approval service, where only `allowed-once` becomes allow and absence or any non-grant becomes deny. Guards run afterward, so listener order cannot convert their denial into dispatched work. - -```js -agent.ctx.on( - 'tools/pre-execute', - async () => ({ kind: 'allow' }), - { prepend: true }, -) - -agent.ctx.tools.guard(execution => - execution.name === 'bash' - ? 'reviewer agents are read-only' - : undefined, -) -``` - -Even a later prepended allow listener cannot bypass the guard. A denied call still becomes an error outcome that flows through result transformation and final observation. - -### `tools/result` observes the final live outcome - -The live pipeline is `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute` → `tools/result`. The first, execute, and post stages are transformable waterfalls; `tools/result` is an awaited observe-only notification after every transform and outer error normalization. - -Every observer receives the same frozen execution and a separate deep-frozen snapshot of the owned result returned to the caller. Listener failures are contained independently, so they cannot change that returned result or starve peers. Routing uses `execution.agent`. - -`tools/result` is not the durable `tool/result` session event. The live notification also fires for direct programmatic executions and is the source of truth for in-process commit logic. The agent loop later appends the durable event for replay, UI reconstruction, and model history. - -```text -execute(input): - accept trustworthy callId and name - try to prepare pipeline-owned execution - on preparation failure: - create an identity-bearing error shell - ownedResult = owned error result - freeze execution - observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) - await every tools/result observer independently with observerResult - return ownedResult - - gate = await tools/pre-execute(execution) - resolve ask through approval when needed - denial = policy denial or first guard denial - - if denied: - result = errorResult(denial) - else: - result = await tools/execute(execution, dispatchRegisteredTool) - - result = await tools/post-execute(execution, result) - ownedResult = normalize into owned lossless JSON - freeze execution - observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) - await every tools/result observer independently with observerResult - return ownedResult -``` - -Waterfalls transform only at their named stages; guards only deny; final observers only observe. - -### `agent/turn-stop` makes continuation terminal - -Steering is input for another model step inside the current turn; queued prompts wait for a future turn. Ordinary continuation remains extensible: the loop computes a default, runs `agent/turn-continuation`, records any force-continue reason as steering, and treats pending steering as a reason to continue. - -The scoped serial `agent/turn-stop` checkpoint runs after that folding. A listener returns `{ action: 'stop' }` or abstains with `undefined`; malformed values and throws close the current turn with an error. A stop is terminal, so later listeners and steering cannot restore continuation. - -The loop uses `strictSerial` because ordinary Cordis serial dispatch treats `null` and `false` as abstentions. This terminal protocol permits only `undefined` to abstain, making accidental return values fail closed. - -Terminal state remains active through `turn/end` and the durability flush. Steering added by continuation, turn-close, or flush listeners is discarded after a terminal stop, while the ordinary queued-prompt FIFO remains untouched. - -```text -afterSuccessfulStep(turn): - decision = await agent/turn-continuation(defaultDecision) - record decision.reason as steering when present - if steering is pending: decision = continue - - terminal = await strictSerial(agent/turn-stop) - if terminal == stop: - discard steering - terminalStopped = true - decision = stop - - append turn/end - await session/flush - - if terminalStopped: - discard steering added by turn/end or flush listeners - else: - move leftover steering to the next-turn queue -``` - -This stronger control is reserved for terminal protocols such as a completed structured child; ordinary continuation policy remains cooperative. - -## Subagents: the composition proof - -In-process subagents add no second scoping model. They create a fresh flat child scope during unpublished setup, install ordinary scoped persona/filter/protocol registrations, own the child through a run handle, and use the same owner-final checkpoints for structured output. - -The roles and phases are explicit: - -| Role | Responsibility | -|---|---| -| Caller | Supplies parent, prompt, optional child configuration, and eventual disposal | -| `SubagentService` | Validates capabilities, owns the public wrapper, normalizes result and lifecycle telemetry | -| `SubagentProvider` backend | Chooses transport and creates one run | -| In-process driver | Owns child creation, setup, prompt drive, result read, cancellation, and teardown | -| Child `Agent` | Uses the ordinary agent lifecycle and its fresh `agent.ctx` | - -```text -accepted start -> started (published) -> result (settled) -> dispose (quiescent) -``` - -Assume the in-process `spawn` backend uses its default name, `parent` is top-level, and global `read` exists: - -```js -const run = ctx.subagents.start('spawn', { - parent, - prompt: [{ type: 'text', text: 'Review this change.' }], - persona: 'You are a careful code reviewer.', - toolFilter: { allow: ['read'] }, - maxDepth: 2, - outputSchema: { - type: 'object', - properties: { summary: { type: 'string' } }, - required: ['summary'], - additionalProperties: false, - }, -}) - -try { - await run.started - const result = await run.result - // result.structured exists only after successful final commit. -} finally { - await run.dispose() -} -``` - -### The child world uses ordinary registrations - -A child persona is a scoped `deployment:persona` section. Its tool filter is a scoped restriction over the live global tool layer. Structured output is a bundle of scoped tool, prompt, protection, guard, and listener registrations. - -```js -let structured -const setup = childCtx => { - if (persona !== undefined) { - childCtx.systemPrompt.section({ - name: 'deployment:persona', - order: 0, - text: persona, - }) - } - if (toolFilter !== undefined) childCtx.tools.restrict(toolFilter) - if (schema !== undefined) { - structured = attachStructuredRuntime(childCtx, schema) - } -} -``` - -The driver creates one run-owner fiber under `parent.ctx` and calls the child factory through it. Parent teardown, `spawn` backend teardown, and manual run disposal reach the same node, but the child still receives a new registration key. Lifetime inheritance therefore does not imply registration inheritance. - -### Structured output is a child-owned terminal protocol - -A structured child registers a real-schema `structured_output` tool and instruction in its own scope. Concurrent children can use different schemas without a global placeholder, reference count, or remove-for-everyone pass. - -Presentation mode changes the invocation route, not ownership: - -| Mode | Advertised invocation route | Canonical wire contribution | Generated SDK | Owner-final guarantee | -|---|---|---|---|---| -| `native` | Native `structured_output` | Visible native schemas, including scoped capture | None | Restore the capture schema and instruction | -| `code` | The `structured_output` SDK binding inside `run_code` | Reserved `run_code`; native capture remains absent | Visible end-capability bindings, including capture | Restore the transport, SDK, native absence, and instruction | -| `both` | Either native capture or its SDK binding | Visible native schemas plus `run_code` | Visible end-capability bindings, including capture | Restore both invocation routes and the instruction | - -Tool mode controls presentation, not an execution allowlist. In code mode, an adapter or direct caller that emits the unadvertised `structured_output` name can still resolve the scoped end capability and takes the native one-stage commit path; a deployment that must forbid that route needs an execution guard. - -An unrelated assembly listener may deliberately add another schema; named protection does not erase unrelated contributions. - -#### Native commits once; Code Mode commits twice - -The capture body validates and stages a cloned value by stable `ToolExecution` identity. The scoped final-result observer commits a native capture only if that exact execution's final result succeeds. - -A schema-validation failure becomes the ordinary `INVALID_ARGS` tool result, so the model can correct the value and call the capture tool again within the same turn. - -```text -structured_output.body(value, execution): - validate value against this child's schema - staged[execution] = clone(value) - return ordinary success - -on tools/result(execution, finalResult): - if execution is staged: - value = staged.remove(execution) - if finalResult succeeded: - captured = value -``` - -For a Code Mode SDK call, successful inner observation records a pending value against the opaque outer `run_code` token. Commit waits for the outer transport's own successful final result because an inner side effect can succeed while the program or its post-policy still fails. - -```text -on tools/result(innerStructuredCall, innerResult): - if innerStructuredCall is staged: - value = staged.remove(innerStructuredCall) - if innerResult succeeded: - pending = { outerToken: innerStructuredCall.parent, value } - -on tools/result(outerRunCodeCall, outerResult): - if pending.outerToken == outerRunCodeCall.token: - value = pending.value - pending = none - if outerResult succeeded: - captured = value -``` - -Once capture is staged against an outer transport or committed, the scoped guard denies later calls in that response. After commit, `agent/turn-stop` ends the turn after ordinary continuation and steering fold. A child that otherwise completes cleanly without a committed capture returns an error rather than being re-prompted; requesting a schema makes output mandatory, not guaranteed. - -### The run protocol separates acceptance, readiness, result, and disposal - -`SubagentService.start()` returns synchronously, but `run.started` is the publication boundary. Callers treat the child as live only after readiness, consume `result`, and always dispose the run. - -Pre-readiness cancellation of an in-process run deactivates the run-owner fiber, prevents publication, rejects `started`, resolves `result` as `aborted`, and emits neither subagent lifecycle edge. - -`SubagentProvider` registration captures name, capability flags, the `inheritsParentContext` conversation-history descriptor, and the bound start callback once. The descriptor says whether completed parent turns seed the child's conversation; it says nothing about scope, services, tools, or authority. - -Starting a run captures every request field once. Parent and abort signal remain identity references; prompt, filter, schema, and options are detached lossless JSON; fixed `persona` and absolute `maxDepth` values validate before backend ownership. The in-process backend separately snapshots its optional session seed, and the service snapshots the terminal result when it settles. - -Depth validation repeats at each public entry while one helper owns the accepted domain: - -```text -tool-subagent plugin load: - assertSubagentMaxDepth(config.maxDepth) - -SubagentService.start(request): - capture and validate request.maxDepth - -startInProcessRun(request): - capture and validate request.maxDepth - parentDepth = validated depthOf(parent) - childDepth = parentDepth + 1 - reject if childDepth is not a safe integer - reject if maxDepth exists and childDepth > maxDepth -``` - -Only `undefined` means parent depth zero. Present depth and cap values must be non-negative safe integers and must not be negative zero; derived overflow rejects even when no request cap exists. - -The service does not expose the backend-owned run handle directly. It captures `id`, `started`, `result`, and methods once; binds methods to that handle; wraps result in one detached frozen record; and installs a shared disposal promise before calling untrusted backend cleanup. Once a callable backend disposer has been captured, a malformed later field triggers rollback; if no callable disposer exists, rollback is impossible and acceptance fails immediately. A backend disposer that directly returns the wrapper's reentrant promise is rejected as a cycle instead of hanging. - -```text -startInProcessRun(backendContext, acceptedRequest): - install backend ownership - attach accepted abort signal - create run-owner fiber under accepted parent.ctx - create child through runOwner.ctx.agents with unpublished setup - - started = child creation publication - result = after started: - send accepted prompt - await child idle - derive owned terminal result - dispose = dispose run owner and await quiescence - -SubagentService.start(...): - backendRun = backend.start(detached request) - serviceRun = freeze accepted id, readiness, bound methods, normalized result - observe result immediately - after readiness: - emit subagent/start, then buffered/eventual subagent/end - on readiness failure: - emit neither lifecycle edge -``` - -The service observes result settlement immediately even while readiness is pending, preventing an early rejection from becoming temporarily unhandled. Lifecycle listeners receive one frozen payload; their throws and returned-promise rejections are contained independently and cannot veto the run. - -## Workflow integration preserves the subagent contract - -The worker workflow bridge preserves the same readiness, terminal-claim, and bounded-cleanup boundaries across a message port. It never announces an unready child, never lets cleanup rewrite an already chosen result, and never suppresses disposal merely because another terminal fact already won. - -The worker executes the workflow script and exchanges protocol messages; the host owns `SubagentService`, which invokes `SubagentProvider` backends and returns normalized run wrappers that the host retains. Their lifetimes follow dependency shape: an AgentLoop-created agent stops when its loop unloads, while a workflow run captures its holder-bound `SubagentService` at start, so unloading the workflow engine prevents new runs without revoking an already returned run. - -Three state dimensions remain separate: - -| Dimension | Question | Winning rule | -|---|---|---| -| Admission | May a worker message still start or announce a child? | Closed admission refuses the exact run and cleans it up | -| Terminal claim | Which external result does the workflow expose? | Earlier accepted external cancellation wins; otherwise first result/death claim wins | -| Physical cleanup | Which registered children and worker resources remain? | Every path may still dispose survivors through per-call gates | - -### Child admission waits for readiness - -After `SubagentService.start()` returns its normalized wrapper, the host registers that exact wrapper before awaiting, attaches result observers immediately, and rechecks admission both then and when `started` settles. A closed boundary claims cancellation and disposal for that exact entry, removes it only when disposal settles, and reports `ChildStartError` only while the worker reply channel remains open. - -The backend's nested `start()` may synchronously reenter workflow cancellation before the service wrapper reaches the host registry. The immediate post-start check and exact-wrapper identity guard close that interval; a backend that later fulfills its own readiness cannot resurrect workflow admission. - -```text -after subagents.start returns its run wrapper: - register exact wrapper for cancellation - observe and snapshot result immediately - if admission closed: refuse and clean exact wrapper - else await run.started - - on ready: - if admission closed: refuse and clean exact run - else send ChildStarted, then buffered/eventual outcome - - on readiness failure: - send ChildStartError only if the worker reply channel remains open - dispose exact wrapper if still registered -``` - -### Each terminal contender claims before its own callbacks - -Each terminal path records the state it owns before invoking its own callback fanout. External `cancel()` records the accepted cancellation reason before invoking child cancellation. On the Result path, the worker queues its `Result` message before settlement cleanup messages on the same port, and the host records the winning result before any Result-triggered abort or cancellation. Reentry therefore observes the fact that already won instead of rewriting it. - -```text -on workflow Result: - cancellationWasAlreadyAccepted = external cancellation is in flight - claim chosen result: - if earlier external cancellation and result is not cancelled: - cancelled result - else: - worker result - - if not cancellationWasAlreadyAccepted: - abort shared child-request signal - cancel every registered child through its at-most-once gate - settle chosen result -``` - -The worker may also send a later `ChildCancel`; host fanout and the worker message share one per-call cancellation gate, so an arbitrary backend's `cancel()` need not be idempotent. Each callback is contained independently. - -### Worker death, exit, and disposal remain separate - -The first worker death signal closes message admission, claims a death result unless an earlier terminal fact won, cancels and disposes registered children, and synthesizes missing lifecycle ends. A queued message can arrive between Node's `error` and `exit`, so the logical admission barrier—not physical exit—prevents late child creation or narration. - -Physical exit performs a final disposal-only sweep without repeating explicit cancellation. A cancellation grace period bounds how long the host waits for cooperative settlement before terminating the worker; a grace result can already be chosen while exit cleanup still needs to dispose surviving child handles. The bound is real: after grace expires, public disposal may return after invoking child disposal and reaping host resources even if a slow backend disposer has not reached quiescence. - -Public `handle.dispose()` claims its shared promise before invoking cancellation or child callbacks. Each `disposeChild` likewise claims its call-ID promise before invoking the backend disposer. Public-first reentry joins the public promise; worker-first reentry lets the holder traversal join the already claimed child promise. Settled `dispose()` still drives a host-side reap before awaiting quiescence, so a fire-and-forget child cannot remain alive merely because workflow result settlement already occurred. - -Together these rules ensure `workflow/agent-start` names only ready children, external result precedence is stable, and every surviving child reaches disposal. - -## Correctness enforcement - -The runtime rule is checked at four escape boundaries: API shape couples related subjects, TypeScript marks typed dispatch, development invariants inspect actual dispatch, and repository gates keep declarations aligned with enforcement. - -### API shape couples values that must agree - -`agentEvents(context, agent)` couples carrier, subject, and first event argument. `assembleContextFor(agent)` couples prompt facts with scope selection. `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered. - -```text -assembleContextFor(agent): - return { agent, scope: agent } - -agentEvents(context, agent): - carrier = scopeTarget(agent, agent) - return dispatcher that always injects agent as the event subject -``` - -These helpers make a mismatch harder to express than the correct spelling. - -### Type markers cover every scoped event declaration - -Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript rejects a bare subject at typed dispatch sites, including subagent lifecycle events scoped to the delegating parent. - -The marker is compile-time only; JavaScript, casts, and direct Cordis dispatch can bypass it. - -### Development invariants inspect actual dispatch - -The invariants plugin observes Cordis's internal dispatch before listener delivery. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. - -Session and subagent payloads do not expose their owner key directly, so their service centralizes key selection and the invariant proves carrier presence. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. - -Dedicated `dsh-scope` unit tests cover the carrier's advanced Proxy behavior: private-field method binding, call/construct shape, primordial filter invocation, own-key/descriptor consistency, and explicit configurable definitions. These are implementation tests, not checks performed by the invariants plugin. - -### Repository gates keep declarations and dispatchers aligned - -`verify-scoped-dispatch` compares declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to name a recognized dispatcher. Source JSDoc generates the [event catalog](../../../cordis-catalog/events.md), which remains the exhaustive signature and mode reference. +`inheritsParentContext` describes conversation-history seeding only, not Cordis scope, service injection, tools, or authority. The [subagent capability RFC](../feature/2026-06-21-subagent-capability-seam.md) owns run usage and the provider contract, while the [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains in-process structured output and workflow race handling. ## Alternatives considered -The rejected designs fail one of the four governing questions: they separate visibility from ownership, choose the wrong isolation unit, expose partial lifecycle, leave accepted values mutable, or rely on extension order for invariants. +The rejected architectures either separate visibility from cleanup, scope only behavior but not registered data, duplicate shared infrastructure, or conflate parent ownership with registration inheritance. ### Pass an agent option to every registration -An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and repeats scope plumbing in every registry. It can also express “visible to A, disposed with unrelated plugin B,” which `agent.ctx` prevents. +An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and repeats scope plumbing in every registry. It can also express “visible to A, disposed with unrelated plugin B,” which registration through `agent.ctx` prevents. ### Filter events while keeping registries global -Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Persona, tool filtering, and concurrent structured schemas would still require global mutation. +Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Agent-local composition would still require temporary global mutation. ### Create one isolated service graph per agent -Service isolation chooses one registry instance, while agent composition needs a merged view of deployment globals plus one agent layer. Per-agent graphs duplicate adapters and force shared persistence and UI infrastructure to discover every instance. - -Independent applications still deserve separate graphs; collaborating agents inside one deployment do not. +Service isolation chooses one registry instance, while the desired view is deployment globals plus one agent layer. Per-agent graphs duplicate adapters and force shared persistence and UI infrastructure to discover every instance. Independent applications still deserve separate graphs; collaborating agents inside one deployment do not. ### Inherit the parent's registrations into a child -Hierarchical registration inheritance silently copies every parent-scoped tool and policy into the child. A flat child layer plus a parent-owned disposer separates lifetime from composition: the parent owns the child without importing its registrations. - -This choice does not create a parent-subset authority guarantee; registration scope and authorization are different designs. - -### Publish the agent before running setup - -Early publication lets setup find the agent in global registries but lets observers act on a partially configured world. Rollback can remove entries but cannot retract external effects from listeners that already ran. - -The unpublished setup callback already receives `agent.ctx` and `ctx.agent`, so early global lookup is unnecessary. - -### Allow only synchronous setup - -Synchronous setup cannot honestly compose child plugins whose activation is asynchronous. TypeScript also permits a promise-returning callback where a void return is expected, so a synchronous-looking type would not reliably contain accidental async work. - -Awaited setup makes the transaction explicit and keeps first publication and prompt assembly behind it. - -### Validate caller data, then clone it - -Validation followed by a separate clone rereads accessors, so it can approve one value and retain another. A generic JSON clone can also erase or coerce exotic prototypes and unsupported values. The lossless-JSON traversal validates and materializes one captured value in the same operation. - -### Enforce invariants with prepended waterfall listeners - -A prepended listener is not permanently outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace a downstream result. The same defect appears in prompt assembly, tool decisions, result commit, and turn continuation. - -The four owner-final APIs express the exact one-way power required: restore named canonical data, deny monotonically, observe immutable final outcome, or stop after ordinary continuation folding. - -### Put agent-scope policy inside vendored Cordis - -Cordis already supplies derived contexts, effect ownership, and receiver-based filtering. The harness-level primitive composes those domain-neutral mechanisms rather than teaching Cordis about agents, tools, prompts, or global-plus-agent merge rules. - -The lifecycle hardening remains correctly inside Cordis because effect pre-registration, parent ownership before child publication, and rejection of late effects protect every plugin under reentrant hot reload, not only agent scopes. +Hierarchical inheritance silently imports every parent-scoped tool and policy. Flat layers plus parent-owned disposal separate lifetime from composition: the parent owns the child without deciding the child's local world. This choice deliberately makes authorization a separate design. ## Consequences -The design buys one composition model across data, behavior, and lifetime. Its cost is per-scope state, transactional lifecycle machinery, owned runtime snapshots, disciplined dispatch, and four deliberately narrow owner-final APIs. +Contributors use the same registration methods at both deployment and agent scope; changing the calling context changes visibility and cleanup together. Model-visible tool lookup, execution, prompt assembly, policy, observation, and teardown agree on one agent key instead of maintaining parallel per-feature scope options. -### Benefits +The cost is explicit subject selection on reads and dispatch, asynchronous programmatic creation, disciplined handle disposal, and awareness that flat registration scope is not authority. Registries retain service-specific merge behavior, and only services that adopt the scope contract become agent-scoped automatically. -The main benefit is that plugin authors change context, not API. Registries and dispatchers then apply the same agent key across presentation, execution, observation, and cleanup. - -- Global plugins remain deployment-wide contributors and observers. -- Per-agent tools, prompt state, restrictions, and listeners use ordinary registration methods through `agent.ctx`. -- Model-visible schemas, executable lookup, Code Mode bindings, policy, and UI presentation resolve from one agent view. -- Create and resume expose no partially configured registry entry, while caller and AgentLoop ownership cover every await and rollback path. -- Agent teardown preserves the session and scoped listeners through loop exit and final flush, then releases IDs only after scope quiescence. -- Structured output composes independently per child without global mutation or middleware-order assumptions. - -### Costs and constraints - -The costs correspond to the four governing questions rather than one hidden framework abstraction. - -- **Registration and delivery:** registries maintain global and per-scope state; every scoped dispatcher must carry the real subject's key; the carrier is proxy-shaped and not identity-equal to its subject. -- **Lifecycle:** programmatic `create()` and `resume()` are asynchronous; caller sentinels, AgentLoop trackers, reservations, publication barriers, and shared quiescence promises cover construction and teardown races. -- **Boundary ownership:** public values are copied, frozen, bound, or retained by identity at their acceptance boundary; data that the boundary's owned representation cannot preserve fails instead of being coerced. -- **Owner-final policy:** prompt protection can reserve names, guards can only deny, final result observers cannot transform, and terminal stop may discard steering. -- **Flat scope:** a desired child-local contribution must be global or registered explicitly for the child; parent ownership alone does not import registrations. -- **Code Mode:** `run_code` remains protected transport infrastructure, so policy that forbids programs denies execution rather than removing the transport from an SDK-based prompt. - -The direct no-setup `ctx.agentLoop.create()` path remains synchronous for configuration and callers that already have complete options. Programmatic registry create/resume use the full unpublished transaction. - -### Deliberate boundaries - -The decision applies registration scope to tools, prompt state, scoped events, sessions, approvals, and in-process subagent composition. `agent.ctx` does not automatically scope every service call; filesystem policy, LLM interception, background subagent state, and other registries retain their existing subject or policy seams until their own designs adopt the rule. - -Security hardening remains separate work. This design does not sandbox same-process plugins, derive child authorization from a parent, freeze a grant set at agent creation, or introduce generic capability/output/termination tags. Those requirements need an explicit authority model rather than additional meaning attached to registration scope. +The decision applies to tools, prompt state, scoped events, session lifecycle and scoped session events, approvals, and in-process subagent composition. Filesystem policy, LLM interception, background backend state, and other registries retain their own subject or policy mechanisms until their designs explicitly adopt agent scope. diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md new file mode 100644 index 0000000000..0fbd3d647e --- /dev/null +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -0,0 +1,969 @@ +# RFC: Agent-scope runtime design and correctness + +Status: implemented + +## Problem + +The [agent-scope contract](2026-07-08-agent-scope-contexts.md) defines the contributor-visible result: registrations made through `agent.ctx` form one flat local layer, operations resolve that layer by their real agent, setup remains unpublished, and teardown preserves the layer until work stops. The implementation must make those claims true inside a cooperative plugin framework and mutable JavaScript runtime. + +Four failure classes interact in the paths this change hardens: + +| Proof obligation | Failure if implemented locally or incompletely | +|---|---| +| Registration and dispatch select the same key | Prompt data resolves for one agent while behavior listeners run for another | +| Construction and teardown have continuous ownership | Reentrant unload publishes a partial world, leaks IDs, or revokes policy before final work | +| Covered validation and later use observe one accepted value | Stateful accessors or caller mutation make checked, executed, logged, and observed data disagree | +| Protocol invariants survive extensible middleware | Listener ordering removes required prompt state, re-allows denied work, commits a failed result, or forces another model step | + +Cordis already supplies derived contexts, effect ownership, receiver-based filtering, and waterfalls, but none alone establishes all four obligations. Context association is not a scope key, raw disposers are not await-idempotent, waterfall listeners can short-circuit or wrap each other, and JavaScript `readonly` types do not constrain runtime accessors. Async persistence, setup, publication callbacks, subagent providers, and worker messages add reentrancy and race boundaries around those primitives. + +## Decision + +The runtime implements agent scope as four coupled mechanisms rather than one generic framework feature: + +| Mechanism | Implementation decision | +|---|---| +| Layer and routing | A scope key tags registration effects; scope-aware contribution registries merge globals plus one layer; dispatch carriers filter listeners by the operation subject | +| Transactional lifetime | Scope, session, registry entry, driver, reservations, caller ownership, and AgentLoop ownership publish and unwind as one ordered transaction | +| Boundary ownership | The hardened acceptance-sensitive paths listed below capture caller fields once and retain stable identities or owner-controlled representations | +| Owner-final policy | Four narrow service-owned boundaries restore named prompt state, deny monotonically, observe final results, and stop terminal turns | + +The same mechanisms carry into in-process subagents and the workflow bridge. Subagents are the composition proof because child setup, structured output, readiness, cancellation, result settlement, and disposal exercise all four obligations concurrently. + +This RFC owns the implementation rationale, algorithms, race handling, and correctness enforcement. The [agent-scope contract](2026-07-08-agent-scope-contexts.md) owns contributor-facing behavior, tool-filter semantics, usage examples, and the security non-goal; this document links to that contract rather than redefining authority or public scope inheritance. + +## Implementation model: domain terms and Cordis mechanics + +Readers need four domain terms and four Cordis mechanics to follow the implementation. Readers already familiar with this codebase and Cordis can skim this section. + +### Recurring domain terms + +Four domain terms keep the rest of the RFC compact. A **Session** is an agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** is the JSON subset that can be copied without changing meaning: primitives, dense arrays, and plain objects; cycles, sparse arrays, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols are rejected. An **end capability** is an actual callable tool implementation, whether the model sees it as a native schema or a Code Mode binding. **Code Mode** gives the model a generated SDK and a reserved `run_code` transport. Pure `code` presentation replaces native advertisement with that interface; `both` presentation retains native schemas alongside it. + +### Four Cordis mechanics + +Contexts select service access and registration origin, fibers own effects, waterfalls provide cooperative transformation, and dispatch receivers select listeners. + +| Cordis concept | Meaning in this RFC | +|---|---| +| Context | The object through which a plugin reaches services and registers contributions; a derived context can carry a different registration scope | +| Fiber and effect | The runtime owner and one owned piece of setup/cleanup; disposing the fiber unwinds its effects | +| Waterfall | Ordered around-middleware whose listener calls `next()` to include downstream work and may transform or short-circuit the result | +| Dispatch receiver | The `this` object used by Cordis listener filtering; a scope carrier encodes the operation's agent key | + +#### Context selects both service access and registration origin + +A Cordis `Context` is the object through which code calls services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service can recover the context through which it was accessed, so the same method can register globally from a plain plugin context or locally from `agent.ctx` without adding an `agent` option to every registration API. Cordis implements contextual service access with a **traced receiver**: a proxy that carries the accessing context while forwarding calls to the concrete service object. + +```js +ctx.tools.register(globalTool) +agent.ctx.tools.register(agentOnlyTool) + +ctx.on('tools/result', globalObserver) +agent.ctx.on('tools/result', agentObserver) +``` + +A context also exposes the dependency view injected into the plugin that minted it. `agent.ctx` therefore carries the agent loop's deliberate service surface; it is not an ambient root context or a security boundary. + +#### Effects make cleanup follow ownership + +An effect is setup whose cleanup belongs to a fiber. Tool registration, prompt contribution, event subscription, and an agent scope are effects, so normal disposal, failure, and hot module reload all follow the same ownership graph. + +```js +ctx.effect(() => { + const resource = openResource() + return async () => { + await resource.close() + } +}) +``` + +Cordis also supports generator effects that nest child effects in a chosen teardown order. The lifecycle section explains why construction must become owner-visible before arbitrary callbacks run. + +#### Waterfalls remain cooperative extension points + +A waterfall listener wraps downstream work. Calling `next()` includes the remaining listeners and base implementation; returning directly skips that downstream portion. + +```js +ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { + const downstream = await next() + return { + ...downstream, + sections: [...downstream.sections, extraSection], + } +}) + +ctx.on('system-prompt/assemble', async () => replacementAssembly) +// The direct return skips this listener's downstream/base. An outer listener +// that already awaited next() still resumes around replacementAssembly. +``` + +This flexibility is intentional for ordinary policy, but it cannot express a fact that must remain true after every wrapper and short-circuit. [Owner-final policy](#owner-final-policy-four-narrow-boundaries) adds only the four final checkpoints that need stronger semantics. + +#### Dispatch receivers select scoped listeners + +Cordis filters listeners using the dispatch receiver, the object visible as `this` inside a function-style listener. `dsh-scope` builds a receiver carrying the operation's scope key, allowing global listeners plus listeners registered for that exact key while rejecting other agents' listeners. + +The receiver is live coordination state, not durable session data. For example, `tools/result` is a live final-outcome notification, while `tool/result` is an append-only session event used for replay and model history. + +## Registration and delivery: global plus exactly one agent layer + +Within services that adopt the agent-scope contract, one scope key controls both registered data and registered behavior. Contribution reads combine the deployment-global layer with exactly one agent layer, while scoped event dispatch admits global listeners plus the listeners for that same agent. + +Scope keys are opaque objects compared by identity; a live `Agent` is its own registration key. There is no name-based equality or parent traversal. + +### Scope mechanism: context, key, and lifetime + +The registration context selects the layer, the scope primitive binds that layer to cleanup, and the nearest scope tag—not an inherited convenience property—selects the key. + +#### The calling context selects visibility and cleanup + +A scope-aware registry method recovers the Cordis context through which its service receiver was accessed and calls `scopeOf(context)` once while installing the registration effect. An absent key selects the global store; a key selects the per-scope store. Cleanup closes over that accepted store and key, so later context mutation or a same-named replacement cannot redirect disposal. Event listeners follow a different Cordis path: `ctx.on()` retains the registering context, and targeted dispatch reads its scope while filtering listeners; `{ global: true }` deliberately bypasses that audience filter without changing cleanup ownership. + +The [public contract](2026-07-08-agent-scope-contexts.md#registration-origin-selects-visibility-and-cleanup) owns the visibility table, shadowing rule, and `{ global: true }` listener exception. Internally, registry resolution overlays one exact identity-keyed map on the global map and never traverses an ancestry relation: + +```text +resolveLayer(agentA): + visible = copy(global registrations) + visible.overlay(registrations from agentA.ctx) + return visible +``` + +The one-overlay algorithm is why the generic primitive needs only opaque identity and effect ownership; parent/child meaning stays outside `dsh-scope`. + +#### The scope primitive keeps layer and owner together + +`dsh-scope` exposes only the operations needed to mint a tagged ownership layer, read its key, target dispatch, and reach quiescent cleanup. For ordinary scope-aware registries, using a separate `{ scope }` option could express “stored in A's layer, disposed with B”; registration through the scoped context makes that mismatch unrepresentable. The `{ global: true }` listener option is an intentional audience exception, and the low-level `scopeTarget(base, key)` primitive still relies on its service-owned caller to supply matching facts. + +| Operation | Responsibility | +|---|---| +| `createScope(context, key)` | Mount an ownership fiber and return its tagged context | +| `scopeOf(context)` | Read the nearest inherited scope key | +| `scopeTarget(base, key)` | Build a scope-filtered dispatch receiver around the existing base receiver | +| `Scope.dispose()` | Return one shared idempotent promise that reaches cleanup quiescence | +| `Scope.rawDispose` | Expose the exact Cordis disposer for ordered generator composition | + +`Scope.dispose()` and `rawDispose` serve different callers. Cordis raw disposers are single-shot, so a repeated raw call need not wait for an earlier asynchronous teardown; the public method follows the backing fiber's in-flight cleanup and gives racing callers the same completion promise. Generator lifecycles use `rawDispose` because Cordis recognizes nested ownership by exact disposer identity. + +The primitive has one essential shape: + +```text +createScope(parentContext, key): + fiber = mount no-op plugin under parentContext + scopedContext = derive fiber.context with nearest-scope-tag = key + + rawDispose = fiber's exact disposer + dispose = memoized operation that: + invoke rawDispose if teardown has not started + follow fiber's in-flight cleanup until quiescent + + return { ctx: scopedContext, rawDispose, dispose } +``` + +Derived contexts inherit the nearest tag. Mounting a plugin under `agent.ctx` preserves the agent scope; deliberately creating another scope replaces the tag below it. + +#### `ctx.agent` is an association; `scopeOf()` selects the layer + +`agent.ctx.agent` gives setup code convenient access to the associated agent, but the nearest scope tag remains authoritative for resolution. A nested scope can inherit the ergonomic `agent` property while replacing the registration key. + +```js +const auditKey = {} +const auditScope = createScope(agent.ctx, auditKey) + +auditScope.ctx.agent === agent // true: inherited association +scopeOf(auditScope.ctx) === auditKey // true: nearest registration key + +await auditScope.dispose() +``` + +This separation keeps the generic scope package independent of the agent package. + +### Resolution contracts preserve domain semantics + +The shared scope selects two layers, but each registry retains its own merge rules and must keep presentation, lookup, and execution coherent within the view it owns. + +#### Registries retain domain-specific merge rules + +The shared primitive answers “which layer?” and “who owns cleanup?”; each service still defines how its values combine. Prompt sections, variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive. Tool lookup and execution receive an agent or scope explicitly, while prompt assembly receives an `AssembleContext` whose `scope` selects the layer. + +Calling a read method through `agent.ctx` does not silently choose an agent subject. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global view. Registration origin and operation subject remain explicit, allowing one shared service to act for any agent. + +#### The tool view is live and executable + +`ToolRegistry` owns one resolver rather than separate presentation and execution stores. It snapshots restriction definitions at registration, applies them to the current global map, overlays the matching scoped map, and derives lookup, dispatch, schemas, SDK bindings, timeouts, inspection, and UI presentation from that resolved map. A filtered global implementation therefore cannot remain executable through a second path. + +The [public RFC](2026-07-08-agent-scope-contexts.md#tool-restrictions-resolve-against-a-live-flat-view) owns the exact allow/deny/future-global/local-overlay behavior. The internal distinction needed here is that `ToolRegistry.knownNames()` validates restrictions against the pre-restriction end-capability universe, while the system-prompt provider validates `toolOrder` against the presentation mode's wire universe. + +Final prompt assembly can include schemas from other `systemPrompt.tools()` providers or assembly listeners. The coherent-view proof therefore covers `ToolRegistry`'s own schemas, bindings, lookup, execution, and presentation; another provider owns coherence for the unrelated schemas it contributes. + +Reserved `run_code` presentation sits outside both registration maps. The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns its mode, SDK, and `toolOrder` semantics; this design relies only on the fact that the transport is resolved separately from filterable end capabilities. + +### Dispatch contract follows the operation subject + +Service-owned dispatch paths derive or couple the scope key with the operation subject, and a carrier composes that key with the chosen base receiver's existing dispatch behavior. For agent events the agent is both base and operation subject; tool, approval, and prompt dispatch instead wrap their owning service while selecting listeners with the operation's agent key. The low-level primitives can still represent mismatched facts, so helper use and development invariants—rather than the type system alone—protect direct internal callers. + +#### The operation subject selects the listener set + +The [public dispatch rule](2026-07-08-agent-scope-contexts.md#scoped-events-follow-the-operations-real-subject) and generated [event catalog](../../../cordis-catalog/events.md) own listener visibility and the exhaustive event-family mapping. The implementation problem is to prevent each service from choosing its carrier, subject argument, and scope key independently. + +Fused helpers keep values that must agree together. `agentEvents(context, agent)` uses one agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` sets both prompt facts and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur without the original agent context. + +#### The carrier preserves base-receiver behavior + +Function-style listeners receive the carrier as `this`. Agent listeners may call methods on the agent base; service listeners rely on the owning service's contextual receiver behavior. The carrier is therefore a proxy that selects listeners while reading, writing, and invoking through the real base receiver. + +The implementation uses a dedicated surrogate proxy target with an immutable composed-filter slot. It combines the base receiver's existing `Context.filter` with the scope predicate instead of replacing it. Methods bind to the real base; callable carriers preserve call and construct shape; descriptor queries normalize configurable flags as required by Proxy invariants; and definitions through the carrier require an explicitly configurable descriptor. Stable built-in references protect the composed filter from accidental `.call` replacement. + +Those mechanics preserve observable JavaScript behavior, including private-field method identity: + +```js +class Base { + #count = 0 + increment() { this.#count += 1 } +} + +const base = new Base() +const key = {} +new Proxy(base, {}).increment() // TypeError: proxy lacks Base's private identity + +const carrier = scopeTarget(base, key) +carrier.increment() // works: method is bound to base +carrier === base // false: carrier has distinct identity +``` + +Together these constraints keep listener selection correct while preserving the base-receiver behavior listeners expect. + +The TypeScript-only `Scoped` marker requires a carrier at typed dispatch sites. Runtime marks and development invariants cover JavaScript, casts, and direct Cordis dispatch; they detect routing mistakes but do not confine hostile same-process code. + +## Lifecycle: compose privately, publish once, tear down in reverse + +Scope, session, registry entry, and driver form one transaction with two owners. Request fields are captured first; AgentLoop tracking and both identity reservations precede asynchronous work; the caller owns the prepared lifecycle before setup; publication proceeds in synchronous observable phases; and every teardown path reaches one reverse-order quiescence boundary. + +Two services split the public API from the implementation. `AgentRegistry`, reached as `ctx.agents`, stores live agents and is the front door for `create()` and `resume()`. Its registered `AgentFactory` is concretely implemented by `AgentLoop`, which constructs and drives agents using its own injected dependencies. The rest of this section calls that concrete co-owner the **AgentLoop factory**. + +| Phase | Public state | Ownership fact | +|---|---|---| +| Reserve | IDs unavailable to competitors | AgentLoop tracking and exact reservations cover the next await | +| Prepare or load | Persistence data is loading, or session, scope, and driver exist privately | Resume's load sentinel covers persistence; the complete caller lifecycle covers setup | +| Setup | `setup(agent.ctx)` may await and register | Neither ID is published | +| Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | +| Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | + +The [public lifecycle contract](2026-07-08-agent-scope-contexts.md#creation-publishes-after-setup-disposal-revokes-after-work-stops) defines what callers observe. The following sections justify each ownership and ordering fact behind that contract. + +### Reservations precede awaiting; lifecycle ownership precedes setup + +AgentLoop tracking and exact identity reservations precede the first await. Resume adds a caller sentinel across persistence loading; create and resume both establish the complete caller-owned lifecycle before invoking setup. + +#### The prepared lifecycle is owned before setup callbacks + +The caller context owns the work it requested and receives the consumer-facing `AgentHandle`. The AgentLoop factory is a structural co-owner because a live agent continues to depend on its injected services. Either owner can deactivate the transaction; both converge on the same lifecycle disposer. + +| Owner mechanism | Covers | Retires when | +|---|---|---| +| Caller lifecycle sentinel | Caller-fiber loss from lifecycle preparation through live lifecycle | Shared lifecycle reaches quiescence | +| Resume load sentinel | Caller-fiber loss across persistence load and lifecycle handoff | Load rollback or the adopted lifecycle reaches quiescence | +| AgentLoop tracker | AgentLoop unload and structural dependency loss | Transaction and lifecycle settle | +| ID reservations | Competing agent/session insertion | Ordered teardown releases both IDs | + +A **sentinel** is an owner-visible effect that follows work whose final disposer is not yet available. It adopts the exact reservation disposers immediately, then follows the complete lifecycle disposer once preparation establishes it. + +Cordis must make construction owner-visible before setup can reenter teardown. An effect's cleanup wrapper enters its owner list before its setup body runs, a child fiber receives its parent-owned disposer before Cordis's child-plugin notification (`internal/plugin`) announces it, and a fiber already unloading rejects new effects after taking its cleanup snapshot. Teardown observers are contained independently so one callback cannot starve peers or interrupt cleanup. These are domain-neutral lifecycle rules; `dsh-scope` uses them by mounting a no-op plugin fiber as the ownership bucket for one scope. + +#### Caller ownership and factory dependency lookup stay separate + +Factory delegation carries two contexts because ownership and dependency origin are different facts. `ownerCtx` is the caller-bound context whose fiber and optional scope own the requested lifecycle. The factory method receiver is the accepted factory traced through that access so the concrete service retains its own injected dependency view. + +```text +callerCtx.agents.create(options) + ownerCtx = context carrying callerCtx's fiber and scope + factoryThis = concrete accepted factory traced through ownerCtx + Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) +``` + +`setFactory()` captures the concrete target and its `createAgent` and `resume` callbacks once. It canonicalizes an already traced service before retracing, avoiding a second proxy layer that would break raw-identity state. Plain factory objects receive the explicit `ownerCtx` without depending on Cordis tracing. + +#### Create and resume reserve identities before awaiting + +Programmatic create and resume reserve both agent and session IDs before any operation can await. Create prepares a new or seeded session; resume loads persisted data while a caller sentinel and AgentLoop load tracker already own the interval in which no `Agent` object exists. + +Reservations are capabilities, not advisory sets. Setup code cannot reserve, prepare, create, register, or enter a substitute under the same IDs. A session reservation prepares at most one exact object, and publication requires the matching factory-held capabilities. A failed or abandoned transaction therefore cannot publish a substitute or wedge an ID indefinitely. + +Resume transfers ownership rather than opening a gap: + +```text +resume(ownerCtx, request): + snapshot request identity, options, and setup callback + reserve agentId and sessionId + install caller sentinel adopting both reservation disposers + track load under AgentLoop + + persisted = await firstOf(persistence.load(sessionId), deactivated) + session = sessionReservation.prepare(reconstruct persisted data) + starting = startOwned(ownerCtx, session, reservations, setup) + caller sentinel follows starting.dispose + return await starting.result +``` + +If deactivation wins, a backend load may still settle internally but has no path back to publication. Preparation failure still returns a rollback-backed lifecycle result, so both owners can wait for actual cleanup instead of mistaking a rejected async result for successful installation. + +### Setup composes an unpublished world + +`setup(agentCtx)` may register tools, prompt state, restrictions, listeners, protections, or child plugins and may await their activation. The new agent is available as `agentCtx.agent`, but neither agent nor session is visible in its global registry. + +The complete rollback skeleton exists before setup runs. If setup throws, rejects, or loses either owner, the scope and prepared resources unwind and the IDs become reusable. After setup settles, a microtask checkpoint and liveness checks let a same-turn owner unload win before publication. + +Setup composes but cannot drive. `send`, `steer`, `inject`, and `cancel` reject until publication reaches the session-start boundary. The driver lock and inbox use runtime-private state, and only factory-held controls enable and start the loop; JavaScript casts cannot call a public start method or write directly into the queue. + +```text +startOwned(ownerCtx, snapshot, preparedSession): + world = prepareLifecycleWithCompleteRollback(ownerCtx, snapshot, preparedSession) + + result = async: + require world active + await firstOf(runOptionalSetup(snapshot.setup, world.agent.ctx), world.deactivated) + await oneMicrotask() + require caller, factory, owner fiber, and owner agent still active + world.publish(snapshot.source) + return handle(world.agent, world.dispose) + + on any error: + await world.dispose() + rethrow +``` + +### Publication is ordered, observable, and rollback-covered + +Publication is one synchronous sequence with liveness checks between three observable notification phases. Both registry entries exist before the first listener runs, but driving stays locked until immediately before `agent/session-start`. + +1. Enter the session store and capture its scope carrier. +2. Enter the agent registry without announcing it. +3. Recheck caller and factory liveness. +4. Emit `session/created`. +5. Recheck liveness. +6. Emit `agent/created`. +7. Recheck liveness. +8. Enable driving. +9. Emit `agent/session-start`. +10. Recheck liveness. +11. Start the driver. + +```text +publish(world): + world.beginSynchronousPublication() + try: + world.detachSession = sessions.enter(world.session, sessionReservation) + world.detachAgent = agents.enter(world.agent, agentReservation) + require callerAndFactoryActive + sessions.announce(world.session) + require callerAndFactoryActive + agents.announce(world.agent) + require callerAndFactoryActive + world.driver.enableDrivingVerbs() + emitNonVetoing(agent/session-start) + require callerAndFactoryActive + world.driver.start() + finally: + world.endSynchronousPublication() +``` + +#### Creation is paired, not atomic + +Observers run between publication steps, so the sequence is not described as atomic. Effects already performed by an earlier listener cannot be retracted if a later listener throws. Instead, each registry marks a creation announcement as begun before dispatch and emits exactly one matching disposal edge during rollback. An entered object that was never announced has no disposal notification because no observer was told it existed. + +A detach requested during `session/created` or `agent/created` is deferred until that dispatch unwinds. Stable captured carriers and exact-object guards prevent a later listener from observing `disposed` before `created` or a stale detach from deleting a replacement with the same ID. The outer publication barrier likewise prevents caller or AgentLoop teardown from removing the other registry entry or unwinding `agent.ctx` while an announcement remains on the stack. + +Creation listener synchronous throws remain vetoes. Returned promise rejections are observed and logged but not awaited: publication has no asynchronous gap in which such a result could roll back safely. Disposal notifications and `agent/session-start` are non-vetoing and independently contain both synchronous throws and returned-promise rejections so one listener cannot block cleanup or later observers. + +### Teardown stops work before revoking registrations + +Every owner path reaches one memoized reverse-order transaction. It marks the lifecycle inactive, waits for an in-progress synchronous publication phase, stops the driver through actual exit and final durability work, detaches the agent and session, unwinds the scope, and releases IDs last. + +Final turn events, the turn-ending flush, and any outstanding session flush started while the agent was idle therefore run while the session and scoped listeners still exist. `agent/disposed` observes an already quiescent and unregistered concrete agent while its session remains live; `session/disposed` follows after event feed detachment and store removal. Both use the stable carrier captured for their matching creation edge. + +```text +disposeOwnedAgent(world): + mark world inactive + await world.synchronousPublicationIfRunning() + await world.stopDriver() # loop exit plus agent-started flushes + world.detachAgent() + world.detachSession() + await world.scope.dispose() + world.releaseSessionReservation() + world.releaseAgentReservation() +``` + +`AgentHandle.dispose()` gives repeated and racing consumers the same completion promise. The lifecycle-long caller sentinel follows that promise even when handle disposal wins first, while the AgentLoop ledger independently stops new transactions and waits for every structurally dependent agent before the service disappears. + +AgentLoop co-ownership follows dependency shape, not a blanket “creator owns every returned value” rule. An AgentLoop-created agent continues to depend on the loop's services, so AgentLoop unload stops it. + +## Boundary ownership: hardened paths accept once and own the accepted value + +The acceptance-sensitive paths enumerated below read caller-owned fields once and retain only owner-controlled identities or snapshots before crossing asynchronous, reentrant, model-visible, or durable-log code. This is a boundary-by-boundary implementation property, not a blanket claim about every public API. The protection is independent of TypeScript: `readonly` annotations vanish at runtime, and JavaScript accessors can return a different value on every read. + +The shared shape distinguishes identity-bearing references from data. Agent objects and abort signals are retained by identity after one read. Boundaries whose contract requires lossless JSON—such as session events and subagent payloads—validate and materialize it in one traversal; other boundaries use their own owned representation, such as `structuredClone` for agent options. Scalars and callbacks are captured once, then each boundary applies the validation promised by its API before downstream use. + +```text +accept(input): + read every relevant top-level field exactly once + retain identity-bearing references without rereading them + validate acceptance-time fields from those captures + copy or pin data in the representation owned by this boundary + bind accepted callbacks once when method receiver state is intentional + expose only owner-controlled identities, frozen records, or detached results +``` + +Capture does not imply uniform eager callback type-checking. Agent `setup` is captured once and any invocation failure enters rollback; a tool guard is likewise captured, and an invalid cast becomes a normalized execution error. The invariant is that later work never rereads caller fields to choose a different value. + +| Boundary | Identity retained | Data detached or pinned | +|---|---|---| +| Tool and `SubagentProvider` registration | Original callback receiver | Name, flags, schemas, scalar config | +| Agent create/resume | Caller context, setup callback | IDs, options, session metadata and seed | +| Approval request | Agent and abort signal | Tool name, call ID, and reason | +| Tool execution | Agent, signal, registry-minted parent token | Call identity and arguments | +| Session append/load | Session identity | Header and event envelopes | +| Subagent start/result | Parent and signal | Prompt, filters, schema, options, result | + +Before agent setup can run, the concrete agent pins its accepted ID, options, and session and binds `ctx` once. Registry detach closures likewise close over their accepted keys instead of rereading mutable public fields. + +A stateful getter shows why validation and ownership must use the same capture: + +```js +let reads = 0 +const input = { + get name() { + reads += 1 + return reads === 1 ? 'safe_tool' : 'different_tool' + }, +} + +// Wrong: validation and storage observe different values. +validateName(input.name) +storeName(input.name) + +// Right: one accepted value drives both. +reads = 0 +const acceptedName = input.name +validateName(acceptedName) +storeName(acceptedName) +``` + +### Registered definitions are frozen snapshots + +Tool registration creates the stored definition identity once; changes occur through explicit unregister/register effects rather than mutation of a caller-retained object. Parameters are materialized in one traversal, callbacks bind once to the accepted definition receiver, and the stored record is deep-frozen. + +The first-party `defineTool()` helper applies the same boundary before registration. It captures each option once, materializes the authoring `SchemaSpec`, and derives both the wire schema and later execution/presentation validation from that owned spec. + +```text +defineTool(options): + accepted = read each option exactly once + parameterSpec = snapshotLosslessJson(accepted.parameters) + wireSchema = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) + build execute and presentation validation over parameterSpec + +registerTool(context, definition): + accepted = read each definition field exactly once + stored = deepFreeze({ + accepted name, description, timeout, + parameters: snapshotLosslessJson(accepted.parameters), + execute: bind accepted.execute to definition, + presentation callbacks: bind accepted callbacks when present + }) + layerFor(scopeOf(context)).add(stored.name, stored) +``` + +`get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached projections. Replacing `definition.execute` after registration has no effect, while a callback can deliberately read live state from its closure or original receiver. + +Factory and backend registration use different reentrancy orderings around the same ownership rule. `AgentFactory` registration claims its single slot before reading callback accessors. `SubagentProvider` registration first snapshots the provider fields, then its effect checks and enters the accepted name. Both capture callback identity and intentional receiver state once, and hot-reload cleanup closes over the accepted slot or key instead of rereading a mutable public property. + +### Durable session ownership carries the scope key + +The [session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md#session-owns-immutable-history) owns header, event, and snapshot semantics. Agent-scope correctness adds one requirement: the store keeps append observers, accepted registry IDs, and captured scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session or redirect later `session/event` delivery by mutating visible state. + +Approval requests follow the same async boundary at smaller scale: one capture preserves exact agent/signal identities, copies scalar fields, captures the session once, and drives `approval/asked`, scoped policy, cancellation, and `approval/decided` from that record. + +### Tool execution has pipeline-owned identity + +The [interception-seams RFC](../feature/2026-06-30-interception-seams.md) owns the public tool-pipeline contract. For agent-scope correctness, `ctx.tools.execute(input)` must turn caller-owned input into one pipeline-owned `ToolExecution` before any scoped policy or dispatch runs. It first reads `callId` and `name` once and requires strings; a failure there rejects because even an error result would lack trustworthy correlation identity. Once those strings are accepted, later input failures can become normal final error outcomes. + +Arguments are materialized once and deep-frozen. The registry assigns a frozen property-free `ToolExecutionToken`; callers cannot choose it. `token`, `callId`, `name`, `arguments`, `agent`, and optional opaque `parent` token become non-writable and non-configurable before policy. `signal` is the only operational field an around-dispatch wrapper may replace or remove. + +```text +prepareExecution(input): + callId = read input.callId exactly once + name = read input.name exactly once + require both are strings + + accepted = read arguments, agent, parent, and signal exactly once + require parent is absent or a registry-minted token + arguments = deepFreeze(snapshotLosslessJson(accepted.arguments)) + + execution = { + token: new frozen property-free object, + callId, name, arguments, + agent: accepted.agent, + parent: accepted.parent, + signal: accepted.signal + } + protect every field except signal + return execution +``` + +Stable execution identity prevents middleware from changing which tool or scope policy accepted. It also gives structured-output commit a safe `WeakMap` key when an adapter reuses a string call ID. Code Mode correlates an SDK sub-call with its enclosing `run_code` using only the outer execution's opaque token, never a mutable reference to the live outer object. + +Result boundaries apply the same ownership rule. Each transform returns data that is captured field-by-field, validated, materialized, and ultimately deep-frozen for final observers; malformed outcomes normalize to JSON-safe error results rather than reaching the session log as apparent success. + +## Owner-final policy: four narrow boundaries + +Waterfalls remain the ordinary extension mechanism; each of four protocol invariants runs after the last extension point capable of violating that specific invariant. Each owner-final API has the weakest one-way power that can preserve its guarantee. + +Here **canonical** means the named registry or tool-schema-provider output assembled before the waterfall—not “all output the service approves.” Protection restores only the names its owner declares. + +| Invariant | Cooperative extension point | Owner-final boundary | Guarantee | +|---|---|---|---| +| Named prompt/tool contribution | `system-prompt/assemble` waterfall | `systemPrompt.protect()` finalization | Canonical presence, absence, definition, and local anchor survive | +| Non-overridable tool denial | `tools/pre-execute` allow/deny/ask waterfall | Synchronous `tools.guard()` | A denial cannot become allow | +| Authoritative live outcome | Execute and post-execute waterfalls | Awaited `tools/result` notification | Observers receive one immutable final result | +| Terminal protocol completion | Continuation waterfall and pending steering | Serial `agent/turn-stop` | No middleware or late steering creates another step | + +### Prompt protection restores named canonical contributions + +`systemPrompt.protect({ sections, tools })` snapshots the requested names and restores their canonical registry or tool-schema-provider output after the complete assembly waterfall. Global and matching scoped protections compose by set union; a waterfall failure still fails assembly rather than triggering recovery. + +Protection covers both presence and absence. If the canonical assembly omits a protected name, finalization removes a listener-fabricated entry; this is how Code Mode keeps a native schema absent while preserving the SDK/transport form. Tool providers likewise expose one captured coherent record for schemas and optional known names, so a stateful getter cannot validate one name and display another. + +#### Global section protection reserves its name + +A globally protected section name cannot be shadowed by a scoped section. Scoped registration under an already protected name fails, and adding protection fails if a scoped shadow already exists. This check occurs before assembly because scoped-over-global merge would otherwise make the shadow itself appear canonical. + +Tool-schema protection does not create a blanket reservation for unrelated schema names. Providers are additive and may deliberately contribute other executable schemas; the owner-final guarantee covers only the named canonical contribution. + +#### Restoration preserves a useful local anchor + +Protection does not reset the whole assembly. It removes protected names from the waterfall result and reinserts each canonical entry before the first surviving later unprotected canonical neighbor, or at the end if none survives. Unprotected entries retain the order and definitions chosen by middleware. + +```text +assemble(context): + assembly = assemble registries for context.scope + canonical = snapshot protected section/tool inputs + transformed = await systemPromptAssembleWaterfall(assembly) + + for each protected canonical name: + remove every transformed entry with that name + if canonical includes the name: + insert before first surviving later canonical neighbor, else append + + return transformed +``` + +Code Mode globally protects `tools:sdk` and reserved `run_code`; structured output adds scoped protection for its instruction and capture schema. + +### Tool guards deny monotonically + +`ctx.tools.guard()` installs a global or scoped synchronous check after the complete `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result. + +Pre-execute hooks still compose ordinary allow, deny, and ask decisions. An ask resolves through the optional approval service, where only `allowed-once` becomes allow and absence or any non-grant becomes deny. Guards run afterward, so listener order cannot convert their denial into dispatched work. + +```js +agent.ctx.on( + 'tools/pre-execute', + async () => ({ kind: 'allow' }), + { prepend: true }, +) + +agent.ctx.tools.guard(execution => + execution.name === 'bash' + ? 'reviewer agents are read-only' + : undefined, +) +``` + +Even a later prepended allow listener cannot bypass the guard. A denied call still becomes an error outcome that flows through result transformation and final observation. + +### `tools/result` observes the final live outcome + +For a successfully prepared execution, the live pipeline is `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute` → `tools/result`. Malformed non-identity input instead takes the error-shell path directly to final observation, as the algorithm below shows. The first, execute, and post stages are transformable waterfalls; `tools/result` is an awaited observe-only notification after every transform and outer error normalization. + +Every observer receives the same frozen execution and a separate deep-frozen snapshot of the owned result returned to the caller. Listener failures are contained independently, so they cannot change that returned result or starve peers. Routing uses `execution.agent`. + +`tools/result` is not the durable `tool/result` session event. The live notification also fires for direct programmatic executions and is the source of truth for in-process commit logic. The agent loop later appends the durable event for replay, UI reconstruction, and model history. + +```text +execute(input): + accept trustworthy callId and name + try to prepare pipeline-owned execution + on preparation failure: + create an identity-bearing error shell + ownedResult = owned error result + freeze execution + observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) + await every tools/result observer independently with observerResult + return ownedResult + + gate = await tools/pre-execute(execution) + resolve ask through approval when needed + denial = policy denial or first guard denial + + if denied: + result = errorResult(denial) + else: + result = await tools/execute(execution, dispatchRegisteredTool) + + result = await tools/post-execute(execution, result) + ownedResult = normalize into owned lossless JSON + freeze execution + observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) + await every tools/result observer independently with observerResult + return ownedResult +``` + +Waterfalls transform only at their named stages; guards only deny; final observers only observe. + +### `agent/turn-stop` makes continuation terminal + +Steering is input for another model step inside the current turn; queued prompts wait for a future turn. Ordinary continuation remains extensible: the loop computes a default, runs `agent/turn-continuation`, records any force-continue reason as steering, and treats pending steering as a reason to continue. + +The scoped serial `agent/turn-stop` checkpoint runs after that folding. A listener returns `{ action: 'stop' }` or abstains with `undefined`; malformed values and throws close the current turn with an error. A stop is terminal, so later listeners and steering cannot restore continuation. + +The loop uses `strictSerial` because ordinary Cordis serial dispatch treats `null` and `false` as abstentions. This terminal protocol permits only `undefined` to abstain, making accidental return values fail closed. + +Terminal state remains active through `turn/end` and the durability flush. Steering added by continuation, turn-close, or flush listeners is discarded after a terminal stop, while the ordinary queued-prompt FIFO remains untouched. + +```text +afterSuccessfulStep(turn): + decision = await agent/turn-continuation(defaultDecision) + record decision.reason as steering when present + if steering is pending: decision = continue + + terminal = await strictSerial(agent/turn-stop) + if terminal == stop: + discard steering + terminalStopped = true + decision = stop + + append turn/end + await session/flush + + if terminalStopped: + discard steering added by turn/end or flush listeners + else: + move leftover steering to the next-turn queue +``` + +This stronger control is reserved for terminal protocols such as a completed structured child; ordinary continuation policy remains cooperative. + +## Subagents: the composition proof + +In-process subagents add no second scoping model. They create a fresh flat child scope during unpublished setup, install ordinary scoped persona/filter/protocol registrations, own the child through a run handle, and use the same owner-final checkpoints for structured output. + +The roles and phases are explicit: + +| Role | Responsibility | +|---|---| +| Caller | Supplies parent, prompt, optional child configuration, and eventual disposal | +| `SubagentService` | Validates capabilities, owns the public wrapper, normalizes result and lifecycle telemetry | +| `SubagentProvider` backend | Chooses transport and creates one run | +| In-process driver | Owns child creation, setup, prompt drive, result read, cancellation, and teardown | +| Child `Agent` | Uses the ordinary agent lifecycle and its fresh `agent.ctx` | + +```text +recommended caller order: start -> await run.started -> await run.result -> await run.dispose() +internal observation: started and result may settle in either order; lifecycle publication waits for started +ownership: dispose may race any phase and joins one cleanup promise +``` + +The [agent-scope contract](2026-07-08-agent-scope-contexts.md#subagents-use-the-same-composition-rule) gives the contributor-facing example, and the [subagent capability RFC](../feature/2026-06-21-subagent-capability-seam.md) owns the public `SubagentRun` contract. This section follows only the in-process ownership and terminal-protocol implementation. + +### The child world uses ordinary registrations + +A child persona is a scoped `deployment:persona` section. Its tool filter is a scoped restriction over the live global tool layer. Structured output is a bundle of scoped tool, prompt, protection, guard, and listener registrations. + +```js +let structured +const setup = childCtx => { + if (persona !== undefined) { + childCtx.systemPrompt.section({ + name: 'deployment:persona', + order: 0, + text: persona, + }) + } + if (toolFilter !== undefined) childCtx.tools.restrict(toolFilter) + if (schema !== undefined) { + structured = attachStructuredRuntime(childCtx, schema) + } +} +``` + +The driver creates one run-owner fiber under `parent.ctx` and calls the child factory through it. Parent teardown, `spawn` backend teardown, and manual run disposal reach the same node, but the child still receives a new registration key. Lifetime inheritance therefore does not imply registration inheritance. + +### Structured output is a child-owned terminal protocol + +A structured child registers a real-schema `structured_output` tool and instruction in its own scope. Concurrent children can use different schemas without a global placeholder, reference count, or remove-for-everyone pass. + +The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns advertised wire routes and SDK behavior. The correctness distinction here is execution nesting: a native capture has one tool execution, while an SDK capture is an inner execution whose parent token identifies the enclosing `run_code`. Tool mode is presentation rather than an execution allowlist, so a direct unadvertised capture still follows the native commit path; a deployment that forbids that route uses an execution guard. + +Named protection restores this child's canonical capture contribution and instruction without erasing unrelated schemas deliberately added by another assembly provider. + +#### Native calls commit once; Code Mode SDK calls commit twice + +The capture body validates and stages a cloned value by stable `ToolExecution` identity. The scoped final-result observer commits a native capture only if that exact execution's final result succeeds. + +A schema-validation failure becomes the ordinary `INVALID_ARGS` tool result, so the model can correct the value and call the capture tool again within the same turn. + +```text +structured_output.body(value, execution): + validate value against this child's schema + staged[execution] = clone(value) + return ordinary success + +on tools/result(execution, finalResult): + if execution is staged: + value = staged.remove(execution) + if finalResult succeeded: + captured = value +``` + +For a Code Mode SDK call, successful inner observation records a pending value against the opaque outer `run_code` token. Commit waits for the outer transport's own successful final result because an inner side effect can succeed while the program or its post-policy still fails. + +```text +on tools/result(innerStructuredCall, innerResult): + if innerStructuredCall is staged: + value = staged.remove(innerStructuredCall) + if innerResult succeeded: + pending = { outerToken: innerStructuredCall.parent, value } + +on tools/result(outerRunCodeCall, outerResult): + if pending.outerToken == outerRunCodeCall.token: + value = pending.value + pending = none + if outerResult succeeded: + captured = value +``` + +Once capture is staged against an outer transport or committed, the scoped guard denies later calls in that response. After commit, `agent/turn-stop` ends the turn after ordinary continuation and steering fold. A child that otherwise completes cleanly without a committed capture returns an error rather than being re-prompted; requesting a schema makes output mandatory, not guaranteed. + +### The run protocol separates acceptance, readiness, result, and disposal + +`SubagentService.start()` returns synchronously, but `run.started` is the publication boundary. Callers treat the child as live only after readiness, consume `result`, and always dispose the run. + +Pre-readiness cancellation of an in-process run deactivates the run-owner fiber, prevents publication, rejects `started`, resolves `result` as `aborted`, and emits neither subagent lifecycle edge. + +`SubagentProvider` registration captures name, capability flags, the `inheritsParentContext` conversation-history descriptor, and the bound start callback once. The descriptor says whether completed parent turns seed the child's conversation; it says nothing about scope, services, tools, or authority. + +Starting a run captures every request field once. Parent and abort signal remain identity references; prompt, filter, schema, and options are detached lossless JSON; fixed `persona` and absolute `maxDepth` values validate before backend ownership. The in-process backend separately snapshots its optional session seed, and the service snapshots the terminal result when it settles. + +Depth validation repeats at each public entry while one helper owns the accepted domain: + +```text +tool-subagent plugin load: + assertSubagentMaxDepth(config.maxDepth) + +SubagentService.start(request): + capture and validate request.maxDepth + +startInProcessRun(request): + capture and validate request.maxDepth + parentDepth = validated depthOf(parent) + childDepth = parentDepth + 1 + reject if childDepth is not a safe integer + reject if maxDepth exists and childDepth > maxDepth +``` + +Only `undefined` means parent depth zero. Present depth and cap values must be non-negative safe integers and must not be negative zero; derived overflow rejects even when no request cap exists. + +The service does not expose the backend-owned run handle directly. It captures `id`, `started`, `result`, and methods once; binds methods to that handle; wraps result in one detached frozen record; and installs a shared disposal promise before calling untrusted backend cleanup. Once a callable backend disposer has been captured, a malformed later field triggers rollback; if no callable disposer can be captured, rollback is impossible and acceptance fails immediately. A backend disposer that directly returns the wrapper's reentrant promise is rejected as a cycle instead of hanging. + +```text +startInProcessRun(backendContext, acceptedRequest): + install backend ownership + attach accepted abort signal + create run-owner fiber under accepted parent.ctx + create child through runOwner.ctx.agents with unpublished setup + + started = child creation publication + result = after started: + send accepted prompt + await child idle + derive owned terminal result + dispose = dispose run owner and await quiescence + +SubagentService.start(...): + backendRun = backend.start(detached request) + serviceRun = freeze accepted id, readiness, bound methods, normalized result + observe result immediately + after readiness: + emit subagent/start, then buffered/eventual subagent/end + on readiness failure: + emit neither lifecycle edge +``` + +The service observes result settlement immediately even while readiness is pending, preventing an early rejection from becoming temporarily unhandled. Lifecycle listeners receive one frozen payload; their throws and returned-promise rejections are contained independently and cannot veto the run. + +## Workflow integration preserves the subagent contract + +The [dynamic-workflows RFC](../feature/2026-07-05-dynamic-workflows.md) owns workflow behavior. The agent-scope concern is whether the worker bridge preserves the same readiness, terminal-claim, and bounded-cleanup boundaries across a message port. It never announces an unready child, never lets cleanup rewrite an already chosen result, and never suppresses disposal merely because another terminal fact already won. + +The worker executes the workflow script and exchanges protocol messages; the host owns `SubagentService`, which invokes `SubagentProvider` backends and returns normalized run wrappers that the host retains. Their lifetimes follow dependency shape: an AgentLoop-created agent stops when its loop unloads, while a workflow run captures its holder-bound `SubagentService` at start, so unloading the workflow engine prevents new runs without revoking an already returned run. + +Three state dimensions remain separate: + +| Dimension | Question | Winning rule | +|---|---|---| +| Admission | May a worker message still start or announce a child? | Closed admission refuses the exact run and cleans it up | +| Terminal claim | Which external result does the workflow expose? | Earlier accepted external cancellation wins; otherwise first result/death claim wins | +| Physical cleanup | Which registered children and worker resources remain? | Every path may still dispose survivors through per-call gates | + +### Child admission waits for readiness + +After `SubagentService.start()` returns its normalized wrapper, the host registers that exact wrapper before awaiting, attaches result observers immediately, and rechecks admission both then and when `started` settles. A closed boundary claims cancellation and disposal for that exact entry, removes it only when disposal settles, and reports `ChildStartError` only while the worker reply channel remains open. + +The backend's nested `start()` may synchronously reenter workflow cancellation before the service wrapper reaches the host registry. The immediate post-start check and exact-wrapper identity guard close that interval; a backend that later fulfills its own readiness cannot resurrect workflow admission. + +```text +after subagents.start returns its run wrapper: + register exact wrapper for cancellation + observe and snapshot result immediately + if admission closed: refuse and clean exact wrapper + else await run.started + + on ready: + if admission closed: refuse and clean exact run + else send ChildStarted, then buffered/eventual outcome + + on readiness failure: + send ChildStartError only if the worker reply channel remains open + dispose exact wrapper if still registered +``` + +### Each terminal contender claims before its own callbacks + +Each terminal path records the state it owns before invoking its own callback fanout. External `cancel()` records the accepted cancellation reason before invoking child cancellation. On the Result path, the worker queues its `Result` message before settlement cleanup messages on the same port, and the host records the winning result before any Result-triggered abort or cancellation. Reentry therefore observes the fact that already won instead of rewriting it. + +```text +on workflow Result: + cancellationWasAlreadyAccepted = external cancellation is in flight + claim chosen result: + if earlier external cancellation and result is not cancelled: + cancelled result + else: + worker result + + if not cancellationWasAlreadyAccepted: + abort shared child-request signal + cancel every registered child through its at-most-once gate + settle chosen result +``` + +The worker may also send a later `ChildCancel`; host fanout and the worker message share one per-call cancellation gate, so an arbitrary backend's `cancel()` need not be idempotent. Each callback is contained independently. + +### Worker death, exit, and disposal remain separate + +The first worker death signal closes message admission, claims a death result unless an earlier terminal fact won, cancels and disposes registered children, and synthesizes missing lifecycle ends. A queued message can arrive between Node's `error` and `exit`, so the logical admission barrier—not physical exit—prevents late child creation or narration. + +Physical exit performs a final disposal-only sweep without repeating explicit cancellation. A cancellation grace period bounds how long the host waits for cooperative settlement before terminating the worker; a grace result can already be chosen while exit cleanup still needs to dispose surviving child handles. The bound is real: after grace expires, public disposal may return after invoking child disposal and reaping host resources even if a slow backend disposer has not reached quiescence. + +Public `handle.dispose()` claims its shared promise before invoking cancellation or child callbacks. Each `disposeChild` likewise claims its call-ID promise before invoking the backend disposer. Public-first reentry joins the public promise; worker-first reentry lets the holder traversal join the already claimed child promise. Settled `dispose()` still drives a host-side reap before awaiting quiescence, so a fire-and-forget child cannot remain alive merely because workflow result settlement already occurred. + +Together these rules ensure `workflow/agent-start` names only ready children, external result precedence is stable, and every surviving child reaches disposal. + +## Correctness enforcement + +The runtime rule is checked at four escape boundaries: API shape couples related subjects, TypeScript marks typed dispatch, development invariants inspect actual dispatch, and repository gates keep declarations aligned with enforcement. + +### API shape couples values that must agree + +`agentEvents(context, agent)` couples carrier, subject, and first event argument. `assembleContextFor(agent)` couples prompt facts with scope selection. `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered. + +```text +assembleContextFor(agent): + return { agent, scope: agent } + +agentEvents(context, agent): + carrier = scopeTarget(agent, agent) + return dispatcher that always injects agent as the event subject +``` + +These helpers make a mismatch harder to express than the correct spelling. + +### Type markers cover every scoped event declaration + +Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript rejects a bare subject at typed dispatch sites, including subagent lifecycle events scoped to the delegating parent. + +The marker is compile-time only; JavaScript, casts, and direct Cordis dispatch can bypass it. + +### Development invariants inspect actual dispatch + +The invariants plugin observes Cordis's internal dispatch before listener delivery. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. + +Session and subagent payloads do not expose their owner key directly, so their service centralizes key selection and the invariant proves carrier presence. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. + +Dedicated `dsh-scope` unit tests cover the carrier's advanced Proxy behavior: private-field method binding, call/construct shape, primordial filter invocation, own-key/descriptor consistency, and explicit configurable definitions. These are implementation tests, not checks performed by the invariants plugin. + +### Repository gates keep declarations and dispatchers aligned + +`verify-scoped-dispatch` compares declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to name a recognized dispatcher. Source JSDoc generates the [event catalog](../../../cordis-catalog/events.md), which remains the exhaustive signature and mode reference. + +## Alternatives considered + +The [agent-scope contract](2026-07-08-agent-scope-contexts.md#alternatives-considered) owns the rejected public architectures: explicit agent parameters, event-only filtering, per-agent service graphs, and hierarchical registration inheritance. This RFC records the implementation alternatives rejected after choosing the public contract. + +### Publish the agent before running setup + +Early publication lets setup find the agent in global registries but lets observers act on a partially configured world. Rollback can remove entries but cannot retract external effects from listeners that already ran. + +The unpublished setup callback already receives `agent.ctx` and `ctx.agent`, so early global lookup is unnecessary. + +### Allow only synchronous setup + +Synchronous setup cannot honestly compose child plugins whose activation is asynchronous. TypeScript also permits a promise-returning callback where a void return is expected, so a synchronous-looking type would not reliably contain accidental async work. + +Awaited setup makes the transaction explicit and keeps first publication and prompt assembly behind it. + +### Validate caller data, then clone it + +Validation followed by a separate clone rereads accessors, so it can approve one value and retain another. A generic JSON clone can also erase or coerce exotic prototypes and unsupported values. The lossless-JSON traversal validates and materializes one captured value in the same operation. + +### Enforce invariants with prepended waterfall listeners + +A prepended listener is not permanently outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace a downstream result. The same defect appears in prompt assembly, tool decisions, result commit, and turn continuation. + +The four owner-final APIs express the exact one-way power required: restore named canonical data, deny monotonically, observe immutable final outcome, or stop after ordinary continuation folding. + +### Put agent-scope policy inside vendored Cordis + +Cordis already supplies derived contexts, effect ownership, and receiver-based filtering. The harness-level primitive composes those domain-neutral mechanisms rather than teaching Cordis about agents, tools, prompts, or global-plus-agent merge rules. + +The lifecycle hardening remains correctly inside Cordis because effect pre-registration, parent ownership before child publication, and rejection of late effects protect every plugin under reentrant hot reload, not only agent scopes. + +## Consequences + +The implementation makes the contributor contract locally checkable at each escape boundary. Its cost is explicit runtime machinery for key coherence, continuous ownership, accepted-value stability, and post-middleware finality. + +### Correctness properties + +The mechanisms compose into five properties: + +- Registry layers and event carriers derive from one opaque key, while fused helpers couple subjects that must agree. +- Reservations, sentinels, provider tracking, publication barriers, and reverse teardown cover every asynchronous or reentrant ownership interval. +- At the hardened boundaries listed above, accepted identities and snapshots prevent runtime accessors or later mutation from splitting validation, execution, logging, and observation. +- Prompt protection, guards, final-result observation, and terminal stop each have only the one-way power their invariant requires. +- In-process subagents and workflow runs preserve readiness, terminal precedence, and disposal under provider callbacks, worker death, and racing owners. + +### Costs and constraints + +The proof is not free: + +- Registries keep global and per-scope state, and every scoped dispatcher must preserve the operation subject through a proxy-shaped carrier. +- Programmatic create and resume require reservation capabilities, two-owner tracking, rollback state, ordered publication, and a shared quiescence promise. +- Acceptance boundaries copy, freeze, bind, or retain values according to their contract, increasing allocation and validation work. +- Owner-final behavior uses four explicit APIs instead of relying on ordinary listener ordering. +- Runtime invariants, generated dispatch checks, and focused Proxy/lifecycle/race tests remain necessary because TypeScript cannot enforce direct JavaScript dispatch or runtime reentrancy. + +The direct no-setup `ctx.agentLoop.create()` path remains synchronous for configuration and callers that already have complete options. Programmatic registry create/resume use the full unpublished transaction. + +### Limits of the proof + +The proof covers services and event families that explicitly adopt the agent-scope helpers. It does not make every service call scope-aware, strengthen the ordering contract of a custom agent registered outside AgentLoop, or force an arbitrary external subagent backend to reach quiescence after a workflow grace deadline. + +The [security and authority non-goal](2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals) is part of the public contract. These mechanisms prove composition and ownership behavior inside one trusted process; they do not prove confinement or parent-to-child non-escalation. diff --git a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md index a5f294f76d..47d9ec0473 100644 --- a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md +++ b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md @@ -24,7 +24,9 @@ One deliberate strictness DIVERGENCE from CC: hook misuse — unknown or deferre **Trust premise (governs every engine decision below)**: workflow scripts are MODEL-WRITTEN — the same trust level as the model's existing bash access — so the engine defends against BUGGY scripts, never hostile ones. In scope: `result` never rejects, no unhandled rejections from dropped hook promises, loud rejection of values JSON cannot carry, fatal-vs-null hook discipline, cancellation that always frees the caller. Out of scope, deliberately: adversarial values (throwing/spinning accessors, proxies with hostile traps, prototype forgery, `prepareStackTrace` hijack) AND Node-API escape from the script's context — the vm context shares object machinery with its surrounding realm, so a script can reach the `Function` constructor (`globalThis.constructor.constructor`) and from it `process` and every Node builtin; the absent globals are API surface, not containment, and a worker thread is NOT a security boundary (an escapee holds process-wide privileges — Node's permission model is per-process). Worker-side code MAY run script code while reading script values, and that is accepted: a synchronous spin costs the script its OWN thread (terminated at the post-cancel grace), never the host loop, so containing error VALUES would be cost without a threat model. Genuine sandboxing (isolated-vm, a separate process) remains an engine swap behind the seam, not incremental defenses here. -**Why node:worker_threads**: one run = one worker thread, no pooling — a run is heavyweight (many children), so thread spin-up (~tens of ms) is noise. The script runs in a vm context INSIDE the worker, keeping the script-visible surface exactly the hook contract above (a bare worker realm would leak `setTimeout`/`fetch`/`process` as accidental API), and every `agent()` bridges to `ctx.subagents` by message-port RPC — children are I/O-bound LLM loops and stay on the host loop; the thread isolates the SCRIPT, the only part that can spin. What the thread buys: `start()` never blocks the host (an in-process engine runs the initial synchronous slice inline and cannot kill a spin past the first await — it could only ABANDON such a script, leaving the spin on the host loop), the post-cancel grace ends in a REAL `worker.terminate()`, and the value boundary is serialization by construction. isolated-vm was rejected for actual sandboxing: maintenance mode, `--no-node-snapshot` on EVERY consumer process (including published bins) on Node ≥ 20, node-gyp source-build fallback. Key mechanics (details in the package README): meta shape-validation and a body pre-parse stay HOST-side (preserving the seam's synchronous throws), a ready→go handshake keeps a run cancelled before start from ever executing the body, `cancel()` drives both child-cancel channels host-side (the shared request signal AND each child's explicit `cancel()` — a wedged worker cannot relay its own cancel RPCs), a host-side child registry backs worker-death reaping and `dispose()` quiescence, the wire protocol is enum-keyed payload maps private to the package, and on a termination path `agentsStarted` degrades to the host-observed count. Coverage puts the worker-side session on an in-process `MessageChannel` (real-Worker code is invisible to main-process v8) and proves the built `lib/worker.js` — a second tsdown entry, sanctioned in the workspace-constraints gate by the `"./worker"` subpath export — under plain node in the built-bin smoke gate. +**Why node:worker_threads**: one run uses one unpooled worker because a workflow run is already heavyweight relative to thread startup. The script runs in a vm context inside the worker, keeping the script-visible surface to the hook contract instead of exposing a bare worker realm, while `agent()` bridges by message-port RPC to I/O-bound child loops on the host. This keeps `start()` from blocking the host on the script's synchronous slice, makes the post-cancel deadline end in a real `worker.terminate()`, and gives cross-thread values a serialization boundary by construction. isolated-vm was rejected for its maintenance state, required `--no-node-snapshot` consumer flag on Node ≥ 20, and node-gyp fallback. + +Host-side meta validation and body pre-parsing preserve the seam's synchronous errors, and private enum-keyed payload maps define the wire protocol. Readiness admission, the two child-cancellation channels, worker-death reaping, result precedence, and disposal quiescence preserve the subagent run contract across that wire; the [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#workflow-integration-preserves-the-subagent-contract) owns those race algorithms. Coverage uses an in-process `MessageChannel` for worker-side logic that main-process V8 coverage cannot see and separately proves the built `lib/worker.js`—a second tsdown entry sanctioned by the `"./worker"` subpath export—under plain Node in the built-bin smoke gate. **Meta as data, never evaluated**: the meta block reaches the seam as a plain JSON request field (the tool's schema-validated `meta` parameter) and the engine only shape-validates it, every violation named. This is a host-isolation invariant, not a convenience: evaluating a meta literal host-side — even one contractually "pure", in an empty timed vm context — hands script-controlled getters a host stack with no timeout the moment the result is READ, defeating the exact spin isolation the worker thread buys. @@ -38,10 +40,9 @@ A `workflow` tool mirroring `dsh-tool-subagent`'s synchronous shape: start, awai `SubagentStartRequest.outputSchema` is implemented by `dsh-subagent-inprocess` for both in-process backends. Each structured child receives its own scoped capture tool, instruction, and enforcement registrations on `child.ctx`; concurrent children can use different schemas without sharing mutable policy, and disposing the child removes the entire attachment. -- **Assembly is owner-protected.** The child registers `structured_output` with the run's real schema plus an order-190 instruction, then `systemPrompt.protect()` restores their canonical presence and definition after the complete assembly waterfall. Restored entries anchor before the first surviving later unprotected canonical neighbor, or at the end, without undoing listener ordering of unprotected entries. In native and both modes the capture tool remains a native wire tool. In pure Code Mode its canonical native presence is absent, so protection removes injected copies while the scoped tool remains in the generated SDK; the Code Mode owner independently protects `tools:sdk` and the reserved `run_code` transport. The loop logs the final assembly as `request/header`, keeping the demand reconstructable. -- **Capture uses a two-level commit.** The capture body validates and stages a cloned value in a `WeakMap` keyed by that immutable execution object; only the observe-only `tools/result` notification commits it when the authoritative JSON-safe result after pre-policy, guards, around dispatch, post-policy, and outer error normalization succeeds. A capture called from a `run_code` program carries only the enclosing execution's opaque token as `parent`: inner success becomes pending, and commits when that token matches the enclosing transport's own successful `tools/result`. An outer runtime failure or post-policy block therefore cannot report structured success, and the observer never receives a live outer execution reference. -- **Finality is monotonic within and after the step.** A scoped `ctx.tools.guard()` denies calls after capture has become pending or committed, and it runs after the entire extensible `tools/pre-execute` waterfall so listener order cannot force-allow a later side effect. After the step, scoped serial `agent/turn-stop` runs after ordinary continuation and steering folding; a captured child stops with no extra model step, and neither a continuation wrapper nor late steering can resurrect it. -- **Schema and failure behavior stay explicit.** `start()` clones the schema so caller mutation cannot drift enforcement. `ToolArgsError` keeps validation retry inside the same turn. A child that finishes cleanly without a committed capture settles `error` to the parent; there is no re-prompt loop. `StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim. +An output schema makes a schema-valid committed capture mandatory for successful child completion. The scoped runtime preserves the canonical capture tool and instruction, commits only a successful final outcome—including the enclosing `run_code` outcome for an SDK call—denies later side effects after capture becomes pending, and stops the child without another model step after commit. A validation failure remains a retryable tool error; clean completion without a committed capture settles as an error. + +`StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim. The [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#structured-output-is-a-child-owned-terminal-protocol) owns the assembly, commit, guard, and terminal-stop correctness algorithms. ## Deferred (documented non-goals of this cut) diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md index 84a3877298..ad34cbd76d 100644 --- a/packages/core/agent/README.md +++ b/packages/core/agent/README.md @@ -31,7 +31,7 @@ Agent *creation* is provided by the plugin implementing `AgentFactory` (`dsh-age The lifecycle edges have two important local caveats. `agent/created` runs after scoped setup and after both session and agent registry entries exist, but concrete driving remains locked until the immediately following `agent/session-start`; that non-vetoing notification is the first supported startup injection point. `agent/disposed` always means the exact agent has left the registry. AgentLoop emits it after its driver is quiescent, while ordered teardown may still be detaching the session and unwinding the scope; custom agents registered directly own any stronger driver-ordering contract themselves. -Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the owner-final exception: it runs after ordinary continuation and steering folding, and its terminal state remains through turn close and flush so steering from those later listeners cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in [the agent-scope RFC](../../../docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md#owner-final-policy-boundaries). +Most interception points are cooperative waterfalls returning seam-specific decisions. `agent/pre-step` is a serial surface-mutation checkpoint, while `agent/turn-stop` is the owner-final exception: it runs after ordinary continuation and steering folding, and its terminal state remains through turn close and flush so steering from those later listeners cannot create an extra step or turn. Ordinary queued prompts remain intact. The full rationale is in the [agent-scope runtime-design RFC](../../../docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md#owner-final-policy-four-narrow-boundaries). Turn and step boundaries and the model token stream are durable `session/event` facts rather than mirrored `agent/*` notifications. Consumers read `turn/*`, `step/*`, and `assistant/chunk` from the session feed; tool policy and outcome observation belong to the complete pipeline documented by [`dsh-tools`](../tools/README.md). From a34801df4bcf079fc8f8580b80b474387cc8ef7b Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 16:54:37 +0800 Subject: [PATCH 12/21] fix(agent-loop): own queued message input --- docs/cordis-catalog/events.md | 28 ++-- docs/core-data-structures/core.md | 13 +- docs/event-producer-consumer.md | 26 ++-- .../2026-07-12-agent-scope-runtime-design.md | 3 + packages/core/agent-loop/README.md | 2 +- packages/core/agent-loop/src/agent.ts | 47 +++++-- packages/core/agent-loop/src/loop.ts | 7 +- .../agent-loop/tests/coverage-edges.spec.ts | 35 ++--- .../agent-loop/tests/review-fixes.spec.ts | 123 +++++++++++++++++- packages/core/agent/README.md | 4 +- packages/core/agent/src/types.ts | 24 +++- 11 files changed, 240 insertions(+), 72 deletions(-) diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index d59bc617d0..b69ed834b3 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -23,7 +23,7 @@ An agent's fully composed scoped world was published in the AgentRegistry. Its s Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:307`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:316`](../../packages/core/agent/src/types.ts) ### `agent/disposed` — emit @@ -35,7 +35,7 @@ An agent was removed from the registry. The concrete AgentLoop lifecycle emits t Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:322`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:331`](../../packages/core/agent/src/types.ts) ### `agent/error` — emit @@ -47,7 +47,7 @@ A step or turn errored. The loop reports a failure here (plus the logger) even w Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:596`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:608`](../../packages/core/agent/src/types.ts) ### `agent/pre-step` — serial @@ -61,7 +61,7 @@ Serial (awaited in registration order), not a waterfall: a listener mutates the Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:428`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:440`](../../packages/core/agent/src/types.ts) ### `agent/prompt-submit` — waterfall @@ -73,11 +73,11 @@ Waterfall: decide what happens to ONE drained queued message before it becomes a Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:446`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:458`](../../packages/core/agent/src/types.ts) ### `agent/queued` — emit -A message entered the agent's inbox (queued or steering). `source` is the resolved source (defaults applied), not the caller's raw options. +A message entered the agent's inbox (queued or steering). Content and the resolved source are the detached, deeply-frozen values retained by the inbox; the `info` wrapper is frozen too, so one listener cannot rewrite what another listener observes. `source` has defaults applied and is not the caller's raw options. ```ts cordis-catalog 'agent/queued'(this: Scoped, agent: Agent, content: ContentBlock[], info: { source: MessageSource; steering: boolean }): void @@ -85,7 +85,7 @@ A message entered the agent's inbox (queued or steering). `source` is the resolv Types: [Agent](../core-data-structures/core.md) · [ContentBlock](../core-data-structures/core.md) · [MessageSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:350`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:362`](../../packages/core/agent/src/types.ts) ### `agent/request` — waterfall @@ -97,7 +97,7 @@ Waterfall: shape the step's call configuration — model switching, sampling ove Types: [Agent](../core-data-structures/core.md) · [LlmCallConfig](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:475`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:487`](../../packages/core/agent/src/types.ts) ### `agent/session-prefix` — waterfall @@ -113,7 +113,7 @@ The seed is a frozen empty list; a contributing listener returns a NEW array — Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:527`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:539`](../../packages/core/agent/src/types.ts) ### `agent/session-start` — emit @@ -125,7 +125,7 @@ The agent's session lifecycle began, fired once before its first turn. `source` Types: [Agent](../core-data-structures/core.md) · [SessionStartSource](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:371`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:383`](../../packages/core/agent/src/types.ts) ### `agent/status` — emit @@ -137,7 +137,7 @@ Agent status changed (`idle` ⇄ `running`, or → `disposed`). Drive lifecycle Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:336`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:345`](../../packages/core/agent/src/types.ts) ### `agent/step-result` — waterfall @@ -149,7 +149,7 @@ Waterfall: post-process the assembled assistant Message before tool dispatch (va Types: [Agent](../core-data-structures/core.md) · [Message](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:542`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:554`](../../packages/core/agent/src/types.ts) ### `agent/turn-continuation` — waterfall @@ -161,7 +161,7 @@ Waterfall: override the turn-continuation decision via a typed ContinuationDecis Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:560`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:572`](../../packages/core/agent/src/types.ts) ### `agent/turn-stop` — serial @@ -173,7 +173,7 @@ Serial terminal-stop checkpoint after the ordinary `agent/turn-continuation` wat Types: [Agent](../core-data-structures/core.md) -Source: [`packages/core/agent/src/types.ts:579`](../../packages/core/agent/src/types.ts) +Source: [`packages/core/agent/src/types.ts:591`](../../packages/core/agent/src/types.ts) ## `approval/*` diff --git a/docs/core-data-structures/core.md b/docs/core-data-structures/core.md index 7937018b9f..bd533fe5c4 100644 --- a/docs/core-data-structures/core.md +++ b/docs/core-data-structures/core.md @@ -267,12 +267,21 @@ interface Agent { */ readonly ctx: Context - /** Queue a user message. Starts a turn when idle; otherwise waits for the next turn. */ + /** + * Queue a user message. Starts a turn when idle; otherwise waits for the next + * turn. Content and the resolved source are accepted as one detached, + * deeply-frozen lossless-JSON record before notification or enqueue, so + * caller or `agent/queued` listener in-place mutation cannot change later + * log/model input. Throws synchronously when either value is not losslessly + * JSON-serializable; `agent/prompt-submit` may still return an explicit + * replacement. + */ send(content: ContentBlock[], options?: SendOptions): void /** * Steer a running turn: content is injected between steps of the current - * turn. When idle, behaves like {@link send}. + * turn. Uses the same owned-value and synchronous-validation boundary as + * {@link send}; when idle, behaves exactly like that method. */ steer(content: ContentBlock[], options?: SendOptions): void diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index b8bcde4c9a..17e9e74f50 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -7,19 +7,19 @@ This matrix shows which packages dispatch each harness-owned event and which pac | Event | Mode | Declared in | Dispatchers | Listeners | | --- | --- | --- | --- | --- | -| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:307`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:322`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:596`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:428`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | -| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:446`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | -| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:350`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | -| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:475`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:527`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | -| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:371`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | -| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:336`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | -| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:542`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | -| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:560`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | -| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:579`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | +| `agent/created` | `emit` | [`packages/core/agent/src/types.ts:316`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/disposed` | `emit` | [`packages/core/agent/src/types.ts:331`](../packages/core/agent/src/types.ts) | [`agent`](../packages/core/agent) (`events.dispatch`) | [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/error` | `emit` | [`packages/core/agent/src/types.ts:608`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/pre-step` | `serial` | [`packages/core/agent/src/types.ts:440`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`serial`) | [`compact-basic`](../packages/compact/compact-basic), [`user-approval`](../packages/ui/user-approval) | +| `agent/prompt-submit` | `waterfall` | [`packages/core/agent/src/types.ts:458`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`acp`](../packages/ui/acp), [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | +| `agent/queued` | `emit` | [`packages/core/agent/src/types.ts:362`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | - | +| `agent/request` | `waterfall` | [`packages/core/agent/src/types.ts:487`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/session-prefix` | `waterfall` | [`packages/core/agent/src/types.ts:539`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`tool-skill`](../packages/skill/tool-skill) | +| `agent/session-start` | `emit` | [`packages/core/agent/src/types.ts:383`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex), [`invariants`](../packages/support/invariants) | +| `agent/status` | `emit` | [`packages/core/agent/src/types.ts:345`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`repeat-tool-guard`](../packages/guard/repeat-tool-guard), [`stdio-agent`](../packages/ui/stdio-agent) | +| `agent/step-result` | `waterfall` | [`packages/core/agent/src/types.ts:554`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | - | +| `agent/turn-continuation` | `waterfall` | [`packages/core/agent/src/types.ts:572`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`waterfall`) | [`hooks-claude`](../packages/hooks/hooks-claude), [`hooks-codex`](../packages/hooks/hooks-codex) | +| `agent/turn-stop` | `serial` | [`packages/core/agent/src/types.ts:591`](../packages/core/agent/src/types.ts) | [`agent-loop`](../packages/core/agent-loop) (`strictSerial (serial)`) | [`subagent-inprocess`](../packages/subagent/subagent-inprocess) | | `approval/request` | `waterfall` | [`packages/ui/user-approval/src/index.ts:72`](../packages/ui/user-approval/src/index.ts) | [`user-approval`](../packages/ui/user-approval) (`waterfall`) | [`acp`](../packages/ui/acp) | | `fs/edit-intent` | `waterfall` | [`packages/fs/fs/src/index.ts:123`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`waterfall`) | [`fs-policy`](../packages/fs/fs-policy) | | `fs/observed` | `emit` | [`packages/fs/fs/src/index.ts:138`](../packages/fs/fs/src/index.ts) | [`tool-fs`](../packages/fs/tool-fs) (`emit`) | [`fs-policy`](../packages/fs/fs-policy) | diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md index 0fbd3d647e..c94f0cee63 100644 --- a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -419,6 +419,7 @@ Capture does not imply uniform eager callback type-checking. Agent `setup` is ca |---|---|---| | Tool and `SubagentProvider` registration | Original callback receiver | Name, flags, schemas, scalar config | | Agent create/resume | Caller context, setup callback | IDs, options, session metadata and seed | +| Agent send/steer | None | Content blocks and resolved message source | | Approval request | Agent and abort signal | Tool name, call ID, and reason | | Tool execution | Agent, signal, registry-minted parent token | Call identity and arguments | | Session append/load | Session identity | Header and event envelopes | @@ -426,6 +427,8 @@ Capture does not imply uniform eager callback type-checking. Agent `setup` is ca Before agent setup can run, the concrete agent pins its accepted ID, options, and session and binds `ctx` once. Registry detach closures likewise close over their accepted keys instead of rereading mutable public fields. +`send()` and running `steer()` resolve the message source once and materialize `{ content, source }` as one detached, deeply frozen lossless-JSON record before `agent/queued` or inbox insertion. The notification and FIFO share that accepted content and source; its metadata wrapper is frozen separately, so neither retained caller references nor an earlier notification listener can rewrite what a later listener, the session log, or the model sees. Invalid content or source throws synchronously without notification, enqueue, or loop wakeup; idle `steer()` delegates to the same `send()` boundary. The later `agent/prompt-submit` waterfall can still replace a queued prompt by returning new content; ownership forbids in-place mutation, not the explicit rewrite protocol. + A stateful getter shows why validation and ownership must use the same capture: ```js diff --git a/packages/core/agent-loop/README.md b/packages/core/agent-loop/README.md index daf7e10d76..8f6b9604c5 100644 --- a/packages/core/agent-loop/README.md +++ b/packages/core/agent-loop/README.md @@ -44,7 +44,7 @@ Agents listed in config are auto-created at startup. `cwd` applies only to fresh - `ReactLoopAgent` — the concrete `Agent` implementation. Its inbox is a JavaScript native-private field, and one prepared session can be claimed by only one concrete driver. Everything observable happens through session events and the `agent/*` event taxonomy. -`Inbox`, `runLoop`, and the instance-bound enable/start controls are package-internal. The package root does not export them, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than constructing or starting the driver internals. +`Inbox`, `runLoop`, and the instance-bound enable/start controls are package-internal. The package root does not export them, and the package exports map exposes no `./src/*` escape hatch; lifecycle owners create agents through `ctx.agents` rather than constructing or starting the driver internals. `ReactLoopAgent.send()` and running `steer()` materialize content plus resolved source once as detached, deeply frozen lossless JSON, then share that accepted record between `agent/queued` and the inbox; malformed data throws before either boundary. ### Loop lifecycle (`loop.ts`) diff --git a/packages/core/agent-loop/src/agent.ts b/packages/core/agent-loop/src/agent.ts index 6ea60c4958..16f10168b6 100644 --- a/packages/core/agent-loop/src/agent.ts +++ b/packages/core/agent-loop/src/agent.ts @@ -12,8 +12,8 @@ import type { AgentId, AgentOptions, AgentStatus, SendOptions } from '@deepseek- import type { Agent } from '@deepseek-ai/dsh-agent' import { deepFreeze } from '@deepseek-ai/dsh-llm' import type { ContentBlock, MessageSource } from '@deepseek-ai/dsh-llm' -import type { Session } from '@deepseek-ai/dsh-session' -import { Inbox } from './inbox.ts' +import { snapshotJsonValue, type Session } from '@deepseek-ai/dsh-session' +import { Inbox, type InboxMessage } from './inbox.ts' import { isTurnOpen, lastTurnNumber, runLoop } from './loop.ts' /** Agents whose rollback-covered publication enabled driving. */ @@ -213,6 +213,26 @@ export class ReactLoopAgent implements Agent { return options?.source ?? { kind: 'user' } } + /** + * Accept one public send/steer payload as the exact detached record shared by + * the live notification and inbox. Lossless-JSON materialization reads every + * nested field once; deep freeze prevents an observer from rewriting queued + * work before the loop drains it. + */ + private acceptInboxMessage(content: ContentBlock[], options?: SendOptions): InboxMessage { + const source = this.resolveSource(options) + const accepted = snapshotJsonValue({ content, source }) + if (accepted === undefined) { + throw new TypeError('agent message content and source must be losslessly JSON-serializable') + } + return deepFreeze(accepted) + } + + /** Reject a driving operation once teardown has synchronously closed the agent. */ + private assertNotDisposed(): void { + if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`) + } + /** Reject every driving verb while creation setup still owns the agent. */ private assertDriveEnabled(action: string): void { if (driveEnabledAgents.has(this)) return @@ -221,24 +241,29 @@ export class ReactLoopAgent implements Agent { send(content: ContentBlock[], options?: SendOptions): void { this.assertDriveEnabled('send') - if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`) - const source = this.resolveSource(options) - this.#inbox.enqueue({ content, source }) - agentEvents(this.loopCtx, this).emit('agent/queued', content, { source, steering: false }) + this.assertNotDisposed() + const accepted = this.acceptInboxMessage(content, options) + // Materialization invokes caller getters, which may reenter handle disposal. + this.assertNotDisposed() + this.#inbox.enqueue(accepted) + const info = deepFreeze({ source: accepted.source, steering: false }) + agentEvents(this.loopCtx, this).emit('agent/queued', accepted.content, info) } steer(content: ContentBlock[], options?: SendOptions): void { this.assertDriveEnabled('steer') - if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`) + this.assertNotDisposed() if (this._status !== 'running') { this.send(content, options); return } - const source = this.resolveSource(options) - this.#inbox.steer({ content, source }) - agentEvents(this.loopCtx, this).emit('agent/queued', content, { source, steering: true }) + const accepted = this.acceptInboxMessage(content, options) + this.assertNotDisposed() + this.#inbox.steer(accepted) + const info = deepFreeze({ source: accepted.source, steering: true }) + agentEvents(this.loopCtx, this).emit('agent/queued', accepted.content, info) } inject(content: ContentBlock[], options?: SendOptions): void { this.assertDriveEnabled('inject') - if (this._status === 'disposed') throw new Error(`agent "${this.id}" is disposed`) + this.assertNotDisposed() const source = this.resolveSource(options) if (isTurnOpen(this.session)) { // A turn is open in the LOG (decided from the log, not agent status — diff --git a/packages/core/agent-loop/src/loop.ts b/packages/core/agent-loop/src/loop.ts index 8c30e42257..756c007c45 100644 --- a/packages/core/agent-loop/src/loop.ts +++ b/packages/core/agent-loop/src/loop.ts @@ -291,11 +291,15 @@ export async function runLoop(ctx: Context, agent: ReactLoopAgent, handle: LoopH // the previous turn/end), where the persistence backend drops it as a // crash tail (the turn-enclosure RFC). Report via agent/error + the logger only; the // driver survives and moves on. + /* v8 ignore start -- defensive internal-corruption backstop: public + * send/steer input is accepted as lossless JSON before enqueue, and + * runTurn contains every failure after turn/start. */ const err = toError(error) ctx.logger.warn(`agent "${agent.id}": turn ${turn} failed before it started: ${err.message}`) try { events.emit('agent/error', turn, 0, err) } catch { /* contained: a throwing agent/error listener must not kill the driver */ } + /* v8 ignore stop */ } // Reset the cancel marker UNCONDITIONALLY here, after the turn returns and @@ -730,9 +734,10 @@ async function runTurn( // `closeStep()` IS idempotent (guarded by `stepOpen`) — it may have run // already in a step branch, so running it again is a safe no-op. Absent // turn/start means the append threw BEFORE its push (a non-serializable - // trigger — impossible for our fixed trigger); nothing was opened, so rethrow + // trigger outside the public lossless-JSON boundary); nothing was opened, so rethrow // to the runLoop backstop. const turnStartLogged = session.events.some(e => e.type === 'turn/start' && e.data.turn === turn) + /* v8 ignore next -- defensive internal-corruption path; public inbox input is lossless JSON */ if (!turnStartLogged) throw error closeStep() // Choose the close reason. Disposal wins only if no error was already diff --git a/packages/core/agent-loop/tests/coverage-edges.spec.ts b/packages/core/agent-loop/tests/coverage-edges.spec.ts index 7a044bfb57..ee58fcd66e 100644 --- a/packages/core/agent-loop/tests/coverage-edges.spec.ts +++ b/packages/core/agent-loop/tests/coverage-edges.spec.ts @@ -35,31 +35,24 @@ function send(agent: ReactLoopAgent, text: string) { agent.send([{ type: 'text', text }]) } -describe('turn boundary listener throws (handled in-turn, loop survives)', () => { - it('a pre-push turn/start failure (non-serializable source) is rethrown to the runLoop backstop', async () => { - // A non-serializable message source makes the turn/start append throw BEFORE - // the event is pushed (Session.append validates before push), so turn/start - // never enters the log. runTurn sees no logged turn/start and rethrows; the - // runLoop backstop reports via agent/error (step 0) + the logger and the - // driver survives. This is the ONLY path that reaches the backstop. - const adapter = new MockAdapter([textResponse('turn 2')]) +describe('inbox acceptance', () => { + it('rejects non-serializable content or source synchronously before notification or enqueue', async () => { + const adapter = new MockAdapter([textResponse('turn 1')]) const ctx = await harness(adapter) const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' }) + let queued = 0 + ctx.on('agent/queued', () => { queued += 1 }) - const errors: { turn: number; step: number; message: string }[] = [] - ctx.on('agent/error', (_a, turn, step, error) => void errors.push({ turn, step, message: error.message })) + expect(() => { + agent.send([{ type: 'text', text: 'first', bad: 1n } as never]) + }).toThrow(/losslessly JSON-serializable/) + expect(() => { + agent.send([{ type: 'text', text: 'first' }], { source: { kind: 'plugin', plugin: 'p', bad: 1n } as never }) + }).toThrow(/losslessly JSON-serializable/) + expect(queued).toBe(0) + expect(agent.session.events).toHaveLength(0) - // A non-serializable source (BigInt) on the queued message. - agent.send([{ type: 'text', text: 'first' }], { source: { kind: 'plugin', plugin: 'p', bad: 1n } as never }) - await waitForIdle(ctx, agent) - - expect(errors).toHaveLength(1) - expect(errors[0]!.step).toBe(0) - expect(errors[0]!.message).toMatch(/non-JSON-serializable/) - // No turn boundary was written (the turn/start append threw before push). - expect(agent.session.events.some(e => e.type === 'turn/start')).toBe(false) - - // loop survives: a well-formed second turn runs normally. + // The rejected value never woke or poisoned the loop; a valid message runs. send(agent, 'second') await waitForIdle(ctx, agent) expect(adapter.requests).toHaveLength(1) diff --git a/packages/core/agent-loop/tests/review-fixes.spec.ts b/packages/core/agent-loop/tests/review-fixes.spec.ts index 3cfa743b65..4c68ac53bd 100644 --- a/packages/core/agent-loop/tests/review-fixes.spec.ts +++ b/packages/core/agent-loop/tests/review-fixes.spec.ts @@ -1,6 +1,6 @@ import { describe, expect, it } from 'vitest' import { Context } from 'cordis' -import LlmService, { CallId, MessageSource, StreamChunk } from '@deepseek-ai/dsh-llm' +import LlmService, { CallId, ContentBlock, MessageSource, StreamChunk } from '@deepseek-ai/dsh-llm' import SessionStore, { Session, SessionEvent, SessionId, TurnEndReason } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools' @@ -437,6 +437,127 @@ describe('MEDIUM: misc registry and config fixes', () => { const steeringSources = agent.session.events.flatMap(e => e.type === 'steering/message' ? [e.data.source] : []) expect(steeringSources).toEqual([{ kind: 'plugin', plugin: 'goal' }]) }) + + it('send() owns content and source before notification and delivery', async () => { + const adapter = new MockAdapter([textResponse('done')]) + const ctx = await harness(adapter) + const agent = ctx.agentLoop.create(AgentId('owned-send'), { model: 'mock' }) + const content = [{ type: 'text' as const, text: 'accepted-send' }] + const source = { kind: 'plugin' as const, plugin: 'accepted-source' } + let notifiedContent: ContentBlock[] | undefined + let notifiedSource: MessageSource | undefined + let notifiedInfoFrozen = false + ctx.on('agent/queued', (subject, acceptedContent, info) => { + if (subject !== agent || info.steering) return + // Retain the exact notification references: cloning here would test the + // listener's copy rather than the event/inbox ownership boundary. + notifiedContent = acceptedContent + notifiedSource = info.source + notifiedInfoFrozen = Object.isFrozen(info) + }) + + agent.send(content, { source }) + content[0]!.text = 'caller-mutated-send' + source.plugin = 'caller-mutated-source' + await waitForIdle(ctx, agent) + + expect(notifiedContent).toEqual([{ type: 'text', text: 'accepted-send' }]) + expect(notifiedSource).toEqual({ kind: 'plugin', plugin: 'accepted-source' }) + expect(Object.isFrozen(notifiedContent)).toBe(true) + expect(Object.isFrozen(notifiedContent?.[0])).toBe(true) + expect(Object.isFrozen(notifiedSource)).toBe(true) + expect(notifiedInfoFrozen).toBe(true) + const recorded = agent.session.events.flatMap(event => event.type === 'user/message' ? [event.data] : []) + expect(recorded).toContainEqual({ + content: [{ type: 'text', text: 'accepted-send' }], + source: { kind: 'plugin', plugin: 'accepted-source' }, + }) + const request = JSON.stringify(adapter.requests[0]!.messages) + expect(request).toContain('accepted-send') + expect(request).not.toContain('caller-mutated-send') + }) + + it('send() rechecks disposal after materializing caller getters', async () => { + const adapter = new MockAdapter([textResponse('unused')]) + const ctx = await harness(adapter) + const handle = await ctx.agents.create({ + agentId: AgentId('reentrant-send-dispose'), + sessionId: SessionId('reentrant-send-dispose-session'), + agentOptions: { model: 'mock' }, + }) + const { agent } = handle + let queued = 0 + ctx.on('agent/queued', subject => void (queued += Number(subject === agent))) + const content = [{ + type: 'text' as const, + get text() { + void handle.dispose() + return 'accepted-after-dispose' + }, + }] + + expect(() => { agent.send(content) }).toThrow(/agent "reentrant-send-dispose" is disposed/) + await handle.dispose() + + expect(queued).toBe(0) + expect(agent.session.events).toHaveLength(0) + expect(adapter.requests).toHaveLength(0) + }) + + it('running steer() owns content and source before notification and delivery', async () => { + const adapter = new MockAdapter([toolCallResponse('c1', 'gate', {}), textResponse('done')]) + const ctx = await harness(adapter) + const agent = ctx.agentLoop.create(AgentId('owned-steer'), { model: 'mock' }) + const entered = Promise.withResolvers() + const release = Promise.withResolvers() + ctx.tools.register(defineTool({ + name: 'gate', + description: '', + parameters: {}, + async execute() { + entered.resolve(undefined) + await release.promise + return [{ type: 'text', text: 'tool done' }] + }, + })) + let notifiedContent: ContentBlock[] | undefined + let notifiedSource: MessageSource | undefined + let notifiedInfoFrozen = false + ctx.on('agent/queued', (subject, acceptedContent, info) => { + if (subject !== agent || !info.steering) return + notifiedContent = acceptedContent + notifiedSource = info.source + notifiedInfoFrozen = Object.isFrozen(info) + }) + + agent.send([{ type: 'text', text: 'start' }]) + await entered.promise + expect(agent.status).toBe('running') + const content = [{ type: 'text' as const, text: 'accepted-steer' }] + const source = { kind: 'plugin' as const, plugin: 'accepted-source' } + agent.steer(content, { source }) + content[0]!.text = 'caller-mutated-steer' + source.plugin = 'caller-mutated-source' + const idle = waitForIdle(ctx, agent) + release.resolve(undefined) + await idle + + expect(notifiedContent).toEqual([{ type: 'text', text: 'accepted-steer' }]) + expect(notifiedSource).toEqual({ kind: 'plugin', plugin: 'accepted-source' }) + expect(Object.isFrozen(notifiedContent)).toBe(true) + expect(Object.isFrozen(notifiedContent?.[0])).toBe(true) + expect(Object.isFrozen(notifiedSource)).toBe(true) + expect(notifiedInfoFrozen).toBe(true) + const recorded = agent.session.events.flatMap(event => event.type === 'steering/message' ? [event.data] : []) + expect(recorded).toContainEqual({ + turn: 1, + content: [{ type: 'text', text: 'accepted-steer' }], + source: { kind: 'plugin', plugin: 'accepted-source' }, + }) + const request = JSON.stringify(adapter.requests[1]!.messages) + expect(request).toContain('accepted-steer') + expect(request).not.toContain('caller-mutated-steer') + }) }) describe('MEDIUM: turn numbering continues across seeded (forked) sessions', () => { diff --git a/packages/core/agent/README.md b/packages/core/agent/README.md index ad34cbd76d..3663808847 100644 --- a/packages/core/agent/README.md +++ b/packages/core/agent/README.md @@ -39,8 +39,8 @@ Turn and step boundaries and the model token stream are durable `session/event` The handle every plugin programs against: -- `agent.send(content, options?)` — queue a message; starts a turn when idle -- `agent.steer(content, options?)` — steer a running turn (inject between steps); behaves like `send` when idle +- `agent.send(content, options?)` — queue a message; starts a turn when idle. Content and resolved source become one detached, deeply frozen lossless-JSON record before `agent/queued` and enqueue; invalid data throws synchronously, and caller or notification-listener in-place mutation cannot change the log or model input (`agent/prompt-submit` still rewrites by returning replacement content). +- `agent.steer(content, options?)` — steer a running turn (inject between steps); uses the same owned acceptance boundary and behaves like `send` when idle - `agent.inject(content, options?)` — inject in-session context (context/message event); the next request sees it. Does not run the model. While a turn is open it joins that turn; while idle it is wrapped in a one-shot `injection` turn so every event stays turn-enclosed ([the turn-enclosure invariant](../../../docs/rfc/implemented/architecture/2026-06-15-turn-enclosure-invariant.md)) - `agent.cancel(reason?)` — cancel ALL pending work: clears the queued + steering FIFOs, aborts the in-flight step, and drops a turn about to start (the pre-step window) so a queued-but-not-started prompt never runs. A UI/ACP `session/cancel` maps to this. The single public stop primitive. Idle with nothing pending → a safe no-op. - `agent.whenIdle()` — resolve once the agent reaches quiescence after settling out of `running` (idle → immediately; disposed → awaits the loop exit). A non-owner's quiescence-observation hook: it observes the work settling WITHOUT tearing the agent down. Teardown is separate — a lifecycle owner stops and unregisters via `AgentHandle.dispose()`, which awaits the loop exit directly. diff --git a/packages/core/agent/src/types.ts b/packages/core/agent/src/types.ts index 0e914888b9..419cc9d1fe 100644 --- a/packages/core/agent/src/types.ts +++ b/packages/core/agent/src/types.ts @@ -202,12 +202,21 @@ export interface Agent { */ readonly ctx: Context - /** Queue a user message. Starts a turn when idle; otherwise waits for the next turn. */ + /** + * Queue a user message. Starts a turn when idle; otherwise waits for the next + * turn. Content and the resolved source are accepted as one detached, + * deeply-frozen lossless-JSON record before notification or enqueue, so + * caller or `agent/queued` listener in-place mutation cannot change later + * log/model input. Throws synchronously when either value is not losslessly + * JSON-serializable; `agent/prompt-submit` may still return an explicit + * replacement. + */ send(content: ContentBlock[], options?: SendOptions): void /** * Steer a running turn: content is injected between steps of the current - * turn. When idle, behaves like {@link send}. + * turn. Uses the same owned-value and synchronous-validation boundary as + * {@link send}; when idle, behaves exactly like that method. */ steer(content: ContentBlock[], options?: SendOptions): void @@ -335,11 +344,14 @@ declare module 'cordis' { */ 'agent/status'(this: Scoped, agent: Agent, status: AgentStatus): void /** - * A message entered the agent's inbox (queued or steering). `source` is - * the resolved source (defaults applied), not the caller's raw options. + * A message entered the agent's inbox (queued or steering). Content and the + * resolved source are the detached, deeply-frozen values retained by the + * inbox; the `info` wrapper is frozen too, so one listener cannot rewrite + * what another listener observes. `source` has defaults applied and is not + * the caller's raw options. * @param agent - the agent whose inbox received the message. - * @param content - the enqueued content blocks, verbatim. - * @param info - the resolved source plus whether it entered as steering. + * @param content - the accepted content blocks retained by the inbox. + * @param info - the accepted source plus whether it entered as steering. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): a listener registered * through `agent.ctx` fires only for that agent's dispatches; a listener on a * plain plugin context fires for every agent. The dispatch `this` is the From 11a074b6644736234c88c4ff21ca36edeab400b7 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 17:17:38 +0800 Subject: [PATCH 13/21] docs(rfc): add agent-scope diagrams --- .../2026-07-08-agent-scope-contexts.md | 38 ++++++++++++++ .../2026-07-12-agent-scope-runtime-design.md | 49 +++++++++++++++++++ 2 files changed, 87 insertions(+) diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 9f380e6dc1..024eb05f82 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -27,6 +27,24 @@ The contract has four parts: The scope is deliberately flat. Resolution never walks parent or sibling scopes. Parent ownership links lifetimes without importing registrations. +For scope-aware registries and default listener routing, the whole mechanism can be read from left to right: the registering context chooses a layer, while the agent named by an operation chooses which one local layer joins the deployment-global layer. + +```mermaid +flowchart LR + plain["Plain plugin context
cleanup follows the plugin"] -->|"registers into"| globalLayer["Deployment-global layer"] + agentAContext["agentA.ctx
cleanup follows Agent A"] -->|"registers into"| agentALayer["Agent A layer"] + agentBContext["agentB.ctx
cleanup follows Agent B"] -->|"registers into"| agentBLayer["Agent B layer"] + + operationA["Operation for Agent A"] -->|"selects"| agentAView["Agent A view
eligible globals plus A local only"] + globalLayer --> agentAView + agentALayer --> agentAView + operationB["Operation for Agent B"] -->|"selects"| agentBView["Agent B view
eligible globals plus B local only"] + globalLayer --> agentBView + agentBLayer --> agentBView +``` + +The missing cross-edges describe registry resolution and default listener routing: Agent A's registered values and ordinary scoped listeners do not enter Agent B's view, and a parent's layer does not enter a child's view merely because the parent owns the child's lifetime. For scope-filtered events, `{ global: true }` is the explicit opt-in exception; it can observe across scopes while cleanup still follows the registering agent. Registry-membership notifications are a separate unfiltered event class described below. + The companion [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains how the implementation preserves this contract under Cordis dispatch, JavaScript mutation and reentrancy, asynchronous setup, rollback, and racing disposal. ### Registration origin selects visibility and cleanup @@ -103,6 +121,26 @@ The returned promise resolves only after setup, ordered lifecycle notification, The calling Cordis context and AgentLoop are structural co-owners. Unloading either disposes the agent, so creation through a short-lived plugin context intentionally gives the agent that shorter lifetime. +The lifecycle keeps the local layer private until setup succeeds and keeps it alive until final work has drained: + +```mermaid +flowchart TB + request["Create or resume"] --> reserve["Reserve agent and session IDs"] + reserve --> privateWorld["Load or build private session, scope, and driver"] + privateWorld --> setup["Await setup through agent.ctx"] + setup --> publish["Publish session and agent, then start the loop"] + publish --> live["Return the live handle"] + + privateWorld -->|"load or preparation failure, or owner loss"| rollback["Rollback startup
no handle escapes"] + setup -->|"setup failure or owner loss"| rollback + publish -->|"publication failure or owner loss"| rollback + live -->|"handle disposal, owner unload, or AgentLoop unload"| settle["Quiesce prepared or running work"] + rollback --> settle + settle --> detach["Detach any published agent, then session"] + detach --> revoke["Dispose any created agent scope"] + revoke --> release["Release acquired IDs"] +``` + Contributors should put agent-local activation inside `setup` and always dispose the returned handle. Code that needs to observe a live agent waits for `create()`/`resume()` to resolve rather than polling the registries during setup. ## Tool restrictions resolve against a live flat view diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md index c94f0cee63..988a30968f 100644 --- a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -249,6 +249,37 @@ Two services split the public API from the implementation. `AgentRegistry`, reac | Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | | Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | +The implementation treats success, rollback, handle disposal, caller unload, and AgentLoop unload as entrances to one owned transaction rather than separate cleanup algorithms: + +```mermaid +flowchart TB + caller["Caller context owner"] --> transaction["Owned create or resume transaction"] + factory["AgentLoop structural owner"] --> transaction + + subgraph creation["Create or resume"] + transaction --> reserve["Reserve both IDs and install trackers"] + reserve --> prepare["Load persistence or prepare the session"] + prepare --> lifecycle["Install the complete caller-owned lifecycle"] + lifecycle --> setup["Await unpublished setup"] + setup --> enter["Enter session and agent registries"] + enter --> announce["Emit session/created, then agent/created"] + announce --> start["Enable driving, emit agent/session-start, start driver"] + end + + transaction -.->|"reservation, load, or preparation failure before lifecycle handoff"| earlyRollback["Release acquired tracking and reservations"] + start --> live["Live handle"] + lifecycle -.->|"failure or owner loss before a handle escapes"| dispose["Join the lifecycle cleanup boundary"] + live -->|"dispose or either owner unloads"| dispose + + subgraph teardown["Reverse-order teardown"] + dispose --> barrier["Wait for synchronous publication to unwind"] + barrier --> drain["Stop driver and complete final flushes"] + drain --> detach["Detach agent, then session"] + detach --> scope["Dispose agent scope to quiescence"] + scope --> release["Release session and agent IDs"] + end +``` + The [public lifecycle contract](2026-07-08-agent-scope-contexts.md#creation-publishes-after-setup-disposal-revokes-after-work-stops) defines what callers observe. The following sections justify each ownership and ordering fact behind that contract. ### Reservations precede awaiting; lifecycle ownership precedes setup @@ -429,6 +460,24 @@ Before agent setup can run, the concrete agent pins its accepted ID, options, an `send()` and running `steer()` resolve the message source once and materialize `{ content, source }` as one detached, deeply frozen lossless-JSON record before `agent/queued` or inbox insertion. The notification and FIFO share that accepted content and source; its metadata wrapper is frozen separately, so neither retained caller references nor an earlier notification listener can rewrite what a later listener, the session log, or the model sees. Invalid content or source throws synchronously without notification, enqueue, or loop wakeup; idle `steer()` delegates to the same `send()` boundary. The later `agent/prompt-submit` waterfall can still replace a queued prompt by returning new content; ownership forbids in-place mutation, not the explicit rewrite protocol. +The inbox path makes that accepted-value boundary concrete. Getter evaluation happens during materialization, so liveness is rechecked before the accepted record crosses into an inbox FIFO: + +```mermaid +flowchart TB + callerInput["Caller-owned content and source"] --> initialCheck["Require a live, drive-enabled agent"] + initialCheck --> accept["Resolve source once; materialize and deep-freeze one record"] + accept -->|"invalid lossless JSON"| invalidReject["Throw synchronously; no inbox insertion, agent/queued, or loop wakeup"] + accept -->|"accepted"| liveness["Recheck disposal after caller getters"] + liveness -->|"disposed reentrantly"| disposedReject["Throw disposed; do not insert or announce the message"] + liveness -->|"still live"| inbox["Insert the record into the queued or steering FIFO"] + inbox -->|"same frozen content and source"| queued["Emit agent/queued with a frozen metadata wrapper"] + inbox -->|"if later drained, read the same owned record"| drain["Loop-owned delivery"] + inbox -->|"cancel before drain"| cancelled["Clear the pending record without delivery"] + inbox -->|"disposal wins before drain"| disposed["Stop delivery; the disposed agent may retain the pending record"] + drain -->|"queued prompt"| prompt["agent/prompt-submit may block or explicitly replace"] + drain -->|"steering consumed by an active turn"| steering["Append steering/message"] +``` + A stateful getter shows why validation and ownership must use the same capture: ```js From 50873b8bd0c03fccefc2b063c72cf7073db955aa Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 18:10:04 +0800 Subject: [PATCH 14/21] docs(rfc): remove redundant lifecycle diagram --- .../2026-07-12-agent-scope-runtime-design.md | 31 ------------------- 1 file changed, 31 deletions(-) diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md index 988a30968f..318c07ad31 100644 --- a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -249,37 +249,6 @@ Two services split the public API from the implementation. `AgentRegistry`, reac | Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | | Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | -The implementation treats success, rollback, handle disposal, caller unload, and AgentLoop unload as entrances to one owned transaction rather than separate cleanup algorithms: - -```mermaid -flowchart TB - caller["Caller context owner"] --> transaction["Owned create or resume transaction"] - factory["AgentLoop structural owner"] --> transaction - - subgraph creation["Create or resume"] - transaction --> reserve["Reserve both IDs and install trackers"] - reserve --> prepare["Load persistence or prepare the session"] - prepare --> lifecycle["Install the complete caller-owned lifecycle"] - lifecycle --> setup["Await unpublished setup"] - setup --> enter["Enter session and agent registries"] - enter --> announce["Emit session/created, then agent/created"] - announce --> start["Enable driving, emit agent/session-start, start driver"] - end - - transaction -.->|"reservation, load, or preparation failure before lifecycle handoff"| earlyRollback["Release acquired tracking and reservations"] - start --> live["Live handle"] - lifecycle -.->|"failure or owner loss before a handle escapes"| dispose["Join the lifecycle cleanup boundary"] - live -->|"dispose or either owner unloads"| dispose - - subgraph teardown["Reverse-order teardown"] - dispose --> barrier["Wait for synchronous publication to unwind"] - barrier --> drain["Stop driver and complete final flushes"] - drain --> detach["Detach agent, then session"] - detach --> scope["Dispose agent scope to quiescence"] - scope --> release["Release session and agent IDs"] - end -``` - The [public lifecycle contract](2026-07-08-agent-scope-contexts.md#creation-publishes-after-setup-disposal-revokes-after-work-stops) defines what callers observe. The following sections justify each ownership and ordering fact behind that contract. ### Reservations precede awaiting; lifecycle ownership precedes setup From e8fed4fb66fcb38c768ec9a3abb4a7a92a70bb08 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 18:57:42 +0800 Subject: [PATCH 15/21] fix(session): contain post-commit observers --- docs/cookbook/extension-cookbook.md | 2 +- docs/cordis-catalog/events.md | 6 +- docs/cordis-catalog/services.md | 2 +- docs/event-producer-consumer.md | 4 +- ...-18-agent-lifecycle-and-ownership-seams.md | 4 +- .../2026-06-30-event-domain-semantics.md | 4 +- .../2026-07-05-reconstructable-requests.md | 2 +- .../2026-07-12-agent-scope-runtime-design.md | 16 +- .../feature/2026-07-06-approval-seam.md | 2 +- ...-20-remove-agent-boundary-mirror-events.md | 2 +- packages/core/agent-loop/src/agent.ts | 36 +- packages/core/agent-loop/src/loop.ts | 114 ++----- packages/core/agent-loop/tests/agent.spec.ts | 6 +- .../agent-loop/tests/coverage-edges.spec.ts | 15 +- packages/core/agent-loop/tests/loop.spec.ts | 13 +- .../agent-loop/tests/review-fixes.spec.ts | 194 +++++++---- packages/core/session/README.md | 10 +- packages/core/session/src/index.ts | 315 +++++++++++++----- packages/core/session/tests/scoped.spec.ts | 49 +++ packages/core/session/tests/session.spec.ts | 315 +++++++++++++++++- packages/support/invariants/README.md | 4 +- packages/support/invariants/src/index.ts | 204 +++++++++--- .../invariants/tests/invariants.spec.ts | 105 +++++- packages/ui/acp/README.md | 2 +- packages/ui/acp/src/index.ts | 60 ++-- packages/ui/acp/tests/dispose.spec.ts | 6 +- packages/ui/acp/tests/turns.spec.ts | 63 ++-- packages/ui/user-approval/README.md | 2 +- packages/ui/user-approval/src/index.ts | 63 +--- .../ui/user-approval/tests/approval.spec.ts | 6 +- scripts/gen-doc-graphs.ts | 15 + 31 files changed, 1166 insertions(+), 475 deletions(-) diff --git a/docs/cookbook/extension-cookbook.md b/docs/cookbook/extension-cookbook.md index f30d38e971..a16cda8799 100644 --- a/docs/cookbook/extension-cookbook.md +++ b/docs/cookbook/extension-cookbook.md @@ -56,7 +56,7 @@ export function apply(ctx: Context) { ## A client-driver plugin (external protocol bridge) -A *client driver* is a UI plugin whose "user" is another program speaking a wire protocol rather than a human at a terminal. It owns the process's stdio (so it must run with **no stdout logger** — every non-protocol byte corrupts the stream), creates/resumes agents on demand through the `dsh-agent` factory seam, translates harness events (`session/event`, `agent/*`) into outbound protocol messages, and translates inbound requests back into `agent.send()` / `agent.cancel()`. Two harness-specific contracts make it correct: resolve each request exactly once off a settle signal (settle from the durable `turn/end` session event — the boundary is a session event, not an `agent/*` mirror — with `agent/status` as the fallback if a peer listener starved yours), and tear each agent down through its `AgentHandle.dispose()` (which stops the loop, `await`s its exit, and unregisters), not just `cancel()` — disposal must *reach* quiescence, not merely request it. +A *client driver* is a UI plugin whose "user" is another program speaking a wire protocol rather than a human at a terminal. It owns the process's stdio (so it must run with **no stdout logger** — every non-protocol byte corrupts the stream), creates/resumes agents on demand through the `dsh-agent` factory seam, translates harness events (`session/event`, `agent/*`) into outbound protocol messages, and translates inbound requests back into `agent.send()` / `agent.cancel()`. Two harness-specific contracts make it correct: resolve each request exactly once from the durable `turn/end` session event, using `agent/status` only as defensive reconciliation against the canonical log, and tear each agent down through its `AgentHandle.dispose()` (which stops the loop, `await`s its exit, and unregisters), not just `cancel()` — disposal must *reach* quiescence, not merely request it. `packages/ui/acp` is the worked example: it bridges the agent to the Agent Client Protocol (JSON-RPC over stdio) so Zed and other ACP editors can drive it. See its README for the full method surface and the permission-prompt answerer it registers on the approval seam. diff --git a/docs/cordis-catalog/events.md b/docs/cordis-catalog/events.md index b69ed834b3..21e69f7a25 100644 --- a/docs/cordis-catalog/events.md +++ b/docs/cordis-catalog/events.md @@ -265,7 +265,7 @@ Source: [`packages/core/session/src/index.ts:64`](../../packages/core/session/sr ### `session/event` — emit -An event was appended to a session log (sync, fire-and-forget). This is the per-append feed a UI or invariant plugin tails. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. +An event was appended to a session log (sync, fire-and-forget). This is the per-append feed a UI or invariant plugin tails. The log push is the commit point; synchronous throws and returned-promise rejections from observers are logged and contained per listener, so they cannot make a committed append appear to fail or starve later listeners. The exact callback list and Cordis internal-dispatch checks resolve before the push; callbacks themselves run only after it. Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the session's owner scope, captured when the session was ENTERED (an agent's session is entered through `agent.ctx`, so its events dispatch in that agent's scope; a bare `sessions.create()` from a plain plugin dispatches subject-less). A listener registered through `agent.ctx` hears only that agent's sessions; a plain plugin listener hears every session. ```ts cordis-catalog 'session/event'(this: Scoped, session: Session, event: SessionEvent): void @@ -273,7 +273,7 @@ An event was appended to a session log (sync, fire-and-forget). This is the per- Types: [SessionEvent](../core-data-structures/core.md) -Source: [`packages/core/session/src/index.ts:78`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:83`](../../packages/core/session/src/index.ts) ### `session/flush` — parallel @@ -283,7 +283,7 @@ Awaited durability checkpoint. The agent loop awaits `ctx.sessions.flush(session 'session/flush'(this: Scoped, session: Session): Promise | void ``` -Source: [`packages/core/session/src/index.ts:96`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:101`](../../packages/core/session/src/index.ts) ## `skill/*` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index 877c10e080..67a6b7a725 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -224,7 +224,7 @@ fork(source: SessionForkSource, boundary?: number, childSessionId?: SessionId): Types: [SessionRegistrationReservation](../core-data-structures/session.md) -Source: [`packages/core/session/src/index.ts:667`](../../packages/core/session/src/index.ts) +Source: [`packages/core/session/src/index.ts:761`](../../packages/core/session/src/index.ts) ## `ctx.skills` — `SkillService` diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index 17e9e74f50..4f2aec7b44 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -27,8 +27,8 @@ This matrix shows which packages dispatch each harness-owned event and which pac | `llm/stream` | `waterfall` | [`packages/llm/llm/src/index.ts:39`](../packages/llm/llm/src/index.ts) | [`llm`](../packages/llm/llm) (`waterfall`) | [`invariants`](../packages/support/invariants), [`llm-replay`](../packages/support/llm-replay) | | `session/created` | `emit` | [`packages/core/session/src/index.ts:52`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence) | | `session/disposed` | `emit` | [`packages/core/session/src/index.ts:64`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | - | -| `session/event` | `emit` | [`packages/core/session/src/index.ts:78`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`emit`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | -| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:96`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`parallel`) | [`session-persistence`](../packages/session-persistence/session-persistence) | +| `session/event` | `emit` | [`packages/core/session/src/index.ts:83`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`acp`](../packages/ui/acp), [`invariants`](../packages/support/invariants), [`session-persistence`](../packages/session-persistence/session-persistence), [`stdio-agent`](../packages/ui/stdio-agent) | +| `session/flush` | `parallel` | [`packages/core/session/src/index.ts:101`](../packages/core/session/src/index.ts) | [`session`](../packages/core/session) (`events.dispatch`) | [`session-persistence`](../packages/session-persistence/session-persistence) | | `skill/provider-added` | `emit` | [`packages/skill/skill/src/index.ts:132`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `skill/provider-removed` | `emit` | [`packages/skill/skill/src/index.ts:138`](../packages/skill/skill/src/index.ts) | [`skill`](../packages/skill/skill) (`emit`) | - | | `subagent/end` | `emit` | [`packages/subagent/subagent/src/index.ts:134`](../packages/subagent/subagent/src/index.ts) | [`subagent`](../packages/subagent/subagent) (`events.dispatch`) | [`hooks-claude`](../packages/hooks/hooks-claude) | diff --git a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md index b727e357ee..80ca18b56f 100644 --- a/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md +++ b/docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md @@ -18,7 +18,7 @@ A new `cancel()` verb on the `Agent` interface — the single public stop primit `ctx.agents.create`/`resume` (and the `AgentFactory` interface) return `AgentHandle = { agent: Agent; dispose(): Promise }`. The disposer is a **consumer capability** — a registry observer holding only the bare `Agent` cannot tear it down. The caller fiber and registered factory provider are structural co-owners: caller unload enforces structured ownership, while provider unload must stop old instances whose scoped dependency surface resolves through that provider. All three paths reach the same memoized teardown: stop the loop, `await` its exit (true quiescence, not just the `disposed` status flip), unregister it, remove its session from the store, unwind its scope, and only then release both public IDs. Config-created agents are already owned by the `AgentLoop` fiber (the handle is discarded). ACP holds each session's disposer in its `SessionRecord` and runs it on disconnect/teardown, so a bare client disconnect leaves no registered agent and no session-store entry — even when `session/load` races teardown (the just-resumed handle is disposed before the closed-guard throw). -**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race detaching the session store's private append observer against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The contained `agent/disposed` and `session/disposed` notifications cannot reject the chain or skip later teardown. +**Teardown ORDER is load-bearing for durability**, and the implementation folds the session lifecycle into the agent's SINGLE composite cordis effect (`SessionStore.prepare`/`enter`/`announce`, replacing a sibling-effect split). A fiber unload disposes sibling effects concurrently (`Promise.all`), which would race removing the session store's append publication hooks against the loop's closing `session/flush` and drop the closing `turn/end`; inside one effect the disposers run as an ordered LIFO chain (loop stopped + `await agent.done` BEFORE the session detaches), so the loop's final flush is captured on BOTH the handle's `dispose()` and a fiber unload. The contained `agent/disposed` and `session/disposed` notifications cannot reject the chain or skip later teardown. ### 3. Bash owner token in the seam @@ -40,7 +40,7 @@ The bash owner-token comparison relies on `session.header.id` being unique among ## Alternatives considered - **A public `BashTask.owner` field** instead of the `BashExecutor.ownerOf(id)` seam — rejected: one read path, no redundant API. -- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing the store-owned append observer's detach against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths. +- **Sibling cordis effects for the agent's session lifecycle** — rejected: a fiber unload disposes sibling effects concurrently (`Promise.all`), racing removal of the store-owned append publication hooks against the loop's closing `session/flush`; the single composite effect's ordered LIFO chain is what captures the closing `turn/end` on both disposal paths. - **A separate step-only `abort()` beside `cancel()`** — shipped originally, then removed as unused; `cancel()` is the single public stop primitive ([the public-stop-surface RFC](../simplification/2026-06-20-public-agent-stop-surface.md)). ## Consequences diff --git a/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md b/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md index 9375a6e248..f0ab95ca80 100644 --- a/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md +++ b/docs/rfc/implemented/architecture/2026-06-30-event-domain-semantics.md @@ -28,9 +28,9 @@ This is the foundational change in a stack that adds a Hooks subsystem; it estab ## Consequences -- The loop no longer emits any boundary mirror; `closeStep` appends `step/end` only and `closeTurn` appends `turn/end` only. A throwing `step/end`/`turn/end` session-event listener is the surviving boundary-listener failure path (contained inside `closeStep`/`closeTurn` — `Session.append` pushes the event before notifying listeners, so the boundary is durable and the turn closes balanced regardless). +- The loop no longer emits any boundary mirror; `closeStep` appends `step/end` only and `closeTurn` appends `turn/end` only. `Session.append` owns post-commit observer containment, so a throwing boundary observer cannot change the turn outcome or starve later consumers; an acceptance or internal validation failure still escapes before the boundary enters the log. - Tests that observed boundaries via the removed emits now observe the durable `turn/start`/`turn/end`/`step/start`/`step/end` session events — the behavior they pin (boundary ordering, step counting) is unchanged; only the feed they read moved to the canonical one. The tests that exercised a *throwing turn-boundary emit listener* were deleted, because that code path no longer exists (there is no emit to throw from). Per [AGENTS.md "tests document behavior, not golden truth"](../../../../AGENTS.md), the behavior and its test moved (or died) together. -- The loop marks the step open (`stepOpen = true`) BEFORE appending `step/start`, because `Session.append` pushes the event to the log before notifying `session/event` listeners (validation throws happen earlier, before the push — see [the session append contract](../../../core-data-structures/session.md)). So a throwing `step/start` session-event listener runs with the step already open and the event already in the log: the loop's outer catch then calls `closeStep()`, which appends the balancing `step/end`, and the turn closes balanced with an error (`turn/start → step/start → step/end → turn/end` — verified by the invariants oracle in the regression test). Closing the open step is owed precisely because the marker is set first. +- The loop marks the step open (`stepOpen = true`) only after `append('step/start')` returns. Internal dispatch validation runs before the log push and may reject without opening a step; post-commit `session/event` observer failures are contained inside `Session.append`. The marker therefore represents exactly the committed boundary that owes a later `step/end`. - The full realization of this is [the simplification RFC "Stop mirroring durable boundaries as agent events"](../simplification/2026-06-20-remove-agent-boundary-mirror-events.md): all four boundary mirrors are removed and every consumer reads boundaries off `session/event`. `agent/steering` (not a boundary mirror) stayed outside that RFC's scope and was removed by its own follow-up, [Remove the `agent/steering` mirror emit](../simplification/2026-07-04-remove-agent-steering-mirror.md) — it mirrored the durable `steering/message`. - The cordis events catalog (`docs/cordis-catalog/events.md`) is regenerated to drop the mirror events. diff --git a/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md b/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md index 73967c14b6..0b82e52581 100644 --- a/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md +++ b/docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md @@ -24,7 +24,7 @@ Prefix-cache stability is corollary #1, not the headline: an append-only log pro **The loop, transmission-stateless.** Per step: render assembly (every step — value comparison needs no change-signal discipline, and a section that varies per step surfaces as a *logged* header event per step instead of a silent bust) → on the instance's FIRST step only, the `agent/session-prefix` waterfall — request-ONLY messages fronting the entire derived history (a frozen empty seed, contributions returned as an extension of `next()`; the home for session-stable openers that must NOT become history — a skills catalog, an AGENTS.md digest), deep-frozen and cached on the instance so reuse is structural and the prefix cannot drift mid-session — → `agent/pre-step`, carrying the composed prefix (compaction's surface mutations land before derivation, and its pressure gate counts the prefix this instance will actually send — never a previous instance's logged one, which could under-gate a resumed/forked instance whose contributor grew) → **messages snapshot, then `step/start` appended as the next operation in the same synchronous frame** → seed the call config (first request of the instance: from `AgentOptions`, so explicit options always beat the logged baseline — fork model-overrides and resume reconfiguration stay correct; afterwards: from the folded header) → the `agent/request` waterfall, re-typed `(agent, turn, step, config: LlmCallConfig, next) → LlmCallConfig` — a frozen seed and a returned replacement are ALL a listener shapes; durable content flows through the log channels (`inject()`, steering, prompt-submit `additionalContext`, sections via `system-prompt/assemble`) — → the header event the request owes the log, carrying the prefix as `messagePrefix` (no session event carries it, so the header is its only durable record; resume = a new instance = a recompose, anchored by its `'resume'` snapshot) → build `GenerateOptions` from `messagePrefix + snapshot` + header, deep-freeze (`deepFreeze` exempts the `AbortSignal`, the one live control channel — freezing one breaks `AbortController.abort()`), dispatch. The loop's per-instance bookkeeping is one boolean plus the cached prefix: whether this instance has logged its anchoring snapshot, and what it composed. -**The reconstruction boundary is `step/start`, unconditionally.** A step's messages are the derivation over `events[0..stepStartSeq)`. Because the snapshot precedes the `step/start` append in the same synchronous frame, nothing can enter this request past the boundary: an `agent.inject()` from an `agent/request` listener (or any concurrent task, or a `session/event` listener firing on `step/start` itself) lands in the log after the boundary and joins the NEXT request. For waterfall-window appends this matches the prior loop (it also derived before its waterfall); for a synchronous `step/start` listener it is a deliberate change — such a listener could previously reach the current request — and `agent/pre-step` is the sanctioned seam for content that must affect the CURRENT request. A step's header for reconstruction is the fold after its own `request/header*` event (which sits between its `step/start` and first response event) or the fold carried forward. +**The reconstruction boundary is `step/start`, unconditionally.** A step's messages are the derivation over `events[0..stepStartSeq)`. Because the snapshot precedes the `step/start` append in the same synchronous frame, an `agent.inject()` from an `agent/request` listener or any concurrent task lands after the boundary and joins the NEXT request. `session/event` is observe-only during publication: a reentrant append is rejected until the current callback list drains, preventing nested event delivery from overtaking the event being observed. `agent/pre-step` is the sanctioned seam for content that must affect the CURRENT request. A step's header for reconstruction is the fold after its own `request/header*` event (which sits between its `step/start` and first response event) or the fold carried forward. **Enforcement.** Dev-mode ([dsh-invariants](../../../../packages/support/invariants/src/index.ts)), on `llm/stream`: a frozen request with a live `sessionId` — the loop-built marker; hand-built one-shots are unfrozen and skipped — must carry messages deep-equal to the folded header's `messagePrefix` followed by the boundary derivation — the derivation rebuilt through a FRESH `Session` over `events[0..stepStartSeq)` so the live cache cannot vouch for itself — and header fields equal to `foldRequestHeader` over the log. There is no divergence allowance and nothing to allow: no seam can put unlogged content into a request — the `agent/session-prefix` seam's product enters only because the header event records it first. `prepend: true` only defends against the replay adapter's short-circuit (an append-registered listener); two prepended listeners have no defined mutual order in cordis, so correctness rests on the seq-bounded fold, never on listener timing. Measurement stays lean: the with-key e2e ([request-cache.e2e.ts](../../../../packages/core/agent-loop/tests/request-cache.e2e.ts)) proves `usage.cacheReadTokens > 0` on every request after the first against the live API, and per-step usage in the log is the production observable — a header event or compaction shows up as a cache-read collapse on the next step. diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md index 318c07ad31..35d1b50c16 100644 --- a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -499,7 +499,19 @@ Factory and backend registration use different reentrancy orderings around the s ### Durable session ownership carries the scope key -The [session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md#session-owns-immutable-history) owns header, event, and snapshot semantics. Agent-scope correctness adds one requirement: the store keeps append observers, accepted registry IDs, and captured scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session or redirect later `session/event` delivery by mutating visible state. +The [session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md#session-owns-immutable-history) owns header, event, and snapshot semantics. Agent-scope correctness adds one requirement: the store keeps append publication, accepted registry IDs, and captured scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session or redirect later `session/event` delivery by mutating visible state. + +An entered session treats append as one synchronous acceptance-and-publication boundary: + +1. Capture the current store attachment and its private attachment epoch, keep the attachment live, then materialize and deep-freeze the caller's event data. +2. Reject if caller getters changed either value; the epoch catches even a transient attach-then-detach that restores the original hook lookup. The event must not become live without the store hooks that accepted it. +3. Resolve the exact scoped `session/event` callback list before commit. Cordis runs `internal/dispatch` during this step, so development invariants can still reject a bad candidate while the log is unchanged. Resolution uses a throwaway mutable argument array; replacing its accepted session or event rejects before commit, and product callbacks later receive a fresh fixed tuple. +4. Push the event into the log. This is the commit point. +5. Invoke the captured callbacks with per-listener containment and best-effort non-throwing failure reporting, then release the attachment barrier and honor any detach requested during acceptance or publication. + +The boundary rejects a reentrant `append()` until the outer callback list drains. Without that guard, an early observer could append event N+1 before a later persistence observer had received event N, reversing delivery relative to the log. Detach is deferred for the same interval, so no event can commit after `session/disposed` or lose its publication hooks. Once the push occurs, synchronous observer throws and returned-promise rejections are logged and contained rather than escaping as a false append failure or starving later observers. + +`SessionStore.flush()` uses the same pre-dispatch fixed-tuple check but remains an awaited durability barrier rather than an observe-only publication. It starts every captured listener synchronously, converts a synchronous throw into that listener's rejected result so later listeners still start, waits for every result to settle, and only then rejects with the first failed listener in registration order. One broken backend therefore cannot make the caller return while another backend is still flushing. Approval requests follow the same async boundary at smaller scale: one capture preserves exact agent/signal identities, copies scalar fields, captures the session once, and drives `approval/asked`, scoped policy, cancellation, and `approval/decided` from that record. @@ -915,7 +927,7 @@ The marker is compile-time only; JavaScript, casts, and direct Cordis dispatch c ### Development invariants inspect actual dispatch -The invariants plugin observes Cordis's internal dispatch before listener delivery. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. +The invariants plugin uses Cordis's internal dispatch as the pre-delivery enforcement point. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. For `session/event`, callback resolution also precedes the log push: the plugin validates and stages the exact candidate there, then advances its live trace only when the same committed event reaches its contained post-commit listener. A later internal check can therefore veto without advancing either log or trace. Both halves of this oracle are explicitly global, so mounting the plugin under a scoped context cannot stage a foreign event without also applying its committed transition. Session and subagent payloads do not expose their owner key directly, so their service centralizes key selection and the invariant proves carrier presence. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. diff --git a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md index 1257554d30..0579bf2629 100644 --- a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md +++ b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md @@ -49,7 +49,7 @@ The `escalation-rejected` twin ends in `{"outcome": "rejected"}` instead: nothin #### The seam: mechanism and policy split -`ApprovalService.request(req)` always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable` — and never rejects. The service synchronously snapshots and shallow-freezes the accepted request before its first asynchronous boundary: scalar fields are copied while the agent and `AbortSignal` remain exact identity capabilities, so later caller mutation cannot redirect scope, payload, cancellation, or either audit event. The service dispatches the `approval/request` waterfall, races the captured signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the captured agent's captured session log. A session observer runs after an event enters the append-only log; if one throws, the service recognizes the recorded event, contains the callback failure, and completes the pair. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. The one precondition: `request()` throws (before appending anything) when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design. +After request validation and a successful `approval/asked` append, the answerer phase always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable`. The service synchronously snapshots and shallow-freezes the accepted request before its first asynchronous boundary: scalar fields are copied while the agent and `AbortSignal` remain exact identity capabilities, so later caller mutation cannot redirect scope, payload, cancellation, or either audit event. The service dispatches the `approval/request` waterfall, races the captured signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the captured agent's captured session log. Request acceptance and either pre-commit audit append may still reject; returning a decision that could not be logged would violate the pair. Session owns post-commit observer containment, so a callback failure cannot turn an authoritative audit append into a rejected request or suppress the matching event. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. `request()` also throws before appending anything when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design. Answerers are the policy, and they are `approval/request` waterfall listeners. The waterfall buys exactly what the seam needs: with zero listeners the dispatch falls through to the caller-supplied default — `unavailable`, so fail-closed needs no configuration and no code in any deployment; a listener that recognizes the request's agent answers by returning an outcome without calling `next()` (the decision slot is single-occupancy, first answer wins — the same documented semantics as the `fs/write-intent` gate); a listener that does not recognize the agent MUST delegate via `next()` so another answerer or the default gets the question; and listeners dispose with their owning fiber, so an unloaded UI plugin degrades the next ask to `unavailable` instead of leaving a dangling channel. Registration order across sibling plugins is not load-order deterministic (the loader starts siblings concurrently), so a deployment composes ONE terminal answerer and reserves `prepend` listeners for decide-or-delegate gates. diff --git a/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md b/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md index e4b72ab5d1..dbef22f3a3 100644 --- a/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md +++ b/docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md @@ -13,7 +13,7 @@ Status: implemented ## Problem -The loop records the canonical transcript in `SessionEvent` and also emitted a parallel set of live `agent/*` boundary mirror events: `agent/turn-start`, `agent/turn-end`, `agent/step-start`, and `agent/step-end`. The mirrors made consumers choose between two sources of truth for the SAME durable fact. ACP already chose the session log for the editor-facing transcript because a throwing peer listener can prevent later `agent/*` listeners from observing a boundary, while the session event was already appended. The stdio UI was the only production consumer that still rendered turn boundaries from the mirror events; it already rendered tool calls and results from `session/event`. +The loop records the canonical transcript in `SessionEvent` and also emitted a parallel set of live `agent/*` boundary mirror events: `agent/turn-start`, `agent/turn-end`, `agent/step-start`, and `agent/step-end`. The mirrors made consumers choose between two sources of truth for the SAME durable fact. ACP already chose the session log for the editor-facing transcript because it is the one durable, replayable record; consuming a live mirror would require reconciling its timing with the boundary already stored in that log. The stdio UI was the only production consumer that still rendered turn boundaries from the mirror events; it already rendered tool calls and results from `session/event`. This duplication is not free. Every lifecycle change had to update the session event, the mirror event, docs, invariants, tests, and snapshot expectations. The duplicate boundary events also made failure ordering subtle: a turn can be durably closed before a live `agent/turn-end` listener runs, so a post-boundary listener failure has no valid in-log position left and must be reported out of band. diff --git a/packages/core/agent-loop/src/agent.ts b/packages/core/agent-loop/src/agent.ts index 16f10168b6..a449e6c907 100644 --- a/packages/core/agent-loop/src/agent.ts +++ b/packages/core/agent-loop/src/agent.ts @@ -275,39 +275,21 @@ export class ReactLoopAgent implements Agent { // No turn open: wrap the injection in a one-shot turn so every event stays // turn-enclosed (the durability/replay boundary is the turn). const turn = lastTurnNumber(this.session) + 1 - // Once turn/start enters the log, a turn/end is OWED no matter what — even - // if a throwing `session/event` listener escapes from the turn/start append - // (Session.append pushes the event BEFORE notifying listeners) or the - // context/message append throws (non-serializable content, throwing - // listener). The finally re-checks the log via isTurnOpen() and closes the - // turn if one was actually opened, so the log never carries a permanently - // open injection turn that would corrupt later turns/replay. (If the - // turn/start append throws BEFORE pushing — non-serializable trigger, which - // can't happen for our fixed trigger — no turn was opened and none is owed.) + // Once turn/start enters the log, a turn/end is owed even if the message + // append fails acceptance or pre-commit validation. The finally re-checks + // the log and closes only a turn that actually opened; post-commit observers + // are contained by Session and cannot create a false append failure. try { this.session.append('turn/start', { turn, trigger: { kind: 'injection', source } }) this.session.append('context/message', { content, source }, { surfaceOp: 'append' }) } finally { - // Close the turn if turn/start made it into the log. Contain a throwing - // turn/end listener: Session.append pushes before notifying, so a throw - // here still leaves turn/end in the log (the turn is balanced) — swallow - // it so it neither replaces the original exception nor skips the flush - // decision below. (It surfaces through the flush path is not needed; the - // turn-balance contract is what matters and it holds.) + // Close the turn if turn/start made it into the log. A pre-commit veto + // must escape rather than being mistaken for a committed turn/end. if (isTurnOpen(this.session)) { - try { - this.session.append('turn/end', { turn, reason: { kind: 'completed' } }) - } catch { - // turn/end is already in the log (pushed before the listener threw), - // so the turn is balanced; the throw is the listener's bug. - } + this.session.append('turn/end', { turn, reason: { kind: 'completed' } }) } - // Decide the durability checkpoint from the LOG, not a flag: a turn was - // recorded iff this turn's turn/start is logged (it may have been closed - // by a throwing-listener turn/end above, which still counts). A - // `turnRecorded` boolean set after append('turn/end') would be skipped by - // a throwing turn/end listener, losing the flush for a balanced in-memory - // turn (crash before the next turn/dispose would drop the idle injection). + // Decide the durability checkpoint from the log: an accepted one-shot + // turn must be flushed even when its message append was the failing step. const turnRecorded = this.session.events.some(e => e.type === 'turn/start' && e.data.turn === turn) // Checkpoint the one-shot turn for durability, exactly as the loop does at // every turn/end. The loop is NOT running (we are idle), so nothing else diff --git a/packages/core/agent-loop/src/loop.ts b/packages/core/agent-loop/src/loop.ts index 756c007c45..982fa02cab 100644 --- a/packages/core/agent-loop/src/loop.ts +++ b/packages/core/agent-loop/src/loop.ts @@ -291,15 +291,14 @@ export async function runLoop(ctx: Context, agent: ReactLoopAgent, handle: LoopH // the previous turn/end), where the persistence backend drops it as a // crash tail (the turn-enclosure RFC). Report via agent/error + the logger only; the // driver survives and moves on. - /* v8 ignore start -- defensive internal-corruption backstop: public - * send/steer input is accepted as lossless JSON before enqueue, and - * runTurn contains every failure after turn/start. */ + // Acceptance and internal dispatch validation can reject before + // turn/start commits. Report that supported pre-turn failure without + // inventing a turn/end for a turn that never opened. const err = toError(error) ctx.logger.warn(`agent "${agent.id}": turn ${turn} failed before it started: ${err.message}`) try { events.emit('agent/error', turn, 0, err) } catch { /* contained: a throwing agent/error listener must not kill the driver */ } - /* v8 ignore stop */ } // Reset the cancel marker UNCONDITIONALLY here, after the turn returns and @@ -346,34 +345,14 @@ async function runTurn( let errorReported = false let terminalStopped = false - // Close the open step exactly once (idempotent via stepOpen). Step boundaries - // are durable session events only — there is no agent/* step emit to mirror - // them (see the agent event-domain rule). A throwing step/end session-event - // listener must not abort finalization and strand the turn open (turn/end - // balance > notifying one bad listener); it is contained and surfaced as a - // turn error below. - const closeStep = (): boolean => { - if (!stepOpen) return false + // Close the open step exactly once (idempotent via stepOpen). Post-commit + // session/event observers are contained by Session; a pre-commit validator + // failure still escapes so the outer recovery path may retry the boundary or + // fail loudly without pretending an uncommitted step/end exists. + const closeStep = (): void => { + if (!stepOpen) return + session.append('step/end', { turn, step }) stepOpen = false - // Session.append pushes step/end BEFORE notifying session/event listeners, - // so a throwing listener leaves step/end in the log (balance holds) but - // would otherwise abort finalization. Contain it and surface it as a turn - // error below. - let failure: unknown - try { - session.append('step/end', { turn, step }) - } catch (error: unknown) { - failure = error - } - // A throwing step/end session-event listener surfaces as a turn error via - // failTurn (idempotent). This prevents a throwing listener from producing a - // silent "completed" turn when the step itself succeeded, AND keeps - // finalization going when closeStep runs from the outer catch. - if (failure !== undefined) { - failTurn(toError(failure)) - return true - } - return false } // Record a step/turn failure exactly once: set the error reason (carrying the @@ -385,12 +364,9 @@ async function runTurn( const failTurn = (err: CodedError): void => { if (errorReported) return errorReported = true - // The turn is always still open here: the only failure that can reach - // failTurn once turn/end is appended would be a throwing turn-boundary - // listener, and turn boundaries are durable session events with no agent/* - // mirror to throw. A throwing `turn/end` session-event listener is already - // contained inside closeTurn (append pushes before notifying, so the - // boundary is durable). So set the error reason for closeTurn to append. + // The turn is still open here. Post-commit observers cannot escape append, + // and a pre-commit turn/end veto leaves no closing boundary to overwrite. + // Set the reason that the next successful closeTurn will append. reason = { kind: 'error', step, ...errorData(err) } try { events.emit('agent/error', turn, step, err) @@ -400,30 +376,17 @@ async function runTurn( } } - // Close the turn. Called exactly once per turn — the normal loop exit and the - // outer catch are mutually exclusive paths, and this never throws (the append - // is contained below), so there is no re-entry to guard against (unlike - // closeStep, which the cancel branches and the outer catch can both reach). - // Turn boundaries are durable session events only — there is no agent/* turn - // emit to mirror them (see the agent event-domain rule). + // Close the turn. Post-commit observer failures are contained by Session; + // pre-commit validation failures escape to recovery instead of being mistaken + // for a committed boundary. Turn boundaries are durable session events only. const closeTurn = (): void => { - // Session.append pushes turn/end BEFORE notifying session/event listeners, - // so a throwing listener leaves turn/end in the log (the turn is balanced) - // but would otherwise escape — from the outer catch it would propagate to - // the runLoop backstop. Contain it: the boundary is durable either way, and - // finalization must not abort on a bad listener. - try { - session.append('turn/end', { turn, reason }) - } catch (error: unknown) { - ctx.logger.warn(`agent "${agent.id}": session/event listener threw on turn/end at turn ${turn}: ${toError(error).message}`) - } + session.append('turn/end', { turn, reason }) } try { // --- Turn boundary. Once turn/start is appended, a turn/end is owed no - // matter what throws below; the catch + closeTurn guarantee it (the catch - // decides "owed" from the log via isTurnOpen, so even a throwing turn/start - // listener — append pushes before notifying — still gets its turn/end). + // matter what throws below; the catch + closeTurn guarantee it. A pre-commit + // veto leaves no turn/start in the log and therefore owes no turn/end. session.append('turn/start', { turn, trigger }) // Each drained queued message runs the `agent/prompt-submit` waterfall before // it becomes a `user/message` — a hook can rewrite the prompt or block it. @@ -581,20 +544,19 @@ async function runTurn( // messages are snapshotted HERE, in the same synchronous frame as the // step/start append directly below — so the snapshot is exactly the // derivation over the log prefix strictly before step/start's seq. - // Anything appended later — by a step/start session/event listener, an - // agent/request-window inject(), any concurrent task — lands after the - // boundary and joins the NEXT request. An external reconstructor + // Anything appended later by the request-window inject seam or a + // concurrent task lands after the boundary and joins the NEXT request. + // session/event itself is observe-only: append reentrancy is rejected + // until the current callback list drains. An external reconstructor // recovers these exact messages by folding the surface over // events[0..stepStartSeq). const boundaryMessages = session.deriveMessages() - // Mark the step open BEFORE the append: Session.append pushes the event - // to the log before notifying session/event listeners, so a THROWING - // step/start listener leaves step/start in the log. Setting stepOpen first - // means the outer catch's closeStep() then appends the balancing step/end - // (turn stays enclosed) instead of stranding an open step under turn/end. - stepOpen = true session.append('step/start', { turn, step }) + // Only a committed step/start creates a balancing obligation. A + // pre-commit veto throws before this assignment; post-commit observers + // are contained inside Session.append(). + stepOpen = true // Cancel landing in the step-start window: a synchronous `session/event` // step/start listener can cancel after the step is already open. Check @@ -647,7 +609,7 @@ async function runTurn( // Steering that arrived during streaming/tool execution. const steered = drainSteering(agent, handle.inbox, turn) - if (closeStep()) break + closeStep() const defaultDecision: ContinuationDecision = { action: stepOutcome.hadToolCalls || steered ? 'continue' : 'stop' } let decision: ContinuationDecision @@ -721,23 +683,11 @@ async function runTurn( // Normal / inline-error loop exit: close the turn. closeTurn() } catch (error: unknown) { - // Decide whether this turn was ever opened from the LOG, not a flag. - // Session.append pushes the event BEFORE notifying session/event listeners, - // so a throwing listener on the `turn/start` append leaves turn/start in the - // log even though execution never reached the lines after that append. - // Gating on a "turn started" boolean would skip turn/end and leave a - // permanently OPEN turn that poisons the next turn/replay (the turn-enclosure RFC). We - // check the log for THIS turn's turn/start: present means a turn/end is owed - // and the normal-exit `closeTurn()` did NOT run (we are here because a throw - // preceded it — the two `closeTurn()` sites are on mutually exclusive paths), - // so this catch appends turn/end with the disposed/error reason chosen below. - // `closeStep()` IS idempotent (guarded by `stepOpen`) — it may have run - // already in a step branch, so running it again is a safe no-op. Absent - // turn/start means the append threw BEFORE its push (a non-serializable - // trigger outside the public lossless-JSON boundary); nothing was opened, so rethrow - // to the runLoop backstop. + // Decide whether this turn opened from the LOG, not a speculative flag. A + // pre-commit validator or acceptance failure leaves no turn/start and owes + // no turn/end, so it propagates to runLoop's backstop. Once turn/start is + // present, this path balances any committed step and records the failure. const turnStartLogged = session.events.some(e => e.type === 'turn/start' && e.data.turn === turn) - /* v8 ignore next -- defensive internal-corruption path; public inbox input is lossless JSON */ if (!turnStartLogged) throw error closeStep() // Choose the close reason. Disposal wins only if no error was already diff --git a/packages/core/agent-loop/tests/agent.spec.ts b/packages/core/agent-loop/tests/agent.spec.ts index be1a0fe5b5..d132d862a8 100644 --- a/packages/core/agent-loop/tests/agent.spec.ts +++ b/packages/core/agent-loop/tests/agent.spec.ts @@ -187,10 +187,8 @@ describe('ReactLoopAgent', () => { const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' }) let flushes = 0 ctx.on('session/flush', () => { flushes += 1 }) - // A session/event listener that throws on the synthetic turn/end. Append - // pushes before notifying, so turn/end is in the log (turn balanced) but the - // throw must NOT skip the durability checkpoint — the flush decision is made - // from the log, not a flag set after the (throwing) append. + // Session contains a throwing post-commit turn/end observer. The accepted + // boundary still triggers the idle injection's durability checkpoint. let threw = false ctx.on('session/event', (_s, event) => { if (!threw && event.type === 'turn/end') { threw = true; throw new Error('boom turn/end') } diff --git a/packages/core/agent-loop/tests/coverage-edges.spec.ts b/packages/core/agent-loop/tests/coverage-edges.spec.ts index ee58fcd66e..23e5670f85 100644 --- a/packages/core/agent-loop/tests/coverage-edges.spec.ts +++ b/packages/core/agent-loop/tests/coverage-edges.spec.ts @@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest' import { Context } from 'cordis' import LlmService, { CallId, LlmError, StreamChunk } from '@deepseek-ai/dsh-llm' import SessionStore, { TurnEndReason } from '@deepseek-ai/dsh-session' +import type { SessionEvent } from '@deepseek-ai/dsh-session' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import ToolRegistry, { defineTool } from '@deepseek-ai/dsh-tools' import AgentRegistry, { AgentId } from '@deepseek-ai/dsh-agent' @@ -122,13 +123,15 @@ describe('tool JSON parse', () => { }) describe('toError normalization', () => { - it('normalizes non-Error throws from a turn/start session-event listener via toError', async () => { + it('normalizes non-Error throws from pre-commit dispatch validation via the runLoop backstop', async () => { const adapter = new MockAdapter([textResponse('ok')]) const ctx = await harness(adapter) const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' }) let threwOnce = false - ctx.on('session/event', (_session, event) => { + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const event = args[1] as SessionEvent if (event.type === 'turn/start' && !threwOnce) { threwOnce = true throw 'naked string error' // non-Error throw, normalized via toError @@ -141,11 +144,9 @@ describe('toError normalization', () => { send(agent, 'go') await waitForIdle(ctx, agent) expect(errors).toHaveLength(1) - expect(errors[0]!.message).toBe('naked string error') - // A non-Error throw is wrapped in a HarnessError with code UNKNOWN, so the - // turn-end error reason carries a routable code instead of degrading. - const turnEnd = agent.session.events.find(e => e.type === 'turn/end') - expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind === 'error' && turnEnd.data.reason.code).toBe('UNKNOWN') + expect(errors[0]).toMatchObject({ message: 'naked string error', code: 'UNKNOWN' }) + expect(adapter.requests).toEqual([]) + expect(agent.session.events.some(event => event.type === 'turn/start' || event.type === 'turn/end')).toBe(false) }) it('normalizes non-Error throws from agent/request waterfall via inline toError in runStep catch', async () => { diff --git a/packages/core/agent-loop/tests/loop.spec.ts b/packages/core/agent-loop/tests/loop.spec.ts index 5815217fc4..f1c3e9af9d 100644 --- a/packages/core/agent-loop/tests/loop.spec.ts +++ b/packages/core/agent-loop/tests/loop.spec.ts @@ -810,10 +810,10 @@ describe('agent loop', () => { ]) }) - it('stops the turn when a step/end session-event listener failure has recorded an error', async () => { + it('contains a step/end observer failure without changing continuation', async () => { const adapter = new MockAdapter([ toolCallResponse('c1', 'echo', { text: 'x' }), - textResponse('should not run'), + textResponse('continued after tool call'), ]) const ctx = await harness(adapter) ctx.tools.register(defineTool({ @@ -826,9 +826,8 @@ describe('agent loop', () => { })) const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' }) let threw = false - // A throwing step/end session-event listener is the surviving boundary-listener - // failure path (step boundaries have no agent/* mirror): closeStep contains it - // and surfaces it as a turn error rather than stranding the turn open. + // Post-commit session observers cannot control the loop. The tool call still + // drives the second model request, and the turn completes normally. ctx.on('session/event', (_session, event) => { if (event.type === 'step/end' && !threw) { threw = true; throw new Error('bad step/end listener') } }) @@ -836,9 +835,9 @@ describe('agent loop', () => { send(agent, 'go') await waitForIdle(ctx, agent) - expect(adapter.requests).toHaveLength(1) + expect(adapter.requests).toHaveLength(2) const turnEnd = agent.session.events.findLast(e => e.type === 'turn/end') - expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind).toBe('error') + expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason.kind).toBe('completed') }) it('chains queued messages into consecutive turns', async () => { diff --git a/packages/core/agent-loop/tests/review-fixes.spec.ts b/packages/core/agent-loop/tests/review-fixes.spec.ts index 4c68ac53bd..d4742da3e6 100644 --- a/packages/core/agent-loop/tests/review-fixes.spec.ts +++ b/packages/core/agent-loop/tests/review-fixes.spec.ts @@ -10,10 +10,7 @@ import { prepareReactLoopAgent } from '../src/agent.ts' import * as Invariants from '@deepseek-ai/dsh-invariants' import { MockAdapter, textResponse, toolCallResponse } from './mock-adapter.ts' -/** - * Regression tests for the findings of the first architecture review - * (Codex + sub-agent, post phase-1). Each describe block names the finding. - */ +/** Regression tests for agent-loop boundary, identity, and lifecycle contracts. */ async function harness(adapter: MockAdapter) { const ctx = new Context() @@ -682,7 +679,7 @@ describe('HIGH: a finish-error stream chunk ends the turn as error, not complete }) }) -describe('P1-6: a step/start session-event listener sees the event already in the log', () => { +describe('step boundary publication order', () => { it('the step/start event is in session.events when its session/event listener fires', async () => { const adapter = new MockAdapter([textResponse('done')]) const ctx = await harness(adapter) @@ -713,7 +710,7 @@ describe('P1-6: a step/start session-event listener sees the event already in th }) }) -describe('P1-5: a started turn (and any open step) is always closed on a boundary throw', () => { +describe('turn and step boundary recovery', () => { // Harness with the invariants plugin loaded as an oracle: it throws on // append if the log goes unbalanced (turn/end while a step is open, // turn/start while a turn is open, etc.), so a regression surfaces as an @@ -744,19 +741,13 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar } } - it('a throwing step/start session-event listener closes the open step then the turn (step/end before turn/end)', async () => { - const adapter = new MockAdapter([textResponse('never reached')]) + it('a throwing step/start observer cannot change a successful turn', async () => { + const adapter = new MockAdapter([textResponse('request completed')]) const ctx = await balancedHarness(adapter) const agent = ctx.agentLoop.create(AgentId('a-stepstart'), { model: 'mock' }) - // Step boundaries have no agent/* mirror; a throwing step/start session-event - // listener is the surviving step-boundary-listener failure. The loop marks - // the step open BEFORE appending step/start (Session.append pushes before - // notifying, so a post-push listener throw still leaves stepOpen=true), so - // the outer catch's closeStep() appends the balancing step/end — the turn - // stays enclosed. The invariants oracle (balancedHarness) rejects any - // imbalance, so a green run proves turn/start → step/start → step/end → - // turn/end nesting holds. + // Session owns post-commit containment. The loop sees a successful append, + // runs the request, and balances the ordinary step and turn boundaries. let threw = false ctx.on('session/event', (_s, event) => { if (event.type === 'step/start' && !threw) { threw = true; throw new Error('boom step-start') } @@ -769,8 +760,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar const e = [...agent.session.events] const c = boundaryCounts(agent) - expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 1 }) - expect(errors.map(x => x.message)).toEqual(['boom step-start']) + expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 0 }) + expect(errors).toEqual([]) // step/end precedes turn/end (the invariants oracle would reject // turn/end-while-step-open, but assert the order explicitly too). const stepEndIdx = e.findIndex(x => x.type === 'step/end') @@ -779,6 +770,101 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar expect(stepEndIdx).toBeLessThan(turnEndIdx) }) + it('a pre-commit step/start validation failure does not invent a step boundary', async () => { + const adapter = new MockAdapter([textResponse('never reached')]) + const ctx = await balancedHarness(adapter) + const agent = ctx.agentLoop.create(AgentId('a-stepstart-veto'), { model: 'mock' }) + let rejected = false + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const event = args[1] as SessionEvent + if (event.type === 'step/start' && !rejected) { + rejected = true + throw new Error('reject step-start before commit') + } + }) + const errors: Error[] = [] + ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) }) + + send(agent, 'go') + await waitForIdle(ctx, agent) + + expect(adapter.requests).toEqual([]) + expect(boundaryCounts(agent)).toMatchObject({ + turnStart: 1, + turnEnd: 1, + stepStart: 0, + stepEnd: 0, + errors: 1, + }) + expect(errors.map(error => error.message)).toEqual(['reject step-start before commit']) + }) + + it('a one-shot turn/end validation failure preserves the earlier turn error on retry', async () => { + const errorStream: StreamChunk[] = [{ type: 'finish', reason: { kind: 'error', message: 'provider failed' } }] + const adapter = new MockAdapter([errorStream]) + const ctx = await balancedHarness(adapter) + const agent = ctx.agentLoop.create(AgentId('a-turnend-veto'), { model: 'mock' }) + let rejected = false + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const event = args[1] as SessionEvent + if (event.type === 'turn/end' && !rejected) { + rejected = true + throw new Error('reject first turn-end') + } + }) + const errors: Error[] = [] + ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) }) + + send(agent, 'go') + await waitForIdle(ctx, agent) + + expect(errors.map(error => error.message)).toEqual(['provider failed']) + expect(boundaryCounts(agent)).toMatchObject({ + turnStart: 1, + turnEnd: 1, + stepStart: 1, + stepEnd: 1, + errors: 1, + }) + const turnEnd = agent.session.events.findLast(event => event.type === 'turn/end') + expect(turnEnd?.type === 'turn/end' && turnEnd.data.reason).toMatchObject({ + kind: 'error', + message: 'provider failed', + }) + }) + + it('a one-shot step/end validation failure keeps the step open until retry succeeds', async () => { + const adapter = new MockAdapter([textResponse('completed before close validation')]) + const ctx = await balancedHarness(adapter) + const agent = ctx.agentLoop.create(AgentId('a-stepend-veto'), { model: 'mock' }) + let rejected = false + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const event = args[1] as SessionEvent + if (event.type === 'step/end' && !rejected) { + rejected = true + throw new Error('reject first step-end') + } + }) + const errors: Error[] = [] + ctx.on('agent/error', (_agent, _turn, _step, error) => { errors.push(error) }) + + send(agent, 'go') + await waitForIdle(ctx, agent) + + expect(adapter.requests).toHaveLength(1) + expect(errors.map(error => error.message)).toEqual(['reject first step-end']) + expect(boundaryCounts(agent)).toMatchObject({ + turnStart: 1, + turnEnd: 1, + stepStart: 1, + stepEnd: 1, + errors: 1, + }) + }) + it('a throwing agent/error listener during a step-error path still balances the turn, loop survives', async () => { // First turn: model stream ends with a finish-error → step error path → // failTurn emits agent/error, whose listener throws. The turn must still @@ -841,13 +927,9 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar }) it('preserves reason disposed when a pre-step listener disposes then throws (outer-catch disposed branch)', async () => { - // Reach the OUTER catch while disposed: an `agent/pre-step` listener requests - // disposal AND throws. The throw escapes the pre-step `await` (line ~419) to - // the loop's outer catch — BEFORE the post-pre-step disposal check at ~422 - // gets to run — so the catch sees `isDisposed() && !errorReported` and must - // PRESERVE reason=disposed rather than overwrite it with the listener's throw - // (disposal is not a failure). This is the surviving path to that sub-branch - // now that there is no turn-boundary emit to throw from. + // A pre-step listener requests disposal and then throws before the ordinary + // post-listener disposal check. The outer catch sees disposal already won + // and must preserve reason=disposed rather than rewrite it as a plugin error. const adapter = new MockAdapter([textResponse('never reached')]) const ctx = await balancedHarness(adapter) let agent!: ReactLoopAgent @@ -883,16 +965,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar expect(errorEmits).toHaveLength(0) }) - it('a throwing session/event listener on the turn/start append still balances the turn', async () => { - // Session.append pushes the event BEFORE notifying session/event listeners, - // so a listener throwing on turn/start leaves turn/start IN THE LOG. The - // loop must therefore still owe (and append) a turn/end — deciding "owed" - // from the log via isTurnOpen, not a "turn started" flag that the throw - // skipped. Otherwise the turn stays permanently open and poisons the next - // turn/replay (the turn-enclosure RFC). (Uses the plain harness — NOT the invariants - // oracle — because the throwing listener is itself a session/event - // subscriber.) - const adapter = new MockAdapter([textResponse('turn 2')]) + it('a throwing turn/start observer cannot starve the loop or later turns', async () => { + const adapter = new MockAdapter([textResponse('turn 1'), textResponse('turn 2')]) const ctx = await harness(adapter) const agent = ctx.agentLoop.create(AgentId('a-preturn'), { model: 'mock' }) @@ -906,12 +980,9 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar send(agent, 'go') await waitForIdle(ctx, agent) - // The error was surfaced exactly once via agent/error. - expect(errors.map(e => e.message)).toEqual(['boom turn/start append']) - // The turn is BALANCED: turn/start is in the log (it was pushed before the - // listener threw), so a turn/end was owed and appended — no open turn. The - // last turn-boundary event being turn/end is exactly the loop's isTurnOpen - // check (no open turn remains). + expect(errors).toEqual([]) + // Session contains the observer failure per listener, so the committed turn + // remains visible to later observers and executes normally. const types = [...agent.session.events].map(e => e.type) expect(types.filter(t => t === 'turn/start')).toHaveLength(1) expect(types.filter(t => t === 'turn/end')).toHaveLength(1) @@ -922,15 +993,10 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar // loop survives: a second turn runs normally. send(agent, 'second') await waitForIdle(ctx, agent) - expect(adapter.requests).toHaveLength(1) + expect(adapter.requests).toHaveLength(2) }) - it('a throwing step/end session-event listener during a successful step ends the turn as error, not completed', async () => { - // closeStep() must surface a throwing step/end listener via failTurn so the - // turn ends with reason error, not a silent "completed" with the throw - // swallowed. Regression test for the closeStep() catch that previously - // swallowed the throw in the normal (no-tool, no-steering) path. (Step - // boundaries have no agent/* mirror; the session-event listener is the path.) + it('a throwing step/end observer cannot rewrite the turn outcome', async () => { const adapter = new MockAdapter([textResponse('all good'), textResponse('turn 2 ok')]) const ctx = await balancedHarness(adapter) const agent = ctx.agentLoop.create(AgentId('a-stepend-throw'), { model: 'mock' }) @@ -946,11 +1012,10 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar await waitForIdle(ctx, agent) const c = boundaryCounts(agent) - // step opened and closed; exactly one error turn-end; turn balanced. - expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 1 }) - expect(errors.map(e => e.message)).toEqual(['boom step-end']) + expect(c).toMatchObject({ turnStart: 1, turnEnd: 1, stepStart: 1, stepEnd: 1, errors: 0 }) + expect(errors).toEqual([]) expect(c.lastTurnEnd?.type === 'turn/end' && c.lastTurnEnd.data.reason) - .toEqual({ kind: 'error', step: 1, message: 'boom step-end' }) + .toEqual({ kind: 'completed' }) // step/end precedes turn/end (ordering contract) const e = [...agent.session.events] @@ -968,14 +1033,11 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar expect(c2.stepStart).toBe(c2.stepEnd) }) - it('a throwing session/event listener on step/end during finalization still appends turn/end', async () => { + it('a throwing step/end observer cannot interrupt error finalization', async () => { // A finish-error stream opens a step then fails it, driving finalization - // through closeStep() with the step open. closeStep appends step/end; a - // session/event listener throwing on THAT must not abort the catch before - // closeTurn — step/end is already logged (balance holds) and the throw is - // contained + surfaced via failTurn, so turn/end is still appended. (The - // failed step itself also routes through failTurn; the step/end-listener - // throw is the second, contained, failure.) + // through closeStep() with the step open. Session contains the observer + // failure after committing step/end, so closeTurn still records the model + // failure and balances the turn. const errorStream: StreamChunk[] = [{ type: 'finish', reason: { kind: 'error', message: 'provider 500' } }] const adapter = new MockAdapter([errorStream, textResponse('turn 2 ok')]) const ctx = await harness(adapter) @@ -996,7 +1058,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar expect(e.some(x => x.type === 'step/end')).toBe(true) expect(e.some(x => x.type === 'turn/end')).toBe(true) expect(e.at(-1)?.type).toBe('turn/end') - expect(errors.length).toBeGreaterThanOrEqual(1) // surfaced via agent/error + expect(errors.map(error => error.message)).toEqual(['provider 500']) // loop survives. send(agent, 'again') @@ -1005,12 +1067,8 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar }) it('a throwing session/event listener on turn/end is contained (turn still balanced, loop survives)', async () => { - // closeTurn appends turn/end; Session.append pushes it BEFORE notifying - // session/event listeners, so a throwing listener leaves turn/end in the log - // (the turn is balanced) but must not escape — from the normal-path closeTurn - // it would otherwise propagate; the append is contained so the loop continues. - // Turn boundaries are durable session events only (no agent/* mirror), so this - // session/event append-notify throw is the sole turn-end-listener failure path. + // Session contains the observer failure after committing turn/end, so the + // boundary stays authoritative and the loop continues normally. const adapter = new MockAdapter([textResponse('turn 1'), textResponse('turn 2')]) const ctx = await harness(adapter) const agent = ctx.agentLoop.create(AgentId('a-turnendappend'), { model: 'mock' }) @@ -1036,7 +1094,7 @@ describe('P1-5: a started turn (and any open step) is always closed on a boundar }) }) -describe('P1-7: tool/result is logged under the originating call.id, not result.callId', () => { +describe('tool result call identity', () => { it('the loop records tool/result under the model call.id even when a post-execute listener replaces content', async () => { // Model emits a tool-call with id "c1", then a final text turn. const adapter = new MockAdapter([ @@ -1116,7 +1174,7 @@ describe('surface: assistant/message omits sourceEventSeqs when no chunks stream -describe('disposal/cancel honored during pre-step assembly (P1-1)', () => { +describe('disposal and cancellation during pre-step assembly', () => { it('disposal during system-prompt assembly drops the about-to-start step as disposed', { timeout: 30000 }, async () => { // Block `system-prompt/assemble` on a promise. Start disposal (which // calls stop() synchronously, setting status=disposed), then release the diff --git a/packages/core/session/README.md b/packages/core/session/README.md index 7389d6fade..085ebfda06 100644 --- a/packages/core/session/README.md +++ b/packages/core/session/README.md @@ -9,31 +9,31 @@ Creates and holds event-sourced `Session` instances. Persistence is intentionall ### Public API - `ctx.sessions.create(id?: SessionId, options?: { seed?: SessionEvent[]; meta?: { cwd?: string; parentSession?: SessionId; createdAt?: number; seedLength?: number } }): Session` — Create a session. `options.seed` replays/forks an existing event log: the constructor reads each array entry once, then recursively validates and copies every nested value in one pass so validation and storage cannot observe different getter results or erase an exotic prototype before checking it. `options.meta` attaches creation metadata (validated absolute `cwd`, `parentSession` lineage, seed boundary) as the immutable `SessionHeader`: the store rejects an exotic metadata shell, reads every accepted field once, and constructs a detached, deep-frozen header. The store fills `version`/`id` and defaults `createdAt` to now; a caller reconstructing a persisted session passes the original `createdAt` and persisted `seedLength` to preserve them. Disposed with the calling fiber. -- `ctx.sessions.flush(session: Session): Promise` Dispatch the awaited `session/flush` durability checkpoint with the carrier captured at enter — THE flush entry point (the loop's turn-end checkpoint and idle injection call it; never dispatch a raw `ctx.parallel`). Rejects a prepared, detached, or stale same-id object instead of inventing a subject-less carrier. +- `ctx.sessions.flush(session: Session): Promise` Dispatch the awaited `session/flush` durability checkpoint with the carrier captured at enter — THE flush entry point (the loop's turn-end checkpoint and idle injection call it; never dispatch a raw `ctx.parallel`). Every captured listener starts, the call waits for all of them to settle, and a failure rejects only after the other listeners finish. Rejects a prepared, detached, or stale same-id object instead of inventing a subject-less carrier. - `ctx.sessions.fork(source, boundary?, childSessionId?): Session` — Resolve a live session object or id, select a seed through the inclusive `boundary` event seq (default: current last event), require that boundary to be `turn/end`, and create a live child session with lineage metadata. - `ctx.sessions.get(id: SessionId): Session | undefined` - `ctx.sessions.list(): Session[]` #### Advanced: ordered-teardown lifecycle primitives -`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before the store-owned append observer detaches — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: +`create()` covers the common case (the session is owned by the calling fiber). When a session must be torn down **in order with another resource** — so a final flush is captured before the store attachment and publication hooks are removed — `create()`'s self-contained effect is wrong, because a fiber unload disposes sibling effects *concurrently*. For that, split the lifecycle and fold it into the owner's single effect: - `ctx.sessions.prepare(id?, options?): Session` — read `options.seed`/`options.meta` once, validate and detach the metadata/header, and construct the `Session` WITHOUT entering it into the store. Same options as `create`. - `ctx.sessions.reserve(id): SessionRegistrationReservation` — hold an unpublished id under the calling fiber and construct its one owned Session through `reservation.prepare(options?)`. `release` is the exact owner effect disposer, so the agent lifecycle can adopt it and keep the ID reserved until scope cleanup quiesces. Until that release, bare `prepare`/`create`/`enter` calls for the id reject; the factory later presents the exact capability to `enter`, making setup-time publication structurally impossible without leaking an abandoned reservation across HMR disposal. -- `ctx.sessions.enter(session, reservation?): () => void` — claim the ID across caller-controlled filter/carrier evaluation, then install the module-private `session/event` observer and add the exact session under its accepted key; a reentrant same-ID entry cannot be overwritten. Returns the idempotent, exact-object-guarded DETACH disposer, which clears notification, carrier, and accepted-key state without letting a stale capability delete a replacement. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved. A factory passes the opaque capability from `reserve(id)` so setup cannot enter the reserved session or publish a same-id replacement before the owning transaction. +- `ctx.sessions.enter(session, reservation?): () => void` — claim the ID across caller-controlled filter/carrier evaluation, then install the module-private append publication hooks and add the exact session under its accepted key; a reentrant same-ID entry cannot be overwritten. Returns the idempotent, exact-object-guarded DETACH disposer, which clears publication, carrier, and accepted-key state without letting a stale capability delete a replacement. Does NOT emit `session/created` (the caller installs the disposer first, then calls `announce`, so a throwing listener rolls the attach back). It re-checks the id because public `prepare`/`enter` calls may be interleaved. A factory passes the opaque capability from `reserve(id)` so setup cannot enter the reserved session or publish a same-id replacement before the owning transaction. - `ctx.sessions.announce(session): void` — begin the one allowed `session/created` announcement for an entered session; repeat and reentrant calls reject before dispatch. A detach requested synchronously by a creation listener is deferred until that dispatch unwinds, so another creation listener cannot observe `session/disposed` before its own `session/created` callback. Detach emits `session/disposed` exactly once, including rollback after a partially delivered creation notification; a never-announced entry emits neither edge. `dsh-agent-loop` is the canonical consumer: after unpublished agent setup it enters both session and agent before announcing either, then nests loop stop, agent removal, session detach, and scope unwind in one ordered lifecycle. The final flush therefore settles before this package detaches the session, whether teardown starts from an `AgentHandle` or owner-fiber unload. ### Live service events -The store pairs announced creation with disposal, publishes each append, and provides an awaited durability checkpoint. Disposal listener failures, including returned-promise rejections, are contained per observer so teardown cannot be interrupted. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md). Persistence consumers write behind from the append notification and drain on the store-owned flush entry point rather than dispatching the event directly. +The store pairs announced creation with disposal, publishes each append, and provides an awaited durability checkpoint. Before the log push it resolves the exact scoped `session/event` callback list, including development-time internal dispatch checks; substitution of the accepted session/event tuple rejects while the log is unchanged. The push is then the commit point, and callback throws or returned-promise rejections are logged and contained per observer. A committed append therefore returns normally, later observers still run, and teardown cannot interrupt an in-flight acceptance/publication boundary. Exact `session/*` signatures, modes, and scope-carrier behavior live in the generated [Cordis event catalog](../../../docs/cordis-catalog/events.md); the append-only payload vocabulary is separately generated into the [persistence catalog](../../../docs/persistence-catalog.md). Persistence consumers write behind from the append notification and drain on the store-owned flush entry point rather than dispatching the event directly. ### Class: `Session` Plain class (not a Cordis Service). Create via `ctx.sessions.create()`. -- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. **Throws** if `data` or surface metadata is not losslessly JSON-serializable (BigInt, function, symbol, undefined, `-0`, non-finite number, circular ref, or an exotic object like Map/Set/Date/class instance). One recursive validate-and-copy pass reads each nested value exactly once and produces the detached value that enters the log, so validation and durability cannot diverge through a stateful getter or a prototype-erasing clone. The accepted event and every nested value are deep-frozen before publication; the returned event and observer notification share that immutable owned record. A third parameter `opts: SurfaceIntent` carries surface metadata: `surfaceOp` and `sourceEventSeqs` are each read once, then the former controls how the event enters the surface linked list and the latter records provenance. Runtime validation accepts only `'append'` or the exact `{ op: 'replace', start, end }` record with non-negative safe-integer bounds, and provenance must be an array of non-negative safe integers; non-surface events reject either field. The marker is **required** for the five `SurfaceEventType` events (every message-producing event must declare how it joins the surface) and rejected by the compiler for non-surface types. The contract is enforced two ways: the typed overload handles a specific event literal, AND runtime checks cover widened unions and raw seed/load logs so invalid metadata can never silently enter or disappear from `deriveMessages()`. +- `session.append(type, data, opts?): SessionEvent` — synchronous, never blocks on I/O. **Throws** if `data` or surface metadata is not losslessly JSON-serializable (BigInt, function, symbol, undefined, `-0`, non-finite number, circular ref, or an exotic object like Map/Set/Date/class instance). One recursive validate-and-copy pass reads each nested value exactly once and produces the detached value that enters the log, so validation and durability cannot diverge through a stateful getter or a prototype-erasing clone. The accepted event and every nested value are deep-frozen before publication; the returned event and observer notification share that immutable owned record. An entered session pins its attachment from materialization through observer delivery, rejects if a caller getter changes that attachment, and rejects a reentrant append until the outer callback list drains; these rules prevent an event from bypassing persistence or being delivered out of log order. The log push is the commit point: a synchronous observer throw or returned-promise rejection is logged per observer and cannot turn the committed append into a caller-visible failure or starve later observers. A third parameter `opts: SurfaceIntent` carries surface metadata: `surfaceOp` and `sourceEventSeqs` are each read once, then the former controls how the event enters the surface linked list and the latter records provenance. Runtime validation accepts only `'append'` or the exact `{ op: 'replace', start, end }` record with non-negative safe-integer bounds, and provenance must be an array of non-negative safe integers; non-surface events reject either field. The marker is **required** for the five `SurfaceEventType` events (every message-producing event must declare how it joins the surface) and rejected by the compiler for non-surface types. The contract is enforced two ways: the typed overload handles a specific event literal, AND runtime checks cover widened unions and raw seed/load logs so invalid metadata can never silently enter or disappear from `deriveMessages()`. - `session.deriveMessages(): Message[]` — the LLM message history, CACHED: each surface node is projected exactly once, when first seen (O(new nodes) per call; a surface rewrite rebuilds via `surface.replaceGeneration`). Returns a fresh array snapshot per call over SHARED, deep-frozen `Message` objects — cloned once off the log at projection time, so a consumer can never mutate logged data (mutation throws). The surface is the single source of derived history — there is no raw-log fallback. - `session.deriveEventMessage(event): Message | null` — the per-event projection `deriveMessages()` folds: one event's derived message (an unfrozen clone), or `null` when it produces none (a non-surface event, or an empty-content `assistant/message` hosting only usage). External reconstructors and the dev invariant fold the same function over a log prefix's surface, so no two paths can disagree about what a request's messages were (the reconstructability RFC). - `session.surface: SurfaceManager` — the derived surface, lazily rebuilt from `surfaceOp` markers in the log. Processes only new events (delta) on each access — the log is append-only, so prior events never change. `surface.replaceGeneration` is the rewrite signal: bumped by every folded `replace` and by `invalidate()`, never reset, so an incremental consumer comparing generations cannot be fooled. diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts index d8b3afb139..3cd1c61451 100644 --- a/packages/core/session/src/index.ts +++ b/packages/core/session/src/index.ts @@ -64,7 +64,12 @@ declare module 'cordis' { 'session/disposed'(this: Scoped, session: Session): void /** * An event was appended to a session log (sync, fire-and-forget). This is - * the per-append feed a UI or invariant plugin tails. + * the per-append feed a UI or invariant plugin tails. The log push is the + * commit point; synchronous throws and returned-promise rejections from + * observers are logged and contained per listener, so they cannot make a + * committed append appear to fail or starve later listeners. The exact + * callback list and Cordis internal-dispatch checks resolve before the push; + * callbacks themselves run only after it. * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): the carrier is the * session's owner scope, captured when the session was ENTERED (an agent's * session is entered through `agent.ctx`, so its events dispatch in that @@ -279,7 +284,62 @@ function renderThrown(value: unknown): string { } } -const appendObservers = new WeakMap void>() +/** Best-effort reporting that cannot re-expose an already-contained failure. */ +function warnContained(ctx: Context, message: string): void { + try { + ctx.logger.warn(message) + } catch { + // contained: logger failure must not turn an observe-only callback failure + // back into a caller-visible error or an unhandled promise rejection. + } +} + +type SessionCallback = (...args: unknown[]) => unknown + +/** Resolve one listener snapshot, including Cordis's internal dispatch checks. */ +function collectSessionCallbacks(ctx: Context, args: unknown[]): SessionCallback[] { + return [...ctx.events.dispatch('emit', args)] as SessionCallback[] +} + +/** Reject pre-commit dispatch instrumentation that substituted accepted values. */ +function assertDispatchTuple(name: string, actual: unknown[], expected: unknown[]): void { + if (actual.length !== expected.length || actual.some((value, index) => value !== expected[index])) { + throw new Error(`${name} internal dispatch replaced the accepted callback tuple`) + } +} + +/** Invoke one resolved observe-only listener snapshot with per-listener containment. */ +function invokeContainedSessionObservers( + ctx: Context, + name: 'session/event' | 'session/disposed', + id: SessionId, + args: unknown[], + callbacks: SessionCallback[], +): void { + for (const callback of callbacks) { + try { + const returned: unknown = callback(...args) + void Promise.resolve(returned).catch((error: unknown) => { + warnContained(ctx, `session "${id}": ${name} listener rejected: ${renderThrown(error)}`) + }) + } catch (error: unknown) { + warnContained(ctx, `session "${id}": ${name} listener threw: ${renderThrown(error)}`) + } + } +} + +interface SessionAppendHooks { + /** Keep the store attachment live through acceptance and publication. */ + begin(): void + /** Resolve the exact observer list before commit; returns its contained publisher. */ + prepareObservation(event: SessionEvent): () => void + /** Release the attachment barrier and honor a deferred detach. */ + end(): void +} + +const appendHooks = new WeakMap() +/** Identity token replaced on every store attachment or detachment. */ +const attachmentEpochs = new WeakMap() /** * An event-sourced session: an append-only log of {@link SessionEvent}s. @@ -289,6 +349,8 @@ const appendObservers = new WeakMap void>() */ export class Session { private log: SessionEvent[] = [] + /** True throughout one event's materialization, validation, commit, and publication. */ + private appendInProgress = false /** * Derived surface — a cached linked list of message-producing events. @@ -393,8 +455,11 @@ export class Session { /** * Append one typed event to the log and synchronously notify observers via - * the store-owned, module-private append observer. The hot path never blocks - * on I/O — persistence plugins buffer asynchronously. + * the store-owned, module-private publication hooks. The hot path never blocks + * on I/O — persistence plugins buffer asynchronously. Once the event enters + * the log, the append is committed: observer failures are logged and + * contained per listener, so they do not change the return value or prevent + * later listeners from observing the same accepted event. * * @param type - The event type (key of {@link SessionEventMap}). * @param data - The event payload; must be JSON-serializable. @@ -416,7 +481,9 @@ export class Session { * copies each nested value once, so a stateful getter cannot supply one value * to validation and another to storage. The event log is the durable source * of truth, so a bad event fails at the append site rather than later during - * a backend flush. + * a backend flush. A synchronous internal dispatch validation failure or an + * append reentered while this acceptance/publication boundary is open also + * rejects before the log changes. */ append( type: T, @@ -426,60 +493,87 @@ export class Session { if (typeof type !== 'string') { throw new TypeError('session event type must be a string') } - const surfaceOpts: SurfaceIntent | undefined = opts[0] - const sourceEventSeqs = surfaceOpts?.sourceEventSeqs - const surfaceOp = surfaceOpts?.surfaceOp - // Surface-eligible events MUST carry a surfaceOp marker — the surface is the - // sole source of derived history, so a marker-less message event would be - // logged yet vanish from deriveMessages(). The typed `opts` overload makes - // the marker mandatory only when `T` is a SPECIFIC SurfaceEventType literal; - // when `T` widens to the SessionEventType union (a caller iterating raw - // events: `for (const e of log) append(e.type, e.data)`), the conditional - // rest collapses to optional and the compiler stops enforcing it. Re-check - // at runtime so that loophole can't silently drop history. - const surfaceMetadata = { - ...sourceEventSeqs !== undefined ? { sourceEventSeqs } : {}, - ...surfaceOp !== undefined ? { surfaceOp } : {}, + if (this.appendInProgress) { + throw new Error('session append cannot reenter while another append is being accepted or published') } - // The caller still owns the data and metadata objects and could mutate them - // after append. Materialize each accepted value exactly once while checking - // its JSON vocabulary, so the log cannot drift and a stateful getter cannot - // show one value to validation and another to a prototype-erasing clone. The - // returned event carries these SAME snapshots. - // - // Surface metadata accessors are read once into one plain record; the - // recursive snapshot then reads each nested value once as it copies it. - // Build the event shape with conditional surface fields via spreading. - // The result is cast through `unknown` because the conditional spreads - // produce an intersection type that the assignability checker can't - // narrow to a specific discriminated-union member when T is generic. - // This is a safe internal boundary: data and surface metadata are - // materialized below before the event enters the log. - const dataSnapshot = snapshotJsonValue(data) - if (dataSnapshot === undefined) { - throw new Error(`session event "${type}" carries non-JSON-serializable data`) + const hooks = appendHooks.get(this) + const attachmentEpoch = attachmentEpochs.get(this) + this.appendInProgress = true + try { + // Start before reading caller-owned fields: a getter may request detach + // or try to append reentrantly. The attachment and sequence boundary stay + // stable until this exact acceptance attempt has either failed or reached + // every post-commit observer. + hooks?.begin() + const surfaceOpts: SurfaceIntent | undefined = opts[0] + const sourceEventSeqs = surfaceOpts?.sourceEventSeqs + const surfaceOp = surfaceOpts?.surfaceOp + // Surface-eligible events MUST carry a surfaceOp marker — the surface is the + // sole source of derived history, so a marker-less message event would be + // logged yet vanish from deriveMessages(). The typed `opts` overload makes + // the marker mandatory only when `T` is a SPECIFIC SurfaceEventType literal; + // when `T` widens to the SessionEventType union (a caller iterating raw + // events: `for (const e of log) append(e.type, e.data)`), the conditional + // rest collapses to optional and the compiler stops enforcing it. Re-check + // at runtime so that loophole can't silently drop history. + const surfaceMetadata = { + ...sourceEventSeqs !== undefined ? { sourceEventSeqs } : {}, + ...surfaceOp !== undefined ? { surfaceOp } : {}, + } + // The caller still owns the data and metadata objects and could mutate them + // after append. Materialize each accepted value exactly once while checking + // its JSON vocabulary, so the log cannot drift and a stateful getter cannot + // show one value to validation and another to a prototype-erasing clone. The + // returned event carries these SAME snapshots. + // + // Surface metadata accessors are read once into one plain record; the + // recursive snapshot then reads each nested value once as it copies it. + // Build the event shape with conditional surface fields via spreading. + // The result is cast through `unknown` because the conditional spreads + // produce an intersection type that the assignability checker can't + // narrow to a specific discriminated-union member when T is generic. + // This is a safe internal boundary: data and surface metadata are + // materialized below before the event enters the log. + const dataSnapshot = snapshotJsonValue(data) + if (dataSnapshot === undefined) { + throw new Error(`session event "${type}" carries non-JSON-serializable data`) + } + const surfaceMetadataSnapshot = snapshotJsonValue(surfaceMetadata) + if (surfaceMetadataSnapshot === undefined) { + throw new Error(`session event "${type}" carries non-JSON-serializable surface metadata`) + } + assertSurfaceMetadataShape( + type, + (surfaceMetadataSnapshot as { surfaceOp?: unknown }).surfaceOp, + (surfaceMetadataSnapshot as { sourceEventSeqs?: unknown }).sourceEventSeqs, + ) + if (appendHooks.get(this) !== hooks || attachmentEpochs.get(this) !== attachmentEpoch) { + throw new Error('session attachment changed while append input was being accepted') + } + const event = { + type, + seq: this.log.length, + time: Date.now(), + data: dataSnapshot, + ...surfaceMetadataSnapshot, + } as unknown as SessionEvent + const acceptedEvent = deepFreeze(event) + // Resolve dispatch before the log push. Cordis runs internal/dispatch + // while producing this list; if instrumentation rejects the carrier, the + // append still fails before commit. The resolved callbacks themselves are + // observe-only and run with per-listener containment after the push. + const publish = hooks?.prepareObservation(acceptedEvent as unknown as SessionEvent) + this.log.push(acceptedEvent as unknown as SessionEvent) + this.eventsSnapshot = undefined + publish?.() + return acceptedEvent + } finally { + try { + hooks?.end() + } finally { + this.appendInProgress = false + } } - const surfaceMetadataSnapshot = snapshotJsonValue(surfaceMetadata) - if (surfaceMetadataSnapshot === undefined) { - throw new Error(`session event "${type}" carries non-JSON-serializable surface metadata`) - } - assertSurfaceMetadataShape( - type, - (surfaceMetadataSnapshot as { surfaceOp?: unknown }).surfaceOp, - (surfaceMetadataSnapshot as { sourceEventSeqs?: unknown }).sourceEventSeqs, - ) - const event = { - type, - seq: this.log.length, - time: Date.now(), - data: dataSnapshot, - ...surfaceMetadataSnapshot, - } as unknown as SessionEvent - const acceptedEvent = deepFreeze(event) - this.log.push(acceptedEvent as unknown as SessionEvent) - this.eventsSnapshot = undefined - appendObservers.get(this)?.(acceptedEvent as unknown as SessionEvent) - return acceptedEvent } /** Cached fold of the request-header events — see {@link requestHeader}. */ @@ -674,7 +768,9 @@ export class SessionStore extends Service { private announced = new WeakSet() /** Entries currently dispatching `session/created`; detach waits for dispatch to unwind. */ private announcing = new WeakSet() - /** A detach requested reentrantly from `session/created`. */ + /** Entries accepting or publishing an append; detach waits for the boundary to unwind. */ + private appending = new WeakSet() + /** A detach requested reentrantly from creation or append publication. */ private pendingDetach = new WeakSet() /** Unpublished identities held across factory load/setup transactions. */ private reservations = new Map() @@ -746,7 +842,7 @@ export class SessionStore extends Service { * fills `version`/`id`/`createdAt`). * * For an agent whose session must be torn down IN ORDER with its loop (so the - * loop's final flush is captured before the store-owned observer detaches), do NOT use this + * loop's final flush is captured before the store attachment ends), do NOT use this * — fold the session lifecycle into the agent's own effect via * {@link prepare} + {@link enter} + {@link announce} (see `dsh-agent-loop`'s * `startOwned`). @@ -763,7 +859,7 @@ export class SessionStore extends Service { // Single effect owned by the calling fiber. Yield the detach BEFORE // announcing so a throwing `session/created` listener rolls the attach back // (the generator effect disposes already-yielded disposers on a throw) - // instead of leaking the store entry + append observer. + // instead of leaking the store entry and its publication hooks. this.ctx.effect(function* (this: SessionStore) { yield this.enter(session) this.announce(session) @@ -777,7 +873,7 @@ export class SessionStore extends Service { * Pairs with {@link enter} + {@link announce}: a caller that owns a composite * `ctx.effect` (the agent factory) folds the session lifecycle into that ONE * effect so a fiber unload tears the session + agent down as a single ORDERED - * chain rather than as racing sibling effects — which would detach the append observer + * chain rather than as racing sibling effects — which would remove the publication hooks * before the loop's closing `session/flush`, dropping the closing events. * * @param id - the session id; omitted, the store mints `session-`. @@ -827,9 +923,9 @@ export class SessionStore extends Service { } /** - * Enter a {@link prepare}d session into the store: wire the module-private - * append observer to `session/event` and add it to the store. Returns the - * DETACH disposer (observer + store removal). Does NOT emit `session/created` — + * Enter a {@link prepare}d session into the store: install the module-private + * append publication hooks and add it to the store. Returns the DETACH + * disposer (hooks + store removal). Does NOT emit `session/created` — * the caller yields this disposer inside its effect and THEN calls * {@link announce}, so a throwing `session/created` listener rolls the attach * back instead of leaking it. @@ -845,7 +941,7 @@ export class SessionStore extends Service { * @param session - a {@link prepare}d session not yet in the store. * @param reservation - the exact unpublished-id capability when a factory * reserved this session across setup. - * @returns the detach disposer (observer + store removal). When called from + * @returns the detach disposer (publication hooks + store removal). When called from * a synchronous `session/created` listener, removal and disposal wait until * that creation dispatch unwinds. * @throws if a session with this id is already in the store. @@ -863,7 +959,7 @@ export class SessionStore extends Service { if (this.store.has(id) || this.enteringIds.has(id)) { throw new Error(`session "${id}" already exists`) } - if (appendObservers.has(session)) throw new Error(`session "${id}" is already attached to a store`) + if (appendHooks.has(session)) throw new Error(`session "${id}" is already attached to a store`) this.enteringIds.add(id) // The carrier is decided HERE, once, from the ENTERING context's scope tag // (`this.ctx` is the caller's context — the tracker mechanism): every @@ -889,20 +985,39 @@ export class SessionStore extends Service { } /* v8 ignore next 1 -- enteringIds prevents a same-store commit during carrier construction */ if (this.store.has(id)) throw new Error(`session "${id}" already exists`) - if (appendObservers.has(session)) throw new Error(`session "${id}" is already attached to a store`) + if (appendHooks.has(session)) throw new Error(`session "${id}" is already attached to a store`) this.carriers.set(session, carrier) const emitCtx = this.ctx - appendObservers.set(session, (event) => { emitCtx.emit(carrier, 'session/event', session, event) }) + appendHooks.set(session, { + begin: () => { this.appending.add(session) }, + prepareObservation(event) { + // Cordis removes carrier/name in place and exposes the remaining array + // to internal/dispatch. Resolve with a throwaway array so an internal + // checker cannot replace the tuple later observers receive. + const dispatchArgs: unknown[] = [carrier, 'session/event', session, event] + const callbackArgs: unknown[] = [session, event] + const callbacks = collectSessionCallbacks(emitCtx, dispatchArgs) + assertDispatchTuple('session/event', dispatchArgs, callbackArgs) + return () => { invokeContainedSessionObservers(emitCtx, 'session/event', id, callbackArgs, callbacks) } + }, + end: () => { + this.appending.delete(session) + if (this.pendingDetach.has(session) && !this.announcing.has(session)) { + this.detachEntered(session, id, carrier) + } + }, + }) + attachmentEpochs.set(session, {}) this.acceptedIds.set(session, id) this.store.set(id, session) let entered = true const detach = (): void => { if (!entered) return entered = false - // A creation listener may own the advanced detach capability. Keep the - // entry and its event observer live until the synchronous creation - // dispatch unwinds, then publish the paired disposal edge. - if (this.announcing.has(session)) { + // A lifecycle listener may own the advanced detach capability. Keep the + // entry and its publication hooks live until synchronous creation or append + // publication unwinds, then publish the paired disposal edge. + if (this.announcing.has(session) || this.appending.has(session)) { this.pendingDetach.add(session) return } @@ -920,7 +1035,8 @@ export class SessionStore extends Service { * remains the exact-identity backstop against future mutation paths */ if (this.store.get(id) !== session || this.acceptedIds.get(session) !== id) return const wasAnnounced = this.announced.delete(session) - appendObservers.delete(session) + appendHooks.delete(session) + attachmentEpochs.set(session, {}) this.acceptedIds.delete(session) this.carriers.delete(session) this.store.delete(id) @@ -943,38 +1059,40 @@ export class SessionStore extends Service { // throw. Rollback must still pair that partial creation with disposal, and // a listener cannot recursively create a second lifecycle edge. this.announced.add(session) - const args: unknown[] = [carrier, 'session/created', session] + const dispatchArgs: unknown[] = [carrier, 'session/created', session] + const callbackArgs: unknown[] = [session] this.announcing.add(session) try { - for (const callback of this.ctx.events.dispatch('emit', args)) { + const callbacks = collectSessionCallbacks(this.ctx, dispatchArgs) + assertDispatchTuple('session/created', dispatchArgs, callbackArgs) + for (const callback of callbacks) { // Synchronous throws intentionally propagate and veto publication; the // yielded detach then emits the paired disposal edge. An async function // is nevertheless assignable to a void listener, so observe its returned // promise: rejection is too late to roll back and must be logged instead // of becoming unhandled. - const returned: unknown = callback(...args) + const returned: unknown = callback(...callbackArgs) void Promise.resolve(returned).catch((error: unknown) => { - this.ctx.logger.warn(`session "${id}": session/created listener rejected: ${renderThrown(error)}`) + warnContained(this.ctx, `session "${id}": session/created listener rejected: ${renderThrown(error)}`) }) } } finally { this.announcing.delete(session) - if (this.pendingDetach.has(session)) this.detachEntered(session, id, carrier) + if (this.pendingDetach.has(session) && !this.appending.has(session)) { + this.detachEntered(session, id, carrier) + } } } /** Emit the paired teardown notification with per-listener containment. */ private emitDisposed(session: Session, carrier: Scoped, id: SessionId): void { - const args: unknown[] = [carrier, 'session/disposed', session] - for (const callback of this.ctx.events.dispatch('emit', args)) { - try { - const returned: unknown = callback(...args) - void Promise.resolve(returned).catch((error: unknown) => { - this.ctx.logger.warn(`session "${id}": session/disposed listener rejected: ${renderThrown(error)}`) - }) - } catch (error: unknown) { - this.ctx.logger.warn(`session "${id}": session/disposed listener threw: ${renderThrown(error)}`) - } + const dispatchArgs: unknown[] = [carrier, 'session/disposed', session] + const callbackArgs: unknown[] = [session] + try { + const callbacks = collectSessionCallbacks(this.ctx, dispatchArgs) + invokeContainedSessionObservers(this.ctx, 'session/disposed', id, callbackArgs, callbacks) + } catch (error: unknown) { + warnContained(this.ctx, `session "${id}": session/disposed dispatch threw: ${renderThrown(error)}`) } } @@ -986,10 +1104,27 @@ export class SessionStore extends Service { * raw `ctx.parallel('session/flush', …)` — one owner, one spelling, and the * scoped-dispatch invariant can pin it. * @param session - the session whose buffered events must reach durable storage. - * @returns resolves when every flush listener has settled; rejects if one rejects. + * @returns resolves when every flush listener has settled; after all settle, + * rejects with the first registered listener failure if any listener failed. */ async flush(session: Session): Promise { - await this.ctx.parallel(this.liveEntryFor(session).carrier, 'session/flush', session) + const { carrier } = this.liveEntryFor(session) + const dispatchArgs: unknown[] = [carrier, 'session/flush', session] + const callbackArgs: unknown[] = [session] + const callbacks = collectSessionCallbacks(this.ctx, dispatchArgs) + assertDispatchTuple('session/flush', dispatchArgs, callbackArgs) + const results = await Promise.allSettled(callbacks.map((callback) => { + try { + return callback(...callbackArgs) + } catch (error: unknown) { + // Preserve the listener's exact rejection value; flush is a caller-owned + // failure boundary, and Cordis listeners may throw arbitrary values. + // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors + return Promise.reject(error) + } + })) + const failure = results.find((result): result is PromiseRejectedResult => result.status === 'rejected') + if (failure !== undefined) throw failure.reason } /** Return the exact live session's accepted id and carrier; detached/prepared objects reject. */ diff --git a/packages/core/session/tests/scoped.spec.ts b/packages/core/session/tests/scoped.spec.ts index 80dd8510d2..80cc08e629 100644 --- a/packages/core/session/tests/scoped.spec.ts +++ b/packages/core/session/tests/scoped.spec.ts @@ -108,6 +108,40 @@ describe('sessions.flush()', () => { await expect(ctx.sessions.flush(session)).rejects.toThrow('disk full') }) + it('does not let a synchronous flush failure starve later listeners', async () => { + const ctx = await mount() + const flushed: Session[] = [] + ctx.on('session/flush', () => { throw new Error('disk full') }) + ctx.on('session/flush', (session) => { flushed.push(session) }) + const session = ctx.sessions.create() + + await expect(ctx.sessions.flush(session)).rejects.toThrow('disk full') + expect(flushed).toEqual([session]) + }) + + it('waits for slower flush listeners before reporting another listener failure', async () => { + const ctx = await mount() + const gate = Promise.withResolvers() + let slowStarted = false + let settled = false + ctx.on('session/flush', () => Promise.reject(new Error('disk full'))) + ctx.on('session/flush', () => { + slowStarted = true + return gate.promise + }) + const session = ctx.sessions.create() + + const flushing = ctx.sessions.flush(session) + void flushing.finally(() => { settled = true }).catch(() => undefined) + await Promise.resolve() + expect(slowStarted).toBe(true) + expect(settled).toBe(false) + + gate.resolve(undefined) + await expect(flushing).rejects.toThrow('disk full') + expect(settled).toBe(true) + }) + it('rejects a never-entered session instead of inventing a carrier', async () => { const ctx = await mount() const scope = await mintScope(ctx, 'owner') @@ -120,6 +154,21 @@ describe('sessions.flush()', () => { expect(flushed).toEqual([]) }) + it('rejects internal dispatch substitution before flush callbacks run', async () => { + const ctx = await mount() + const session = ctx.sessions.create() + const replacement = ctx.sessions.create() + const flushed: Session[] = [] + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name === 'session/flush') args[0] = replacement + }) + ctx.on('session/flush', (candidate) => { flushed.push(candidate) }) + + await expect(ctx.sessions.flush(session)) + .rejects.toThrow('session/flush internal dispatch replaced the accepted callback tuple') + expect(flushed).toEqual([]) + }) + it('clears a detached carrier and rejects stale flushes', async () => { const ctx = await mount() const scope = await mintScope(ctx, 'owner') diff --git a/packages/core/session/tests/session.spec.ts b/packages/core/session/tests/session.spec.ts index 6edeac0084..761f89ed2b 100644 --- a/packages/core/session/tests/session.spec.ts +++ b/packages/core/session/tests/session.spec.ts @@ -702,7 +702,7 @@ describe('SessionStore', () => { const session = ctx.sessions.create() expect(created).toEqual([session]) - // The store-owned append observer is module-private. A JavaScript caller + // The store-owned append publication hooks are module-private. A JavaScript caller // may create an unrelated property with the old implementation's name, // but cannot suppress the durable event feed. expect(Reflect.set(session, 'onAppend', undefined)).toBe(true) @@ -1120,7 +1120,7 @@ describe('SessionStore', () => { expect(disposed.map(session => session.id)).toEqual(['fixed']) // A subsequent create of the SAME id succeeds (the already-exists check is - // not wedged) and its store-owned observer is correctly wired (events observable). + // not wedged) and its store-owned publication hooks are correctly wired. const events: SessionEvent[] = [] ctx.on('session/event', (_session, event) => void events.push(event)) const session = ctx.sessions.create(SessionId('fixed')) @@ -1129,6 +1129,277 @@ describe('SessionStore', () => { expect(events).toHaveLength(1) }) + it('contains session/event observer failures after the append commit point', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const session = ctx.sessions.create(SessionId('contained-event')) + const heard: SessionEvent[] = [] + let committedBeforeNotify = false + ctx.on('session/event', (observedSession, event) => { + committedBeforeNotify = observedSession.events.at(-1) === event + throw new Error('sync event observer') + }) + ctx.on('session/event', () => Promise.reject(new Error('async event observer')) as never) + ctx.on('session/event', (_observedSession, event) => { heard.push(event) }) + + let appended!: SessionEvent + expect(() => { + appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + }).not.toThrow() + expect(committedBeforeNotify).toBe(true) + expect(session.events).toEqual([appended]) + expect(heard).toEqual([appended]) + await Promise.resolve() + await Promise.resolve() + + expect(warnings).toEqual([ + 'session "contained-event": session/event listener threw: Error: sync event observer', + 'session "contained-event": session/event listener rejected: Error: async event observer', + ]) + }) + + it('runs internal dispatch validation on one frozen candidate before commit and resets after a veto', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId('dispatch-veto')) + const validations: Array<{ event: SessionEvent; logLength: number; frozen: boolean }> = [] + const observed: SessionEvent[] = [] + let reject = true + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const [observedSession, event] = args as [Session, SessionEvent] + validations.push({ + event, + logLength: observedSession.events.length, + frozen: Object.isFrozen(event) && Object.isFrozen(event.data), + }) + if (reject) { + reject = false + throw new Error('reject first candidate') + } + }) + ctx.on('session/event', (_observedSession, event) => { observed.push(event) }) + + expect(() => session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + })).toThrow('reject first candidate') + expect(session.events).toEqual([]) + expect(observed).toEqual([]) + + const appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + expect(validations.map(({ logLength, frozen }) => ({ logLength, frozen }))).toEqual([ + { logLength: 0, frozen: true }, + { logLength: 0, frozen: true }, + ]) + expect(validations.map(({ event }) => event.seq)).toEqual([0, 0]) + expect(validations[1]!.event).toBe(appended) + expect(session.events).toEqual([appended]) + expect(observed).toEqual([appended]) + }) + + it('resolves session/event dispatch before commit so instrumentation failure cannot hide a logged event', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId('dispatch-check')) + const observed: SessionEvent[] = [] + ctx.on('internal/dispatch', (_mode, name) => { + if (name === 'session/event') throw new Error('dispatch instrumentation rejected the carrier') + }) + ctx.on('session/event', (_observedSession, event) => { observed.push(event) }) + + expect(() => session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + })).toThrow('dispatch instrumentation rejected the carrier') + expect(session.events).toEqual([]) + expect(observed).toEqual([]) + }) + + it('rejects prepend or append instrumentation that replaces the accepted observer tuple', async () => { + for (const prepend of [true, false]) { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId(`dispatch-tuple-${prepend}`)) + const replacementSession = new Session(SessionId('replacement')) + const replacementEvent = { + type: 'turn/end', + seq: 99, + time: 1, + data: { turn: 99, reason: { kind: 'completed' } }, + } as SessionEvent + const observed: Array<{ session: Session; event: SessionEvent }> = [] + let replace = true + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event' || !replace) return + args[0] = replacementSession + args[1] = replacementEvent + }, { prepend }) + ctx.on('session/event', (observedSession, event) => { + observed.push({ session: observedSession, event }) + }) + + expect(() => session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + })).toThrow('session/event internal dispatch replaced the accepted callback tuple') + expect(session.events).toEqual([]) + expect(observed).toEqual([]) + + replace = false + const appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + expect(session.events).toEqual([appended]) + expect(observed).toEqual([{ session, event: appended }]) + } + }) + + it('rejects if a bare session becomes attached while caller data is materialized', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = new Session(SessionId('attach-during-append')) + const observed: SessionEvent[] = [] + let sessionEventDispatches = 0 + let detach!: () => void + ctx.on('internal/dispatch', (_mode, name) => { + if (name === 'session/event') sessionEventDispatches += 1 + }) + ctx.on('session/event', (_observedSession, event) => { observed.push(event) }) + const data = { + get todos(): TodoItem[] { + detach = ctx.sessions.enter(session) + ctx.sessions.announce(session) + return [] + }, + } + + expect(() => session.append('todo/write', data)) + .toThrow('session attachment changed while append input was being accepted') + expect(ctx.sessions.get(session.id)).toBe(session) + expect(session.events).toEqual([]) + expect(sessionEventDispatches).toBe(0) + expect(observed).toEqual([]) + + const appended = session.append('todo/write', { todos: [] }) + expect(session.events).toEqual([appended]) + expect(sessionEventDispatches).toBe(1) + expect(observed).toEqual([appended]) + detach() + }) + + it('rejects a transient attach and detach while caller data is materialized', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = new Session(SessionId('attach-detach-during-append')) + const lifecycle: string[] = [] + const observed: SessionEvent[] = [] + ctx.on('session/created', () => { lifecycle.push('created') }) + ctx.on('session/disposed', () => { lifecycle.push('disposed') }) + ctx.on('session/event', (_observedSession, event) => { observed.push(event) }) + const data = { + get todos(): TodoItem[] { + const detach = ctx.sessions.enter(session) + ctx.sessions.announce(session) + detach() + return [] + }, + } + + expect(() => session.append('todo/write', data)) + .toThrow('session attachment changed while append input was being accepted') + expect(ctx.sessions.get(session.id)).toBeUndefined() + expect(session.events).toEqual([]) + expect(lifecycle).toEqual(['created', 'disposed']) + expect(observed).toEqual([]) + }) + + it('contains a reentrant observer append without reordering later observers', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const session = ctx.sessions.create(SessionId('reentrant-observer')) + const heard: SessionEvent[] = [] + ctx.on('session/event', (observedSession) => { + observedSession.append('todo/write', { todos: [] }) + }) + ctx.on('session/event', (_observedSession, event) => { heard.push(event) }) + + const appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + expect(session.events).toEqual([appended]) + expect(heard).toEqual([appended]) + expect(warnings).toEqual([ + 'session "reentrant-observer": session/event listener threw: Error: session append cannot reenter while another append is being accepted or published', + ]) + }) + + it('keeps observer failures contained when warning output itself throws', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + ctx.logger.warn = (() => { throw new Error('logger unavailable') }) as typeof ctx.logger.warn + const session = ctx.sessions.create(SessionId('throwing-logger')) + const heard: SessionEvent[] = [] + ctx.on('session/event', () => { throw new Error('sync observer') }) + ctx.on('session/event', () => Promise.reject(new Error('async observer')) as never) + ctx.on('session/event', (_observedSession, event) => { heard.push(event) }) + + let appended!: SessionEvent + expect(() => { + appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + }).not.toThrow() + await Promise.resolve() + await Promise.resolve() + + expect(session.events).toEqual([appended]) + expect(heard).toEqual([appended]) + }) + + it('defers detach through dispatch resolution, commit, and observer publication', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const order: string[] = [] + const session = ctx.sessions.prepare(SessionId('detach-during-append')) + const detach = ctx.sessions.enter(session) + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event') return + const session = args[0] as Session + order.push(`resolve:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`) + detach() + }) + ctx.on('session/event', (session) => { + order.push(`observe:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`) + }) + ctx.on('session/disposed', (session) => { + order.push(`dispose:${ctx.sessions.get(session.id) === session ? 'live' : 'detached'}`) + }) + ctx.sessions.announce(session) + + const appended = session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + + expect(session.events).toEqual([appended]) + expect(order).toEqual(['resolve:live', 'observe:live', 'dispose:detached']) + expect(ctx.sessions.get(session.id)).toBeUndefined() + }) + it('observes async session/created rejection without rolling back or starving peers', async () => { const ctx = new Context() await ctx.plugin(SessionStore) @@ -1181,6 +1452,46 @@ describe('SessionStore', () => { 'session "contained-disposal": session/disposed listener rejected: Error: async disposed', ]) }) + + it('contains internal dispatch failure after session detachment', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const heard: Session[] = [] + ctx.on('internal/dispatch', (_mode, name) => { + if (name === 'session/disposed') throw new Error('disposed dispatch instrumentation') + }) + ctx.on('session/disposed', (session) => { heard.push(session) }) + const session = ctx.sessions.prepare(SessionId('disposed-dispatch')) + const detach = ctx.sessions.enter(session) + ctx.sessions.announce(session) + + expect(() => { detach() }).not.toThrow() + expect(ctx.sessions.get(session.id)).toBeUndefined() + expect(heard).toEqual([]) + expect(warnings).toEqual([ + 'session "disposed-dispatch": session/disposed dispatch threw: Error: disposed dispatch instrumentation', + ]) + }) + + it('does not let internal dispatch replace the disposed callback tuple', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const replacement = new Session(SessionId('replacement-disposed')) + const heard: Session[] = [] + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name === 'session/disposed') args[0] = replacement + }) + ctx.on('session/disposed', (session) => { heard.push(session) }) + const session = ctx.sessions.prepare(SessionId('fixed-disposed-tuple')) + const detach = ctx.sessions.enter(session) + ctx.sessions.announce(session) + + detach() + + expect(heard).toEqual([session]) + }) }) describe('todo/write event', () => { diff --git a/packages/support/invariants/README.md b/packages/support/invariants/README.md index 4f50ec42f3..c4b909773d 100644 --- a/packages/support/invariants/README.md +++ b/packages/support/invariants/README.md @@ -6,6 +6,8 @@ Dev-mode event-contract assertions. This pure-listener plugin checks relationshi Session itself owns immutable log storage in every composition: it takes one lossless JSON snapshot of each accepted event, deep-freezes that record, and exposes the log through immutable array snapshots. The invariants plugin checks the cross-record and cross-seam rules that storage immutability cannot express. +Session-log assertions run during Cordis `internal/dispatch`, while `Session.append()` is resolving the `session/event` callback snapshot but before it pushes the candidate into the log. A valid transition is staged by exact event identity and applied to the live trace only when that same committed event reaches the plugin's contained post-commit listener. A later internal dispatch check can therefore veto without advancing either the log or the invariant trace, while ordinary `session/event` observer failures remain observe-only. + ## Plugin A functional plugin — register the module namespace (this is what loading by name in `cordis.yml` does): @@ -19,7 +21,7 @@ declare const ctx: Context await ctx.plugin(Invariants) ``` -`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist, so a hot reload mid-turn does not falsely reject the next event. It registers only listeners and has no configuration. +`inject`: `['sessions']` — it reads `ctx.sessions.list()` at apply time to rebuild trace state for sessions that already exist, so a hot reload mid-turn does not falsely reject the next event. The oracle listeners are explicitly global so pre-commit staging and post-commit application keep the same audience even if the plugin is mounted under a scoped context; their cleanup still belongs to that mounting fiber. The plugin has no configuration. ## Invariants asserted diff --git a/packages/support/invariants/src/index.ts b/packages/support/invariants/src/index.ts index 8d8f52f3d7..20396c4f5d 100644 --- a/packages/support/invariants/src/index.ts +++ b/packages/support/invariants/src/index.ts @@ -21,7 +21,7 @@ import type { Context } from 'cordis' import { carrierKeyOf, isScopeCarrier } from '@deepseek-ai/dsh-scope' import type { AssembleContext } from '@deepseek-ai/dsh-system-prompt' import type { ToolExecution } from '@deepseek-ai/dsh-tools' -import { HarnessError } from '@deepseek-ai/dsh-llm' +import { assertNever, HarnessError } from '@deepseek-ai/dsh-llm' import type { CallId, GenerateOptions } from '@deepseek-ai/dsh-llm' import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent' import { Session, SessionId, foldRequestHeader } from '@deepseek-ai/dsh-session' @@ -70,6 +70,23 @@ interface SessionTrace { surface: number[] } +/** One accepted event's deferred mutation of a live session trace. */ +interface SessionTraceTransition { + /** Scalar state after the event commits. */ + scalars: Pick + /** The event's mutation of the open step's pending call set. */ + pendingCalls: + | { kind: 'none' } + | { kind: 'add' | 'delete'; callId: CallId } + | { kind: 'clear' } + /** The event's mutation of the derived surface order. */ + surface: + | { kind: 'none' | 'append' } + | { kind: 'replace'; start: number; count: number } + /** The committed event sequence to add to the known-sequence set. */ + seq: number +} + /** Event payload prefix for scoped seams whose first argument names its agent. */ interface AgentSubject { agent: Agent @@ -84,14 +101,19 @@ function requireOpenStep(trace: SessionTrace, kind: string, turn: number, step: } } -/** Assert one appended event against the per-session invariants. */ -function checkEvent(trace: SessionTrace, event: SessionEvent): void { +/** Validate one candidate event without mutating the committed session trace. */ +function validateEvent(trace: SessionTrace, event: SessionEvent): SessionTraceTransition { // seq is strictly monotonic — the spine of replay equivalence. lastSeq // starts at -1, so the first event (seq 0) passes. if (event.seq <= trace.lastSeq) { throw new InvariantError(`seq must strictly increase: saw ${event.seq} after ${trace.lastSeq}`) } - trace.lastSeq = event.seq + let openTurn = trace.openTurn + let openStep = trace.openStep + let nextTurn = trace.nextTurn + let nextStep = trace.nextStep + let pendingCalls: SessionTraceTransition['pendingCalls'] = { kind: 'none' } + let surface: SessionTraceTransition['surface'] = { kind: 'none' } // --- Surface invariants --- // Surface metadata (sourceEventSeqs, surfaceOp) is only valid on @@ -133,7 +155,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { // positional range — every shadowed node must appear in sourceEventSeqs. if (se.surfaceOp !== undefined) { if (se.surfaceOp === 'append') { - trace.surface.push(event.seq) + surface = { kind: 'append' } } else { const { start, end } = se.surfaceOp const startIdx = trace.surface.indexOf(start) @@ -155,9 +177,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { if (missing.length > 0) { throw new InvariantError(`surface replace: sourceEventSeqs must include every shadowed surface node; missing ${missing.join(', ')}`) } - // Apply the replace to the tracked surface: the new node takes the - // range's position so order stays in sync for later replaces. - trace.surface.splice(startIdx, shadowed.length, event.seq) + surface = { kind: 'replace', start: startIdx, count: shadowed.length } } } @@ -176,8 +196,8 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { if (event.data.turn !== trace.nextTurn) { throw new InvariantError(`turn/start expected turn ${trace.nextTurn}, got ${event.data.turn}`) } - trace.openTurn = event.data.turn - trace.nextStep = 1 + openTurn = event.data.turn + nextStep = 1 break } case 'turn/end': { @@ -187,8 +207,8 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { if (trace.openStep !== null) { throw new InvariantError(`turn/end ${event.data.turn} while step ${trace.openStep} is still open`) } - trace.openTurn = null - trace.nextTurn += 1 + openTurn = null + nextTurn += 1 break } case 'step/start': { @@ -202,16 +222,16 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { if (event.data.step !== trace.nextStep) { throw new InvariantError(`step/start expected step ${trace.nextStep} in turn ${event.data.turn}, got ${event.data.step}`) } - trace.openStep = event.data.step + openStep = event.data.step break } case 'step/end': { requireOpenStep(trace, 'step/end', event.data.turn, event.data.step) // A result must arrive in the step that issued the call; orphan calls // (a step that errored before its result) do not carry to the next step. - trace.pendingCalls.clear() - trace.openStep = null - trace.nextStep += 1 + pendingCalls = { kind: 'clear' } + openStep = null + nextStep += 1 break } case 'assistant/chunk': { @@ -224,7 +244,7 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { } case 'tool/call': { requireOpenStep(trace, 'tool/call', event.data.turn, event.data.step) - trace.pendingCalls.add(event.data.callId) + pendingCalls = { kind: 'add', callId: event.data.callId } break } case 'tool/result': { @@ -233,9 +253,10 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { // does NOT hold: a call may have no result — a throwing tool-execution // pipeline step ends the turn with no tool/result, which is legal.) const syntheticInterrupted = event.data.isError && event.data.error?.code === 'interrupted' - if (!trace.pendingCalls.delete(event.data.callId) && !syntheticInterrupted) { + if (!trace.pendingCalls.has(event.data.callId) && !syntheticInterrupted) { throw new InvariantError(`tool/result for ${event.data.callId} with no prior tool/call in this step`) } + pendingCalls = { kind: 'delete', callId: event.data.callId } break } // Turn-enclosure (the turn-enclosure RFC): EVERY session event not handled by a boundary @@ -255,8 +276,52 @@ function checkEvent(trace: SessionTrace, event: SessionEvent): void { break } } - // Track every seq seen — used above to validate sourceEventSeqs references. - trace.knownSeqs.add(event.seq) + return { + scalars: { lastSeq: event.seq, openTurn, openStep, nextTurn, nextStep }, + pendingCalls, + surface, + seq: event.seq, + } +} + +/** Apply one already-validated transition after its event commits. */ +function applyTransition(trace: SessionTrace, transition: SessionTraceTransition): void { + Object.assign(trace, transition.scalars) + switch (transition.pendingCalls.kind) { + case 'none': + break + case 'add': + trace.pendingCalls.add(transition.pendingCalls.callId) + break + case 'delete': + trace.pendingCalls.delete(transition.pendingCalls.callId) + break + case 'clear': + trace.pendingCalls.clear() + break + /* v8 ignore next -- validateEvent produces this closed transition union */ + default: + assertNever(transition.pendingCalls, 'session trace pending-call transition') + } + switch (transition.surface.kind) { + case 'none': + break + case 'append': + trace.surface.push(transition.seq) + break + case 'replace': + trace.surface.splice(transition.surface.start, transition.surface.count, transition.seq) + break + /* v8 ignore next -- validateEvent produces this closed transition union */ + default: + assertNever(transition.surface, 'session trace surface transition') + } + trace.knownSeqs.add(transition.seq) +} + +/** Validate and apply one event while rebuilding an already-committed log. */ +function replayEvent(trace: SessionTrace, event: SessionEvent): void { + applyTransition(trace, validateEvent(trace, event)) } /** Legal agent status transitions (the only state machine the loop guarantees). */ @@ -284,6 +349,11 @@ function checkTransition(from: AgentStatus | undefined, to: AgentStatus): void { */ export function apply(ctx: Context): void { const traces = new WeakMap() + const stagedTransitions = new WeakMap() // Agent status has no stored history to replay; the first observation after // (re-)apply seeds the baseline, so a reload never produces a false positive. const lastStatus = new WeakMap() @@ -304,14 +374,14 @@ export function apply(ctx: Context): void { const trace = freshTrace() traces.set(session, trace) for (const event of session.events) { - checkEvent(trace, event) + replayEvent(trace, event) } return trace } // Every store-created session (the only kind that emits session/event) is - // seeded first — via ctx.sessions.list() at apply or session/created — so - // the fallback is a defensive guard, never hit in practice. + // seeded first — via ctx.sessions.list() at apply or session/created — so the + // fallback is a defensive guard, never hit in practice. /* v8 ignore next -- traceFor's fallback: session/event always follows a seed */ const traceFor = (session: Session): SessionTrace => traces.get(session) ?? seedSession(session) @@ -322,16 +392,51 @@ export function apply(ctx: Context): void { // A newly created session may arrive seeded/forked (the constructor copies // the seed WITHOUT emitting session/event), so replay its log here too. - ctx.on('session/created', (session) => { seedSession(session) }) + ctx.on('session/created', (session) => { seedSession(session) }, { global: true }) ctx.on('session/event', (session, event) => { - checkEvent(traceFor(session), event) - }) + // Session resolves dispatch before committing, so internal/dispatch has + // already staged this exact event. A later dispatch veto skips every + // session/event callback and therefore leaves the live trace unchanged. + const staged = stagedTransitions.get(event) + /* v8 ignore next 2 -- internal/dispatch stages the exact callback arguments */ + if (staged === undefined || staged.session !== session) { + throw new InvariantError('session/event reached publication without matching pre-commit validation') + } + stagedTransitions.delete(event) + applyTransition(staged.trace, staged.transition) + }, { global: true }) ctx.on('agent/status', (agent, status) => { checkTransition(lastStatus.get(agent), status) lastStatus.set(agent, status) - }) + }, { global: true }) + + // --- Setup-drives invariant --------------------------------------------- + // + // CreateAgentOptions.setup COMPOSES the agent's scoped world; it must not + // DRIVE the agent. ReactLoopAgent rejects every driving verb structurally + // until rollback-covered publication reaches the session-start boundary; + // this event-level invariant remains the cross-implementation backstop for + // alternate Agent implementations and raw session writes. A turn/start + // candidate before agent/session-start is rejected by internal/dispatch, + // before Session commits it. Sessions of agents that exist BEFORE this + // plugin applies are marked started (their ordering is unknowable after the + // fact — never a false positive on HMR). `agents` is read via ctx.get (a + // strict, optional store lookup) rather than injected: the invariants plugin + // must load in harnesses that carry no agent registry at all (bare session + // tests), where this check simply never trips. + const sessionStarted = new WeakSet() + for (const agent of ctx.get('agents')?.list() ?? []) sessionStarted.add(agent.session) + const assertSessionStartedBeforeTurn = (session: Session, event: SessionEvent): void => { + if (event.type !== 'turn/start' || sessionStarted.has(session)) return + const owner = ctx.get('agents')?.list().find(agent => agent.session === session) + if (owner === undefined) return + throw new InvariantError( + `agent "${owner.id}": a turn opened before agent/session-start fired — ` + + 'CreateAgentOptions.setup composes the scoped world, it must not drive the agent ' + + '(send/steer/inject belong after creation returns)') + } // --- Scoped-dispatch invariants (the agent-scoping seam) --------------- // @@ -386,6 +491,22 @@ export function apply(ctx: Context): void { `"${name}" was dispatched with a scope carrier keyed to a DIFFERENT subject than its arguments name — ` + 'the carrier key and the event\'s subject must be the same object (use agentEvents(ctx, agent))') } + if (name === 'agent/session-start') { + // Mark before product listeners run: a prepended session-start listener is + // explicitly allowed to inject the first turn's context synchronously. + sessionStarted.add((args[0] as Agent).session) + } + if (name === 'session/event') { + const [session, event] = args as [Session, SessionEvent] + const trace = traceFor(session) + const transition = validateEvent(trace, event) + assertSessionStartedBeforeTurn(session, event) + // The exact event identity reaches the contained post-commit listener. + // A later internal/dispatch listener may still veto; because validation + // is pure, abandoning this weakly keyed transition does not advance the + // committed trace or retain the session. + stagedTransitions.set(event, { session, trace, transition }) + } // The assembly context must never carry the agent DX field without the // scope layer selector: the assembly would silently miss the agent's // scoped sections/tools (use assembleContextFor(agent)). @@ -399,33 +520,6 @@ export function apply(ctx: Context): void { } }, { global: true }) - // --- Setup-drives invariant --------------------------------------------- - // - // CreateAgentOptions.setup COMPOSES the agent's scoped world; it must not - // DRIVE the agent. ReactLoopAgent rejects every driving verb structurally - // until rollback-covered publication reaches the session-start boundary; this event-level invariant remains the - // cross-implementation backstop for alternate Agent implementations and raw - // session writes. A turn/start appended before agent/session-start is a - // creation-time misuse, reported at the appending call site. Sessions of - // agents that exist BEFORE this plugin applies are marked started (their - // ordering is unknowable after the fact — never a false positive on HMR). - // `agents` is read via ctx.get (a strict, optional store lookup) rather - // than injected: the invariants plugin must load in harnesses that carry - // no agent registry at all (bare session tests), where this check simply - // never trips. - const sessionStarted = new WeakSet() - for (const agent of ctx.get('agents')?.list() ?? []) sessionStarted.add(agent.session) - ctx.on('agent/session-start', (agent) => { sessionStarted.add(agent.session) }) - ctx.on('session/event', (session, event) => { - if (event.type !== 'turn/start' || sessionStarted.has(session)) return - const owner = ctx.get('agents')?.list().find(agent => agent.session === session) - if (owner === undefined) return - throw new InvariantError( - `agent "${owner.id}": a turn opened before agent/session-start fired — ` - + 'CreateAgentOptions.setup composes the scoped world, it must not drive the agent ' - + '(send/steer/inject belong after creation returns)') - }) - // Request-reconstruction cross-check (the reconstructability RFC): a // loop-built request — frozen envelope + live sessionId is the marker; a // hand-built one-shot (compaction summarize) is unfrozen and skipped — must @@ -501,5 +595,5 @@ export function apply(ctx: Context): void { throw new InvariantError(`llm request for session "${String(session.id)}" diverges from the folded request header`) } return next() - }, { prepend: true }) + }, { global: true, prepend: true }) } diff --git a/packages/support/invariants/tests/invariants.spec.ts b/packages/support/invariants/tests/invariants.spec.ts index 44a87abf8c..efbf1dd978 100644 --- a/packages/support/invariants/tests/invariants.spec.ts +++ b/packages/support/invariants/tests/invariants.spec.ts @@ -1,6 +1,6 @@ import { describe, expect, it, vi } from 'vitest' import { Context } from 'cordis' -import { scopeTarget } from '@deepseek-ai/dsh-scope' +import { createScope, scopeTarget } from '@deepseek-ai/dsh-scope' import { CallId } from '@deepseek-ai/dsh-llm' import type { Agent } from '@deepseek-ai/dsh-agent' import SessionStore, { Session, SessionId } from '@deepseek-ai/dsh-session' @@ -21,6 +21,25 @@ function mockAgent(id: string): Agent { } describe('session-log invariants', () => { + it('keeps pre-commit staging and post-commit application global when mounted under a scope', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + let scopedCtx!: Context + await ctx.plugin(Object.assign((inner: Context) => { + scopedCtx = createScope(inner, {}).ctx + }, { inject: ['sessions'] })) + await scopedCtx.plugin(Invariants) + const globalSession = ctx.sessions.create(SessionId('global-under-scoped-invariants')) + + expect(() => { + globalSession.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + }) + globalSession.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + }).not.toThrow() + }) + it('accepts a well-formed turn/step/tool sequence', async () => { const { ctx } = await setup() const session = ctx.sessions.create() @@ -37,6 +56,75 @@ describe('session-log invariants', () => { }).not.toThrow() }) + it('does not advance the trace when a later internal-dispatch listener vetoes', async () => { + const { ctx } = await setup() + const session = ctx.sessions.create(SessionId('dispatch-veto-rollback')) + let veto = true + ctx.on('internal/dispatch', (_mode, name) => { + if (name !== 'session/event' || !veto) return + veto = false + throw new Error('later dispatch veto') + }) + + expect(() => session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + })).toThrow('later dispatch veto') + expect(session.events).toEqual([]) + + expect(() => { + session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) + session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + }).not.toThrow() + expect(session.events.map(event => event.type)).toEqual(['turn/start', 'turn/end']) + }) + + it('does not stage a substituted candidate from prepended internal instrumentation', async () => { + const { ctx } = await setup() + const session = ctx.sessions.create(SessionId('dispatch-substitution-rollback')) + let substitute = true + const replacement = { + type: 'turn/start', + seq: 0, + time: 1, + data: { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }, + } as const + ctx.on('internal/dispatch', (_mode, name, args) => { + if (name !== 'session/event' || !substitute) return + substitute = false + args[1] = replacement + }, { prepend: true }) + + expect(() => session.append('turn/start', { + turn: 1, + trigger: { kind: 'message', source: { kind: 'user' } }, + })).toThrow('session/event internal dispatch replaced the accepted callback tuple') + expect(session.events).toEqual([]) + + expect(() => { + session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) + session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + }).not.toThrow() + }) + + it('applies the committed transition after a prepended observer throws', async () => { + const { ctx } = await setup() + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const session = ctx.sessions.create(SessionId('postcommit-peer')) + ctx.on('session/event', () => { throw new Error('hostile observer') }, { prepend: true }) + + expect(() => { + session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) + session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + }).not.toThrow() + expect(session.events.map(event => event.type)).toEqual(['turn/start', 'turn/end']) + expect(warnings).toEqual([ + 'session "postcommit-peer": session/event listener threw: Error: hostile observer', + 'session "postcommit-peer": session/event listener threw: Error: hostile observer', + ]) + }) + it('rejects a non-monotonic seq (replay spine)', async () => { const { ctx } = await setup() const session = ctx.sessions.create() @@ -861,10 +949,19 @@ describe('scoped-dispatch invariants', () => { expect(() => { session.append('turn/start', { turn: 1, trigger: { kind: 'message', source: { kind: 'user' } } }) }).toThrow(/turn opened before agent\/session-start/) - // After session-start fires, turns open freely. - ctx.emit(scopeTarget(agent, agent), 'agent/session-start', agent, 'startup') - expect(() => { + expect(session.events).toEqual([]) + // The internal boundary marks the session before even a prepended product + // listener runs, so the supported session-start injection pattern can open + // and close its one-shot context turn synchronously. + ctx.on('agent/session-start', () => { + session.append('turn/start', { turn: 1, trigger: { kind: 'injection', source: { kind: 'plugin', plugin: 'test' } } }) session.append('turn/end', { turn: 1, reason: { kind: 'completed' } }) + }, { prepend: true }) + expect(() => { + ctx.emit(scopeTarget(agent, agent), 'agent/session-start', agent, 'startup') + }).not.toThrow() + expect(session.events.map(event => event.type)).toEqual(['turn/start', 'turn/end']) + expect(() => { session.append('turn/start', { turn: 2, trigger: { kind: 'message', source: { kind: 'user' } } }) }).not.toThrow() }) diff --git a/packages/ui/acp/README.md b/packages/ui/acp/README.md index 2f1f35adc4..f5734e1f10 100644 --- a/packages/ui/acp/README.md +++ b/packages/ui/acp/README.md @@ -71,7 +71,7 @@ When the client does NOT advertise the capability, none of the `_meta`/terminal ## Settle-exactly-once -A `session/prompt` resolves (or rejects) exactly once, keyed off the canonical session log (the `session/event` stream). One listener captures the prompt's owning turn from the log's `turn/start` and settles on the matching `turn/end` — the durable boundary event (`closeTurn` appends it unconditionally; there is no `agent/*` turn mirror). A prompt settles only on ITS OWN turn (`inflight.turn === turn/end.turn`), so a stale `turn/end` for a previously-cancelled turn whose end arrives late can never settle the wrong prompt. A turn that ends `error` REJECTS the RPC with an internal error carrying the failure message (ACP has no error stop reason); every other reason resolves via the codec. As a fallback, when the agent settles to `idle`/`disposed` with a prompt still pending — e.g. a peer `session/event` listener registered before the bridge threw and starved the bridge's listener — an `agent/status` handler reconciles the prompt from the log (the owning turn's `turn/end`, or `cancelled` if the turn was torn down without one). An empty/whitespace prompt is rejected up front — it would queue no work, so no turn would start and the RPC would hang. +A `session/prompt` resolves (or rejects) exactly once, keyed off the canonical session log (the `session/event` stream). One listener captures the prompt's owning turn from the log's `turn/start` and settles on the matching `turn/end` — the durable boundary event (`closeTurn` appends it unconditionally; there is no `agent/*` turn mirror). A prompt settles only on ITS OWN turn (`inflight.turn === turn/end.turn`), so a stale `turn/end` for a previously-cancelled turn whose end arrives late can never settle the wrong prompt. A turn that ends `error` REJECTS the RPC with an internal error carrying the failure message (ACP has no error stop reason); every other reason resolves via the codec. Session contains post-commit observer failures per listener, so another subscriber cannot starve the bridge. As defensive cross-seam reconciliation, an `agent/status` handler checks the log whenever the agent reaches `idle`/`disposed` with a prompt still pending, settling from the owning turn's `turn/end` or as `cancelled` if teardown left no clean boundary. An empty/whitespace prompt is rejected up front — it would queue no work, so no turn would start and the RPC would hang. ## Permission prompts diff --git a/packages/ui/acp/src/index.ts b/packages/ui/acp/src/index.ts index 35ff870080..5cd24c2c73 100644 --- a/packages/ui/acp/src/index.ts +++ b/packages/ui/acp/src/index.ts @@ -308,11 +308,10 @@ interface SessionRecord { * so a later stale `turn/end` finds no pending prompt. * * `logWatermark` is the session log length at the moment the prompt was - * installed (before `send()`). The settle-from-log fallback uses it to infer - * the owning `turn/start` from the canonical log even when the live - * `session/event` capture was starved (a peer listener that throws on - * `turn/start` — see `settleFromLog`): the prompt owns the FIRST `turn/start` - * appended at or after this watermark. + * installed (before `send()`). Defensive settle-from-log reconciliation uses + * it to infer the owning `turn/start` if status reaches idle/disposed before + * live correlation settled the prompt: the prompt owns the FIRST message + * `turn/start` appended at or after this watermark. */ inflight: { resolve: (reason: StopReason) => void @@ -338,12 +337,11 @@ interface SessionRecord { /** * Drive the in-flight prompt's settle from the harness event stream. The bridge * settles off the durable log: the `turn/end` session event on the - * `session/event` feed for the prompt's own turn, with the agent - * erroring/settling to idle as a fallback (docs/defensive-patterns.md "honor - * cross-seam contracts on BOTH sides") for the case where a throwing peer `session/event` listener - * starved the bridge's listener before it saw the boundary. The first of these - * to fire settles the prompt; `settle` is then cleared so the others are no-ops - * (settle-exactly-once). + * `session/event` feed for the prompt's own turn, with idle/disposed status as + * defensive log reconciliation (docs/defensive-patterns.md "honor cross-seam + * contracts on BOTH sides"). Session contains post-commit observer failures, + * so peers cannot starve this feed. The first settlement path clears the slot, + * making every later signal a no-op. */ export function apply(ctx: Context, config: AcpConfig): void { // Capture the injected services NOW, during apply(), while we are inside this @@ -527,23 +525,18 @@ export function apply(ctx: Context, config: AcpConfig): void { settleFromTurnEnd(inflight, event.data.reason) }) - // Settle fallback: a `session/event` listener registered BEFORE ACP that - // throws (on `turn/start` OR `turn/end`) would, via cordis `emit`'s - // stop-on-throw, starve ACP's listener above — the prompt would hang or, if - // only the turn number was missed, settle as the wrong outcome. So when the - // agent settles to `idle` (or is disposed), reconcile against the canonical - // log: determine the prompt's owning turn (the captured `turn`, or — if the - // live capture was starved — the FIRST `turn/start` appended at/after the - // install-time `logWatermark`), then settle from that turn's `turn/end` - // (reject on error, resolve via codec), or `cancelled` if no owning turn ever - // started. Never double-settles — clears `inflight` first. + // Defensive settle fallback: when the agent reaches idle/disposed while a + // prompt is still pending, reconcile against the canonical log. Determine + // the owning turn from live capture or the first message turn after the + // install-time watermark, then settle from its turn/end; if no clean owning + // turn exists, settle cancelled. The slot is cleared first, so this cannot + // double-settle against the live session/event path. const settleFromLog = (rec: SessionRecord): void => { const inflight = rec.inflight if (inflight === undefined) return const events = rec.agent.session.events - // The owning turn number: the captured one, or — if the live capture was - // starved — inferred from the log as the first MESSAGE-triggered turn opened - // at/after the watermark. The message-trigger filter matches the live + // The owning turn number: the captured one, or inferred from the log as the + // first MESSAGE-triggered turn opened at/after the watermark. The filter matches the live // capture: a one-shot `injection` turn a plugin may open between // prompt-install and the prompt's turn is NOT the prompt's turn. Undefined // only if no message turn ever started for this prompt. @@ -568,9 +561,8 @@ export function apply(ctx: Context, config: AcpConfig): void { settleFromTurnEnd(inflight, end.data.reason) } - // On a settle to idle/disposed, reconcile any still-pending prompt from the - // log (covers a starved `session/event` listener — see settleFromLog). A mid- - // step disposal that never appended a clean turn/end resolves `cancelled`. + // On idle/disposed, reconcile any still-pending prompt from the log. A + // mid-step disposal that never appended a clean turn/end resolves `cancelled`. // Demux via the agent→sessionId reverse map. ctx.on('agent/status', (agent, status: AgentStatus) => { const sessionId = bySession.get(agent) @@ -902,9 +894,9 @@ export function apply(ctx: Context, config: AcpConfig): void { // Install the in-flight slot BEFORE send() (send does not synchronously // flip status to running; the session/event listener records the turn // number and settle/rejects it). Capture the log length now as the - // watermark: the settle-from-log fallback infers the owning turn/start - // as the first one appended at/after it, surviving a starved live - // capture. A turn that ends in error rejects this promise (the codec + // watermark: defensive status reconciliation can infer the owning + // turn/start if status arrives reentrantly after commit but before this + // bridge's live callback. A turn that ends in error rejects this promise (the codec // never produces an error stop reason). const stopReason = await new Promise((resolve, reject) => { rec.inflight = { resolve, reject, turn: undefined, logWatermark: rec.agent.session.events.length } @@ -1010,15 +1002,15 @@ export function apply(ctx: Context, config: AcpConfig): void { * quiescence"): for each session settle any pending prompt `cancelled`, then * run that session's {@link AgentHandle} `dispose()` — which stops the loop * (sets `disposed`, aborts the in-flight step), AWAITS the loop's exit (the - * final `turn/end` + `session/flush` are captured while the store-owned append observer is still + * final `turn/end` + `session/flush` are captured while the store-owned publication hooks are still * attached), unregisters the agent, and removes its session from the store. * The per-session disposes run in parallel. Idempotent — clears the `sessions` * map first and memoizes, so a second call (close racing dispose) is a no-op. * Shared by Cordis disposal AND client disconnect (`conn.closed`). * - * Per-agent disposal closes the former pre-step best-effort window — but via - * the DISPOSED path, not `cancel()`: the start-disposer resolves `handle.disposed`, - * which wakes the parked loop, and `isDisposed()` breaks the loop before a + * Per-agent disposal closes the queued-before-run window through the DISPOSED + * path, not `cancel()`: the start-disposer resolves `handle.disposed`, which + * wakes the parked loop, and `isDisposed()` breaks the loop before a * queued-but-not-yet-running turn can start (a turn cut off mid-flight ends * with reason `disposed`, not `aborted`). A bare client disconnect (resolves * `conn.closed` WITHOUT disposing the fiber) thus leaves NO registered agent diff --git a/packages/ui/acp/tests/dispose.spec.ts b/packages/ui/acp/tests/dispose.spec.ts index 9dbd72aa35..f02a7b0649 100644 --- a/packages/ui/acp/tests/dispose.spec.ts +++ b/packages/ui/acp/tests/dispose.spec.ts @@ -160,7 +160,7 @@ describe('acp bridge — disposal & HMR safety', () => { // The teardown-ORDER guarantee: a per-agent dispose must stop the loop, // AWAIT its exit (so the loop's final `turn/end` + `session/flush` fire // through the still-attached store observer → `session/event`), and only - // THEN detach that observer + remove the session. If the order were inverted + // THEN remove its publication hooks and session entry. If the order were inverted // (detach first), the closing events would never reach persistence. Drive a // CLEAN turn to completion, dispose JUST the bridge, then re-load the // persisted log from disk and assert the closing turn/end is on disk — the @@ -190,7 +190,7 @@ describe('acp bridge — disposal & HMR safety', () => { // produced BY the dispose itself. Here the model stream HANGS, so the turn is // still open when teardown runs: the composite agent effect stops the loop, // the loop unwinds and appends `turn/end {disposed}` + runs its final - // `session/flush` — all while the store-owned append observer is still attached (the session + // `session/flush` — all while the store-owned publication hooks are still attached (the session // detach is the LAST disposer in the same effect's LIFO chain) — and only // THEN is the session detached. If the order were inverted (or the session // were a racing SIBLING effect), the abort-produced `turn/end` would never @@ -255,7 +255,7 @@ describe('acp bridge — disposal & HMR safety', () => { // into ONE composite effect whose disposers run as a `.then()` chain. The // register disposer emits `agent/disposed`; if a listener throws and the // emit is UNCONTAINED, the rejected chain skips the LATER session-detach - // disposer — stranding the session in the store with its append observer attached (a + // disposer — stranding the session in the store with its publication hooks attached (a // leak AND a durability hole, since the new design relies on detach // running). The emit must be contained. Register a throwing listener, drive // a clean turn, dispose, and assert the session was STILL removed. diff --git a/packages/ui/acp/tests/turns.spec.ts b/packages/ui/acp/tests/turns.spec.ts index e182d5f2bf..3fc6eef8a6 100644 --- a/packages/ui/acp/tests/turns.spec.ts +++ b/packages/ui/acp/tests/turns.spec.ts @@ -3,7 +3,7 @@ import { mkdtemp, rm } from 'node:fs/promises' import { tmpdir } from 'node:os' import { join } from 'node:path' import { defineTool } from '@deepseek-ai/dsh-tools' -import { AgentId } from '@deepseek-ai/dsh-agent' +import { AgentId, agentEvents } from '@deepseek-ai/dsh-agent' import { PROTOCOL_VERSION } from '@agentclientprotocol/sdk' import { errorResponse, @@ -235,12 +235,9 @@ describe('acp bridge — turn outcomes', () => { expect(failed).toHaveLength(1) }) - it('settles via the log fallback when a prior session/event listener throws (starvation)', async () => { - // A peer session/event listener that runs BEFORE the bridge's listener - // throws on turn/end (prepend: true puts it first). cordis emit stops at the - // throw, so the bridge's session/event listener never sees turn/end and - // cannot settle there. The agent/status idle-fallback must reconcile the - // prompt from the log so the RPC settles instead of hanging. + it('settles successfully when an earlier turn/end observer throws', async () => { + // Session contains each post-commit observer failure, so a prepended peer + // cannot starve the bridge's live turn/end delivery. harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] }) harness.ctx.on('session/event', (_s, event) => { if (event.type === 'turn/end') throw new Error('peer listener boom') @@ -250,9 +247,7 @@ describe('acp bridge — turn outcomes', () => { expect(res.stopReason).toBe('end_turn') }) - it('log fallback REJECTS when the starved turn ended in error', async () => { - // Same starvation as above, but the turn fails: the idle-fallback must - // reject the RPC from the logged turn/end{error}, not resolve. + it('still rejects a failed turn when an earlier turn/end observer throws', async () => { harness = await makeBridgeHarness({ storageDir, script: [errorResponse('starved boom')] }) harness.ctx.on('session/event', (_s, event) => { if (event.type === 'turn/end') throw new Error('peer listener boom') @@ -262,21 +257,49 @@ describe('acp bridge — turn outcomes', () => { .rejects.toThrow(/turn failed: starved boom/) }) - it('log fallback infers the owning turn when turn/START capture is starved', async () => { - // A peer listener throws on turn/START (not turn/end): the bridge never + it('captures and settles the owning turn when an earlier turn-start observer throws', async () => { + // Turn correlation still reaches the bridge after the throwing peer and // captures inflight.turn via the live stream. A throwing turn/start listener - // also FAILS the turn (the throw is recorded as the turn's error). Without - // the watermark inference the fallback would resolve `cancelled` (the bug); - // with it, it infers the owning turn from the log and REJECTS from that - // turn's error turn/end. (The model's own error is never reached — the turn - // failed at start — so the rejection carries the listener's failure.) - harness = await makeBridgeHarness({ storageDir, script: [textResponse('never runs')] }) + // Session contains post-commit callbacks independently. + // The model request and normal turn outcome therefore still occur. + harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] }) harness.ctx.on('session/event', (_s, event) => { if (event.type === 'turn/start') throw new Error('peer listener boom on start') }, { prepend: true }) const sessionId = await newSession(harness) - await expect(harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] })) - .rejects.toThrow(/turn failed:/) + const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }) + expect(result.stopReason).toBe('end_turn') + }) + + it('status reconciliation infers the owning message turn when teardown wins after turn/start', async () => { + harness = await makeBridgeHarness({ storageDir, script: [textResponse('background completion')] }) + const sessionId = await newSession(harness) + const agent = harness.ctx.agents.get(AgentId(sessionId))! + harness.ctx.on('session/event', (session, event) => { + if (session !== agent.session || event.type !== 'turn/start') return + // Inject the signal ordering the defensive fallback handles: disposal + // status after turn/start commits but before ACP's later live observer. + // This is event-level simulation; it does not mutate the test agent. + agentEvents(harness!.ctx, agent).emit('agent/status', 'disposed') + }, { prepend: true }) + + const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }) + expect(result.stopReason).toBe('cancelled') + }) + + it('status reconciliation can settle from a committed turn/end before live delivery', async () => { + harness = await makeBridgeHarness({ storageDir, script: [textResponse('answer')] }) + const sessionId = await newSession(harness) + const agent = harness.ctx.agents.get(AgentId(sessionId))! + harness.ctx.on('session/event', (session, event) => { + if (session !== agent.session || event.type !== 'turn/end') return + // Inject a reentrant status signal after the boundary commits to exercise + // the defensive log path before ACP's captured callback runs. + agentEvents(harness!.ctx, agent).emit('agent/status', 'idle') + }, { prepend: true }) + + const result = await harness.client.prompt({ sessionId, prompt: [{ type: 'text', text: 'go' }] }) + expect(result.stopReason).toBe('end_turn') }) it('a between-turn injection does not settle the prompt early (message-trigger correlation)', async () => { diff --git a/packages/ui/user-approval/README.md b/packages/ui/user-approval/README.md index 1c573cdf3f..b47f112aae 100644 --- a/packages/ui/user-approval/README.md +++ b/packages/ui/user-approval/README.md @@ -2,7 +2,7 @@ User-approval seam. Owns the `ctx.approval` service ([`ApprovalService`](src/index.ts)) and the one-shot permission vocabulary the harness shares: `ApprovalRequest` (agent + tool identity + reason + abort signal), the closed `ApprovalOutcome` union (`allowed-once` / `rejected` / `cancelled` / `unavailable`), the `ApprovalRequestId` brand pairing the two log-only audit events (`approval/asked` / `approval/decided`), and the `approval/request` waterfall the answerers listen on. It lives in the UI group because its purpose is human permission, while remaining channel-neutral: it depends only on Cordis and core vocabulary packages, never on a concrete UI. -The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its decision phase always resolves to an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service reads the request fields and `agent.session` binding once, requires object agent/session identities, a string `toolName`, optional string `callId`/`reason`, and an AbortSignal-shaped live capability, then shallow-freezes a detached request record while preserving the exact `agent` and signal identities. A malformed request rejects before any audit append; later caller mutation cannot redirect scope, payload, cancellation, policy lookup, or either audit event. The other precondition is an open turn on the captured session — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask also rejects before appending. Session observers run after an event enters the append-only log; if one throws, the service recognizes that the audit is already authoritative, contains the observer failure, and completes the pair. +The contract in one line: `ctx.approval.request(req)` puts exactly one question — "may this specific action proceed?" — to whatever answerers the deployment composed, and its answerer phase always produces an outcome: an aborted signal yields `cancelled`, a throwing or missing answerer yields `unavailable`, and `allowed-once` is a grant for the single asked-about action, never a class of future ones. Acceptance is synchronous: the service reads the request fields and `agent.session` binding once, requires object agent/session identities, a string `toolName`, optional string `callId`/`reason`, and an AbortSignal-shaped live capability, then shallow-freezes a detached request record while preserving the exact `agent` and signal identities. A malformed request rejects before any audit append; later caller mutation cannot redirect scope, payload, cancellation, policy lookup, or either audit event. The other precondition is an open turn on the captured session — the audit pair is turn-enclosed by contract (the turn is the durable log's commit/replay boundary; a bare event between turns is crash-tail garbage on reload), so an idle ask also rejects before appending. Either audit append may reject before commit because returning an unlogged decision would violate the pair. Session contains post-commit observer failures, so an authoritative audit append cannot reject the request or suppress its matching event. The service is the mechanism, answerers are the policy. Answerers are `approval/request` waterfall listeners occupying a single decision slot: answer for an agent you own by returning an outcome without calling `next()`, or delegate an agent you don't recognize by calling `next()` — the chain's built-in default is `unavailable`, so a deployment with no answerer (headless, CI) fails closed with zero configuration. Dispatch is keyed by `req.agent`: a listener registered through `agent.ctx` receives only that agent's questions, while a plain-context listener receives every agent's. Registration order across sibling plugins is not load-order deterministic; compose one terminal answerer per deployment and use `prepend` listeners only for decide-or-delegate gates. diff --git a/packages/ui/user-approval/src/index.ts b/packages/ui/user-approval/src/index.ts index 93ccd973c7..9b0347bb74 100644 --- a/packages/ui/user-approval/src/index.ts +++ b/packages/ui/user-approval/src/index.ts @@ -383,20 +383,23 @@ export class ApprovalService extends Service { * contract (the turn is the log's commit/replay boundary; an idle append * would be dropped as crash tail on reload) — and likewise throws before * appending anything when called idle; asking outside a turn is a deferred - * design. Once accepted it always resolves to an outcome, never rejects: an - * aborted signal yields `'cancelled'`, a missing or throwing answerer yields - * `'unavailable'` (fail closed), and a rogue non-vocabulary return value is - * normalized to `'unavailable'`. The caller-owned request is synchronously + * design. The answerer phase always produces an outcome: an aborted signal + * yields `'cancelled'`, a missing or throwing answerer yields `'unavailable'` + * (fail closed), and a rogue non-vocabulary return value is normalized to + * `'unavailable'`. A failure that prevents either audit append from committing + * still rejects; returning an unlogged decision would violate the audit pair. + * The caller-owned request is synchronously * snapshotted, so later mutation cannot split routing, dispatch payload, * cancellation, policy lookup, or the audit pair across agents/sessions. * Appends the * `approval/asked`/`approval/decided` audit pair (log-only) around the - * decision regardless of outcome. A synchronous session observer failure - * after an audit event entered the append-only log is contained; the event - * is already authoritative, so the pair still completes and the request - * still resolves. + * decision regardless of outcome. Session contains each post-commit observer + * failure, so an already authoritative audit event cannot make this request + * reject or suppress its matching event. * @param req - the pending decision (agent, tool identity, reason, signal). * @returns the closed outcome; `'allowed-once'` is the only grant. + * @throws when request acceptance fails, no turn is open, or either audit + * event fails before the session append commit point. */ async request(req: ApprovalRequest): Promise { // Accept one immutable request shape before the first async boundary. The @@ -476,47 +479,17 @@ export class ApprovalService extends Service { ) } const id = ApprovalRequestId(randomUUID()) - this.appendAudit(session, 'approval/asked', id, () => { - Reflect.apply(append, session, ['approval/asked', { - id, - toolName: accepted.toolName, - ...accepted.callId !== undefined ? { callId: accepted.callId } : {}, - ...accepted.reason !== undefined ? { reason: accepted.reason } : {}, - }]) - }) + Reflect.apply(append, session, ['approval/asked', { + id, + toolName: accepted.toolName, + ...accepted.callId !== undefined ? { callId: accepted.callId } : {}, + ...accepted.reason !== undefined ? { reason: accepted.reason } : {}, + }]) const outcome = await this.decide(accepted, session, acceptedSignal) - this.appendAudit(session, 'approval/decided', id, () => { - Reflect.apply(append, session, ['approval/decided', { id, outcome }]) - }) + Reflect.apply(append, session, ['approval/decided', { id, outcome }]) return outcome } - /** - * Append one audit event while distinguishing a post-append observer throw - * from a failure that prevented the event entering the log. `Session.append` - * pushes first and then notifies synchronously, so log growth proves the - * event is already authoritative; that observer failure is reported and - * contained so it cannot reject the approval or suppress its matching event. - * @param session - the captured session receiving both audit events. - * @param type - the audit event currently being appended. - * @param id - the request id, used to identify the contained failure. - * @param append - the single concrete `Session.append` call. - */ - private appendAudit( - session: Session, - type: 'approval/asked' | 'approval/decided', - id: ApprovalRequestId, - append: () => void, - ): void { - const length = session.events.length - try { - append() - } catch (error) { - if (session.events.length === length) throw error - this.ctx.logger.warn(`approval request "${id}": ${type} observer threw after the event was appended`) - } - } - /** * The session's effective policy: its own `approval/policy` fold, else the * configured default (the schema already defaulted an omitted policy to diff --git a/packages/ui/user-approval/tests/approval.spec.ts b/packages/ui/user-approval/tests/approval.spec.ts index 831b50111b..4d4b7aa67f 100644 --- a/packages/ui/user-approval/tests/approval.spec.ts +++ b/packages/ui/user-approval/tests/approval.spec.ts @@ -323,7 +323,7 @@ describe('ApprovalService.request', () => { const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided') expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided']) expect(decided?.data.id).toBe(asked?.data.id) - expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/asked observer threw')) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after asked append')) }) it('contains an approval/decided observer throw after append and still resolves', async () => { @@ -346,10 +346,10 @@ describe('ApprovalService.request', () => { const decided = session.events.find((event): event is SessionEvent<'approval/decided'> => event.type === 'approval/decided') expect(audit.map(event => event.type)).toEqual(['approval/asked', 'approval/decided']) expect(decided?.data).toMatchObject({ id: asked?.data.id, outcome: 'rejected' }) - expect(warn).toHaveBeenCalledWith(expect.stringContaining('approval/decided observer threw')) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('session/event listener threw: Error: observer failed after decided append')) }) - it('does not misclassify a pre-append failure as an observer failure', async () => { + it('propagates an append failure that prevented audit log growth', async () => { const ctx = await mounted() const failure = new Error('append failed before log growth') const agent = { diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts index 048ce58937..c36a50c244 100644 --- a/scripts/gen-doc-graphs.ts +++ b/scripts/gen-doc-graphs.ts @@ -253,6 +253,12 @@ const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: str // and contains each listener directly rather than rebuilding via agentEvents. { event: 'agent/disposed', pkg: 'agent', method: 'events.dispatch' }, { event: 'session/created', pkg: 'session', method: 'events.dispatch' }, + // Session event callbacks are likewise resolved before the log push, then + // invoked individually after commit so observer failures are contained. + { event: 'session/event', pkg: 'session', method: 'events.dispatch' }, + // Flush resolves the scoped callback set directly so internal instrumentation + // cannot substitute the accepted session before parallel invocation. + { event: 'session/flush', pkg: 'session', method: 'events.dispatch' }, // Session disposal uses direct callback resolution so teardown contains each // synchronous throw and returned-promise rejection independently. { event: 'session/disposed', pkg: 'session', method: 'events.dispatch' }, @@ -278,6 +284,12 @@ const DYNAMIC_EVENT_DISPATCHERS: Array<{ event: string; pkg: string; method: str { event: 'workflow/end', pkg: 'workflow', method: 'events.dispatch' }, ] +const DYNAMIC_EVENT_LISTENERS: Array<{ event: string; pkg: string }> = [ + // The invariants oracle marks the session started from its global + // internal/dispatch listener before product session-start callbacks run. + { event: 'agent/session-start', pkg: 'invariants' }, +] + function generatedHeader(title: string): string[] { return [ ' pkg_brand pkg_session --> pkg_llm pkg_session --> pkg_scope + pkg_system_prompt --> pkg_llm + pkg_system_prompt --> pkg_scope pkg_fs --> pkg_brand pkg_fs --> pkg_llm pkg_web --> pkg_llm pkg_sandbox --> pkg_llm - pkg_system_prompt --> pkg_llm - pkg_system_prompt --> pkg_scope - pkg_system_prompt --> pkg_session + pkg_agent --> pkg_brand + pkg_agent --> pkg_llm + pkg_agent --> pkg_scope + pkg_agent --> pkg_session + pkg_agent --> pkg_system_prompt pkg_bash --> pkg_brand pkg_bash --> pkg_sandbox pkg_bash --> pkg_session @@ -146,26 +150,22 @@ flowchart TD pkg_llm_replay --> pkg_session pkg_sandbox_local --> pkg_llm pkg_sandbox_local --> pkg_sandbox - pkg_agent --> pkg_brand - pkg_agent --> pkg_llm - pkg_agent --> pkg_scope - pkg_agent --> pkg_session - pkg_agent --> pkg_system_prompt pkg_bash_local --> pkg_bash pkg_bash_local --> pkg_timeout + pkg_compact_basic --> pkg_agent + pkg_compact_basic --> pkg_compact + pkg_compact_basic --> pkg_llm + pkg_compact_basic --> pkg_session pkg_hook_protocol --> pkg_bash pkg_hook_protocol --> pkg_session pkg_session_persistence_jsonl --> pkg_session pkg_session_persistence_jsonl --> pkg_session_persistence pkg_session_persistence_sqlite --> pkg_session pkg_session_persistence_sqlite --> pkg_session_persistence - pkg_bash_sandbox --> pkg_bash - pkg_bash_sandbox --> pkg_bash_local - pkg_bash_sandbox --> pkg_sandbox - pkg_compact_basic --> pkg_agent - pkg_compact_basic --> pkg_compact - pkg_compact_basic --> pkg_llm - pkg_compact_basic --> pkg_session + pkg_invariants --> pkg_agent + pkg_invariants --> pkg_llm + pkg_invariants --> pkg_scope + pkg_invariants --> pkg_session pkg_user_approval --> pkg_agent pkg_user_approval --> pkg_brand pkg_user_approval --> pkg_llm @@ -184,6 +184,9 @@ flowchart TD pkg_tools --> pkg_session pkg_tools --> pkg_system_prompt pkg_tools --> pkg_user_approval + pkg_bash_sandbox --> pkg_bash + pkg_bash_sandbox --> pkg_bash_local + pkg_bash_sandbox --> pkg_sandbox pkg_agent_loop --> pkg_agent pkg_agent_loop --> pkg_llm pkg_agent_loop --> pkg_scope @@ -210,7 +213,6 @@ flowchart TD pkg_subagent --> pkg_agent pkg_subagent --> pkg_llm pkg_subagent --> pkg_scope - pkg_subagent --> pkg_session pkg_subagent --> pkg_tools pkg_tool_web --> pkg_llm pkg_tool_web --> pkg_system_prompt @@ -229,12 +231,6 @@ flowchart TD pkg_hooks_codex --> pkg_llm pkg_hooks_codex --> pkg_session pkg_hooks_codex --> pkg_tools - pkg_invariants --> pkg_agent - pkg_invariants --> pkg_llm - pkg_invariants --> pkg_scope - pkg_invariants --> pkg_session - pkg_invariants --> pkg_system_prompt - pkg_invariants --> pkg_tools pkg_acp --> pkg_agent pkg_acp --> pkg_bash pkg_acp --> pkg_llm @@ -333,10 +329,11 @@ flowchart TD | [`llm-deepseek`](../packages/llm/llm-deepseek) | `llm` | [`llm`](../packages/llm/llm) | | [`llm-pi-ai`](../packages/llm/llm-pi-ai) | `llm` | [`llm`](../packages/llm/llm) | | [`session`](../packages/core/session) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope) | +| [`system-prompt`](../packages/core/system-prompt) | `core` | [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope) | | [`fs`](../packages/fs/fs) | `fs` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm) | | [`web`](../packages/web/web) | `web` | [`llm`](../packages/llm/llm) | | [`sandbox`](../packages/sandbox/sandbox) | `sandbox` | [`llm`](../packages/llm/llm) | -| [`system-prompt`](../packages/core/system-prompt) | `core` | [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session) | +| [`agent`](../packages/core/agent) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | | [`bash`](../packages/bash/bash) | `bash` | [`brand`](../packages/util/brand), [`sandbox`](../packages/sandbox/sandbox), [`session`](../packages/core/session) | | [`fs-local`](../packages/fs/fs-local) | `fs` | [`fs`](../packages/fs/fs) | | [`fs-policy`](../packages/fs/fs-policy) | `fs` | [`fs`](../packages/fs/fs) | @@ -349,28 +346,27 @@ flowchart TD | [`session-persistence`](../packages/session-persistence/session-persistence) | `session-persistence` | [`session`](../packages/core/session) | | [`llm-replay`](../packages/support/llm-replay) | `support` | [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | | [`sandbox-local`](../packages/sandbox/sandbox-local) | `sandbox` | [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox) | -| [`agent`](../packages/core/agent) | `core` | [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | | [`bash-local`](../packages/bash/bash-local) | `bash` | [`bash`](../packages/bash/bash), [`timeout`](../packages/util/timeout) | +| [`compact-basic`](../packages/compact/compact-basic) | `compact` | [`agent`](../packages/core/agent), [`compact`](../packages/compact/compact), [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | | [`hook-protocol`](../packages/hooks/hook-protocol) | `hooks` | [`bash`](../packages/bash/bash), [`session`](../packages/core/session) | | [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) | | [`session-persistence-sqlite`](../packages/session-persistence/session-persistence-sqlite) | `session-persistence` | [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence) | -| [`bash-sandbox`](../packages/bash/bash-sandbox) | `bash` | [`bash`](../packages/bash/bash), [`bash-local`](../packages/bash/bash-local), [`sandbox`](../packages/sandbox/sandbox) | -| [`compact-basic`](../packages/compact/compact-basic) | `compact` | [`agent`](../packages/core/agent), [`compact`](../packages/compact/compact), [`llm`](../packages/llm/llm), [`session`](../packages/core/session) | +| [`invariants`](../packages/support/invariants) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session) | | [`user-approval`](../packages/ui/user-approval) | `ui` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt) | | [`user-interaction`](../packages/ui/user-interaction) | `ui` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm) | | [`workflow`](../packages/workflow/workflow) | `workflow` | [`agent`](../packages/core/agent), [`brand`](../packages/util/brand), [`llm`](../packages/llm/llm) | | [`tools`](../packages/core/tools) | `core` | [`agent`](../packages/core/agent), [`code-runtime`](../packages/code-runtime/code-runtime), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`user-approval`](../packages/ui/user-approval) | +| [`bash-sandbox`](../packages/bash/bash-sandbox) | `bash` | [`bash`](../packages/bash/bash), [`bash-local`](../packages/bash/bash-local), [`sandbox`](../packages/sandbox/sandbox) | | [`agent-loop`](../packages/core/agent-loop) | `core` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-bash`](../packages/bash/tool-bash) | `bash` | [`agent`](../packages/core/agent), [`bash`](../packages/bash/bash), [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`user-approval`](../packages/ui/user-approval) | | [`tool-fs`](../packages/fs/tool-fs) | `fs` | [`fs`](../packages/fs/fs), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`tool-skill`](../packages/skill/tool-skill) | `skill` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`skill`](../packages/skill/skill), [`tools`](../packages/core/tools) | -| [`subagent`](../packages/subagent/subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | +| [`subagent`](../packages/subagent/subagent) | `subagent` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`tools`](../packages/core/tools) | | [`tool-web`](../packages/web/tool-web) | `web` | [`llm`](../packages/llm/llm), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools), [`web`](../packages/web/web) | | [`timeout-policy`](../packages/timeout/timeout-policy) | `timeout` | [`llm`](../packages/llm/llm), [`timeout`](../packages/util/timeout), [`tools`](../packages/core/tools) | | [`tool-todo`](../packages/todo/tool-todo) | `todo` | [`agent`](../packages/core/agent), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | | [`tool-cordis`](../packages/cordis/tool-cordis) | `cordis` | [`scope`](../packages/core/scope), [`tools`](../packages/core/tools) | | [`hooks-codex`](../packages/hooks/hooks-codex) | `hooks` | [`agent`](../packages/core/agent), [`hook-protocol`](../packages/hooks/hook-protocol), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`tools`](../packages/core/tools) | -| [`invariants`](../packages/support/invariants) | `support` | [`agent`](../packages/core/agent), [`llm`](../packages/llm/llm), [`scope`](../packages/core/scope), [`session`](../packages/core/session), [`system-prompt`](../packages/core/system-prompt), [`tools`](../packages/core/tools) | | [`acp`](../packages/ui/acp) | `ui` | [`agent`](../packages/core/agent), [`bash`](../packages/bash/bash), [`llm`](../packages/llm/llm), [`sandbox`](../packages/sandbox/sandbox), [`session`](../packages/core/session), [`session-persistence`](../packages/session-persistence/session-persistence), [`tools`](../packages/core/tools), [`user-approval`](../packages/ui/user-approval), [`user-interaction`](../packages/ui/user-interaction) | | [`tool-ask-user`](../packages/ui/tool-ask-user) | `ui` | [`agent`](../packages/core/agent), [`tools`](../packages/core/tools), [`user-interaction`](../packages/ui/user-interaction) | | [`repeat-tool-guard`](../packages/guard/repeat-tool-guard) | `guard` | [`agent`](../packages/core/agent), [`tools`](../packages/core/tools) | diff --git a/docs/persistence-catalog.md b/docs/persistence-catalog.md index cb0e8ce0dc..245d25fa5f 100644 --- a/docs/persistence-catalog.md +++ b/docs/persistence-catalog.md @@ -23,7 +23,7 @@ An approval question was put to the answerer chain — log-only audit (like `hoo Types: [CallId](core-data-structures/core.md) -Source: [`packages/ui/user-approval/src/index.ts:86`](../packages/ui/user-approval/src/index.ts) +Source: [`packages/ui/user-approval/src/index.ts:84`](../packages/ui/user-approval/src/index.ts) #### `approval/decided` — log-only @@ -33,7 +33,7 @@ The outcome of a prior `approval/asked` (same `id`) — log-only audit. Exactly 'approval/decided': { id: ApprovalRequestId; outcome: ApprovalOutcome } ``` -Source: [`packages/ui/user-approval/src/index.ts:97`](../packages/ui/user-approval/src/index.ts) +Source: [`packages/ui/user-approval/src/index.ts:95`](../packages/ui/user-approval/src/index.ts) #### `approval/policy` — log-only @@ -43,7 +43,7 @@ The session's approval policy was switched — log-only, durable, replayable, ne 'approval/policy': { policy: ApprovalPolicy } ``` -Source: [`packages/ui/user-approval/src/index.ts:109`](../packages/ui/user-approval/src/index.ts) +Source: [`packages/ui/user-approval/src/index.ts:107`](../packages/ui/user-approval/src/index.ts) ### `assistant/*` @@ -57,7 +57,7 @@ Raw stream chunk — token-level replay fidelity. Types: [StreamChunk](core-data-structures/llm-streaming.md) -Source: [`packages/core/session/src/types.ts:317`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:322`](../packages/core/session/src/types.ts) #### `assistant/message` — surface @@ -69,7 +69,7 @@ Assembled assistant message for one step (derived history uses this). Carries th Types: [ContentBlock](core-data-structures/core.md) · [TokenUsage](core-data-structures/llm-streaming.md) -Source: [`packages/core/session/src/types.ts:324`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:329`](../packages/core/session/src/types.ts) ### `bash/*` @@ -129,7 +129,7 @@ In-session context injection (file-change notices, subdir AGENTS.md, skill conte Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:315`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:320`](../packages/core/session/src/types.ts) ### `hook/*` @@ -165,7 +165,7 @@ A queued prompt an `agent/prompt-submit` listener VETOED — the durable record Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:309`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:314`](../packages/core/session/src/types.ts) ### `request/*` @@ -177,7 +177,7 @@ Full snapshot of the EpochHeader the NEXT request is built under, with the Reque 'request/header': { header: EpochHeader; reason: RequestHeaderReason } ``` -Source: [`packages/core/session/src/types.ts:369`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:374`](../packages/core/session/src/types.ts) #### `request/header-delta` — log-only @@ -187,7 +187,7 @@ Amendment to the folded EpochHeader: at least one of a SystemDelta, a ToolsDelta 'request/header-delta': { system?: SystemDelta; tools?: ToolsDelta; config?: LlmCallConfig; messagePrefix?: Message[] } ``` -Source: [`packages/core/session/src/types.ts:386`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:391`](../packages/core/session/src/types.ts) ### `steering/*` @@ -201,7 +201,7 @@ Steering content injected between steps of a running turn. Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:342`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:347`](../packages/core/session/src/types.ts) ### `step/*` @@ -213,7 +213,7 @@ Closes step `step` of turn `turn`. 'step/end': { turn: number; step: number } ``` -Source: [`packages/core/session/src/types.ts:296`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:301`](../packages/core/session/src/types.ts) #### `step/start` — log-only @@ -223,7 +223,7 @@ Opens step `step` of turn `turn` — one model call plus the tool executions it 'step/start': { turn: number; step: number } ``` -Source: [`packages/core/session/src/types.ts:294`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:299`](../packages/core/session/src/types.ts) ### `todo/*` @@ -239,7 +239,7 @@ NOT a SurfaceEventType: it produces no LLM message and never reaches `deriveMess Types: [TodoItem](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:356`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:361`](../packages/core/session/src/types.ts) ### `tool/*` @@ -253,7 +253,7 @@ The model requested one tool invocation: `name` with the raw `arguments` JSON st Types: [CallId](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:330`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:335`](../packages/core/session/src/types.ts) #### `tool/code-dispatch` — log-only @@ -277,7 +277,7 @@ A completed tool call's model-facing result, plus an optional tool-private `meta Types: [CallId](core-data-structures/core.md) · [ContentBlock](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:340`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:345`](../packages/core/session/src/types.ts) ### `turn/*` @@ -291,7 +291,7 @@ Closes turn `turn` with the TurnEndReason that ended it. The loop fires the awai Types: [TurnEndReason](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:292`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:297`](../packages/core/session/src/types.ts) #### `turn/start` — log-only @@ -303,7 +303,7 @@ Opens turn `turn`. `trigger` records what started it — a drained message batch Types: [TurnTrigger](core-data-structures/session.md) -Source: [`packages/core/session/src/types.ts:286`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:291`](../packages/core/session/src/types.ts) ### `user/*` @@ -317,4 +317,4 @@ A user-visible prompt (queued message drained at turn start). Types: [ContentBlock](core-data-structures/core.md) · [MessageSource](core-data-structures/core.md) -Source: [`packages/core/session/src/types.ts:298`](../packages/core/session/src/types.ts) +Source: [`packages/core/session/src/types.ts:303`](../packages/core/session/src/types.ts) diff --git a/docs/rfc/INDEX.md b/docs/rfc/INDEX.md index 5e508344fa..1483401835 100644 --- a/docs/rfc/INDEX.md +++ b/docs/rfc/INDEX.md @@ -70,6 +70,7 @@ Generated by `pnpm run gen-rfc-index` from the RFC tree — never edit by hand; | [The session prefix — request-only messages in front of the derived history](implemented/feature/2026-07-07-session-prefix.md) | 2026-07-07 | | [Repeat-tool-call guard plugin](implemented/feature/2026-07-08-repeat-tool-guard.md) | 2026-07-08 | | [The self-referential cordis toolset](implemented/feature/2026-07-08-self-referential-cordis-toolset.md) | 2026-07-08 | +| [Configure subagent persona, tool visibility, and depth](implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) | 2026-07-12 | ### Simplification diff --git a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md index 024eb05f82..76c40805f8 100644 --- a/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md +++ b/docs/rfc/implemented/architecture/2026-07-08-agent-scope-contexts.md @@ -4,30 +4,28 @@ Status: implemented ## Problem -One application needs to share infrastructure across many agents while giving each agent a coherent local world. Model adapters, persistence, user interfaces, and most tool implementations belong to the deployment; personas, visible tools, live policy, event listeners, and cleanup often belong to one agent. +One application needs to share infrastructure across many agents while letting each agent have its own tools, prompt contributions, policies, and listeners. Shared adapters, persistence, and user interfaces belong to the deployment; a persona, tool variant, or listener often belongs to one agent. -A separate service graph per agent duplicates shared infrastructure. One global registration graph has the opposite failure: an agent-specific tool, prompt section, restriction, or listener can leak into unrelated agents. Contributors need one way to compose local behavior without learning a different registration API for every service. +A separate service graph per agent duplicates shared infrastructure. One global registration graph has the opposite failure: an agent-specific contribution can leak into unrelated agents. Contributors need one ordinary registration mechanism that determines both who can see a contribution and when it is cleaned up. -The mechanism also needs a clear lifetime. An agent must not become visible before its local registrations exist, and final loop work must not lose those registrations before it settles. Parent-owned subagents make both failures easy to trigger because several differently configured agents can exist concurrently inside one application. +The mechanism also needs a publication boundary. An agent must not become visible before its local world is complete, and teardown must retain that world until final work has stopped. ## Decision -Every live agent owns one flat registration layer through `agent.ctx`. Code registers through the context that owns the contribution; scope-aware services resolve deployment-global registrations plus exactly one matching agent layer; scoped events route by the operation's real agent; and the layer is published and revoked with the agent lifecycle. +Every live agent owns one flat registration layer exposed as `agent.ctx`. Code registers through the context that owns a contribution; scope-aware services combine deployment-global registrations with exactly one matching agent layer; operations choose that layer from their real agent; and the layer exists for the agent's complete published lifetime. -A Cordis **context** is the object through which code accesses services and registers owned effects. The [Cordis primer](../../../cordis-primer.md) explains the framework beyond that concept. +Cordis is the plugin framework underneath the SDK. A Cordis **context** is the object plugins use to access services and register effects whose cleanup follows that context. The [Cordis primer](../../../cordis-primer.md) explains the framework in more detail. -The contract has four parts: +For most contributors, the complete contract is four rules: -| Contributor question | Contract | +| Question | Rule | |---|---| -| Where do I register agent-local behavior? | Use the ordinary service API through `agent.ctx` | -| What does an agent see? | Deployment globals plus its own layer, with service-specific merge rules | -| Which scoped listeners run? | By default, unscoped listeners plus listeners for the operation's agent; an explicit global-listener exception is described below | -| How long does local behavior exist? | Assembled during unpublished setup, observable only after creation succeeds, and retained through quiescent teardown | +| Where do I register behavior for one agent? | Call the ordinary registration API through `agent.ctx` | +| What does an operation for an agent see? | Deployment globals plus that agent's layer, using the owning service's merge rules | +| Which scoped listeners run? | Unscoped listeners plus listeners registered for the operation's agent | +| How long does the layer exist? | Setup completes before publication; disposal keeps it until work reaches quiescence | -The scope is deliberately flat. Resolution never walks parent or sibling scopes. Parent ownership links lifetimes without importing registrations. - -For scope-aware registries and default listener routing, the whole mechanism can be read from left to right: the registering context chooses a layer, while the agent named by an operation chooses which one local layer joins the deployment-global layer. +The scope is flat. Resolution never walks parent or sibling scopes, and lifetime ownership does not imply registration inheritance. ```mermaid flowchart LR @@ -35,41 +33,32 @@ flowchart LR agentAContext["agentA.ctx
cleanup follows Agent A"] -->|"registers into"| agentALayer["Agent A layer"] agentBContext["agentB.ctx
cleanup follows Agent B"] -->|"registers into"| agentBLayer["Agent B layer"] - operationA["Operation for Agent A"] -->|"selects"| agentAView["Agent A view
eligible globals plus A local only"] + operationA["Operation for Agent A"] -->|"selects"| agentAView["Agent A view
globals plus A local"] globalLayer --> agentAView agentALayer --> agentAView - operationB["Operation for Agent B"] -->|"selects"| agentBView["Agent B view
eligible globals plus B local only"] + operationB["Operation for Agent B"] -->|"selects"| agentBView["Agent B view
globals plus B local"] globalLayer --> agentBView agentBLayer --> agentBView ``` -The missing cross-edges describe registry resolution and default listener routing: Agent A's registered values and ordinary scoped listeners do not enter Agent B's view, and a parent's layer does not enter a child's view merely because the parent owns the child's lifetime. For scope-filtered events, `{ global: true }` is the explicit opt-in exception; it can observe across scopes while cleanup still follows the registering agent. Registry-membership notifications are a separate unfiltered event class described below. +The missing cross-edges are the isolation rule: Agent A's local registrations do not enter Agent B's view, and a parent's registrations do not enter a child merely because the parent owns the child's lifetime. -The companion [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains how the implementation preserves this contract under Cordis dispatch, JavaScript mutation and reentrancy, asynchronous setup, rollback, and racing disposal. +The companion [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains the implementation and correctness reasoning. The [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) owns the separate `persona`, `toolFilter`, and `maxDepth` feature. -### Registration origin selects visibility and cleanup +### Registration origin chooses visibility and cleanup -A contribution made through a plain plugin context is deployment-global and is disposed with that plugin. The same method called through `agent.ctx` contributes only to that agent and is disposed with the agent scope. +A registration made through a plain plugin context is deployment-global and is disposed with that plugin. The same method called through `agent.ctx` contributes to one agent and is disposed with that agent's scope. -| Registration origin | Registration layer and default audience | Disposed with | +| Registration origin | Default visibility | Disposed with | |---|---|---| -| Plain plugin context | Deployment-global; eligible for every agent view, subject to service merge and restriction rules | Registering plugin | -| `agent.ctx` | Agent-local; visible to that agent by default | Agent scope | +| Plain plugin context | Every eligible agent view | Registering plugin | +| `agent.ctx` | Exactly that agent's view | Agent scope | -This applies to tools, prompt sections and variables, restrictions, protections, guards, and scoped event listeners. Named scoped values ordinarily shadow same-named global values; an owning service may reserve a protected name and reject the shadow instead. Duplicate names within one layer fail. Event listeners have the explicit `{ global: true }` audience exception described below. +Tools, prompt sections and variables, tool restrictions, guards, and scoped event listeners adopt this contract. Named local values ordinarily shadow a same-named global value for that agent; each owning service documents exceptions and merge behavior. -The public pattern is ordinary registration inside `setup`: +The ordinary contributor pattern is to register the complete local world during agent setup: ```js -const reviewSummaryTool = { - name: 'review_summary', - description: 'Return the review summary.', - parameters: { type: 'object', properties: {} }, - async execute() { - return [{ type: 'text', text: 'review complete' }] - }, -} - const handle = await ctx.agents.create({ agentId: AgentId('reviewer'), sessionId: SessionId('reviewer-session'), @@ -80,130 +69,108 @@ const handle = await ctx.agents.create({ order: 0, text: 'Review code, but do not modify files.', }) - agentCtx.tools.restrict({ allow: ['read'] }) - agentCtx.tools.register(reviewSummaryTool) + agentCtx.tools.register({ + name: 'review_summary', + description: 'Return the review summary.', + parameters: { type: 'object', properties: {} }, + async execute() { + return [{ type: 'text', text: 'review complete' }] + }, + }) }, }) -const reviewer = handle.agent -ctx.tools.get('read', reviewer) // global and allowed -ctx.tools.get('bash', reviewer) // undefined: filtered global -ctx.tools.get('review_summary') // undefined: not global -ctx.tools.get('review_summary', reviewer) // reviewer-local +ctx.tools.get('review_summary') // undefined: not global +ctx.tools.get('review_summary', handle.agent) // the reviewer-local tool await handle.dispose() -ctx.tools.get('review_summary', reviewer) // undefined: scope is gone +ctx.tools.get('review_summary', handle.agent) // undefined: scope is gone ``` -### The operation selects the view +Setup receives a full trusted Cordis context so it can compose ordinary plugins and services. Its contract is composition-only: driving or publishing the in-flight agent through casts or internal registry calls is unsupported. -Registration origin and operation subject are separate facts. Calling a read method through `agent.ctx` does not implicitly select that agent; lookup, execution, prompt assembly, and event dispatch still receive the agent or scope they act for. +### The operation chooses the view -For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope requests the global view. `ctx.tools.get(name, agent)` and `ctx.tools.execute({ ..., agent })` select that agent's tool view explicitly. This lets one shared service act for any agent without binding the service instance itself to one scope. +Registration origin and operation subject are separate facts. Calling a service through `agent.ctx` selects where a new registration belongs; it does not bind later reads to that agent. -`agent.ctx.agent` is the associated agent for setup code, but it is not a general scope-selection shortcut. Contributors creating nested generic scopes use the nearest scope tag as the registration key; inheriting an `agent` property does not import the outer registration layer. +Tool lookup and execution receive the agent they act for. Prompt assembly receives an assembly context for the agent whose request is being built. Event dispatch receives its domain subject. This keeps shared service instances reusable across agents while making each operation's view explicit. -### Scoped events follow the operation's real subject +Only services that adopt the scope contract resolve an agent layer. `agent.ctx` does not automatically change arbitrary Cordis service calls. -By default, an event about agent A reaches unscoped listeners and A-scoped listeners, not B-scoped listeners; agent-less dispatch reaches only unscoped listeners. Product helpers and service-owned paths couple the routing key to the value the operation already owns—such as `ToolExecution.agent`, `ApprovalRequest.agent`, the prompt assembly scope, or the session's captured owner. Advanced code that constructs a low-level carrier or assembly context directly must keep its subject and scope fields aligned; development invariants detect mismatches, but the low-level types do not make every mismatch unrepresentable. +### Scoped events keep routing separate from event data -Cordis listeners have one explicit exception. `{ global: true }` bypasses contextual filtering, so a listener registered through `agent.ctx` can observe other agents and subjectless dispatches while its cleanup still belongs to that agent scope. Use it only for deliberate cross-scope observation. +An event about Agent A normally reaches unscoped listeners and A-scoped listeners, not B-scoped listeners. An event without an agent subject reaches only unscoped listeners. -Registry-membership notifications remain unfiltered because they describe shared registry state rather than an operation for one agent. The generated [event catalog](../../../cordis-catalog/events.md) is the exhaustive reference for event signatures and modes. +At the Cordis level, `Scoped` is an opaque routing receiver. It carries the filter used to choose listeners but is not the domain object. Event signatures therefore keep the real `Agent`, tool execution, approval request, or other subject as an explicit argument that listeners can inspect. -### Creation publishes after setup; disposal revokes after work stops +A listener registered with `{ global: true }` deliberately bypasses contextual audience filtering while its cleanup still follows the registering context. Registry-membership notifications remain unfiltered because they describe shared registry state rather than one agent's operation. The generated [event catalog](../../../cordis-catalog/events.md) is the exhaustive event reference. -`ctx.agents.create()` and `resume()` construct an unpublished agent. Their optional `setup(agentCtx)` callback may await child-plugin activation and register the complete local world. During setup, neither the agent nor its session is visible in the public registries, and driving methods reject. +### Creation publishes last and disposal revokes last -The returned promise resolves only after setup, ordered lifecycle notification, and loop start succeed. Setup failure or owner loss rolls the unpublished world back and releases its IDs. A caller therefore never receives a handle to a partially configured agent. +`ctx.agents.create()` and `resume()` build an unpublished session, scope, agent, and driver. They await `setup`, admit the final session and agent entries, announce them in order, start the loop, and only then return a handle. -`AgentHandle.dispose()` performs the reverse boundary. It stops and drains the loop, preserves the session and scoped listeners through final events and flushes, detaches the agent and session, unwinds the scope, and releases IDs. Repeated or racing calls join the same completion promise. +An optional creation signal cancels work only while create or resume is pending. After the promise resolves, the returned `AgentHandle` owns explicit disposal. -The calling Cordis context and AgentLoop are structural co-owners. Unloading either disposes the agent, so creation through a short-lived plugin context intentionally gives the agent that shorter lifetime. +If loading, setup, admission, or publication fails, the private transaction rolls back everything it prepared. Concurrent operations using the same caller-supplied live ID may both reach setup, but final registry entry admits only one; every loser rejects and cleans its private resources. Sequential reuse after awaited disposal remains valid. -The lifecycle keeps the local layer private until setup succeeds and keeps it alive until final work has drained: +`AgentHandle.dispose()` reverses the boundary. It deactivates creation or driving, waits for synchronous publication to unwind, stops and drains the driver and final session flushes, detaches the agent and session, and finally disposes the scope. Repeated or racing disposal requests join one completion promise. + +The calling Cordis context and the concrete AgentLoop factory are structural co-owners. Unloading either disposes the transaction or live agent. ```mermaid flowchart TB - request["Create or resume"] --> reserve["Reserve agent and session IDs"] - reserve --> privateWorld["Load or build private session, scope, and driver"] - privateWorld --> setup["Await setup through agent.ctx"] - setup --> publish["Publish session and agent, then start the loop"] - publish --> live["Return the live handle"] + request["Create or resume"] --> privateWorld["Build private session, scope, agent, and driver"] + privateWorld --> setup["Await composition through agent.ctx"] + setup --> admission["Admit final session and agent entries"] + admission --> publish["Announce lifecycle and start the driver"] + publish --> live["Return AgentHandle"] - privateWorld -->|"load or preparation failure, or owner loss"| rollback["Rollback startup
no handle escapes"] - setup -->|"setup failure or owner loss"| rollback - publish -->|"publication failure or owner loss"| rollback - live -->|"handle disposal, owner unload, or AgentLoop unload"| settle["Quiesce prepared or running work"] - rollback --> settle - settle --> detach["Detach any published agent, then session"] - detach --> revoke["Dispose any created agent scope"] - revoke --> release["Release acquired IDs"] + privateWorld -->|"failure, cancellation, or owner loss"| rollback["Rollback private work"] + setup -->|"failure, cancellation, or owner loss"| rollback + admission -->|"duplicate or owner loss"| rollback + publish -->|"listener failure or owner loss"| rollback + live -->|"handle or owner disposal"| quiesce["Stop and drain work"] + rollback --> quiesce + quiesce --> detach["Detach agent, then session"] + detach --> revoke["Dispose the agent scope"] ``` -Contributors should put agent-local activation inside `setup` and always dispose the returned handle. Code that needs to observe a live agent waits for `create()`/`resume()` to resolve rather than polling the registries during setup. +### Subagent controls are an independent feature -## Tool restrictions resolve against a live flat view +In-process subagents consume agent scope by installing their local composition during unpublished setup. Their optional persona, live global-tool filter, and absolute depth cap are not intrinsic scope semantics; the [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) defines those controls, provider capability checks, and dynamic tool behavior. -A tool restriction filters the live deployment-global end-capability layer, after which scope-local tools are added. `allow` retains named globals, `deny` removes named globals, multiple restrictions intersect, and a hidden global tool is absent from both registry presentation and executable lookup. +`inheritsParentContext` describes conversation-history seeding only. It says nothing about Cordis scope, injected services, tools, or authority. -Filter presence is explicit: omitting a filter installs no restriction, `restrict({})` rejects, and `allow: []` deliberately hides every global end capability. +## Security and authority are non-goals -Because globals are live, allow- and deny-lists intentionally differ when a new global tool appears: +Agent scopes compose trusted same-process registrations. They do not sandbox plugins, define a parent-to-child authority lattice, freeze grants at creation, or guarantee that a child can do no more than its parent. -```text -at time 0: - global tools = { read, bash } - deny { bash } view = { read } - allow { read } view = { read } +A parent may own a child whose visible tools are wider than its own because lifetime ownership does not donate or cap registrations. A plugin holding a Cordis context also runs in the same process and can call available services directly. -after registering global tool web: - deny { bash } view = { read, web } - allow { read } view = { read } -``` - -Scope-local tools are merged after the filter. A local tool can therefore exist even when it is absent from an allow-list over globals. This is composition behavior, not an authorization promise. - -Reserved Code Mode presentation is not part of the filterable end-capability layer. The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns the `run_code`, SDK, `toolOrder`, and presentation-versus-execution contracts; contributors changing Code Mode behavior follow that decision rather than inferring new authority semantics from agent scope. - -## Security and authority are explicit non-goals - -Agent scopes compose trusted in-process registrations. They do not sandbox plugins, define a parent-to-child authority lattice, freeze a creation-time grant set, or guarantee that a child can do no more than its parent. A plugin holding a Cordis context runs in the same process and can call the services injected into that context. - -A parent can own a child whose visible tool set is wider than its own. For example, a parent restricted to global `read` can spawn a child with no restriction; the child then sees later global tools plus its own local registrations. The parent owns the child's lifetime but does not donate or cap the child's registration layer. - -Deployments that need non-escalation require a separate authority representation, propagation rule, and execution check. Authority-versus-visibility ledgers, parent-subset grants, explicit future-grant APIs, and generic capability/output/termination tags are outside this decision. - -## Subagents use the same composition rule - -In-process subagents are a consumer of agent scope, not a second scoping model. A child gets a fresh flat layer during unpublished setup; its persona, tool filter, structured-output protocol, and listeners are ordinary registrations through the child's context. Parent teardown, backend teardown, and manual run disposal own the child lifetime without importing the parent's registrations. - -`inheritsParentContext` describes conversation-history seeding only, not Cordis scope, service injection, tools, or authority. The [subagent capability RFC](../feature/2026-06-21-subagent-capability-seam.md) owns run usage and the provider contract, while the [runtime-design RFC](2026-07-12-agent-scope-runtime-design.md) explains in-process structured output and workflow race handling. +Deployments that need non-escalation require a separate authority representation, propagation rule, and execution check. Parent-subset grants, creation-time authorization snapshots, explicit future-grant APIs, and generic capability/output/termination tags are outside this decision. ## Alternatives considered -The rejected architectures either separate visibility from cleanup, scope only behavior but not registered data, duplicate shared infrastructure, or conflate parent ownership with registration inheritance. +The rejected designs either separate visibility from cleanup, cover only one registration family, duplicate shared infrastructure, or conflate lifetime ownership with inheritance. ### Pass an agent option to every registration -An API such as `tools.register(definition, { agent })` leaves global registration as the leak-by-omission default and repeats scope plumbing in every registry. It can also express “visible to A, disposed with unrelated plugin B,” which registration through `agent.ctx` prevents. +An API such as `tools.register(definition, { agent })` repeats scope plumbing in every registry and permits visibility ownership to drift from cleanup ownership. Registering through `agent.ctx` makes both facts follow one Cordis effect owner. ### Filter events while keeping registries global -Listener filtering prevents a hook from intercepting the wrong agent but does not scope tool schemas, executable lookup, prompt sections, variables, or Code Mode bindings. Agent-local composition would still require temporary global mutation. +Listener filtering prevents the wrong hook from running but does not scope tool schemas, executable lookup, prompt sections, variables, or other registered data. Agent-local composition would still require temporary global mutation. -### Create one isolated service graph per agent +### Create one service graph per agent -Service isolation chooses one registry instance, while the desired view is deployment globals plus one agent layer. Per-agent graphs duplicate adapters and force shared persistence and UI infrastructure to discover every instance. Independent applications still deserve separate graphs; collaborating agents inside one deployment do not. +The required view is shared deployment services plus one local registration layer. Per-agent graphs duplicate adapters and complicate shared persistence, provider registries, and application boot. -### Inherit the parent's registrations into a child +### Inherit parent registration scopes -Hierarchical inheritance silently imports every parent-scoped tool and policy. Flat layers plus parent-owned disposal separate lifetime from composition: the parent owns the child without deciding the child's local world. This choice deliberately makes authorization a separate design. +Parentage describes lifetime and conversation lineage, not a universal merge policy. Hierarchical lookup makes unrelated services inherit accidentally and cannot define security without a separate authority model. ## Consequences -Contributors use the same registration methods at both deployment and agent scope; changing the calling context changes visibility and cleanup together. Model-visible tool lookup, execution, prompt assembly, policy, observation, and teardown agree on one agent key instead of maintaining parallel per-feature scope options. +Contributors use one familiar pattern: register shared behavior through a plugin context, register local behavior through `agent.ctx`, select the real agent on operations, and dispose the returned handle. Setup is atomic from an observer's perspective, and teardown preserves local behavior until work stops. -The cost is explicit subject selection on reads and dispatch, asynchronous programmatic creation, disciplined handle disposal, and awareness that flat registration scope is not authority. Registries retain service-specific merge behavior, and only services that adopt the scope contract become agent-scoped automatically. - -The decision applies to tools, prompt state, scoped events, session lifecycle and scoped session events, approvals, and in-process subagent composition. Filesystem policy, LLM interception, background backend state, and other registries retain their own subject or policy mechanisms until their designs explicitly adopt agent scope. +The cost is explicit subject selection, asynchronous programmatic creation, and service-specific scope adoption. Flat registration scope is intentionally not authority, and subagent composition controls remain a separate feature rather than hidden scope semantics. diff --git a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md index 35d1b50c16..786dce250e 100644 --- a/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md +++ b/docs/rfc/implemented/architecture/2026-07-12-agent-scope-runtime-design.md @@ -4,999 +4,390 @@ Status: implemented ## Problem -The [agent-scope contract](2026-07-08-agent-scope-contexts.md) defines the contributor-visible result: registrations made through `agent.ctx` form one flat local layer, operations resolve that layer by their real agent, setup remains unpublished, and teardown preserves the layer until work stops. The implementation must make those claims true inside a cooperative plugin framework and mutable JavaScript runtime. +The [agent-scope contract](2026-07-08-agent-scope-contexts.md) is simple for contributors: register through `agent.ctx`, resolve one global-plus-agent view, publish only after setup, and retain the scope until work stops. The runtime must preserve that contract across a cooperative plugin framework, asynchronous creation, reentrant listeners, durable session commits, and worker or process failure. -Four failure classes interact in the paths this change hardens: +The main design risk is adding a second mechanism for every race. Separate reservations, readiness sentinels, cancellation relays, snapshot layers, and protection registries can mirror the same fact until no reader can tell which one is authoritative. That machinery also encourages the runtime to treat trusted typed calls as hostile serialization boundaries. -| Proof obligation | Failure if implemented locally or incompletely | -|---|---| -| Registration and dispatch select the same key | Prompt data resolves for one agent while behavior listeners run for another | -| Construction and teardown have continuous ownership | Reentrant unload publishes a partial world, leaks IDs, or revokes policy before final work | -| Covered validation and later use observe one accepted value | Stateful accessors or caller mutation make checked, executed, logged, and observed data disagree | -| Protocol invariants survive extensible middleware | Listener ordering removes required prompt state, re-allows denied work, commits a failed result, or forces another model step | - -Cordis already supplies derived contexts, effect ownership, receiver-based filtering, and waterfalls, but none alone establishes all four obligations. Context association is not a scope key, raw disposers are not await-idempotent, waterfall listeners can short-circuit or wrap each other, and JavaScript `readonly` types do not constrain runtime accessors. Async persistence, setup, publication callbacks, subagent providers, and worker messages add reentrancy and race boundaries around those primitives. +The implementation needs enough state to preserve real ownership and settlement boundaries, but no more. A correctness reviewer must be able to follow one fact from acceptance through publication and teardown without reconciling parallel representations. ## Decision -The runtime implements agent scope as four coupled mechanisms rather than one generic framework feature: +The runtime uses one mechanism per independent fact. Scope routing has an opaque carrier; each live registry object has one entry record; each create or resume operation has one transaction; typed same-process calls borrow readonly values; real data boundaries materialize once; and worker/process code retains separate terminal and quiescence state only where different owners can genuinely race. -| Mechanism | Implementation decision | +The design can be skimmed as seven choices: + +| Problem | Authoritative mechanism | |---|---| -| Layer and routing | A scope key tags registration effects; scope-aware contribution registries merge globals plus one layer; dispatch carriers filter listeners by the operation subject | -| Transactional lifetime | Scope, session, registry entry, driver, reservations, caller ownership, and AgentLoop ownership publish and unwind as one ordered transaction | -| Boundary ownership | The hardened acceptance-sensitive paths listed below capture caller fields once and retain stable identities or owner-controlled representations | -| Owner-final policy | Four narrow service-owned boundaries restore named prompt state, deny monotonically, observe final results, and stop terminal turns | +| Select global plus one agent's registrations | Opaque scope key and routing carrier | +| Own one live agent or session | One registry entry captured by its disposer | +| Coordinate create/resume | One `AgentCreationTransaction` | +| Protect durable, queued, model, or wire data | Materialize once at that boundary | +| Pass typed values inside one process | Readonly borrowed contract | +| Preserve an owner's final prompt/tool policy | Contribution-owned finality and one final observer point | +| Coordinate subagent, worker, and process shutdown | One cancellation signal plus the independent terminal/quiescence facts of that boundary | -The same mechanisms carry into in-process subagents and the workflow bridge. Subagents are the composition proof because child setup, structured output, readiness, cancellation, result settlement, and disposal exercise all four obligations concurrently. +The rest of this RFC expands those choices in dependency order. It first explains the Cordis mechanics, then scope routing, creation and session commit, tools and prompts, subagents and workflows, and finally the checks that make the reasoning executable. -This RFC owns the implementation rationale, algorithms, race handling, and correctness enforcement. The [agent-scope contract](2026-07-08-agent-scope-contexts.md) owns contributor-facing behavior, tool-filter semantics, usage examples, and the security non-goal; this document links to that contract rather than redefining authority or public scope inheritance. +The [July 8 RFC](2026-07-08-agent-scope-contexts.md) remains the contributor contract. The separate [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md) owns `persona`, `toolFilter`, and `maxDepth`; this document discusses only how their setup fits the lifecycle. -## Implementation model: domain terms and Cordis mechanics +## Cordis model: context, fiber, effect, receiver, and waterfall -Readers need four domain terms and four Cordis mechanics to follow the implementation. Readers already familiar with this codebase and Cordis can skim this section. +Five Cordis ideas are required to understand the implementation. A context selects services and registration ownership; a fiber is one live plugin or child lifecycle; an effect attaches cleanup to a fiber; an event receiver selects listeners; and a waterfall lets listeners transform or veto an operation in sequence. -### Recurring domain terms +### A context is an ownership path through one service graph -Four domain terms keep the rest of the RFC compact. A **Session** is an agent run's append-only event log, from which model history and durable replay are derived. **Lossless JSON** is the JSON subset that can be copied without changing meaning: primitives, dense arrays, and plain objects; cycles, sparse arrays, exotic prototypes, non-finite numbers, negative zero, `undefined`, `bigint`, functions, and symbols are rejected. An **end capability** is an actual callable tool implementation, whether the model sees it as a native schema or a Code Mode binding. **Code Mode** gives the model a generated SDK and a reserved `run_code` transport. Pure `code` presentation replaces native advertisement with that interface; `both` presentation retains native schemas alongside it. +All agents share one Cordis service graph. A derived context does not clone `ToolRegistry`, `SystemPrompt`, persistence, or model adapters; it changes how registrations made through that context are tagged and which effects own their cleanup. -### Four Cordis mechanics +`agent.ctx` is such a derived context. Service calls still reach the shared instances, while a registration can inspect its calling context and store a contribution under the nearest scope key. Ordinary plugin contexts carry no scope key and therefore register globally. -Contexts select service access and registration origin, fibers own effects, waterfalls provide cooperative transformation, and dispatch receivers select listeners. +### Fibers and effects make cleanup structural -| Cordis concept | Meaning in this RFC | -|---|---| -| Context | The object through which a plugin reaches services and registers contributions; a derived context can carry a different registration scope | -| Fiber and effect | The runtime owner and one owned piece of setup/cleanup; disposing the fiber unwinds its effects | -| Waterfall | Ordered around-middleware whose listener calls `next()` to include downstream work and may transform or short-circuit the result | -| Dispatch receiver | The `this` object used by Cordis listener filtering; a scope carrier encodes the operation's agent key | +A Cordis fiber is the live instance created when a plugin or child context is activated. Its state records whether that lifecycle is active, unloading, failed, or disposed. `ctx.effect()` and `ctx.on()` return disposers and also attach those disposers to the registering fiber, so unloading a plugin or agent scope removes everything registered through that context without a separate inventory. -#### Context selects both service access and registration origin +The vendored Cordis fiber implementation establishes ownership before arbitrary setup or `internal/plugin` observers run. A reentrant unload can see the child fiber or effect that has started, reject effects added after unload begins, and join cleanup already started through a public single-shot disposer. Teardown observers are contained individually so one callback cannot prevent structural cleanup. -A Cordis `Context` is the object through which code calls services such as `ctx.tools`, `ctx.systemPrompt`, and `ctx.sessions`. A service can recover the context through which it was accessed, so the same method can register globally from a plain plugin context or locally from `agent.ctx` without adding an `agent` option to every registration API. Cordis implements contextual service access with a **traced receiver**: a proxy that carries the accessing context while forwarding calls to the concrete service object. +These are framework lifecycle guarantees rather than agent-specific policy. Agent creation depends on them because setup can activate arbitrary plugins and synchronously reenter owner disposal. -```js -ctx.tools.register(globalTool) -agent.ctx.tools.register(agentOnlyTool) +### Receivers route listeners; waterfalls compose decisions -ctx.on('tools/result', globalObserver) -agent.ctx.on('tools/result', agentObserver) -``` +Cordis filters listeners using the dispatch receiver (`this`), while harness listeners need an explicit agent, execution, request, or other subject. `Scoped` marks the receiver expected by a scoped event declaration, but the runtime carrier deliberately exposes no subject API. -A context also exposes the dependency view injected into the plugin that minted it. `agent.ctx` therefore carries the agent loop's deliberate service surface; it is not an ambient root context or a security boundary. +Product helpers therefore construct the carrier and pass the domain subject separately. This prevents listener routing from becoming an alternate object model and keeps event signatures understandable without knowledge of carrier internals. -#### Effects make cleanup follow ownership +A Cordis waterfall is middleware-style dispatch. Each listener receives `next()`: calling it delegates to the remaining listeners and base operation, while returning without it vetoes or replaces the downstream result. Waterfalls power prompt assembly and tool policy; ordinary emit events notify synchronously, and parallel events await all listeners without a veto result. -An effect is setup whose cleanup belongs to a fiber. Tool registration, prompt contribution, event subscription, and an agent scope are effects, so normal disposal, failure, and hot module reload all follow the same ownership graph. +## Scope routing: one opaque key selects one layer -```js -ctx.effect(() => { - const resource = openResource() - return async () => { - await resource.close() - } -}) -``` +The scope package implements the smallest object needed for Cordis routing. Its carrier holds only a composed service filter and scope predicate, while the package records the opaque key privately and exposes the scope fiber's quiescent disposer separately. -Cordis also supports generator effects that nest child effects in a chosen teardown order. The lifecycle section explains why construction must become owner-visible before arbitrary callbacks run. +### Scope identity uses object identity -#### Waterfalls remain cooperative extension points +A `ScopeKey` is an opaque object compared by identity. The harness uses the live `Agent` as its own key, but the primitive is domain-neutral and supports other scoped owners. -A waterfall listener wraps downstream work. Calling `next()` includes the remaining listeners and base implementation; returning directly skips that downstream portion. +`createScope(parent, key)` returns a scope whose `ctx` shares the parent's services and whose effects are tagged with that key. `scopeOf(ctx)` reads the nearest registration key. `scopeTarget(base, key)` creates the event receiver whose filter preserves the base receiver's Cordis service filter, then admits unscoped listeners and listeners with that exact key. -```js -ctx.on('system-prompt/assemble', async (_assembly, _context, next) => { - const downstream = await next() - return { - ...downstream, - sections: [...downstream.sections, extraSection], - } -}) +The receiver is a small carrier rather than a transparent proxy for the domain object. Code that needs the agent receives the explicit event argument; code that needs registration ownership receives `agent.ctx`. -ctx.on('system-prompt/assemble', async () => replacementAssembly) -// The direct return skips this listener's downstream/base. An outer listener -// that already awaited next() still resumes around replacementAssembly. -``` +### Registry reads overlay one exact map -This flexibility is intentional for ordinary policy, but it cannot express a fact that must remain true after every wrapper and short-circuit. [Owner-final policy](#owner-final-policy-four-narrow-boundaries) adds only the four final checkpoints that need stronger semantics. +Scope-aware registries store global contributions separately from identity-keyed local contributions. A read resolves the global layer and at most one local layer; it never traverses parentage. -#### Dispatch receivers select scoped listeners +Each service retains its domain rule. Named prompt values and tools use local shadowing, tool restrictions filter globals before local tools are added, and events select listener audiences rather than registered data. Scope supplies identity and ownership, not a universal merge algorithm. -Cordis filters listeners using the dispatch receiver, the object visible as `this` inside a function-style listener. `dsh-scope` builds a receiver carrying the operation's scope key, allowing global listeners plus listeners registered for that exact key while rejecting other agents' listeners. +### Fused dispatch helpers prevent subject drift -The receiver is live coordination state, not durable session data. For example, `tools/result` is a live final-outcome notification, while `tool/result` is an append-only session event used for replay and model history. +`agentEvents(context, agent)` constructs the agent's carrier and injects the same agent as the event subject. Session, tool, approval, prompt, and subagent services likewise derive routing from the object they already own instead of accepting an unrelated key. -## Registration and delivery: global plus exactly one agent layer +The type marker rejects ordinary bare-receiver mistakes, and development invariants cover direct JavaScript or casted dispatch. The subject remains explicit because routing correctness and useful event data are different concerns. -Within services that adopt the agent-scope contract, one scope key controls both registered data and registered behavior. Contribution reads combine the deployment-global layer with exactly one agent layer, while scoped event dispatch admits global listeners plus the listeners for that same agent. +## Agent creation: one transaction owns the complete operation -Scope keys are opaque objects compared by identity; a live `Agent` is its own registration key. There is no name-based equality or parent traversal. +Create and resume are one asynchronous lifecycle with several phases, not several lifecycles. `AgentCreationTransaction` owns caller and factory liveness, optional cancellation, private resources, publication, rollback, and the memoized teardown observed by every owner. -### Scope mechanism: context, key, and lifetime +### Registry entries are the only live identity records -The registration context selects the layer, the scope primitive binds that layer to cleanup, and the nearest scope tag—not an inherited convenience property—selects the key. +AgentRegistry and SessionStore each keep one entry per live object. The entry holds the stable ID, object, scoped carrier, and the small amount of publication or append state that belongs to that object. -#### The calling context selects visibility and cleanup +A detach closure captures its exact entry. It deletes only when the map still points to that entry, so an old disposer cannot delete a later object that reuses the same ID. No registry rereads a mutable caller object to decide identity. -A scope-aware registry method recovers the Cordis context through which its service receiver was accessed and calls `scopeOf(context)` once while installing the registration effect. An absent key selects the global store; a key selects the per-scope store. Cleanup closes over that accepted store and key, so later context mutation or a same-named replacement cannot redirect disposal. Event listeners follow a different Cordis path: `ctx.on()` retains the registering context, and targeted dispatch reads its scope while filtering listeners; `{ global: true }` deliberately bypasses that audience filter without changing cleanup ownership. +There is no reservation API. Caller-supplied IDs are admitted at final entry. Concurrent same-ID operations may both complete private setup; exactly one final `enter()` succeeds, and every loser rolls its private resources back. Sequential reuse is valid after the earlier disposer reaches quiescence. -The [public contract](2026-07-08-agent-scope-contexts.md#registration-origin-selects-visibility-and-cleanup) owns the visibility table, shadowing rule, and `{ global: true }` listener exception. Internally, registry resolution overlays one exact identity-keyed map on the global map and never traverses an ancestry relation: +### The transaction owns preparation before awaiting it -```text -resolveLayer(agentA): - visible = copy(global registrations) - visible.overlay(registrations from agentA.ctx) - return visible -``` +The transaction is installed under both the calling Cordis context and the concrete AgentLoop factory before persistence load or setup can suspend. It also observes an optional create/resume signal until the public operation settles. -The one-overlay algorithm is why the generic primitive needs only opaque identity and effect ownership; parent/child meaning stays outside `dsh-scope`. +Create prepares a new Session. Resume loads and validates the persisted Session before preparing the same live session identity. Both paths then build the scope, agent, and driver and invoke the same setup/publication algorithm. -#### The scope primitive keeps layer and owner together +The factory stores concrete trace targets but invokes them through a caller-bound Cordis trace. This preserves dependency origin and caller ownership without stacking trace proxies. -`dsh-scope` exposes only the operations needed to mint a tagged ownership layer, read its key, target dispatch, and reach quiescent cleanup. For ordinary scope-aware registries, using a separate `{ scope }` option could express “stored in A's layer, disposed with B”; registration through the scoped context makes that mismatch unrepresentable. The `{ global: true }` listener option is an intentional audience exception, and the low-level `scopeTarget(base, key)` primitive still relies on its service-owned caller to supply matching facts. +### Setup is trusted composition inside a private world -| Operation | Responsibility | -|---|---| -| `createScope(context, key)` | Mount an ownership fiber and return its tagged context | -| `scopeOf(context)` | Read the nearest inherited scope key | -| `scopeTarget(base, key)` | Build a scope-filtered dispatch receiver around the existing base receiver | -| `Scope.dispose()` | Return one shared idempotent promise that reaches cleanup quiescence | -| `Scope.rawDispose` | Expose the exact Cordis disposer for ordered generator composition | +Setup receives the full child context and may await plugin activation. It can register tools, prompt sections, restrictions, listeners, and other effects, but the public contract does not support driving or publishing the in-flight agent through casts or internal registry calls. -`Scope.dispose()` and `rawDispose` serve different callers. Cordis raw disposers are single-shot, so a repeated raw call need not wait for an earlier asynchronous teardown; the public method follows the backing fiber's in-flight cleanup and gives racing callers the same completion promise. Generator lifecycles use `rawDispose` because Cordis recognizes nested ownership by exact disposer identity. +The transaction races asynchronous load and setup against deactivation rather than waiting forever for a promise owned by external code. If cancellation or owner unload wins, public creation rejects after transaction-owned cleanup even when the external promise never settles. -The primitive has one essential shape: +### Publication has one ordered commit path -```text -createScope(parentContext, key): - fiber = mount no-op plugin under parentContext - scopedContext = derive fiber.context with nearest-scope-tag = key +Publication admits and announces resources in the order required by observers: - rawDispose = fiber's exact disposer - dispose = memoized operation that: - invoke rawDispose if teardown has not started - follow fiber's in-flight cleanup until quiescent +1. Enter the session. +2. Enter the agent. +3. Announce `session/created`. +4. Announce `agent/created`. +5. Enable public driving. +6. Emit `agent/session-start`. +7. Start the driver. - return { ctx: scopedContext, rawDispose, dispose } -``` +The agent never drives before both registries and creation notifications agree. A synchronous listener may veto or dispose an owner; the transaction records publication in progress and waits for that callback stack to unwind before teardown continues. Every creation announcement that begins has a matching disposal announcement during rollback. -Derived contexts inherit the nearest tag. Mounting a plugin under `agent.ctx` preserves the agent scope; deliberately creating another scope replaces the tag below it. - -#### `ctx.agent` is an association; `scopeOf()` selects the layer - -`agent.ctx.agent` gives setup code convenient access to the associated agent, but the nearest scope tag remains authoritative for resolution. A nested scope can inherit the ergonomic `agent` property while replacing the registration key. - -```js -const auditKey = {} -const auditScope = createScope(agent.ctx, auditKey) - -auditScope.ctx.agent === agent // true: inherited association -scopeOf(auditScope.ctx) === auditKey // true: nearest registration key - -await auditScope.dispose() -``` - -This separation keeps the generic scope package independent of the agent package. - -### Resolution contracts preserve domain semantics - -The shared scope selects two layers, but each registry retains its own merge rules and must keep presentation, lookup, and execution coherent within the view it owns. - -#### Registries retain domain-specific merge rules - -The shared primitive answers “which layer?” and “who owns cleanup?”; each service still defines how its values combine. Prompt sections, variables, and tools use scoped-over-global shadowing by name. Tool-schema providers are additive. Tool lookup and execution receive an agent or scope explicitly, while prompt assembly receives an `AssembleContext` whose `scope` selects the layer. - -Calling a read method through `agent.ctx` does not silently choose an agent subject. For example, `agent.ctx.systemPrompt.assemble()` without an assembly scope still requests the global view. Registration origin and operation subject remain explicit, allowing one shared service to act for any agent. - -#### The tool view is live and executable - -`ToolRegistry` owns one resolver rather than separate presentation and execution stores. It snapshots restriction definitions at registration, applies them to the current global map, overlays the matching scoped map, and derives lookup, dispatch, schemas, SDK bindings, timeouts, inspection, and UI presentation from that resolved map. A filtered global implementation therefore cannot remain executable through a second path. - -The [public RFC](2026-07-08-agent-scope-contexts.md#tool-restrictions-resolve-against-a-live-flat-view) owns the exact allow/deny/future-global/local-overlay behavior. The internal distinction needed here is that `ToolRegistry.knownNames()` validates restrictions against the pre-restriction end-capability universe, while the system-prompt provider validates `toolOrder` against the presentation mode's wire universe. - -Final prompt assembly can include schemas from other `systemPrompt.tools()` providers or assembly listeners. The coherent-view proof therefore covers `ToolRegistry`'s own schemas, bindings, lookup, execution, and presentation; another provider owns coherence for the unrelated schemas it contributes. - -Reserved `run_code` presentation sits outside both registration maps. The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns its mode, SDK, and `toolOrder` semantics; this design relies only on the fact that the transport is resolved separately from filterable end capabilities. - -### Dispatch contract follows the operation subject - -Service-owned dispatch paths derive or couple the scope key with the operation subject, and a carrier composes that key with the chosen base receiver's existing dispatch behavior. For agent events the agent is both base and operation subject; tool, approval, and prompt dispatch instead wrap their owning service while selecting listeners with the operation's agent key. The low-level primitives can still represent mismatched facts, so helper use and development invariants—rather than the type system alone—protect direct internal callers. - -#### The operation subject selects the listener set - -The [public dispatch rule](2026-07-08-agent-scope-contexts.md#scoped-events-follow-the-operations-real-subject) and generated [event catalog](../../../cordis-catalog/events.md) own listener visibility and the exhaustive event-family mapping. The implementation problem is to prevent each service from choosing its carrier, subject argument, and scope key independently. - -Fused helpers keep values that must agree together. `agentEvents(context, agent)` uses one agent as the subject, scope key, and first event argument. `assembleContextFor(agent)` sets both prompt facts and the scope selector. The session store captures its carrier when a session enters because later appends and flushes may occur without the original agent context. - -#### The carrier preserves base-receiver behavior - -Function-style listeners receive the carrier as `this`. Agent listeners may call methods on the agent base; service listeners rely on the owning service's contextual receiver behavior. The carrier is therefore a proxy that selects listeners while reading, writing, and invoking through the real base receiver. - -The implementation uses a dedicated surrogate proxy target with an immutable composed-filter slot. It combines the base receiver's existing `Context.filter` with the scope predicate instead of replacing it. Methods bind to the real base; callable carriers preserve call and construct shape; descriptor queries normalize configurable flags as required by Proxy invariants; and definitions through the carrier require an explicitly configurable descriptor. Stable built-in references protect the composed filter from accidental `.call` replacement. - -Those mechanics preserve observable JavaScript behavior, including private-field method identity: - -```js -class Base { - #count = 0 - increment() { this.#count += 1 } -} - -const base = new Base() -const key = {} -new Proxy(base, {}).increment() // TypeError: proxy lacks Base's private identity - -const carrier = scopeTarget(base, key) -carrier.increment() // works: method is bound to base -carrier === base // false: carrier has distinct identity -``` - -Together these constraints keep listener selection correct while preserving the base-receiver behavior listeners expect. - -The TypeScript-only `Scoped` marker requires a carrier at typed dispatch sites. Runtime marks and development invariants cover JavaScript, casts, and direct Cordis dispatch; they detect routing mistakes but do not confine hostile same-process code. - -## Lifecycle: compose privately, publish once, tear down in reverse - -Scope, session, registry entry, and driver form one transaction with two owners. Request fields are captured first; AgentLoop tracking and both identity reservations precede asynchronous work; the caller owns the prepared lifecycle before setup; publication proceeds in synchronous observable phases; and every teardown path reaches one reverse-order quiescence boundary. - -Two services split the public API from the implementation. `AgentRegistry`, reached as `ctx.agents`, stores live agents and is the front door for `create()` and `resume()`. Its registered `AgentFactory` is concretely implemented by `AgentLoop`, which constructs and drives agents using its own injected dependencies. The rest of this section calls that concrete co-owner the **AgentLoop factory**. - -| Phase | Public state | Ownership fact | -|---|---|---| -| Reserve | IDs unavailable to competitors | AgentLoop tracking and exact reservations cover the next await | -| Prepare or load | Persistence data is loading, or session, scope, and driver exist privately | Resume's load sentinel covers persistence; the complete caller lifecycle covers setup | -| Setup | `setup(agent.ctx)` may await and register | Neither ID is published | -| Publish and start | Session, agent, and lifecycle notifications appear in order | Liveness is checked between observable phases | -| Dispose | Driver drains, registries detach, scope unwinds, IDs release | All owner paths join one completion promise | - -The [public lifecycle contract](2026-07-08-agent-scope-contexts.md#creation-publishes-after-setup-disposal-revokes-after-work-stops) defines what callers observe. The following sections justify each ownership and ordering fact behind that contract. - -### Reservations precede awaiting; lifecycle ownership precedes setup - -AgentLoop tracking and exact identity reservations precede the first await. Resume adds a caller sentinel across persistence loading; create and resume both establish the complete caller-owned lifecycle before invoking setup. - -#### The prepared lifecycle is owned before setup callbacks - -The caller context owns the work it requested and receives the consumer-facing `AgentHandle`. The AgentLoop factory is a structural co-owner because a live agent continues to depend on its injected services. Either owner can deactivate the transaction; both converge on the same lifecycle disposer. - -| Owner mechanism | Covers | Retires when | -|---|---|---| -| Caller lifecycle sentinel | Caller-fiber loss from lifecycle preparation through live lifecycle | Shared lifecycle reaches quiescence | -| Resume load sentinel | Caller-fiber loss across persistence load and lifecycle handoff | Load rollback or the adopted lifecycle reaches quiescence | -| AgentLoop tracker | AgentLoop unload and structural dependency loss | Transaction and lifecycle settle | -| ID reservations | Competing agent/session insertion | Ordered teardown releases both IDs | - -A **sentinel** is an owner-visible effect that follows work whose final disposer is not yet available. It adopts the exact reservation disposers immediately, then follows the complete lifecycle disposer once preparation establishes it. - -Cordis must make construction owner-visible before setup can reenter teardown. An effect's cleanup wrapper enters its owner list before its setup body runs, a child fiber receives its parent-owned disposer before Cordis's child-plugin notification (`internal/plugin`) announces it, and a fiber already unloading rejects new effects after taking its cleanup snapshot. Teardown observers are contained independently so one callback cannot starve peers or interrupt cleanup. These are domain-neutral lifecycle rules; `dsh-scope` uses them by mounting a no-op plugin fiber as the ownership bucket for one scope. - -#### Caller ownership and factory dependency lookup stay separate - -Factory delegation carries two contexts because ownership and dependency origin are different facts. `ownerCtx` is the caller-bound context whose fiber and optional scope own the requested lifecycle. The factory method receiver is the accepted factory traced through that access so the concrete service retains its own injected dependency view. - -```text -callerCtx.agents.create(options) - ownerCtx = context carrying callerCtx's fiber and scope - factoryThis = concrete accepted factory traced through ownerCtx - Reflect.apply(capturedCreateAgent, factoryThis, [ownerCtx, options]) -``` - -`setFactory()` captures the concrete target and its `createAgent` and `resume` callbacks once. It canonicalizes an already traced service before retracing, avoiding a second proxy layer that would break raw-identity state. Plain factory objects receive the explicit `ownerCtx` without depending on Cordis tracing. - -#### Create and resume reserve identities before awaiting - -Programmatic create and resume reserve both agent and session IDs before any operation can await. Create prepares a new or seeded session; resume loads persisted data while a caller sentinel and AgentLoop load tracker already own the interval in which no `Agent` object exists. - -Reservations are capabilities, not advisory sets. Setup code cannot reserve, prepare, create, register, or enter a substitute under the same IDs. A session reservation prepares at most one exact object, and publication requires the matching factory-held capabilities. A failed or abandoned transaction therefore cannot publish a substitute or wedge an ID indefinitely. - -Resume transfers ownership rather than opening a gap: - -```text -resume(ownerCtx, request): - snapshot request identity, options, and setup callback - reserve agentId and sessionId - install caller sentinel adopting both reservation disposers - track load under AgentLoop - - persisted = await firstOf(persistence.load(sessionId), deactivated) - session = sessionReservation.prepare(reconstruct persisted data) - starting = startOwned(ownerCtx, session, reservations, setup) - caller sentinel follows starting.dispose - return await starting.result -``` - -If deactivation wins, a backend load may still settle internally but has no path back to publication. Preparation failure still returns a rollback-backed lifecycle result, so both owners can wait for actual cleanup instead of mistaking a rejected async result for successful installation. - -### Setup composes an unpublished world - -`setup(agentCtx)` may register tools, prompt state, restrictions, listeners, protections, or child plugins and may await their activation. The new agent is available as `agentCtx.agent`, but neither agent nor session is visible in its global registry. - -The complete rollback skeleton exists before setup runs. If setup throws, rejects, or loses either owner, the scope and prepared resources unwind and the IDs become reusable. After setup settles, a microtask checkpoint and liveness checks let a same-turn owner unload win before publication. - -Setup composes but cannot drive. `send`, `steer`, `inject`, and `cancel` reject until publication reaches the session-start boundary. The driver lock and inbox use runtime-private state, and only factory-held controls enable and start the loop; JavaScript casts cannot call a public start method or write directly into the queue. - -```text -startOwned(ownerCtx, snapshot, preparedSession): - world = prepareLifecycleWithCompleteRollback(ownerCtx, snapshot, preparedSession) - - result = async: - require world active - await firstOf(runOptionalSetup(snapshot.setup, world.agent.ctx), world.deactivated) - await oneMicrotask() - require caller, factory, owner fiber, and owner agent still active - world.publish(snapshot.source) - return handle(world.agent, world.dispose) - - on any error: - await world.dispose() - rethrow -``` - -### Publication is ordered, observable, and rollback-covered - -Publication is one synchronous sequence with liveness checks between three observable notification phases. Both registry entries exist before the first listener runs, but driving stays locked until immediately before `agent/session-start`. - -1. Enter the session store and capture its scope carrier. -2. Enter the agent registry without announcing it. -3. Recheck caller and factory liveness. -4. Emit `session/created`. -5. Recheck liveness. -6. Emit `agent/created`. -7. Recheck liveness. -8. Enable driving. -9. Emit `agent/session-start`. -10. Recheck liveness. -11. Start the driver. - -```text -publish(world): - world.beginSynchronousPublication() - try: - world.detachSession = sessions.enter(world.session, sessionReservation) - world.detachAgent = agents.enter(world.agent, agentReservation) - require callerAndFactoryActive - sessions.announce(world.session) - require callerAndFactoryActive - agents.announce(world.agent) - require callerAndFactoryActive - world.driver.enableDrivingVerbs() - emitNonVetoing(agent/session-start) - require callerAndFactoryActive - world.driver.start() - finally: - world.endSynchronousPublication() -``` - -#### Creation is paired, not atomic - -Observers run between publication steps, so the sequence is not described as atomic. Effects already performed by an earlier listener cannot be retracted if a later listener throws. Instead, each registry marks a creation announcement as begun before dispatch and emits exactly one matching disposal edge during rollback. An entered object that was never announced has no disposal notification because no observer was told it existed. - -A detach requested during `session/created` or `agent/created` is deferred until that dispatch unwinds. Stable captured carriers and exact-object guards prevent a later listener from observing `disposed` before `created` or a stale detach from deleting a replacement with the same ID. The outer publication barrier likewise prevents caller or AgentLoop teardown from removing the other registry entry or unwinding `agent.ctx` while an announcement remains on the stack. - -Creation listener synchronous throws remain vetoes. Returned promise rejections are observed and logged but not awaited: publication has no asynchronous gap in which such a result could roll back safely. Disposal notifications and `agent/session-start` are non-vetoing and independently contain both synchronous throws and returned-promise rejections so one listener cannot block cleanup or later observers. - -### Teardown stops work before revoking registrations - -Every owner path reaches one memoized reverse-order transaction. It marks the lifecycle inactive, waits for an in-progress synchronous publication phase, stops the driver through actual exit and final durability work, detaches the agent and session, unwinds the scope, and releases IDs last. - -Final turn events, the turn-ending flush, and any outstanding session flush started while the agent was idle therefore run while the session and scoped listeners still exist. `agent/disposed` observes an already quiescent and unregistered concrete agent while its session remains live; `session/disposed` follows after event feed detachment and store removal. Both use the stable carrier captured for their matching creation edge. - -```text -disposeOwnedAgent(world): - mark world inactive - await world.synchronousPublicationIfRunning() - await world.stopDriver() # loop exit plus agent-started flushes - world.detachAgent() - world.detachSession() - await world.scope.dispose() - world.releaseSessionReservation() - world.releaseAgentReservation() -``` - -`AgentHandle.dispose()` gives repeated and racing consumers the same completion promise. The lifecycle-long caller sentinel follows that promise even when handle disposal wins first, while the AgentLoop ledger independently stops new transactions and waits for every structurally dependent agent before the service disappears. - -AgentLoop co-ownership follows dependency shape, not a blanket “creator owns every returned value” rule. An AgentLoop-created agent continues to depend on the loop's services, so AgentLoop unload stops it. - -## Boundary ownership: hardened paths accept once and own the accepted value - -The acceptance-sensitive paths enumerated below read caller-owned fields once and retain only owner-controlled identities or snapshots before crossing asynchronous, reentrant, model-visible, or durable-log code. This is a boundary-by-boundary implementation property, not a blanket claim about every public API. The protection is independent of TypeScript: `readonly` annotations vanish at runtime, and JavaScript accessors can return a different value on every read. - -The shared shape distinguishes identity-bearing references from data. Agent objects and abort signals are retained by identity after one read. Boundaries whose contract requires lossless JSON—such as session events and subagent payloads—validate and materialize it in one traversal; other boundaries use their own owned representation, such as `structuredClone` for agent options. Scalars and callbacks are captured once, then each boundary applies the validation promised by its API before downstream use. - -```text -accept(input): - read every relevant top-level field exactly once - retain identity-bearing references without rereading them - validate acceptance-time fields from those captures - copy or pin data in the representation owned by this boundary - bind accepted callbacks once when method receiver state is intentional - expose only owner-controlled identities, frozen records, or detached results -``` - -Capture does not imply uniform eager callback type-checking. Agent `setup` is captured once and any invocation failure enters rollback; a tool guard is likewise captured, and an invalid cast becomes a normalized execution error. The invariant is that later work never rereads caller fields to choose a different value. - -| Boundary | Identity retained | Data detached or pinned | -|---|---|---| -| Tool and `SubagentProvider` registration | Original callback receiver | Name, flags, schemas, scalar config | -| Agent create/resume | Caller context, setup callback | IDs, options, session metadata and seed | -| Agent send/steer | None | Content blocks and resolved message source | -| Approval request | Agent and abort signal | Tool name, call ID, and reason | -| Tool execution | Agent, signal, registry-minted parent token | Call identity and arguments | -| Session append/load | Session identity | Header and event envelopes | -| Subagent start/result | Parent and signal | Prompt, filters, schema, options, result | - -Before agent setup can run, the concrete agent pins its accepted ID, options, and session and binds `ctx` once. Registry detach closures likewise close over their accepted keys instead of rereading mutable public fields. - -`send()` and running `steer()` resolve the message source once and materialize `{ content, source }` as one detached, deeply frozen lossless-JSON record before `agent/queued` or inbox insertion. The notification and FIFO share that accepted content and source; its metadata wrapper is frozen separately, so neither retained caller references nor an earlier notification listener can rewrite what a later listener, the session log, or the model sees. Invalid content or source throws synchronously without notification, enqueue, or loop wakeup; idle `steer()` delegates to the same `send()` boundary. The later `agent/prompt-submit` waterfall can still replace a queued prompt by returning new content; ownership forbids in-place mutation, not the explicit rewrite protocol. - -The inbox path makes that accepted-value boundary concrete. Getter evaluation happens during materialization, so liveness is rechecked before the accepted record crosses into an inbox FIFO: +The sequence diagram isolates the non-obvious race: a synchronous creation listener can request disposal while the publication call stack still owns both registry entries. Teardown must deactivate immediately but wait for that stack to unwind before stopping and detaching anything. ```mermaid -flowchart TB - callerInput["Caller-owned content and source"] --> initialCheck["Require a live, drive-enabled agent"] - initialCheck --> accept["Resolve source once; materialize and deep-freeze one record"] - accept -->|"invalid lossless JSON"| invalidReject["Throw synchronously; no inbox insertion, agent/queued, or loop wakeup"] - accept -->|"accepted"| liveness["Recheck disposal after caller getters"] - liveness -->|"disposed reentrantly"| disposedReject["Throw disposed; do not insert or announce the message"] - liveness -->|"still live"| inbox["Insert the record into the queued or steering FIFO"] - inbox -->|"same frozen content and source"| queued["Emit agent/queued with a frozen metadata wrapper"] - inbox -->|"if later drained, read the same owned record"| drain["Loop-owned delivery"] - inbox -->|"cancel before drain"| cancelled["Clear the pending record without delivery"] - inbox -->|"disposal wins before drain"| disposed["Stop delivery; the disposed agent may retain the pending record"] - drain -->|"queued prompt"| prompt["agent/prompt-submit may block or explicitly replace"] - drain -->|"steering consumed by an active turn"| steering["Append steering/message"] +sequenceDiagram + participant Tx as AgentCreationTransaction + participant Registries + participant Listener as Synchronous listener + participant Driver + + Tx->>Tx: mark publication in progress + Tx->>Registries: announce agent/created + Registries->>Listener: invoke inside the same call stack + Listener->>Tx: dispose reentrantly + Tx->>Tx: deactivate, teardown waits for publication + Tx-->>Listener: disposal request accepted + Listener-->>Registries: return + Registries-->>Tx: announcement unwound + Tx->>Tx: resolve publication settlement + Tx->>Driver: stop and drain + Tx->>Registries: detach agent, then session + Tx->>Tx: dispose scope and resolve teardown ``` -A stateful getter shows why validation and ownership must use the same capture: +### Teardown preserves work before revoking registrations -```js -let reads = 0 -const input = { - get name() { - reads += 1 - return reads === 1 ? 'safe_tool' : 'different_tool' - }, -} +Every teardown request joins one memoized path. The order is: -// Wrong: validation and storage observe different values. -validateName(input.name) -storeName(input.name) +1. Deactivate creation or driving and let synchronous publication finish. +2. Stop and drain the driver, including idle injection flushes. +3. Detach the agent. +4. Detach the session. +5. Dispose the agent scope. +6. Retire transaction ownership tracking. -// Right: one accepted value drives both. -reads = 0 -const acceptedName = input.name -validateName(acceptedName) -storeName(acceptedName) -``` +This order lets final agent and session events use the matching scoped listeners and keeps persistence observers attached through the final flush. Scope disposal comes last because registration revocation is the externally visible lifetime boundary. -### Registered definitions are frozen snapshots +## Session append: materialize, validate, commit, notify -Tool registration creates the stored definition identity once; changes occur through explicit unregister/register effects rather than mutation of a caller-retained object. Parameters are materialized in one traversal, callbacks bind once to the accepted definition receiver, and the stored record is deep-frozen. +Session events cross a durable boundary, so append owns their data. The rest of the algorithm uses one attached entry and one commit point. -The first-party `defineTool()` helper applies the same boundary before registration. It captures each option once, materializes the authoring `SchemaSpec`, and derives both the wire schema and later execution/presentation validation from that owned spec. +### Durable data is materialized once -```text -defineTool(options): - accepted = read each option exactly once - parameterSpec = snapshotLosslessJson(accepted.parameters) - wireSchema = snapshotLosslessJson(convertToJsonSchema(parameterSpec)) - build execute and presentation validation over parameterSpec +Session headers, seeds, and appended events are lossless JSON data. The Session constructor or append path materializes and validates them before storage and exposes frozen snapshots, so later caller mutation cannot change persistence, replay, or model reconstruction. -registerTool(context, definition): - accepted = read each definition field exactly once - stored = deepFreeze({ - accepted name, description, timeout, - parameters: snapshotLosslessJson(accepted.parameters), - execute: bind accepted.execute to definition, - presentation callbacks: bind accepted callbacks when present - }) - layerFor(scopeOf(context)).add(stored.name, stored) -``` +This is a real ownership boundary: the values leave the caller, may be persisted, and must reconstruct the same request later. It is intentionally stricter than a typed same-process callback or registry definition. -`get()` and `visible()` return the frozen stored definitions; `schemas()` returns detached projections. Replacing `definition.execute` after registration has no effect, while a callback can deliberately read live state from its closure or original receiver. +### Pre-commit listeners can veto; post-commit observers cannot -Factory and backend registration use different reentrancy orderings around the same ownership rule. `AgentFactory` registration claims its single slot before reading callback accessors. `SubagentProvider` registration first snapshots the provider fields, then its effect checks and enters the accepted name. Both capture callback identity and intentional receiver state once, and hot-reload cleanup closes over the accepted slot or key instead of rereading a mutable public property. +Append follows one sequence: -### Durable session ownership carries the scope key +1. Materialize the durable event and surface intent. +2. Claim the SessionEntry and reject reentrant append on that entry. +3. Resolve scoped callbacks and run internal invariant validation. +4. Push exactly once; this is the commit point. +5. Notify each observer independently, containing synchronous and asynchronous failures. +6. Release append state and honor a detach requested during publication. -The [session-immutability RFC](2026-06-11-dev-invariants-over-deep-readonly.md#session-owns-immutable-history) owns header, event, and snapshot semantics. Agent-scope correctness adds one requirement: the store keeps append publication, accepted registry IDs, and captured scope carriers in private owner state rather than caller-writable fields. Outside JavaScript therefore cannot rename a stored session or redirect later `session/event` delivery by mutating visible state. +No observer error makes a committed event look uncommitted, and one bad listener cannot starve later listeners. Session invariants stage their transition before commit and apply it only when the same event reaches the contained post-commit observer. -An entered session treats append as one synchronous acceptance-and-publication boundary: +`flush()` starts every persistence listener and awaits every result before reporting failure. This deliberate all-settled behavior prevents a synchronous failure from starving another backend or final flush. -1. Capture the current store attachment and its private attachment epoch, keep the attachment live, then materialize and deep-freeze the caller's event data. -2. Reject if caller getters changed either value; the epoch catches even a transient attach-then-detach that restores the original hook lookup. The event must not become live without the store hooks that accepted it. -3. Resolve the exact scoped `session/event` callback list before commit. Cordis runs `internal/dispatch` during this step, so development invariants can still reject a bad candidate while the log is unchanged. Resolution uses a throwaway mutable argument array; replacing its accepted session or event rejects before commit, and product callbacks later receive a fresh fixed tuple. -4. Push the event into the log. This is the commit point. -5. Invoke the captured callbacks with per-listener containment and best-effort non-throwing failure reporting, then release the attachment barrier and honor any detach requested during acceptance or publication. +## Trust boundaries: copy only when ownership actually changes -The boundary rejects a reentrant `append()` until the outer callback list drains. Without that guard, an early observer could append event N+1 before a later persistence observer had received event N, reversing delivery relative to the log. Detach is deferred for the same interval, so no event can commit after `session/disposed` or lose its publication hooks. Once the push occurs, synchronous observer throws and returned-promise rejections are logged and contained rather than escaping as a false append failure or starving later observers. +The runtime distinguishes typed in-process contracts from serialization and durability boundaries. This is the main simplification rule for values and callbacks. -`SessionStore.flush()` uses the same pre-dispatch fixed-tuple check but remains an awaited durability barrier rather than an observe-only publication. It starts every captured listener synchronously, converts a synchronous throw into that listener's rejected result so later listeners still start, waits for every result to settle, and only then rejects with the first failed listener in registration order. One broken backend therefore cannot make the caller return while another backend is still flushing. - -Approval requests follow the same async boundary at smaller scale: one capture preserves exact agent/signal identities, copies scalar fields, captures the session once, and drives `approval/asked`, scoped policy, cancellation, and `approval/decided` from that record. - -### Tool execution has pipeline-owned identity - -The [interception-seams RFC](../feature/2026-06-30-interception-seams.md) owns the public tool-pipeline contract. For agent-scope correctness, `ctx.tools.execute(input)` must turn caller-owned input into one pipeline-owned `ToolExecution` before any scoped policy or dispatch runs. It first reads `callId` and `name` once and requires strings; a failure there rejects because even an error result would lack trustworthy correlation identity. Once those strings are accepted, later input failures can become normal final error outcomes. - -Arguments are materialized once and deep-frozen. The registry assigns a frozen property-free `ToolExecutionToken`; callers cannot choose it. `token`, `callId`, `name`, `arguments`, `agent`, and optional opaque `parent` token become non-writable and non-configurable before policy. `signal` is the only operational field an around-dispatch wrapper may replace or remove. - -```text -prepareExecution(input): - callId = read input.callId exactly once - name = read input.name exactly once - require both are strings - - accepted = read arguments, agent, parent, and signal exactly once - require parent is absent or a registry-minted token - arguments = deepFreeze(snapshotLosslessJson(accepted.arguments)) - - execution = { - token: new frozen property-free object, - callId, name, arguments, - agent: accepted.agent, - parent: accepted.parent, - signal: accepted.signal - } - protect every field except signal - return execution -``` - -Stable execution identity prevents middleware from changing which tool or scope policy accepted. It also gives structured-output commit a safe `WeakMap` key when an adapter reuses a string call ID. Code Mode correlates an SDK sub-call with its enclosing `run_code` using only the outer execution's opaque token, never a mutable reference to the live outer object. - -Result boundaries apply the same ownership rule. Each transform returns data that is captured field-by-field, validated, materialized, and ultimately deep-frozen for final observers; malformed outcomes normalize to JSON-safe error results rather than reaching the session log as apparent success. - -## Owner-final policy: four narrow boundaries - -Waterfalls remain the ordinary extension mechanism; each of four protocol invariants runs after the last extension point capable of violating that specific invariant. Each owner-final API has the weakest one-way power that can preserve its guarantee. - -Here **canonical** means the named registry or tool-schema-provider output assembled before the waterfall—not “all output the service approves.” Protection restores only the names its owner declares. - -| Invariant | Cooperative extension point | Owner-final boundary | Guarantee | -|---|---|---|---| -| Named prompt/tool contribution | `system-prompt/assemble` waterfall | `systemPrompt.protect()` finalization | Canonical presence, absence, definition, and local anchor survive | -| Non-overridable tool denial | `tools/pre-execute` allow/deny/ask waterfall | Synchronous `tools.guard()` | A denial cannot become allow | -| Authoritative live outcome | Execute and post-execute waterfalls | Awaited `tools/result` notification | Observers receive one immutable final result | -| Terminal protocol completion | Continuation waterfall and pending steering | Serial `agent/turn-stop` | No middleware or late steering creates another step | - -### Prompt protection restores named canonical contributions - -`systemPrompt.protect({ sections, tools })` snapshots the requested names and restores their canonical registry or tool-schema-provider output after the complete assembly waterfall. Global and matching scoped protections compose by set union; a waterfall failure still fails assembly rather than triggering recovery. - -Protection covers both presence and absence. If the canonical assembly omits a protected name, finalization removes a listener-fabricated entry; this is how Code Mode keeps a native schema absent while preserving the SDK/transport form. Tool providers likewise expose one captured coherent record for schemas and optional known names, so a stateful getter cannot validate one name and display another. - -#### Global section protection reserves its name - -A globally protected section name cannot be shadowed by a scoped section. Scoped registration under an already protected name fails, and adding protection fails if a scoped shadow already exists. This check occurs before assembly because scoped-over-global merge would otherwise make the shadow itself appear canonical. - -Tool-schema protection does not create a blanket reservation for unrelated schema names. Providers are additive and may deliberately contribute other executable schemas; the owner-final guarantee covers only the named canonical contribution. - -#### Restoration preserves a useful local anchor - -Protection does not reset the whole assembly. It removes protected names from the waterfall result and reinserts each canonical entry before the first surviving later unprotected canonical neighbor, or at the end if none survives. Unprotected entries retain the order and definitions chosen by middleware. - -```text -assemble(context): - assembly = assemble registries for context.scope - canonical = snapshot protected section/tool inputs - transformed = await systemPromptAssembleWaterfall(assembly) - - for each protected canonical name: - remove every transformed entry with that name - if canonical includes the name: - insert before first surviving later canonical neighbor, else append - - return transformed -``` - -Code Mode globally protects `tools:sdk` and reserved `run_code`; structured output adds scoped protection for its instruction and capture schema. - -### Tool guards deny monotonically - -`ctx.tools.guard()` installs a global or scoped synchronous check after the complete `tools/pre-execute` waterfall and before dispatch. A guard returns a denial reason or `undefined`; it has no allow result. - -Pre-execute hooks still compose ordinary allow, deny, and ask decisions. An ask resolves through the optional approval service, where only `allowed-once` becomes allow and absence or any non-grant becomes deny. Guards run afterward, so listener order cannot convert their denial into dispatched work. - -```js -agent.ctx.on( - 'tools/pre-execute', - async () => ({ kind: 'allow' }), - { prepend: true }, -) - -agent.ctx.tools.guard(execution => - execution.name === 'bash' - ? 'reviewer agents are read-only' - : undefined, -) -``` - -Even a later prepended allow listener cannot bypass the guard. A denied call still becomes an error outcome that flows through result transformation and final observation. - -### `tools/result` observes the final live outcome - -For a successfully prepared execution, the live pipeline is `tools/pre-execute` → guards → `tools/execute` → `tools/post-execute` → `tools/result`. Malformed non-identity input instead takes the error-shell path directly to final observation, as the algorithm below shows. The first, execute, and post stages are transformable waterfalls; `tools/result` is an awaited observe-only notification after every transform and outer error normalization. - -Every observer receives the same frozen execution and a separate deep-frozen snapshot of the owned result returned to the caller. Listener failures are contained independently, so they cannot change that returned result or starve peers. Routing uses `execution.agent`. - -`tools/result` is not the durable `tool/result` session event. The live notification also fires for direct programmatic executions and is the source of truth for in-process commit logic. The agent loop later appends the durable event for replay, UI reconstruction, and model history. - -```text -execute(input): - accept trustworthy callId and name - try to prepare pipeline-owned execution - on preparation failure: - create an identity-bearing error shell - ownedResult = owned error result - freeze execution - observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) - await every tools/result observer independently with observerResult - return ownedResult - - gate = await tools/pre-execute(execution) - resolve ask through approval when needed - denial = policy denial or first guard denial - - if denied: - result = errorResult(denial) - else: - result = await tools/execute(execution, dispatchRegisteredTool) - - result = await tools/post-execute(execution, result) - ownedResult = normalize into owned lossless JSON - freeze execution - observerResult = deepFreeze(snapshotLosslessJson(ownedResult)) - await every tools/result observer independently with observerResult - return ownedResult -``` - -Waterfalls transform only at their named stages; guards only deny; final observers only observe. - -### `agent/turn-stop` makes continuation terminal - -Steering is input for another model step inside the current turn; queued prompts wait for a future turn. Ordinary continuation remains extensible: the loop computes a default, runs `agent/turn-continuation`, records any force-continue reason as steering, and treats pending steering as a reason to continue. - -The scoped serial `agent/turn-stop` checkpoint runs after that folding. A listener returns `{ action: 'stop' }` or abstains with `undefined`; malformed values and throws close the current turn with an error. A stop is terminal, so later listeners and steering cannot restore continuation. - -The loop uses `strictSerial` because ordinary Cordis serial dispatch treats `null` and `false` as abstentions. This terminal protocol permits only `undefined` to abstain, making accidental return values fail closed. - -Terminal state remains active through `turn/end` and the durability flush. Steering added by continuation, turn-close, or flush listeners is discarded after a terminal stop, while the ordinary queued-prompt FIFO remains untouched. - -```text -afterSuccessfulStep(turn): - decision = await agent/turn-continuation(defaultDecision) - record decision.reason as steering when present - if steering is pending: decision = continue - - terminal = await strictSerial(agent/turn-stop) - if terminal == stop: - discard steering - terminalStopped = true - decision = stop - - append turn/end - await session/flush - - if terminalStopped: - discard steering added by turn/end or flush listeners - else: - move leftover steering to the next-turn queue -``` - -This stronger control is reserved for terminal protocols such as a completed structured child; ordinary continuation policy remains cooperative. - -## Subagents: the composition proof - -In-process subagents add no second scoping model. They create a fresh flat child scope during unpublished setup, install ordinary scoped persona/filter/protocol registrations, own the child through a run handle, and use the same owner-final checkpoints for structured output. - -The roles and phases are explicit: - -| Role | Responsibility | +| Boundary | Ownership rule | |---|---| -| Caller | Supplies parent, prompt, optional child configuration, and eventual disposal | -| `SubagentService` | Validates capabilities, owns the public wrapper, normalizes result and lifecycle telemetry | -| `SubagentProvider` backend | Chooses transport and creates one run | -| In-process driver | Owns child creation, setup, prompt drive, result read, cancellation, and teardown | -| Child `Agent` | Uses the ordinary agent lifecycle and its fresh `agent.ctx` | +| Typed service/plugin call in the same process | Borrow readonly values and callbacks | +| Parsed plugin configuration or external file | Validate semantic and structural input | +| Queued inbox message | Materialize before asynchronous consumption | +| Model/tool JSON input or output | Materialize at the model/tool boundary | +| Durable session or persistence data | Materialize and validate before commit | +| Worker, process, or wire message | Serialize, validate, and own the decoded value | -```text -recommended caller order: start -> await run.started -> await run.result -> await run.dispose() -internal observation: started and result may settle in either order; lifecycle publication waits for started -ownership: dispose may race any phase and joins one cleanup promise -``` +Tests that fabricate hostile getters, replace typed callbacks after handoff, or cast fake service objects do not define a production contract by themselves. The runtime keeps checks where data crosses a parser, queue, model, durable, file, worker, process, or wire boundary and relies on readonly types plus plugin discipline inside the trusted process. -The [agent-scope contract](2026-07-08-agent-scope-contexts.md#subagents-use-the-same-composition-rule) gives the contributor-facing example, and the [subagent capability RFC](../feature/2026-06-21-subagent-capability-seam.md) owns the public `SubagentRun` contract. This section follows only the in-process ownership and terminal-protocol implementation. +Callback containment is separate from data ownership. Listeners are arbitrary extension code and can throw even when their arguments are trusted; publication and post-commit paths still contain failures according to their event contract. -### The child world uses ordinary registrations +## Tools and prompts: one view, one execution identity, explicit finality -A child persona is a scoped `deployment:persona` section. Its tool filter is a scoped restriction over the live global tool layer. Structured output is a bundle of scoped tool, prompt, protection, guard, and listener registrations. +Tool presentation and execution share one private resolver, while prompt/tool owners declare the few contributions that cooperative middleware may not alter finally. No second registry mirrors ownership. -```js -let structured -const setup = childCtx => { - if (persona !== undefined) { - childCtx.systemPrompt.section({ - name: 'deployment:persona', - order: 0, - text: persona, - }) - } - if (toolFilter !== undefined) childCtx.tools.restrict(toolFilter) - if (schema !== undefined) { - structured = attachStructuredRuntime(childCtx, schema) - } -} -``` +### One resolver defines the tool view -The driver creates one run-owner fiber under `parent.ctx` and calls the child factory through it. Parent teardown, `spawn` backend teardown, and manual run disposal reach the same node, but the child still receives a new registration key. Lifetime inheritance therefore does not imply registration inheritance. +The private resolver applies the current presentation mode, live global restrictions, exact local overlay, and local shadowing. Schemas, lookup, execution, Code Mode SDK generation, restriction validation, and owner-final name derivation all use that resolver or its pre-restriction global-name view. -### Structured output is a child-owned terminal protocol +The [subagent composition-controls RFC](../feature/2026-07-12-subagent-persona-tool-filter-and-depth.md#tool-filtering-is-one-live-global-view-rule) owns the user-visible allow/deny semantics. The implementation requirement is agreement: a filtered-away global cannot remain executable through a different lookup path, and a locally shadowed definition is the same definition presented and executed. -A structured child registers a real-schema `structured_output` tool and instruction in its own scope. Concurrent children can use different schemas without a global placeholder, reference count, or remove-for-everyone pass. +`ToolRestriction` accepts readonly allow/deny names and compiles them into internal sets. Multiple restrictions intersect. Public `visible()` and `knownNames()` methods are unnecessary because only the registry needs the intermediate views. -The [Code Mode RFC](../feature/2026-06-15-code-mode.md) owns advertised wire routes and SDK behavior. The correctness distinction here is execution nesting: a native capture has one tool execution, while an SDK capture is an inner execution whose parent token identifies the enclosing `run_code`. Tool mode is presentation rather than an execution allowlist, so a direct unadvertised capture still follows the native commit path; a deployment that forbids that route uses an execution guard. +### Tool execution owns identity and boundary materialization -Named protection restores this child's canonical capture contribution and instruction without erasing unrelated schemas deliberately added by another assembly provider. +The registry assigns every execution a fresh branded `Symbol` token. Nested Code Mode calls carry the outer token as `parent`, so structured output can correlate an inner capture with its enclosing `run_code` result by identity. -#### Native calls commit once; Code Mode SDK calls commit twice +A fresh registry-assigned Symbol provides collision-free execution identity without a WeakSet membership registry. Callers cannot supply the execution's own token through `ToolExecutionInput`; they only receive the pipeline-owned `ToolExecution` after the registry creates it. This is a trusted typed contract, not a runtime defense against arbitrary casts or JavaScript callers. -The capture body validates and stages a cloned value by stable `ToolExecution` identity. The scoped final-result observer commits a native capture only if that exact execution's final result succeeds. +Arguments are materialized once where model/tool JSON enters the pipeline. Pre-, around-, and post-execute listeners operate on the typed execution and decisions. Call ID correlation, approval, monotonic guards, and Code Mode nesting remain explicit relational checks. -A schema-validation failure becomes the ordinary `INVALID_ARGS` tool result, so the model can correct the value and call the capture tool again within the same turn. +After the last post-execute listener, the registry materializes and freezes the accepted final result once. Every `tools/result` observer receives that exact committed object, and observer failures are awaited and contained individually. An outer pipeline failure is normalized into a committed error result, so observers can discard staged work against the same authoritative boundary. -```text -structured_output.body(value, execution): - validate value against this child's schema - staged[execution] = clone(value) - return ordinary success +### Contribution-owned finality protects only named invariants -on tools/result(execution, finalResult): - if execution is staged: - value = staged.remove(execution) - if finalResult succeeded: - captured = value -``` +Most prompt assembly remains a cooperative waterfall: listeners may reorder, replace, or remove ordinary sections and schemas. A contribution sets `ownerFinal: true` only when its owner must retain final control over that named entry. -For a Code Mode SDK call, successful inner observation records a pending value against the opaque outer `run_code` token. Commit waits for the outer transport's own successful final result because an inner side effect can succeed while the program or its post-policy still fails. +Prompt sections carry owner-finality directly. Tool definitions carry it through the tool provider's `ownerFinalNames`, including canonical absence when a presentation mode intentionally omits a tool. `tools:sdk`, `run_code`, and structured-output instruction/schema contributions use this flag. -```text -on tools/result(innerStructuredCall, innerResult): - if innerStructuredCall is staged: - value = staged.remove(innerStructuredCall) - if innerResult succeeded: - pending = { outerToken: innerStructuredCall.parent, value } +An owner-final name is reserved across the global and scoped layers: a scoped shadow cannot be added beneath a global owner-final contribution, and a global contribution cannot become owner-final while any scoped shadow already exists. This makes the registered owner definition unambiguous before assembly begins. -on tools/result(outerRunCodeCall, outerResult): - if pending.outerToken == outerRunCodeCall.token: - value = pending.value - pending = none - if outerResult succeeded: - captured = value -``` +Assembly takes one private canonical snapshot before the waterfall. After listeners finish, it restores only owner-final names to their canonical presence, absence, definition, and relative anchor among surviving entries. Unrelated listener additions and reordering remain untouched. -Once capture is staged against an outer transport or committed, the scoped guard denies later calls in that response. After commit, `agent/turn-stop` ends the turn after ordinary continuation and steering fold. A child that otherwise completes cleanly without a committed capture returns an error rather than being re-prompted; requesting a schema makes output mandatory, not guaranteed. +Attaching finality to the owning contribution has two benefits. Registration and cleanup cannot drift from a separate protection registry, and the reader can see why a particular prompt/tool entry is special at its definition. -### The run protocol separates acceptance, readiness, result, and disposal +### Structured output commits only authoritative outcomes -`SubagentService.start()` returns synchronously, but `run.started` is the publication boundary. Callers treat the child as live only after readiness, consume `result`, and always dispose the run. +Structured output uses the final prompt/tool boundaries as a two-phase commit. The child-scoped `structured_output` tool and its instruction are owner-final; the tool body validates a candidate and stages it by the current `ToolExecution`, but successful capture is decided only by immutable `tools/result` observations. -Pre-readiness cancellation of an in-process run deactivates the run-owner fiber, prevents publication, rejects `started`, resolves `result` as `aborted`, and emits neither subagent lifecycle edge. +For a native call, the observer deletes the stage and commits its value only when that exact execution's final result succeeds. A post-execute block or outer pipeline failure therefore cannot leave a captured value behind. -`SubagentProvider` registration captures name, capability flags, the `inheritsParentContext` conversation-history descriptor, and the bound start callback once. The descriptor says whether completed parent turns seed the child's conversation; it says nothing about scope, services, tools, or authority. +For a Code Mode SDK call, the inner successful result records `{ parentToken, value }` rather than committing. The observer waits for the `run_code` execution whose token matches `parentToken` and commits only if that outer final result also succeeds. Program failure, runtime abort, or outer post-policy denial discards the pending value. -Starting a run captures every request field once. Parent and abort signal remain identity references; prompt, filter, schema, and options are detached lossless JSON; fixed `persona` and absolute `maxDepth` values validate before backend ownership. The in-process backend separately snapshots its optional session seed, and the service snapshots the terminal result when it settles. +Once a value is pending or committed, a scoped monotonic guard denies later tool calls. After commit, the ordinary serial `agent/turn-stop` listener returns a stop decision after continuation and steering have already folded. A schema-validation failure remains an ordinary `INVALID_ARGS` tool error and leaves the child able to retry within the same turn. -Depth validation repeats at each public entry while one helper owns the accepted domain: +Pure Code Mode omits `structured_output` from native wire schemas and exposes it through the generated SDK. Contribution-owned finality preserves that canonical absence, preventing an assembly listener from fabricating a second native route while keeping the instruction and SDK declaration intact. -```text -tool-subagent plugin load: - assertSubagentMaxDepth(config.maxDepth) +### Four final boundaries have four narrow powers -SubagentService.start(request): - capture and validate request.maxDepth +Owner-final behavior is not a general priority system. Four domain owners need four different one-way powers after cooperative extension points: -startInProcessRun(request): - capture and validate request.maxDepth - parentDepth = validated depthOf(parent) - childDepth = parentDepth + 1 - reject if childDepth is not a safe integer - reject if maxDepth exists and childDepth > maxDepth -``` - -Only `undefined` means parent depth zero. Present depth and cap values must be non-negative safe integers and must not be negative zero; derived overflow rejects even when no request cap exists. - -The service does not expose the backend-owned run handle directly. It captures `id`, `started`, `result`, and methods once; binds methods to that handle; wraps result in one detached frozen record; and installs a shared disposal promise before calling untrusted backend cleanup. Once a callable backend disposer has been captured, a malformed later field triggers rollback; if no callable disposer can be captured, rollback is impossible and acceptance fails immediately. A backend disposer that directly returns the wrapper's reentrant promise is rejected as a cycle instead of hanging. - -```text -startInProcessRun(backendContext, acceptedRequest): - install backend ownership - attach accepted abort signal - create run-owner fiber under accepted parent.ctx - create child through runOwner.ctx.agents with unpublished setup - - started = child creation publication - result = after started: - send accepted prompt - await child idle - derive owned terminal result - dispose = dispose run owner and await quiescence - -SubagentService.start(...): - backendRun = backend.start(detached request) - serviceRun = freeze accepted id, readiness, bound methods, normalized result - observe result immediately - after readiness: - emit subagent/start, then buffered/eventual subagent/end - on readiness failure: - emit neither lifecycle edge -``` - -The service observes result settlement immediately even while readiness is pending, preventing an early rejection from becoming temporarily unhandled. Lifecycle listeners receive one frozen payload; their throws and returned-promise rejections are contained independently and cannot veto the run. - -## Workflow integration preserves the subagent contract - -The [dynamic-workflows RFC](../feature/2026-07-05-dynamic-workflows.md) owns workflow behavior. The agent-scope concern is whether the worker bridge preserves the same readiness, terminal-claim, and bounded-cleanup boundaries across a message port. It never announces an unready child, never lets cleanup rewrite an already chosen result, and never suppresses disposal merely because another terminal fact already won. - -The worker executes the workflow script and exchanges protocol messages; the host owns `SubagentService`, which invokes `SubagentProvider` backends and returns normalized run wrappers that the host retains. Their lifetimes follow dependency shape: an AgentLoop-created agent stops when its loop unloads, while a workflow run captures its holder-bound `SubagentService` at start, so unloading the workflow engine prevents new runs without revoking an already returned run. - -Three state dimensions remain separate: - -| Dimension | Question | Winning rule | +| Boundary | Final power | Why ordinary listener order is insufficient | |---|---|---| -| Admission | May a worker message still start or announce a child? | Closed admission refuses the exact run and cleans it up | -| Terminal claim | Which external result does the workflow expose? | Earlier accepted external cancellation wins; otherwise first result/death claim wins | -| Physical cleanup | Which registered children and worker resources remain? | Every path may still dispose survivors through per-call gates | +| Prompt assembly | Restore named canonical contributions | A later listener can remove or replace an invariant schema or instruction | +| Tool pre-policy | Deny monotonically | A later listener must not re-allow an already denied call | +| Tool result | Observe the immutable committed outcome | Structured output must commit only the result that actually escaped the pipeline | +| Turn continuation | Stop after ordinary continuation folding | A committed terminal output must end the turn | -### Child admission waits for readiness +`ToolGuard` remains the monotonic policy registry. Final tool observation is the contained `tools/result` point described above. Terminal structured output listens on the ordinary serial `agent/turn-stop` fold after normal continuation and steering decisions; no public `strictSerial()` dispatcher is needed for the typed listener contract. -After `SubagentService.start()` returns its normalized wrapper, the host registers that exact wrapper before awaiting, attaches result observers immediately, and rechecks admission both then and when `started` settles. A closed boundary claims cancellation and disposal for that exact entry, removes it only when disposal settles, and reports `ChildStartError` only while the worker reply channel remains open. +### Skill and approval services trust typed callers -The backend's nested `start()` may synchronously reenter workflow cancellation before the service wrapper reaches the host registry. The immediate post-start check and exact-wrapper identity guard close that interval; a backend that later fulfills its own readiness cannot resurrect workflow admission. +Skill registry definitions and approval policies are readonly same-process contracts. Their services do not clone callback objects or defend against post-handoff callback replacement. -```text -after subagents.start returns its run wrapper: - register exact wrapper for cancellation - observe and snapshot result immediately - if admission closed: refuse and clean exact wrapper - else await run.started +Skill still validates external skill files and parsed provider output, routes catalogs through the calling agent's tool view, and disposes registrations exactly. Approval still resolves policy, observes cancellation, routes `approval/request` by `request.agent`, records the durable audit pair, and contains answerer and post-commit observer failures. - on ready: - if admission closed: refuse and clean exact run - else send ChildStarted, then buffered/eventual outcome +## Subagents: readiness is the start promise - on readiness failure: - send ChildStartError only if the worker reply channel remains open - dispose exact wrapper if still registered -``` +Subagent startup has one ownership transfer. The provider owns partial resources until its start promise fulfills with a ready published run; the caller owns the returned run and must dispose it. -### Each terminal contender claims before its own callbacks +### The service contract has one cancellation channel -Each terminal path records the state it owns before invoking its own callback fanout. External `cancel()` records the accepted cancellation reason before invoking child cancellation. On the Result path, the worker queues its `Result` message before settlement cleanup messages on the same port, and the host records the winning result before any Result-triggered abort or cancellation. Reentry therefore observes the fact that already won instead of rewriting it. +`SubagentProvider.start()` and `SubagentService.start()` return `Promise`. The promise fulfills only after the backend has established the child it promises, so callers and `subagent/start` observers never need a second `run.started` readiness promise. -```text -on workflow Result: - cancellationWasAlreadyAccepted = external cancellation is in flight - claim chosen result: - if earlier external cancellation and result is not cancelled: - cancelled result - else: - worker result +`SubagentStartRequest.signal` is required. Aborting it requests cancellation during startup and after readiness. `SubagentRun.dispose()` also requests cancellation and awaits quiescence. There is no separate public `run.cancel()` channel. - if not cancellationWasAlreadyAccepted: - abort shared child-request signal - cancel every registered child through its at-most-once gate - settle chosen result -``` +Optional `sendMessage()` supports a live backend that can accept steering. Optional `resume()` returns `Promise` because the resumed child has the same asynchronous readiness boundary. -The worker may also send a later `ChildCancel`; host fanout and the worker message share one per-call cancellation gate, so an arbitrary backend's `cancel()` need not be idempotent. Each callback is contained independently. +The service validates provider capabilities and request semantics before calling the provider. A provider rejection cleans any partial resources before the rejection escapes and emits no `subagent/start`/`subagent/end` pair. After fulfillment, the service attaches result observation, emits scoped start, and returns the run. Provider removal prevents later starts but does not revoke a run already accepted by the provider. -### Worker death, exit, and disposal remain separate +### In-process providers reuse the core transaction -The first worker death signal closes message admission, claims a death result unless an earlier terminal fact won, cancels and disposes registered children, and synthesizes missing lifecycle ends. A queued message can arrive between Node's `error` and `exit`, so the logical admission barrier—not physical exit—prevents late child creation or narration. +Spawn and fork share one in-process driver. It creates the child through `parent.ctx`, passes the required signal into the core creation transaction, and installs persona, tool restriction, and structured-output contributions during unpublished setup. -Physical exit performs a final disposal-only sweep without repeating explicit cancellation. A cancellation grace period bounds how long the host waits for cooperative settlement before terminating the worker; a grace result can already be chosen while exit cleanup still needs to dispose surviving child handles. The bound is real: after grace expires, public disposal may return after invoking child disposal and reaping host resources even if a slow backend disposer has not reached quiescence. +The provider awaits creation and returns only the published run. At the handoff, core creation detaches its creation-only abort listener; the provider immediately rechecks the signal before installing the live-run listener, so an abort in that narrow interval disposes the new handle instead of escaping cancellation. Parent teardown follows the child because the operation belongs to `parent.ctx`; provider unload blocks new starts but does not become a second revocation owner for accepted runs. The run disposer cancels the child and awaits the AgentHandle's ordered teardown. -Public `handle.dispose()` claims its shared promise before invoking cancellation or child callbacks. Each `disposeChild` likewise claims its call-ID promise before invoking the backend disposer. Public-first reentry joins the public promise; worker-first reentry lets the holder traversal join the already claimed child promise. Settled `dispose()` still drives a host-side reap before awaiting quiescence, so a fire-and-forget child cannot remain alive merely because workflow result settlement already occurred. +Spawn uses an empty session seed. Fork uses a validated completed-turn prefix. Conversation seeding changes history only and does not import scope, tools, services, or authority. -Together these rules ensure `workflow/agent-start` names only ready children, external result precedence is stable, and every surviving child reaches disposal. +### ACP providers own the process until readiness or cleanup + +An ACP provider crosses a real process and wire boundary, so it retains validation, environment scrubbing, message serialization, abort/process races, and kill-to-exit quiescence. + +Start resolves only after `initialize` and `newSession` succeed. Abort, spawn failure, RPC failure, or invalid startup response reaps the process before rejection. After readiness, result maps the ACP prompt outcome and streamed output; dispose requests cancellation, closes the connection, and awaits process exit through one memoized path. + +## Workflows and ACP UI: retain only independent async facts + +Worker and editor bridges need more state than same-process registries because messages, process death, and rendering can settle independently. Their state is organized around those real facts rather than duplicate cancellation protocols. + +### Workflow children are pending starts or published records + +The workflow host keeps pending provider-start promises and published child records. A child moves from pending to published only when async `SubagentService.start()` fulfills; rejected starts clean their partial provider work and produce no child lifecycle pair. + +One host-owned AbortController supplies the required signal to pending and live children. Closing workflow admission aborts that signal, so there is no duplicate `ChildCancel` worker RPC or explicit host-side `run.cancel()` fanout. Quiescence waits for both pending starts and published child disposal. + +The worker boundary still serializes requests and outcomes. The host retains first-terminal-outcome arbitration, exact child accounting, worker-death handling, grace termination, late/duplicate message rejection, and bounded cleanup because result receipt, worker exit, and child quiescence are genuinely independent facts. + +### Terminal result and physical cleanup remain separate + +The workflow result records the first accepted terminal outcome according to the public precedence rules. Cleanup can continue after that result is chosen: live children still need disposal, a worker still needs termination, and a slow external backend may outlive the configured grace bound. + +Public disposal claims its memoized promise before invoking callbacks. Worker death closes admission before processing any queued late child request, synthesizes missing lifecycle ends, and starts child/process cleanup without rewriting an outcome already claimed. + +### ACP prompt settlement does not depend on rendering success + +The ACP UI correlates a prompt with its observed turn directly. It does not scan from a `logWatermark` or use session status as a second reconciliation oracle. + +Prompt handling settles correlation in a `finally` around transcript rendering. A rendering failure can fail presentation, but it cannot skip prompt settlement or leave the session permanently in flight. Concurrent loads of the same persisted caller-supplied session ID remain excluded because that is a real persistence identity race, not a UUID collision concern. ## Correctness enforcement -The runtime rule is checked at four escape boundaries: API shape couples related subjects, TypeScript marks typed dispatch, development invariants inspect actual dispatch, and repository gates keep declarations aligned with enforcement. +The design is enforced at types, runtime escape points, generated contracts, and behavioral tests. No one layer is asked to prove what it cannot observe. -### API shape couples values that must agree +### Types make the ordinary path hard to misuse -`agentEvents(context, agent)` couples carrier, subject, and first event argument. `assembleContextFor(agent)` couples prompt facts with scope selection. `SessionStore.flush(session)` owns lookup of the carrier captured when the session entered. +Readonly contracts describe borrowed same-process values. `Scoped` marks event receivers, `agentEvents()` fuses carrier and subject, tool inputs omit registry-owned tokens, and subagent async return types expose readiness directly. -```text -assembleContextFor(agent): - return { agent, scope: agent } +TypeScript cannot govern JavaScript casts, direct Cordis dispatch, process messages, or durable files, so runtime enforcement remains at those escape points. -agentEvents(context, agent): - carrier = scopeTarget(agent, agent) - return dispatcher that always injects agent as the event subject -``` +### Runtime invariants cover cross-service facts -These helpers make a mismatch harder to express than the correct spelling. +The invariants plugin verifies that every declared scoped event uses a marked carrier and that event families exposing a subject use the matching key. Session trace validation stages before append commit and advances after the same event commits. -### Type markers cover every scoped event declaration +The plugin does not police trusted setup by scanning registries or reject prompt assembly objects fabricated through casts. Those checks would turn composition contracts into speculative runtime machinery without protecting a real external boundary. -Scoped agent, approval, tool, prompt, session, and subagent lifecycle events declare a `Scoped` receiver. TypeScript rejects a bare subject at typed dispatch sites, including subagent lifecycle events scoped to the delegating parent. +### Generated artifacts keep public contracts aligned -The marker is compile-time only; JavaScript, casts, and direct Cordis dispatch can bypass it. +The event catalog, service catalog, producer/consumer matrix, configuration catalog, module graph, tool catalog, and type-equivalence blocks are generated or freshness-gated from source. `verify-scoped-dispatch` keeps the declared scoped-event set aligned with runtime invariant coverage. -### Development invariants inspect actual dispatch - -The invariants plugin uses Cordis's internal dispatch as the pre-delivery enforcement point. Every scoped event requires a marked carrier, and events whose arguments expose the subject require the carrier key to be the same object. For `session/event`, callback resolution also precedes the log push: the plugin validates and stages the exact candidate there, then advances its live trace only when the same committed event reaches its contained post-commit listener. A later internal check can therefore veto without advancing either log or trace. Both halves of this oracle are explicitly global, so mounting the plugin under a scoped context cannot stage a foreign event without also applying its committed transition. - -Session and subagent payloads do not expose their owner key directly, so their service centralizes key selection and the invariant proves carrier presence. Additional invariants reject an assembly whose `agent` and `scope` disagree and a turn opened before `agent/session-start`. - -Dedicated `dsh-scope` unit tests cover the carrier's advanced Proxy behavior: private-field method binding, call/construct shape, primordial filter invocation, own-key/descriptor consistency, and explicit configurable definitions. These are implementation tests, not checks performed by the invariants plugin. - -### Repository gates keep declarations and dispatchers aligned - -`verify-scoped-dispatch` compares declared scoped events with the runtime invariant table, and the generated event matrix requires every declaration to name a recognized dispatcher. Source JSDoc generates the [event catalog](../../../cordis-catalog/events.md), which remains the exhaustive signature and mode reference. +Behavioral tests pin scoped routing and disposal, final-entry collision cleanup, publication rollback, ordered quiescence, durable pre/post-commit behavior, live tool filtering across presentation and execution, owner-final Code Mode and structured output, async subagent startup and signal cancellation, worker terminal arbitration, ACP settlement, and process teardown. ## Alternatives considered -The [agent-scope contract](2026-07-08-agent-scope-contexts.md#alternatives-considered) owns the rejected public architectures: explicit agent parameters, event-only filtering, per-agent service graphs, and hierarchical registration inheritance. This RFC records the implementation alternatives rejected after choosing the public contract. +The [July 8 RFC](2026-07-08-agent-scope-contexts.md#alternatives-considered) owns alternatives to the public flat-scope contract. The alternatives here concern implementation shape. -### Publish the agent before running setup +### Use a transparent proxy as the scope carrier -Early publication lets setup find the agent in global registries but lets observers act on a partially configured world. Rollback can remove entries but cannot retract external effects from listeners that already ran. +A proxy that impersonates the subject must preserve property, callable, constructable, private-field, descriptor, and proxy-invariant behavior that listener routing never needs. A small opaque carrier keeps the filter and key while the explicit event argument carries the subject. -The unpublished setup callback already receives `agent.ctx` and `ctx.agent`, so early global lookup is unnecessary. +### Reserve agent and session IDs before setup -### Allow only synchronous setup +Reservations prevent duplicate private setup work but require cross-service capabilities, release ordering, abandoned-reservation cleanup, and prepared-object binding. IDs are caller-supplied and concurrent reuse is caller error; final entry can choose the winner while the losing transaction rolls back cleanly. -Synchronous setup cannot honestly compose child plugins whose activation is asynchronous. TypeScript also permits a promise-returning callback where a void return is expected, so a synchronous-looking type would not reliably contain accidental async work. +### Snapshot every typed same-process argument -Awaited setup makes the transaction explicit and keeps first publication and prompt assembly behind it. +Universal copying defends against stateful getters and callers that violate readonly contracts, but it adds allocation, duplicated validators, and paths that can forget to copy. Materialization belongs at parser, queue, model, durable, worker, process, and wire boundaries where ownership actually changes. -### Validate caller data, then clone it +### Give readiness, cancellation, and disposal separate controllers -Validation followed by a separate clone rereads accessors, so it can approve one value and retain another. A generic JSON clone can also erase or coerce exotic prototypes and unsupported values. The lossless-JSON traversal validates and materializes one captured value in the same operation. +Parallel sentinels can all mirror whether one operation is live. One transaction or start promise owns the operation; separate promises remain only where publication unwind, external work, terminal result, and physical quiescence can settle independently. -### Enforce invariants with prepended waterfall listeners +### Keep synchronous subagent start plus `run.started` -A prepended listener is not permanently outermost: another plugin can prepend later, a short-circuit can skip inner work, and an outer wrapper can replace a downstream result. The same defect appears in prompt assembly, tool decisions, result commit, and turn continuation. +This splits provider acceptance from readiness and forces every consumer to register a partial run, attach result observation, await readiness, and clean up readiness failure. An async start promise makes provider-to-caller ownership transfer the readiness boundary itself. -The four owner-final APIs express the exact one-way power required: restore named canonical data, deny monotonically, observe immutable final outcome, or stop after ordinary continuation folding. +### Keep a separate prompt-protection registry -### Put agent-scope policy inside vendored Cordis +A protection registration mirrors the names and lifetime already owned by prompt sections and tool definitions. `ownerFinal` keeps the exceptional policy on the contribution and lets assembly derive the canonical set directly. -Cordis already supplies derived contexts, effect ownership, and receiver-based filtering. The harness-level primitive composes those domain-neutral mechanisms rather than teaching Cordis about agents, tools, prompts, or global-plus-agent merge rules. +### Remove worker/process lifecycle guards with same-process hardening -The lifecycle hardening remains correctly inside Cordis because effect pre-registration, parent ownership before child publication, and rejection of late effects protect every plugin under reentrant hot reload, not only agent scopes. +Worker messages, process death, and durable input do cross ownership and serialization boundaries. First-outcome arbitration, validation, environment scrubbing, and quiescent process cleanup remain necessary even though hostile same-process callback machinery does not. ## Consequences -The implementation makes the contributor contract locally checkable at each escape boundary. Its cost is explicit runtime machinery for key coherence, continuous ownership, accepted-value stability, and post-middleware finality. +The implementation is smaller and its proof follows the same shape as its ownership graph. One key selects a layer, one entry owns a live registry object, one transaction owns creation, one resolver owns a tool view, and one async promise transfers subagent ownership. -### Correctness properties +### What the design guarantees -The mechanisms compose into five properties: +- A scoped contribution is visible only in its exact agent view and is disposed with that scope. +- Create and resume expose no partially configured handle; final-entry losers and publication failures clean every prepared resource. +- Disposal retains scoped listeners and persistence through driver drain and final session work, then revokes the scope. +- Durable, queued, model, worker, process, and wire values are owned at their real boundary; typed same-process values follow readonly contracts. +- Tool presentation and execution resolve the same live view, and committed results have one immutable observation point. +- Owner-final prompt/tool contributions survive cooperative assembly without freezing unrelated middleware behavior. +- Subagent start returns only a ready run, required signals cancel pending or live work, and disposal reaches the backend's quiescence contract. +- Worker/process result precedence and cleanup remain correct under death, late messages, and bounded teardown. -- Registry layers and event carriers derive from one opaque key, while fused helpers couple subjects that must agree. -- Reservations, sentinels, provider tracking, publication barriers, and reverse teardown cover every asynchronous or reentrant ownership interval. -- At the hardened boundaries listed above, accepted identities and snapshots prevent runtime accessors or later mutation from splitting validation, execution, logging, and observation. -- Prompt protection, guards, final-result observation, and terminal stop each have only the one-way power their invariant requires. -- In-process subagents and workflow runs preserve readiness, terminal precedence, and disposal under provider callbacks, worker death, and racing owners. +### Costs and limits -### Costs and constraints +Scope-aware services still maintain global and identity-keyed maps, and operations must carry their real agent explicitly. Async create/resume and subagent start require callers to await ownership transfer and dispose returned handles. -The proof is not free: +The design trusts typed plugins in the same process. It does not defend against arbitrary casts, stateful getters, mutation that violates readonly contracts, or a plugin deliberately using ambient service access outside the supported composition API. -- Registries keep global and per-scope state, and every scoped dispatcher must preserve the operation subject through a proxy-shaped carrier. -- Programmatic create and resume require reservation capabilities, two-owner tracking, rollback state, ordered publication, and a shared quiescence promise. -- Acceptance boundaries copy, freeze, bind, or retain values according to their contract, increasing allocation and validation work. -- Owner-final behavior uses four explicit APIs instead of relying on ordinary listener ordering. -- Runtime invariants, generated dispatch checks, and focused Proxy/lifecycle/race tests remain necessary because TypeScript cannot enforce direct JavaScript dispatch or runtime reentrancy. - -The direct no-setup `ctx.agentLoop.create()` path remains synchronous for configuration and callers that already have complete options. Programmatic registry create/resume use the full unpublished transaction. - -### Limits of the proof - -The proof covers services and event families that explicitly adopt the agent-scope helpers. It does not make every service call scope-aware, strengthen the ordering contract of a custom agent registered outside AgentLoop, or force an arbitrary external subagent backend to reach quiescence after a workflow grace deadline. - -The [security and authority non-goal](2026-07-08-agent-scope-contexts.md#security-and-authority-are-explicit-non-goals) is part of the public contract. These mechanisms prove composition and ownership behavior inside one trusted process; they do not prove confinement or parent-to-child non-escalation. +The [security and authority non-goal](2026-07-08-agent-scope-contexts.md#security-and-authority-are-non-goals) remains fundamental. These mechanisms prove registration composition, publication, and lifetime ownership; they do not prove confinement or parent-to-child non-escalation. diff --git a/docs/rfc/implemented/feature/2026-06-15-code-mode.md b/docs/rfc/implemented/feature/2026-06-15-code-mode.md index be18e94ae0..16f42104be 100644 --- a/docs/rfc/implemented/feature/2026-06-15-code-mode.md +++ b/docs/rfc/implemented/feature/2026-06-15-code-mode.md @@ -24,11 +24,11 @@ Three decisions, each elaborated in its own section below: `ToolRegistry` gains a schemastery-validated config (`static Config`), its first: `mode: 'native' | 'code' | 'both'`, default `'native'`. A deployment flips it from `cordis.yml` (`tools: { mode: code }`) — no code edit, per the no-hardcoded-tunables convention. -**Wire tool list = the registry's contribution.** The registry feeds assembly through a mode-aware provider: `'native'` contributes every capability visible to that assembly scope, `'code'` contributes only `run_code`, and `'both'` contributes both. Because [`PromptAssembly.tools` is the single source the loop's request header snapshots](../../../../packages/core/system-prompt/src/index.ts), the presentation is logged and reconstructable. The reserved transport is not a capability: it lives outside global/scoped registration and restriction layers, cannot be registered or shadowed, and cannot be named by `ctx.tools.restrict()`. `systemPrompt.protect()` restores its canonical schema after the complete assembly waterfall, so listeners cannot strip, replace, duplicate, or fabricate it. The mode governs only the registry's contribution; a deployment that deliberately installs another direct `systemPrompt.tools()` provider still owns that provider's schemas. +**Wire tool list = the registry's contribution.** The registry feeds assembly through a mode-aware provider: `'native'` contributes every capability visible to that assembly scope, `'code'` contributes only `run_code`, and `'both'` contributes both. Because [`PromptAssembly.tools` is the single source the loop's request header snapshots](../../../../packages/core/system-prompt/src/index.ts), the presentation is logged and reconstructable. The reserved transport is not a capability: it lives outside global/scoped registration and restriction layers, cannot be registered or shadowed, and cannot be named by `ctx.tools.restrict()`. Its `ToolDefinition` declares `ownerFinal: true`, so the provider reports the name as final and assembly restores its canonical schema or canonical absence after the waterfall. The mode governs only the registry's contribution; a deployment that deliberately installs another direct `systemPrompt.tools()` provider still owns that provider's schemas. **Interaction with `toolOrder`, stated up front:** a configured `systemPrompt.toolOrder` naming native capabilities rejects every assembly under `mode: 'code'`, because those names are outside that mode's wire-validation universe. This is correct behavior, not a bug: a deployment using Code Mode updates its order config or drops it. -**The SDK prompt section.** Under `'code'` and `'both'` the registry registers one lazy prompt section (`tools:sdk`, in the 100–199 tool-guidance order band) whose thunk regenerates, for each assembly scope, a TypeScript declaration of every visible end-capability tool plus fixed usage instructions. It uses the same visibility resolver as lookup and execution, so scoped grants and shadows appear while restricted globals disappear; the reserved `run_code` transport itself is excluded. The thunk emits tools in lexicographic name order, so an unchanged visible set produces byte-identical text, and `systemPrompt.protect()` restores the canonical section after every assembly listener. Because that protection is global, it also reserves the `tools:sdk` registry name against scoped section shadows; otherwise scoped-over-global resolution could make a later shadow look canonical before restoration. +**The SDK prompt section.** Under `'code'` and `'both'` the registry registers one lazy prompt section (`tools:sdk`, in the 100–199 tool-guidance order band) whose thunk regenerates, for each assembly scope, a TypeScript declaration of every visible end-capability tool plus fixed usage instructions. It uses the same visibility resolver as lookup and execution, so scoped grants and shadows appear while restricted globals disappear; the reserved `run_code` transport itself is excluded. The thunk emits tools in lexicographic name order, so an unchanged visible set produces byte-identical text. The section declares `ownerFinal: true`, which restores its canonical contribution after every assembly listener and reserves the global name against scoped shadows. **Codegen.** A pure `jsonSchemaToTs(schema)` module inside `dsh-tools` (sibling of `json-schema.ts` — `schemas()` and the SDK are two projections of the same store) maps the JSON-Schema subset the `defineTool` DSL emits (object/string/number/boolean/array, `properties`, `required`, string `enum` → literal union, nested objects, array `items`, `description` → JSDoc) to a TS type literal. It is **total**: any construct outside that subset (`$ref`, `oneOf`/`anyOf`, `integer`, future MCP shapes, …) degrades to `unknown` without throwing. Because `ToolSchema.name` is an arbitrary string, the SDK is declared as one object constant — `declare const tools: { "some-mcp-tool"(args: …): Promise; bash(args: …): Promise; … }` — quoted keys make every name reachable with no sanitization or alias-collision logic. Typing is advisory (the runtime executes type-stripped JS); the instructions say so. diff --git a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md index f26aa501ef..c24c6102d9 100644 --- a/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md +++ b/docs/rfc/implemented/feature/2026-06-21-subagent-capability-seam.md @@ -35,9 +35,9 @@ A new package group `packages/subagent/`: | `@deepseek-ai/dsh-subagent-mock` | support: a scripted provider for testing the seam through the real load path | | `@deepseek-ai/dsh-tool-subagent` | consumer: the model-facing `subagent` tool over `ctx.subagents` | -### The primitive: `start → SubagentRun` +### The primitive: async `start → SubagentRun` -A provider exposes `start(request) → SubagentRun`. The run carries `started` (the provider's publication/readiness promise), `result` (the terminal `SubagentResult`), `cancel()`, and `dispose()`. The transport-neutral verb is **`start`**; "spawn" is reserved for the in-process `dsh-subagent-spawn` backend's identity, not the service verb. The service's `start(name, request)` resolves the named provider, validates capabilities, delegates, and waits for `started` before emitting the paired `subagent/start` / `subagent/end`; an attempt that never establishes a child emits neither lifecycle event. For an in-process backend, readiness means the child is published in `ctx.agents`; for ACP it means the remote session exists. +A provider exposes `start(request) → Promise`. Promise fulfillment is the publication/readiness and provider-to-caller ownership boundary: for an in-process backend the child is already published in `ctx.agents`, and for ACP the remote session already exists. `SubagentStartRequest.signal` is the single cancellation channel before and after readiness; `SubagentRun` carries the terminal `result` and a `dispose()` method that cancels remaining work and awaits quiescence. The transport-neutral verb is **`start`**; "spawn" is reserved for the in-process `dsh-subagent-spawn` backend's identity, not the service verb. A rejected start cleans provider-owned partial resources and emits neither subagent lifecycle event. ### Two kinds of optional capability, discovered two ways @@ -54,7 +54,7 @@ Each subagent runs in its **own `Session`** (own id, `parentSession` lineage), p ### Synchronous collect (first cut) -The `dsh-tool-subagent` consumer awaits `run.result` and returns the child's final output as the tool result, blocking the parent's turn until the child finishes. It does so inside a `try/finally` that always `dispose()`s the run (no leaked idle child/session on any path), bridges `exec.signal` to `run.cancel()`, and maps a non-`completed` stop reason to an `isError` result rather than returning partial output as success. Steering (`sendMessage`) is part of the contract but **intentionally unused** this cut. +The `dsh-tool-subagent` consumer passes its execution signal into the start request, awaits the ready run's `result`, and returns the child's final output as the tool result, blocking the parent's turn until the child finishes. A `try/finally` always `dispose()`s the run, so no success, failure, or cancellation path leaks an idle child/session. A non-`completed` stop reason maps to an `isError` result rather than returning partial output as success. Steering (`sendMessage`) is part of the contract but intentionally unused in this consumer. ### Provider selection is config, not model-facing @@ -66,7 +66,7 @@ The seam is tested through the real cordis Loader / export path, not a hand-buil ## Consequences -- **Recursion.** Without a guard, an in-process child inherits the spawn tool and can spawn unboundedly. Depth-limit is an optional capability (the in-process backends enforce it; ACP advertises it off and rejects a `maxDepth` request); tool-filtering is likewise optional. Tool-filtering, when implemented, needs a `tools/pre-execute` deny in the child context — schema filtering alone is insufficient because a model can hallucinate a denied tool name. +- **Recursion.** Without a bound, an in-process child can see the delegation tool and recurse. The in-process backends implement the optional absolute depth limit and scoped live-global `toolFilter`; ACP advertises both capabilities off and rejects such a request. The [subagent composition-controls RFC](2026-07-12-subagent-persona-tool-filter-and-depth.md) owns their exact semantics and security limits. - **Blocking the parent turn.** Synchronous collect holds the parent's `runStep` open for the child's full duration. This is acceptable for the first cut; **background / poll / spill semantics are deferred to a future redesign that unifies long-running-tool handling across subagents AND bash** (a sub-agent and a long `bash` background task pose the same "the model started something slow, how does it collect later" problem, and should share one mechanism rather than each inventing its own). - **Live progress.** This cut surfaces only lifecycle + final result; a per-chunk child→parent update stream is deferred with the background redesign. - **ACP client surface.** Proxying `fs`/`terminal` from the ACP child back to the parent (a shared-workspace mode) is future work; the first cut advertises neither, so the child self-serves in its own process. diff --git a/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md b/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md index ec608177b4..518f9dedef 100644 --- a/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md +++ b/docs/rfc/implemented/feature/2026-06-22-acp-subagent-backend.md @@ -34,7 +34,7 @@ The child is a separate process, so it inherits an environment. Credential-shape Designed at every tier the backend touches, per the root AGENTS.md rule that a new capability shape names its coverage at every tier at plan time: -- **Keyless unit/integration** (`subagent-acp.spec.ts`): spawns a scripted mock ACP server subprocess (`tests/mock-acp-server.ts`) and drives it through the real backend over real ACP stdio. Covers: the prompt round-trip + output accumulation; every StopReason mapping; cancellation via `run.cancel()` and via the request signal; the already-aborted-before-start case; the cancel-races-ahead-of-newSession case; a torn-pipe-after-cancel (child crashes on cancel) settling `aborted`; permission auto-answer under both policies (including the allow-policy-no-allow-option fallback); a non-message update consumed but not accumulated; a nonexistent-command spawn failure settling `error`; HMR provider cleanup; and the namespace export shape. 100% per-file coverage. +- **Keyless unit/integration** (`subagent-acp.spec.ts`): spawns a scripted mock ACP server subprocess (`tests/mock-acp-server.ts`) and drives it through the real backend over real ACP stdio. Coverage includes the prompt round-trip and output accumulation; every StopReason mapping; cancellation through the required request signal and through disposal; already-aborted and cancel-races-ahead-of-newSession starts; a torn pipe after cancellation settling `aborted`; permission auto-answer under both policies; non-message updates; nonexistent-command startup failure with process reaping; provider HMR; and the namespace export shape. - **With-key e2e** (`subagent-acp.e2e.ts`): the harness drives ITSELF — the backend spawns the real `acp-agent` example process and a real model in that child answers a prompt (PONG) and does real file work (writes `proof.txt`, verified on disk). Self-skips without `DEEPSEEK_API_KEY`. This is the "talk to our own process" smoke and the out-of-process analogue of the in-process spawn e2e. - **Snapshot**: deferred as `TODO(acp-subagent-replay)`. An ACP child is a distinct replay shape — each child is its own PROCESS with its own single-agent replay (booted under `DSH_SNAPSHOT=replay` with its own sessions-root + fixture), unlike the in-process per-session keying that [the per-session replay RFC](../testing/2026-06-22-subagent-snapshot-replay.md) added. The keyless mock-server tests give deterministic coverage of the backend in the meantime; the snapshot follow-up would record the parent driving a real-but-replayed ACP child. diff --git a/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md b/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md index 17730458de..aa853edd24 100644 --- a/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md +++ b/docs/rfc/implemented/feature/2026-06-30-subagent-observe-enrich.md @@ -6,13 +6,13 @@ Status: implemented The hooks subsystem ([interception seams RFC](2026-06-30-interception-seams.md)) lets a plugin observe and gate the agent at lifecycle points. Claude Code and Codex both expose **SubagentStart / SubagentStop** hooks, and CC's carry the subagent's final message. The harness already emits `subagent/start` and `subagent/end` lifecycle events ([the subagent capability-seam](2026-06-21-subagent-capability-seam.md)), but their payloads were minimal (`provider`, `id`, and on end `stopReason`) — not enough for a hooks bridge to report WHAT a subagent produced without separately reaching for the live run. -This RFC enriches the end payload. It is deliberately **observe-only**: no control-flow change, no waterfall, no `start()` restructure. A run-affecting subagent-stop decision (continuation, injection that changes the run) is a separate, larger redesign and stays out of scope. +This RFC enriches the end payload. It is deliberately **observe-only**: no control-flow change and no waterfall. A run-affecting subagent-stop decision (continuation, injection that changes the run) is a separate, larger redesign and stays out of scope. ## Decision -**Add `lastAssistantMessage` — the child's final output — to `SubagentRunEndInfo`.** On the settle path it is a DEEP CLONE of `SubagentResult.output` (so an observer sees WHAT the subagent produced without holding the run). On the REJECT path (an infrastructure fault where no `SubagentResult` was produced — the seam only knows `stopReason: 'error'`) it is absent. The clone is load-bearing for observe-only: the `subagent/end` emit fires from a detached `.then` registered *before* `start()` returns, i.e. before the caller's own `await run.result` continuation — handing listeners the same array reference would let a mutating listener corrupt the caller's `SubagentResult.output`. `structuredClone` makes the event a read-only view (a regression test mutates the event's array and asserts the caller's result is untouched); a clone failure is contained (logged, the event still fires without `lastAssistantMessage`) rather than becoming an unhandled rejection on the detached `.then`. +**Add `lastAssistantMessage` — the child's final output — to `SubagentRunEndInfo`.** On the settle path it is the readonly typed `SubagentResult.output`, so an observer sees what the child produced without holding the run. On an infrastructure rejection where no `SubagentResult` exists, it is absent and the event reports `stopReason: 'error'`. Providers and listeners are trusted same-process collaborators and honor the borrowed immutable payload contract. -Both events stay plain **`emit`s**. The service waits for `run.started` before firing `subagent/start`; an in-process listener can therefore reach the published child via `ctx.agents.get(info.id)` and `inject()` into it, while a remote provider need not have a local registry entry. It observes `run.result` immediately, snapshots the end payload before the caller can mutate it, and emits `subagent/end` only after start; readiness rejection emits neither event. The callbacks remain observe-only and per-listener containment keeps one bad subscriber from stranding a live run, surfacing as an unhandled rejection, or starving later listeners. +Both events stay plain **`emit`s**. Async `SubagentService.start()` attaches result observation to the ready provider run, emits `subagent/start`, and then returns the run; an in-process listener can therefore reach the published child via `ctx.agents.get(info.id)`, while a remote provider need not have a local registry entry. A rejected provider start emits neither event. The callbacks remain observe-only and per-listener containment keeps one bad subscriber from stranding a live run or starving later listeners. ## Alternatives considered diff --git a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md index 47d9ec0473..ed718686ef 100644 --- a/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md +++ b/docs/rfc/implemented/feature/2026-07-05-dynamic-workflows.md @@ -26,7 +26,7 @@ One deliberate strictness DIVERGENCE from CC: hook misuse — unknown or deferre **Why node:worker_threads**: one run uses one unpooled worker because a workflow run is already heavyweight relative to thread startup. The script runs in a vm context inside the worker, keeping the script-visible surface to the hook contract instead of exposing a bare worker realm, while `agent()` bridges by message-port RPC to I/O-bound child loops on the host. This keeps `start()` from blocking the host on the script's synchronous slice, makes the post-cancel deadline end in a real `worker.terminate()`, and gives cross-thread values a serialization boundary by construction. isolated-vm was rejected for its maintenance state, required `--no-node-snapshot` consumer flag on Node ≥ 20, and node-gyp fallback. -Host-side meta validation and body pre-parsing preserve the seam's synchronous errors, and private enum-keyed payload maps define the wire protocol. Readiness admission, the two child-cancellation channels, worker-death reaping, result precedence, and disposal quiescence preserve the subagent run contract across that wire; the [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#workflow-integration-preserves-the-subagent-contract) owns those race algorithms. Coverage uses an in-process `MessageChannel` for worker-side logic that main-process V8 coverage cannot see and separately proves the built `lib/worker.js`—a second tsdown entry sanctioned by the `"./worker"` subpath export—under plain Node in the built-bin smoke gate. +Host-side meta validation and body pre-parsing preserve the seam's synchronous errors, and private enum-keyed payload maps define the wire protocol. Pending async starts, published child records, one host cancellation signal, worker-death reaping, result precedence, and disposal quiescence preserve the subagent run contract across that wire; the [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#workflow-children-are-pending-starts-or-published-records) owns those race algorithms. Coverage uses an in-process `MessageChannel` for worker-side logic that main-process V8 coverage cannot see and separately proves the built `lib/worker.js`—a second tsdown entry sanctioned by the `"./worker"` subpath export—under plain Node in the built-bin smoke gate. **Meta as data, never evaluated**: the meta block reaches the seam as a plain JSON request field (the tool's schema-validated `meta` parameter) and the engine only shape-validates it, every violation named. This is a host-isolation invariant, not a convenience: evaluating a meta literal host-side — even one contractually "pure", in an empty timed vm context — hands script-controlled getters a host stack with no timeout the moment the result is READ, defeating the exact spin isolation the worker thread buys. @@ -42,7 +42,7 @@ A `workflow` tool mirroring `dsh-tool-subagent`'s synchronous shape: start, awai An output schema makes a schema-valid committed capture mandatory for successful child completion. The scoped runtime preserves the canonical capture tool and instruction, commits only a successful final outcome—including the enclosing `run_code` outcome for an SDK call—denies later side effects after capture becomes pending, and stops the child without another model step after commit. A validation failure remains a retryable tool error; clean completion without a committed capture settles as an error. -`StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim. The [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#structured-output-is-a-child-owned-terminal-protocol) owns the assembly, commit, guard, and terminal-stop correctness algorithms. +`StructuredOutputSchema` is the raw enforceable JSON-Schema subset in `dsh-tools` (single-string `type`, `properties`/`required`/`additionalProperties`, `items`, scalar `enum`/`const`), and unsupported keywords fail loudly because that wire data becomes the capture tool's parameters verbatim. The [agent-scope runtime-design RFC](../architecture/2026-07-12-agent-scope-runtime-design.md#structured-output-commits-only-authoritative-outcomes) owns the assembly, commit, guard, and terminal-stop correctness algorithms. ## Deferred (documented non-goals of this cut) diff --git a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md index 0579bf2629..5d82226a96 100644 --- a/docs/rfc/implemented/feature/2026-07-06-approval-seam.md +++ b/docs/rfc/implemented/feature/2026-07-06-approval-seam.md @@ -49,11 +49,11 @@ The `escalation-rejected` twin ends in `{"outcome": "rejected"}` instead: nothin #### The seam: mechanism and policy split -After request validation and a successful `approval/asked` append, the answerer phase always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable`. The service synchronously snapshots and shallow-freezes the accepted request before its first asynchronous boundary: scalar fields are copied while the agent and `AbortSignal` remain exact identity capabilities, so later caller mutation cannot redirect scope, payload, cancellation, or either audit event. The service dispatches the `approval/request` waterfall, races the captured signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the captured agent's captured session log. Request acceptance and either pre-commit audit append may still reject; returning a decision that could not be logged would violate the pair. Session owns post-commit observer containment, so a callback failure cannot turn an authoritative audit append into a rejected request or suppress the matching event. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. `request()` also throws before appending anything when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design. +After request validation and a successful `approval/asked` append, the answerer phase always resolves to a closed `ApprovalOutcome` — `allowed-once` / `rejected` / `cancelled` / `unavailable`. `ApprovalRequest` is a readonly same-process contract, so the service borrows its routing identity and cancellation signal instead of copying the record or capturing a parallel callback bundle. It dispatches the `approval/request` waterfall, races the request signal (abort settles `cancelled`; a late answer is discarded, never double-audited), contains a throwing answerer as `unavailable`, normalizes a rogue non-vocabulary return to `unavailable`, and lands the log-only audit pair `approval/asked`/`approval/decided` (paired by the branded `ApprovalRequestId`) on the request agent's session log. Request acceptance and either pre-commit audit append may still reject; returning a decision that could not be logged would violate the pair. Session owns post-commit observer containment, so a callback failure cannot turn an authoritative audit append into a rejected request or suppress the matching event. Grants are one-shot by definition: `allowed-once` authorizes the single asked-about action, never a class of future ones, and the service stores nothing between requests. `request()` also throws before appending anything when the agent's session has no open turn — the audit pair must be turn-enclosed, the turn being the durable log's commit/replay boundary (a bare event between turns is dropped as crash tail on reload); every ask path runs mid-turn already, and idle asks are a deferred design. Answerers are the policy, and they are `approval/request` waterfall listeners. The waterfall buys exactly what the seam needs: with zero listeners the dispatch falls through to the caller-supplied default — `unavailable`, so fail-closed needs no configuration and no code in any deployment; a listener that recognizes the request's agent answers by returning an outcome without calling `next()` (the decision slot is single-occupancy, first answer wins — the same documented semantics as the `fs/write-intent` gate); a listener that does not recognize the agent MUST delegate via `next()` so another answerer or the default gets the question; and listeners dispose with their owning fiber, so an unloaded UI plugin degrades the next ask to `unavailable` instead of leaving a dangling channel. Registration order across sibling plugins is not load-order deterministic (the loader starts siblings concurrently), so a deployment composes ONE terminal answerer and reserves `prepend` listeners for decide-or-delegate gates. -`ApprovalRequest` carries the asking `agent` (routes the question; receives the audit events), the `toolName`, the optional exact `callId`, the asker's human-readable `reason`, and the optional `signal`. The caller owns this input record; `request()` owns its frozen acceptance snapshot. The vocabulary is deliberately self-contained — it names the tool-call by the `CallId` brand from `dsh-llm` and never imports `dsh-tools` — because `dsh-tools` depends on `dsh-user-approval` (the ask routing) and a `ToolCallView` import would close a package cycle. It deliberately does NOT carry tool arguments: a UI answerer attaches the prompt to the already-streamed tool call via `callId` instead of re-rendering the call. +`ApprovalRequest` carries the asking `agent` (routes the question; receives the audit events), the `toolName`, the optional exact `callId`, the asker's human-readable `reason`, and the optional `signal`. The caller retains ownership and honors the readonly contract for the duration of `request()`. The vocabulary is deliberately self-contained — it names the tool-call by the `CallId` brand from `dsh-llm` and never imports `dsh-tools` — because `dsh-tools` depends on `dsh-user-approval` (the ask routing) and a `ToolCallView` import would close a package cycle. It deliberately does NOT carry tool arguments: a UI answerer attaches the prompt to the already-streamed tool call via `callId` instead of re-rendering the call. #### Ask routing in dsh-tools @@ -79,7 +79,7 @@ One package, no cycles: `dsh-user-approval` peers on `cordis`, `dsh-session` (ev ### Testing -Unit tier: the service's outcome branches (fail-closed default, first-wins slot, delegation, containment, rogue-value normalization, abort-before and abort-during with late-answer discard, fresh ids, fiber-disposal degradation), accepted-request mutation across agent scopes, post-append observer throws on both audit events, and the policy tier (both values × dispatch/decide, a `'never'` decision unbypassable even by an answerer prepended AFTER the service, audit pair intact) in `dsh-user-approval`; the ask routing matrix (grant dispatches; three non-grant reasons pinned verbatim; unmounted and agent-less degrades; the registry's own exhaustiveness backstop against a non-conforming stand-in) in `dsh-tools`; the answerer (wire shape of the prompt, outcome mapping, unknown-option conservatism, foreign-agent and call-less delegation) driven through a real bridge + scripted client in `dsh-acp`. +Unit tier: the service's outcome branches (fail-closed default, first-wins slot, delegation, containment, rogue-value normalization, abort-before and abort-during with late-answer discard, fresh ids, fiber-disposal degradation), scoped routing, post-append observer throws on both audit events, and the policy tier (both values × dispatch/decide, a `'never'` decision unbypassable even by an answerer prepended AFTER the service, audit pair intact) in `dsh-user-approval`; the ask routing matrix (grant dispatches; three non-grant reasons pinned verbatim; unmounted and agent-less degrades; the registry's own exhaustiveness backstop against a non-conforming stand-in) in `dsh-tools`; the answerer (wire shape of the prompt, outcome mapping, unknown-option conservatism, foreign-agent and call-less delegation) driven through a real bridge + scripted client in `dsh-acp`. Snapshot tier: the harness accepts scripted permission answers (`permissionAnswers` in a scenario's `input.json`, consumed FIFO; an unscripted prompt answers `cancelled`, fail closed). The seam's wire is recorded end to end in the sandbox example's suite: both escalation branches drive `session/request_permission` through this seam over scripted answers (grant and rejection), and the recorded `mode-switching` scenario pins the `'never'` prompt sentence and the policy-switch notice ([the sandbox RFC](2026-07-06-sandbox.md) § Testing). @@ -105,7 +105,7 @@ The implemented contract is pinned by the suites in Testing: - With an ApprovalService and an answerer composed, a hook's `ask` reaches a human and `allowed-once` dispatches the tool; every other outcome denies with its distinct reason. - A `'never'` session auto-rejects every ask without prompting anyone, states the policy in its prompt, and narrates switches (the shared switching mechanics are pinned in [the sandbox RFC](2026-07-06-sandbox.md)). - Every unanswerable path fails closed to `unavailable`: no service, no listener, a foreign or agent-less request, a throwing answerer, a rogue return value, or a dead client connection. -- Every `request()` snapshots its routing identity and lands exactly one `approval/asked`/`approval/decided` pair on that agent's captured log, replayable and invisible to the model transcript; post-append observer failures cannot split the pair. +- Every `request()` routes through its readonly agent identity and lands exactly one `approval/asked`/`approval/decided` pair on that agent's log, replayable and invisible to the model transcript; post-append observer failures cannot split the pair. - Prompts route per-session through the bridge's ownership map; one session's prompt can never reach another session's editor. - A deployment with no ApprovalService emits no approval prompt or approval audit events and denies every `ask` request. diff --git a/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md b/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md index 9d657f7bd4..5b6eeb4ccb 100644 --- a/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md +++ b/docs/rfc/implemented/feature/2026-07-12-subagent-persona-tool-filter-and-depth.md @@ -41,7 +41,7 @@ Resolution follows these rules: 3. Child-scoped tools are added after global filtering and may shadow an admitted global tool. 4. Reserved `run_code` presentation and other scope-local protocol contributions are outside the global filter. -Configuration fails loudly when a filter is empty or names a tool that is unknown, scope-local, or reserved at setup time. This catches misspellings and prevents configuration from appearing effective when it cannot affect the named entry. +Configuration fails loudly when a filter supplies neither `allow` nor `deny`, or names something outside the current global restrictable set, including a scope-local-only or reserved name. `allow: []` is valid and deliberately hides every global tool. These checks catch misspellings and prevent configuration from appearing effective when it cannot affect the named entry. The global registry remains live. A deny-only filter admits a later global name unless it explicitly denies that name; an allow-list excludes a later global name unless it explicitly allows that name. Removing a global tool removes it from every resolved view. These semantics preserve hot registration while making the difference between allow and deny explicit. diff --git a/packages/AGENTS.md b/packages/AGENTS.md index ac26b926f7..4b7bed4d1c 100644 --- a/packages/AGENTS.md +++ b/packages/AGENTS.md @@ -5,6 +5,8 @@ This directory contains all `@deepseek-ai/dsh-*` harness packages. Repo-wide con - **Plugin export shape — namespace OR default, never both.** A *service* package exports the service class as `export default` (the Loader instantiates it). A *function/namespace* plugin exports `name` / `inject` / `Config` / `apply` as separate named exports and **must NOT add `export default`** — the cordis Loader's `unwrapExports` does `exports.default ?? exports`, so a stray default export collapses the module to the bare `apply` function and silently discards the `inject`/`name`/`Config` namespace, leaving the plugin with no injected services (it then throws `cannot get property … without inject` at load). See [docs/postmortem/0001](../docs/postmortem/0001-acp-default-export-drops-inject.md). - **Read an optional (non-injected) service via `ctx.get(name)`, not `ctx.`.** For a service a plugin reads opportunistically but deliberately leaves out of `static inject` (e.g. `AgentLoop` reading `sessionPersistence`), the `ctx.` property proxy resolves by an ancestor-only fiber walk that throws when the call arrives through a foreign traceable shadow (the service lives on a sibling fiber). `ctx.get(name)` is the topology-independent global-store lookup, strict by default (an inactive/absent backend reads as `undefined` — prefer it over the `ctx.get(name, false)` overload, which also skips the active-state check). Services that ARE in `static inject` resolve fine via `ctx.`. See [docs/postmortem/0001](../docs/postmortem/0001-acp-default-export-drops-inject.md). - **A plugin shipped via `cordis.yml` needs at least one test through the REAL Loader/export path** — hand-built `ctx.plugin({...})` mounts bypass `unwrapExports` and cannot catch a broken export shape. Full testing policy (tiers, with-key generosity, real-entry-path guards): [docs/testing.md](../docs/testing.md). +- **Typed same-process service and plugin calls are contracts, not serialization boundaries.** Prefer readonly borrowed values; materialize or defensively validate only at parser/config, queued, model/tool JSON, durable/file, worker, process, or wire boundaries. +- **Represent one asynchronous operation with one lifecycle controller or transaction.** Separate readiness, cancellation, disposal, reservation, or sentinel state requires an independent owner or settlement boundary; otherwise fold it while preserving rollback, callback containment, and quiescence. Naming notes: diff --git a/packages/cordis/tool-cordis/src/api-catalog.ts b/packages/cordis/tool-cordis/src/api-catalog.ts index 88b89f5d3b..3ee6d1081f 100644 --- a/packages/cordis/tool-cordis/src/api-catalog.ts +++ b/packages/cordis/tool-cordis/src/api-catalog.ts @@ -54,7 +54,7 @@ export interface TypeApiEntry { export const SERVICE_API: readonly ServiceApiEntry[] = [ { key: 'agentLoop', - summary: 'The agent-loop plugin (`ctx.agentLoop`): creates ReactLoopAgents, runs their loops, and registers them in `ctx.agents`.', + summary: 'Concrete ReactLoopAgent factory and driver service.', methods: [ 'create(id: AgentId, options: AgentOptions = {}, meta: Pick = {}): ReactLoopAgent', 'async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise', @@ -65,12 +65,11 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ key: 'agents', summary: 'Agent registry (`ctx.agents`): tracks live agents so UI, hook, and orchestrator plugins can find them without depending on the concrete loop package.', methods: [ - 'reserve(id: AgentId): AgentRegistrationReservation', 'setFactory(factory: AgentFactory): () => Promise | void', 'async create(options: CreateAgentOptions): Promise', 'async resume(options: ResumeAgentOptions): Promise', 'register(agent: Agent): () => Promise | void', - 'enter(agent: Agent, reservation?: AgentRegistrationReservation): () => void', + 'enter(agent: Agent): () => void', 'announce(agent: Agent): void', 'get(id: AgentId): Agent | undefined', 'list(): Agent[]', @@ -156,10 +155,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ key: 'sessions', summary: 'In-memory session store (`ctx.sessions`).', methods: [ - 'reserve(id: SessionId): SessionRegistrationReservation', 'create(id?: SessionId, options?: CreateSessionOptions): Session', 'prepare(id?: SessionId, options?: CreateSessionOptions): Session', - 'enter(session: Session, reservation?: SessionRegistrationReservation): () => void', + 'enter(session: Session): () => void', 'announce(session: Session): void', 'async flush(session: Session): Promise', 'get(id: SessionId): Session | undefined', @@ -179,22 +177,21 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ }, { key: 'subagents', - summary: 'The `subagents` service: a registry of named SubagentProviders and a capability-checked start surface.', + summary: 'Named provider registry and capability-checked start surface.', methods: [ 'registerProvider(provider: SubagentProvider): () => Promise | void', 'getProvider(name: string): SubagentProvider | undefined', 'list(): string[]', - 'start(name: string, request: SubagentStartRequest): SubagentRun', + 'async start(name: string, request: SubagentStartRequest): Promise', ], }, { key: 'systemPrompt', - summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contribution protections; the agent loop calls `assemble(context)` once per step.', + summary: 'Registry service (`ctx.systemPrompt`): plugins contribute ordered text sections, tool-schema providers, named prompt variables, and owner-final contributions; the agent loop calls `assemble(context)` once per step.', methods: [ 'section(section: PromptSection): () => Promise | void', 'tools(provider: (context: AssembleContext) => ToolProviderResult): () => Promise | void', 'variable(name: string, provider: (context: AssembleContext) => string | undefined): () => Promise | void', - 'protect(protection: PromptProtection): () => Promise | void', 'async assemble(context: AssembleContext = {}): Promise', ], }, @@ -205,10 +202,8 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ 'register(definition: ToolDefinition): () => Promise | void', 'restrict(filter: ToolRestriction): () => Promise | void', 'guard(guard: ToolGuard): () => Promise | void', - 'visible(scope?: ScopeKey): ToolDefinition[]', 'get(name: string, scope?: ScopeKey): ToolDefinition | undefined', 'schemas(scope?: ScopeKey): ToolSchema[]', - 'knownNames(scope?: ScopeKey): string[]', 'async execute(exec: ToolExecutionInput): Promise', ], }, @@ -389,25 +384,25 @@ export const EVENT_API: readonly EventApiEntry[] = [ name: 'subagent/end', mode: 'emit', signature: '\'subagent/end\'(this: Scoped, info: SubagentRunEndInfo): void', - summary: 'A started subagent run settled — emitted when SubagentRun.result resolves (any stop reason) or rejects (reported as `error`).', + summary: 'A ready child settled.', }, { name: 'subagent/provider-added', mode: 'emit', signature: '\'subagent/provider-added\'(provider: SubagentProvider): void', - summary: 'A provider became resolvable in the SubagentService registry.', + summary: 'A provider became resolvable in the registry.', }, { name: 'subagent/provider-removed', mode: 'emit', signature: '\'subagent/provider-removed\'(name: string): void', - summary: 'A provider left the registry (its plugin\'s fiber was disposed — an unload or an HMR reload).', + summary: 'A provider left the registry.', }, { name: 'subagent/start', mode: 'emit', signature: '\'subagent/start\'(this: Scoped, info: SubagentRunInfo): void', - summary: 'A subagent run started — emitted only after SubagentRun.started fulfills, when the provider has established a live child.', + summary: 'A provider established a ready child.', }, { name: 'system-prompt/assemble', @@ -419,7 +414,7 @@ export const EVENT_API: readonly EventApiEntry[] = [ name: 'system-prompt/change', mode: 'emit', signature: '\'system-prompt/change\'(): void', - summary: 'A section, tool provider, variable provider, or protection was registered or unregistered (the assembly inputs changed — possibly for one scope only).', + summary: 'A section, tool provider, or variable provider was registered or unregistered (the assembly inputs changed — possibly for one scope only).', }, { name: 'tools/change', @@ -436,7 +431,7 @@ export const EVENT_API: readonly EventApiEntry[] = [ { name: 'tools/post-execute', mode: 'waterfall', - signature: '\'tools/post-execute\'(this: Scoped, exec: ToolExecution, result: ToolExecutionResult, next: () => Promise): Promise', + signature: '\'tools/post-execute\'(this: Scoped, exec: ToolExecution, result: Readonly, next: () => Promise): Promise', summary: 'Waterfall AFTER a tool runs — where hook plugins inspect the result and accept it (optionally REPLACING the model-facing content, and/or attaching `additionalContext` for the next request) or block it with corrective `feedback` (Claude Code\'s `PostToolUse`).', }, { @@ -511,10 +506,6 @@ export const TYPE_API: readonly TypeApiEntry[] = [ name: 'AgentOptions', declaration: 'export interface AgentOptions {\n model?: string;\n}', }, - { - name: 'AgentRegistrationReservation', - declaration: 'export interface AgentRegistrationReservation {\n readonly id: AgentId;\n release(): void;\n}', - }, { name: 'AgentStatus', declaration: 'export type AgentStatus = \'idle\' | \'running\' | \'disposed\';', @@ -525,7 +516,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ApprovalRequest', - declaration: 'export interface ApprovalRequest {\n agent: Agent;\n toolName: string;\n callId?: CallId;\n reason?: string;\n signal?: AbortSignal;\n}', + declaration: 'export interface ApprovalRequest {\n readonly agent: Agent;\n readonly toolName: string;\n readonly callId?: CallId;\n readonly reason?: string;\n readonly signal?: AbortSignal;\n}', }, { name: 'AskUserQuestionAnswer', @@ -653,11 +644,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'CreateAgentOptions', - declaration: 'export interface CreateAgentOptions {\n agentId: AgentId;\n sessionId: SessionId;\n meta?: {\n cwd?: string;\n parentSession?: SessionId;\n seedLength?: number;\n };\n seed?: SessionEvent[];\n agentOptions?: AgentOptions;\n setup?: (agentCtx: Context) => Promise | void;\n}', + declaration: 'export interface CreateAgentOptions {\n readonly agentId: AgentId;\n readonly sessionId: SessionId;\n readonly meta?: {\n readonly cwd?: string;\n readonly parentSession?: SessionId;\n readonly seedLength?: number;\n };\n readonly seed?: readonly SessionEvent[];\n readonly agentOptions?: AgentOptions;\n readonly signal?: AbortSignal;\n readonly setup?: (agentCtx: Context) => Promise | void;\n}', }, { name: 'CreateSessionOptions', - declaration: 'export interface CreateSessionOptions {\n seed?: SessionEvent[];\n meta?: {\n cwd?: string;\n parentSession?: SessionId;\n createdAt?: number;\n seedLength?: number;\n };\n}', + declaration: 'export interface CreateSessionOptions {\n readonly seed?: readonly SessionEvent[];\n readonly meta?: {\n readonly cwd?: string;\n readonly parentSession?: SessionId;\n readonly createdAt?: number;\n readonly seedLength?: number;\n };\n}', }, { name: 'DiffCallView', @@ -755,13 +746,9 @@ export const TYPE_API: readonly TypeApiEntry[] = [ name: 'PromptAssembly', declaration: 'export interface PromptAssembly {\n sections: AssembledSection[];\n tools: ToolSchema[];\n variables: Record;\n}', }, - { - name: 'PromptProtection', - declaration: 'export interface PromptProtection {\n sections?: readonly string[];\n tools?: readonly string[];\n}', - }, { name: 'PromptSection', - declaration: 'export interface PromptSection {\n name: string;\n order: number;\n text: string | ((context: AssembleContext) => string);\n}', + declaration: 'export interface PromptSection {\n readonly name: string;\n readonly order: number;\n readonly text: string | ((context: AssembleContext) => string);\n readonly ownerFinal?: boolean;\n}', }, { name: 'ReasoningBlock', @@ -769,7 +756,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ResumeAgentOptions', - declaration: 'export interface ResumeAgentOptions {\n agentId: AgentId;\n resumeSessionId: SessionId;\n agentOptions?: AgentOptions;\n setup?: (agentCtx: Context) => Promise | void;\n}', + declaration: 'export interface ResumeAgentOptions {\n readonly agentId: AgentId;\n readonly resumeSessionId: SessionId;\n readonly agentOptions?: AgentOptions;\n readonly signal?: AbortSignal;\n readonly setup?: (agentCtx: Context) => Promise | void;\n}', }, { name: 'SandboxEnforcement', @@ -809,23 +796,19 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'SessionHeader', - declaration: 'export interface SessionHeader {\n version: number;\n id: SessionId;\n createdAt: number;\n cwd?: string;\n parentSession?: SessionId;\n seedLength?: number;\n}', + declaration: 'export interface SessionHeader {\n readonly version: number;\n readonly id: SessionId;\n readonly createdAt: number;\n readonly cwd?: string;\n readonly parentSession?: SessionId;\n readonly seedLength?: number;\n}', }, { name: 'SessionId', declaration: 'export type SessionId = Branded<\'SessionId\'>;', }, - { - name: 'SessionRegistrationReservation', - declaration: 'export interface SessionRegistrationReservation {\n readonly id: SessionId;\n prepare(options?: CreateSessionOptions): Session;\n release(): void;\n}', - }, { name: 'SkillCandidate', - declaration: 'export interface SkillCandidate extends SkillSummary {\n rank: number;\n locator: unknown;\n path?: string;\n metadata?: Record;\n}', + declaration: 'export interface SkillCandidate extends SkillSummary {\n readonly rank: number;\n readonly locator: unknown;\n readonly path?: string;\n readonly metadata?: Readonly>;\n}', }, { name: 'SkillDefinition', - declaration: 'export interface SkillDefinition extends SkillSummary {\n content: string;\n path?: string;\n metadata?: Record;\n}', + declaration: 'export interface SkillDefinition extends SkillSummary {\n readonly content: string;\n readonly path?: string;\n readonly metadata?: Readonly>;\n}', }, { name: 'SkillLookupOptions', @@ -833,15 +816,15 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'SkillProvider', - declaration: 'export interface SkillProvider {\n name: string;\n list(options: SkillLookupOptions): Promise;\n get(candidate: SkillCandidate, options: SkillLookupOptions): Promise;\n}', + declaration: 'export interface SkillProvider {\n readonly name: string;\n readonly list: (options: SkillLookupOptions) => Promise;\n readonly get: (candidate: SkillCandidate, options: SkillLookupOptions) => Promise;\n}', }, { name: 'SkillRegistration', - declaration: 'export type SkillRegistration = Omit & {\n provider?: string;\n};', + declaration: 'export type SkillRegistration = Omit & {\n readonly provider?: string;\n};', }, { name: 'SkillResourceBase', - declaration: 'export type SkillResourceBase = {\n kind: \'directory\';\n path: string;\n} | {\n kind: \'url\';\n url: string;\n} | {\n kind: \'opaque\';\n description: string;\n};', + declaration: 'export type SkillResourceBase = {\n readonly kind: \'directory\';\n readonly path: string;\n} | {\n readonly kind: \'url\';\n readonly url: string;\n} | {\n readonly kind: \'opaque\';\n readonly description: string;\n};', }, { name: 'SkillSource', @@ -849,7 +832,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'SkillSummary', - declaration: 'export interface SkillSummary {\n name: string;\n description: string;\n whenToUse?: string;\n disableModelInvocation?: boolean;\n source: SkillSource;\n provider: string;\n resourceBase?: SkillResourceBase;\n}', + declaration: 'export interface SkillSummary {\n readonly name: string;\n readonly description: string;\n readonly whenToUse?: string;\n readonly disableModelInvocation?: boolean;\n readonly source: SkillSource;\n readonly provider: string;\n readonly resourceBase?: SkillResourceBase;\n}', }, { name: 'StreamChunk', @@ -873,23 +856,23 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'SubagentCapabilities', - declaration: 'export interface SubagentCapabilities {\n outputSchema: boolean;\n depthLimit: boolean;\n toolFilter: boolean;\n persona: boolean;\n}', + declaration: 'export interface SubagentCapabilities {\n readonly outputSchema: boolean;\n readonly depthLimit: boolean;\n readonly toolFilter: boolean;\n readonly persona: boolean;\n}', }, { name: 'SubagentProvider', - declaration: 'export interface SubagentProvider {\n readonly name: string;\n readonly capabilities: SubagentCapabilities;\n readonly inheritsParentContext: boolean;\n start(request: SubagentStartRequest): SubagentRun;\n}', + declaration: 'export interface SubagentProvider {\n readonly name: string;\n readonly capabilities: SubagentCapabilities;\n readonly inheritsParentContext: boolean;\n start(request: SubagentStartRequest): Promise;\n}', }, { name: 'SubagentResult', - declaration: 'export interface SubagentResult {\n output: ContentBlock[];\n structured?: unknown;\n stopReason: SubagentStopReason;\n}', + declaration: 'export interface SubagentResult {\n readonly output: ContentBlock[];\n readonly structured?: unknown;\n readonly stopReason: SubagentStopReason;\n}', }, { name: 'SubagentRun', - declaration: 'export interface SubagentRun {\n readonly id: AgentId;\n readonly started: Promise;\n readonly result: Promise;\n cancel(reason?: string): void;\n dispose(): Promise;\n sendMessage?(content: ContentBlock[]): void;\n resume?(content: ContentBlock[]): SubagentRun;\n}', + declaration: 'export interface SubagentRun {\n readonly id: AgentId;\n readonly result: Promise;\n dispose(): Promise;\n sendMessage?(content: ContentBlock[]): void;\n resume?(content: ContentBlock[]): Promise;\n}', }, { name: 'SubagentStartRequest', - declaration: 'export interface SubagentStartRequest {\n prompt: ContentBlock[];\n parent: Agent;\n signal?: AbortSignal;\n agentOptions?: AgentOptions;\n outputSchema?: StructuredOutputSchema;\n maxDepth?: number;\n toolFilter?: {\n allow?: string[];\n deny?: string[];\n };\n persona?: string;\n}', + declaration: 'export interface SubagentStartRequest {\n readonly prompt: ContentBlock[];\n readonly parent: Agent;\n readonly signal: AbortSignal;\n readonly agentOptions?: AgentOptions;\n readonly outputSchema?: StructuredOutputSchema;\n readonly maxDepth?: number;\n readonly toolFilter?: ToolRestriction;\n readonly persona?: string;\n}', }, { name: 'SubagentStopReason', @@ -937,7 +920,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ToolDefinition', - declaration: 'export interface ToolDefinition extends ToolSchema {\n execute(args: unknown, exec: ToolExecution): Promise;\n timeoutMs?: number;\n presentCall?(args: unknown): ToolCallView | undefined;\n presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}', + declaration: 'export interface ToolDefinition extends ToolSchema {\n execute(args: unknown, exec: ToolExecution): Promise;\n timeoutMs?: number;\n readonly ownerFinal?: boolean;\n presentCall?(args: unknown): ToolCallView | undefined;\n presentResult?(args: unknown, result: ToolResult): ToolResultView | undefined;\n}', }, { name: 'ToolErrorInfo', @@ -961,7 +944,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ToolExecutionToken', - declaration: 'export interface ToolExecutionToken {\n readonly [toolExecutionTokenBrand]: true;\n}', + declaration: 'export type ToolExecutionToken = symbol & {\n readonly [toolExecutionTokenBrand]: true;\n};', }, { name: 'ToolGuard', @@ -969,11 +952,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ToolProviderResult', - declaration: 'export interface ToolProviderResult {\n schemas: ToolSchema[];\n knownNames?: readonly string[];\n}', + declaration: 'export interface ToolProviderResult {\n readonly schemas: readonly ToolSchema[];\n readonly knownNames?: readonly string[];\n readonly ownerFinalNames?: readonly string[];\n}', }, { name: 'ToolRestriction', - declaration: 'export interface ToolRestriction {\n allow?: string[];\n deny?: string[];\n}', + declaration: 'export interface ToolRestriction {\n readonly allow?: readonly string[];\n readonly deny?: readonly string[];\n}', }, { name: 'ToolResult', diff --git a/packages/core/agent-loop/tests/loop.spec.ts b/packages/core/agent-loop/tests/loop.spec.ts index f1c3e9af9d..71be5b339e 100644 --- a/packages/core/agent-loop/tests/loop.spec.ts +++ b/packages/core/agent-loop/tests/loop.spec.ts @@ -272,7 +272,7 @@ describe('agent loop', () => { expect(result.data.meta).toBeUndefined() expect(result.data.content).toEqual([{ type: 'text', - text: 'Error: tools/execute must return a losslessly JSON-serializable ToolExecutionResult', + text: 'Error: tool result must be losslessly JSON-serializable', }]) } // The normalized failure was durably logged and fed back to the model; the diff --git a/packages/subagent/subagent/src/index.ts b/packages/subagent/subagent/src/index.ts index 559825d404..6332a0a458 100644 --- a/packages/subagent/subagent/src/index.ts +++ b/packages/subagent/subagent/src/index.ts @@ -73,14 +73,17 @@ declare module 'cordis' { /** * A provider established a ready child. For in-process providers, * `ctx.agents.get(info.id)` resolves during this notification. - * Scope-filtered by the delegating parent and paired with `subagent/end`. + * Scope-filtered dispatch keys the carrier by the delegating parent, so a + * parent-scoped listener observes only its own delegations. Paired with + * `subagent/end`. * @param info - the provider and ready child identity. * @mode emit */ 'subagent/start'(this: Scoped, info: SubagentRunInfo): void /** - * A ready child settled. Scope-filtered by the delegating parent and - * paired with `subagent/start`. + * A ready child settled. Scope-filtered dispatch uses the same delegating + * parent carrier as `subagent/start`, so the lifecycle pair reaches the + * same scoped audience. * @param info - the run identity and terminal outcome. * @mode emit */ diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts index ae1fa8d170..68139e9ff8 100644 --- a/scripts/gen-cordis-catalog.ts +++ b/scripts/gen-cordis-catalog.ts @@ -81,7 +81,6 @@ const FENCE = 'ts cordis-catalog' */ export const LINK_MAP: Record = { Agent: 'core.md', - AgentRegistrationReservation: 'core.md', ContentBlock: 'core.md', Message: 'core.md', MessageSource: 'core.md', @@ -89,7 +88,6 @@ export const LINK_MAP: Record = { LlmCallConfig: 'core.md', SessionEvent: 'core.md', SessionStartSource: 'core.md', - SessionRegistrationReservation: 'session.md', StreamChunk: 'llm-streaming.md', TurnEndReason: 'session.md', ToolDefinition: 'tools.md', diff --git a/scripts/gen-doc-graphs.ts b/scripts/gen-doc-graphs.ts index c36a50c244..c4c8186f38 100644 --- a/scripts/gen-doc-graphs.ts +++ b/scripts/gen-doc-graphs.ts @@ -588,12 +588,12 @@ function collectEventRelations(): Map { if (method === 'on') { const event = eventArg(node.arguments, method) if (event) ensure(event).listeners.add(leaf) - } else if (method === 'emit' || method === 'parallel' || method === 'serial' || method === 'strictSerial' || method === 'waterfall') { + } else if (method === 'emit' || method === 'parallel' || method === 'serial' || method === 'waterfall') { const event = eventArg(node.arguments, method) if (event) { const relation = ensure(event) const methods = relation.dispatchers.get(leaf) ?? new Set() - methods.add(method === 'strictSerial' ? 'strictSerial (serial)' : method) + methods.add(method) relation.dispatchers.set(leaf, methods) } } diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json index 62111d1551..a219ea1b1d 100644 --- a/scripts/type-equiv.manifest.json +++ b/scripts/type-equiv.manifest.json @@ -11,7 +11,6 @@ { "doc": "docs/core-data-structures/core.md", "symbol": "LlmCallConfig", "source": "packages/llm/llm/src/call-config.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "SessionEvent", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "Agent", "source": "packages/core/agent/src/types.ts" }, - { "doc": "docs/core-data-structures/core.md", "symbol": "AgentRegistrationReservation", "source": "packages/core/agent/src/index.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "HookContext", "source": "packages/core/agent/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "PromptDecision", "source": "packages/core/agent/src/types.ts" }, { "doc": "docs/core-data-structures/core.md", "symbol": "ContinuationDecision", "source": "packages/core/agent/src/types.ts" }, @@ -23,8 +22,8 @@ { "doc": "docs/core-data-structures/scope.md", "symbol": "Scope", "source": "packages/core/scope/src/index.ts" }, { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "AssembleContext", "source": "packages/core/system-prompt/src/index.ts" }, + { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "PromptSection", "source": "packages/core/system-prompt/src/index.ts" }, { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "ToolProviderResult", "source": "packages/core/system-prompt/src/index.ts" }, - { "doc": "docs/core-data-structures/system-prompt.md", "symbol": "PromptProtection", "source": "packages/core/system-prompt/src/index.ts" }, { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "StreamChunk", "source": "packages/llm/llm/src/types.ts" }, { "doc": "docs/core-data-structures/llm-streaming.md", "symbol": "TokenUsage", "source": "packages/llm/llm/src/types.ts" }, @@ -41,7 +40,6 @@ { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceOp", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceIntent", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/session.md", "symbol": "SurfaceNode", "source": "packages/core/session/src/surface.ts" }, - { "doc": "docs/core-data-structures/session.md", "symbol": "SessionRegistrationReservation", "source": "packages/core/session/src/index.ts" }, { "doc": "docs/core-data-structures/persistence.md", "symbol": "SessionHeader", "source": "packages/core/session/src/types.ts" }, { "doc": "docs/core-data-structures/persistence.md", "symbol": "CreateSessionOptions", "source": "packages/core/session/src/types.ts" }, @@ -54,6 +52,7 @@ { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecutionInput", "source": "packages/core/tools/src/index.ts" }, { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecution", "source": "packages/core/tools/src/index.ts" }, { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolGuard", "source": "packages/core/tools/src/index.ts" }, + { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolRestriction", "source": "packages/core/tools/src/index.ts" }, { "doc": "docs/core-data-structures/tools.md", "symbol": "ToolExecutionResult", "source": "packages/core/tools/src/index.ts" }, { "doc": "docs/core-data-structures/tools.md", "symbol": "PreToolDecision", "source": "packages/core/tools/src/index.ts" }, { "doc": "docs/core-data-structures/tools.md", "symbol": "PostToolDecision", "source": "packages/core/tools/src/index.ts" }, From 738054562d7bee3999ff2aee9fd8832597ebbd2f Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 23:15:07 +0800 Subject: [PATCH 20/21] fix: complete scoped lifecycle simplification --- packages/core/agent-loop/src/index.ts | 30 +++---- packages/core/agent-loop/tests/agent.spec.ts | 14 +++ packages/core/agent-loop/tests/resume.spec.ts | 22 +++++ .../agent-loop/tests/scope-lifecycle.spec.ts | 90 +++++++++++++++++++ packages/core/agent/src/index.ts | 1 + packages/core/session/src/index.ts | 1 + packages/core/tools/src/index.ts | 3 +- packages/core/tools/tests/scoped.spec.ts | 15 ++++ packages/skill/skill/src/index.ts | 1 - packages/subagent/subagent-acp/src/run.ts | 5 ++ .../subagent-acp/tests/subagent-acp.spec.ts | 17 +++- .../subagent-mock/tests/subagent-mock.spec.ts | 20 +++++ packages/ui/user-approval/src/index.ts | 3 - .../ui/user-approval/tests/approval.spec.ts | 20 ----- .../workflow-workerthread/src/host.ts | 8 +- .../tests/workflow-workerthread.spec.ts | 61 +++++++++++++ 16 files changed, 261 insertions(+), 50 deletions(-) diff --git a/packages/core/agent-loop/src/index.ts b/packages/core/agent-loop/src/index.ts index 3f717378d2..4ad4779176 100644 --- a/packages/core/agent-loop/src/index.ts +++ b/packages/core/agent-loop/src/index.ts @@ -54,7 +54,6 @@ class FactoryOwnership { } track(transaction: AgentCreationTransaction): () => void { - if (!this.isActive()) throw new Error('agent loop is not active') this.transactions.add(transaction) return () => { this.transactions.delete(transaction) } } @@ -62,12 +61,9 @@ class FactoryOwnership { async dispose(): Promise { this.accepting = false const reason = new Error('agent loop is not active') - const results = await Promise.allSettled( + await Promise.all( [...this.transactions].map(transaction => transaction.disposeForFactory(reason)), ) - const errors = results.flatMap(result => result.status === 'rejected' ? [result.reason as unknown] : []) - if (errors.length === 1) throw errors[0] - if (errors.length > 1) throw new AggregateError(errors, 'agent loop transaction disposal failed') } } @@ -101,8 +97,6 @@ class AgentCreationTransaction { private detachAgent: (() => void) | undefined private publishing = false private cleanupTask: Promise | undefined - private finished = false - private wrapperFinished = false private ownerFollowing = true private readonly ownerDispose: () => Promise | void private readonly untrackFactory: () => void @@ -120,20 +114,17 @@ class AgentCreationTransaction { ownerCtx.fiber.assertActive() this.ownerAgent = ownerCtx.agent this.ownerFiber = ownerCtx.fiber + if (!ownership.isActive()) throw new Error('agent loop is not active') + this.ownerDispose = ownerCtx.effect(() => () => { + if (!this.ownerFollowing) return + return this.dispose(new Error(`agent "${id}" setup aborted: owner disposed during setup`)) + }, `agentLoop.owner(${id})`) this.untrackFactory = ownership.track(this) - try { - this.ownerDispose = ownerCtx.effect(() => () => { - if (!this.ownerFollowing) return - return this.dispose(new Error(`agent "${id}" setup aborted: owner disposed during setup`)) - }, `agentLoop.owner(${id})`) - } catch (error: unknown) { - this.untrackFactory() - throw error - } if (signal === undefined) { this.abortListener = undefined } else { this.abortListener = () => { + /* v8 ignore next 3 -- transaction teardown contains callback/driver failures; rejection is a future-drift backstop. */ void this.dispose(signalAbortError(id, signal)).catch((error: unknown) => { this.loopCtx.logger.error(error) }) @@ -168,6 +159,7 @@ class AgentCreationTransaction { return await Promise.race([ Promise.resolve(operation), this.deactivation.promise.then(() => { + /* v8 ignore next -- deactivate() assigns failure before resolving deactivation. */ throw this.failure ?? new Error(`agent "${this.id}" creation deactivated`) }), ]) @@ -229,9 +221,11 @@ class AgentCreationTransaction { publish(source: SessionStartSource): AgentHandle { this.assertActive() const driver = this.driver + /* v8 ignore next -- publish() is private and every caller invokes prepare() first. */ if (driver === undefined) throw new Error(`agent "${this.id}" is not prepared`) const agent = driver.agent const session = this.session + /* v8 ignore next -- prepare() assigns the session before it can produce the driver above. */ if (session === undefined) throw new Error(`agent "${this.id}" has no prepared session`) this.publishing = true try { @@ -274,8 +268,6 @@ class AgentCreationTransaction { /** Complete ownership bookkeeping after every resource reached quiescence. */ private finish(): void { - if (this.finished) return - this.finished = true this.untrackFactory() this.ownerFollowing = false void this.ownerDispose() @@ -310,8 +302,6 @@ class AgentCreationTransaction { /** Mark the public create/resume continuation settled and detach its creation-only signal. */ finishWrapper(): void { - if (this.wrapperFinished) return - this.wrapperFinished = true if (this.signal !== undefined && this.abortListener !== undefined) { this.signal.removeEventListener('abort', this.abortListener) } diff --git a/packages/core/agent-loop/tests/agent.spec.ts b/packages/core/agent-loop/tests/agent.spec.ts index 95b5440fe1..7f65bbc5f3 100644 --- a/packages/core/agent-loop/tests/agent.spec.ts +++ b/packages/core/agent-loop/tests/agent.spec.ts @@ -49,6 +49,20 @@ function send(agent: ReactLoopAgent, text: string) { } describe('ReactLoopAgent', () => { + it('rejects access before context binding and a second driver for one session', async () => { + const ctx = new Context() + await ctx.plugin(SessionStore) + const session = ctx.sessions.create(SessionId('exclusive-driver')) + const prepared = prepareReactLoopAgent(ctx, AgentId('first-driver'), { model: 'mock' }, session) + + expect(() => prepared.agent.ctx).toThrow('context is not bound') + expect(() => prepareReactLoopAgent(ctx, AgentId('second-driver'), { model: 'mock' }, session)) + .toThrow('already has a concrete agent driver') + + await prepared.dispose() + await ctx.fiber.dispose() + }) + it('borrows caller options and binds its scoped context exactly once', async () => { const ctx = await harness(new MockAdapter([textResponse('unused')])) const options = { model: 'mock' } diff --git a/packages/core/agent-loop/tests/resume.spec.ts b/packages/core/agent-loop/tests/resume.spec.ts index 2c9fc78177..93605008ec 100644 --- a/packages/core/agent-loop/tests/resume.spec.ts +++ b/packages/core/agent-loop/tests/resume.spec.ts @@ -69,7 +69,29 @@ async function promptly(task: Promise): Promise { } } +/** Throw an arbitrary callback value to exercise the public unknown-error boundary. */ +function throwUnknown(value: unknown): never { + throw value +} + describe('the session-persistence RFC: AgentLoop factory create/resume', () => { + it('normalizes a non-Error resume publication failure for rollback and rethrows it', async () => { + const sessionId = SessionId('unknown-resume-failure-s') + const root = await persistSession(sessionId) + const ctx = await mountPersistentHarness(root, new MockAdapter([textResponse('next')])) + const failure = { source: 'resume' } + ctx.on('session/created', () => throwUnknown(failure)) + + await expect(ctx.agents.resume({ + agentId: AgentId('unknown-resume-failure'), + resumeSessionId: sessionId, + })).rejects.toBe(failure) + + expect(ctx.agents.get(AgentId('unknown-resume-failure'))).toBeUndefined() + expect(ctx.sessions.get(sessionId)).toBeUndefined() + await ctx.fiber.dispose() + }) + it('createAgent uses the caller-supplied sessionId (not ${id}-session)', async () => { const adapter = new MockAdapter([textResponse('hi')]) const { ctx } = await persistentHarness(adapter) diff --git a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts index 65ebbff8dd..2c478ad1f0 100644 --- a/packages/core/agent-loop/tests/scope-lifecycle.spec.ts +++ b/packages/core/agent-loop/tests/scope-lifecycle.spec.ts @@ -40,6 +40,11 @@ function waitForIdle(ctx: Context, agent: ReactLoopAgent): Promise { const text = (t: string): ContentBlock[] => [{ type: 'text', text: t }] +/** Throw an arbitrary callback value to exercise the public unknown-error boundary. */ +function throwUnknown(value: unknown): never { + throw value +} + /** Invoke the exact lifecycle effect to exercise same-stack reentrant teardown. */ function disposeCurrentLifecycle(ownerCtx: Context): void { const lifecycle = [...ownerCtx.fiber._disposables] @@ -52,6 +57,91 @@ function disposeCurrentLifecycle(ownerCtx: Context): void { } describe('agent scope lifecycle', () => { + it('rejects an already-aborted creation signal before publishing either identity', async () => { + const ctx = await harness() + const reason = new Error('cancelled before creation') + const controller = new AbortController() + controller.abort(reason) + + await expect(ctx.agents.create({ + agentId: AgentId('pre-aborted'), + sessionId: SessionId('pre-aborted-s'), + signal: controller.signal, + })).rejects.toBe(reason) + + expect(ctx.agents.get(AgentId('pre-aborted'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('pre-aborted-s'))).toBeUndefined() + + const valueController = new AbortController() + valueController.abort('plain cancellation reason') + await expect(ctx.agents.create({ + agentId: AgentId('pre-aborted-value'), + sessionId: SessionId('pre-aborted-value-s'), + signal: valueController.signal, + })).rejects.toMatchObject({ + message: 'agent "pre-aborted-value" creation aborted', + cause: 'plain cancellation reason', + }) + + expect(ctx.agents.get(AgentId('pre-aborted-value'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('pre-aborted-value-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('joins cleanup when an abort lands reentrantly during scope preparation', async () => { + const ctx = await harness() + const reason = new Error('cancelled while preparing') + const controller = new AbortController() + let aborted = false + ctx.on('internal/plugin', (fiber) => { + if (aborted || fiber.name !== 'scope') return + aborted = true + controller.abort(reason) + }) + + await expect(ctx.agents.create({ + agentId: AgentId('prepare-abort'), + sessionId: SessionId('prepare-abort-s'), + signal: controller.signal, + })).rejects.toBe(reason) + + expect(ctx.agents.get(AgentId('prepare-abort'))).toBeUndefined() + expect(ctx.sessions.get(SessionId('prepare-abort-s'))).toBeUndefined() + await ctx.fiber.dispose() + }) + + it('normalizes non-Error create failures for rollback while rethrowing the original value', async () => { + const ctx = await harness() + let thrown: unknown + ctx.on('session/created', () => { + if (thrown === undefined) return + const value = thrown + thrown = undefined + throwUnknown(value) + }) + + const createFailure = { source: 'create' } + thrown = createFailure + let createCaught: unknown + try { + ctx.agentLoop.create(AgentId('unknown-create')) + } catch (error: unknown) { + createCaught = error + } + expect(createCaught).toBe(createFailure) + + const ownedFailure = { source: 'createAgent' } + thrown = ownedFailure + await expect(ctx.agents.create({ + agentId: AgentId('unknown-owned-create'), + sessionId: SessionId('unknown-owned-create-s'), + })).rejects.toBe(ownedFailure) + + expect(ctx.agents.get(AgentId('unknown-create'))).toBeUndefined() + expect(ctx.agents.get(AgentId('unknown-owned-create'))).toBeUndefined() + await ctx.fiber.dispose() + }) + it('wires agent.ctx: tagged with the agent, DX field set, ctx.agent safe elsewhere', async () => { const ctx = await harness() const agent = ctx.agentLoop.create(AgentId('a1'), { model: 'mock' }) diff --git a/packages/core/agent/src/index.ts b/packages/core/agent/src/index.ts index 07ec5adb99..42b9d13e35 100644 --- a/packages/core/agent/src/index.ts +++ b/packages/core/agent/src/index.ts @@ -364,6 +364,7 @@ export class AgentRegistry extends Service { entry.detachRequested = false // A stale capability can never delete a later same-id lifecycle. The // captured entry identity is the final boundary. + /* v8 ignore next -- enter() rejects replacement while this single-shot detach capability is live. */ if (this.store.get(entry.id) !== entry) return this.store.delete(entry.id) this.entries.delete(entry.agent) diff --git a/packages/core/session/src/index.ts b/packages/core/session/src/index.ts index b671ad195b..6ce38bbffe 100644 --- a/packages/core/session/src/index.ts +++ b/packages/core/session/src/index.ts @@ -731,6 +731,7 @@ export class SessionStore extends Service { entry.detachRequested = false // A stale capability cannot remove observers or storage belonging to a // later same-id lifecycle. + /* v8 ignore next -- enter() rejects replacement while this single-shot detach capability is live. */ if (this.store.get(entry.id) !== entry) return this.store.delete(entry.id) attachments.delete(entry.session) diff --git a/packages/core/tools/src/index.ts b/packages/core/tools/src/index.ts index 3365662458..84a1ec3c51 100644 --- a/packages/core/tools/src/index.ts +++ b/packages/core/tools/src/index.ts @@ -843,7 +843,8 @@ export class ToolRegistry extends Service { // invariant assertion as well as protection against future layer changes. if (this.codeTransport !== undefined) { visible.set(RUN_CODE_NAME, this.codeTransport) - if (this.codeTransport.ownerFinal === true) ownerFinalNames.add(RUN_CODE_NAME) + // createRunCodeTool() owns this internal transport and always marks it owner-final. + ownerFinalNames.add(RUN_CODE_NAME) } return { visible, knownNames, restrictableNames, ownerFinalNames } } diff --git a/packages/core/tools/tests/scoped.spec.ts b/packages/core/tools/tests/scoped.spec.ts index caf3ccb7be..991d420054 100644 --- a/packages/core/tools/tests/scoped.spec.ts +++ b/packages/core/tools/tests/scoped.spec.ts @@ -103,6 +103,21 @@ describe('scoped tool registration', () => { .toThrow(/owner-final tool "reserved" cannot be registered while a scoped shadow exists/) }) + it('restores global and scoped owner-final tools removed by assembly middleware', async () => { + const ctx = await mount() + const { scope, key } = await mintAgentScope(ctx, 'owner-final') + ctx.tools.register({ ...tool('required'), ownerFinal: true }) + scope.ctx.tools.register({ ...tool('scoped-required'), ownerFinal: true }) + ctx.on('system-prompt/assemble', async assembly => ({ + ...assembly, + tools: assembly.tools.filter(schema => !schema.name.includes('required')), + })) + + expect((await ctx.systemPrompt.assemble()).tools.map(schema => schema.name)).toContain('required') + expect((await ctx.systemPrompt.assemble({ scope: key })).tools.map(schema => schema.name)) + .toEqual(expect.arrayContaining(['required', 'scoped-required'])) + }) + it('disposing the scope unwinds its registrations and leaves no residue', async () => { const ctx = await mount() const { scope, key } = await mintAgentScope(ctx, 'a') diff --git a/packages/skill/skill/src/index.ts b/packages/skill/skill/src/index.ts index af4af6f7a2..f2ece2379f 100644 --- a/packages/skill/skill/src/index.ts +++ b/packages/skill/skill/src/index.ts @@ -527,7 +527,6 @@ function waitWithAbort(promise: Promise, signal: AbortSignal | undefined): reject(toError(error)) }, ) - if (signal.aborted) onAbort() }) } diff --git a/packages/subagent/subagent-acp/src/run.ts b/packages/subagent/subagent-acp/src/run.ts index 54a5641d96..5222906a2d 100644 --- a/packages/subagent/subagent-acp/src/run.ts +++ b/packages/subagent/subagent-acp/src/run.ts @@ -340,6 +340,11 @@ export async function startAcpRun(request: SubagentStartRequest, spec: AcpRunSpe cancelSettled.then((): SubagentResult => ({ output: collectOutput(), stopReason: 'aborted' })), ]) } catch (error: unknown) { + // A deterministic cancellation resolves `cancelSettled` before its + // best-effort ACP cancel can reject the prompt. This fallback is only for + // a process/pipe rejection already queued when the abort event fires; its + // first-outcome ordering cannot be forced without a timing-dependent test. + /* v8 ignore next */ if (flags.cancelled) return { output: collectOutput(), stopReason: 'aborted' } // The seam contract: result resolves (never rejects) on a child-level // failure. Startup failures were already rejected before publication; diff --git a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts index 4bbafea521..eed3cfe1ed 100644 --- a/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts +++ b/packages/subagent/subagent-acp/tests/subagent-acp.spec.ts @@ -127,7 +127,9 @@ describe('dsh-subagent-acp', () => { const result = await run.result expect(result.stopReason).toBe('completed') expect(text(result.output)).toBe('hello from acp child') - await run.dispose() + const disposal = run.dispose() + expect(run.dispose()).toBe(disposal) + await disposal }) it('maps a max_tokens stop reason', async () => { @@ -470,6 +472,19 @@ describe('dsh-subagent-acp', () => { await run.dispose() }) + it('logs a flattened child failure through the registered provider', async () => { + const ctx = await setup({ MOCK_CRASH_ON_PROMPT: '1' }) + const warnings: string[] = [] + ctx.logger.warn = ((message: unknown) => { warnings.push(String(message)) }) as typeof ctx.logger.warn + const run = await ctx.subagents.start('acp', request()) + const result = await run.result + expect(result.stopReason).toBe('error') + expect(warnings).toEqual([ + expect.stringContaining('subagent-acp "acp": child run failed (error):'), + ]) + await run.dispose() + }) + it('resolves error (never rejects) even when the onError sink itself throws', async () => { // onError is a caller-supplied callback boundary: its own exception must be // contained, or it would reject `result` and break the seam's "result never diff --git a/packages/support/subagent-mock/tests/subagent-mock.spec.ts b/packages/support/subagent-mock/tests/subagent-mock.spec.ts index 3ddfaad4d4..7fd93c62bc 100644 --- a/packages/support/subagent-mock/tests/subagent-mock.spec.ts +++ b/packages/support/subagent-mock/tests/subagent-mock.spec.ts @@ -32,6 +32,7 @@ describe('dsh-subagent-mock', () => { structured: undefined, stopReason: 'completed', }) + await run.dispose() }) it('registers under a configurable name', async () => { @@ -75,6 +76,25 @@ describe('dsh-subagent-mock', () => { await expect(run.result).resolves.toMatchObject({ stopReason: 'aborted' }) }) + it('rejects an already-aborted request before starting publication', async () => { + const ctx = await mount() + const controller = new AbortController() + controller.abort() + + await expect(ctx.subagents.start('mock', baseRequest({ signal: controller.signal }))) + .rejects.toThrow('mock subagent start aborted before publication') + }) + + it('rejects when cancellation wins the asynchronous publication handoff', async () => { + const ctx = await mount() + const controller = new AbortController() + const pending = ctx.subagents.start('mock', baseRequest({ signal: controller.signal })) + + controller.abort() + + await expect(pending).rejects.toThrow('mock subagent start aborted before publication') + }) + it('unregisters the provider when the owning fiber is disposed (HMR safety)', async () => { const ctx = new Context() await ctx.plugin(SubagentService) diff --git a/packages/ui/user-approval/src/index.ts b/packages/ui/user-approval/src/index.ts index 8496e40e62..6b3ef962bb 100644 --- a/packages/ui/user-approval/src/index.ts +++ b/packages/ui/user-approval/src/index.ts @@ -451,9 +451,6 @@ export class ApprovalService extends Service { resolve('cancelled') } signal.addEventListener('abort', onAbort, { once: true }) - // Abort can win after the initial check but before listener installation. - // Recheck at the settlement boundary so that edge still cancels. - if (signal.aborted) onAbort() void answer.then((outcome) => { signal.removeEventListener('abort', onAbort) // After an abort won the race this resolve is a settled-promise no-op: diff --git a/packages/ui/user-approval/tests/approval.spec.ts b/packages/ui/user-approval/tests/approval.spec.ts index be9e723732..ff0cd5c7d8 100644 --- a/packages/ui/user-approval/tests/approval.spec.ts +++ b/packages/ui/user-approval/tests/approval.spec.ts @@ -281,26 +281,6 @@ describe('ApprovalService.request', () => { expect(appended[1]?.data).toMatchObject({ outcome: 'cancelled' }) }) - it('does not miss an abort between the initial check and listener installation', async () => { - const ctx = await mounted() - const { agent, appended } = fakeAgent() - const answer = Promise.withResolvers() - ctx.on('approval/request', () => answer.promise) - const controller = new AbortController() - const addEventListener = controller.signal.addEventListener.bind(controller.signal) - const add = vi.spyOn(controller.signal, 'addEventListener').mockImplementation((type, listener, options) => { - controller.abort() - addEventListener(type, listener, options) - }) - - await expect(ctx.approval.request(requestOf(agent, { signal: controller.signal }))).resolves.toBe('cancelled') - - answer.resolve('allowed-once') - await Promise.resolve() - expect(add).toHaveBeenCalledOnce() - expect(appended[1]?.data).toMatchObject({ outcome: 'cancelled' }) - }) - it('resolves cancelled when the signal aborts mid-question and discards the late answer', async () => { const ctx = await mounted() const { agent, appended } = fakeAgent() diff --git a/packages/workflow/workflow-workerthread/src/host.ts b/packages/workflow/workflow-workerthread/src/host.ts index 44ea569382..95c07f0d2d 100644 --- a/packages/workflow/workflow-workerthread/src/host.ts +++ b/packages/workflow/workflow-workerthread/src/host.ts @@ -468,13 +468,13 @@ export class WorkerRun implements WorkflowRun { .catch((error: unknown) => { this.ctx.logger.warn(`workflow-workerthread: child dispose failed: ${renderThrown(error)}`) }) - .then(() => { this.finishChild(callId, record) }) + .then(() => { this.finishChild(callId) }) return record.disposal } - /** Drop an exact child record and release quiescence waiters when all work ends. */ - private finishChild(callId: number, record: ChildRecord): void { - if (this.children.get(callId) === record) this.children.delete(callId) + /** Drop a child record and release quiescence waiters when all work ends. */ + private finishChild(callId: number): void { + this.children.delete(callId) this.notifyChildQuiescence() } diff --git a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts index 623da10f72..4ad00ee02f 100644 --- a/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts +++ b/packages/workflow/workflow-workerthread/tests/workflow-workerthread.spec.ts @@ -1049,6 +1049,67 @@ describe('dsh-workflow-workerthread', () => { await ctx.fiber.dispose() }) + it('refuses and disposes a provider run that becomes ready after its real worker dies', async () => { + const ctx = new Context() + await ctx.plugin(SubagentService) + const requested = Promise.withResolvers() + const ready = Promise.withResolvers() + let disposeCalls = 0 + const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => ctx.logger) + const provider: SubagentProvider = { + name: 'late-ready', + capabilities: { outputSchema: true, depthLimit: true, toolFilter: true, persona: false }, + inheritsParentContext: false, + start: (request) => { + requested.resolve(request) + // Model a backend whose independent startup boundary cannot be + // interrupted promptly. The host must still reject ownership if the + // worker dies before this promise transfers the ready run. + return ready.promise + }, + } + ctx.subagents.registerProvider(provider) + await ctx.plugin(WorkerWorkflowEngine, { provider: 'late-ready', maxConcurrentAgents: 1 }) + const lifecycle: string[] = [] + ctx.on('workflow/agent-start', () => { lifecycle.push('start') }) + ctx.on('workflow/agent-end', () => { lifecycle.push('end') }) + + const handle = ctx.workflows.start({ + ...scripted("return await agent('pending startup')"), + parent: fakeParent(), + }) + const request = await requested.promise + const worker = (handle as unknown as { worker: Worker }).worker + + // Kill the actual Worker while provider startup is independently + // pending. Death closes admission and aborts the shared signal, but this + // deliberately uncooperative provider still fulfills afterward. + await worker.terminate() + const result = await handle.result + expect(result.stopReason).toBe('error') + expect(result.error).toContain('exit code') + expect(request.signal.aborted).toBe(true) + expect(request.signal.reason).toBe('workflow worker gone') + + ready.resolve({ + id: AgentId('late-ready-child'), + result: Promise.resolve({ output: [], stopReason: 'aborted' }), + dispose: () => { + disposeCalls += 1 + return Promise.reject(new Error('late ready dispose failed')) + }, + }) + await waitFor(() => { + expect(disposeCalls).toBe(1) + expect(warn).toHaveBeenCalledWith(expect.stringContaining('refused child dispose failed: Error: late ready dispose failed')) + }, 1000) + expect(lifecycle).toEqual([]) + + await handle.dispose() + expect(disposeCalls).toBe(1) + await ctx.fiber.dispose() + }) + it('a worker that exits before settling reports an error result and reaps its children', async () => { const ctx = new Context() await ctx.plugin(SubagentService) From 2ca806a1ec24fe3bf9e09eb3309bfcce378d89f9 Mon Sep 17 00:00:00 2001 From: Tianyi Cui <53024+tianyicui@users.noreply.github.com> Date: Sun, 12 Jul 2026 23:16:30 +0800 Subject: [PATCH 21/21] docs: refresh scoped lifecycle catalogs --- docs/config-catalog.md | 2 +- docs/cordis-catalog/services.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 4e92f0a0a2..63d1303fc6 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -129,7 +129,7 @@ export interface Config { Depends on: [`AgentId`](../packages/core/agent/src/index.ts) · [`AgentOptions`](../packages/core/agent/src/index.ts) · [`SessionId`](../packages/core/session/src/index.ts) -Source: [`packages/core/agent-loop/src/index.ts:335`](../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:325`](../packages/core/agent-loop/src/index.ts) ## `@deepseek-ai/dsh-bash-local` diff --git a/docs/cordis-catalog/services.md b/docs/cordis-catalog/services.md index 29e440776d..2e508e0a35 100644 --- a/docs/cordis-catalog/services.md +++ b/docs/cordis-catalog/services.md @@ -19,7 +19,7 @@ async createAgent(ownerCtx: Context, options: CreateAgentOptions): Promise ``` -Source: [`packages/core/agent-loop/src/index.ts:348`](../../packages/core/agent-loop/src/index.ts) +Source: [`packages/core/agent-loop/src/index.ts:338`](../../packages/core/agent-loop/src/index.ts) ## `ctx.agents` — `AgentRegistry`