From e07f41d5fd8ca172287fda0f923b4d1f69c592f3 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 17:32:09 +0800 Subject: [PATCH 01/26] Revert #932 transactional Cordis reload changes Apply real git revert --no-commit operations in reverse order: acb0797a1421eab128a4bd03355e930c1a221fb0 af97714f2413a3e55f0f15ab1b283beb133b3f2d 2018b0b7e64b444bff82b62c9466f13adc4603bb 43170c027cfbf9155dad7a43c01ca39364d4aef2 a621e927d6b3763798c3929e28912d86c9576f2d Resolve the app-boot package move, preserve deleted files and frozen archived notes, retain the modern lockfile graph, and preserve independent later lifecycle and lazy-config changes. Do not revert 6ac7d72d: that merge also contains eight unrelated commits from the #936 dependency chain. This is the mechanical intermediate result. Its focused check exposed consumer and packaging incompatibilities. The following compatibility commit supplies those adaptations and reconciles the vendor ledger. --- package.json | 1 - packages/boot/app-boot/src/index.ts | 57 ++--- packages/boot/app-boot/tests/app-boot.spec.ts | 20 +- .../boot/app-boot/tests/config-reload.spec.ts | 242 ++---------------- .../boot/app-boot/tests/hmr-config.spec.ts | 213 --------------- .../host/directory-picker-auto/src/index.ts | 9 +- .../tests/loader-composition.spec.ts | 2 +- .../host/webserver/tests/webserver.spec.ts | 24 +- packages/typert/loader/tests/loader.spec.ts | 4 +- pnpm-workspace.yaml | 4 - scripts/verify-vendored-links.ts | 72 ------ vendor/README.md | 6 +- vendor/cordis/src/events.ts | 2 +- vendor/cordis/src/fiber.ts | 6 +- vendor/hmr/src/index.ts | 176 +------------ vendor/include/src/index.ts | 138 ++++------ vendor/loader/src/config/entry.ts | 198 +++----------- vendor/loader/src/config/group.ts | 81 ++---- vendor/loader/src/config/isolate.ts | 4 +- vendor/loader/src/config/tree.ts | 53 +--- vendor/loader/src/index.ts | 11 +- vendor/schemastery/package.json | 9 - 22 files changed, 206 insertions(+), 1126 deletions(-) delete mode 100644 packages/boot/app-boot/tests/hmr-config.spec.ts delete mode 100644 scripts/verify-vendored-links.ts diff --git a/package.json b/package.json index a09fa3f997..d5a5b1c41b 100644 --- a/package.json +++ b/package.json @@ -133,7 +133,6 @@ "verify-client-packages": "tsx scripts/verify-client-packages.ts", "verify-client-ui-i18n": "tsx scripts/verify-client-ui-i18n.ts", "verify-no-bare-dispatcher": "tsx scripts/verify-no-bare-dispatcher.ts", - "verify-vendored-links": "tsx scripts/verify-vendored-links.ts", "verify-cordis-config": "tsx scripts/verify-cordis-config.ts", "rescope-vendor": "tsx scripts/rescope-vendor.ts", "rescope-vendor:check": "tsx scripts/rescope-vendor.ts --check", diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index ef891cef0d..3698a092a8 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -780,9 +780,6 @@ export async function assertEntriesActivated(ctx: Context, binName: string): Pro * complete plugin set. * @returns the root context once every entry has started, or as soon as a * surface disposed the tree while startup was still in flight. - * @throws a labelled error after disposing the partial context — `host - * preparation failed` when `prepare` threw before any config-tree entry - * mounted, `plugin tree failed to load` afterwards. */ export async function boot( binName: string, @@ -792,45 +789,21 @@ export async function boot( bareModuleBaseUrl?: string, ): Promise { const ctx = new Context() - // Two failure labels: `prepare` runs before any config-tree entry mounts, - // so its failure is host setup, not the plugin tree. - let stage = 'host preparation failed' - try { - ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + '/' - ctx.provide('dshHomePath', dshHomePath) - await ctx.plugin(Loader) - await prepare?.(ctx) - stage = 'plugin tree failed to load' - await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl) - // A surface can finish and dispose the whole tree while startup is still - // in flight, before the last entry settles. The Loader service goes with - // it, and the activation audit describes a live tree — reading `ctx.loader` - // past this point would throw a TypeError over an app that exited exactly - // as asked. Transactional group updates settle - // lifecycle inside the mount, so the teardown can land before it returns; - // re-check after every await. - await ctx.get('loader')?.await() - if (ctx.get('loader') === undefined) return ctx - await assertEntriesActivated(ctx, binName) - return ctx - } catch (cause) { - // Root-fiber disposal contains cleanup failures per observer (Cordis - // fiber.ts hardening) and a repeated call returns the settled single-shot - // result, so this await cannot reject and replace `cause`. - await ctx.fiber.dispose() - const detail = cause instanceof Error ? cause.message : String(cause) - // The transactional Loader wraps a failing entry apply in one message per - // tree layer; every layer's message is folded into `detail` above, and the - // deepest cause is the plugin's own thrown error, whose stack names the - // real failure site — append it so the startup diagnostic preserves the - // original activation error instead of only the wrap chain. - let deepest: unknown = cause - while (deepest instanceof Error && deepest.cause !== undefined) deepest = deepest.cause - const stack = deepest instanceof AggregateError - ? `\n${deepest.stack ?? deepest.message}\n${deepest.errors.map(formatActivationError).join('\n')}` - : deepest instanceof Error && deepest !== cause ? `\n${deepest.stack ?? deepest.message}` : '' - throw new Error(`${binName}: ${stage}: ${detail}${stack}`, { cause }) - } + ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + '/' + ctx.provide('dshHomePath', dshHomePath) + await ctx.plugin(Loader) + await prepare?.(ctx) + await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl) + await ctx.loader.await() + // A surface can finish and dispose the whole tree while that await is still + // pending: the TUI renders as soon as its own fiber starts, so an `/exit` + // typed before the last entry settles tears the context down under us. The + // Loader service goes with it, and the activation audit describes a live + // tree — reading `ctx.loader` here would throw a TypeError over an app that + // exited exactly as asked. + if (ctx.get('loader') === undefined) return ctx + await assertEntriesActivated(ctx, binName) + return ctx } /** Prompt-section name for the harness-source location line an app bin adds after boot. */ diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index fe373d7bf0..c878fbd3a2 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -729,22 +729,6 @@ describe('boot', () => { } }) - it('disposes partial host setup and labels non-Error preparation failures', async () => { - const dir = tmp() - const failure = 42 - let disposed = false - const task = boot(NAME, join(dir, 'cordis.yml'), undefined, (ctx) => { - ctx.effect(() => () => { disposed = true }) - throw failure - }) - - await expect(task).rejects.toMatchObject({ - message: `${NAME}: host preparation failed: ${failure}`, - cause: failure, - }) - expect(disposed).toBe(true) - }) - it('exposes dshHomePath to Loader config expressions', async () => { const dir = tmp() const dshHome = join(dir, 'home') @@ -851,9 +835,9 @@ describe('boot', () => { const deepest = new Error('stackless deep failure') delete (deepest as { stack?: string }).stack await expect(boot(NAME, join(dir, 'cordis.yml'), undefined, () => { - throw new Error('wrapped setup failure', { cause: deepest }) + throw new Error('host preparation failed', { cause: deepest }) })).rejects.toThrow( - `${NAME}: host preparation failed: wrapped setup failure\nstackless deep failure`, + `${NAME}: plugin tree failed to load: host preparation failed\nstackless deep failure`, ) }) diff --git a/packages/boot/app-boot/tests/config-reload.spec.ts b/packages/boot/app-boot/tests/config-reload.spec.ts index 386b537ce4..4486c66ba8 100644 --- a/packages/boot/app-boot/tests/config-reload.spec.ts +++ b/packages/boot/app-boot/tests/config-reload.spec.ts @@ -1,7 +1,12 @@ /** - * Transactional config replacement through the booted Include and Loader tree. - * HMR contains rejected refreshes; direct callers receive the error after the - * previous generation has been retained or restored. + * Config hot-reload resilience of the booted include tree. `dsh-app-boot` + * installs a fail-loud unhandled-rejection handler, so a `refresh()` that + * rethrows a config-file parse error would kill a live app on one bad + * `cordis.yml` edit (the HMR watcher awaits `refresh()` in an async event + * callback nobody else catches). These tests pin the vendored + * `@cordisjs/plugin-include` contract that boot relies on: an invalid file + * keeps the last good tree, and a valid re-read re-applies overlay patches + * exactly like the initial load. */ import { mkdtempSync, rmSync, writeFileSync } from 'node:fs' @@ -27,11 +32,10 @@ interface TreeFixture { include: Include } -async function bootTree(configBody: string, files: Record = {}): Promise { +async function bootTree(configBody: string): Promise { const dir = mkdtempSync(join(tmpdir(), 'dsh-config-reload-')) tempRoots.push(dir) writeFileSync(join(dir, 'noop.mjs'), NOOP_PLUGIN) - for (const [name, content] of Object.entries(files)) writeFileSync(join(dir, name), content) writeFileSync(join(dir, 'cordis.yml'), configBody) const ctx = await boot(NAME, join(dir, 'cordis.yml')) const entry = [...ctx.loader.entries()].find(candidate => candidate.subtree !== undefined) @@ -43,41 +47,20 @@ function entryConfig(ctx: Context, id: string): unknown { return [...ctx.loader.entries()].find(entry => entry.options.id === id)?.options.config } -function entryById(ctx: Context, id: string) { - const entry = [...ctx.loader.entries()].find(entry => entry.options.id === id) - if (!entry) throw new Error(`missing loader entry ${id}`) - return entry -} - -function plugin(name: string, body = ''): string { - return `export default function ${name}(_ctx, config = {}) { ${body} }\n` -} - -async function expectUpdateFailure(task: Promise, stage: string): Promise { - try { - await task - } catch (error) { - expect(error).toBeInstanceOf(Error) - expect((error as Error).message).toContain(`failed to ${stage} loader entry`) - return - } - throw new Error(`expected loader update to fail during ${stage}`) -} - describe('include refresh with an invalid file', () => { - it('rejects while keeping the last good tree, then applies the next valid edit', async () => { + it('keeps the last good tree instead of throwing, then applies the next valid edit', async () => { const { ctx, dir, include } = await bootTree('- id: noop\n name: ./noop.mjs\n config:\n value: 1\n') try { expect(entryConfig(ctx, 'noop')).toEqual({ value: 1 }) writeFileSync(join(dir, 'cordis.yml'), 'invalid: [unclosed\n') - await expect(include.refresh()).rejects.toThrow('failed to parse config file') + await expect(include.refresh()).resolves.toBeUndefined() expect(entryConfig(ctx, 'noop')).toEqual({ value: 1 }) // An empty file parses to `undefined` without a YAML error; it must be // treated exactly like a parse failure, not crash the entry walk. writeFileSync(join(dir, 'cordis.yml'), '') - await expect(include.refresh()).rejects.toThrow('failed to validate config file') + await expect(include.refresh()).resolves.toBeUndefined() expect(entryConfig(ctx, 'noop')).toEqual({ value: 1 }) writeFileSync(join(dir, 'cordis.yml'), '- id: noop\n name: ./noop.mjs\n config:\n value: 2\n') @@ -90,201 +73,6 @@ describe('include refresh with an invalid file', () => { }) }) -describe('loader entry replacement', () => { - it('imports a changed name before replacing the running plugin', async () => { - const { ctx } = await bootTree('- id: target\n name: ./old.mjs\n', { - 'old.mjs': plugin('oldPlugin'), - 'new.mjs': plugin('newPlugin'), - }) - try { - const entry = entryById(ctx, 'target') - await entry.update({ name: './new.mjs' }) - expect(entry.options.name).toBe('./new.mjs') - expect(entry.parent.data.find(options => options.id === 'target')).toBe(entry.options) - expect(entry.fiber?.runtime?.callback.name).toBe('newPlugin') - expect(entry.options.disabled).toBeUndefined() - await entry.fiber?.await() - } finally { - await ctx.fiber.dispose() - } - }) - - it('retains the running plugin when the replacement cannot be imported', async () => { - const { ctx } = await bootTree('- id: target\n name: ./old.mjs\n', { - 'old.mjs': plugin('oldPlugin'), - }) - try { - const entry = entryById(ctx, 'target') - const fiber = entry.fiber - await expectUpdateFailure(entry.update({ name: './missing.mjs' }), 'import') - expect(entry.options.name).toBe('./old.mjs') - expect(entry.fiber === fiber).toBe(true) - await fiber?.await() - } finally { - await ctx.fiber.dispose() - } - }) - - it('restores the previous plugin after replacement application fails', async () => { - const { ctx } = await bootTree('- id: target\n name: ./old.mjs\n', { - 'old.mjs': plugin('oldPlugin'), - 'bad.mjs': plugin('badPlugin', 'throw new Error("candidate apply failed")'), - }) - try { - const entry = entryById(ctx, 'target') - const previous = entry.fiber - await expectUpdateFailure(entry.update({ name: './bad.mjs' }), 'apply') - expect(entry.options.name).toBe('./old.mjs') - expect(entry.fiber === previous).toBe(false) - expect(entry.fiber?.runtime?.callback.name).toBe('oldPlugin') - expect(entry.options.disabled).toBeUndefined() - await entry.fiber?.await() - } finally { - await ctx.fiber.dispose() - } - }) - - it('restores the previous config when an in-place restart fails', async () => { - const { ctx } = await bootTree('- id: target\n name: ./configurable.mjs\n config:\n fail: false\n', { - 'configurable.mjs': plugin('configurablePlugin', 'if (config.fail) throw new Error("candidate config failed")'), - }) - try { - const entry = entryById(ctx, 'target') - const fiber = entry.fiber - await expectUpdateFailure(entry.update({ config: { fail: true } }), 'apply') - expect(entry.options.config).toEqual({ fail: false }) - expect(entry.fiber === fiber).toBe(true) - await fiber?.await() - } finally { - await ctx.fiber.dispose() - } - }) - - it('does not persist a failed direct fiber update', async () => { - const { ctx } = await bootTree('- id: target\n name: ./configurable.mjs\n config:\n fail: false\n', { - 'configurable.mjs': plugin('configurablePlugin', 'if (config.fail) throw new Error("candidate config failed")'), - }) - try { - const entry = entryById(ctx, 'target') - const fiber = entry.fiber - if (!fiber) throw new Error('target entry has no fiber') - await expect(fiber.update({ fail: true })).rejects.toThrow('candidate config failed') - expect(entry.options.config).toEqual({ fail: false }) - expect(entry.parent.data.find(options => options.id === 'target')).toBe(entry.options) - } finally { - await ctx.fiber.dispose() - } - }) -}) - -describe('loader tree replacement', () => { - it('rolls back earlier updates and additions when a later entry fails', async () => { - const { ctx, dir, include } = await bootTree([ - '- id: existing', - ' name: ./configurable.mjs', - ' config:', - ' value: old', - '', - ].join('\n'), { - 'configurable.mjs': plugin('configurablePlugin'), - 'bad.mjs': plugin('badPlugin', 'throw new Error("candidate apply failed")'), - }) - try { - writeFileSync(join(dir, 'cordis.yml'), [ - '- id: existing', - ' name: ./configurable.mjs', - ' config:', - ' value: candidate', - '- id: added', - ' name: ./noop.mjs', - '- id: bad', - ' name: ./bad.mjs', - '', - ].join('\n')) - await expect(include.refresh()).rejects.toThrow('failed to apply loader entry bad') - expect(entryConfig(ctx, 'existing')).toEqual({ value: 'old' }) - expect([...ctx.loader.entries()].some(entry => entry.options.id === 'added')).toBe(false) - expect([...ctx.loader.entries()].some(entry => entry.options.id === 'bad')).toBe(false) - - writeFileSync(join(dir, 'cordis.yml'), [ - '- id: existing', - ' name: ./configurable.mjs', - ' config:', - ' value: committed', - '- id: added', - ' name: ./noop.mjs', - '', - ].join('\n')) - await include.refresh() - expect(entryConfig(ctx, 'existing')).toEqual({ value: 'committed' }) - expect(entryById(ctx, 'added').fiber).toBeDefined() - } finally { - await ctx.fiber.dispose() - } - }) - - it('stops and restores descendants when an ancestor group is disabled and re-enabled', async () => { - // No manual builtin registration: `boot()` supplies `cordis:group` beside - // `cordis:include`, which is what lets a composition give one `isolate` - // realm to a provider and its consumers together. - const { ctx, dir, include } = await bootTree('- id: noop\n name: ./noop.mjs\n') - try { - const config = (disabled: boolean) => [ - '- id: parent', - ' name: cordis:group', - ' group: true', - ` disabled: ${disabled}`, - ' config:', - ' - id: child', - ' name: ./noop.mjs', - '', - ].join('\n') - - writeFileSync(join(dir, 'cordis.yml'), config(false)) - await include.refresh() - expect(entryById(ctx, 'child').fiber).toBeDefined() - - writeFileSync(join(dir, 'cordis.yml'), config(true)) - await include.refresh() - expect(entryById(ctx, 'child').fiber).toBeUndefined() - - writeFileSync(join(dir, 'cordis.yml'), config(false)) - await include.refresh() - expect(entryById(ctx, 'child').fiber).toBeDefined() - } finally { - await ctx.fiber.dispose() - } - }) - - it('restores a programmatic entry move when its update fails', async () => { - const { ctx } = await bootTree('- id: noop\n name: ./noop.mjs\n', { - 'movable.mjs': plugin('movablePlugin', 'if (config.fail) throw new Error("candidate config failed")'), - }) - try { - const groupId = await ctx.loader.create({ name: 'cordis:group', group: true, config: [] }) - const targetId = await ctx.loader.create({ name: './movable.mjs', config: { fail: false } }) - const target = entryById(ctx, targetId) - const source = target.parent - const sourceIndex = source.data.indexOf(target.options) - const destination = entryById(ctx, groupId).subgroup - if (!destination) throw new Error('created loader group has no subgroup') - - await expectUpdateFailure( - ctx.loader.update(targetId, { config: { fail: true } }, groupId), - 'apply', - ) - - expect(target.parent).toBe(source) - expect(Object.getPrototypeOf(target.ctx)).toBe(source.ctx) - expect(source.data.indexOf(target.options)).toBe(sourceIndex) - expect(destination.data).not.toContain(target.options) - expect(target.options.config).toEqual({ fail: false }) - } finally { - await ctx.fiber.dispose() - } - }) -}) - describe('include refresh with overlay patches', () => { it('re-applies entry patches and inserted entries on every re-read (parity with initial load)', async () => { const dir = mkdtempSync(join(tmpdir(), 'dsh-config-reload-overlay-')) @@ -335,9 +123,9 @@ describe('include refresh with overlay patches', () => { await ctx.loader.await() expect(entryConfig(ctx, 'noop')).toEqual({ value: 'patched-v2' }) - // Omitting the patch list must remove the overlay rather than reuse the - // Include's previous config through a default parameter. - await entry.update({ config: { path: './base.yml' } }) + // Removing every patch must revert to the file's own values: patching + // may not bake earlier patch results into the cached parse. + await entry.update({ config: { path: './base.yml', patches: [] } }) await ctx.loader.await() expect(entryConfig(ctx, 'noop')).toEqual({ value: 'edited-2' }) } finally { diff --git a/packages/boot/app-boot/tests/hmr-config.spec.ts b/packages/boot/app-boot/tests/hmr-config.spec.ts deleted file mode 100644 index 6487ad0695..0000000000 --- a/packages/boot/app-boot/tests/hmr-config.spec.ts +++ /dev/null @@ -1,213 +0,0 @@ -import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs' -import { realpath } from 'node:fs/promises' -import { tmpdir } from 'node:os' -import { join } from 'node:path' -import { pathToFileURL } from 'node:url' -import { Context } from '@deepseek-ai/cordis' -import Hmr from '@deepseek-ai/cordis-plugin-hmr' -import Loader from '@deepseek-ai/cordis-plugin-loader' -import Timer from '@deepseek-ai/cordis-plugin-timer' -import { afterEach, describe, expect, it, vi } from 'vitest' - -/** Every per-test tree root, removed once the booted watcher has been disposed. */ -const hmrRoots: string[] = [] - -async function bootHmr(dir: string, root: string[] = [], usePolling?: boolean): Promise { - const ctx = new Context() - ctx.baseUrl = pathToFileURL(dir).href + '/' - await ctx.plugin(Loader) - await ctx.plugin(Timer) - await ctx.plugin(Hmr, { - root, - ignored: [], - debounce: 0, - ...usePolling === undefined ? {} : { usePolling }, - }) - return ctx -} - -async function eventually(test: () => boolean, message: string): Promise { - const deadline = Date.now() + 10_000 - while (!test()) { - if (Date.now() >= deadline) throw new Error(message) - await new Promise(resolve => setTimeout(resolve, 10)) - } -} - -describe('HMR exact config paths', () => { - afterEach(() => { - for (const root of hmrRoots.splice(0)) rmSync(root, { recursive: true, force: true }) - }) - - it('observes module changes when its watch base is a filesystem alias', { timeout: 30_000 }, async () => { - const target = mkdtempSync(join(tmpdir(), 'dsh-hmr-module-canonical-')) - const alias = `${target}-alias` - const aliasFilename = join(alias, 'module.ts') - symlinkSync(target, alias, process.platform === 'win32' ? 'junction' : 'dir') - writeFileSync(aliasFilename, 'export const generation = 0\n') - // This acceptance owns alias-to-cache identity. Other cases below exercise - // native events; polling keeps Windows fs.watch queue pressure out of it. - const ctx = await bootHmr(alias, ['.'], true) - const filename = join(await realpath(target), 'module.ts') - const expected = pathToFileURL(filename).href - const cacheHas = vi.spyOn(ctx.loader.internal!.loadCache, 'has').mockReturnValue(false) - const observed: string[] = [] - ctx.on('hmr/change', (url) => { observed.push(url) }) - try { - const deadline = Date.now() + 20_000 - for (let generation = 1; !observed.includes(expected); generation += 1) { - if (Date.now() >= deadline) { - throw new Error(`HMR did not observe ${expected} through the alias; observed ${JSON.stringify(observed)}`) - } - // The watch base, not the writer spelling, is the alias under test. - // Grow the file on every write: polling must not depend on timestamp - // precision when several generations land inside one filesystem tick. - writeFileSync(filename, `export const generation = ${generation}\n${' '.repeat(generation)}\n`) - // Leave Chokidar's atomic-write window idle so one coalesced change can publish. - await new Promise(resolve => setTimeout(resolve, 250)) - } - expect(cacheHas).toHaveBeenCalledWith(expected) - } finally { - await ctx.fiber.dispose() - unlinkSync(alias) - rmSync(target, { recursive: true, force: true }) - } - }) - - it('collapses filesystem aliases before registering an exact watch', async () => { - const target = mkdtempSync(join(tmpdir(), 'dsh-hmr-canonical-')) - const alias = `${target}-alias` - symlinkSync(target, alias, process.platform === 'win32' ? 'junction' : 'dir') - const ctx = await bootHmr(alias) - try { - await ctx.hmr.registerConfig('plugins.yml', () => {}) - await expect(ctx.hmr.registerConfig(join(await realpath(target), 'plugins.yml'), () => {})) - .rejects.toThrow('config path already registered') - } finally { - await ctx.fiber.dispose() - unlinkSync(alias) - rmSync(target, { recursive: true, force: true }) - } - }) - - it('observes add, change, and unlink outside its module roots', { timeout: 20_000 }, async () => { - const dir = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) - hmrRoots.push(dir) - const filename = join(dir, 'plugins.yml') - const ctx = await bootHmr(dir) - const observed: string[] = [] - try { - await ctx.hmr.registerConfig(filename, () => { - try { - observed.push(readFileSync(filename, 'utf8')) - } catch (error) { - if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error - observed.push('missing') - } - }) - - writeFileSync(filename, 'one', { flag: 'wx' }) - await eventually(() => observed.includes('one'), 'HMR did not observe config creation') - writeFileSync(filename, 'two') - await eventually(() => observed.includes('two'), 'HMR did not observe config change') - unlinkSync(filename) - await eventually(() => observed.includes('missing'), 'HMR did not observe config removal') - } finally { - await ctx.fiber.dispose() - } - }) - - it('observes creation when the config parent did not exist at registration', { timeout: 20_000 }, async () => { - const root = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) - hmrRoots.push(root) - const dir = join(root, 'later') - const filename = join(dir, 'plugins.yml') - const ctx = await bootHmr(root) - const observed: string[] = [] - try { - await ctx.hmr.registerConfig(filename, () => { - observed.push(readFileSync(filename, 'utf8')) - }) - mkdirSync(dir) - writeFileSync(filename, 'created') - await eventually(() => observed.includes('created'), 'HMR did not observe config creation under a new parent') - } finally { - await ctx.fiber.dispose() - } - }) - - it('serializes refreshes and waits for them during disposal', { timeout: 20_000 }, async () => { - const dir = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) - hmrRoots.push(dir) - const filename = join(dir, 'plugins.yml') - writeFileSync(filename, 'one') - const ctx = await bootHmr(dir) - const started = Promise.withResolvers() - const release = Promise.withResolvers() - const observed: string[] = [] - let active = 0 - let maxActive = 0 - try { - const dispose = await ctx.hmr.registerConfig(filename, async () => { - active += 1 - maxActive = Math.max(maxActive, active) - observed.push(readFileSync(filename, 'utf8')) - if (observed.length === 1) { - started.resolve(undefined) - await release.promise - } - active -= 1 - }) - await started.promise - writeFileSync(filename, 'two') - // Chokidar coalesces atomic writes for 100 ms by default. Wait beyond - // that window so this edit is queued before registration disposal. - await new Promise(resolve => setTimeout(resolve, 250)) - - let disposed = false - const disposal = dispose().then(() => { disposed = true }) - await Promise.resolve() - expect(disposed).toBe(false) - release.resolve(undefined) - await disposal - expect(maxActive).toBe(1) - expect(observed).toEqual(['one', 'two']) - } finally { - release.resolve(undefined) - await ctx.fiber.dispose() - } - }) - - it('normalizes refresh failures and broadcasts them without escaping the watcher', { timeout: 20_000 }, async () => { - const dir = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) - hmrRoots.push(dir) - const filename = join(dir, 'plugins.yml') - const ctx = await bootHmr(dir) - const failure = Promise.withResolvers<{ filename: string; error: Error }>() - let failureCount = 0 - try { - ctx.on('hmr/config-update-failed', () => { - throw new Error('observer failed') - }) - ctx.on('hmr/config-update-failed', (failedFilename, error) => { - failureCount += 1 - failure.resolve({ filename: failedFilename, error }) - }) - await ctx.hmr.registerConfig(filename, () => { throw 42 }) - writeFileSync(filename, 'invalid') - - const observed = await failure.promise - expect(observed.filename).toBe(filename) - expect(observed.error).toBeInstanceOf(Error) - expect(observed.error.message).toBe('42') - - // Let Chokidar's atomic-write window close before requiring a distinct - // second notification from the same path. - await new Promise(resolve => setTimeout(resolve, 250)) - writeFileSync(filename, 'invalid again') - await eventually(() => failureCount === 2, 'HMR stopped broadcasting after an observer rejected') - } finally { - await ctx.fiber.dispose() - } - }) -}) diff --git a/packages/host/directory-picker-auto/src/index.ts b/packages/host/directory-picker-auto/src/index.ts index f384828125..a95e981ad8 100644 --- a/packages/host/directory-picker-auto/src/index.ts +++ b/packages/host/directory-picker-auto/src/index.ts @@ -77,10 +77,11 @@ export async function apply(ctx: Context): Promise { for (const id of [...ids].reverse()) { // Tree teardown (group.stop) can have removed the entry already; // nothing is left to unmount or await then. - if (ctx.loader.store[id] === undefined) continue - // remove() disposes the entry transactionally, so the chooser's unload - // signals completion only after that face quiesced. - await ctx.loader.remove(id) + const entry = ctx.loader.store[id] + if (entry === undefined) continue + const fiber = entry.fiber + ctx.loader.remove(id) + await fiber?.dispose() } } try { diff --git a/packages/host/directory-picker-auto/tests/loader-composition.spec.ts b/packages/host/directory-picker-auto/tests/loader-composition.spec.ts index 49bf319b0c..77ad4b549d 100644 --- a/packages/host/directory-picker-auto/tests/loader-composition.spec.ts +++ b/packages/host/directory-picker-auto/tests/loader-composition.spec.ts @@ -259,7 +259,7 @@ describe('real Loader composition', () => { const { ctx, configPath } = await loadComposition('127.0.0.1') const backendEntry = [...ctx.loader.entries()].find(entry => entry.options.name === NATIVE)! - await ctx.loader.remove(backendEntry.id) + ctx.loader.remove(backendEntry.id) const autoEntry = [...ctx.loader.entries()].find(entry => entry.options.name === AUTO)! renameControl.remainingFailures = 1 await expect(autoEntry.fiber!.dispose()).resolves.not.toThrow() diff --git a/packages/host/webserver/tests/webserver.spec.ts b/packages/host/webserver/tests/webserver.spec.ts index b7ac506b17..04bbe9b4cf 100644 --- a/packages/host/webserver/tests/webserver.spec.ts +++ b/packages/host/webserver/tests/webserver.spec.ts @@ -12,7 +12,7 @@ import { tmpdir } from 'node:os' import { join } from 'node:path' import { pathToFileURL } from 'node:url' import { afterEach, describe, expect, it } from 'vitest' -import { Context } from '@deepseek-ai/cordis' +import { Context, FiberState } from '@deepseek-ai/cordis' import Loader from '@deepseek-ai/cordis-plugin-loader' import Include from '@deepseek-ai/cordis-plugin-include' import HttpServer, { renderIndexInjections } from '../src/index.ts' @@ -361,17 +361,25 @@ describe('real Loader composition', () => { const firstRoot = root root = undefined // keep the first composition's files until the end + // loader.await() never rejects (allSettled); the bind failure surfaces as + // a FAILED fiber whose error escapes as a late rejection — the shape the + // boot's installFailLoud is contracted to catch. Capture it here the same + // way, and assert it really is the bind error. + const rejections: unknown[] = [] + const onUnhandled = (err: unknown): void => { rejections.push(err) } + process.on('unhandledRejection', onUnhandled) let second: Context | undefined try { - let failure: unknown - try { - await loadComposition(takenPort) - } catch (error) { - failure = error + second = await loadComposition(takenPort) + const entry = [...second.loader.entries()].find(e => e.options.name === '@deepseek-ai/dsh-host-webserver') + expect(entry?.fiber?.state).toBe(FiberState.FAILED) + // The rejection escapes a tick after loader.await() settles; bounded poll. + for (let i = 0; i < 100 && rejections.length === 0; i++) { + await new Promise(resolve => setTimeout(resolve, 10)) } - second = context - expect(String(failure)).toMatch(/failed to apply loader entry.*EADDRINUSE/) + expect(rejections.map(String).join('\n')).toContain('EADDRINUSE') } finally { + process.off('unhandledRejection', onUnhandled) await second?.fiber.dispose() context = first if (root !== undefined) await rm(root, { recursive: true, force: true }) diff --git a/packages/typert/loader/tests/loader.spec.ts b/packages/typert/loader/tests/loader.spec.ts index 2f4b4cae04..979b5b535b 100644 --- a/packages/typert/loader/tests/loader.spec.ts +++ b/packages/typert/loader/tests/loader.spec.ts @@ -212,12 +212,12 @@ describe('typert loader', () => { await new Promise(resolve => setTimeout(resolve, 20)) expect(ctx.typert.list()).toHaveLength(1) - await ctx.loader.remove(id) + ctx.loader.remove(id) await ctx.loader.await() // The unmount reconciliation rides a queued microtask flush. await new Promise(resolve => setTimeout(resolve, 20)) expect(ctx.typert.get('@fixture/with-typert#Thing')).toBeUndefined() - await ctx.loader.remove(plainId) + ctx.loader.remove(plainId) await ctx.loader.await() await new Promise(resolve => setTimeout(resolve, 20)) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 68eff9cd1c..cde062a553 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,10 +14,6 @@ packages: # closure is what the exe bundles and what the Python runtime distributes. - python/sdk-runtime -# Vendored framework packages keep their upstream semver ranges, while local -# builds must resolve those matching names to this workspace's pinned sources. -linkWorkspacePackages: true - overrides: '@deepseek-ai/cosmokit': 'link:vendor/cosmokit' '@deepseek-ai/schemastery': 'link:vendor/schemastery' diff --git a/scripts/verify-vendored-links.ts b/scripts/verify-vendored-links.ts deleted file mode 100644 index 93b8390157..0000000000 --- a/scripts/verify-vendored-links.ts +++ /dev/null @@ -1,72 +0,0 @@ -/** - * Verify that pnpm-lock.yaml resolves every vendored package name to its - * workspace `link:` — never a registry copy. `linkWorkspacePackages: true` - * (pnpm-workspace.yaml) makes matching upstream semver ranges resolve to the - * pinned vendored sources; a registry copy of the same name coexisting with - * the vendored one silently forks the framework layer (vendor/README.md). - */ -import { readdir, readFile } from 'node:fs/promises' -import { join, resolve } from 'node:path' -import * as yaml from 'js-yaml' - -const root = resolve(import.meta.dirname, '..') - -async function vendoredNames(): Promise> { - const names = new Set() - for (const entry of await readdir(join(root, 'vendor'), { withFileTypes: true })) { - if (!entry.isDirectory()) continue - let manifest: { name?: string } - try { - manifest = JSON.parse(await readFile(join(root, 'vendor', entry.name, 'package.json'), 'utf8')) as { name?: string } - } catch { - continue // not a package directory (e.g. vendor/README.md siblings) - } - if (manifest.name !== undefined) names.add(manifest.name) - } - return names -} - -interface Lockfile { - importers?: Record> - packages?: Record - snapshots?: Record -} - -const names = await vendoredNames() -if (names.size === 0) throw new Error('verify-vendored-links: no vendored package manifests found under vendor/') -const lockfile = yaml.load(await readFile(join(root, 'pnpm-lock.yaml'), 'utf8')) as Lockfile - -const violations: string[] = [] - -// Importer resolutions: every dependency entry naming a vendored package must -// resolve to a link:, or the build silently uses a registry copy. -for (const [importer, sections] of Object.entries(lockfile.importers ?? {})) { - for (const [section, dependencies] of Object.entries(sections)) { - if (typeof dependencies !== 'object' || dependencies === null) continue - for (const [dependency, entry] of Object.entries(dependencies as Record)) { - if (!names.has(dependency)) continue - const version = entry.version ?? '' - if (!version.startsWith('link:')) { - violations.push(`${importer} ${section}.${dependency} resolves to ${JSON.stringify(version)} (expected link:)`) - } - } - } -} - -// Package/snapshot keys: a registry copy materializes as a `@` -// key; vendored names must never appear there at all. -for (const section of ['packages', 'snapshots'] as const) { - for (const key of Object.keys(lockfile[section] ?? {})) { - const atIndex = key.lastIndexOf('@') - if (atIndex <= 0) continue - const packageName = key.slice(0, atIndex) - if (names.has(packageName)) violations.push(`${section} entry ${key} is a registry copy of a vendored package`) - } -} - -if (violations.length > 0) { - console.error(`verify-vendored-links: ${String(violations.length)} lockfile resolution(s) bypass the vendored workspaces:`) - for (const violation of violations) console.error(` - ${violation}`) - process.exit(1) -} -console.log(`verify-vendored-links: all ${String(names.size)} vendored package names resolve to workspace links.`) diff --git a/vendor/README.md b/vendor/README.md index 4cfbe892de..47b3093b76 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -2,7 +2,7 @@ This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned). -All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`. The `hygiene` gate `verify-vendored-links` asserts every vendored name resolves to a workspace `link:` in `pnpm-lock.yaml` with no registry copy alongside. Schemastery's manifest additionally declares a conditional `exports` map (import → `.mjs`, require → `.cjs`): pnpm links the directory itself, so without `exports` Node's ESM resolver would fall back to `main` and load the CJS entry whose lazy `require('@deepseek-ai/cosmokit')` can race ESM loading of the same linked module under module-hook hosts (vitest). Upstream MIT `LICENSE` files are preserved in each package directory. +All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`. Schemastery's manifest additionally declares a conditional `exports` map (import → `.mjs`, require → `.cjs`): pnpm links the directory itself, so without `exports` Node's ESM resolver would fall back to `main` and load the CJS entry whose lazy `require('@deepseek-ai/cosmokit')` can race ESM loading of the same linked module under module-hook hosts (vitest). Upstream MIT `LICENSE` files are preserved in each package directory. This file covers the manifest, the local-modification log, and the procedure for **updating** an existing vendored package. To **add a new** one, see the cookbook guide: [docs/cookbook/adding-a-vendored-package.md](../docs/cookbook/adding-a-vendored-package.md). @@ -35,9 +35,9 @@ Keep this log exhaustive — every divergence from upstream must be listed. 3. **All `tsconfig.json` files**: regenerated to extend the repo-root `tsconfig.base.json`, emit TypeScript intermediates to `lib/types`, and declare project references. 4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`. 5. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under `lib/types` and then write the publish runtime entries under `lib/`. Like the regenerated tsconfigs, they are not part of the upstream sync surface. -6. **`cordis/src/fiber.ts` lifecycle hardening**: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is `UNLOADING` (while `PENDING` and `LOADING` remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before `internal/plugin` publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, skip plugin execution when reentrant disposal invalidates the load epoch before its first checkpoint, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup. `Fiber.update()` returns its `internal/update` waterfall result, allowing Loader callers to await a restart while preserving synchronous config validation. +6. **`cordis/src/fiber.ts` lifecycle hardening**: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is `UNLOADING` (while `PENDING` and `LOADING` remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before `internal/plugin` publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, skip plugin execution when reentrant disposal invalidates the load epoch before its first checkpoint, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup. 7. **`cordis/src/*.ts` JSDoc enrichment**: added `@param`/`@returns` tags and contract documentation (disposal semantics, waterfall veto, bail conditions, error cases) across the public plugin-author surface — `Context` (class, statics, and the `Context` interface properties incl. `root`), `EventsService`, `Fiber`, `RegistryService`, `ReflectService`, `Service`, `LoggerService` and their `declare module './context.ts'` overloads. Comment-only; no code changes. Motivation: the website API-reference generator renders these docs and hard-errors on undocumented members. Retire this entry when the enrichment is upstreamed to the fork. -8. **Transactional Loader/Include config reconciliation**: Loader imports a changed entry name before disposal, awaits lifecycle settlement, and restores the previous plugin or config when candidate application fails. Loader settlement rechecks service-gated fibers after current tasks drain, rejects failures, and leaves fibers with absent dependencies pending. Group updates start candidates concurrently, await every outcome, contain sibling-start failures after their owning tree is disposed, undo changes and additions on live-update failure, await removal, preserve programmatic option identity, and persist direct or tree-level mutations only after success. Include reads and validates detached candidate content, applies patches to a clone, reconciles the tree, and only then commits its cached content/data; direct refresh failures propagate for the caller to contain. A non-array parse is invalid, patches re-apply on every file or Include-config update, an omitted patch list clears the overlay, and initial content falls back to `initial` only on `ENOENT`. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts` and `packages/host/webserver/tests/webserver.spec.ts`. +8. **Transactional Loader/Include config reconciliation**: Loader imports a changed entry name before disposal, awaits lifecycle settlement, and restores the previous plugin or config when candidate application fails. Loader settlement rechecks service-gated fibers after current tasks drain, rejects failures, and leaves fibers with absent dependencies pending. Group updates run sequentially and undo changes and additions on live-update failure, await removal, preserve programmatic option identity, and persist direct or tree-level mutations only after success. Include reads and validates detached candidate content, applies patches to a clone, reconciles the tree, and only then commits its cached content/data; direct refresh failures propagate for the caller to contain. A non-array parse is invalid, patches re-apply on every file or Include-config update, and initial content falls back to `initial` only on `ENOENT`. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts` and `packages/host/webserver/tests/webserver.spec.ts`. 9. **`hmr/src/index.ts` exact config watching**: `registerConfig()` watches one absolute config path outside module roots, including a path under missing parents, serializes and coalesces refreshes, and returns an async disposer that closes the watcher and drains active work. Module watches realpath their existing base directory, attach change listeners before declaring the service ready, and use that spelling for Node module-cache identity; exact config watches realpath the deepest existing watch ancestor and restore the missing suffix. Those native paths prevent Windows short-name aliases from colliding with long-form libuv event paths while exact-config callbacks keep the requested filename. Refresh failures are normalized to `Error`, logged, and broadcast through the parallel `hmr/config-update-failed` event; observer failures are contained. Config-file changes discovered by the ordinary HMR watcher use the same serialized path. Covered by `packages/boot/app-boot/tests/hmr-config.spec.ts`. 10. **Vendored Node-compatible TypeScript**: marked erased imports explicitly across `cordis`, `loader`, `include`, `hmr`, and `schemastery` so Node's native TypeScript transform does not request types as runtime exports. Schemastery's source uses an ESM default export and its package declares `type: module`; its built ESM/CJS entries retain explicit `.mjs`/`.cjs` extensions. 11. **`include/src/index.ts` patch-semantics export**: extracted the private `applyPatches` body into the exported pure function `applyEntryPatches(data, patches, warn)` (the method delegates to it) and exported the `!!js` YAML dialect as `entryListSchema`, so `dsh --dump-config` composes and prints exactly what the include would mount without booting a tree. Behavior-preserving for mounting; the extraction exists because config tooling must never reimplement (and drift from) the patch algorithm. `applyEntryPatches` also indexes each `insert`ed entry as it is added, so a later patch in the same list can configure or disable a row an earlier patch inserted; upstream built the id index once before the patch loop, leaving inserted rows silently unpatchable. That matters because `dsh` composes an empty profile root with each bundle's patch layer, the profile's and the home-level `cordis.patch.yml`, and any `--patch` overlays as sibling patch lists at one include level — patches never cross an include boundary, so surface-only rows would otherwise be unreachable from user config. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts`. diff --git a/vendor/cordis/src/events.ts b/vendor/cordis/src/events.ts index e9bd85e3e1..c7bf42632e 100644 --- a/vendor/cordis/src/events.ts +++ b/vendor/cordis/src/events.ts @@ -340,7 +340,7 @@ export interface Events { /** Interception hook for a service binding (no core producer). */ 'internal/service'(this: Context, name: string, value: any): void /** Waterfall: a fiber config update is being applied; skip `next()` to veto. */ - 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void | Promise): void | Promise + 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void): void /** Waterfall: a service is being read through the context proxy. */ 'internal/get'(ctx: Context, name: string, error: Error, next: () => any): any /** Waterfall: a service is being written through the context proxy. */ diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts index 38a3197e29..6bb1caa7a5 100644 --- a/vendor/cordis/src/fiber.ts +++ b/vendor/cordis/src/fiber.ts @@ -730,8 +730,8 @@ export class Fiber { * * @param config — the new raw config; validated before anything restarts. * @param noSave — hint for persistence hooks not to write the change back. - * @returns the update waterfall result; the default restart returns a promise. - * @throws when validation, an update listener, or the restarted plugin fails. + * @returns nothing; the restart runs behind the `internal/update` waterfall. + * @throws {ValidationError} when the new config fails validation. */ update(config: any, noSave = false) { this.assertActive() @@ -745,7 +745,7 @@ export class Fiber { return } config = this._resolveConfig(config) - return this.context.waterfall(this, 'internal/update', config, noSave, () => { + this.context.waterfall(this, 'internal/update', config, noSave, () => { this.config = config this._error = undefined return this.restart() diff --git a/vendor/hmr/src/index.ts b/vendor/hmr/src/index.ts index f79d8344dc..ccd399622a 100644 --- a/vendor/hmr/src/index.ts +++ b/vendor/hmr/src/index.ts @@ -3,8 +3,8 @@ import type { Dict } from '@deepseek-ai/cosmokit' import { ModuleLoader, type ModuleJob, type ResolveResult } from '@deepseek-ai/cordis-plugin-loader' import type { Include } from '@deepseek-ai/cordis-plugin-include' import { FSWatcher, watch, type ChokidarOptions } from 'chokidar' -import { dirname, relative, resolve } from 'node:path' -import { realpath, stat } from 'node:fs/promises' +import { relative, resolve } from 'node:path' +import { realpath } from 'node:fs/promises' import { handleError } from './error.ts' import type {} from '@deepseek-ai/cordis-plugin-timer' import { fileURLToPath, pathToFileURL } from 'node:url' @@ -20,13 +20,7 @@ declare module '@deepseek-ai/cordis' { interface Events { 'hmr/change'(url: string): void 'hmr/reload'(reloads: Map): void - /** - * A watched config-file refresh failed. - * @param filename - Absolute path observed by HMR. - * @param error - Normalized refresh failure. - * @mode parallel - */ - 'hmr/config-update-failed'(filename: string, error: Error): Promise | void + } } @@ -52,37 +46,6 @@ interface Reload { runtime?: Plugin.Runtime } -interface ConfigRefresh { - dirty: boolean - running?: Promise -} - -interface ConfigRegistration { - watcher: FSWatcher -} - -async function findWatchRoot(filename: string): Promise<{ filename: string; root: string; depth: number }> { - let root = dirname(filename) - let depth = 0 - while (true) { - try { - if (!(await stat(root)).isDirectory()) throw new Error(`config watch parent is not a directory: ${root}`) - const canonicalRoot = await realpath(root) - return { - filename: resolve(canonicalRoot, relative(root, filename)), - root: canonicalRoot, - depth, - } - } catch (error) { - if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error - const parent = dirname(root) - if (parent === root) throw error - root = parent - depth += 1 - } - } -} - class Hmr extends Service { static inject = ['loader', 'timer'] @@ -90,9 +53,6 @@ class Hmr extends Service { private internal: ModuleLoader private watcher!: FSWatcher - private readonly configs = new Map() - private readonly configRefreshes = new WeakMap() - private readonly refreshTasks = new Set>() /** * Changes from externals will always trigger a full reload. @@ -124,68 +84,6 @@ class Hmr extends Service { this.baseDir = fileURLToPath(new URL(config.base || '.', ctx.baseUrl)) } - /** - * Watch one exact config path outside the configured module roots. - * @param filename - Config path, resolved against the HMR base directory. - * @param refresh - Refresh callback run serially on add, change, or unlink. - * @returns an asynchronous disposer once the exact watch is ready. - * @throws when HMR is inactive, the path is already registered, or watcher startup fails. - */ - async registerConfig(filename: string, refresh: () => Promise | void): Promise<() => Promise> { - if (!this.watcher) throw new Error('HMR is not active') - filename = resolve(this.baseDir, filename) - const target = await findWatchRoot(filename) - const watchFilename = target.filename - if (this.configs.has(watchFilename)) throw new Error(`config path already registered: ${filename}`) - - const { root, depth } = target - const watcher = watch(root, { - ...this.config, - cwd: undefined, - depth, - ignored: undefined, - ignoreInitial: false, - }) - const registration = { watcher } - this.configs.set(watchFilename, registration) - const onChange = (path: string) => { - const observed = resolve(path) - if (observed !== filename && observed !== watchFilename) return - this.refreshConfig(registration, filename, refresh) - } - watcher.on('add', onChange) - watcher.on('change', onChange) - watcher.on('unlink', onChange) - - const ready = Promise.withResolvers() - let readyState: 'pending' | 'resolved' | 'rejected' = 'pending' - watcher.once('ready', () => { - readyState = 'resolved' - ready.resolve() - }) - watcher.on('error', (error) => { - if (readyState === 'pending') { - readyState = 'rejected' - ready.reject(error) - } else { - this.ctx.logger.warn(error) - } - }) - - try { - await ready.promise - return this.ctx.effect(() => async () => { - if (this.configs.get(watchFilename) === registration) this.configs.delete(watchFilename) - await watcher.close() - await this.configRefreshes.get(registration)?.running - }, 'hmr.registerConfig()') - } catch (error) { - this.configs.delete(watchFilename) - await watcher.close() - throw error - } - } - /** * Resolve a module specifier to a URL, compatible with Node 22-24. */ @@ -197,12 +95,7 @@ class Hmr extends Service { } async* [Service.init]() { - yield async () => { - await this.watcher?.close() - await Promise.allSettled([...this.configs.values()].map(registration => registration.watcher.close())) - this.configs.clear() - await Promise.allSettled([...this.refreshTasks]) - } + yield () => this.watcher?.close() const { loader } = this.ctx const { root, ignored } = this.config @@ -229,31 +122,15 @@ class Hmr extends Service { ...this.config, cwd: watchBaseDir, ignored: path => match(relative(watchBaseDir, path)), - // The initial scan re-announces files the boot just consumed: an `add` - // for a config file refreshes an include whose initial apply may still - // be in flight, and a failing apply then rolls this plugin back while - // the scan-triggered refresh waits on that apply — a teardown deadlock - // that strands boot without a diagnostic. Only events after the scan - // matter here; `registerConfig` keeps its own initial scan because a - // user patch layer present at registration must apply once. ignoreInitial: true, }) const partialReload = this.ctx.debounce(() => this.partialReload(), this.config.debounce) - const onChange = (kind: 'add' | 'change' | 'unlink', path: string) => { - this.ctx.logger.debug('%s detected at %C', kind, path) + this.watcher.on('change', async (path) => { + this.ctx.logger.debug('change detected at %C', path) const filename = resolve(watchBaseDir, path) const configuredFilename = resolve(this.baseDir, path) - // Config reload: the file is a loader config file (e.g. cordis.yml). - for (const entry of loader.entries()) { - const include = entry.subtree as Include | undefined - if (include?.filename !== filename && include?.filename !== configuredFilename) continue - this.refreshConfig(include, include.filename, () => include.refresh()) - return - } - - if (kind !== 'change') return const url = pathToFileURL(filename).href // Full reload: the changed file is part of the framework @@ -267,11 +144,15 @@ class Hmr extends Service { return partialReload() } + for (const entry of loader.entries()) { + const include = entry.subtree as Include | undefined + if (include?.filename !== filename && include?.filename !== configuredFilename) continue + await include.refresh() + return + } + this.ctx.emit('hmr/change', url) - } - this.watcher.on('add', path => onChange('add', path)) - this.watcher.on('change', path => onChange('change', path)) - this.watcher.on('unlink', path => onChange('unlink', path)) + }) const ready = Promise.withResolvers() let readyState: 'pending' | 'resolved' | 'rejected' = root.length === 0 ? 'resolved' : 'pending' @@ -294,35 +175,6 @@ class Hmr extends Service { await ready.promise } - private refreshConfig(key: object, filename: string, refresh: () => Promise | void) { - const state = this.configRefreshes.get(key) ?? { dirty: false } - this.configRefreshes.set(key, state) - state.dirty = true - if (state.running) return - const task = (async () => { - do { - state.dirty = false - try { - await refresh() - } catch (reason) { - const error = reason instanceof Error ? reason : new Error(String(reason), { cause: reason }) - this.ctx.logger.warn('config reload at %C failed', filename) - this.ctx.logger.warn(error) - try { - await this.ctx.parallel('hmr/config-update-failed', filename, error) - } catch (rejection) { - this.ctx.logger.warn(rejection) - } - } - } while (state.dirty) - })().finally(() => { - state.running = undefined - this.refreshTasks.delete(task) - }) - state.running = task - this.refreshTasks.add(task) - } - // hide stack trace from HMR getOuterStack = (): string[] => [ // ' at HMR.partialReload ()', diff --git a/vendor/include/src/index.ts b/vendor/include/src/index.ts index 5ee20ef43e..cd7406bbab 100644 --- a/vendor/include/src/index.ts +++ b/vendor/include/src/index.ts @@ -44,8 +44,7 @@ function retryableWriteError(error: unknown): boolean { * Apply patch lists to an entry list — THE patch semantics of this include, * shared by mounting (`applyPatches`) and offline config tooling * (`dsh --dump-config`) so a dump can never drift from what boots. The input - * is never mutated and the result is always detached from it (even with no - * patches): patching or mounting shared entry objects would bake earlier + * is never mutated: patching shared entry objects would bake earlier patch * values into the cached parse, so repeated application (config hot-reloads) * could never revert a removed or changed patch. Inserted entries are indexed * as they are added, so a later patch in the same list can target a row an @@ -60,8 +59,8 @@ export function applyEntryPatches( patches: PatchOptions[] | undefined, warn: (message: string, ...args: any[]) => void, ): EntryOptions[] { + if (!patches?.length) return [...data] data = structuredClone(data) - if (!patches?.length) return data const entryMap = new Map() const buildMap = (entries: EntryOptions[]) => { @@ -127,20 +126,6 @@ export function applyEntryPatches( return data } -type ConfigUpdateStage = 'read' | 'parse' | 'validate' - -interface ReadCandidate { - content: string - data: EntryOptions[] -} - -class ConfigFileError extends Error { - constructor(public readonly stage: ConfigUpdateStage, path: string, cause: unknown) { - super(`failed to ${stage} config file ${path}`, { cause }) - this.name = 'ConfigFileError' - } -} - /** Runtime patch applied to entries loaded from an included config file. */ export interface PatchOptions { id?: string @@ -189,7 +174,6 @@ export class Include extends EntryTree { private writeTask?: NodeJS.Timeout | undefined private pendingWrite?: EntryOptions[] private writeQueue: Promise = Promise.resolve() - private applyQueue: Promise = Promise.resolve() constructor(ctx: Context, public config: Include.Config) { super(ctx) @@ -203,31 +187,20 @@ export class Include extends EntryTree { this.readonly = !this.type this.ctx.baseUrl = new URL('.', pathToFileURL(this.filename)).href - ctx.on('internal/update', async (config, _, next) => { + ctx.on('internal/update', (config, _, next) => { if (config.path !== this.config.path) return next() - await this.enqueue(async () => { - const data = this.applyPatches(this.data!, config.patches) - await this.root.update(data) - this.config = config + // Veto the fiber restart (children update in place), but persist the new + // config ourselves — `Fiber.update` only assigns `this.config` behind + // `next()`, and a stale `this.config.patches` would make the next + // `refresh()` re-apply the old overlay. + this.config = config + this.root.update(this.applyPatches(this.data!, config.patches)).catch((error) => { + this.ctx.logger.warn('config update at %C failed', this.filename) + this.ctx.logger.warn(error) }) }) } - /** - * Serialize one child-tree mutation behind every earlier one. The group's - * transactional `update` is not reentrant: two concurrent applies (the init - * apply racing an HMR-triggered refresh from the watcher's initial scan) - * interleave create and rollback on the same entries and strand the include - * fiber without settling, so every apply path funnels through this queue. - * A predecessor's failure is its own caller's outcome and never gates the - * next task. - */ - private enqueue(task: () => Promise): Promise { - const run = this.applyQueue.then(task, task) - this.applyQueue = run.then(() => {}, () => {}) - return run - } - private async checkAccess() { if (!this.type) return try { @@ -237,55 +210,56 @@ export class Include extends EntryTree { } } - private async read(forced = false): Promise { - let content: string - try { - content = await readFile(this.filename, 'utf8') - } catch (error) { - throw new ConfigFileError('read', this.filename, error) - } - if (!forced && this.content === content) return + private async read(forced = false) { + const content = await readFile(this.filename, 'utf8') + if (!forced && this.content === content) return false let data: any - try { - if (this.type === 'application/yaml') { - data = yaml.load(content, { schema }) - } else if (this.type === 'application/json') { - data = JSON.parse(content) - } else { - const module = await import(/* @vite-ignore */ this.filename) - data = module.default || module - } - } catch (error) { - throw new ConfigFileError('parse', this.filename, error) + if (this.type === 'application/yaml') { + data = yaml.load(content, { schema: entryListSchema }) + } else if (this.type === 'application/json') { + data = JSON.parse(content) + } else { + const module = await import(/* @vite-ignore */ this.filename) + data = module.default || module } + // An empty or truncated file (common mid-edit: editors and `sed -i` write + // through temp states) parses to `undefined`, not an error; reject every + // non-array shape here so callers see one "invalid file" signal. Content + // and data commit only on success, so an edit that is later reverted to + // the exact last good content correctly reads as "unchanged". if (!Array.isArray(data)) { - throw new ConfigFileError('validate', this.filename, new TypeError('config file must be a top-level array')) + throw new TypeError(`config file must be a top-level array of entries: ${this.filename}`) } - return { content, data } + this.content = content + this.data = data + await this.checkAccess() + return true } - private applyPatches(data: EntryOptions[], patches?: PatchOptions[]): EntryOptions[] { + private applyPatches(data: EntryOptions[], patches = this.config.patches): EntryOptions[] { return applyEntryPatches(data, patches, (message, ...args) => { this.ctx.root.logger?.('loader').warn(message, ...args) }) } async* [Service.init]() { - let candidate: ReadCandidate try { - candidate = (await this.read(true))! + await this.read() } catch (error) { - if (!(error instanceof ConfigFileError) || error.stage !== 'read' || (error.cause as NodeJS.ErrnoException)?.code !== 'ENOENT') throw error + // Only a missing file falls back to `initial` (or the not-found error): + // an existing-but-invalid file must fail loud with its real parse error, + // never be mislabelled as absent or silently overwritten. + if ((error as NodeJS.ErrnoException | null)?.code !== 'ENOENT') throw error if (this.config.initial) { - await this._writeFile(this.config.initial as any) - candidate = (await this.read(true))! + this.writeFile(this.config.initial as any) + await this.read() } else { throw new Error(`config file not found: ${this.filename}`) } } yield () => this.stop() - await this.apply(candidate) + await this.root.update(this.applyPatches(this.data!)) } async stop() { @@ -294,30 +268,18 @@ export class Include extends EntryTree { } /** - * Re-read the file and transactionally refresh child entries when content changed. - * @returns a promise resolving after the new tree commits, or immediately when unchanged. - * @throws when reading, parsing, validation, application, or rollback fails; the last good tree remains active when rollback succeeds. + * Re-read the file and refresh child entries when content changed. An + * unreadable or unparsable file logs a warning and keeps the last good + * tree: a hot-reload of a live app must never take the process down. */ async refresh() { - // Read inside the queue so the changed-content check compares against the - // predecessor's committed state, not a mid-apply snapshot. - await this.enqueue(async () => { - const candidate = await this.read() - if (!candidate) return - await this._apply(candidate) - }) - } - - private apply(candidate: ReadCandidate) { - return this.enqueue(() => this._apply(candidate)) - } - - private async _apply(candidate: ReadCandidate) { - const data = this.applyPatches(candidate.data, this.config.patches) - await this.root.update(data) - this.content = candidate.content - this.data = candidate.data - await this.checkAccess() + try { + if (!await this.read()) return + await this.root.update(this.applyPatches(this.data!)) + } catch (error) { + this.ctx.logger.warn('config reload at %C failed; keeping the running tree', this.filename) + this.ctx.logger.warn(error) + } } private async _writeFile(config: EntryOptions[]) { diff --git a/vendor/loader/src/config/entry.ts b/vendor/loader/src/config/entry.ts index 19dc11a40a..7cf2520af3 100644 --- a/vendor/loader/src/config/entry.ts +++ b/vendor/loader/src/config/entry.ts @@ -21,11 +21,6 @@ export interface EntryOptions { inject?: Inject | null } -function updateError(stage: 'import' | 'dispose' | 'apply' | 'rollback', options: EntryOptions, cause: unknown) { - const detail = cause instanceof Error ? cause.message : String(cause) - return new Error(`failed to ${stage} loader entry ${options.id} (${options.name}): ${detail}`, { cause }) -} - function takeEntries(object: {}, keys: string[]) { const result: [string, any][] = [] for (const key of keys) { @@ -43,11 +38,6 @@ function sortKeys(object: T, prepend = ['id', 'name'], append = [' return Object.assign(object, Object.fromEntries([...part1, ...rest, ...part2])) } -function replaceKeys(target: T, source: T): T { - for (const key of Object.keys(target)) Reflect.deleteProperty(target, key) - return Object.assign(target, source) -} - /** One configured plugin node inside an `EntryTree`. */ export class Entry { static readonly key = Symbol.for('cordis.entry') @@ -61,7 +51,6 @@ export class Entry { public subtree?: EntryTree _initTask?: Promise - _disposing = 0 constructor(public loader: Loader) { this.ctx = loader.ctx.extend({ [Entry.key]: this }) @@ -82,18 +71,13 @@ export class Entry { /** True when this entry or any owning parent entry is disabled. */ get disabled() { - return this._disabled(this.options) - } - - private _disabled(options: EntryOptions) { // group is always enabled - if (options.group) return false - if (this.disabledOf(options)) return true - let entry = this.parent.ctx.fiber.entry - while (entry) { + if (this.options.group) return false + let entry: Entry | undefined = this + do { if (this.disabledOf(entry.options)) return true entry = entry.parent.ctx.fiber.entry - } + } while (entry) return false } @@ -111,12 +95,12 @@ export class Entry { return evaluate(this.ctx, expr) } - private async _patchContext(diff: string[]) { - await this.context.waterfall('loader/patch-context', this, async () => { + private _patchContext(diff: string[]) { + this.context.waterfall('loader/patch-context', this, () => { Object.setPrototypeOf(this.ctx, this.parent.ctx) if (this.fiber?.uid && (diff.includes('config') || this.options.group)) { - await this.fiber.update(this.options.config, true) + this.fiber.update(this.options.config, true) } }) } @@ -127,122 +111,41 @@ export class Entry { await this.init() } - async _dispose(fiber = this.fiber) { - if (!fiber) return - if (this.fiber === fiber) this.fiber = undefined - this._disposing += 1 - try { - await fiber.dispose() - } finally { - this._disposing -= 1 - } - } - /** Merge new options, restart as needed, and persist through the parent tree. */ async update(options: Partial, create = false, force = false) { - const previousOptions = this.options - const legacy = { ...previousOptions } - const candidate = create ? options as EntryOptions : { ...previousOptions } - if (!create) { + const legacy = { ...this.options } + + // step 1: update options + if (create) { + this.options = options as EntryOptions + } else { for (const [key, value] of Object.entries(options)) { if (isNullable(value)) { - delete candidate[key as keyof EntryOptions] + delete this.options[key] } else { - candidate[key as keyof EntryOptions] = value as never + this.options[key] = value } } } - sortKeys(candidate) + sortKeys(this.options) - const diff = Object - .keys({ ...candidate, ...legacy }) - .filter(key => !deepEqual(candidate[key as keyof EntryOptions], legacy[key as keyof EntryOptions])) - if (!diff.length && !force) return - - const commit = () => { - if (create) return - this.options = replaceKeys(previousOptions, candidate) - } - - const previous = this.fiber - if (!previous?.uid) { - this.fiber = undefined - this.options = candidate - try { - if (!this._disabled(candidate)) await this.init() - } catch (error) { - this.options = previousOptions - throw error - } - commit() + // step 2: execute + if (this.disabled) { + this.fiber?.dispose() return } - if (this._disabled(candidate)) { - this.options = candidate - try { - await this._dispose(previous) - } catch (error) { - this.options = previousOptions - throw updateError('dispose', candidate, error) - } - commit() + // step 3: check if options are changed + if (this.fiber?.uid) { + const diff = Object + .keys({ ...this.options, ...legacy }) + .filter(key => !deepEqual(this.options[key], legacy[key])) + if (!diff.length && !force) return this.context.emit('loader/partial-dispose', this, legacy, true) - return + this._patchContext(diff) + } else { + await this.init() } - - const replace = diff.some(key => key === 'name' || key === 'inject' || key === 'group') - if (!replace) { - this.options = candidate - try { - await this._patchContext(diff) - } catch (error) { - this.options = previousOptions - try { - await this._patchContext(diff) - } catch (rollbackError) { - throw updateError('rollback', legacy, new AggregateError([error, rollbackError])) - } - this.context.emit('loader/partial-dispose', this, candidate, true) - throw updateError('apply', candidate, error) - } - commit() - this.context.emit('loader/partial-dispose', this, legacy, true) - return - } - - let plugin: any - try { - plugin = diff.includes('name') - ? this.loader.unwrapExports(await this.parent.tree.import(candidate.name, this.getOuterStack)) - : previous.runtime!.callback - } catch (error) { - throw updateError('import', candidate, error) - } - - const previousPlugin = previous.runtime!.callback - this.options = candidate - try { - await this._dispose(previous) - } catch (error) { - this.options = previousOptions - throw updateError('dispose', candidate, error) - } - - try { - await this._start(plugin) - } catch (error) { - this.options = previousOptions - try { - await this._start(previousPlugin) - } catch (rollbackError) { - throw updateError('rollback', legacy, new AggregateError([error, rollbackError])) - } - this.context.emit('loader/partial-dispose', this, candidate, true) - throw updateError('apply', candidate, error) - } - commit() - this.context.emit('loader/partial-dispose', this, legacy, true) } getOuterStack = () => { @@ -261,43 +164,26 @@ export class Entry { await (this._initTask ??= this._init()) } finally { this._initTask = undefined - if (!this.loader.getTasks().length) this.ctx.reflect.notify(['loader']) - } - await this._await() - } - - async _await() { - try { - await this.fiber?.await() - } catch (error) { - throw updateError('apply', this.options, error) } + this.fiber?.await().finally(() => { + if (this.loader.getTasks().length) return + this.ctx.reflect.notify(['loader']) + }) } private async _init() { - let plugin: any + let exports: any try { - plugin = this.loader.unwrapExports(await this.parent.tree.import(this.options.name, this.getOuterStack)) + exports = await this.parent.tree.import(this.options.name, this.getOuterStack) } catch (error) { - throw updateError('import', this.options, error) - } - try { - await this._start(plugin) - } catch (error) { - throw updateError('apply', this.options, error) - } - } - - private async _start(plugin: any) { - let fiber: Fiber | undefined - try { - await this._patchContext([]) - this.loader.showLog(this, 'apply') - fiber = this.fiber = this.ctx.registry.plugin(plugin, this.options.config, this.getOuterStack) - await fiber.await() - } catch (error) { - await this._dispose(fiber) - throw error + this.ctx.logger.error(error) + return + } finally { + this._initTask = undefined } + const plugin = this.loader.unwrapExports(exports) + this._patchContext([]) + this.loader.showLog(this, 'apply') + this.fiber = this.ctx.registry.plugin(plugin, this.options.config, this.getOuterStack) } } diff --git a/vendor/loader/src/config/group.ts b/vendor/loader/src/config/group.ts index 2e322b1e26..15d4d49e4b 100644 --- a/vendor/loader/src/config/group.ts +++ b/vendor/loader/src/config/group.ts @@ -19,23 +19,12 @@ export class EntryGroup { async create(options: Omit) { const id = this.tree.ensureId(options) - const existing = this.tree.store[id] - const entry: Entry = existing ?? (this.tree.store[id] = new Entry(this.ctx.loader)) - const previousParent = entry.parent + const entry: Entry = this.tree.store[id] ??= new Entry(this.ctx.loader) // Entry may be moved from another group, // so we need to update the parent reference. entry.parent = this // Use `create: true` to replace existing entry.options. - try { - await entry.update(options, true, true) - } catch (error) { - if (existing) { - entry.parent = previousParent - } else { - delete this.tree.store[id] - } - throw error - } + await entry.update(options, true, true) return entry.id } @@ -45,10 +34,10 @@ export class EntryGroup { if (index >= 0) config.splice(index, 1) } - async remove(id: string, isDispose = false) { + remove(id: string, isDispose = false) { const entry = this.tree.store[id] if (!entry) return - await entry._dispose() + entry.fiber?.dispose() if (!isDispose) { this.unlink(entry.options) } @@ -58,56 +47,26 @@ export class EntryGroup { async update(config: EntryOptions[]) { const oldConfig = this.data as EntryOptions[] - const seen = new Set() - for (const options of config) { - const id = this.tree.ensureId(options) - if (seen.has(id)) throw new TypeError(`duplicate loader entry id: ${id}`) - seen.add(id) - } + this.data = config const oldMap = Object.fromEntries(oldConfig.map(options => [options.id, options])) - const newMap = Object.fromEntries(config.map(options => [options.id, options])) + const newMap = Object.fromEntries(config.map(options => [options.id ?? Symbol('anonymous'), options])) - try { - const outcomes = await Promise.allSettled(config.map(options => this.create(options))) - // Disposal owns termination: sibling starts can still be settling after - // the containing tree has gone away, but their failures no longer - // describe a live update to roll back. - if (this.ctx.fiber.uid === null) return - const failures = outcomes - .filter((outcome): outcome is PromiseRejectedResult => outcome.status === 'rejected') - .map(outcome => outcome.reason) - if (failures.length === 1) throw failures[0] - if (failures.length > 1) throw new AggregateError(failures, 'loader entries failed to apply') - for (const id of Object.keys(oldMap)) { - if (!newMap[id]) await this.remove(id, true) + // update inner plugins + const ids = Reflect.ownKeys({ ...oldMap, ...newMap }) as string[] + await Promise.all(ids.map(async (id) => { + if (newMap[id]) { + await this.create(newMap[id]).catch((error) => { + this.ctx.logger.error(error) + }) + } else { + this.remove(id) } - this.data = config - } catch (error) { - const rollbackErrors: unknown[] = [] - for (const id of Object.keys(newMap).reverse()) { - if (oldMap[id]) continue - try { - await this.remove(id, true) - } catch (rollbackError) { - rollbackErrors.push(rollbackError) - } - } - for (const options of oldConfig) { - try { - await this.create(options) - } catch (rollbackError) { - rollbackErrors.push(rollbackError) - } - } - this.data = oldConfig - if (rollbackErrors.length) throw new AggregateError([error, ...rollbackErrors], 'loader entry rollback failed') - throw error - } + })) } - async stop() { + stop() { for (const options of this.data) { - await this.remove(options.id, true) + this.remove(options.id, true) } } } @@ -119,7 +78,9 @@ export class Group extends EntryGroup { constructor(public ctx: Context, public config: EntryOptions[]) { super(ctx, ctx.fiber.entry!.parent.tree) - ctx.on('internal/update', config => this.update(config)) + ctx.on('internal/update', (config) => { + this.update(config) + }) } async* [Service.init]() { diff --git a/vendor/loader/src/config/isolate.ts b/vendor/loader/src/config/isolate.ts index 0dd2a06c92..e2fd539157 100644 --- a/vendor/loader/src/config/isolate.ts +++ b/vendor/loader/src/config/isolate.ts @@ -93,7 +93,7 @@ export default function isolate(ctx: Context) { entry.ctx[Context.isolate] = Object.create(entry.ctx[Context.isolate]) }) - ctx.on('loader/patch-context', async (entry, next) => { + ctx.on('loader/patch-context', (entry, next) => { // step 1: generate new isolate map const newMap: Dict = Object.create(entry.parent.ctx[Context.isolate]) for (const name of Object.keys(entry.options.isolate ?? {})) { @@ -126,7 +126,7 @@ export default function isolate(ctx: Context) { swap(entry.ctx[Context.intercept], entry.options.intercept) // step 4: reload fiber - await next() + next() // step 5: replace service impl for (const [symbol1, symbol2, flag1, flag2] of Object.values(diff)) { diff --git a/vendor/loader/src/config/tree.ts b/vendor/loader/src/config/tree.ts index c1925f0b90..b75d641375 100644 --- a/vendor/loader/src/config/tree.ts +++ b/vendor/loader/src/config/tree.ts @@ -39,27 +39,12 @@ export abstract class EntryTree { .filter(isNonNullable) } - /** - * Wait until this tree has no active import or lifecycle tasks. - * @throws a settled fiber failure, or an aggregate when several fibers failed. - */ + /** Wait until this tree has no pending import or lifecycle tasks. */ async await() { while (true) { const tasks = this.getTasks() - if (tasks.length) { - await Promise.allSettled(tasks) - continue - } - const outcomes = await Promise.allSettled( - [...this.entries()].map(entry => entry._await()), - ) - const failures = outcomes - .filter((outcome): outcome is PromiseRejectedResult => outcome.status === 'rejected') - .map(outcome => outcome.reason) - if (failures.length === 1) throw failures[0] - if (failures.length > 1) throw new AggregateError(failures, 'loader fibers failed') - this.ctx.reflect.notify(['loader']) - if (!this.getTasks().length) return + if (!tasks.length) return + await Promise.allSettled(tasks) } } @@ -96,17 +81,15 @@ export abstract class EntryTree { /** Create an entry in the root group or a nested group. */ async create(options: Omit, parent: string | null = null, position = Infinity) { const group = this.resolveGroup(parent) - const id = await group.create(options) - const entry = this.resolve(id) - group.data.splice(position, 0, entry.options) + group.data.splice(position, 0, options as EntryOptions) group.tree.write() - return id + return group.create(options) } /** Stop and remove an entry from its parent group. */ - async remove(id: string) { + remove(id: string) { const entry = this.resolve(id) - await entry.parent.remove(id) + entry.parent.remove(id) entry.parent.tree.write() } @@ -114,31 +97,15 @@ export abstract class EntryTree { async update(id: string, options: Omit, parent?: string | null, position?: number) { const entry = this.resolve(id) const source = entry.parent - const sourceIndex = source.data.indexOf(entry.options) - let target = source if (parent !== undefined) { - target = this.resolveGroup(parent) + const target = this.resolveGroup(parent) source.unlink(entry.options) target.data.splice(position ?? Infinity, 0, entry.options) + target.tree.write() entry.parent = target } - try { - await entry.update(options, false, true) - } catch (error) { - if (parent !== undefined) { - target.unlink(entry.options) - source.data.splice(sourceIndex < 0 ? source.data.length : sourceIndex, 0, entry.options) - entry.parent = source - try { - await entry.update({}, false, true) - } catch (rollbackError) { - throw new AggregateError([error, rollbackError], `failed to roll back loader entry move ${id}`) - } - } - throw error - } source.tree.write() - if (target !== source) target.tree.write() + return entry.update(options, false, true) } /** Import a plugin module from a specifier or `cordis:` builtin. */ diff --git a/vendor/loader/src/index.ts b/vendor/loader/src/index.ts index 781353b983..ac736ae356 100644 --- a/vendor/loader/src/index.ts +++ b/vendor/loader/src/index.ts @@ -26,7 +26,7 @@ declare module '@deepseek-ai/cordis' { 'loader/config-update'(): void 'loader/entry-init'(entry: Entry): void 'loader/partial-dispose'(entry: Entry, legacy: Partial, active: boolean): void - 'loader/patch-context'(entry: Entry, next: () => void | Promise): void | Promise + 'loader/patch-context'(entry: Entry, next: () => void): void } interface Context { @@ -100,12 +100,12 @@ export class Loader extends EntryTree { return interpolate(this.ctx, config) }, { global: true }) - ctx.on('internal/update', async function (config, noSave, next) { + ctx.on('internal/update', function (config, noSave, next) { if (!this.entry || noSave || this.parent.fiber?.entry === this.entry) return next() - await next() const unparse = this.runtime?.Config?.['simplify'] this.entry.options.config = unparse ? unparse(config) : config this.entry.parent.tree.write() + return next() }, { global: true, prepend: true }) ctx.on('internal/update', function (config, _, next) { @@ -143,12 +143,9 @@ export class Loader extends EntryTree { const treeOwner = fiber.entry.parent.tree.ctx.fiber if (!treeOwner.uid || treeOwner.state === FiberState.UNLOADING) return - // case 6: Loader is replacing or removing this exact fiber - if (fiber.entry._disposing) return - this.showLog(fiber.entry, 'unload') - // case 7: fiber is disposed by loader behavior + // case 6: fiber is disposed by loader behavior // such as inject checker, config file update, ancestor group disable if (fiber.entry.disabled) return diff --git a/vendor/schemastery/package.json b/vendor/schemastery/package.json index 92f9b09b82..828339371e 100644 --- a/vendor/schemastery/package.json +++ b/vendor/schemastery/package.json @@ -14,15 +14,6 @@ "main": "lib/index.cjs", "module": "lib/index.mjs", "types": "lib/types/index.d.ts", - "exports": { - ".": { - "types": "./lib/types/index.d.ts", - "import": "./lib/index.mjs", - "require": "./lib/index.cjs" - }, - "./src/*": "./src/*", - "./package.json": "./package.json" - }, "files": [ "lib/index.mjs", "lib/index.cjs", From 2abb542a222032b1ad3c5abd7bb65ffffe15b8de Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 17:33:32 +0800 Subject: [PATCH 02/26] Adapt current consumers to nontransactional Cordis Loader Move exact user-patch watching into app boot and audit activation explicitly. Wait for CLI fallback HMR and preset subtrees. Join the first fiber-disposal result in the directory chooser and browser package runner. Keep async update errors observable without restoring generic Loader rollback. Restore the current workspace-link and Schemastery manifests and their gate. Preserve unconditional patch-input cloning, awaited Include initialization, and durable teardown writes. Update diagnostics, snapshots, bilingual docs, and the exhaustive vendor divergence ledger. Validation: focused Loader, watcher, preset, inventory, and cleanup tests; 100% watcher coverage; 32 Web preset cases; real CLI webhook model session; SDK smokes; 13 headless expected cases; 3 recorded-session replays; build, typecheck, lint contracts, and all 34 doc-sync gates. A full Node 24/Python 3.12 Vitest run had 21806 passes and two failures: a baseline-reproduced experimental CSS import failure and a Python probe timeout that passed alone. The default Node 26/Python 3.9 run additionally exposed unsupported Python and FileHandle-GC host failures. --- ...-fail-loud-releases-the-terminal.i18n.yaml | 4 +- ...6-07-31-fail-loud-releases-the-terminal.md | 2 +- ...7-31-fail-loud-releases-the-terminal.zh.md | 2 +- ...26-09-09-nontransactional-loader.i18n.yaml | 6 + .../2026-09-09-nontransactional-loader.md | 33 ++ .../2026-09-09-nontransactional-loader.zh.md | 33 ++ ...-09-user-patch-hmr-test-delivery.i18n.yaml | 4 +- ...2026-09-09-user-patch-hmr-test-delivery.md | 14 +- ...6-09-09-user-patch-hmr-test-delivery.zh.md | 14 +- apps/cli/src/profile-boot.ts | 1 + apps/cli/tests/built-bin.e2e.ts | 4 - .../stderr.expected.txt | 4 +- .../tests/profiles/sdk/keyless-smoke.e2e.ts | 2 +- package.json | 1 + packages/boot/app-boot/README.i18n.yaml | 4 +- packages/boot/app-boot/README.md | 4 +- packages/boot/app-boot/README.zh.md | 4 +- packages/boot/app-boot/package.json | 4 +- packages/boot/app-boot/src/index.ts | 68 +++-- packages/boot/app-boot/src/watch-config.ts | 89 ++++++ packages/boot/app-boot/tests/app-boot.spec.ts | 12 +- .../boot/app-boot/tests/config-reload.spec.ts | 36 ++- .../boot/app-boot/tests/user-patches.spec.ts | 59 ++-- .../boot/app-boot/tests/watch-config.spec.ts | 286 ++++++++++++++++++ .../cordis-client-runner/README.i18n.yaml | 4 +- .../extensions/cordis-client-runner/README.md | 2 +- .../cordis-client-runner/README.zh.md | 2 +- .../src/client/runtime.ts | 4 +- .../tests/runner.client.spec.ts | 30 +- .../host/directory-picker-auto/src/index.ts | 10 +- .../tests/loader-composition.spec.ts | 22 +- .../plugin-inventory/tests/inventory.spec.ts | 2 +- .../host/webserver/tests/webserver.spec.ts | 14 +- .../tests/inventory.spec.ts | 1 + .../preset/agent-presets/README.i18n.yaml | 4 +- packages/preset/agent-presets/README.md | 2 +- packages/preset/agent-presets/README.zh.md | 2 +- packages/preset/agent-presets/src/mount.ts | 20 +- .../preset/agent-presets/tests/mount.spec.ts | 9 +- .../tests/loader-composition.spec.ts | 1 + pnpm-lock.yaml | 6 +- pnpm-workspace.yaml | 4 + scripts/verify-vendored-links.ts | 72 +++++ vendor/README.md | 18 +- vendor/cordis/src/events.ts | 2 +- vendor/cordis/src/fiber.ts | 6 +- vendor/hmr/src/index.ts | 1 - vendor/include/src/index.ts | 17 +- vendor/loader/src/config/entry.ts | 11 +- vendor/loader/src/config/isolate.ts | 3 +- vendor/loader/src/config/utils.ts | 2 +- vendor/loader/src/index.ts | 2 +- vendor/schemastery/package.json | 9 + 53 files changed, 786 insertions(+), 186 deletions(-) create mode 100644 .agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml create mode 100644 .agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md create mode 100644 .agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md create mode 100644 packages/boot/app-boot/src/watch-config.ts create mode 100644 packages/boot/app-boot/tests/watch-config.spec.ts create mode 100644 scripts/verify-vendored-links.ts diff --git a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml index 1f631789a8..89a74eaa00 100644 --- a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml +++ b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md -2026-07-31-fail-loud-releases-the-terminal.md: e5196121a850997b5eff045a26dd7c638776196c -2026-07-31-fail-loud-releases-the-terminal.zh.md: 5cec9fe7d4ac75df1b5c88f2ea4cb0a665730719 +2026-07-31-fail-loud-releases-the-terminal.md: a6b8ccc5a0ad885a349b32707face7bfce9d7bed +2026-07-31-fail-loud-releases-the-terminal.zh.md: 728fca424d2622af6222d51a3240eafd0e117986 diff --git a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md index e5196121a8..a6b8ccc5a0 100644 --- a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md +++ b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.md @@ -15,7 +15,7 @@ $ 1;2;4cecho hello zsh: command not found: 4cecho ``` -The Loader mounts entries concurrently, so entry failure order is not startup order. `ui-tui` activates and calls pi-tui's `ProcessTerminal.start()`, which puts stdin in raw mode, enables bracketed paste, and writes the Kitty keyboard-protocol probe — a sequence ending in a Device Attributes query (`ESC [ c`). A sibling entry (here `llm-pi-ai`) then rejects on its own config. At the time, that rejection surfaced as an unhandled rejection, and `installFailLoud` wrote one stderr line and called `process.exit(1)` immediately. (The transactional Loader now settles config-tree failures through `boot()`, which disposes the partial context itself; the release hook remains the guard for rejections `boot()` cannot see — a plugin's detached async work rejecting during or after mounting.) +The Loader mounts entries concurrently, so entry failure order is not startup order. `ui-tui` activates and calls pi-tui's `ProcessTerminal.start()`, which puts stdin in raw mode, enables bracketed paste, and writes the Kitty keyboard-protocol probe — a sequence ending in a Device Attributes query (`ESC [ c`). A sibling entry (here `llm-pi-ai`) then rejects on its own config. At the time, that rejection surfaced as an unhandled rejection, and `installFailLoud` wrote one stderr line and called `process.exit(1)` immediately. (The [Loader activation audit](../simplification/2026-09-09-nontransactional-loader.md) reports config-tree failures through `boot()`, which disposes the partial context itself; the release hook remains the guard for rejections `boot()` cannot see — a plugin's detached async work rejecting during or after mounting.) Nothing disposed the tree, so `ProcessTerminal.stop()` never ran: raw mode, bracketed paste, and the keyboard protocol stayed set on the shell that outlived the process. The terminal's answer to the Device Attributes query (`1;2;4c`) arrived after exit and was read by the shell as typed input — the literal text above. diff --git a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md index 5cec9fe7d4..728fca424d 100644 --- a/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md +++ b/.agents/notes/implemented/bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md @@ -17,7 +17,7 @@ zsh: command not found: 4cecho Loader 并发挂载各个条目，因此条目失败的顺序并不等于启动顺序。`ui-tui` 会先激活并调用 pi-tui 的 `ProcessTerminal.start()`，它把 stdin 置为 raw 模式、启用 bracketed paste，并写出 Kitty 键盘协议探测序列——该序列以一个 Device Attributes 查询（`ESC [ c`）结尾。随后某个同级条目（这里是 `llm-pi-ai`）因自身配置而 rejection。 -在当时，该 rejection 以未处理 rejection 的形式浮现，而 `installFailLoud` 只写一行 stderr 就立即调用 `process.exit(1)`。（事务化 Loader 现在让配置树失败经 `boot()` 结算，由它自行 dispose（资源释放）部分构建的上下文；release 钩子仍然守护 `boot()` 看不到的 rejection——插件游离的异步工作在挂载期间或挂载之后失败。）没有任何环节 dispose 这棵树，因此 `ProcessTerminal.stop()` 从未执行：raw 模式、bracketed paste 和键盘协议都残留在比进程活得更久的 shell 上。终端对 Device Attributes 查询的回应（`1;2;4c`）在进程退出之后才到达，被 shell 当作用户输入读入——也就是上面那段字面文本。 +在当时，该 rejection 以未处理 rejection 的形式浮现，而 `installFailLoud` 只写一行 stderr 就立即调用 `process.exit(1)`。（[Loader 激活检查](../simplification/2026-09-09-nontransactional-loader.zh.md) 让配置树失败经 `boot()` 报告，由它自行 dispose（资源释放）部分构建的上下文；release 钩子仍然守护 `boot()` 看不到的 rejection——插件游离的异步工作在挂载期间或挂载之后失败。）没有任何环节 dispose 这棵树，因此 `ProcessTerminal.stop()` 从未执行：raw 模式、bracketed paste 和键盘协议都残留在比进程活得更久的 shell 上。终端对 Device Attributes 查询的回应（`1;2;4c`）在进程退出之后才到达，被 shell 当作用户输入读入——也就是上面那段字面文本。 `/exit` 路径从不受影响，因为它会 dispose 整棵树，从而进入 TUI 自身的 `shutdown()`：先 `drainInput()`（吸收尚未返回的响应），再 `ui.stop()`。缺陷在于**启动失败**没有通往这同一套拆卸流程的路径。 diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml new file mode 100644 index 0000000000..0cb0ade9b5 --- /dev/null +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml @@ -0,0 +1,6 @@ +# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each +# side as of the last confirmed-consistent state. Both languages carry equal authority; +# after editing either side, bring the other along and re-record with: +# pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md +2026-09-09-nontransactional-loader.md: e3d43e6d56235e35d1a273900a935a7df19318be +2026-09-09-nontransactional-loader.zh.md: 55abb03a1f72c9e88304033d76d3db80bb28f916 diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md new file mode 100644 index 0000000000..e3d43e6d56 --- /dev/null +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md @@ -0,0 +1,33 @@ +# Agent Note: Keep Loader mutations non-transactional + +Status: implemented + +English | [中文](2026-09-09-nontransactional-loader.zh.md) + +## Problem + +Transactional config reload preserves an old plugin generation after a failed edit, but requires Loader to own candidate imports, lifecycle settlement, rollback, option identity, and Include serialization. These changes make the vendored implementation substantially different from its pinned sources. Application startup and profile patch watching also depend on that settlement implicitly. + +## Decision + +Revert the five commits in [#932](https://github.com/deepseek-harness/deepseek-harness/pull/932), resolving package moves and retaining independent later behavior. The reported merge commit belongs to the larger #936 dependency chain; reverting its first-parent diff would remove unrelated repository-plugin support. The [vendor ledger](../../../../vendor/README.md#local-modifications) records every retained source change against the unchanged pins. + +Loader changes entry options eagerly. EntryGroup starts siblings concurrently and logs application failures; EntryTree waits for outstanding work without rejecting failed fibers. Neither restores a previous plugin or configuration. Include retains parse validation and patch reapplication, but plugin failures can leave a partially applied tree. + +Application consumers own their completion checks. The CLI waits for its fallback HMR service before installing live patch watchers. The directory chooser checks the entries it mounts. The chooser and browser package runner capture the first fiber-disposal result before removing the entry, then await it before reporting teardown complete. Preset mounting waits for its subtree and reports import, activation, and missing-service failures. [App boot](../../../../packages/boot/app-boot/README.md) owns exact patch-file watching, activation audits, and partial-context cleanup. These adaptations are separate from the reverse patch. + +The small update-result extension forwards asynchronous restart failures through Fiber and Entry updates. The detached import-completion observer handles both fiber outcomes; the fiber still retains its failure for an explicit audit. Durable Include writes drain before and after child removal so a later teardown write cannot erase an earlier terminal write failure. Missing-file initialization waits for its write and rereads the file before mounting initial entries. + +## Alternatives considered + +**Keep transactional Loader updates.** They provide automatic recovery from a rejected plugin candidate, but retain the vendored lifecycle machinery being removed. Parse failures can be contained without plugin rollback. + +**Restore every vendored file verbatim.** This would also remove lazy injected config evaluation, conditional disabled entries, lifecycle disposal fixes, durable writes, and module-loader compatibility. Those changes have independent consumers and remain recorded in the vendor ledger. + +**Move generic rollback into app boot.** This would retain the same candidate-generation and restoration obligations under another owner. Applications instead report failures and allow a later valid edit to recover. + +## Consequences + +A plugin activation failure can leave the new options and a failed fiber in place. Callers that require active plugins must audit after settlement; awaiting `Loader.create()` alone does not establish activation. Automatic plugin rollback requires a separate future decision with evidence that its recovery benefit warrants the additional lifecycle implementation. + +[Live-patch tests](../testing/2026-09-09-user-patch-hmr-test-delivery.md) retain controlled event delivery and native watcher coverage, while asserting failure reporting without rollback. The [terminal-release policy](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.md) remains applicable to fatal errors and partial boot teardown. Web preset composition and a real CLI webhook-created model Session provide the application-level verification beyond hand-mounted plugins. diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md new file mode 100644 index 0000000000..55abb03a1f --- /dev/null +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md @@ -0,0 +1,33 @@ +# Agent Note: 保持 Loader 更改非事务化 + +Status: implemented + +[English](2026-09-09-nontransactional-loader.md) | 中文 + +## 问题 + +事务化配置重载会在编辑失败后保留旧插件代次，但要求 Loader 负责候选导入、生命周期结算、回滚、选项对象身份和 Include 串行化。这些更改使 vendor 实现与固定来源产生显著差异。应用启动和 profile patch 监视也隐式依赖该结算行为。 + +## 决策 + +撤销 [#932](https://github.com/deepseek-harness/deepseek-harness/pull/932) 中的五个提交，解决包移动冲突并保留后续独立行为。记录的合并提交属于更大的 #936 依赖链；撤销其第一父提交差异还会删除无关的仓库插件支持。[Vendor 修改记录](../../../../vendor/README.md#local-modifications) 按不变的固定来源记录每项保留的源码更改。 + +Loader 立即更改条目选项。EntryGroup 并发启动同级条目并记录应用失败；EntryTree 等待未完成的工作，但不因失败的 fiber 而拒绝。两者均不恢复旧插件或配置。Include 保留解析校验和 patch 重应用，但插件失败可能留下部分应用的配置树。 + +应用消费者负责完成检查。CLI 在安装实时 patch 监视器前等待其回退 HMR 服务。目录选择器检查其挂载的条目。选择器和浏览器包运行器在移除条目前取得首次 fiber 释放的结果，并等待该结果后才报告拆卸完成。预设挂载等待其子树，并报告导入、激活和缺少服务的失败。[应用启动](../../../../packages/boot/app-boot/README.zh.md) 负责精确 patch 文件监视、激活检查和部分上下文清理。这些适配与反向补丁分开。 + +小范围的更新结果扩展通过 Fiber 和 Entry 更新传递异步重启失败。游离的导入完成观察器处理 fiber 的两种结果；fiber 仍保留失败信息供显式检查。Include 的持久写入在删除子条目前后均排空，防止后续拆卸写入掩盖更早的终止性写入失败。缺失文件的初始化等待写入完成，并重新读取文件后才挂载初始条目。 + +## 考虑过的替代方案 + +**保留事务化 Loader 更新。** 它们能从被拒绝的插件候选自动恢复，但会保留本次删除的 vendor 生命周期机制。解析失败可以独立于插件回滚进行处理。 + +**逐字恢复所有 vendor 文件。** 这还会删除延迟注入配置求值、条件禁用条目、生命周期释放修复、持久写入和模块加载器兼容性。这些更改具有独立消费者，并继续记录在 vendor 修改记录中。 + +**将通用回滚移入应用启动。** 这会在另一归属下保留相同的候选代次与恢复义务。应用改为报告失败，并允许后续有效编辑恢复。 + +## 后果 + +插件激活失败可能保留新选项和失败的 fiber。要求插件处于激活状态的调用者必须在结算后检查；仅等待 `Loader.create()` 不能证明激活。自动插件回滚需要后续独立决策，并证明其恢复收益值得额外的生命周期实现。 + +[实时 patch 测试](../testing/2026-09-09-user-patch-hmr-test-delivery.zh.md) 保留受控事件投递和原生监视覆盖，同时断言不回滚时的失败报告。[终端释放策略](../bug-fix/2026-07-31-fail-loud-releases-the-terminal.zh.md) 仍适用于致命错误和部分启动拆卸。Web preset 组合与真实 CLI webhook 创建的模型 Session 提供手动挂载插件之外的应用级验证。 diff --git a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml index 81de55da66..699ced6cd7 100644 --- a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml +++ b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md -2026-09-09-user-patch-hmr-test-delivery.md: 427cf938d38eaf5c351fc0334bfd7df766d5663c -2026-09-09-user-patch-hmr-test-delivery.zh.md: c2a3a14c9f322e748dbfd131a98138b13c5d47a6 +2026-09-09-user-patch-hmr-test-delivery.md: fadd191650411f07c3b8b1f35c94e73869fbc8e2 +2026-09-09-user-patch-hmr-test-delivery.zh.md: b108cf25766ff108d87c429e9f208c2d4cf7afd2 diff --git a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md index 427cf938d3..fadd191650 100644 --- a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md +++ b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md @@ -1,4 +1,4 @@ -# Agent Note: User-patch transactions control filesystem event delivery +# Agent Note: User-patch tests control filesystem event delivery Status: implemented @@ -6,22 +6,22 @@ English | [中文](2026-09-09-user-patch-hmr-test-delivery.zh.md) ## Problem -The [macOS Sandbox run](https://github.com/deepseek-harness/deepseek-harness/actions/runs/34238200206/job/102101292119) times out while waiting for the first user-patch addition. Concurrent local reproductions show no filesystem notification reaching HMR. A polling variant also misses a subsequent edit while HMR has no pending refresh. These failures prevent the transaction assertions from exercising the parser, activation, and rollback behavior they own. +The [macOS Sandbox run](https://github.com/deepseek-harness/deepseek-harness/actions/runs/34238200206/job/102101292119) times out while waiting for the first user-patch addition. Concurrent local reproductions show no filesystem notification reaching HMR. A polling variant also misses a subsequent edit while HMR has no pending refresh. These failures prevent the refresh assertions from exercising the parser, activation, and recovery behavior they own. ## Decision -The [user-patch transaction test](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) writes real patch files and delivers their add, change, and unlink events through a Chokidar watcher without native watch handles. HMR registration, refresh serialization, Include recomposition, plugin activation, failure broadcasting, rollback, and recovery remain real. The fixture restores its watcher factory and disposes the Context even when setup fails before the local cleanup block. +The [user-patch test](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) writes real patch files and delivers their add, change, and unlink events through a Chokidar watcher without native watch handles. App-boot watcher registration, refresh serialization, Include recomposition, plugin activation, failure reporting, and recovery remain real; plugin rollback is absent under the [Loader policy](../simplification/2026-09-09-nontransactional-loader.md). The fixture restores its watcher factory and disposes the Context even when setup fails before the local cleanup block. -The separate [HMR config tests](../../../../packages/boot/app-boot/tests/hmr-config.spec.ts) own native notification delivery, including add/change/unlink, initially absent parents, and filesystem aliases. The transaction test does not establish operating-system delivery guarantees. +The separate [watcher tests](../../../../packages/boot/app-boot/tests/watch-config.spec.ts) own native notification delivery, including add/change/unlink, initially absent parents, and filesystem aliases. The refresh test does not establish operating-system delivery guarantees. ## Alternatives considered -**Native notifications for every transaction assertion.** Rejected because it repeats the native delivery dependency across each parser and activation state transition. A missing event obscures which downstream behavior is broken. +**Native notifications for every refresh assertion.** Rejected because it repeats the native delivery dependency across each parser and activation state transition. A missing event obscures which downstream behavior is broken. **Polling and fixed settling delays.** Rejected because neither acknowledges delivery of the next edit. Chokidar readiness does not expose completion of Node's asynchronous initial polling baseline; a local polling reproduction still misses changes. Increasing the test deadline cannot recover an event that was never emitted. -**Mock HMR registration or Include.** Rejected because the test must retain transactional recomposition and last-good-state assertions after activation and parse failures. +**Mock HMR registration or Include.** Rejected because the test must retain real recomposition, report activation failures, and preserve the running configuration after parse failures. ## Consequences -The transaction sequence retains every semantic assertion and removes fixed change-throttle sleeps. Independent concurrent processes exercise isolation, and a forced setup failure verifies watcher closure and factory restoration before the next case. Native watcher failures remain visible in their owning tests and require their own diagnosis. +The refresh sequence retains its semantic assertions and removes fixed change-throttle sleeps. Independent concurrent processes exercise isolation, and a forced setup failure verifies watcher closure and factory restoration before the next case. Native watcher failures remain visible in their owning tests and require their own diagnosis. diff --git a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md index c2a3a14c9f..b108cf2576 100644 --- a/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md +++ b/.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md @@ -1,4 +1,4 @@ -# Agent Note: 用户 patch 事务控制文件系统事件投递 +# Agent Note: 用户 patch 测试控制文件系统事件投递 Status: implemented @@ -6,22 +6,22 @@ Status: implemented ## 问题 -[macOS Sandbox 运行](https://github.com/deepseek-harness/deepseek-harness/actions/runs/34238200206/job/102101292119) 在等待首次用户 patch 新增时超时。本地并发复现表明，没有文件系统通知到达 HMR。轮询变体也会遗漏后续修改，此时 HMR 没有待执行的刷新。这些失败阻止事务断言执行其负责验证的解析、激活与回滚行为。 +[macOS Sandbox 运行](https://github.com/deepseek-harness/deepseek-harness/actions/runs/34238200206/job/102101292119) 在等待首次用户 patch 新增时超时。本地并发复现表明，没有文件系统通知到达 HMR。轮询变体也会遗漏后续修改，此时 HMR 没有待执行的刷新。这些失败阻止刷新断言执行其负责验证的解析、激活与回滚行为。 ## 决策 -[用户 patch 事务测试](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) 写入真实 patch 文件，并通过不持有原生监听句柄的 Chokidar watcher 投递 add、change 和 unlink 事件。HMR 注册、刷新串行化、Include 重组、插件激活、失败广播、回滚与恢复仍使用真实实现。即使初始化在进入局部清理块前失败，夹具也会恢复 watcher 工厂并销毁 Context。 +[用户 patch 测试](../../../../packages/boot/app-boot/tests/user-patches.spec.ts) 写入真实 patch 文件，并通过不持有原生监听句柄的 Chokidar watcher 投递 add、change 和 unlink 事件。应用启动监视器注册、刷新串行化、Include 重组、插件激活、失败报告与恢复仍使用真实实现；[Loader 策略](../simplification/2026-09-09-nontransactional-loader.zh.md) 不提供插件回滚。即使初始化在进入局部清理块前失败，夹具也会恢复 watcher 工厂并销毁 Context。 -独立的 [HMR 配置测试](../../../../packages/boot/app-boot/tests/hmr-config.spec.ts) 负责原生通知投递，包括 add/change/unlink、初始不存在的父目录和文件系统别名。事务测试不验证操作系统的投递保证。 +独立的 [监视器测试](../../../../packages/boot/app-boot/tests/watch-config.spec.ts) 负责原生通知投递，包括 add/change/unlink、初始不存在的父目录和文件系统别名。刷新测试不验证操作系统的投递保证。 ## 考虑过的替代方案 -**每个事务断言都使用原生通知。** 不采用，因为这会让每次解析器与激活状态转换都重复依赖原生投递。事件缺失会掩盖下游究竟哪个行为出现问题。 +**每个刷新断言都使用原生通知。** 不采用，因为这会让每次解析器与激活状态转换都重复依赖原生投递。事件缺失会掩盖下游究竟哪个行为出现问题。 **轮询与固定等待。** 不采用，因为两者都不能确认下一次修改已经投递。Chokidar 就绪状态不暴露 Node 异步初始轮询基线的完成时刻；本地轮询复现仍会遗漏修改。延长测试期限无法恢复从未发出的事件。 -**Mock HMR 注册或 Include。** 不采用，因为测试必须保留事务重组，以及激活和解析失败后的最后有效状态断言。 +**Mock HMR 注册或 Include。** 不采用，因为测试必须保留真实重组、报告激活失败，并在解析失败后保留运行中的配置。 ## 影响 -事务序列保留所有语义断言，并移除固定的 change 节流等待。独立并发进程验证隔离性，强制初始化失败则验证 watcher 在下一用例前关闭、工厂在下一用例前恢复。原生 watcher 失败仍在其所属测试中可见，需要单独诊断。 +刷新序列保留其语义断言，并移除固定的 change 节流等待。独立并发进程验证隔离性，强制初始化失败则验证 watcher 在下一用例前关闭、工厂在下一用例前恢复。原生 watcher 失败仍在其所属测试中可见，需要单独诊断。 diff --git a/apps/cli/src/profile-boot.ts b/apps/cli/src/profile-boot.ts index 0715efe1bb..1c50e1b581 100644 --- a/apps/cli/src/profile-boot.ts +++ b/apps/cli/src/profile-boot.ts @@ -368,6 +368,7 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con await ctx.loader.create({ name: '@deepseek-ai/cordis-plugin-timer' }) } await ctx.loader.create({ name: '@deepseek-ai/cordis-plugin-hmr', config: { root: [] } }) + await ctx.loader.await() } await watchUserPatches(ctx, { binName: NAME, diff --git a/apps/cli/tests/built-bin.e2e.ts b/apps/cli/tests/built-bin.e2e.ts index ef606d49af..3697d3fb75 100644 --- a/apps/cli/tests/built-bin.e2e.ts +++ b/apps/cli/tests/built-bin.e2e.ts @@ -757,10 +757,6 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', }, SPAWN_TIMEOUT_MS + 30_000) it('reports a patch-overlay boot failure without hanging', async () => { - // The HMR main watcher's initial scan once refreshed the include - // mid-initial-apply, deadlocking the failing apply's rollback against the - // refresh drain: dsh exited 13 with no diagnostic instead of settling - // ([vendor/README.md](../../../vendor/README.md)). const home = mkdtempSync(join(tmpdir(), 'dsh-invalid-patch-')) try { const result = await runBuiltBin(['--profile', 'web', '--patch', invalidProvider], { diff --git a/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt b/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt index f3252180b9..74e084a926 100644 --- a/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt +++ b/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt @@ -1,3 +1,3 @@ -headless-test-driver: plugin tree failed to load: failed to apply loader entry include (cordis:include): failed to apply loader entry activation-error (./activation-error.mjs): startup activation snapshot failure -Error: startup activation snapshot failure +headless-test-driver: plugin tree failed to load: headless-test-driver: 1 entry did not activate +./activation-error.mjs: Error: startup activation snapshot failure at activation-error-fixture diff --git a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts index c879e5b8b9..51c85178db 100644 --- a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts +++ b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts @@ -355,7 +355,7 @@ describe('Python SDK dsh profile keyless smoke', () => { expect(exitCode, stderr).toBe(1) expect(stdout).toBe('') expect(stderr).toContain('plugin tree failed to load') - expect(stderr).toContain('failed to apply loader entry sdk-jsonrpc-server (@deepseek-ai/dsh-sdk-jsonrpc-server)') + expect(stderr).toContain('@deepseek-ai/dsh-sdk-jsonrpc-server: SyntaxError:') expect(stderr).toContain('sometimes') } finally { await rm(root, { recursive: true, force: true }) diff --git a/package.json b/package.json index d5a5b1c41b..a09fa3f997 100644 --- a/package.json +++ b/package.json @@ -133,6 +133,7 @@ "verify-client-packages": "tsx scripts/verify-client-packages.ts", "verify-client-ui-i18n": "tsx scripts/verify-client-ui-i18n.ts", "verify-no-bare-dispatcher": "tsx scripts/verify-no-bare-dispatcher.ts", + "verify-vendored-links": "tsx scripts/verify-vendored-links.ts", "verify-cordis-config": "tsx scripts/verify-cordis-config.ts", "rescope-vendor": "tsx scripts/rescope-vendor.ts", "rescope-vendor:check": "tsx scripts/rescope-vendor.ts --check", diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 3d4666ea0d..ce5f0f1cee 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: df386b64089f962960b09538381e9d4b4905feb0 -README.zh.md: 5a7246c52ea5bcc8d5322d9fac4a87ec2e2ef4cc +README.md: bbc3e3147a455149d3e263f0bf4f1091d93f46cc +README.zh.md: 53d8b58df6da74581539585bce81d885f7708cf8 diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index df386b6408..bbc3e3147a 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -54,7 +54,7 @@ Your machine-local preferences also live in the Harness home: - **`.env`** — your ordinary environment layers: the invoking directory's file outranks the Harness-home file, and both sit below the inherited environment. Variables that decide how the process starts (`PATH`, `DSH_*`, `XDG_*` and similar) are rejected from files: export them instead. The four proxy names (`HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY`) are accepted from the Harness-home file only, never from the invoking directory's, which arrives with a clone. For a non-product bin that just wants one directory's `.env`, a missing file is fine and an unloadable one prints one labelled warning line. - **`cordis.patch.yml`** — your tweak layer, applied after every bundle layer (per-profile first, then the home-level file, which therefore outranks it): replace one entry's whole config (restating the fields you keep), insert new entries, or interpolate `!!js` expressions at boot. A patch naming an entry that does not exist prints a stderr warning; an empty or comments-only file fails boot — disable the layer with `[]` instead. -Profiles with `patchReload: live` watch both user patch files: a valid edit recomposes without restart, while a rejected edit leaves the last good app running. A `startup` profile installs neither those watchers nor the launcher's watch-only HMR fallback. +Profiles with `patchReload: live` watch both user patch files. Parse failures preserve the running configuration; plugin activation failures are reported and can leave a partially applied tree. A later valid edit can recover it. Loader changes are not rolled back. A `startup` profile installs neither those watchers nor the launcher's watch-only HMR fallback. Inserted plugin names may be absolute filesystem paths, file URLs, or package specifiers. Patch loading converts absolute paths and patch-relative `./` or `../` paths to file URLs within `insert` rows and their nested groups; existing-entry name assertions and replacement `config` values remain literal. @@ -118,7 +118,7 @@ Read these pages when the package-level contract is not enough. They move from t - [dsh-home-paths](../../util/home-paths/README.md) — the Harness-home resolver (`resolveDshHome`). - [Configuration source ownership](../../../.agents/notes/implemented/architecture/2026-08-04-configuration-source-ownership.md) — why a discovered file may not decide bootstrap behavior. - [Profile plugin bundles](../../../.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.md) — the profile and bundle composition design. -- [User-patch HMR tests](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md) — ownership of transaction behavior and native filesystem delivery. +- [User-patch HMR tests](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.md) — ownership of live-patch behavior and native filesystem delivery. ----- diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 5a7246c52e..53d8b58df6 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -54,7 +54,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head - **`.env`**——你的普通环境层：调用目录的文件优先于 harness home 的文件，两者都低于继承环境。决定进程如何启动的变量（`PATH`、`DSH_*`、`XDG_*` 等）会被文件拒绝：请改为导出。四个代理名（`HTTP_PROXY`、`HTTPS_PROXY`、`ALL_PROXY`、`NO_PROXY`）只从 harness home 的文件接受，绝不从调用目录的文件接受——后者随 clone 一起到来。对于只想加载某个目录 `.env` 的非产品 bin，文件缺失不影响启动，文件无法加载时输出一行带标签的警告。 - **`cordis.patch.yml`**——你的 tweak 层，应用在所有组合包层之后（先应用逐 profile 的文件，再应用 home 级文件，因此后者优先级更高）：替换某个条目的整个 config（重述你要保留的字段）、插入新条目，或在启动时插值 `!!js` 表达式。patch 指定的条目不存在时输出 stderr 警告；空文件或仅含注释的文件会导致启动失败——如需禁用该层，请改用 `[]`。 -带 `patchReload: live` 的 profile 会监视两份用户 patch 文件：有效编辑无需重启即可重新组合，被拒绝的编辑则让最后一个可用应用继续运行。`startup` profile 既不安装这些监视器，也不安装 launcher 的仅监视 HMR 回退。 +带 `patchReload: live` 的 profile 会监视两份用户 patch 文件。解析失败会保留运行中的配置；插件激活失败会被报告，并可能留下部分应用的配置树。后续有效编辑可以恢复它。Loader 更改不会回滚。`startup` profile 既不安装这些监视器，也不安装 launcher 的仅监视 HMR 回退。 插入条目的插件名可以是绝对文件系统路径、文件 URL 或包标识符。patch 加载会把 `insert` 条目及其嵌套分组中的绝对路径以及相对于 patch 文件的 `./` 或 `../` 路径转换为文件 URL；对已有条目名称的断言及替换用的 `config` 值保持原样。 @@ -118,7 +118,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head - [dsh-home-paths](../../util/home-paths/README.zh.md)——harness home 解析器（`resolveDshHome`）。 - [配置来源归属](../../../.agents/notes/implemented/architecture/2026-08-04-configuration-source-ownership.zh.md)——被发现的文件为何不得决定 bootstrap 行为。 - [Profile 插件组合包](../../../.agents/notes/implemented/architecture/2026-08-05-profile-plugin-bundles.zh.md)——profile 与组合包组合设计。 -- [用户 patch HMR 测试](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md)——事务行为与原生文件系统投递的验证归属。 +- [用户 patch HMR 测试](../../../.agents/notes/implemented/testing/2026-09-09-user-patch-hmr-test-delivery.zh.md)——实时 patch 行为与原生文件系统投递的验证归属。 ----- diff --git a/packages/boot/app-boot/package.json b/packages/boot/app-boot/package.json index 2e49da08de..daf0d9a9df 100644 --- a/packages/boot/app-boot/package.json +++ b/packages/boot/app-boot/package.json @@ -29,6 +29,7 @@ "dependencies": { "@deepseek-ai/dsh-atomic-write": "workspace:^", "@deepseek-ai/dsh-package-manifest": "workspace:^", + "chokidar": "4.0.3", "js-yaml": "^4.2.0", "resolve.exports": "^2.0.3" }, @@ -57,7 +58,6 @@ "@deepseek-ai/dsh-home-paths": "workspace:^", "@deepseek-ai/dsh-system-prompt": "workspace:^", "@types/js-yaml": "^4.0.9", - "@deepseek-ai/cordis": "workspace:^", - "chokidar": "4.0.3" + "@deepseek-ai/cordis": "workspace:^" } } diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 3698a092a8..8cfc8f5678 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -18,6 +18,7 @@ import Group from '@deepseek-ai/cordis-plugin-group' import { dshHomePath, resolveDshHome } from '@deepseek-ai/dsh-home-paths' import { createLaunchEnvironmentSnapshot, type LaunchEnvironmentSnapshot } from '@deepseek-ai/dsh-launch-environment' import type {} from '@deepseek-ai/cordis-plugin-hmr' +import { watchConfig } from './watch-config.ts' import type {} from '@deepseek-ai/dsh-system-prompt' declare module '@deepseek-ai/cordis' { @@ -241,7 +242,7 @@ export interface UserPatchWatchOptions { } /** - * Watch the user patch layer through Cordis HMR and transactionally reapply it to the boot include. + * Watch the user patch layer and reapply it to the boot Include without rollback. * @param ctx - settled app context containing the root Include and an active HMR service. * @param options - diagnostic, file, and patch-composition inputs. * @returns an asynchronous disposer after the exact-path watcher is ready. @@ -256,7 +257,7 @@ export async function watchUserPatches( if (hmr === undefined) throw new Error(`${binName}: user patch-layer watching requires the Cordis HMR service`) const entry = bootstrapIncludes.get(ctx) if (entry === undefined) throw new Error(`${binName}: user patch-layer watching requires the root Include entry`) - const register = hmr.registerConfig(filename, async () => { + const register = watchConfig(ctx, filename, hmr.config, async () => { // Re-read the include's non-patch options per refresh so a writer that // updates another option between refreshes is not silently reverted. const { patches: _previousPatches, ...includeConfig } = entry.options.config as Include.Config @@ -268,6 +269,8 @@ export async function watchUserPatches( patches, }, }) + await ctx.loader.await() + await assertEntriesActivated(ctx, binName) }) try { return await register @@ -511,7 +514,7 @@ function groupedDump( * names; relative names continue to resolve beside the configuration file. * @returns the created root Include entry, or `undefined` when a surface * disposed the whole tree (taking the Loader service with it) while the - * transactional create was still settling entry lifecycle. + * entry creation was in flight. */ export async function mountRootInclude( ctx: Context, @@ -762,11 +765,9 @@ export async function assertEntriesActivated(ctx: Context, binName: string): Pro * is statically imported and mounted as the `cordis:include` builtin, loading * through the ambient module pipeline (vite/tsx/plain ESM). The package build * embeds Include while leaving Loader external, so the built include tree and - * host share one Loader peer. Loader - * settlement rejects startup failures, which `boot` wraps after disposing the - * partial context; a missing fiber or never-activating entry is rejected by - * the final audit, {@link assertEntriesActivated}, which rethrows a plugin's - * init rejection with its original stack; later unhandled rejections remain + * host share one Loader peer. The final audit, {@link assertEntriesActivated}, + * rejects missing, failed, or inactive entries. `boot` disposes its partial + * context on failure and preserves the original activation stack; later unhandled rejections remain * covered by {@link installFailLoud}. Built bins need the Loader's native * helper for bare plugin specifiers; relative specifiers do not. * @param binName - the diagnostic prefix for load-failure errors. @@ -780,6 +781,9 @@ export async function assertEntriesActivated(ctx: Context, binName: string): Pro * complete plugin set. * @returns the root context once every entry has started, or as soon as a * surface disposed the tree while startup was still in flight. + * @throws a labelled error after disposing the partial context — `host + * preparation failed` when `prepare` threw before any config-tree entry + * mounted, `plugin tree failed to load` afterwards. */ export async function boot( binName: string, @@ -789,21 +793,39 @@ export async function boot( bareModuleBaseUrl?: string, ): Promise { const ctx = new Context() - ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + '/' - ctx.provide('dshHomePath', dshHomePath) - await ctx.plugin(Loader) - await prepare?.(ctx) - await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl) - await ctx.loader.await() - // A surface can finish and dispose the whole tree while that await is still - // pending: the TUI renders as soon as its own fiber starts, so an `/exit` - // typed before the last entry settles tears the context down under us. The - // Loader service goes with it, and the activation audit describes a live - // tree — reading `ctx.loader` here would throw a TypeError over an app that - // exited exactly as asked. - if (ctx.get('loader') === undefined) return ctx - await assertEntriesActivated(ctx, binName) - return ctx + // Two failure labels: `prepare` runs before any config-tree entry mounts, + // so its failure is host setup, not the plugin tree. + let stage = 'host preparation failed' + try { + ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + '/' + ctx.provide('dshHomePath', dshHomePath) + await ctx.plugin(Loader) + await prepare?.(ctx) + stage = 'plugin tree failed to load' + await mountRootInclude(ctx, absoluteConfigPath, patches, bareModuleBaseUrl) + // A surface can finish and dispose the whole tree while startup is still + // in flight, before the last entry settles. The Loader service goes with + // it, and the activation audit describes a live tree — reading `ctx.loader` + // past this point would throw a TypeError over an app that exited exactly + // as asked. Re-check after settlement before auditing the tree. + await ctx.get('loader')?.await() + if (ctx.get('loader') === undefined) return ctx + await assertEntriesActivated(ctx, binName) + return ctx + } catch (cause) { + // Root-fiber disposal contains cleanup failures per observer (Cordis + // fiber.ts hardening) and a repeated call returns the settled single-shot + // result, so this await cannot reject and replace `cause`. + await ctx.fiber.dispose() + const detail = cause instanceof Error ? cause.message : String(cause) + // A wrapper can carry an activation error whose original stack names the failed plugin. + let deepest: unknown = cause + while (deepest instanceof Error && deepest.cause !== undefined) deepest = deepest.cause + const stack = deepest instanceof AggregateError + ? `\n${deepest.stack ?? deepest.message}\n${deepest.errors.map(formatActivationError).join('\n')}` + : deepest instanceof Error && deepest !== cause ? `\n${deepest.stack ?? deepest.message}` : '' + throw new Error(`${binName}: ${stage}: ${detail}${stack}`, { cause }) + } } /** Prompt-section name for the harness-source location line an app bin adds after boot. */ diff --git a/packages/boot/app-boot/src/watch-config.ts b/packages/boot/app-boot/src/watch-config.ts new file mode 100644 index 0000000000..ec761ee6a2 --- /dev/null +++ b/packages/boot/app-boot/src/watch-config.ts @@ -0,0 +1,89 @@ +/** Exact-path watching for live profile patch files outside Cordis module roots. */ +import { dirname, relative, resolve } from 'node:path' +import { realpath, stat } from 'node:fs/promises' +import { watch, type ChokidarOptions } from 'chokidar' +import type { Context } from '@deepseek-ai/cordis' + +const registrations = new WeakMap>() + +async function findWatchRoot(filename: string): Promise<{ filename: string; root: string; depth: number }> { + let root = dirname(filename) + let depth = 0 + while (true) { + try { + if (!(await stat(root)).isDirectory()) throw new Error(`config watch parent is not a directory: ${root}`) + const canonicalRoot = await realpath(root) + return { filename: resolve(canonicalRoot, relative(root, filename)), root: canonicalRoot, depth } + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error + const parent = dirname(root) + if (parent === root) throw error + root = parent + depth += 1 + } + } +} + +/** + * Watch one patch path, including missing parents, and serialize refresh callbacks. + * @param ctx Context that owns watcher disposal and receives refresh failures. + * @param filename Absolute patch-file path. + * @param options Deployment watcher options inherited from the HMR configuration. + * @param refresh Callback for additions, changes, and removals. + * @returns A disposer that closes the watcher and drains its current refresh. + * @throws When path resolution, watcher startup, or effect registration fails. + */ +export async function watchConfig( + ctx: Context, filename: string, options: ChokidarOptions, refresh: () => Promise | void, +): Promise<() => Promise> { + const target = await findWatchRoot(filename) + const paths = registrations.get(ctx) ?? new Set() + registrations.set(ctx, paths) + if (paths.has(target.filename)) throw new Error(`config path already registered: ${filename}`) + const { cwd: _cwd, ignored: _ignored, ...watchOptions } = options + const watcher = watch(target.root, { + ...watchOptions, depth: target.depth, ignoreInitial: false, + }) + paths.add(target.filename) + const state = { dirty: false } + let running: Promise | undefined + const onChange = (path: string) => { + const observed = resolve(path) + if (observed !== filename && observed !== target.filename) return + state.dirty = true + if (running) return + running = (async () => { + while (state.dirty) { + state.dirty = false + try { + await refresh() + } catch (reason) { + const error = reason instanceof Error ? reason : new Error(String(reason), { cause: reason }) + ctx.logger.warn('config reload at %C failed', filename) + ctx.logger.warn(error) + } + } + })().finally(() => { running = undefined }) + } + watcher.on('add', onChange) + watcher.on('change', onChange) + watcher.on('unlink', onChange) + const ready = Promise.withResolvers() + let pending = true + watcher.once('ready', () => { pending = false; ready.resolve() }) + watcher.on('error', (error) => { + if (pending) { pending = false; ready.reject(error) } else { ctx.logger.warn(error) } + }) + const dispose = async () => { + await watcher.close() + paths.delete(target.filename) + await running + } + try { + await ready.promise + return ctx.effect(() => dispose, 'app-boot.watchConfig()') + } catch (error) { + await dispose() + throw error + } +} diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index c878fbd3a2..61fda39717 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -790,7 +790,7 @@ describe('boot', () => { const dir = tmp() writeFileSync(join(dir, 'cordis.yml'), '- id: ghost\n name: ./missing.mjs\n') await expect(boot(NAME, join(dir, 'cordis.yml'))).rejects.toThrow( - `${NAME}: plugin tree failed to load: failed to apply loader entry`, + `${NAME}: plugin tree failed to load: ${NAME}: plugin(s) failed to load: ./missing.mjs`, ) }) @@ -808,7 +808,7 @@ describe('boot', () => { writeFileSync(configPath, config) await expect(boot(NAME, configPath)).rejects.toThrow( - 'failed to apply loader entry invalid-config (./noop.mjs)', + './noop.mjs: SyntaxError:', ) expect(readFileSync(configPath, 'utf8')).toBe(config) }) @@ -825,8 +825,8 @@ describe('boot', () => { ].join('\n')) writeFileSync(join(dir, 'cordis.yml'), '- id: failing\n name: ./failing.mjs\n') await expect(boot(NAME, join(dir, 'cordis.yml'))).rejects.toThrow(new RegExp([ - String.raw`failed to apply loader entry failing \(\./failing\.mjs\): pinned activation failure\n`, - String.raw`Error: pinned activation failure\n {4}at failing-fixture$`, + String.raw`\./failing\.mjs: Error: pinned activation failure\n`, + String.raw` {4}at failing-fixture$`, ].join(''))) }) @@ -835,9 +835,9 @@ describe('boot', () => { const deepest = new Error('stackless deep failure') delete (deepest as { stack?: string }).stack await expect(boot(NAME, join(dir, 'cordis.yml'), undefined, () => { - throw new Error('host preparation failed', { cause: deepest }) + throw new Error('wrapped setup failure', { cause: deepest }) })).rejects.toThrow( - `${NAME}: plugin tree failed to load: host preparation failed\nstackless deep failure`, + `${NAME}: host preparation failed: wrapped setup failure\nstackless deep failure`, ) }) diff --git a/packages/boot/app-boot/tests/config-reload.spec.ts b/packages/boot/app-boot/tests/config-reload.spec.ts index 4486c66ba8..e53879cf34 100644 --- a/packages/boot/app-boot/tests/config-reload.spec.ts +++ b/packages/boot/app-boot/tests/config-reload.spec.ts @@ -1,15 +1,6 @@ -/** - * Config hot-reload resilience of the booted include tree. `dsh-app-boot` - * installs a fail-loud unhandled-rejection handler, so a `refresh()` that - * rethrows a config-file parse error would kill a live app on one bad - * `cordis.yml` edit (the HMR watcher awaits `refresh()` in an async event - * callback nobody else catches). These tests pin the vendored - * `@cordisjs/plugin-include` contract that boot relies on: an invalid file - * keeps the last good tree, and a valid re-read re-applies overlay patches - * exactly like the initial load. - */ +/** File reload and overlay behavior through the booted Include tree. */ -import { mkdtempSync, rmSync, writeFileSync } from 'node:fs' +import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { afterAll, describe, expect, it } from 'vitest' @@ -32,10 +23,11 @@ interface TreeFixture { include: Include } -async function bootTree(configBody: string): Promise { +async function bootTree(configBody: string, files: Record = {}): Promise { const dir = mkdtempSync(join(tmpdir(), 'dsh-config-reload-')) tempRoots.push(dir) writeFileSync(join(dir, 'noop.mjs'), NOOP_PLUGIN) + for (const [name, content] of Object.entries(files)) writeFileSync(join(dir, name), content) writeFileSync(join(dir, 'cordis.yml'), configBody) const ctx = await boot(NAME, join(dir, 'cordis.yml')) const entry = [...ctx.loader.entries()].find(candidate => candidate.subtree !== undefined) @@ -48,6 +40,26 @@ function entryConfig(ctx: Context, id: string): unknown { } describe('include refresh with an invalid file', () => { + it('writes and activates initial entries when an included file is missing', async () => { + const { ctx, dir } = await bootTree([ + '- id: initialized', + " name: 'cordis:include'", + ' config:', + ' path: ./created.yml', + ' initial:', + ' - id: noop', + ' name: ./noop.mjs', + ' config: { value: initial }', + '', + ].join('\n')) + try { + expect(entryConfig(ctx, 'noop')).toEqual({ value: 'initial' }) + expect(readFileSync(join(dir, 'created.yml'), 'utf8')).toContain('id: noop') + } finally { + await ctx.fiber.dispose() + } + }) + it('keeps the last good tree instead of throwing, then applies the next valid edit', async () => { const { ctx, dir, include } = await bootTree('- id: noop\n name: ./noop.mjs\n config:\n value: 1\n') try { diff --git a/packages/boot/app-boot/tests/user-patches.spec.ts b/packages/boot/app-boot/tests/user-patches.spec.ts index f894cda489..17c2f6bb84 100644 --- a/packages/boot/app-boot/tests/user-patches.spec.ts +++ b/packages/boot/app-boot/tests/user-patches.spec.ts @@ -1,7 +1,7 @@ /** * User patch-layer behavior of `dsh-app-boot`: the optional patch-list loader * (a profile's `cordis.patch.yml`) and `boot()` applying the user layer over - * a real Loader tree, kept live through transactional HMR. + * a real Loader tree with live file watching. */ import { mkdirSync, mkdtempSync, rmSync, unlinkSync, writeFileSync } from 'node:fs' @@ -270,7 +270,9 @@ describe('Loader config interpolation', () => { await provider?.update({ disabled: true }) await provider?.update({ config: { fail: true } }) await provider?.update({ disabled: false }) - await expect(ctx.loader.await()).rejects.toThrow('rejected provider') + await ctx.loader.await() + const reader = [...ctx.loader.entries()].find(entry => entry.options.id === 'reader') + await expect(reader?.fiber?.await()).rejects.toThrow('rejected provider') expect(ctx.get('readerResult')).toBeUndefined() await provider?.update({ disabled: true }) @@ -342,7 +344,8 @@ describe('Loader entry disabled interpolation', () => { const disabledFalse = { __jsExpr: 'process.version.length === 0' } as unknown as boolean await entry?.update({ disabled: disabledTrue }) expect(entry?.disabled).toBe(true) - expect(entry?.fiber).toBeUndefined() + await ctx.loader.await() + expect(entry?.fiber?.uid).toBeNull() await entry?.update({ disabled: disabledFalse }) expect(entry?.disabled).toBe(false) expect(entry?.fiber).toBeDefined() @@ -403,7 +406,7 @@ describe('boot with user patches', () => { } }) - it('watches add, failure, recovery, and removal through transactional HMR', { timeout: 20_000 }, async () => { + it('applies live patches, reports failures without rollback, and recovers after a later edit', { timeout: 20_000 }, async () => { const dir = tmp() const userDir = tmp() const filename = join(userDir, PROFILE_PATCH_FILENAME) @@ -412,8 +415,8 @@ describe('boot with user patches', () => { onTestFinished(() => ctx.fiber.dispose()) await ctx.plugin(Timer) await ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 }) - // Native notifications belong to hmr-config.spec.ts; this case owns the - // real HMR/Include transaction after each delivered filesystem event. + // Native notifications belong to watch-config.spec.ts; this case owns + // Include recomposition after each explicitly delivered filesystem event. const watchers: FSWatcher[] = [] const previousFactory = configWatch.create onTestFinished(() => { configWatch.create = previousFactory }) @@ -423,10 +426,11 @@ describe('boot with user patches', () => { queueMicrotask(() => { watcher.emit('ready') }) return watcher } - const failures: Array<{ filename: string; error: Error }> = [] - ctx.on('hmr/config-update-failed', (failedFilename, error) => { - failures.push({ filename: failedFilename, error }) + const failures: Error[] = [] + const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation((value: unknown) => { + if (value instanceof Error) failures.push(value) }) + onTestFinished(() => { warn.mockRestore() }) const dispose = await watchUserPatches(ctx, { binName: NAME, filename, @@ -441,16 +445,15 @@ describe('boot with user patches', () => { writeFileSync(filename, '- id: noop\n config:\n fail: true\n') watcher.emit('change', filename) - await eventually(() => failures.length === 1, 'failed candidate was not broadcast') - expect(failures[0]).toMatchObject({ filename }) - expect(failures[0]?.error).toBeInstanceOf(Error) - expect((entryConfig(ctx, 'noop') as { value?: string }).value).toBe('live') + await eventually(() => failures.length === 1, 'failed candidate was not reported') + expect(failures[0]).toBeInstanceOf(Error) + expect(entryConfig(ctx, 'noop')).toMatchObject({ fail: true }) writeFileSync(filename, 'invalid: [unclosed\n') watcher.emit('change', filename) - await eventually(() => failures.length === 2, 'parse failure was not broadcast') - expect(failures[1]?.error).toBeInstanceOf(Error) - expect((entryConfig(ctx, 'noop') as { value?: string }).value).toBe('live') + await eventually(() => failures.length === 2, 'parse failure was not reported') + expect(failures[1]).toBeInstanceOf(Error) + expect(entryConfig(ctx, 'noop')).toMatchObject({ fail: true }) writeFileSync(filename, '- id: noop\n config:\n value: recovered\n') watcher.emit('change', filename) @@ -494,21 +497,19 @@ describe('boot with user patches', () => { }) it('returns a no-op disposer when the tree is disposed while the watcher opens', async () => { - // A surface can dispose the whole tree while registerConfig's effect - // registration is still in flight (the HMR effect then fails with - // INACTIVE_EFFECT); the app is exiting exactly as asked, so the watcher - // must not crash the process. The stub makes the race deterministic — the - // live-teardown ordering itself is not stageable. const dir = tmp() const ctx = await boot(NAME, writeTree(dir)) - try { - const teardown = Object.assign(new Error('cannot create effect on inactive context'), { code: 'INACTIVE_EFFECT' }) - ctx.provide('hmr', { registerConfig: () => Promise.reject(teardown) }) - const dispose = await watchUserPatches(ctx, { binName: NAME, filename: join(tmp(), PROFILE_PATCH_FILENAME) }) - await expect(dispose()).resolves.toBeUndefined() - } finally { - await ctx.fiber.dispose() + await ctx.plugin(Timer) + await ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 }) + const previousFactory = configWatch.create + onTestFinished(() => { configWatch.create = previousFactory }) + configWatch.create = (options) => { + const watcher = new FSWatcher(options) + void ctx.fiber.dispose().then(() => { watcher.emit('ready') }) + return watcher } + const dispose = await watchUserPatches(ctx, { binName: NAME, filename: join(tmp(), PROFILE_PATCH_FILENAME) }) + await expect(dispose()).resolves.toBeUndefined() }) it('propagates registration failures other than mid-teardown', async () => { @@ -519,7 +520,7 @@ describe('boot with user patches', () => { await ctx.plugin(Timer) await ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 }) const dispose = await watchUserPatches(ctx, { binName: NAME, filename }) - // Same user-layer path registered twice: HMR refuses; not a teardown race. + // Same user-layer path registered twice: the watcher refuses; not a teardown race. await expect(watchUserPatches(ctx, { binName: NAME, filename })).rejects.toThrow('already registered') await dispose() } finally { diff --git a/packages/boot/app-boot/tests/watch-config.spec.ts b/packages/boot/app-boot/tests/watch-config.spec.ts new file mode 100644 index 0000000000..aeed3dadbf --- /dev/null +++ b/packages/boot/app-boot/tests/watch-config.spec.ts @@ -0,0 +1,286 @@ +import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs' +import { realpath } from 'node:fs/promises' +import * as fsPromises from 'node:fs/promises' +import { tmpdir } from 'node:os' +import { join, parse } from 'node:path' +import { pathToFileURL } from 'node:url' +import { Context } from '@deepseek-ai/cordis' +import { watchConfig } from '../src/watch-config.ts' +import Hmr from '@deepseek-ai/cordis-plugin-hmr' +import Loader from '@deepseek-ai/cordis-plugin-loader' +import Timer from '@deepseek-ai/cordis-plugin-timer' +import { afterEach, describe, expect, it, onTestFinished, vi } from 'vitest' +import { FSWatcher, type ChokidarOptions } from 'chokidar' + +const configWatch = vi.hoisted(() => ({ create: undefined as ((options?: ChokidarOptions) => FSWatcher) | undefined })) +vi.mock('node:fs/promises', async (importOriginal) => { + const native = await importOriginal() + return { ...native, stat: vi.fn(native.stat) } +}) +vi.mock('chokidar', async (importOriginal) => { + const native = await importOriginal() + return { ...native, watch: (paths: string | string[], options?: ChokidarOptions) => + configWatch.create === undefined ? native.watch(paths, options) : configWatch.create(options) } +}) + +/** Every per-test tree root, removed once the booted watcher has been disposed. */ +const hmrRoots: string[] = [] + +async function bootHmr(dir: string, root: string[] = [], usePolling?: boolean): Promise { + const ctx = new Context() + ctx.baseUrl = pathToFileURL(dir).href + '/' + await ctx.plugin(Loader) + await ctx.plugin(Timer) + await ctx.plugin(Hmr, { + root, + ignored: [], + debounce: 0, + ...usePolling === undefined ? {} : { usePolling }, + }) + return ctx +} + +async function eventually(test: () => boolean, message: string): Promise { + const deadline = Date.now() + 10_000 + while (!test()) { + if (Date.now() >= deadline) throw new Error(message) + await new Promise(resolve => setTimeout(resolve, 10)) + } +} + +describe('HMR exact config paths', () => { + afterEach(() => { + for (const root of hmrRoots.splice(0)) rmSync(root, { recursive: true, force: true }) + }) + + it('observes module changes when its watch base is a filesystem alias', { timeout: 30_000 }, async () => { + const target = mkdtempSync(join(tmpdir(), 'dsh-hmr-module-canonical-')) + const alias = `${target}-alias` + const aliasFilename = join(alias, 'module.ts') + symlinkSync(target, alias, process.platform === 'win32' ? 'junction' : 'dir') + writeFileSync(aliasFilename, 'export const generation = 0\n') + // This acceptance owns alias-to-cache identity. Other cases below exercise + // native events; polling keeps Windows fs.watch queue pressure out of it. + const ctx = await bootHmr(alias, ['.'], true) + const filename = join(await realpath(target), 'module.ts') + const expected = pathToFileURL(filename).href + const cacheHas = vi.spyOn(ctx.loader.internal!.loadCache, 'has').mockReturnValue(false) + const observed: string[] = [] + ctx.on('hmr/change', (url) => { observed.push(url) }) + try { + const deadline = Date.now() + 20_000 + for (let generation = 1; !observed.includes(expected); generation += 1) { + if (Date.now() >= deadline) { + throw new Error(`HMR did not observe ${expected} through the alias; observed ${JSON.stringify(observed)}`) + } + // The watch base, not the writer spelling, is the alias under test. + // Grow the file on every write: polling must not depend on timestamp + // precision when several generations land inside one filesystem tick. + writeFileSync(filename, `export const generation = ${generation}\n${' '.repeat(generation)}\n`) + // Leave Chokidar's atomic-write window idle so one coalesced change can publish. + await new Promise(resolve => setTimeout(resolve, 250)) + } + expect(cacheHas).toHaveBeenCalledWith(expected) + } finally { + await ctx.fiber.dispose() + unlinkSync(alias) + rmSync(target, { recursive: true, force: true }) + } + }) + + it('collapses filesystem aliases before registering an exact watch', async () => { + const target = mkdtempSync(join(tmpdir(), 'dsh-hmr-canonical-')) + const alias = `${target}-alias` + symlinkSync(target, alias, process.platform === 'win32' ? 'junction' : 'dir') + const ctx = await bootHmr(alias) + try { + await watchConfig(ctx, join(alias, 'plugins.yml'), {}, () => {}) + await expect(watchConfig(ctx, join(await realpath(target), 'plugins.yml'), {}, () => {})) + .rejects.toThrow('config path already registered') + } finally { + await ctx.fiber.dispose() + unlinkSync(alias) + rmSync(target, { recursive: true, force: true }) + } + }) + + it('observes add, change, and unlink outside its module roots', { timeout: 20_000 }, async () => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) + hmrRoots.push(dir) + const filename = join(dir, 'plugins.yml') + const ctx = await bootHmr(dir) + const observed: string[] = [] + try { + await watchConfig(ctx, filename, {}, () => { + try { + observed.push(readFileSync(filename, 'utf8')) + } catch (error) { + if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error + observed.push('missing') + } + }) + + writeFileSync(filename, 'one', { flag: 'wx' }) + await eventually(() => observed.includes('one'), 'HMR did not observe config creation') + writeFileSync(filename, 'two') + await eventually(() => observed.includes('two'), 'HMR did not observe config change') + unlinkSync(filename) + await eventually(() => observed.includes('missing'), 'HMR did not observe config removal') + } finally { + await ctx.fiber.dispose() + } + }) + + it('observes creation when the config parent did not exist at registration', { timeout: 20_000 }, async () => { + const root = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) + hmrRoots.push(root) + const dir = join(root, 'later') + const filename = join(dir, 'plugins.yml') + const ctx = await bootHmr(root) + const observed: string[] = [] + try { + await watchConfig(ctx, filename, {}, () => { + observed.push(readFileSync(filename, 'utf8')) + }) + mkdirSync(dir) + writeFileSync(filename, 'created') + await eventually(() => observed.includes('created'), 'HMR did not observe config creation under a new parent') + } finally { + await ctx.fiber.dispose() + } + }) + + it('serializes refreshes and waits for them during disposal', async () => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-hmr-config-')) + hmrRoots.push(dir) + const filename = join(dir, 'plugins.yml') + const ctx = await bootHmr(dir) + onTestFinished(() => ctx.fiber.dispose()) + const watcher = new FSWatcher() + const previousFactory = configWatch.create + onTestFinished(() => { configWatch.create = previousFactory }) + configWatch.create = () => { queueMicrotask(() => { watcher.emit('ready') }); return watcher } + const started = Promise.withResolvers() + const release = Promise.withResolvers() + onTestFinished(() => { release.resolve(undefined) }) + let calls = 0 + let active = 0 + let maxActive = 0 + const dispose = await watchConfig(ctx, filename, {}, async () => { + active += 1 + maxActive = Math.max(maxActive, active) + if (++calls === 1) { + started.resolve(undefined) + await release.promise + } + active -= 1 + }) + watcher.emit('change', join(dir, 'unrelated.yml')) + expect(calls).toBe(0) + watcher.emit('add', filename) + await started.promise + watcher.emit('change', filename) + watcher.emit('unlink', filename) + let disposed = false + const disposal = dispose().then(() => { disposed = true }) + await Promise.resolve() + expect(disposed).toBe(false) + release.resolve(undefined) + await disposal + expect(maxActive).toBe(1) + expect(calls).toBe(2) + }) + + it('rejects a patch path whose parent is a regular file', async () => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-patch-parent-')) + hmrRoots.push(dir) + const parent = join(dir, 'file') + writeFileSync(parent, '') + const ctx = new Context() + onTestFinished(() => ctx.fiber.dispose()) + await expect(watchConfig(ctx, join(parent, 'plugins.yml'), {}, () => {})) + .rejects.toThrow('config watch parent is not a directory') + }) + + it('stops searching when the filesystem root cannot be read', async () => { + const failure = Object.assign(new Error('filesystem root unavailable'), { code: 'ENOENT' }) + const read = vi.mocked(fsPromises.stat).mockClear().mockRejectedValueOnce(failure) + onTestFinished(() => { read.mockRestore() }) + const ctx = new Context() + onTestFinished(() => ctx.fiber.dispose()) + await expect(watchConfig(ctx, join(parse(tmpdir()).root, 'plugins.yml'), {}, () => {})).rejects.toBe(failure) + expect(read).toHaveBeenCalledOnce() + }) + + it.each(['creation', 'ready'] as const)('releases registration after watcher %s fails', async (phase) => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-patch-watch-failure-')) + hmrRoots.push(dir) + const ctx = new Context() + onTestFinished(() => ctx.fiber.dispose()) + const filename = join(dir, 'plugins.yml') + const previousFactory = configWatch.create + onTestFinished(() => { configWatch.create = previousFactory }) + const failure = new Error('watcher unavailable') + const failed = new FSWatcher() + const closed = vi.spyOn(failed, 'close') + configWatch.create = () => { + if (phase === 'creation') throw failure + queueMicrotask(() => { failed.emit('error', failure) }) + return failed + } + await expect(watchConfig(ctx, filename, {}, () => {})).rejects.toBe(failure) + if (phase === 'ready') expect(closed).toHaveBeenCalledOnce() + const watcher = new FSWatcher() + configWatch.create = () => { queueMicrotask(() => { watcher.emit('ready') }); return watcher } + await watchConfig(ctx, filename, {}, () => {}) + const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {}) + onTestFinished(() => { warn.mockRestore() }) + watcher.emit('error', failure) + expect(warn).toHaveBeenCalledWith(failure) + }) + + it('closes a ready watcher when its context has already been disposed', async () => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-patch-disposed-')) + hmrRoots.push(dir) + const root = new Context() + const fiber = root.plugin(() => {}) + await fiber + const ctx = fiber.ctx + await fiber.dispose() + const watcher = new FSWatcher() + const close = vi.spyOn(watcher, 'close') + const previousFactory = configWatch.create + onTestFinished(() => { configWatch.create = previousFactory }) + configWatch.create = () => { queueMicrotask(() => { watcher.emit('ready') }); return watcher } + await expect(watchConfig(ctx, join(dir, 'plugins.yml'), {}, () => {})) + .rejects.toThrow('cannot create effect on inactive context') + expect(close).toHaveBeenCalledOnce() + }) + + it('logs a normalized refresh failure and continues processing later events', async () => { + const dir = mkdtempSync(join(tmpdir(), 'dsh-patch-failure-')) + hmrRoots.push(dir) + const filename = join(dir, 'plugins.yml') + const ctx = await bootHmr(dir) + onTestFinished(() => ctx.fiber.dispose()) + const watcher = new FSWatcher() + const previousFactory = configWatch.create + onTestFinished(() => { configWatch.create = previousFactory }) + configWatch.create = () => { queueMicrotask(() => { watcher.emit('ready') }); return watcher } + const warn = vi.spyOn(ctx.logger, 'warn').mockImplementation(() => {}) + onTestFinished(() => { warn.mockRestore() }) + let calls = 0 + const recovered = Promise.withResolvers() + await watchConfig(ctx, filename, {}, () => { + if (++calls === 1) throw 42 + recovered.resolve(undefined) + }) + watcher.emit('change', filename) + await expect.poll(() => warn.mock.calls.length).toBe(2) + expect(warn.mock.calls[0]).toEqual(['config reload at %C failed', filename]) + expect(warn.mock.calls[1]?.[0]).toMatchObject({ message: '42' }) + watcher.emit('change', filename) + await recovered.promise + expect(calls).toBe(2) + }) +}) diff --git a/packages/extensions/cordis-client-runner/README.i18n.yaml b/packages/extensions/cordis-client-runner/README.i18n.yaml index d1cbdd5fdf..f99b115e71 100644 --- a/packages/extensions/cordis-client-runner/README.i18n.yaml +++ b/packages/extensions/cordis-client-runner/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/extensions/cordis-client-runner/README.md -README.md: 260d4703bda2560a4254962d7b868221d0328ec8 -README.zh.md: a74128508c5b6a81d0600452b6ec5301bf7c8dcb +README.md: 153a8bf3b71d2c4c8edf3423dd0b7004083d1ecc +README.zh.md: 3f36f180043ce9074161889d3f1b0a7ab9b781ba diff --git a/packages/extensions/cordis-client-runner/README.md b/packages/extensions/cordis-client-runner/README.md index 260d4703bd..153a8bf3b7 100644 --- a/packages/extensions/cordis-client-runner/README.md +++ b/packages/extensions/cordis-client-runner/README.md @@ -51,7 +51,7 @@ This section explains the design behind the browser half; the observable behavio ### Design philosophy -The browser half is built on one principle: a dynamic package must ride the same activation gating, fiber-effect cleanup, and status projection as a static one. The evaluated plugin is seated in the module table and mounted through `loader.create`; unload is entry removal plus factory invalidation plus style removal. The guard is a whitelist — lifecycle verbs plus declared services — that mirrors the host-side sandbox facade, so a package author meets one contract on both halves. One observer feeds two outlets: the slot registry's entry-error seam is watched only here, and a crash belonging to a package this runner seated goes upstream to the host for the model and onto this package's own `renderFailures` for the panel. +The browser half is built on one principle: a dynamic package must ride the same activation gating, fiber-effect cleanup, and status projection as a static one. The evaluated plugin is seated in the module table and mounted through `loader.create`; unload removes the entry, waits for its fiber's cleanup, then invalidates its factory and removes its styles. The guard is a whitelist — lifecycle verbs plus declared services — that mirrors the host-side sandbox facade, so a package author meets one contract on both halves. One observer feeds two outlets: the slot registry's entry-error seam is watched only here, and a crash belonging to a package this runner seated goes upstream to the host for the model and onto this package's own `renderFailures` for the panel. ### Source map diff --git a/packages/extensions/cordis-client-runner/README.zh.md b/packages/extensions/cordis-client-runner/README.zh.md index a74128508c..3f36f18004 100644 --- a/packages/extensions/cordis-client-runner/README.zh.md +++ b/packages/extensions/cordis-client-runner/README.zh.md @@ -51,7 +51,7 @@ kind: "package-reference" ### 设计理念 -浏览器半建立在一个原则之上：动态包必须与静态包共享同一套激活门控、fiber effect 清理与状态投影。求值后的插件被塞进模块表，并经 `loader.create` 挂载；卸载 = 移除 entry + 失效 factory + 撤下样式。guard 是一份白名单——生命周期动词加已声明服务——与 host 侧沙箱门面对称，因此包作者在两侧面对同一个约定。一个观察者供两个出口：只有这里监视槽位注册表的 entry 错误接缝，凡属于本 runner 落座过的包的崩溃，一路上行给 host（给模型），一路发布到本包自己的 `renderFailures`（给面板）。 +浏览器半建立在一个原则之上：动态包必须与静态包共享同一套激活门控、fiber effect 清理与状态投影。求值后的插件被塞进模块表，并经 `loader.create` 挂载；卸载先移除 entry，等待其 fiber 清理完成，再使 factory 失效并撤下样式。guard 是一份白名单——生命周期动词加已声明服务——与 host 侧沙箱门面对称，因此包作者在两侧面对同一个约定。一个观察者供两个出口：只有这里监视槽位注册表的 entry 错误接缝，凡属于本 runner 落座过的包的崩溃，一路上行给 host（给模型），一路发布到本包自己的 `renderFailures`（给面板）。 ### 源码地图 diff --git a/packages/extensions/cordis-client-runner/src/client/runtime.ts b/packages/extensions/cordis-client-runner/src/client/runtime.ts index c16e420ffb..bed64e7519 100644 --- a/packages/extensions/cordis-client-runner/src/client/runtime.ts +++ b/packages/extensions/cordis-client-runner/src/client/runtime.ts @@ -451,7 +451,9 @@ export class DynamicCordisPackageRunner { this.failures.delete(id) // Entry removal disposes the fiber (slot entries and facade effects // cascade); the factory invalidation makes a later re-load legal. - await this.env.loader.remove(entryId) + const disposal = this.env.loader.resolve(entryId).fiber?.dispose() + this.env.loader.remove(entryId) + await disposal this.env.modules.invalidate(moduleIdOf(id)) styles.dispose() } diff --git a/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts b/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts index 93cd0d3373..03314c0f96 100644 --- a/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts +++ b/packages/extensions/cordis-client-runner/tests/runner.client.spec.ts @@ -13,7 +13,7 @@ import { Context } from '@deepseek-ai/cordis' import type { Loader } from '@deepseek-ai/cordis-plugin-loader' -import { describe, expect, it, vi } from 'vitest' +import { describe, expect, it, onTestFinished, vi } from 'vitest' import type { CordisDynamicPackageId, CordisDynamicPluginId, CordisDynamicPluginRunId, SessionId, } from '@deepseek-ai/dsh-api-remotes/client' @@ -52,7 +52,7 @@ interface Bench { invalidated: string[] removed: string[] created: string[] - invoke: ReturnType + invoke: ReturnType Promise>> /** Render failures the runner sent upstream, in order. */ reported: { agentId: SessionId @@ -103,15 +103,15 @@ async function boot(): Promise { return Promise.resolve(entryId) }, resolve: (entryId: string) => fibers.get(entryId) ?? { fiber: undefined }, - remove: async (entryId: string) => { + remove: (entryId: string) => { removed.push(entryId) const entry = fibers.get(entryId) fibers.delete(entryId) - await (entry?.fiber as { dispose(): Promise } | undefined)?.dispose() + void (entry?.fiber as { dispose(): Promise } | undefined)?.dispose() }, } as unknown as Loader - const invoke = vi.fn(() => Promise.resolve(null)) + const invoke = vi.fn<() => Promise>(() => Promise.resolve(null)) const reported: Bench['reported'] = [] // The crash seam is stood in so a test can report an entry failure without a // React render, exactly as the renderer's boundary would; registrations still @@ -298,6 +298,26 @@ describe('failure stages', () => { }) describe('retract', () => { + it('waits for plugin cleanup before invalidating its module factory', async () => { + const bench = await boot() + const started = Promise.withResolvers() + const release = Promise.withResolvers() + onTestFinished(() => { release.resolve(undefined) }) + bench.invoke.mockImplementation(() => { + started.resolve(undefined) + return release.promise + }) + await bench.runner.load(half({ code: 'return { apply: (ctx) => ctx.effect(() => () => host.call("cleanup", null)) }' })) + bench.runner.retract(PLUGIN, RUN) + await started.promise + await bench.settle() + expect(bench.removed).toEqual(['entry-1']) + expect(bench.invalidated).toEqual(['dyn/dyn-1']) + release.resolve(undefined) + await bench.settle() + expect(bench.invalidated).toEqual(['dyn/dyn-1', 'dyn/dyn-1']) + }) + it('unloads at the named revision', async () => { const bench = await boot() await bench.runner.load(half()) diff --git a/packages/host/directory-picker-auto/src/index.ts b/packages/host/directory-picker-auto/src/index.ts index a95e981ad8..46a5dff2f7 100644 --- a/packages/host/directory-picker-auto/src/index.ts +++ b/packages/host/directory-picker-auto/src/index.ts @@ -79,14 +79,18 @@ export async function apply(ctx: Context): Promise { // nothing is left to unmount or await then. const entry = ctx.loader.store[id] if (entry === undefined) continue - const fiber = entry.fiber + const disposal = entry.fiber?.dispose() ctx.loader.remove(id) - await fiber?.dispose() + await disposal } } try { for (const name of [BACKEND_PACKAGES[backend], SURFACE_PACKAGES[backend]]) { - ids.push(await ctx.loader.create({ name })) + const id = await ctx.loader.create({ name }) + ids.push(id) + const entry = ctx.loader.resolve(id) + if (entry.fiber === undefined) throw new Error(`directory-picker-auto: failed to load ${name}`) + await entry.fiber.await() } } catch (cause) { // Setup owns the entries it created until it returns the disposer: leaving diff --git a/packages/host/directory-picker-auto/tests/loader-composition.spec.ts b/packages/host/directory-picker-auto/tests/loader-composition.spec.ts index 77ad4b549d..83970e6686 100644 --- a/packages/host/directory-picker-auto/tests/loader-composition.spec.ts +++ b/packages/host/directory-picker-auto/tests/loader-composition.spec.ts @@ -12,7 +12,7 @@ import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises' import { tmpdir } from 'node:os' import { join } from 'node:path' import { pathToFileURL } from 'node:url' -import { afterEach, describe, expect, it, vi } from 'vitest' +import { afterEach, describe, expect, it, onTestFinished, vi } from 'vitest' import { Context } from '@deepseek-ai/cordis' import Loader from '@deepseek-ai/cordis-plugin-loader' import Include from '@deepseek-ai/cordis-plugin-include' @@ -205,7 +205,21 @@ describe('real Loader composition', () => { // and the disposer joins the backend's teardown — the service is gone the // moment dispose() settles, with no further loader await. const autoEntry = [...ctx.loader.entries()].find(entry => entry.options.name === AUTO)! - await autoEntry.fiber!.dispose() + const backendEntry = [...ctx.loader.entries()].find(entry => entry.options.name === NATIVE)! + const cleanupStarted = Promise.withResolvers() + const releaseCleanup = Promise.withResolvers() + onTestFinished(() => { releaseCleanup.resolve(undefined) }) + backendEntry.fiber!.ctx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await releaseCleanup.promise + }) + let disposed = false + const disposal = autoEntry.fiber!.dispose().then(() => { disposed = true }) + await cleanupStarted.promise + await Promise.resolve() + expect(disposed).toBe(false) + releaseCleanup.resolve(undefined) + await disposal expect(entryNames(ctx)).not.toContain(NATIVE) expect(entryNames(ctx)).not.toContain(NATIVE_SURFACE) expect(ctx.get('directoryPicker')).toBeUndefined() @@ -245,7 +259,9 @@ describe('real Loader composition', () => { it('unmounts the backend when the surface entry fails to load', { timeout: 60_000 }, async () => { stubAttendedHost() - await expect(loadComposition('127.0.0.1', { failSurface: true })).rejects.toThrow(/surface import failed/) + const { ctx } = await loadComposition('127.0.0.1', { failSurface: true }) + const chooser = [...ctx.loader.entries()].find(entry => entry.options.name === AUTO)! + await expect(chooser.fiber!.await()).rejects.toThrow(/directory-picker-auto: failed to load/) // Setup owns both entries until it returns its disposer, so a failed surface // must take the mounted backend with it: otherwise a retry collides with the diff --git a/packages/host/plugin-inventory/tests/inventory.spec.ts b/packages/host/plugin-inventory/tests/inventory.spec.ts index 2bf3516db2..1887897246 100644 --- a/packages/host/plugin-inventory/tests/inventory.spec.ts +++ b/packages/host/plugin-inventory/tests/inventory.spec.ts @@ -86,7 +86,7 @@ describe('PluginInventoryGateway', () => { fiberPhase: null, }) - await ctx.loader.remove(pendingId) + ctx.loader.remove(pendingId) expect((await inventory.list()).entries.some(entry => entry.entryId === pendingId)).toBe(false) }) diff --git a/packages/host/webserver/tests/webserver.spec.ts b/packages/host/webserver/tests/webserver.spec.ts index 04bbe9b4cf..9db21bd537 100644 --- a/packages/host/webserver/tests/webserver.spec.ts +++ b/packages/host/webserver/tests/webserver.spec.ts @@ -361,25 +361,13 @@ describe('real Loader composition', () => { const firstRoot = root root = undefined // keep the first composition's files until the end - // loader.await() never rejects (allSettled); the bind failure surfaces as - // a FAILED fiber whose error escapes as a late rejection — the shape the - // boot's installFailLoud is contracted to catch. Capture it here the same - // way, and assert it really is the bind error. - const rejections: unknown[] = [] - const onUnhandled = (err: unknown): void => { rejections.push(err) } - process.on('unhandledRejection', onUnhandled) let second: Context | undefined try { second = await loadComposition(takenPort) const entry = [...second.loader.entries()].find(e => e.options.name === '@deepseek-ai/dsh-host-webserver') expect(entry?.fiber?.state).toBe(FiberState.FAILED) - // The rejection escapes a tick after loader.await() settles; bounded poll. - for (let i = 0; i < 100 && rejections.length === 0; i++) { - await new Promise(resolve => setTimeout(resolve, 10)) - } - expect(rejections.map(String).join('\n')).toContain('EADDRINUSE') + await expect(entry?.fiber?.await()).rejects.toThrow('EADDRINUSE') } finally { - process.off('unhandledRejection', onUnhandled) await second?.fiber.dispose() context = first if (root !== undefined) await rm(root, { recursive: true, force: true }) diff --git a/packages/llm/plugin-package-inventory-deepseek/tests/inventory.spec.ts b/packages/llm/plugin-package-inventory-deepseek/tests/inventory.spec.ts index 280afb90b8..d09a22a02f 100644 --- a/packages/llm/plugin-package-inventory-deepseek/tests/inventory.spec.ts +++ b/packages/llm/plugin-package-inventory-deepseek/tests/inventory.spec.ts @@ -194,6 +194,7 @@ describe('DeepSeek plugin package inventory', () => { await ctx.loader.create({ name: 'versioned-plugin/plugin.mjs' }) await ctx.loader.create({ name: 'cordis:include', config: { path: pathToFileURL(composition).href } }) + await ctx.loader.await() const prepared = await ctx.deepseekLlmApiExtensions.prepare({ body: { messages: [] }, signal: SIGNAL }) expect(prepared.fields.dsh_plugin_packages?.packages).toEqual([ diff --git a/packages/preset/agent-presets/README.i18n.yaml b/packages/preset/agent-presets/README.i18n.yaml index 2ddf994845..c560b84ff8 100644 --- a/packages/preset/agent-presets/README.i18n.yaml +++ b/packages/preset/agent-presets/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/preset/agent-presets/README.md -README.md: 6ef3374a5f1ae6b83005073f80d63d156ee92f9c -README.zh.md: a1be6d634e592126711befad4ffcb06ca0bdc26c +README.md: ff03d71ddd9360846597101026e5e8662fc2a370 +README.zh.md: 2d96b0948628f6a7c034b48d683fcfe737ae7d78 diff --git a/packages/preset/agent-presets/README.md b/packages/preset/agent-presets/README.md index 6ef3374a5f..ff03d71ddd 100644 --- a/packages/preset/agent-presets/README.md +++ b/packages/preset/agent-presets/README.md @@ -126,7 +126,7 @@ This section explains the design behind the roster and the standing mount; obser ### The mount audit -A directly-plugged subtree is absent from `ctx.loader.entries()`, so no boot audit covers it; `mountPreset` proves the result usable itself and rejects three shapes: an unscoped target (the preset's tools would register globally), a row still waiting for a service the composition never supplies, and a row that published a service into the root realm (process-global, so the second preset publishing the same name collides). The invariant companion re-checks the last rule on every service notification, because a row publishing from a timer or an asynchronous continuation would escape the one-shot audit. +A directly-plugged subtree is absent from `ctx.loader.entries()`, so no boot audit covers it; `mountPreset` proves the result usable itself and rejects an import or activation failure, an unscoped target (the preset's tools would register globally), a row still waiting for a service the composition never supplies, and a row that published a service into the root realm (process-global, so the second preset publishing the same name collides). The invariant companion re-checks the last rule on every service notification, because a row publishing from a timer or an asynchronous continuation would escape the one-shot audit. ### Authoring mechanics diff --git a/packages/preset/agent-presets/README.zh.md b/packages/preset/agent-presets/README.zh.md index a1be6d634e..2d96b09486 100644 --- a/packages/preset/agent-presets/README.zh.md +++ b/packages/preset/agent-presets/README.zh.md @@ -126,7 +126,7 @@ agent-presets: ### 挂载审计 -直接挂载的子树不会出现在 `ctx.loader.entries()` 中，因此没有启动审计能覆盖它；`mountPreset` 自行证明结果可用，并拒绝三种形态：无 scope 的目标（preset 的工具会注册成全局的）、仍在等待组装从未提供的服务的行、以及把服务发布进根 realm 的行（进程级全局，第二个发布同名服务的 preset 会相撞）。不变式伴生插件在每次服务通知时复查最后一条规则，因为从定时器或异步续体发布的行会绕过一次性审计。 +直接挂载的子树不会出现在 `ctx.loader.entries()` 中，因此没有启动审计能覆盖它；`mountPreset` 自行证明结果可用，并拒绝导入或激活失败、无 scope 的目标（preset 的工具会注册成全局的）、仍在等待组装从未提供的服务的行、以及把服务发布进根 realm 的行（进程级全局，第二个发布同名服务的 preset 会相撞）。不变式伴生插件在每次服务通知时复查最后一条规则，因为从定时器或异步续体发布的行会绕过一次性审计。 ### 创作机制 diff --git a/packages/preset/agent-presets/src/mount.ts b/packages/preset/agent-presets/src/mount.ts index 1e273ba950..c13530f2c9 100644 --- a/packages/preset/agent-presets/src/mount.ts +++ b/packages/preset/agent-presets/src/mount.ts @@ -295,24 +295,28 @@ export function serviceForAgent( /** * Rows that did not reach a usable state, each rendered as one diagnostic line. * - * A row whose module failed to import or whose plugin threw already rejects the - * mount through the loader; what remains observable here is a row still waiting - * for a service the composition never supplies. + * Wait for the subtree, then report import failures, activation failures, and + * rows waiting for services the composition does not supply. * @param tree - the mounted subtree. * @returns one line per unusable row, empty when every enabled row is usable. */ -export function inactiveRows(tree: EntryTree): string[] { +export async function inactiveRows(tree: EntryTree): Promise { + await tree.await() const lines: string[] = [] for (const entry of tree.entries()) { if (entry.disabled) continue const fiber = entry.fiber - /* v8 ignore next 4 -- the loader rejects an entry whose module or plugin failed, - so a settled tree never holds an enabled fiber-less entry; the branch exists - only because `Entry.fiber` is declared optional. */ if (fiber === undefined) { lines.push(`${entry.options.id} (${entry.options.name}): never started`) continue } + try { + await fiber.await() + } catch (error) { + const detail = error instanceof Error ? error.message : String(error) + lines.push(`${entry.options.id} (${entry.options.name}): ${detail}`) + continue + } const missing = Object.keys(fiber.inject).filter(name => fiber.ctx.get(name) === undefined) if (missing.length > 0) { lines.push(`${entry.options.id} (${entry.options.name}): waiting for ${missing.join(', ')}`) @@ -400,7 +404,7 @@ export async function mountPreset(agentCtx: Context, preset: AgentPreset): Promi /* v8 ignore next -- the subclass constructor runs before `await()` settles for every mounted tree */ if (subtree === undefined) throw new Error('mounted subtree did not publish its entry tree') const { tree, fiber } = subtree - const unusable = inactiveRows(tree) + const unusable = await inactiveRows(tree) if (unusable.length > 0) { throw new Error(`${String(unusable.length)} row(s) did not activate:\n${unusable.join('\n')}`) } diff --git a/packages/preset/agent-presets/tests/mount.spec.ts b/packages/preset/agent-presets/tests/mount.spec.ts index 6c43c2192c..03b9daa7a0 100644 --- a/packages/preset/agent-presets/tests/mount.spec.ts +++ b/packages/preset/agent-presets/tests/mount.spec.ts @@ -255,20 +255,13 @@ describe('rejecting a composition that cannot be used', () => { }) it('names every failed row, not just the count', async () => { - // The Loader folds several failed rows into one AggregateError whose own - // message names none of them; unflattened, the operator is told only that - // "loader entries failed to apply" and has nothing to act on. await expect(agentOn(ctx, 'sess-two-broken', 'two-broken')) .rejects.toThrow(/first-refuses[\s\S]*second-refuses/) }) it('names the rows inside a failed group, not the group alone', async () => { - // The Loader's per-row wrapper keeps only `cause.message`, so a group's - // own AggregateError arrives with its `errors` reachable through `cause` - // alone. Reading the message stops at "loader entries failed to apply" - // and names neither row that actually refused. await expect(agentOn(ctx, 'sess-nested-broken', 'nested-broken')) - .rejects.toThrow(/outer[\s\S]*inner-first[\s\S]*inner-second/) + .rejects.toThrow(/inner-first[\s\S]*inner-second/) }) it('names the unresolved service when a row never activates', async () => { diff --git a/packages/todo/tool-todo/tests/loader-composition.spec.ts b/packages/todo/tool-todo/tests/loader-composition.spec.ts index b99909fa2a..7365651f21 100644 --- a/packages/todo/tool-todo/tests/loader-composition.spec.ts +++ b/packages/todo/tool-todo/tests/loader-composition.spec.ts @@ -87,6 +87,7 @@ async function boot(configLines: readonly string[]): Promise { } as unknown as NonNullable await ctx.loader.create({ name: 'cordis:include', config: { path: pathToFileURL(configPath).href } }) await ctx.loader.await() + for (const entry of ctx.loader.entries()) await entry.fiber?.await() return ctx } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index bcea481379..3eb1aba574 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -1255,6 +1255,9 @@ importers: '@deepseek-ai/dsh-package-manifest': specifier: workspace:^ version: link:../../util/package-manifest + chokidar: + specifier: 4.0.3 + version: 4.0.3 js-yaml: specifier: ^4.2.0 version: 4.2.0 @@ -1292,9 +1295,6 @@ importers: '@types/js-yaml': specifier: ^4.0.9 version: 4.0.9 - chokidar: - specifier: 4.0.3 - version: 4.0.3 packages/boot/cmdline: devDependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index cde062a553..68eff9cd1c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,6 +14,10 @@ packages: # closure is what the exe bundles and what the Python runtime distributes. - python/sdk-runtime +# Vendored framework packages keep their upstream semver ranges, while local +# builds must resolve those matching names to this workspace's pinned sources. +linkWorkspacePackages: true + overrides: '@deepseek-ai/cosmokit': 'link:vendor/cosmokit' '@deepseek-ai/schemastery': 'link:vendor/schemastery' diff --git a/scripts/verify-vendored-links.ts b/scripts/verify-vendored-links.ts new file mode 100644 index 0000000000..93b8390157 --- /dev/null +++ b/scripts/verify-vendored-links.ts @@ -0,0 +1,72 @@ +/** + * Verify that pnpm-lock.yaml resolves every vendored package name to its + * workspace `link:` — never a registry copy. `linkWorkspacePackages: true` + * (pnpm-workspace.yaml) makes matching upstream semver ranges resolve to the + * pinned vendored sources; a registry copy of the same name coexisting with + * the vendored one silently forks the framework layer (vendor/README.md). + */ +import { readdir, readFile } from 'node:fs/promises' +import { join, resolve } from 'node:path' +import * as yaml from 'js-yaml' + +const root = resolve(import.meta.dirname, '..') + +async function vendoredNames(): Promise> { + const names = new Set() + for (const entry of await readdir(join(root, 'vendor'), { withFileTypes: true })) { + if (!entry.isDirectory()) continue + let manifest: { name?: string } + try { + manifest = JSON.parse(await readFile(join(root, 'vendor', entry.name, 'package.json'), 'utf8')) as { name?: string } + } catch { + continue // not a package directory (e.g. vendor/README.md siblings) + } + if (manifest.name !== undefined) names.add(manifest.name) + } + return names +} + +interface Lockfile { + importers?: Record> + packages?: Record + snapshots?: Record +} + +const names = await vendoredNames() +if (names.size === 0) throw new Error('verify-vendored-links: no vendored package manifests found under vendor/') +const lockfile = yaml.load(await readFile(join(root, 'pnpm-lock.yaml'), 'utf8')) as Lockfile + +const violations: string[] = [] + +// Importer resolutions: every dependency entry naming a vendored package must +// resolve to a link:, or the build silently uses a registry copy. +for (const [importer, sections] of Object.entries(lockfile.importers ?? {})) { + for (const [section, dependencies] of Object.entries(sections)) { + if (typeof dependencies !== 'object' || dependencies === null) continue + for (const [dependency, entry] of Object.entries(dependencies as Record)) { + if (!names.has(dependency)) continue + const version = entry.version ?? '' + if (!version.startsWith('link:')) { + violations.push(`${importer} ${section}.${dependency} resolves to ${JSON.stringify(version)} (expected link:)`) + } + } + } +} + +// Package/snapshot keys: a registry copy materializes as a `@` +// key; vendored names must never appear there at all. +for (const section of ['packages', 'snapshots'] as const) { + for (const key of Object.keys(lockfile[section] ?? {})) { + const atIndex = key.lastIndexOf('@') + if (atIndex <= 0) continue + const packageName = key.slice(0, atIndex) + if (names.has(packageName)) violations.push(`${section} entry ${key} is a registry copy of a vendored package`) + } +} + +if (violations.length > 0) { + console.error(`verify-vendored-links: ${String(violations.length)} lockfile resolution(s) bypass the vendored workspaces:`) + for (const violation of violations) console.error(` - ${violation}`) + process.exit(1) +} +console.log(`verify-vendored-links: all ${String(names.size)} vendored package names resolve to workspace links.`) diff --git a/vendor/README.md b/vendor/README.md index 47b3093b76..305f241929 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -2,7 +2,7 @@ This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned). -All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`. Schemastery's manifest additionally declares a conditional `exports` map (import → `.mjs`, require → `.cjs`): pnpm links the directory itself, so without `exports` Node's ESM resolver would fall back to `main` and load the CJS entry whose lazy `require('@deepseek-ai/cosmokit')` can race ESM loading of the same linked module under module-hook hosts (vitest). Upstream MIT `LICENSE` files are preserved in each package directory. +All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`. The `hygiene` gate `verify-vendored-links` asserts every vendored name resolves to a workspace `link:` in `pnpm-lock.yaml` with no registry copy alongside. Schemastery's manifest additionally declares a conditional `exports` map (import → `.mjs`, require → `.cjs`): pnpm links the directory itself, so without `exports` Node's ESM resolver would fall back to `main` and load the CJS entry whose lazy `require('@deepseek-ai/cosmokit')` can race ESM loading of the same linked module under module-hook hosts (vitest). Upstream MIT `LICENSE` files are preserved in each package directory. This file covers the manifest, the local-modification log, and the procedure for **updating** an existing vendored package. To **add a new** one, see the cookbook guide: [docs/cookbook/adding-a-vendored-package.md](../docs/cookbook/adding-a-vendored-package.md). @@ -33,17 +33,17 @@ Keep this log exhaustive — every divergence from upstream must be listed. 1. **`hmr/src/index.ts`**: removed the `./locales/en-US.yml` / `./locales/zh-CN.yml` imports, the `.i18n({...})` call on the `Config` schema, and the `src/locales/` directory. Rationale: those imports require a runtime YAML loader hook (`@cordisjs/unyaml`) that we do not vendor; the i18n texts only localize config descriptions. 2. **All `package.json` files**: regenerated — added `private: true`, added precise `files` entries for bundled runtime files and `lib/types/**/*.d.ts` / `.d.ts.map`, preserved `src` in `files` only for packages whose previous file list already shipped it, added a `./src/*` export where missing, pointed declaration metadata at `lib/types`, and removed upstream `devDependencies`/`scripts`/`repository` fields. Dependency and peer-dependency ranges are preserved except that `hmr` declares `esbuild` as a direct dev dependency because its source imports the `BuildFailure` type and pnpm's strict workspace resolution requires the owner package to name that dependency, and `loader` requires `node-addon-require-builtin@^0.1.4` to match the runtime used by published app packages. 3. **All `tsconfig.json` files**: regenerated to extend the repo-root `tsconfig.base.json`, emit TypeScript intermediates to `lib/types`, and declare project references. -4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`. +4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`. Type-only dependencies use `import type` or inline `type` modifiers so ESM output does not retain erased interfaces. 5. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under `lib/types` and then write the publish runtime entries under `lib/`. Like the regenerated tsconfigs, they are not part of the upstream sync surface. 6. **`cordis/src/fiber.ts` lifecycle hardening**: locally closes three reentrant disposal gaps. An effect's owner-list wrapper is registered before its setup body runs, so an unload begun from inside setup awaits setup and every collected cleanup; synchronous setup failure removes the wrapper and rolls back collected cleanup. Async cleanup stays owner-visible until quiescence, and Cordis's internal effect composition joins an already-running cleanup while repeated public disposer calls retain their upstream single-shot result. Effect creation is rejected while the owner is `UNLOADING` (while `PENDING` and `LOADING` remain legal), preventing cleanup-time registrations from escaping the unload snapshot. Child fibers register and receive their parent-owned disposer before `internal/plugin` publication, resolve dependency declarations added by that notification before activation, drain effects attached while pending, skip plugin execution when reentrant disposal invalidates the load epoch before its first checkpoint, and contain teardown-notification failures per observer so one callback cannot starve peers or interrupt ownership cleanup. -7. **`cordis/src/*.ts` JSDoc enrichment**: added `@param`/`@returns` tags and contract documentation (disposal semantics, waterfall veto, bail conditions, error cases) across the public plugin-author surface — `Context` (class, statics, and the `Context` interface properties incl. `root`), `EventsService`, `Fiber`, `RegistryService`, `ReflectService`, `Service`, `LoggerService` and their `declare module './context.ts'` overloads. Comment-only; no code changes. Motivation: the website API-reference generator renders these docs and hard-errors on undocumented members. Retire this entry when the enrichment is upstreamed to the fork. -8. **Transactional Loader/Include config reconciliation**: Loader imports a changed entry name before disposal, awaits lifecycle settlement, and restores the previous plugin or config when candidate application fails. Loader settlement rechecks service-gated fibers after current tasks drain, rejects failures, and leaves fibers with absent dependencies pending. Group updates run sequentially and undo changes and additions on live-update failure, await removal, preserve programmatic option identity, and persist direct or tree-level mutations only after success. Include reads and validates detached candidate content, applies patches to a clone, reconciles the tree, and only then commits its cached content/data; direct refresh failures propagate for the caller to contain. A non-array parse is invalid, patches re-apply on every file or Include-config update, and initial content falls back to `initial` only on `ENOENT`. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts` and `packages/host/webserver/tests/webserver.spec.ts`. -9. **`hmr/src/index.ts` exact config watching**: `registerConfig()` watches one absolute config path outside module roots, including a path under missing parents, serializes and coalesces refreshes, and returns an async disposer that closes the watcher and drains active work. Module watches realpath their existing base directory, attach change listeners before declaring the service ready, and use that spelling for Node module-cache identity; exact config watches realpath the deepest existing watch ancestor and restore the missing suffix. Those native paths prevent Windows short-name aliases from colliding with long-form libuv event paths while exact-config callbacks keep the requested filename. Refresh failures are normalized to `Error`, logged, and broadcast through the parallel `hmr/config-update-failed` event; observer failures are contained. Config-file changes discovered by the ordinary HMR watcher use the same serialized path. Covered by `packages/boot/app-boot/tests/hmr-config.spec.ts`. -10. **Vendored Node-compatible TypeScript**: marked erased imports explicitly across `cordis`, `loader`, `include`, `hmr`, and `schemastery` so Node's native TypeScript transform does not request types as runtime exports. Schemastery's source uses an ESM default export and its package declares `type: module`; its built ESM/CJS entries retain explicit `.mjs`/`.cjs` extensions. -11. **`include/src/index.ts` patch-semantics export**: extracted the private `applyPatches` body into the exported pure function `applyEntryPatches(data, patches, warn)` (the method delegates to it) and exported the `!!js` YAML dialect as `entryListSchema`, so `dsh --dump-config` composes and prints exactly what the include would mount without booting a tree. Behavior-preserving for mounting; the extraction exists because config tooling must never reimplement (and drift from) the patch algorithm. `applyEntryPatches` also indexes each `insert`ed entry as it is added, so a later patch in the same list can configure or disable a row an earlier patch inserted; upstream built the id index once before the patch loop, leaving inserted rows silently unpatchable. That matters because `dsh` composes an empty profile root with each bundle's patch layer, the profile's and the home-level `cordis.patch.yml`, and any `--patch` overlays as sibling patch lists at one include level — patches never cross an include boundary, so surface-only rows would otherwise be unreachable from user config. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts`. -12. **`include/src/index.ts` serialized child-tree mutation and `hmr/src/index.ts` main-watcher initial-scan suppression**: every Include child-tree mutation (initial apply, refresh, `internal/update` patch re-application) runs through one per-Include queue, because the group's transactional `update` is not reentrant — two concurrent applies interleave create and rollback on the same entries and strand the Include fiber without ever settling. The HMR main watcher passes `ignoreInitial: true`: the initial scan re-announced files boot had just consumed, and its `add` for a config file refreshed an Include mid-initial-apply; once serialized, a failing initial apply's rollback disposed HMR, whose teardown drain waited on the queued refresh sitting behind that same apply — a deadlock that exited 13 with no diagnostic. `registerConfig()` keeps its own `ignoreInitial: false` watcher because a user patch layer present at registration must apply once. Covered by the patch-overlay boot-failure built-bin case in `apps/cli/tests/built-bin.e2e.ts`. +7. **Cordis and Loader JSDoc enrichment**: added `@param`/`@returns` tags and contract documentation (disposal semantics, waterfall veto, bail conditions, error cases) across the public plugin-author surface — `Context` (class, statics, and the `Context` interface properties incl. `root`), module re-exports, shared utility helpers, `EventsService`, `Fiber`, `RegistryService`, `ReflectService`, `Service`, `LoggerService` and their `declare module './context.ts'` overloads. Loader documentation covers `loader/src/{index,internal,config/entry,config/group,config/isolate,config/tree,config/utils}.ts`, including entry ownership, tree mutation methods, and the `!!js` discriminator. Comment-only; no code changes. Motivation: the website API-reference generator renders these docs and hard-errors on undocumented members. Retire this entry when the enrichment is upstreamed to the fork. +8. **`include/src/index.ts` resilient file refresh and patch reapplication**: [#514](https://github.com/deepseek-harness/deepseek-harness/pull/514) validates a top-level entry array before caching parsed content, logs refresh failures, reapplies patches after file or Include-config edits, updates the Include config when it vetoes a restart, and uses `initial` only after `ENOENT`. These parse protections retain the running tree after an invalid file; plugin activation failures can leave a partially applied tree. Loader entry/group/tree mutations follow the pinned eager, non-transactional implementation and do not restore previous plugins or options. Covered by `packages/boot/app-boot/tests/{config-reload,user-patches}.spec.ts`. +9. **`hmr/src/index.ts` module-watcher readiness and native paths**: realpath the existing watch base, classify framework modules and attach listeners before reporting readiness, and compare config paths using both canonical and configured spellings. This preserves Node module-cache identity across Windows short-name paths and filesystem aliases. The main watcher uses `ignoreInitial: true` so startup reads do not trigger another refresh; exact profile patch watching is owned by `packages/boot/app-boot/src/watch-config.ts`. Covered by `packages/boot/app-boot/tests/watch-config.spec.ts`. +10. **Vendored Node-compatible TypeScript**: marked erased imports explicitly across `cordis`, `loader`, `include`, `hmr`, and `schemastery` so Node's native TypeScript transform does not request types as runtime exports. HMR declares the same Loader and Timer injections with `static inject` instead of decorators. Schemastery's source uses an ESM default export and its package declares `type: module`; its built ESM/CJS entries retain explicit `.mjs`/`.cjs` extensions. +11. **`include/src/index.ts` patch-semantics export**: extracted the private `applyPatches` body into the exported pure function `applyEntryPatches(data, patches, warn)` (the method delegates to it) and exported the `!!js` YAML dialect as `entryListSchema`, so `dsh --dump-config` composes and prints exactly what the include would mount without booting a tree. The entry list is deep-cloned even without patches so Loader mutations cannot alter the cached parse. Public patch and Include fields carry JSDoc for config tooling. Behavior-preserving for mounting; the extraction exists because config tooling must never reimplement (and drift from) the patch algorithm. `applyEntryPatches` also indexes each `insert`ed entry as it is added, so a later patch in the same list can configure or disable a row an earlier patch inserted; upstream built the id index once before the patch loop, leaving inserted rows silently unpatchable. That matters because `dsh` composes an empty profile root with each bundle's patch layer, the profile's and the home-level `cordis.patch.yml`, and any `--patch` overlays as sibling patch lists at one include level — patches never cross an include boundary, so surface-only rows would otherwise be unreachable from user config. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts`. +12. **`cordis/src/{events,fiber}.ts` and `loader/src/{index,config/entry,config/isolate}.ts` update completion**: `Fiber.update()` returns its update-waterfall result. Entry config updates forward and await that result, while the isolate listener forwards it after its synchronous context changes. This prevents asynchronous restart failures from escaping their callers without adding rollback. The detached `Entry.init()` completion observer handles both outcomes; the fiber retains its activation error for explicit audits. Covered by `packages/boot/app-boot/tests/user-patches.spec.ts` and `packages/host/webserver/tests/webserver.spec.ts`. 13. **`include/src/index.ts` `writeTask` type**: widened the optional `writeTask?: NodeJS.Timeout` property to `NodeJS.Timeout | undefined` — the debounced writer assigns `undefined` on flush, which `exactOptionalPropertyTypes` rejects on a plain optional. Type-only; no behavior change. -14. **`include/src/index.ts` durable debounced writes**: serialized and tracked config-file writes, retried transient `EACCES`/`EBUSY`/`EPERM` rename failures with a bounded backoff, observed asynchronous timer rejections, and drained the latest write during Include teardown. Windows can briefly retain a destination handle after a Loader child disposes; the upstream fire-and-forget rename escaped as an unhandled rejection and could lose the persisted `disabled` state. A terminal failure is logged by the asynchronous writer and remains on the queue so `Include.stop()` rethrows it instead of silently declaring persistence complete; Cordis's ordinary fiber teardown retains its separate error-containment contract. Covered by `packages/host/directory-picker-auto/tests/loader-composition.spec.ts` with injected transient and terminal rename failures. +14. **`include/src/index.ts` durable debounced writes**: serialized and tracked config-file writes, retried transient `EACCES`/`EBUSY`/`EPERM` rename failures with a bounded backoff, observed asynchronous timer rejections, and drained writes before and after child removal during Include teardown. The first drain preserves an existing terminal write failure even if child removal schedules a later write. Missing-file initialization awaits the write and forces a fresh parse before mounting the initial entries. Windows can briefly retain a destination handle after a Loader child disposes; the upstream fire-and-forget rename escaped as an unhandled rejection and could lose the persisted `disabled` state. A terminal failure is logged by the asynchronous writer and remains on the queue so `Include.stop()` rethrows it instead of silently declaring persistence complete; Cordis's ordinary fiber teardown retains its separate error-containment contract. Covered by `packages/host/directory-picker-auto/tests/loader-composition.spec.ts` with injected transient and terminal rename failures. 15. **Lazy Loader config resolution across `cordis/src/{events,fiber}.ts`, `loader/src/{index,config/entry}.ts`, `include/src/index.ts`, and `hmr/src/index.ts`**: ports [cordiverse/cordis#41](https://github.com/cordiverse/cordis/pull/41), retaining raw fiber config and resolving it through `internal/config` only after declared injections are active. Provider replacement re-resolves the raw expression, pending updates retain it, and HMR transfers it. Resolution applies only to the entry root, so child plugins mounted by a row keep caller-owned config identity. Include declares the `EntryGroup.key` tree-carrier marker (as Group does): its config is entry and patch lists, so interpolation keeps it literal and a `!!js` expression inside a nested row's config resolves lazily in that row's own fiber (Include's own `path` therefore stays literal too). Deferred failures retain the owning row diagnostic, and tree teardown does not persist failure-driven self-disposal. Covered by `packages/boot/app-boot/tests/{app-boot,user-patches}.spec.ts`, `packages/boot/cmdline/tests/cmdline.spec.ts`, `apps/cli/tests/web-agent-presets.e2e.ts`, and the built custom-profile cases in `apps/cli/tests/built-bin.e2e.ts`. 16. **`cordis/package.json` publishes `src`**: added `src` to the `files` list, joining the other eight vendored packages. Cordis declares `"./src/*": "./src/*"` in its exports, so a tarball without `src` publishes an export map pointing at absent files; the release change judgement also reads `files` to decide whether a diff reaches the payload, and a package whose only published paths are build output has no tracked path to match. 17. **`@deepseek-ai` rescope**: every vendored manifest `name`, every internal dependency entry among the vendored set, and every module specifier that reaches them use the scoped names in the manifest table's `npm name` column. Directory names, version numbers, and dependency ranges are unchanged, and no upstream runtime identifier is renamed — `Symbol.for('schemastery')` and Schemastery's `vendor:` metadata field keep their upstream values. Re-apply with `pnpm run rescope-vendor --apply` after a sync; the table's two name columns are the mapping, restated for consumers in [docs/rescope.md](../docs/rescope.md). diff --git a/vendor/cordis/src/events.ts b/vendor/cordis/src/events.ts index c7bf42632e..e9bd85e3e1 100644 --- a/vendor/cordis/src/events.ts +++ b/vendor/cordis/src/events.ts @@ -340,7 +340,7 @@ export interface Events { /** Interception hook for a service binding (no core producer). */ 'internal/service'(this: Context, name: string, value: any): void /** Waterfall: a fiber config update is being applied; skip `next()` to veto. */ - 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void): void + 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void | Promise): void | Promise /** Waterfall: a service is being read through the context proxy. */ 'internal/get'(ctx: Context, name: string, error: Error, next: () => any): any /** Waterfall: a service is being written through the context proxy. */ diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts index 6bb1caa7a5..38a3197e29 100644 --- a/vendor/cordis/src/fiber.ts +++ b/vendor/cordis/src/fiber.ts @@ -730,8 +730,8 @@ export class Fiber { * * @param config — the new raw config; validated before anything restarts. * @param noSave — hint for persistence hooks not to write the change back. - * @returns nothing; the restart runs behind the `internal/update` waterfall. - * @throws {ValidationError} when the new config fails validation. + * @returns the update waterfall result; the default restart returns a promise. + * @throws when validation, an update listener, or the restarted plugin fails. */ update(config: any, noSave = false) { this.assertActive() @@ -745,7 +745,7 @@ export class Fiber { return } config = this._resolveConfig(config) - this.context.waterfall(this, 'internal/update', config, noSave, () => { + return this.context.waterfall(this, 'internal/update', config, noSave, () => { this.config = config this._error = undefined return this.restart() diff --git a/vendor/hmr/src/index.ts b/vendor/hmr/src/index.ts index ccd399622a..d5d31305ae 100644 --- a/vendor/hmr/src/index.ts +++ b/vendor/hmr/src/index.ts @@ -20,7 +20,6 @@ declare module '@deepseek-ai/cordis' { interface Events { 'hmr/change'(url: string): void 'hmr/reload'(reloads: Map): void - } } diff --git a/vendor/include/src/index.ts b/vendor/include/src/index.ts index cd7406bbab..c3bfdc60ee 100644 --- a/vendor/include/src/index.ts +++ b/vendor/include/src/index.ts @@ -44,7 +44,8 @@ function retryableWriteError(error: unknown): boolean { * Apply patch lists to an entry list — THE patch semantics of this include, * shared by mounting (`applyPatches`) and offline config tooling * (`dsh --dump-config`) so a dump can never drift from what boots. The input - * is never mutated: patching shared entry objects would bake earlier patch + * is never mutated and the result is always detached from it (even with no + * patches): patching or mounting shared entry objects would bake earlier * values into the cached parse, so repeated application (config hot-reloads) * could never revert a removed or changed patch. Inserted entries are indexed * as they are added, so a later patch in the same list can target a row an @@ -59,8 +60,8 @@ export function applyEntryPatches( patches: PatchOptions[] | undefined, warn: (message: string, ...args: any[]) => void, ): EntryOptions[] { - if (!patches?.length) return [...data] data = structuredClone(data) + if (!patches?.length) return data const entryMap = new Map() const buildMap = (entries: EntryOptions[]) => { @@ -251,8 +252,8 @@ export class Include extends EntryTree { // never be mislabelled as absent or silently overwritten. if ((error as NodeJS.ErrnoException | null)?.code !== 'ENOENT') throw error if (this.config.initial) { - this.writeFile(this.config.initial as any) - await this.read() + await this._writeFile(this.config.initial as any) + await this.read(true) } else { throw new Error(`config file not found: ${this.filename}`) } @@ -263,8 +264,12 @@ export class Include extends EntryTree { } async stop() { - await this.root.stop() - await this.flushWrite() + try { + await this.flushWrite() + } finally { + this.root.stop() + await this.flushWrite() + } } /** diff --git a/vendor/loader/src/config/entry.ts b/vendor/loader/src/config/entry.ts index 7cf2520af3..9e1258dd6b 100644 --- a/vendor/loader/src/config/entry.ts +++ b/vendor/loader/src/config/entry.ts @@ -96,11 +96,11 @@ export class Entry { } private _patchContext(diff: string[]) { - this.context.waterfall('loader/patch-context', this, () => { + return this.context.waterfall('loader/patch-context', this, () => { Object.setPrototypeOf(this.ctx, this.parent.ctx) if (this.fiber?.uid && (diff.includes('config') || this.options.group)) { - this.fiber.update(this.options.config, true) + return this.fiber.update(this.options.config, true) } }) } @@ -142,7 +142,7 @@ export class Entry { .filter(key => !deepEqual(this.options[key], legacy[key])) if (!diff.length && !force) return this.context.emit('loader/partial-dispose', this, legacy, true) - this._patchContext(diff) + await this._patchContext(diff) } else { await this.init() } @@ -165,10 +165,11 @@ export class Entry { } finally { this._initTask = undefined } - this.fiber?.await().finally(() => { + const notify = () => { if (this.loader.getTasks().length) return this.ctx.reflect.notify(['loader']) - }) + } + this.fiber?.await().then(notify, notify) } private async _init() { diff --git a/vendor/loader/src/config/isolate.ts b/vendor/loader/src/config/isolate.ts index e2fd539157..102c7c41c9 100644 --- a/vendor/loader/src/config/isolate.ts +++ b/vendor/loader/src/config/isolate.ts @@ -126,7 +126,7 @@ export default function isolate(ctx: Context) { swap(entry.ctx[Context.intercept], entry.options.intercept) // step 4: reload fiber - next() + const result = next() // step 5: replace service impl for (const [symbol1, symbol2, flag1, flag2] of Object.values(diff)) { @@ -150,6 +150,7 @@ export default function isolate(ctx: Context) { delete entry.ctx[delims[name]] } } + return result }) ctx.on('loader/partial-dispose', (entry, legacy, active) => { diff --git a/vendor/loader/src/config/utils.ts b/vendor/loader/src/config/utils.ts index cd706c0407..8e28be0c4c 100644 --- a/vendor/loader/src/config/utils.ts +++ b/vendor/loader/src/config/utils.ts @@ -8,7 +8,7 @@ export const evaluate = new Function('ctx', 'expr', ` } `) as ((ctx: object, expr: string) => any) -/** Recursively replace YAML `!js` expression nodes with evaluated values. */ +/** Recursively replace YAML `!!js` expression nodes with evaluated values. */ export function interpolate(ctx: object, value: any) { if (isJsExpr(value)) { return evaluate(ctx, value.__jsExpr) diff --git a/vendor/loader/src/index.ts b/vendor/loader/src/index.ts index ac736ae356..1231b4d357 100644 --- a/vendor/loader/src/index.ts +++ b/vendor/loader/src/index.ts @@ -26,7 +26,7 @@ declare module '@deepseek-ai/cordis' { 'loader/config-update'(): void 'loader/entry-init'(entry: Entry): void 'loader/partial-dispose'(entry: Entry, legacy: Partial, active: boolean): void - 'loader/patch-context'(entry: Entry, next: () => void): void + 'loader/patch-context'(entry: Entry, next: () => void | Promise): void | Promise } interface Context { diff --git a/vendor/schemastery/package.json b/vendor/schemastery/package.json index 828339371e..92f9b09b82 100644 --- a/vendor/schemastery/package.json +++ b/vendor/schemastery/package.json @@ -14,6 +14,15 @@ "main": "lib/index.cjs", "module": "lib/index.mjs", "types": "lib/types/index.d.ts", + "exports": { + ".": { + "types": "./lib/types/index.d.ts", + "import": "./lib/index.mjs", + "require": "./lib/index.cjs" + }, + "./src/*": "./src/*", + "./package.json": "./package.json" + }, "files": [ "lib/index.mjs", "lib/index.cjs", From d225dbba5034298505246fa81625d30e3db994a4 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 18:34:11 +0800 Subject: [PATCH 03/26] Remove nonessential remnants of Cordis PR 932 --- ...26-09-09-nontransactional-loader.i18n.yaml | 4 +- .../2026-09-09-nontransactional-loader.md | 6 +- .../2026-09-09-nontransactional-loader.zh.md | 6 +- docs/cordis-api/fiber.i18n.yaml | 4 +- docs/cordis-api/fiber.md | 6 +- docs/cordis-api/fiber.zh.md | 6 +- docs/event-producer-consumer.i18n.yaml | 4 +- docs/event-producer-consumer.md | 1 + docs/event-producer-consumer.zh.md | 1 + docs/rescope.i18n.yaml | 4 +- docs/rescope.md | 2 +- docs/rescope.zh.md | 2 +- package.json | 1 - packages/boot/app-boot/README.i18n.yaml | 4 +- packages/boot/app-boot/README.md | 1 + packages/boot/app-boot/README.zh.md | 1 + packages/boot/app-boot/src/index.ts | 6 ++ packages/boot/app-boot/tests/app-boot.spec.ts | 20 ++++++ .../boot/app-boot/tests/user-patches.spec.ts | 7 +- packages/bundle/web-app/README.i18n.yaml | 4 +- packages/bundle/web-app/README.md | 2 +- packages/bundle/web-app/README.zh.md | 2 +- packages/bundle/web-app/src/index.ts | 10 +-- packages/bundle/web-app/tests/web-app.spec.ts | 26 ++++++- packages/preset/agent-presets/src/mount.ts | 23 ++---- .../preset/agent-presets/tests/mount.spec.ts | 23 +++++- pnpm-workspace.yaml | 4 -- scripts/rescope-vendor.ts | 11 +-- scripts/run-gates.spec.ts | 2 +- scripts/run-gates.ts | 1 - scripts/verify-vendored-links.ts | 72 ------------------- vendor/README.md | 10 +-- vendor/cordis/src/events.ts | 2 +- vendor/cordis/src/fiber.ts | 6 +- vendor/hmr/README.md | 6 +- vendor/hmr/src/index.ts | 6 +- vendor/include/src/index.ts | 5 +- vendor/loader/src/config/entry.ts | 6 +- vendor/loader/src/config/isolate.ts | 3 +- vendor/loader/src/index.ts | 2 +- 40 files changed, 147 insertions(+), 165 deletions(-) delete mode 100644 scripts/verify-vendored-links.ts diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml index 0cb0ade9b5..0e0de823e8 100644 --- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md -2026-09-09-nontransactional-loader.md: e3d43e6d56235e35d1a273900a935a7df19318be -2026-09-09-nontransactional-loader.zh.md: 55abb03a1f72c9e88304033d76d3db80bb28f916 +2026-09-09-nontransactional-loader.md: 7ea4db0abf0fb65e443126dbca9fd822e47ce2d0 +2026-09-09-nontransactional-loader.zh.md: 5293efb58998f68a25e1143a2d043da32ef06bfb diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md index e3d43e6d56..7ea4db0abf 100644 --- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.md @@ -14,9 +14,11 @@ Revert the five commits in [#932](https://github.com/deepseek-harness/deepseek-h Loader changes entry options eagerly. EntryGroup starts siblings concurrently and logs application failures; EntryTree waits for outstanding work without rejecting failed fibers. Neither restores a previous plugin or configuration. Include retains parse validation and patch reapplication, but plugin failures can leave a partially applied tree. -Application consumers own their completion checks. The CLI waits for its fallback HMR service before installing live patch watchers. The directory chooser checks the entries it mounts. The chooser and browser package runner capture the first fiber-disposal result before removing the entry, then await it before reporting teardown complete. Preset mounting waits for its subtree and reports import, activation, and missing-service failures. [App boot](../../../../packages/boot/app-boot/README.md) owns exact patch-file watching, activation audits, and partial-context cleanup. These adaptations are separate from the reverse patch. +Application consumers own their completion checks. The CLI waits for its fallback HMR service before installing live patch watchers. The directory chooser checks the entries it mounts. The chooser and browser package runner capture the first fiber-disposal result before removing the entry, then await it before reporting teardown complete. Preset mounting waits for its subtree and reports import, activation, and missing-service failures. [App boot](../../../../packages/boot/app-boot/README.md) owns exact patch-file watching, activation audits, and partial-context cleanup. Web startup audits activation before printing a URL or opening the browser. These adaptations preserve existing consumer behavior after the reverse patch. -The small update-result extension forwards asynchronous restart failures through Fiber and Entry updates. The detached import-completion observer handles both fiber outcomes; the fiber still retains its failure for an explicit audit. Durable Include writes drain before and after child removal so a later teardown write cannot erase an earlier terminal write failure. Missing-file initialization waits for its write and rereads the file before mounting initial entries. +Fiber, Entry, and isolate keep their upstream update return behavior. App boot observes discarded restart promises through the existing `internal/update` waterfall and waits for fibers before auditing a patch reload. The detached import-completion observer handles both fiber outcomes; the fiber still retains its failure for an explicit audit. Durable Include writes drain before and after child removal so a later teardown write cannot erase an earlier terminal write failure. + +Two #932-specific vendor changes remain: awaited initial-file creation and forced rereading in Include, and Schemastery conditional exports. Restoring the pre-#932 debounced write/read sequence reproduces `ENOENT` in the missing-file initialization test. Keeping these two lines preserves the existing `initial` option without an application-side file writer or a second YAML serializer. Removing Schemastery exports reproduces `ERR_REQUIRE_ESM_RACE_CONDITION` while the Web preset suite boots: Node falls back to the CJS entry during concurrent ESM imports. The HMR injection decorators, conditional patch cloning, and update return values use the pre-#932 behavior. Explicit `workspace:^` dependencies make the #932 workspace-link switch and dedicated lockfile check unnecessary. ## Alternatives considered diff --git a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md index 55abb03a1f..5293efb589 100644 --- a/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md +++ b/.agents/notes/implemented/simplification/2026-09-09-nontransactional-loader.zh.md @@ -14,9 +14,11 @@ Status: implemented Loader 立即更改条目选项。EntryGroup 并发启动同级条目并记录应用失败；EntryTree 等待未完成的工作，但不因失败的 fiber 而拒绝。两者均不恢复旧插件或配置。Include 保留解析校验和 patch 重应用，但插件失败可能留下部分应用的配置树。 -应用消费者负责完成检查。CLI 在安装实时 patch 监视器前等待其回退 HMR 服务。目录选择器检查其挂载的条目。选择器和浏览器包运行器在移除条目前取得首次 fiber 释放的结果，并等待该结果后才报告拆卸完成。预设挂载等待其子树，并报告导入、激活和缺少服务的失败。[应用启动](../../../../packages/boot/app-boot/README.zh.md) 负责精确 patch 文件监视、激活检查和部分上下文清理。这些适配与反向补丁分开。 +应用消费者负责完成检查。CLI 在安装实时 patch 监视器前等待其回退 HMR 服务。目录选择器检查其挂载的条目。选择器和浏览器包运行器在移除条目前取得首次 fiber 释放的结果，并等待该结果后才报告拆卸完成。预设挂载等待其子树，并报告导入、激活和缺少服务的失败。[应用启动](../../../../packages/boot/app-boot/README.zh.md) 负责精确 patch 文件监视、激活检查和部分上下文清理。Web 启动在打印 URL 或打开浏览器前检查激活状态。这些适配维持应用反向补丁后已有的消费者行为。 -小范围的更新结果扩展通过 Fiber 和 Entry 更新传递异步重启失败。游离的导入完成观察器处理 fiber 的两种结果；fiber 仍保留失败信息供显式检查。Include 的持久写入在删除子条目前后均排空，防止后续拆卸写入掩盖更早的终止性写入失败。缺失文件的初始化等待写入完成，并重新读取文件后才挂载初始条目。 +Fiber、Entry 和 isolate 保持上游的更新返回行为。App boot 通过现有的 `internal/update` waterfall 观察被丢弃的重启 promise，并在检查 patch 重载前等待 fiber。游离的导入完成观察器处理 fiber 的两种结果；fiber 仍保留失败信息供显式检查。Include 的持久写入在删除子条目前后均排空，防止后续拆卸写入掩盖更早的终止性写入失败。 + +保留两项 #932 专属 vendor 改动：Include 中等待初始文件创建并强制重新读取，以及 Schemastery 条件导出。恢复 #932 前的防抖写入和读取顺序，会在缺失文件初始化测试中复现 `ENOENT`。保留这两行可以维持已有 `initial` 选项，而无需在应用侧增加文件写入器或另一份 YAML 序列化逻辑。移除 Schemastery exports 后，Web preset 测试在启动时复现 `ERR_REQUIRE_ESM_RACE_CONDITION`：并发 ESM 导入使 Node 回退到 CJS 入口。HMR 注入装饰器、条件 patch 克隆及更新返回值采用 #932 前的行为。显式 `workspace:^` 依赖使 #932 的 workspace 链接开关与专用锁文件检查不再必要。 ## 考虑过的替代方案 diff --git a/docs/cordis-api/fiber.i18n.yaml b/docs/cordis-api/fiber.i18n.yaml index 537be01dbc..98b54791f3 100644 --- a/docs/cordis-api/fiber.i18n.yaml +++ b/docs/cordis-api/fiber.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/cordis-api/fiber.md -fiber.md: 182b77390b29b8a90504437d0ccc2dfeba23921a -fiber.zh.md: 9ed3e52618586dc3815b9d913439d11a227fb64b +fiber.md: 3044301effde267bf580c3a5138481b10513f755 +fiber.zh.md: bee2f523f1fa2a2add2afc3a3fc322903f1ef6f0 diff --git a/docs/cordis-api/fiber.md b/docs/cordis-api/fiber.md index 182b77390b..3044301eff 100644 --- a/docs/cordis-api/fiber.md +++ b/docs/cordis-api/fiber.md @@ -256,8 +256,8 @@ Dispose and immediately reload this plugin with its current config. * * @param config — the new raw config; validated before anything restarts. * @param noSave — hint for persistence hooks not to write the change back. - * @returns the update waterfall result; the default restart returns a promise. - * @throws when validation, an update listener, or the restarted plugin fails. + * @returns nothing; the restart runs behind the `internal/update` waterfall. + * @throws {ValidationError} when the new config fails validation. */ update(config: any, noSave = false) ``` @@ -269,7 +269,7 @@ Runs the `internal/update` waterfall first, so update hooks (and HMR) can veto o - `config` — the new raw config; validated before anything restarts. - `noSave` — hint for persistence hooks not to write the change back. -**Returns** the update waterfall result; the default restart returns a promise. +**Returns** nothing; the restart runs behind the `internal/update` waterfall. [Source](../../vendor/cordis/src/fiber.ts#L736) diff --git a/docs/cordis-api/fiber.zh.md b/docs/cordis-api/fiber.zh.md index 9ed3e52618..bee2f523f1 100644 --- a/docs/cordis-api/fiber.zh.md +++ b/docs/cordis-api/fiber.zh.md @@ -258,8 +258,8 @@ dispose 此插件，并立即使用其当前配置重新加载。 * * @param config — the new raw config; validated before anything restarts. * @param noSave — hint for persistence hooks not to write the change back. - * @returns the update waterfall result; the default restart returns a promise. - * @throws when validation, an update listener, or the restarted plugin fails. + * @returns nothing; the restart runs behind the `internal/update` waterfall. + * @throws {ValidationError} when the new config fails validation. */ update(config: any, noSave = false) ``` @@ -271,7 +271,7 @@ update(config: any, noSave = false) - `config`：新的原始配置；在任何内容重新启动前进行校验。 - `noSave`：提示持久化钩子不要写回此变更。 -**返回**更新 waterfall 的结果；默认的重新启动操作返回一个 promise。 +**返回**无返回值；重启由 `internal/update` waterfall 执行。 [源码](../../vendor/cordis/src/fiber.ts#L736) diff --git a/docs/event-producer-consumer.i18n.yaml b/docs/event-producer-consumer.i18n.yaml index 09eecc6d42..477779842a 100644 --- a/docs/event-producer-consumer.i18n.yaml +++ b/docs/event-producer-consumer.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/event-producer-consumer.md -event-producer-consumer.md: 2239c9786f9e18b6a8e9514bfd53da7f87cfb8a4 -event-producer-consumer.zh.md: e43d48e2ee163843752bcda9fe3578839e05252b +event-producer-consumer.md: 90dad01703601b58f7f495905d94cffbf18999b8 +event-producer-consumer.zh.md: f617b910165fec096e4ed4347f89c4323fe6f8e9 diff --git a/docs/event-producer-consumer.md b/docs/event-producer-consumer.md index 2239c9786f..90dad01703 100644 --- a/docs/event-producer-consumer.md +++ b/docs/event-producer-consumer.md @@ -84,5 +84,6 @@ This matrix shows which packages dispatch each harness-owned event and which pac | `internal/plugin` | - | `inspector`, `loader`, [`lsp-stdio`](../packages/lsp/lsp-stdio), `modules` | | `internal/service` | - | [`agent-presets`](../packages/preset/agent-presets), `gateway` | | `internal/status` | - | [`agent`](../packages/core/agent), `inspector` | +| `internal/update` | - | [`app-boot`](../packages/boot/app-boot) | Maintenance mode: generated: Cordis event declarations and producer/listener edges are resolved from the repository TypeScript Program. diff --git a/docs/event-producer-consumer.zh.md b/docs/event-producer-consumer.zh.md index e43d48e2ee..f617b91016 100644 --- a/docs/event-producer-consumer.zh.md +++ b/docs/event-producer-consumer.zh.md @@ -86,5 +86,6 @@ | `internal/plugin` | - | `inspector`, `loader`, [`lsp-stdio`](../packages/lsp/lsp-stdio), `modules` | | `internal/service` | - | [`agent-presets`](../packages/preset/agent-presets), `gateway` | | `internal/status` | - | [`agent`](../packages/core/agent), `inspector` | +| `internal/update` | - | [`app-boot`](../packages/boot/app-boot) | Maintenance mode: generated: Cordis event declarations and producer/listener edges are resolved from the repository TypeScript Program. diff --git a/docs/rescope.i18n.yaml b/docs/rescope.i18n.yaml index 620421da84..ed6948f492 100644 --- a/docs/rescope.i18n.yaml +++ b/docs/rescope.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/rescope.md -rescope.md: 676dee2507a974beb20a4c0e8059b6a74aa9c0c9 -rescope.zh.md: 1683111354b1ff7c8771a87b7b03bcbeb0ac0761 +rescope.md: 80a0b1dc67c8b3585f2c18cad3afff9dde5859f9 +rescope.zh.md: aaf65024520308c5d0013d85a128a42839a84573 diff --git a/docs/rescope.md b/docs/rescope.md index 676dee2507..80a0b1dc67 100644 --- a/docs/rescope.md +++ b/docs/rescope.md @@ -23,7 +23,7 @@ Subpath exports keep their path: `@cordisjs/plugin-loader/repository` becomes `@ ## What the rename does not touch - **Directory names and upstream source versions.** `vendor/hmr/` stays `vendor/hmr/`, and the table records the upstream version of the pinned source snapshot, so the manifest reads as an upstream snapshot; the vendored `package.json`'s own `version` field is the harness's released manifest version, which `pnpm run release:vendor` bumps and a re-sync restores to the upstream version. -- **Dependency ranges.** A dependency entry changes its key, never its range: `"cordis": "^4.0.0-rc.7"` becomes `"@deepseek-ai/cordis": "^4.0.0-rc.7"`. `linkWorkspacePackages` resolves those preserved ranges to the pinned workspaces. +- **Dependency ranges.** Renaming changes dependency keys without changing ranges. Workspace manifests use `workspace:^` for repository-owned runtime dependencies, so pnpm resolves the pinned local packages and substitutes release ranges when publishing. - **The Loader's `cordis:` builtin prefix.** `cordis:include` and `cordis:group` are a protocol prefix, not a package name. - **The `cordis.yml` configuration family**, including `*.cordis.yml`, `*.cordis.snapshot.yml`, and `cordis.patch.yml`. - **Harness packages whose own names contain the word**, such as `@deepseek-ai/dsh-tool-cordis`. diff --git a/docs/rescope.zh.md b/docs/rescope.zh.md index 1683111354..aaf6502452 100644 --- a/docs/rescope.zh.md +++ b/docs/rescope.zh.md @@ -23,7 +23,7 @@ Cordis 框架及其基础库以源码形式 vendored 在 [`vendor/`](../vendor/R ## 改名不碰什么 - **目录名与上游源码版本。** `vendor/hmr/` 仍是 `vendor/hmr/`，清单表记录的是所钉住源码快照的上游版本，因此清单读作一份上游快照；而每个 vendored 包 `package.json` 自身的 `version` 字段是 harness 发布的清单版本，`pnpm run release:vendor` 会提升它，重新 sync 时会恢复成上游版本。 -- **依赖 range。** 依赖条目只换键、不换范围：`"cordis": "^4.0.0-rc.7"` 变成 `"@deepseek-ai/cordis": "^4.0.0-rc.7"`；`linkWorkspacePackages` 靠这些保留下来的范围把它们解析到固定的 workspace。 +- **依赖 range。** 改名只修改依赖键，不改变范围。Workspace 清单对仓库内的运行时依赖使用 `workspace:^`，因此 pnpm 会解析到固定的本地包，并在发布时替换为版本范围。 - **Loader 的 `cordis:` 内建前缀。** `cordis:include`、`cordis:group` 是协议前缀，不是包名。 - **`cordis.yml` 配置文件家族**，包括 `*.cordis.yml`、`*.cordis.snapshot.yml`、`cordis.patch.yml`。 - **名字里带这个词的 harness 包**，例如 `@deepseek-ai/dsh-tool-cordis`。 diff --git a/package.json b/package.json index a09fa3f997..d5a5b1c41b 100644 --- a/package.json +++ b/package.json @@ -133,7 +133,6 @@ "verify-client-packages": "tsx scripts/verify-client-packages.ts", "verify-client-ui-i18n": "tsx scripts/verify-client-ui-i18n.ts", "verify-no-bare-dispatcher": "tsx scripts/verify-no-bare-dispatcher.ts", - "verify-vendored-links": "tsx scripts/verify-vendored-links.ts", "verify-cordis-config": "tsx scripts/verify-cordis-config.ts", "rescope-vendor": "tsx scripts/rescope-vendor.ts", "rescope-vendor:check": "tsx scripts/rescope-vendor.ts --check", diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index ce5f0f1cee..dec2c2a582 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: bbc3e3147a455149d3e263f0bf4f1091d93f46cc -README.zh.md: 53d8b58df6da74581539585bce81d885f7708cf8 +README.md: 8ead27c1a6a3544f34b391facfc3888f50ba479f +README.zh.md: c4b933249eb9c769afb4e49ec525e6174a1903b5 diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index bbc3e3147a..8ead27c1a6 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -88,6 +88,7 @@ This section explains how the outcomes above are realized and points at the code - **Two Loader builtins.** `mountRootInclude` registers `cordis:include` and `cordis:group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, and an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name. Both load through the ambient module pipeline rather than the included tree's own specifier resolution. - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links. - **One rejection checkpoint.** `assertEntriesActivated` keeps the exact reasons it folds into the boot diagnostic visible through the next process rejection checkpoint, so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. +- **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success. - **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`, and appends the deepest plugin error's stack so the startup diagnostic preserves the original activation error instead of only the wrap chain. ### Helper behavior diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 53d8b58df6..c4b933249e 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -88,6 +88,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head - **两个 Loader builtin。** `mountRootInclude` 把 `cordis:include` 与 `cordis:group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，而位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`。两者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。 - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部 bundle 若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。 - **单一 rejection 检查点。** `assertEntriesActivated` 把折入启动诊断的确切原因保持到下一个进程级 rejection 检查点可见，使 `installFailLoud` 能合并 Loader 的重复通知，而所有无关的未处理 rejection 仍然致命。 +- **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。 - **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`（此后的一切失败），并追加最深层插件错误的堆栈，使启动诊断保留原始激活错误，而不只是包装链。 ### Helper 行为 diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 8cfc8f5678..05da302eb0 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -270,6 +270,7 @@ export async function watchUserPatches( }, }) await ctx.loader.await() + await Promise.allSettled([...ctx.loader.entries()].map(entry => Promise.resolve(entry.fiber?.await()))) await assertEntriesActivated(ctx, binName) }) try { @@ -799,6 +800,11 @@ export async function boot( try { ctx.baseUrl = pathToFileURL(dirname(absoluteConfigPath)).href + '/' ctx.provide('dshHomePath', dshHomePath) + // Fiber.update() discards the restart promise. Observe it before the + // waterfall returns; activation audits still report the failed fiber. + ctx.on('internal/update', (_config, _noSave, next: () => unknown) => { + void Promise.resolve(next()).catch((error: unknown) => { ctx.logger.error(error) }) + }, { global: true, prepend: true }) await ctx.plugin(Loader) await prepare?.(ctx) stage = 'plugin tree failed to load' diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 61fda39717..537d4efad5 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -786,6 +786,20 @@ describe('boot', () => { expect(ctx.get('loader')).toBeUndefined() }) + it('returns when disposal completes before root entry creation returns', async () => { + const dir = tmp() + writeFileSync(join(dir, 'cordis.yml'), '[]\n') + const ctx = await boot(NAME, join(dir, 'cordis.yml'), [], (ctx) => { + const create = ctx.loader.create.bind(ctx.loader) + vi.spyOn(ctx.loader, 'create').mockImplementation(async (...args) => { + const id = await create(...args) + await ctx.fiber.dispose() + return id + }) + }) + expect(ctx.get('loader')).toBeUndefined() + }) + it('rejects (never exits 0 half-empty) when a config names a plugin that cannot be imported', async () => { const dir = tmp() writeFileSync(join(dir, 'cordis.yml'), '- id: ghost\n name: ./missing.mjs\n') @@ -841,6 +855,12 @@ describe('boot', () => { ) }) + it('reports a non-Error rejection from host preparation', async () => { + await expect(boot(NAME, join(tmp(), 'cordis.yml'), [], () => { + throw 'host refused' + })).rejects.toThrow(`${NAME}: host preparation failed: host refused`) + }) + it('expands a stackless aggregate at the deepest activation cause', async () => { const dir = tmp() const aggregate = new AggregateError([ diff --git a/packages/boot/app-boot/tests/user-patches.spec.ts b/packages/boot/app-boot/tests/user-patches.spec.ts index 17c2f6bb84..efb89afb86 100644 --- a/packages/boot/app-boot/tests/user-patches.spec.ts +++ b/packages/boot/app-boot/tests/user-patches.spec.ts @@ -503,9 +503,14 @@ describe('boot with user patches', () => { await ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 }) const previousFactory = configWatch.create onTestFinished(() => { configWatch.create = previousFactory }) + const release = Promise.withResolvers() + ctx.effect(() => () => release.promise) + let disposal: Promise | undefined + onTestFinished(async () => { release.resolve(undefined); await disposal }) configWatch.create = (options) => { const watcher = new FSWatcher(options) - void ctx.fiber.dispose().then(() => { watcher.emit('ready') }) + disposal = ctx.fiber.dispose() + queueMicrotask(() => { watcher.emit('ready') }) return watcher } const dispose = await watchUserPatches(ctx, { binName: NAME, filename: join(tmp(), PROFILE_PATCH_FILENAME) }) diff --git a/packages/bundle/web-app/README.i18n.yaml b/packages/bundle/web-app/README.i18n.yaml index e04aaa88d7..d4b3f1a257 100644 --- a/packages/bundle/web-app/README.i18n.yaml +++ b/packages/bundle/web-app/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/bundle/web-app/README.md -README.md: aea694942173a856861d00a69f15b451cc930976 -README.zh.md: f1b402c985ec2c21afdd67f8cb5477196aafeb44 +README.md: 94560cf45affe0ee4c9570054c40c00e9185901b +README.zh.md: 89195c9d8be67f73fe90e6d16af271b7a7ca35bd diff --git a/packages/bundle/web-app/README.md b/packages/bundle/web-app/README.md index aea6949421..94560cf45a 100644 --- a/packages/bundle/web-app/README.md +++ b/packages/bundle/web-app/README.md @@ -77,7 +77,7 @@ A patch replaces the targeted row's whole `config`, so each web row restates eve ### Readiness -The URL line and browser handoff are readiness signals: supervisors RPC as soon as they observe the line, and a browser requests the page as soon as it opens, so both run only after the Loader tree settles and Connection authentication is available — or immediately in a hand-built tree without a Loader. A tree disposed mid-boot announces nothing. +The URL line and browser handoff are readiness signals: supervisors RPC as soon as they observe the line, and a browser requests the page as soon as it opens, so both run only after the Loader tree settles, every enabled entry passes the activation audit, and Connection authentication is available — or immediately in a hand-built tree without a Loader. A failed tree or a tree disposed mid-boot announces nothing. ### LAN trust sampling diff --git a/packages/bundle/web-app/README.zh.md b/packages/bundle/web-app/README.zh.md index f1b402c985..89195c9d8b 100644 --- a/packages/bundle/web-app/README.zh.md +++ b/packages/bundle/web-app/README.zh.md @@ -77,7 +77,7 @@ patch 会替换目标行的整个 `config`，因此每个 Web 行都重述自己 ### 就绪宣告 -URL 行与浏览器交接都是就绪信号：监督方一观察到该行就发起 RPC，浏览器一打开就请求页面，因此两者只在 Loader 配置树结算且 Connection 认证可用后运行——在没有 Loader 的手工构建树中则立即运行。启动中途被释放的树不会宣告任何内容。 +URL 行与浏览器交接都是就绪信号：监督方一观察到该行就发起 RPC，浏览器一打开就请求页面，因此两者只在 Loader 配置树结算、每个启用的条目通过激活检查且 Connection 认证可用后运行——在没有 Loader 的手工构建树中则立即运行。失败的树或启动中途被释放的树不会宣告任何内容。 ### LAN 信任采样 diff --git a/packages/bundle/web-app/src/index.ts b/packages/bundle/web-app/src/index.ts index 63edf46529..b5debdc26f 100644 --- a/packages/bundle/web-app/src/index.ts +++ b/packages/bundle/web-app/src/index.ts @@ -18,7 +18,7 @@ import { networkInterfaces } from 'node:os' import { fileURLToPath } from 'node:url' import type { Context } from '@deepseek-ai/cordis' import z from '@deepseek-ai/schemastery' -import { addHarnessSourceSection } from '@deepseek-ai/dsh-app-boot' +import { addHarnessSourceSection, assertEntriesActivated } from '@deepseek-ai/dsh-app-boot' import type {} from '@deepseek-ai/dsh-client-connection' import * as FrontendStatic from '@deepseek-ai/dsh-host-frontend-static' import { launchedThroughSsh, launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment' @@ -284,15 +284,17 @@ export function apply(ctx: Context, config: Config): void { const settled = connectionCtx.get('loader')?.await() if (settled === undefined) announceReady() else { - void settled.then(() => { + void settled.then(async () => { + await assertEntriesActivated(connectionCtx, 'dsh web') // The tree can be disposed while the boot was in flight (early // SIGTERM); a URL line or browser tab for a dead server would only // mislead, and reading torn-down services would turn a clean shutdown // into a crash. if (connectionCtx.get('webServer') !== undefined && connectionCtx.get('connection') !== undefined) announceReady() - // Loader reports a failed boot; this row only stays quiet. - }, () => {}) + }).catch(() => { + // Boot owns the failure diagnostic; readiness remains unpublished. + }) } }) } diff --git a/packages/bundle/web-app/tests/web-app.spec.ts b/packages/bundle/web-app/tests/web-app.spec.ts index 3e17147419..e963648038 100644 --- a/packages/bundle/web-app/tests/web-app.spec.ts +++ b/packages/bundle/web-app/tests/web-app.spec.ts @@ -11,8 +11,9 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { join } from 'node:path' import { PassThrough } from 'node:stream' -import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' +import { afterEach, beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest' import { Context } from '@deepseek-ai/cordis' +import Loader from '@deepseek-ai/cordis-plugin-loader' import { createLaunchEnvironmentSnapshot, DSH_LAUNCH_ENVIRONMENT_KEY } from '@deepseek-ai/dsh-launch-environment' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import type { WebServer } from '@deepseek-ai/dsh-host-webserver' @@ -100,7 +101,7 @@ function provideConnection(ctx: Context): void { /** A fake Loader whose settlement the test controls (the URL line waits on it). */ function provideLoader(ctx: Context, settle: () => Promise = async () => {}): void { - ctx.provide('loader', { await: settle } as never) + ctx.provide('loader', { await: settle, entries: () => [] } as never) } interface BashContribution { @@ -313,6 +314,27 @@ describe('web-app runtime glue', () => { await torn.fiber.dispose() }) + it('keeps readiness private when Loader settles with a failed sibling', async () => { + stageDist() + const ctx = new Context() + onTestFinished(() => ctx.fiber.dispose()) + ctx.baseUrl = 'file:///' + ctx.provide('webServer', fakeHttpServer().server) + provideConnection(ctx) + await ctx.plugin(Loader) + ctx.loader.builtins.failure = () => { throw new Error('sibling rejected') } + const id = await ctx.loader.create({ name: 'cordis:failure' }) + await ctx.loader.await() + await expect(ctx.loader.resolve(id).fiber?.await()).rejects.toThrow('sibling rejected') + const log = vi.spyOn(console, 'log').mockImplementation(() => {}) + const openBrowser = vi.fn(async () => {}) + internals.openBrowser = openBrowser + apply(ctx, new Config({ openBrowser: true, printUrl: true, surfaceContext: false, trustedHosts: [] })) + await new Promise(resolve => setImmediate(resolve)) + expect(log).not.toHaveBeenCalled() + expect(openBrowser).not.toHaveBeenCalled() + }) + it('fails loud when the prompt section resolves against a portless webserver', async () => { stageDist() const ctx = new Context() diff --git a/packages/preset/agent-presets/src/mount.ts b/packages/preset/agent-presets/src/mount.ts index c13530f2c9..e759230505 100644 --- a/packages/preset/agent-presets/src/mount.ts +++ b/packages/preset/agent-presets/src/mount.ts @@ -313,7 +313,7 @@ export async function inactiveRows(tree: EntryTree): Promise { try { await fiber.await() } catch (error) { - const detail = error instanceof Error ? error.message : String(error) + const detail = mountDetail(error) lines.push(`${entry.options.id} (${entry.options.name}): ${detail}`) continue } @@ -328,14 +328,8 @@ export async function inactiveRows(tree: EntryTree): Promise { /** * The causes of `error` whose detail its own message does not already carry. * - * `AggregateError` names none of its causes in its own message, so its - * `errors` are the branches. The Loader's per-row wrapper takes the opposite - * approach: it appends `cause.message` to the message it builds and keeps the - * cause only as `error.cause`, so following a plain chain would print every - * line twice. That leaves exactly one lossy shape — a wrapped row whose cause - * is an `AggregateError`. Its message ends with the aggregate's own line and - * drops the `errors` behind it, which is how a failed group reports as - * "loader entries failed to apply" and names none of the rows that failed. + * Aggregate errors carry separate member messages. A wrapper can preserve the + * aggregate as its cause without including those messages in its own text. * @param error - the failure to read branches from. * @returns the branches to render beneath `error.message`, possibly empty. */ @@ -347,19 +341,12 @@ function detailBranches(error: Error): readonly unknown[] { /** * The reportable text of a mount failure. * - * The loader reports several failed rows as one `AggregateError`, whose own - * message names none of them; without flattening, a composition that fails on - * two rows says only "loader entries failed to apply" and the operator has - * nothing to act on. Nested groups indent under the row that owns them, so a - * composition failing inside a group still names the rows rather than the - * group alone. + * A plugin may reject with an aggregate or wrap one as its cause. Include its + * member messages beneath the row diagnostic so each failure is visible. * @param error - the value the mount rejected with. * @returns a single-line-per-cause description. */ function mountDetail(error: unknown): string { - /* v8 ignore next -- every path into the mount's catch throws an Error: the loader - wraps a row's thrown value before it propagates, and this module's own - rejections are Errors. The fallback keeps a hostile value readable. */ if (!(error instanceof Error)) return String(error) const branches = detailBranches(error) if (branches.length === 0) return error.message diff --git a/packages/preset/agent-presets/tests/mount.spec.ts b/packages/preset/agent-presets/tests/mount.spec.ts index 03b9daa7a0..660fdcdecd 100644 --- a/packages/preset/agent-presets/tests/mount.spec.ts +++ b/packages/preset/agent-presets/tests/mount.spec.ts @@ -15,7 +15,7 @@ import AgentRegistry, { assembleContextFor, type Agent } from '@deepseek-ai/dsh- import AgentLoop from '@deepseek-ai/dsh-agent-loop' import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest' import AgentPresets, { - COMPOSITION_FILE, leakedServices, livePresetMounts, mountPreset, serviceForAgent, + COMPOSITION_FILE, inactiveRows, leakedServices, livePresetMounts, mountPreset, serviceForAgent, } from '@deepseek-ai/dsh-agent-presets' import type { Config } from '@deepseek-ai/dsh-agent-presets' import type {} from '@deepseek-ai/dsh-agent-presets/types' @@ -242,6 +242,27 @@ describe('composing a child agent from its parent', () => { }) describe('rejecting a composition that cannot be used', () => { + it('reports import failures and arbitrary plugin rejections after eager settlement', async () => { + ctx.loader.builtins.stringFailure = () => { throw 'string rejection' } + ctx.loader.builtins.aggregateFailure = () => { + throw new AggregateError([ + new Error('first member'), + new Error('wrapped member', { cause: new AggregateError(['nested member'], 'nested aggregate') }), + ], 'aggregate rejection') + } + await ctx.loader.root.update([ + { id: 'missing', name: 'cordis:missingBuiltin' }, + { id: 'disabled', name: 'cordis:missingBuiltin', disabled: true }, + { id: 'string', name: 'cordis:stringFailure' }, + { id: 'aggregate', name: 'cordis:aggregateFailure' }, + ]) + expect(await inactiveRows(ctx.loader)).toEqual([ + 'missing (cordis:missingBuiltin): never started', + 'string (cordis:stringFailure): string rejection', + 'aggregate (cordis:aggregateFailure): aggregate rejection\n- first member\n- wrapped member\n - nested member', + ]) + }) + it('refuses to mount into a context that carries no agent scope', async () => { await expect(ctx.agentPresets.mount(ctx, 'standard')) .rejects.toThrow(/unscoped context/) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 68eff9cd1c..cde062a553 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,10 +14,6 @@ packages: # closure is what the exe bundles and what the Python runtime distributes. - python/sdk-runtime -# Vendored framework packages keep their upstream semver ranges, while local -# builds must resolve those matching names to this workspace's pinned sources. -linkWorkspacePackages: true - overrides: '@deepseek-ai/cosmokit': 'link:vendor/cosmokit' '@deepseek-ai/schemastery': 'link:vendor/schemastery' diff --git a/scripts/rescope-vendor.ts b/scripts/rescope-vendor.ts index 5a73201bf0..ec75d2938b 100644 --- a/scripts/rescope-vendor.ts +++ b/scripts/rescope-vendor.ts @@ -222,15 +222,8 @@ const EXACT_EDITS: readonly ExactEdit[] = [ { id: 'vendor-readme-preamble', file: 'vendor/README.md', - find: 'All vendored packages keep their **original npm names** and are marked `private: true` — they are never published from this repo. `pnpm-workspace.yaml#linkWorkspacePackages` makes matching upstream semver ranges resolve these pinned workspaces, including imports from built `lib/`; disabling it substitutes npm copies behind the same names.', - replace: 'All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`.', - expect: 1, - }, - { - id: 'vendor-readme-schemastery-note', - file: 'vendor/README.md', - find: 'whose lazy `require(\'cosmokit\')` can race', - replace: 'whose lazy `require(\'@deepseek-ai/cosmokit\')` can race', + find: 'All vendored packages keep their **original npm names** (they are resolved through pnpm workspaces) and are marked `private: true` — they are never published from this repo.', + replace: 'All vendored packages use the **`@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`). The manifest table records upstream versions and source commits; each package manifest carries its Harness release version and publication metadata. Repository-owned runtime dependencies use `workspace:^`, so local builds resolve the pinned workspace packages and publication substitutes release ranges.', expect: 1, }, { diff --git a/scripts/run-gates.spec.ts b/scripts/run-gates.spec.ts index a5ad767c32..de9ca46d88 100644 --- a/scripts/run-gates.spec.ts +++ b/scripts/run-gates.spec.ts @@ -213,7 +213,7 @@ describe('gate graph validation', () => { 'rescope-vendor', 'publint', 'constraints', 'package-dependencies', 'application-entrypoints', 'dsh-package-licenses', 'package-invariants', 'built-package-invariants', 'node-next-types', 'optional-dependency-imports', 'client-packages', 'client-ui-i18n', 'no-bare-dispatcher', 'cordis-config', - 'runtime-closure', 'vendored-links', + 'runtime-closure', ]) expect(defaultConcurrency('hygiene', ids.length, 8)).toEqual({ workers: 4, diff --git a/scripts/run-gates.ts b/scripts/run-gates.ts index 3918c87d38..9dac9e6560 100644 --- a/scripts/run-gates.ts +++ b/scripts/run-gates.ts @@ -286,7 +286,6 @@ export function gatesForMode(selected: Mode): Gate[] { ...hygieneLeafGates(), pnpmScript('cordis-config', 'verify-cordis-config', { label: 'Cordis config' }), pnpmScript('runtime-closure', 'verify-runtime-closure', { label: 'runtime closure' }), - pnpmScript('vendored-links', 'verify-vendored-links', { label: 'vendored links' }), ] case 'doc-sync': return docSyncLeafGates() diff --git a/scripts/verify-vendored-links.ts b/scripts/verify-vendored-links.ts deleted file mode 100644 index 93b8390157..0000000000 --- a/scripts/verify-vendored-links.ts +++ /dev/null @@ -1,72 +0,0 @@ -/** - * Verify that pnpm-lock.yaml resolves every vendored package name to its - * workspace `link:` — never a registry copy. `linkWorkspacePackages: true` - * (pnpm-workspace.yaml) makes matching upstream semver ranges resolve to the - * pinned vendored sources; a registry copy of the same name coexisting with - * the vendored one silently forks the framework layer (vendor/README.md). - */ -import { readdir, readFile } from 'node:fs/promises' -import { join, resolve } from 'node:path' -import * as yaml from 'js-yaml' - -const root = resolve(import.meta.dirname, '..') - -async function vendoredNames(): Promise> { - const names = new Set() - for (const entry of await readdir(join(root, 'vendor'), { withFileTypes: true })) { - if (!entry.isDirectory()) continue - let manifest: { name?: string } - try { - manifest = JSON.parse(await readFile(join(root, 'vendor', entry.name, 'package.json'), 'utf8')) as { name?: string } - } catch { - continue // not a package directory (e.g. vendor/README.md siblings) - } - if (manifest.name !== undefined) names.add(manifest.name) - } - return names -} - -interface Lockfile { - importers?: Record> - packages?: Record - snapshots?: Record -} - -const names = await vendoredNames() -if (names.size === 0) throw new Error('verify-vendored-links: no vendored package manifests found under vendor/') -const lockfile = yaml.load(await readFile(join(root, 'pnpm-lock.yaml'), 'utf8')) as Lockfile - -const violations: string[] = [] - -// Importer resolutions: every dependency entry naming a vendored package must -// resolve to a link:, or the build silently uses a registry copy. -for (const [importer, sections] of Object.entries(lockfile.importers ?? {})) { - for (const [section, dependencies] of Object.entries(sections)) { - if (typeof dependencies !== 'object' || dependencies === null) continue - for (const [dependency, entry] of Object.entries(dependencies as Record)) { - if (!names.has(dependency)) continue - const version = entry.version ?? '' - if (!version.startsWith('link:')) { - violations.push(`${importer} ${section}.${dependency} resolves to ${JSON.stringify(version)} (expected link:)`) - } - } - } -} - -// Package/snapshot keys: a registry copy materializes as a `@` -// key; vendored names must never appear there at all. -for (const section of ['packages', 'snapshots'] as const) { - for (const key of Object.keys(lockfile[section] ?? {})) { - const atIndex = key.lastIndexOf('@') - if (atIndex <= 0) continue - const packageName = key.slice(0, atIndex) - if (names.has(packageName)) violations.push(`${section} entry ${key} is a registry copy of a vendored package`) - } -} - -if (violations.length > 0) { - console.error(`verify-vendored-links: ${String(violations.length)} lockfile resolution(s) bypass the vendored workspaces:`) - for (const violation of violations) console.error(` - ${violation}`) - process.exit(1) -} -console.log(`verify-vendored-links: all ${String(names.size)} vendored package names resolve to workspace links.`) diff --git a/vendor/README.md b/vendor/README.md index 305f241929..106585c6fb 100644 --- a/vendor/README.md +++ b/vendor/README.md @@ -2,7 +2,7 @@ This directory contains source-vendored copies of the Cordis framework and its foundation libraries. They are copied into this monorepo instead of being depended on via npm, so that the harness fully owns its framework layer (auditable, patchable, pinned). -All vendored packages are **renamed into the `@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`): every harness package declares `cordis` as a peer dependency, so publishing the harness publishes this framework layer too, and a publication under the upstream names would squat them on the registry. Directory names and upstream version numbers are deliberately unchanged, so the manifest below still reads as an upstream snapshot. `pnpm-workspace.yaml#linkWorkspacePackages` makes those preserved semver ranges resolve these pinned workspaces, including imports from built `lib/`. The `hygiene` gate `verify-vendored-links` asserts every vendored name resolves to a workspace `link:` in `pnpm-lock.yaml` with no registry copy alongside. Schemastery's manifest additionally declares a conditional `exports` map (import → `.mjs`, require → `.cjs`): pnpm links the directory itself, so without `exports` Node's ESM resolver would fall back to `main` and load the CJS entry whose lazy `require('@deepseek-ai/cosmokit')` can race ESM loading of the same linked module under module-hook hosts (vitest). Upstream MIT `LICENSE` files are preserved in each package directory. +All vendored packages use the **`@deepseek-ai` scope** (`cordis` → `@deepseek-ai/cordis`, `@cordisjs/plugin-` → `@deepseek-ai/cordis-plugin-`). The manifest table records upstream versions and source commits; each package manifest carries its Harness release version and publication metadata. Repository-owned runtime dependencies use `workspace:^`, so local builds resolve the pinned workspace packages and publication substitutes release ranges. Upstream MIT `LICENSE` files are preserved in each package directory. This file covers the manifest, the local-modification log, and the procedure for **updating** an existing vendored package. To **add a new** one, see the cookbook guide: [docs/cookbook/adding-a-vendored-package.md](../docs/cookbook/adding-a-vendored-package.md). @@ -31,7 +31,7 @@ Intentionally **not** vendored (verified unused by this set): `reggol`, `@cordis Keep this log exhaustive — every divergence from upstream must be listed. 1. **`hmr/src/index.ts`**: removed the `./locales/en-US.yml` / `./locales/zh-CN.yml` imports, the `.i18n({...})` call on the `Config` schema, and the `src/locales/` directory. Rationale: those imports require a runtime YAML loader hook (`@cordisjs/unyaml`) that we do not vendor; the i18n texts only localize config descriptions. -2. **All `package.json` files**: regenerated — added `private: true`, added precise `files` entries for bundled runtime files and `lib/types/**/*.d.ts` / `.d.ts.map`, preserved `src` in `files` only for packages whose previous file list already shipped it, added a `./src/*` export where missing, pointed declaration metadata at `lib/types`, and removed upstream `devDependencies`/`scripts`/`repository` fields. Dependency and peer-dependency ranges are preserved except that `hmr` declares `esbuild` as a direct dev dependency because its source imports the `BuildFailure` type and pnpm's strict workspace resolution requires the owner package to name that dependency, and `loader` requires `node-addon-require-builtin@^0.1.4` to match the runtime used by published app packages. +2. **All `package.json` files**: regenerated for Harness releases with scoped names, release versions, publication metadata, precise bundled-runtime and `lib/types/**/*.d.ts` / `.d.ts.map` file entries, source exports where applicable, and declaration metadata pointing at `lib/types`. Repository-owned dependencies use the workspace protocol. HMR declares `esbuild` as a direct dev dependency for its imported `BuildFailure` type, and Loader requires `node-addon-require-builtin@^0.1.4` to match published app runtimes. 3. **All `tsconfig.json` files**: regenerated to extend the repo-root `tsconfig.base.json`, emit TypeScript intermediates to `lib/types`, and declare project references. 4. **Vendored TypeScript source internal specifiers**: changed local relative imports/exports from upstream's specifier shape to explicit `.ts` specifiers so TypeScript rewrites emitted JS to `.js` while declarations keep explicit, NodeNext-safe `.ts` specifiers. This includes `loader/src/config/isolate.ts` using `declare module './entry.ts'`. Type-only dependencies use `import type` or inline `type` modifiers so ESM output does not retain erased interfaces. 5. **`schemastery/tsdown.config.ts` and `logger-console/tsdown.config.ts`**: ours, not upstream files — per-package build-shape overrides (dual ESM+CJS output; separate node/browser entries) for the repo-root tsdown build. They read the JS emitted under `lib/types` and then write the publish runtime entries under `lib/`. Like the regenerated tsconfigs, they are not part of the upstream sync surface. @@ -39,9 +39,9 @@ Keep this log exhaustive — every divergence from upstream must be listed. 7. **Cordis and Loader JSDoc enrichment**: added `@param`/`@returns` tags and contract documentation (disposal semantics, waterfall veto, bail conditions, error cases) across the public plugin-author surface — `Context` (class, statics, and the `Context` interface properties incl. `root`), module re-exports, shared utility helpers, `EventsService`, `Fiber`, `RegistryService`, `ReflectService`, `Service`, `LoggerService` and their `declare module './context.ts'` overloads. Loader documentation covers `loader/src/{index,internal,config/entry,config/group,config/isolate,config/tree,config/utils}.ts`, including entry ownership, tree mutation methods, and the `!!js` discriminator. Comment-only; no code changes. Motivation: the website API-reference generator renders these docs and hard-errors on undocumented members. Retire this entry when the enrichment is upstreamed to the fork. 8. **`include/src/index.ts` resilient file refresh and patch reapplication**: [#514](https://github.com/deepseek-harness/deepseek-harness/pull/514) validates a top-level entry array before caching parsed content, logs refresh failures, reapplies patches after file or Include-config edits, updates the Include config when it vetoes a restart, and uses `initial` only after `ENOENT`. These parse protections retain the running tree after an invalid file; plugin activation failures can leave a partially applied tree. Loader entry/group/tree mutations follow the pinned eager, non-transactional implementation and do not restore previous plugins or options. Covered by `packages/boot/app-boot/tests/{config-reload,user-patches}.spec.ts`. 9. **`hmr/src/index.ts` module-watcher readiness and native paths**: realpath the existing watch base, classify framework modules and attach listeners before reporting readiness, and compare config paths using both canonical and configured spellings. This preserves Node module-cache identity across Windows short-name paths and filesystem aliases. The main watcher uses `ignoreInitial: true` so startup reads do not trigger another refresh; exact profile patch watching is owned by `packages/boot/app-boot/src/watch-config.ts`. Covered by `packages/boot/app-boot/tests/watch-config.spec.ts`. -10. **Vendored Node-compatible TypeScript**: marked erased imports explicitly across `cordis`, `loader`, `include`, `hmr`, and `schemastery` so Node's native TypeScript transform does not request types as runtime exports. HMR declares the same Loader and Timer injections with `static inject` instead of decorators. Schemastery's source uses an ESM default export and its package declares `type: module`; its built ESM/CJS entries retain explicit `.mjs`/`.cjs` extensions. -11. **`include/src/index.ts` patch-semantics export**: extracted the private `applyPatches` body into the exported pure function `applyEntryPatches(data, patches, warn)` (the method delegates to it) and exported the `!!js` YAML dialect as `entryListSchema`, so `dsh --dump-config` composes and prints exactly what the include would mount without booting a tree. The entry list is deep-cloned even without patches so Loader mutations cannot alter the cached parse. Public patch and Include fields carry JSDoc for config tooling. Behavior-preserving for mounting; the extraction exists because config tooling must never reimplement (and drift from) the patch algorithm. `applyEntryPatches` also indexes each `insert`ed entry as it is added, so a later patch in the same list can configure or disable a row an earlier patch inserted; upstream built the id index once before the patch loop, leaving inserted rows silently unpatchable. That matters because `dsh` composes an empty profile root with each bundle's patch layer, the profile's and the home-level `cordis.patch.yml`, and any `--patch` overlays as sibling patch lists at one include level — patches never cross an include boundary, so surface-only rows would otherwise be unreachable from user config. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts`. -12. **`cordis/src/{events,fiber}.ts` and `loader/src/{index,config/entry,config/isolate}.ts` update completion**: `Fiber.update()` returns its update-waterfall result. Entry config updates forward and await that result, while the isolate listener forwards it after its synchronous context changes. This prevents asynchronous restart failures from escaping their callers without adding rollback. The detached `Entry.init()` completion observer handles both outcomes; the fiber retains its activation error for explicit audits. Covered by `packages/boot/app-boot/tests/user-patches.spec.ts` and `packages/host/webserver/tests/webserver.spec.ts`. +10. **Vendored Node-compatible TypeScript**: marked erased imports explicitly across `cordis`, `loader`, `include`, `hmr`, and `schemastery` so Node's native TypeScript transform does not request types as runtime exports. Schemastery's source uses an ESM default export and its package declares `type: module`. Conditional exports select `.mjs` for import and `.cjs` for require; without them, concurrent imports under module-hook hosts reach the CJS entry and can race its require of ESM Cosmokit (`ERR_REQUIRE_ESM_RACE_CONDITION`). +11. **`include/src/index.ts` patch-semantics export**: extracted the private `applyPatches` body into the exported pure function `applyEntryPatches(data, patches, warn)` (the method delegates to it) and exported the `!!js` YAML dialect as `entryListSchema`, so `dsh --dump-config` composes and prints exactly what the include would mount without booting a tree. The entry list is deep-cloned when patches are present; without patches, the returned array retains the entry objects. Public patch and Include fields carry JSDoc for config tooling. Behavior-preserving for mounting; the extraction exists because config tooling must never reimplement (and drift from) the patch algorithm. `applyEntryPatches` also indexes each `insert`ed entry as it is added, so a later patch in the same list can configure or disable a row an earlier patch inserted; upstream built the id index once before the patch loop, leaving inserted rows silently unpatchable. That matters because `dsh` composes an empty profile root with each bundle's patch layer, the profile's and the home-level `cordis.patch.yml`, and any `--patch` overlays as sibling patch lists at one include level — patches never cross an include boundary, so surface-only rows would otherwise be unreachable from user config. Covered by `packages/boot/app-boot/tests/config-reload.spec.ts`. +12. **`loader/src/config/entry.ts` activation observer**: the detached `Entry.init()` completion observer handles both outcomes; the fiber retains its activation error for explicit consumer audits. Covered by `packages/boot/app-boot/tests/user-patches.spec.ts`. 13. **`include/src/index.ts` `writeTask` type**: widened the optional `writeTask?: NodeJS.Timeout` property to `NodeJS.Timeout | undefined` — the debounced writer assigns `undefined` on flush, which `exactOptionalPropertyTypes` rejects on a plain optional. Type-only; no behavior change. 14. **`include/src/index.ts` durable debounced writes**: serialized and tracked config-file writes, retried transient `EACCES`/`EBUSY`/`EPERM` rename failures with a bounded backoff, observed asynchronous timer rejections, and drained writes before and after child removal during Include teardown. The first drain preserves an existing terminal write failure even if child removal schedules a later write. Missing-file initialization awaits the write and forces a fresh parse before mounting the initial entries. Windows can briefly retain a destination handle after a Loader child disposes; the upstream fire-and-forget rename escaped as an unhandled rejection and could lose the persisted `disabled` state. A terminal failure is logged by the asynchronous writer and remains on the queue so `Include.stop()` rethrows it instead of silently declaring persistence complete; Cordis's ordinary fiber teardown retains its separate error-containment contract. Covered by `packages/host/directory-picker-auto/tests/loader-composition.spec.ts` with injected transient and terminal rename failures. 15. **Lazy Loader config resolution across `cordis/src/{events,fiber}.ts`, `loader/src/{index,config/entry}.ts`, `include/src/index.ts`, and `hmr/src/index.ts`**: ports [cordiverse/cordis#41](https://github.com/cordiverse/cordis/pull/41), retaining raw fiber config and resolving it through `internal/config` only after declared injections are active. Provider replacement re-resolves the raw expression, pending updates retain it, and HMR transfers it. Resolution applies only to the entry root, so child plugins mounted by a row keep caller-owned config identity. Include declares the `EntryGroup.key` tree-carrier marker (as Group does): its config is entry and patch lists, so interpolation keeps it literal and a `!!js` expression inside a nested row's config resolves lazily in that row's own fiber (Include's own `path` therefore stays literal too). Deferred failures retain the owning row diagnostic, and tree teardown does not persist failure-driven self-disposal. Covered by `packages/boot/app-boot/tests/{app-boot,user-patches}.spec.ts`, `packages/boot/cmdline/tests/cmdline.spec.ts`, `apps/cli/tests/web-agent-presets.e2e.ts`, and the built custom-profile cases in `apps/cli/tests/built-bin.e2e.ts`. diff --git a/vendor/cordis/src/events.ts b/vendor/cordis/src/events.ts index e9bd85e3e1..c7bf42632e 100644 --- a/vendor/cordis/src/events.ts +++ b/vendor/cordis/src/events.ts @@ -340,7 +340,7 @@ export interface Events { /** Interception hook for a service binding (no core producer). */ 'internal/service'(this: Context, name: string, value: any): void /** Waterfall: a fiber config update is being applied; skip `next()` to veto. */ - 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void | Promise): void | Promise + 'internal/update'(this: Fiber, config: any, noSave: boolean, next: () => void): void /** Waterfall: a service is being read through the context proxy. */ 'internal/get'(ctx: Context, name: string, error: Error, next: () => any): any /** Waterfall: a service is being written through the context proxy. */ diff --git a/vendor/cordis/src/fiber.ts b/vendor/cordis/src/fiber.ts index 38a3197e29..6bb1caa7a5 100644 --- a/vendor/cordis/src/fiber.ts +++ b/vendor/cordis/src/fiber.ts @@ -730,8 +730,8 @@ export class Fiber { * * @param config — the new raw config; validated before anything restarts. * @param noSave — hint for persistence hooks not to write the change back. - * @returns the update waterfall result; the default restart returns a promise. - * @throws when validation, an update listener, or the restarted plugin fails. + * @returns nothing; the restart runs behind the `internal/update` waterfall. + * @throws {ValidationError} when the new config fails validation. */ update(config: any, noSave = false) { this.assertActive() @@ -745,7 +745,7 @@ export class Fiber { return } config = this._resolveConfig(config) - return this.context.waterfall(this, 'internal/update', config, noSave, () => { + this.context.waterfall(this, 'internal/update', config, noSave, () => { this.config = config this._error = undefined return this.restart() diff --git a/vendor/hmr/README.md b/vendor/hmr/README.md index eec6ff940f..c9a9cca667 100644 --- a/vendor/hmr/README.md +++ b/vendor/hmr/README.md @@ -8,10 +8,8 @@ application files. Changes to framework-level dependencies fall back to `loader.exit()`, letting the host process restart. Module watches canonicalize their existing base directory before opening -Chokidar. Exact config watches likewise canonicalize the deepest existing -ancestor, then restore any missing suffix. Callbacks and diagnostics retain the -requested absolute filename, while the native backend receives one filesystem -spelling even when Windows supplied an 8.3 alias. +Chokidar, so the native backend receives one filesystem spelling even when +Windows supplied an 8.3 alias. ## Requirements diff --git a/vendor/hmr/src/index.ts b/vendor/hmr/src/index.ts index d5d31305ae..e7aed96164 100644 --- a/vendor/hmr/src/index.ts +++ b/vendor/hmr/src/index.ts @@ -1,4 +1,4 @@ -import { Context, Service, type Plugin } from '@deepseek-ai/cordis' +import { Context, Inject, Service, type Plugin } from '@deepseek-ai/cordis' import type { Dict } from '@deepseek-ai/cosmokit' import { ModuleLoader, type ModuleJob, type ResolveResult } from '@deepseek-ai/cordis-plugin-loader' import type { Include } from '@deepseek-ai/cordis-plugin-include' @@ -45,9 +45,9 @@ interface Reload { runtime?: Plugin.Runtime } +@Inject('loader') +@Inject('timer') class Hmr extends Service { - static inject = ['loader', 'timer'] - public baseDir: string private internal: ModuleLoader diff --git a/vendor/include/src/index.ts b/vendor/include/src/index.ts index c3bfdc60ee..ee4dd53fb8 100644 --- a/vendor/include/src/index.ts +++ b/vendor/include/src/index.ts @@ -44,8 +44,7 @@ function retryableWriteError(error: unknown): boolean { * Apply patch lists to an entry list — THE patch semantics of this include, * shared by mounting (`applyPatches`) and offline config tooling * (`dsh --dump-config`) so a dump can never drift from what boots. The input - * is never mutated and the result is always detached from it (even with no - * patches): patching or mounting shared entry objects would bake earlier + * is never mutated: patching shared entry objects would bake earlier patch * values into the cached parse, so repeated application (config hot-reloads) * could never revert a removed or changed patch. Inserted entries are indexed * as they are added, so a later patch in the same list can target a row an @@ -60,8 +59,8 @@ export function applyEntryPatches( patches: PatchOptions[] | undefined, warn: (message: string, ...args: any[]) => void, ): EntryOptions[] { + if (!patches?.length) return [...data] data = structuredClone(data) - if (!patches?.length) return data const entryMap = new Map() const buildMap = (entries: EntryOptions[]) => { diff --git a/vendor/loader/src/config/entry.ts b/vendor/loader/src/config/entry.ts index 9e1258dd6b..11cffa24d7 100644 --- a/vendor/loader/src/config/entry.ts +++ b/vendor/loader/src/config/entry.ts @@ -96,11 +96,11 @@ export class Entry { } private _patchContext(diff: string[]) { - return this.context.waterfall('loader/patch-context', this, () => { + this.context.waterfall('loader/patch-context', this, () => { Object.setPrototypeOf(this.ctx, this.parent.ctx) if (this.fiber?.uid && (diff.includes('config') || this.options.group)) { - return this.fiber.update(this.options.config, true) + this.fiber.update(this.options.config, true) } }) } @@ -142,7 +142,7 @@ export class Entry { .filter(key => !deepEqual(this.options[key], legacy[key])) if (!diff.length && !force) return this.context.emit('loader/partial-dispose', this, legacy, true) - await this._patchContext(diff) + this._patchContext(diff) } else { await this.init() } diff --git a/vendor/loader/src/config/isolate.ts b/vendor/loader/src/config/isolate.ts index 102c7c41c9..e2fd539157 100644 --- a/vendor/loader/src/config/isolate.ts +++ b/vendor/loader/src/config/isolate.ts @@ -126,7 +126,7 @@ export default function isolate(ctx: Context) { swap(entry.ctx[Context.intercept], entry.options.intercept) // step 4: reload fiber - const result = next() + next() // step 5: replace service impl for (const [symbol1, symbol2, flag1, flag2] of Object.values(diff)) { @@ -150,7 +150,6 @@ export default function isolate(ctx: Context) { delete entry.ctx[delims[name]] } } - return result }) ctx.on('loader/partial-dispose', (entry, legacy, active) => { diff --git a/vendor/loader/src/index.ts b/vendor/loader/src/index.ts index 1231b4d357..ac736ae356 100644 --- a/vendor/loader/src/index.ts +++ b/vendor/loader/src/index.ts @@ -26,7 +26,7 @@ declare module '@deepseek-ai/cordis' { 'loader/config-update'(): void 'loader/entry-init'(entry: Entry): void 'loader/partial-dispose'(entry: Entry, legacy: Partial, active: boolean): void - 'loader/patch-context'(entry: Entry, next: () => void | Promise): void | Promise + 'loader/patch-context'(entry: Entry, next: () => void): void } interface Context { From 2376d210bd776d2a529fc4e0e4342b7a83ed7510 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 13:36:05 +0800 Subject: [PATCH 04/26] Preserve nested plugin errors after Cordis revert --- packages/boot/app-boot/README.i18n.yaml | 4 ++-- packages/boot/app-boot/README.md | 2 +- packages/boot/app-boot/README.zh.md | 2 +- packages/boot/app-boot/src/index.ts | 12 ++++++++---- packages/boot/app-boot/tests/app-boot.spec.ts | 18 ++++++++++++++++++ 5 files changed, 30 insertions(+), 8 deletions(-) diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 389919113a..a9eadabcc5 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: 8ead27c1a6a3544f34b391facfc3888f50ba479f -README.zh.md: a074afa1dde0ff9eb90b7dc5a8348ac9bb3920b6 +README.md: 2d67d7061c48205a5592e54e404a23d93ed17b3a +README.zh.md: e177bfa86ca28768b08a4be3a48617b20a68a1e7 diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index 8ead27c1a6..2d67d7061c 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -89,7 +89,7 @@ This section explains how the outcomes above are realized and points at the code - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links. - **One rejection checkpoint.** `assertEntriesActivated` keeps the exact reasons it folds into the boot diagnostic visible through the next process rejection checkpoint, so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. - **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success. -- **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`, and appends the deepest plugin error's stack so the startup diagnostic preserves the original activation error instead of only the wrap chain. +- **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`. Plugin diagnostics include original stacks, nested causes, and aggregate member failures. ### Helper behavior diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index a074afa1dd..e177bfa86c 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -89,7 +89,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部组合包若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。 - **单一 rejection 检查点。** `assertEntriesActivated` 把折入启动诊断的确切原因保持到下一个进程级 rejection 检查点可见，使 `installFailLoud` 能合并 Loader 的重复通知，而所有无关的未处理 rejection 仍然致命。 - **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。 -- **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`（此后的一切失败），并追加最深层插件错误的堆栈，使启动诊断保留原始激活错误，而不只是包装链。 +- **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`。插件诊断包含原始堆栈、嵌套原因和聚合错误中的各项失败。 ### Helper 行为 diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 05da302eb0..5f1906e2b4 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -706,15 +706,19 @@ const FIBER_PENDING = 0 as FiberState.PENDING const FIBER_ACTIVE = 2 as FiberState.ACTIVE const FIBER_FAILED = 3 as FiberState.FAILED -/** Render a thrown plugin value without discarding an Error's original stack. */ +/** Render plugin stacks, nested causes, and aggregate member failures. */ function formatActivationError(error: unknown): string { - return error instanceof Error ? error.stack ?? error.message : String(error) + if (!(error instanceof Error)) return String(error) + const details = [error.stack ?? error.message] + if (error.cause !== undefined) details.push(formatActivationError(error.cause)) + if (error instanceof AggregateError) details.push(...error.errors.map(formatActivationError)) + return details.join('\n') } /** * Reject a settled Loader tree when an enabled entry failed or remains inactive. - * Plugin failures include the original thrown stack; pending entries name their - * unresolved services because no plugin error exists for that state. Active + * Plugin failures include original stacks, nested causes, and aggregate members. + * Pending entries name their unresolved services because no plugin error exists for that state. Active * entries require no further wait; only failed fibers are awaited to recover * their private rejection reason. * @param ctx - the settled context whose Loader entries to audit. diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 537d4efad5..bfb8e24355 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -580,6 +580,24 @@ describe('assertEntriesActivated', () => { ]), NAME)).rejects.toThrow(`${NAME}: 2 entries did not activate\nstackless: stackless failure\nplain: plain failure`) }) + it('preserves nested activation causes and aggregate member failures', async () => { + const original = new Error('tool discovery failed') + const aggregate = new AggregateError([original, 'transport closed'], 'connection failed', { + cause: new Error('server rejected discovery'), + }) + const wrapper = new Error('plugin activation failed', { cause: aggregate }) + await expect(assertEntriesActivated(ctxWith([ + { fiber: fiber(3, wrapper), options: { name: 'wrapped-plugin' } }, + ]), NAME)).rejects.toThrow([ + `${NAME}: 1 entry did not activate`, + `wrapped-plugin: ${wrapper.stack!}`, + aggregate.stack!, + (aggregate.cause as Error).stack!, + original.stack!, + 'transport closed', + ].join('\n')) + }) + it('reports unresolved services for pending entries', async () => { let awaitCalls = 0 const expected = [ From 06c491508f5f2fa78afc6b0a3e8e9f6dc3fccfa9 Mon Sep 17 00:00:00 2001 From: creatixchu Date: Thu, 10 Sep 2026 16:09:18 +0800 Subject: [PATCH 05/26] =?UTF-8?q?fix(llm-deepseek):=20=E8=AF=B7=E6=B1=82?= =?UTF-8?q?=E5=9B=BE=E7=89=87=E6=8C=89=20V4.1=20token=20=E7=BD=91=E6=A0=BC?= =?UTF-8?q?=E6=8A=95=E5=BD=B1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ImageRequestPolicy 改为投影规则加可选单边上限加字节目标，投影是 pixel-budget 或 token-grid 的封闭联合。token 网格求解器放在 dsh-attachment 的 request-projection 里，deepSeekImageTokens 复用同一个求解器计价。DeepSeek 路由默认按 14 px patch、3:1 降采样、1024 token 上限的网格投影，每张请求图片加 4096 像素单边上限，字节目标提高到 2 MiB；显式 imagePixelBudget 与 pi-ai 路由仍走总像素预算。缩放只按长边给定，短边由编码器四舍五入，与投影预测一致。变换版本升到 request-image-v6。 Closes #3929 --- .../attachment-local/src/normalization.ts | 12 +- .../attachment-local/src/request-image.ts | 38 ++++- .../attachment-local/tests/index.spec.ts | 2 +- .../tests/request-image-verification.spec.ts | 2 +- .../tests/request-image.spec.ts | 69 ++++++--- packages/attachment/attachment/src/index.ts | 7 +- .../attachment/src/request-projection.ts | 126 ++++++++++++++-- packages/attachment/attachment/src/types.ts | 40 +++++- .../attachment/attachment/tests/index.spec.ts | 4 +- .../tests/request-projection.spec.ts | 66 ++++++++- .../extensions/tool-cordis/src/api-catalog.ts | 8 +- packages/llm/llm-deepseek/src/adapter.ts | 6 +- packages/llm/llm-deepseek/src/image-tokens.ts | 134 ++++-------------- packages/llm/llm-deepseek/src/index.ts | 14 +- .../llm/llm-deepseek/src/request-pricing.ts | 39 ++--- .../llm/llm-deepseek/tests/adapter.spec.ts | 16 +-- .../tests/request-pricing.spec.ts | 29 +++- packages/llm/llm-pi-ai/src/adapter.ts | 2 +- packages/llm/llm-pi-ai/src/context.ts | 2 +- packages/llm/llm-pi-ai/tests/adapter.spec.ts | 2 +- packages/llm/llm-pi-ai/tests/convert.spec.ts | 2 +- 21 files changed, 407 insertions(+), 213 deletions(-) diff --git a/packages/attachment/attachment-local/src/normalization.ts b/packages/attachment/attachment-local/src/normalization.ts index 7d514786a2..199a50af6b 100644 --- a/packages/attachment/attachment-local/src/normalization.ts +++ b/packages/attachment/attachment-local/src/normalization.ts @@ -79,14 +79,10 @@ function preparedPipeline(data: Uint8Array, width: number, height: number): Shar /** Dimensions under the total-pixel budget, then the long-edge cap, without changing aspect ratio. */ function initialDimensions(detected: DetectedImage, policy: NormalizationPolicy): { width: number; height: number } { - const budgeted = requestImageDimensions(detected.width, detected.height, policy.maxPixels) - const longEdge = Math.max(budgeted.width, budgeted.height) - if (longEdge <= policy.maxDimension) return budgeted - const scale = policy.maxDimension / longEdge - return { - width: Math.max(1, Math.floor(budgeted.width * scale)), - height: Math.max(1, Math.floor(budgeted.height * scale)), - } + return requestImageDimensions(detected.width, detected.height, { + projection: { kind: 'pixel-budget', maxPixels: policy.maxPixels }, + maxDimension: policy.maxDimension, + }) } /** diff --git a/packages/attachment/attachment-local/src/request-image.ts b/packages/attachment/attachment-local/src/request-image.ts index 237dc5811f..f1bfe435c6 100644 --- a/packages/attachment/attachment-local/src/request-image.ts +++ b/packages/attachment/attachment-local/src/request-image.ts @@ -9,6 +9,7 @@ import type { ImageMediaType, ImageAttachmentRef, ImageRequestPolicy, + ImageRequestProjection, RequestImageAttachment, StoredImageAttachment, } from '@deepseek-ai/dsh-attachment' @@ -22,7 +23,7 @@ import { import { detectImage, encodedAlphaIsCompatible, probeImage } from './image.ts' /** Transform version included in every cache and upload-index identity. */ -export const REQUEST_IMAGE_TRANSFORM_VERSION = 'request-image-v5' +export const REQUEST_IMAGE_TRANSFORM_VERSION = 'request-image-v6' interface EncodedRequestImage { data: Uint8Array @@ -47,15 +48,36 @@ function checkedInteger(value: number, name: string): number { } function validatePolicy(policy: ImageRequestPolicy): void { - checkedInteger(policy.maxPixels, 'Image request maxPixels') + const { projection } = policy + if (projection.kind === 'pixel-budget') { + checkedInteger(projection.maxPixels, 'Image request maxPixels') + } else { + checkedInteger(projection.patchSize, 'Image request patchSize') + checkedInteger(projection.downsampleRatio, 'Image request downsampleRatio') + checkedInteger(projection.maxTokens, 'Image request maxTokens') + } + if (policy.maxDimension !== undefined) checkedInteger(policy.maxDimension, 'Image request maxDimension') checkedInteger(policy.maxBytes, 'Image request maxBytes') } +/** Projection fields in a fixed key order so equal policies digest identically. */ +function projectionDescriptor(projection: ImageRequestProjection): Record { + return projection.kind === 'pixel-budget' + ? { kind: projection.kind, maxPixels: projection.maxPixels } + : { + kind: projection.kind, + patchSize: projection.patchSize, + downsampleRatio: projection.downsampleRatio, + maxTokens: projection.maxTokens, + } +} + function descriptor(attachment: ImageAttachmentRef, policy: ImageRequestPolicy): string { return JSON.stringify({ transformVersion: REQUEST_IMAGE_TRANSFORM_VERSION, attachmentId: attachment.attachmentId, - routePixelBudget: policy.maxPixels, + projection: projectionDescriptor(policy.projection), + maxDimension: policy.maxDimension ?? null, encodedByteBudget: policy.maxBytes, encoding: { webpQualities: IMAGE_ENCODING_QUALITIES, @@ -70,7 +92,7 @@ function descriptor(attachment: ImageAttachmentRef, policy: ImageRequestPolicy): /** * Complete deterministic identity for one attachment and route-owned request policy. * @param attachment - provider-independent durable normalized attachment reference. - * @param policy - route-owned pixel and byte policy. + * @param policy - route-owned projection, per-side cap, and byte policy. * @returns branded digest over every request transform input. */ export function requestImageVariantId( @@ -80,9 +102,11 @@ export function requestImageVariantId( return ImageVariantId(`sha256:${digest(descriptor(attachment, policy))}`) } +/** Resize by the source long edge only, so the encoder rounds the short edge exactly as the projection did. */ function pipeline(attachment: StoredImageAttachment, width: number, height: number): Sharp { + const byWidth = attachment.ref.width >= attachment.ref.height return sourcePipeline(attachment) - .resize({ width, height, fit: 'inside', withoutEnlargement: true }) + .resize({ ...byWidth ? { width } : { height }, withoutEnlargement: true }) } function sourcePipeline(attachment: StoredImageAttachment): Sharp { @@ -94,7 +118,7 @@ async function createRequestImage( policy: ImageRequestPolicy, hasAlpha: boolean, ): Promise { - const dimensions = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy.maxPixels) + const dimensions = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy) if (dimensions.width === attachment.ref.width && dimensions.height === attachment.ref.height && attachment.data.byteLength <= policy.maxBytes) { @@ -126,7 +150,7 @@ async function readCached( try { const data = new Uint8Array(await readFile(path, { signal })) const detected = await probeImage(data) - const maximum = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy.maxPixels) + const maximum = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy) if (detected.depth !== 'uchar' || detected.space !== 'srgb' || detected.width > maximum.width || detected.height > maximum.height || !encodedAlphaIsCompatible(expectedAlpha, detected)) return undefined diff --git a/packages/attachment/attachment-local/tests/index.spec.ts b/packages/attachment/attachment-local/tests/index.spec.ts index 5711c6d35d..a46d6f0b10 100644 --- a/packages/attachment/attachment-local/tests/index.spec.ts +++ b/packages/attachment/attachment-local/tests/index.spec.ts @@ -85,7 +85,7 @@ describe('local attachment service', () => { String(ref.attachmentId).slice('sha256:'.length), )) await expect(readFile(hostPath)).resolves.toEqual(Buffer.from(data)) - const request = await service.readImageRequest(ref, { maxPixels: 1, maxBytes: 1024 }) + const request = await service.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1024 }) expect(request).not.toHaveProperty('access') const fileData = Uint8Array.of(0, 1, 2, 255) diff --git a/packages/attachment/attachment-local/tests/request-image-verification.spec.ts b/packages/attachment/attachment-local/tests/request-image-verification.spec.ts index 32bc005c94..eabc735229 100644 --- a/packages/attachment/attachment-local/tests/request-image-verification.spec.ts +++ b/packages/attachment/attachment-local/tests/request-image-verification.spec.ts @@ -38,7 +38,7 @@ describe('request image verification', () => { const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) control.mismatch = true - await expect(attachments.readImageRequest(attachment, { maxPixels: 16 * 16, maxBytes: 1024 * 1024 })) + await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 })) .rejects.toMatchObject({ code: 'ATTACHMENT_WRITE_FAILED', message: 'Encoded model-request image does not match its verified 8-bit sRGB metadata.', diff --git a/packages/attachment/attachment-local/tests/request-image.spec.ts b/packages/attachment/attachment-local/tests/request-image.spec.ts index 821480d028..73c0c366b1 100644 --- a/packages/attachment/attachment-local/tests/request-image.spec.ts +++ b/packages/attachment/attachment-local/tests/request-image.spec.ts @@ -48,7 +48,7 @@ describe('local request-image cache', () => { const first = await attachments.saveImage({ data: await image(8, 4), mediaType: 'image/png' }) const second = await attachments.saveImage({ data: await image(4, 8), mediaType: 'image/png' }) const firstStored = await attachments.readImage(first) - const policy = { maxPixels: 1_000, maxBytes: 1024 * 1024 } + const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 1_000 }, maxBytes: 1024 * 1024 } const request = await attachments.readImageRequest(first, policy) const batch = await Promise.all([first, second].map( @@ -63,17 +63,52 @@ describe('local request-image cache', () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(8, 4), mediaType: 'image/png' }) - await expect(attachments.readImageRequest(attachment, { maxPixels: 0, maxBytes: 100 })) + await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 0 }, maxBytes: 100 })) .rejects.toThrow('Image request maxPixels must be a positive integer') - await expect(attachments.readImageRequest(attachment, { maxPixels: 100, maxBytes: 0 })) + await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 100 }, maxBytes: 0 })) .rejects.toThrow('Image request maxBytes must be a positive integer') + await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 100 }, maxDimension: 0, maxBytes: 100 })) + .rejects.toThrow('Image request maxDimension must be a positive integer') + for (const field of ['patchSize', 'downsampleRatio', 'maxTokens'] as const) { + const projection = { kind: 'token-grid' as const, patchSize: 14, downsampleRatio: 3, maxTokens: 1024, [field]: 1.5 } + await expect(attachments.readImageRequest(attachment, { projection, maxBytes: 100 })) + .rejects.toThrow(`Image request ${field} must be a positive integer`) + } + }) + + it('projects onto a token grid, caps the long edge, and keys the cache by projection', async () => { + const attachments = await store() + const grid = { kind: 'token-grid' as const, patchSize: 14, downsampleRatio: 3, maxTokens: 1024 } + const square = await attachments.saveImage({ data: await image(2048, 2048), mediaType: 'image/png' }) + const small = await attachments.saveImage({ data: await image(800, 800), mediaType: 'image/png' }) + const thin = await attachments.saveImage({ data: await image(8000, 40), mediaType: 'image/png' }) + const wide = await attachments.saveImage({ data: await image(1920, 1080), mediaType: 'image/png' }) + const tall = await attachments.saveImage({ data: await image(1080, 1920), mediaType: 'image/png' }) + + const squareRequest = await attachments.readImageRequest(square, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + const smallRequest = await attachments.readImageRequest(small, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + const thinRequest = await attachments.readImageRequest(thin, { projection: grid, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }) + const budgeted = await attachments.readImageRequest(square, { projection: { kind: 'pixel-budget' as const, maxPixels: 1302 * 1302 }, maxBytes: 2 * 1024 * 1024 }) + const uncapped = await attachments.readImageRequest(thin, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + const wideRequest = await attachments.readImageRequest(wide, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + const tallRequest = await attachments.readImageRequest(tall, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + + expect(squareRequest).toMatchObject({ width: 1302, height: 1302, mediaType: 'image/jpeg' }) + expect(smallRequest).toMatchObject({ width: 800, height: 800, mediaType: 'image/png' }) + expect(smallRequest.data).toEqual((await attachments.readImage(small)).data) + expect(thinRequest).toMatchObject({ width: 4096, height: 20 }) + expect(uncapped).toMatchObject({ width: 8000, height: 40 }) + expect(wideRequest).toMatchObject({ width: 1708, height: 961 }) + expect(tallRequest).toMatchObject({ width: 961, height: 1708 }) + expect(budgeted.variantId).not.toBe(squareRequest.variantId) + expect(uncapped.variantId).not.toBe(thinRequest.variantId) }) it('keeps the smallest ladder output when the encoded-byte target is unreachable', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(1, 1), mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { maxPixels: 1, maxBytes: 1 }) + const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 }) expect(request.mediaType).toBe('image/jpeg') expect(request.bytes).toBeGreaterThan(1) @@ -83,7 +118,7 @@ describe('local request-image cache', () => { it('regenerates invalid, oversized, incompatible, or mismatched cached variants', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(64, 32), mediaType: 'image/png' }) - const policy = { maxPixels: 16 * 16, maxBytes: 4_096 } + const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 4_096 } const initial = await attachments.readImageRequest(attachment, policy) const hash = String(initial.variantId).slice('sha256:'.length) const path = join(attachments.root, 'request-images', hash.slice(0, 2), hash) @@ -132,10 +167,10 @@ describe('local request-image cache', () => { data: await image(2048, 1024), mediaType: 'image/png', name: 'wide.png', }) - const squareRequest = await attachments.readImageRequest(square, { maxPixels: 640_000, maxBytes: 1024 * 1024 }) - const wideRequest = await attachments.readImageRequest(wide, { maxPixels: 640_000, maxBytes: 1024 * 1024 }) - const repeated = await attachments.readImageRequest(wide, { maxPixels: 640_000, maxBytes: 1024 * 1024 }) - const low = await attachments.readImageRequest(wide, { maxPixels: 512 * 512, maxBytes: 1024 * 1024 }) + const squareRequest = await attachments.readImageRequest(square, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) + const wideRequest = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) + const repeated = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) + const low = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxBytes: 1024 * 1024 }) expect(squareRequest).toMatchObject({ width: 800, height: 800 }) expect(wideRequest).toMatchObject({ width: 1130, height: 565 }) @@ -175,8 +210,8 @@ describe('local request-image cache', () => { const photo = await attachments.saveImage({ data: photoSource, mediaType: 'image/png' }) const alpha = await attachments.saveImage({ data: alphaSource, mediaType: 'image/png' }) - const photoRequest = await attachments.readImageRequest(photo, { maxPixels: 128 * 128, maxBytes: 1024 * 1024 }) - const alphaRequest = await attachments.readImageRequest(alpha, { maxPixels: 128 * 128, maxBytes: 4_096 }) + const photoRequest = await attachments.readImageRequest(photo, { projection: { kind: 'pixel-budget' as const, maxPixels: 128 * 128 }, maxBytes: 1024 * 1024 }) + const alphaRequest = await attachments.readImageRequest(alpha, { projection: { kind: 'pixel-budget' as const, maxPixels: 128 * 128 }, maxBytes: 4_096 }) expect(photoRequest.mediaType).toBe('image/jpeg') expect(alphaRequest.mediaType).toBe('image/webp') @@ -192,7 +227,7 @@ describe('local request-image cache', () => { }).toColourspace('rgb16').png().toBuffer()) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { maxPixels: 16 * 16, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 }) expect(request.bytes).toBeLessThanOrEqual(1024 * 1024) expect(request.width * request.height).toBeLessThanOrEqual(16 * 16) @@ -206,7 +241,7 @@ describe('local request-image cache', () => { const source = await complexOpaqueAlphaImage(64, 32) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { maxPixels: 16 * 16, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 }) expect(request.mediaType).toBe('image/webp') await expect(sharp(request.data).metadata()).resolves.toMatchObject({ hasAlpha: false }) @@ -228,7 +263,7 @@ describe('local request-image cache', () => { }).png().toBuffer()) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { maxPixels: 640_000, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) expect(request).toMatchObject({ width: 800, height: 800 }) expect(request.bytes).toBeLessThanOrEqual(1024 * 1024) @@ -241,7 +276,7 @@ describe('local request-image cache', () => { }) const run = vi.spyOn(CompressionLimiter.prototype, 'run') const controller = new AbortController() - const policy = { maxPixels: 640_000, maxBytes: 1024 * 1024 } + const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 } const cancelled = attachments.readImageRequest(attachment, policy, controller.signal) const completed = attachments.readImageRequest(attachment, policy) @@ -271,7 +306,7 @@ describe('local request-image cache', () => { const controller = new AbortController() const request = attachments.readImageRequest( attachment, - { maxPixels: 640_000, maxBytes: 1024 * 1024 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }, controller.signal, ) await vi.waitFor(() => { @@ -304,7 +339,7 @@ describe('local request-image cache', () => { return actualRead(ref, signal) }) const controller = new AbortController() - const policy = { maxPixels: 640_000, maxBytes: 1024 * 1024 } + const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 } const cancelled = attachments.readImageRequest(attachment, policy, controller.signal) await vi.waitFor(() => { expect(calls).toBe(1) diff --git a/packages/attachment/attachment/src/index.ts b/packages/attachment/attachment/src/index.ts index 5df42a8bda..312bd2a3e7 100644 --- a/packages/attachment/attachment/src/index.ts +++ b/packages/attachment/attachment/src/index.ts @@ -22,7 +22,8 @@ export { AttachmentId, ImageVariantId } from './brand.ts' export { AttachmentError, isAttachmentError, isImageAdmissionError } from './error.ts' export type { AttachmentErrorCode, ImageAdmissionErrorCode } from './error.ts' export { admitEncodedFile, admitEncodedImages } from './admission.ts' -export { requestImageDimensions } from './request-projection.ts' +export { requestImageDimensions, tokenGridProjection } from './request-projection.ts' +export type { ProjectedDimensions } from './request-projection.ts' export type { AttachmentId as AttachmentIdType, AdmittedPromptContentPart, @@ -33,6 +34,7 @@ export type { ImageAttachmentLimits, ImageAttachmentRef, ImageRequestPolicy, + ImageRequestProjection, ImageMediaType, PromptContentPart, RequestImageAttachment, @@ -40,6 +42,7 @@ export type { SaveFileStreamAttachment, SaveImageAttachment, StoredImageAttachment, + TokenGridProjection, } from './types.ts' declare module '@deepseek-ai/cordis' { @@ -241,7 +244,7 @@ export abstract class AttachmentStore extends Service { /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - exact route pixel budget and encoded-byte target; a target no ladder quality meets yields the smallest ladder output. + * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ diff --git a/packages/attachment/attachment/src/request-projection.ts b/packages/attachment/attachment/src/request-projection.ts index ac9a56c983..f1a9d855ed 100644 --- a/packages/attachment/attachment/src/request-projection.ts +++ b/packages/attachment/attachment/src/request-projection.ts @@ -3,18 +3,19 @@ * provider-side request pricing. @module @deepseek-ai/dsh-attachment/request-projection */ -/** - * Compute aspect-preserving integer dimensions within a hard total-pixel budget. - * @param width - positive source width. - * @param height - positive source height. - * @param maxPixels - positive width-times-height cap. - * @returns inward-rounded dimensions; small images are not enlarged. - */ -export function requestImageDimensions( - width: number, - height: number, - maxPixels: number, -): { width: number; height: number } { +import type { ImageRequestPolicy, ImageRequestProjection, TokenGridProjection } from './types.ts' + +/** Integer width and height of one projected image. */ +export interface ProjectedDimensions { + width: number + height: number +} + +const intDiv = (value: number, divisor: number): number => Math.floor(value / divisor) +const ceilDiv = (value: number, divisor: number): number => Math.floor((value + divisor - 1) / divisor) + +/** Aspect-preserving integer dimensions within a hard total-pixel budget; small images are not enlarged. */ +function pixelBudgetDimensions(width: number, height: number, maxPixels: number): ProjectedDimensions { const scale = Math.min(1, Math.sqrt(maxPixels / (width * height))) if (scale === 1) return { width, height } if (width >= height) { @@ -34,3 +35,104 @@ export function requestImageDimensions( } return { width: projectedWidth, height: projectedHeight } } + +/** Token count of one grid: every row carries a separator, plus two framing tokens. */ +function gridTokens(rows: number, columns: number): number { + return rows * (columns + 1) + 2 +} + +/** + * Project one image onto the token grid of a `token-grid` projection. The + * provider pads each edge up to a whole patch, groups patches into token + * cells, and keeps the padded source when its cell grid fits `maxTokens`; + * otherwise it solves the largest aspect-preserving grid inside the cap, whose + * edges are whole patches. The closed-form solve always lands inside the cap. + * @param width - positive integer source width in pixels. + * @param height - positive integer source height in pixels. + * @param grid - patch size, per-axis downsampling ratio, and token cap. + * @returns the dimensions the provider retains and the tokens it charges. + */ +export function tokenGridProjection( + width: number, + height: number, + grid: Extract, +): TokenGridProjection { + const { patchSize, downsampleRatio, maxTokens } = grid + const cells = (paddedLength: number): number => ceilDiv(intDiv(paddedLength, patchSize), downsampleRatio) + const paddedWidth = ceilDiv(width, patchSize) * patchSize + const paddedHeight = ceilDiv(height, patchSize) * patchSize + const directTokens = gridTokens(cells(paddedHeight), cells(paddedWidth)) + if (directTokens <= maxTokens) { + return { width: paddedWidth, height: paddedHeight, tokens: directTokens, unscaled: true } + } + const cellSize = patchSize * downsampleRatio + const aspect = height / width + const idealColumns = Math.sqrt((maxTokens - 2) / aspect + 0.25) - 0.5 + const idealRows = idealColumns * aspect + let bestWidth: number + let bestHeight: number + if (idealColumns < 1) { + bestWidth = cellSize + bestHeight = intDiv(maxTokens - 2, 2) * cellSize + } else if (idealRows < 1) { + bestWidth = (maxTokens - 3) * cellSize + bestHeight = cellSize + } else { + const columns = Math.trunc(idealColumns) + const rows = Math.trunc(idealRows) + const scale = Math.min(columns * cellSize / width, rows * cellSize / height) + bestWidth = Math.trunc(width * scale / patchSize) * patchSize + bestHeight = Math.trunc(height * scale / patchSize) * patchSize + } + return { + width: bestWidth, + height: bestHeight, + tokens: gridTokens(cells(bestHeight), cells(bestWidth)), + unscaled: false, + } +} + +/** Aspect-preserving dimensions with an exact long edge; the short edge rounds to the nearest pixel. */ +function fromLongEdge(width: number, height: number, longEdge: number): ProjectedDimensions { + return width >= height + ? { width: longEdge, height: Math.max(1, Math.round(longEdge * height / width)) } + : { width: Math.max(1, Math.round(longEdge * width / height)), height: longEdge } +} + +function projectDimensions(width: number, height: number, projection: ImageRequestProjection): ProjectedDimensions { + switch (projection.kind) { + case 'pixel-budget': + return pixelBudgetDimensions(width, height, projection.maxPixels) + case 'token-grid': { + const fit = tokenGridProjection(width, height, projection) + if (fit.unscaled) return { width, height } + return fromLongEdge(width, height, width >= height ? fit.width : fit.height) + } + /* v8 ignore next 4 -- ImageRequestProjection is a closed union; this branch is only the static exhaustiveness guard. */ + default: { + const unreachable: never = projection + throw new Error(`unknown image request projection ${JSON.stringify(unreachable)}`) + } + } +} + +/** + * Compute the aspect-preserving integer dimensions of one request image: + * the policy projection first, then the optional per-side cap. Small images + * are never enlarged. A downscaled result keeps the source long edge exact + * and rounds the short edge, matching a long-edge-only encoder resize. + * @param width - positive source width. + * @param height - positive source height. + * @param policy - route projection rule and optional per-side cap. + * @returns integer dimensions. + */ +export function requestImageDimensions( + width: number, + height: number, + policy: Pick, +): ProjectedDimensions { + const projected = projectDimensions(width, height, policy.projection) + const longEdge = Math.max(projected.width, projected.height) + if (policy.maxDimension === undefined || longEdge <= policy.maxDimension) return projected + return fromLongEdge(width, height, policy.maxDimension) +} diff --git a/packages/attachment/attachment/src/types.ts b/packages/attachment/attachment/src/types.ts index a69b2363dc..0c8482a1eb 100644 --- a/packages/attachment/attachment/src/types.ts +++ b/packages/attachment/attachment/src/types.ts @@ -132,10 +132,46 @@ export interface StoredImageAttachment { data: Uint8Array } +/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ +export type ImageRequestProjection = + | { + /** Hard cap on width multiplied by height. */ + kind: 'pixel-budget' + /** Maximum width multiplied by height after projection. */ + maxPixels: number + } + | { + /** + * Largest aspect-preserving patch grid whose token count + * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. + */ + kind: 'token-grid' + /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ + patchSize: number + /** Patches per token cell along each axis. */ + downsampleRatio: number + /** Token cap for one image. */ + maxTokens: number + } + +/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ +export interface TokenGridProjection { + /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ + width: number + /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + height: number + /** Tokens charged for the retained grid. */ + tokens: number + /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ + unscaled: boolean +} + /** Deterministic request-image policy selected by one exact model route. */ export interface ImageRequestPolicy { - /** Maximum width multiplied by height after aspect-preserving projection. */ - maxPixels: number + /** Downscale rule applied before the per-side cap. */ + projection: ImageRequestProjection + /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ + maxDimension?: number /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ maxBytes: number } diff --git a/packages/attachment/attachment/tests/index.spec.ts b/packages/attachment/attachment/tests/index.spec.ts index 923c1a4360..63c0471f40 100644 --- a/packages/attachment/attachment/tests/index.spec.ts +++ b/packages/attachment/attachment/tests/index.spec.ts @@ -154,12 +154,12 @@ describe('AttachmentStore.readImageRequest', () => { it('reports unsupported request projection while preserving cancellation', async () => { const store = new UnsupportedProjectionStore(new Context()) const ref = await new RecordingStore(new Context()).saveImage(image(1)) - await expect(store.readImageRequest(ref, { maxPixels: 1, maxBytes: 1 })) + await expect(store.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 })) .rejects.toMatchObject({ code: 'ATTACHMENT_PROJECTION_UNSUPPORTED' }) const controller = new AbortController() const reason = new Error('cancel unsupported projection') controller.abort(reason) - expect(() => store.readImageRequest(ref, { maxPixels: 1, maxBytes: 1 }, controller.signal)).toThrow(reason) + expect(() => store.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 }, controller.signal)).toThrow(reason) }) it('rejects generic-file storage and exposes no provider-owned host path by default', async () => { diff --git a/packages/attachment/attachment/tests/request-projection.spec.ts b/packages/attachment/attachment/tests/request-projection.spec.ts index 5e8a740779..0a7d604b5b 100644 --- a/packages/attachment/attachment/tests/request-projection.spec.ts +++ b/packages/attachment/attachment/tests/request-projection.spec.ts @@ -1,14 +1,18 @@ import { describe, expect, it } from 'vitest' -import { requestImageDimensions } from '../src/index.ts' +import { requestImageDimensions, tokenGridProjection } from '../src/index.ts' +import type { ImageRequestProjection } from '../src/index.ts' -describe('request image dimensions', () => { +const PIXEL_BUDGET: ImageRequestProjection = { kind: 'pixel-budget', maxPixels: 640_000 } +const TOKEN_GRID = { kind: 'token-grid', patchSize: 14, downsampleRatio: 3, maxTokens: 1024 } as const + +describe('pixel-budget projection', () => { it.each([ [4096, 4096, 800, 800], [4096, 2048, 1130, 565], [3840, 2160, 1066, 600], [320, 240, 320, 240], ])('projects %sx%s under 640,000 pixels as %sx%s', (width, height, expectedWidth, expectedHeight) => { - const projected = requestImageDimensions(width, height, 640_000) + const projected = requestImageDimensions(width, height, { projection: PIXEL_BUDGET }) expect(projected).toEqual({ width: expectedWidth, height: expectedHeight, @@ -17,13 +21,65 @@ describe('request image dimensions', () => { }) it('projects a portrait within the same total-pixel budget', () => { - const projected = requestImageDimensions(2160, 3840, 640_000) + const projected = requestImageDimensions(2160, 3840, { projection: PIXEL_BUDGET }) expect(projected).toEqual({ width: 600, height: 1066 }) expect(projected.width * projected.height).toBeLessThanOrEqual(640_000) }) it('rounds a portrait inward when integer aspect rounding crosses the pixel cap', () => { - expect(requestImageDimensions(2, 4, 5)).toEqual({ width: 1, height: 2 }) + expect(requestImageDimensions(2, 4, { projection: { kind: 'pixel-budget', maxPixels: 5 } })).toEqual({ width: 1, height: 2 }) + }) +}) + +describe('token-grid projection', () => { + it('keeps the patch-padded source when its grid fits the token cap', () => { + expect(tokenGridProjection(800, 800, TOKEN_GRID)).toEqual({ width: 812, height: 812, tokens: 422, unscaled: true }) + expect(tokenGridProjection(1302, 1302, TOKEN_GRID)).toEqual({ width: 1302, height: 1302, tokens: 994, unscaled: true }) + }) + + it.each([ + [1303, 1303, 1302, 1302, 994], + [4096, 4096, 1302, 1302, 994], + [3840, 2160, 1708, 966, 968], + [2160, 3840, 966, 1708, 986], + [4000, 1000, 2520, 630, 917], + ])('solves %sx%s onto the largest in-cap grid %sx%s', (width, height, expectedWidth, expectedHeight, tokens) => { + expect(tokenGridProjection(width, height, TOKEN_GRID)).toEqual({ + width: expectedWidth, + height: expectedHeight, + tokens, + unscaled: false, + }) + expect(expectedWidth % TOKEN_GRID.patchSize).toBe(0) + expect(expectedHeight % TOKEN_GRID.patchSize).toBe(0) + }) + + it('solves one-row and one-column grids for extreme aspect ratios', () => { + expect(tokenGridProjection(100_000, 1, TOKEN_GRID)).toEqual({ width: 42_882, height: 42, tokens: 1024, unscaled: false }) + expect(tokenGridProjection(1, 100_000, TOKEN_GRID)).toEqual({ width: 42, height: 21_462, tokens: 1024, unscaled: false }) + }) + + it('sends a fitting source at its own dimensions and a larger source at the solved grid', () => { + expect(requestImageDimensions(800, 800, { projection: TOKEN_GRID })).toEqual({ width: 800, height: 800 }) + expect(requestImageDimensions(8192, 78, { projection: TOKEN_GRID })).toEqual({ width: 8192, height: 78 }) + expect(requestImageDimensions(2048, 1024, { projection: TOKEN_GRID })).toEqual({ width: 1848, height: 924 }) + }) + + it('keeps the solved long edge and rounds the short edge to the source aspect ratio', () => { + expect(requestImageDimensions(3840, 2160, { projection: TOKEN_GRID })).toEqual({ width: 1708, height: 961 }) + expect(requestImageDimensions(1080, 2400, { projection: TOKEN_GRID })).toEqual({ width: 838, height: 1862 }) + }) +}) + +describe('per-side cap', () => { + it('scales the projected image down to the cap on its long edge', () => { + expect(requestImageDimensions(8192, 78, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 4096, height: 39 }) + expect(requestImageDimensions(1, 8192, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 1, height: 4096 }) + expect(requestImageDimensions(10_000, 100, { projection: PIXEL_BUDGET, maxDimension: 4096 })).toEqual({ width: 4096, height: 41 }) + }) + + it('leaves an image within the cap untouched', () => { + expect(requestImageDimensions(2048, 2048, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 1302, height: 1302 }) }) }) diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts index 6f16abb7d0..c7a984b12a 100644 --- a/packages/extensions/tool-cordis/src/api-catalog.ts +++ b/packages/extensions/tool-cordis/src/api-catalog.ts @@ -550,7 +550,7 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ { signature: 'readImageRequest( ref: ImageAttachmentRef, policy: ImageRequestPolicy, signal?: AbortSignal, ): Promise', description: 'Generate or read one deterministic model-request version from the stored normalized image.', - parameters: [{ name: 'ref', description: 'durable provider-independent normalized attachment reference.' }, { name: 'policy', description: 'exact route pixel budget and encoded-byte target; a target no ladder quality meets yields the smallest ladder output.' }, { name: 'signal', description: 'optional cancellation.' }], + parameters: [{ name: 'ref', description: 'durable provider-independent normalized attachment reference.' }, { name: 'policy', description: 'route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output.' }, { name: 'signal', description: 'optional cancellation.' }], returns: 'request bytes and the cache/upload identity covering every transform input.', }, ], @@ -4360,7 +4360,11 @@ export const TYPE_API: readonly TypeApiEntry[] = [ }, { name: 'ImageRequestPolicy', - declaration: 'export interface ImageRequestPolicy {\n maxPixels: number;\n maxBytes: number;\n}', + declaration: 'export interface ImageRequestPolicy {\n projection: ImageRequestProjection;\n maxDimension?: number;\n maxBytes: number;\n}', + }, + { + name: 'ImageRequestProjection', + declaration: 'export type ImageRequestProjection = {\n kind: \'pixel-budget\';\n maxPixels: number;\n} | {\n kind: \'token-grid\';\n patchSize: number;\n downsampleRatio: number;\n maxTokens: number;\n};', }, { name: 'ImageVariantId', diff --git a/packages/llm/llm-deepseek/src/adapter.ts b/packages/llm/llm-deepseek/src/adapter.ts index be165c1d4c..432902ca6b 100644 --- a/packages/llm/llm-deepseek/src/adapter.ts +++ b/packages/llm/llm-deepseek/src/adapter.ts @@ -60,7 +60,11 @@ export interface DeepSeekCatalogModel { maxTokens?: number /** Accepted request modalities; omission is text-only. */ inputModalities?: ModelModality[] - /** Total-pixel budget for one deterministic request preview, or the 512-by-512 `low` preset. */ + /** + * Total-pixel budget replacing the published token-grid projection for one + * deterministic request preview, or the 512-by-512 `low` preset; omission + * projects onto the token grid. + */ imagePixelBudget?: number | 'low' /** Encoded-byte target for one deterministic request preview; the smallest quality-ladder output is used when no quality fits. */ imageMaxBytes?: number diff --git a/packages/llm/llm-deepseek/src/image-tokens.ts b/packages/llm/llm-deepseek/src/image-tokens.ts index 609eb7269c..318ee1f399 100644 --- a/packages/llm/llm-deepseek/src/image-tokens.ts +++ b/packages/llm/llm-deepseek/src/image-tokens.ts @@ -1,119 +1,39 @@ /** * DeepSeek vision-token accounting: the provider's published image-token - * calculator (api-docs.deepseek.com, Token & Token Usage) ported verbatim in - * its current `v41` configuration. The provider scales an image below - * 544×544 total pixels up, aligns it to a 14px-patch grid, downsamples 3:1 - * per axis into token cells, and caps one image at 1024 tokens by solving the - * largest aspect-preserving grid inside that budget. The count is exact: this - * configuration has no alignment pad and no aspect-ratio clamp. Actual usage - * remains authoritative. + * calculator (api-docs.deepseek.com, Token & Token Usage) in its current + * `v41` configuration. The provider scales an image below 544×544 total + * pixels up, then projects it onto the token grid shared with request + * projection, iterating to a fixpoint. The count is exact: this configuration + * has no alignment pad and no aspect-ratio clamp. Actual usage remains + * authoritative. * * @module dsh-llm-deepseek/image-tokens */ -/** Vision patch edge in pixels. */ -const PATCH_SIZE = 14 -/** Per-axis patch-to-token downsampling ratio. */ -const DOWNSAMPLE_RATIO = 3 -/** Provider cap on tokens for one request image. */ -const MAX_IMAGE_TOKENS = 1024 +import { tokenGridProjection } from '@deepseek-ai/dsh-attachment' +import type { ImageRequestProjection, TokenGridProjection } from '@deepseek-ai/dsh-attachment' + +/** Published DeepSeek vision grid: 14px patches, 3:1 per-axis downsampling, at most 1024 tokens per image. */ +export const DEEPSEEK_IMAGE_TOKEN_GRID = { + kind: 'token-grid', + patchSize: 14, + downsampleRatio: 3, + maxTokens: 1024, +} as const satisfies ImageRequestProjection + /** Total-pixel floor; smaller images are scaled up before grid projection. */ const MIN_PIXELS = 544 * 544 -/** Pixels covered by one token cell along either axis. */ -const CELL_SIZE = PATCH_SIZE * DOWNSAMPLE_RATIO -const intDiv = (value: number, divisor: number): number => Math.floor(value / divisor) -const ceilDiv = (value: number, divisor: number): number => Math.floor((value + divisor - 1) / divisor) - -interface GridResize { - readonly gridHeight: number - readonly gridWidth: number - readonly bestHeight: number - readonly bestWidth: number - readonly numTokens: number +/** One scale-up-then-project pass; the caller iterates it to a fixpoint. */ +function resizeOnce(width: number, height: number): TokenGridProjection { + const pixels = width * height + if (pixels >= MIN_PIXELS) return tokenGridProjection(width, height, DEEPSEEK_IMAGE_TOKEN_GRID) + const scale = Math.sqrt(MIN_PIXELS / pixels) + return tokenGridProjection(Math.trunc(width * scale), Math.trunc(height * scale), DEEPSEEK_IMAGE_TOKEN_GRID) } -/** Token count of one grid: every row carries a separator, plus two framing tokens. */ -function gridTokens(gridHeight: number, gridWidth: number): number { - return gridHeight * (gridWidth + 1) + 2 -} - -/** Token-cell count along one padded pixel axis. */ -function gridCells(paddedLength: number): number { - return ceilDiv(intDiv(paddedLength, PATCH_SIZE), DOWNSAMPLE_RATIO) -} - -/** Solve the largest grid within `budget` tokens preserving the aspect ratio. */ -function solveResizeRatio(height: number, width: number, budget: number): GridResize { - const aspect = height / width - const idealGridWidth = Math.sqrt((budget - 2) / aspect + 0.25) - 0.5 - const idealGridHeight = idealGridWidth * aspect - let bestHeight: number - let bestWidth: number - if (idealGridWidth < 1) { - const solvedGridWidth = 1 - const solvedGridHeight = intDiv(budget - 2, solvedGridWidth + 1) - bestWidth = solvedGridWidth * CELL_SIZE - bestHeight = solvedGridHeight * CELL_SIZE - } else if (idealGridHeight < 1) { - const solvedGridHeight = 1 - const solvedGridWidth = intDiv(budget - 2, solvedGridHeight) - 1 - bestWidth = solvedGridWidth * CELL_SIZE - bestHeight = solvedGridHeight * CELL_SIZE - } else { - const solvedGridWidth = Math.trunc(idealGridWidth) - const solvedGridHeight = Math.trunc(idealGridHeight) - const scale = Math.min(solvedGridWidth * CELL_SIZE / width, solvedGridHeight * CELL_SIZE / height) - bestWidth = Math.trunc(width * scale / PATCH_SIZE) * PATCH_SIZE - bestHeight = Math.trunc(height * scale / PATCH_SIZE) * PATCH_SIZE - } - const gridHeight = gridCells(bestHeight) - const gridWidth = gridCells(bestWidth) - return { gridHeight, gridWidth, bestHeight, bestWidth, numTokens: gridTokens(gridHeight, gridWidth) } -} - -/** Project padded pixel dimensions onto the largest in-budget token grid. */ -function safeResize(height: number, width: number, paddedHeight: number, paddedWidth: number): GridResize { - const gridHeight = gridCells(paddedHeight) - const gridWidth = gridCells(paddedWidth) - const direct: GridResize = { - gridHeight, - gridWidth, - bestHeight: paddedHeight, - bestWidth: paddedWidth, - numTokens: gridTokens(gridHeight, gridWidth), - } - if (direct.numTokens <= MAX_IMAGE_TOKENS) return direct - const solved = solveResizeRatio(height, width, MAX_IMAGE_TOKENS) - /* v8 ignore next 3 -- the published solver's assertion; the closed-form - solve stays within the budget for every positive geometry. */ - if (solved.numTokens > MAX_IMAGE_TOKENS) { - throw new Error(`deepseek image tokens: no grid fits the token budget for ${width}x${height}`) - } - return solved -} - -/** One scale-pad-project pass; the caller iterates it to a fixpoint. */ -function resizeOnce(width: number, height: number): GridResize { - let scaledWidth = width - let scaledHeight = height - const pixels = scaledWidth * scaledHeight - if (pixels < MIN_PIXELS && pixels > 0) { - const scale = Math.sqrt(MIN_PIXELS / pixels) - scaledWidth = Math.trunc(scaledWidth * scale) - scaledHeight = Math.trunc(scaledHeight * scale) - } - const paddedWidth = ceilDiv(scaledWidth, PATCH_SIZE) * PATCH_SIZE - const paddedHeight = ceilDiv(scaledHeight, PATCH_SIZE) * PATCH_SIZE - return safeResize(scaledHeight, scaledWidth, paddedHeight, paddedWidth) -} - -function sameResize(a: GridResize, b: GridResize): boolean { - return a.gridHeight === b.gridHeight - && a.gridWidth === b.gridWidth - && a.bestHeight === b.bestHeight - && a.bestWidth === b.bestWidth - && a.numTokens === b.numTokens +function sameResize(a: TokenGridProjection, b: TokenGridProjection): boolean { + return a.width === b.width && a.height === b.height && a.tokens === b.tokens } /** @@ -126,8 +46,8 @@ function sameResize(a: GridResize, b: GridResize): boolean { export function deepSeekImageTokens(width: number, height: number): number { let result = resizeOnce(width, height) for (let iteration = 1; iteration < 10; iteration += 1) { - const next = resizeOnce(result.bestWidth, result.bestHeight) - if (sameResize(next, result)) return result.numTokens + const next = resizeOnce(result.width, result.height) + if (sameResize(next, result)) return result.tokens result = next } /* v8 ignore next 2 -- the published solver's non-convergence guard; every diff --git a/packages/llm/llm-deepseek/src/index.ts b/packages/llm/llm-deepseek/src/index.ts index d536fc1f9b..1e41a4f5f7 100644 --- a/packages/llm/llm-deepseek/src/index.ts +++ b/packages/llm/llm-deepseek/src/index.ts @@ -38,11 +38,9 @@ import { } from './adapter.ts' import type { DeepSeekCatalogModel, DeepSeekConnectionOptions } from './adapter.ts' import { - DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET, DEFAULT_MAX_IMAGES_PER_REQUEST, DEFAULT_MAX_REQUEST_FILES_BYTES, DEFAULT_REQUEST_IMAGE_MAX_BYTES, - DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, } from './request-pricing.ts' export { @@ -65,11 +63,11 @@ export { DEFAULT_MAX_IMAGES_PER_REQUEST, DEFAULT_MAX_REQUEST_FILES_BYTES, DEFAULT_REQUEST_IMAGE_MAX_BYTES, - DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, + REQUEST_IMAGE_MAX_DIMENSION, deepSeekImageRequestPricing, resolveRequestImagePolicy, } from './request-pricing.ts' -export { deepSeekImageTokens } from './image-tokens.ts' +export { DEEPSEEK_IMAGE_TOKEN_GRID, deepSeekImageTokens } from './image-tokens.ts' export { DeepSeekFileStore, MAX_CHAT_IMAGE_BYTES } from './file-store.ts' export type { DeepSeekFileConnection, DeepSeekFilePolicy, DeepSeekFileReference } from './file-store.ts' export { DeepSeekFilesClient, MAX_FILE_EXPIRY_SECONDS, MAX_FILE_UPLOAD_BYTES, MAX_STORED_FILE_BYTES, MAX_STORED_FILE_COUNT, MIN_FILE_EXPIRY_SECONDS } from './files-api.ts' @@ -95,8 +93,6 @@ const DEFAULT_MODELS: DeepSeekCatalogModel[] = [ name: 'DeepSeek-V41-Flash', contextWindow: DEFAULT_CONTEXT_WINDOW, inputModalities: ['text', 'image'], - imagePixelBudget: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, - imageMaxBytes: DEFAULT_REQUEST_IMAGE_MAX_BYTES, systemPromptUpdate: 'in-history', }, { @@ -116,8 +112,6 @@ const DEFAULT_MODELS: DeepSeekCatalogModel[] = [ name: 'DeepSeek-V4-Flash-Vision-Exp', contextWindow: DEFAULT_CONTEXT_WINDOW, inputModalities: ['text', 'image'], - imagePixelBudget: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, - imageMaxBytes: DEFAULT_REQUEST_IMAGE_MAX_BYTES, }, ] @@ -285,9 +279,7 @@ function resolveModels(models: readonly DeepSeekCatalogModel[] | undefined): Dee inputModalities: [...inputModalities], ...hasImage ? { - imagePixelBudget: model.imagePixelBudget === 'low' - ? DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET - : model.imagePixelBudget ?? DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, + ...model.imagePixelBudget === undefined ? {} : { imagePixelBudget: model.imagePixelBudget }, imageMaxBytes: model.imageMaxBytes ?? DEFAULT_REQUEST_IMAGE_MAX_BYTES, } : {}, diff --git a/packages/llm/llm-deepseek/src/request-pricing.ts b/packages/llm/llm-deepseek/src/request-pricing.ts index acdf4dc15a..732038da28 100644 --- a/packages/llm/llm-deepseek/src/request-pricing.ts +++ b/packages/llm/llm-deepseek/src/request-pricing.ts @@ -1,6 +1,6 @@ /** * Provider-side request-image pricing for DeepSeek routes: reproduces the - * adapter's deterministic request projection (per-model pixel budget, + * adapter's deterministic request projection (per-model projection, * oldest-first offload under the raw-byte and count budgets) and prices every * retained image with the published vision-token accounting. Consumed * synchronously by the token meter through `LlmAdapter.imageRequestPricing`; @@ -12,36 +12,43 @@ import { offloadedImageText, offloadedImagePrefixCount, requestImageHandleText, textOnlyImageText } from '@deepseek-ai/dsh-llm' import type { ImageAttachmentAccessResolver, LlmImageRequestPrice, LlmImageRequestPricing } from '@deepseek-ai/dsh-llm' import { requestImageDimensions } from '@deepseek-ai/dsh-attachment' -import type { ImageAttachmentRef, ImageRequestPolicy } from '@deepseek-ai/dsh-attachment' -import { deepSeekImageTokens } from './image-tokens.ts' +import type { ImageAttachmentRef, ImageRequestPolicy, ImageRequestProjection } from '@deepseek-ai/dsh-attachment' +import { DEEPSEEK_IMAGE_TOKEN_GRID, deepSeekImageTokens } from './image-tokens.ts' import type { DeepSeekCatalogModel, DeepSeekConnectionOptions } from './adapter.ts' /** Default bound on accumulated file-referenced image bytes per request. */ export const DEFAULT_MAX_REQUEST_FILES_BYTES = 128 * 1024 * 1024 /** Provider request image-count limit. */ export const DEFAULT_MAX_IMAGES_PER_REQUEST = 600 -/** Default total-pixel budget for harness request-image projection. */ -export const DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET = 640_000 /** Total-pixel budget matching provider low-detail image input. */ export const DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET = 512 * 512 /** Encoded-byte target for one deterministic model-request image; the smallest quality-ladder output is used when no quality fits. */ -export const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 1024 * 1024 +export const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 2 * 1024 * 1024 +/** + * Provider per-side limit for a request carrying 15 or more images, applied + * to every request image so the image count never changes a projection. + */ +export const REQUEST_IMAGE_MAX_DIMENSION = 4096 /** - * Resolve the request-image budgets owned by one DeepSeek model route. + * Resolve the request-image policy owned by one DeepSeek model route: the + * published token grid unless the model overrides it with a pixel budget, + * the provider per-side limit, and the encoded-byte target. * @param model - Advertised model route and its optional image overrides. - * @returns Complete pixel and encoded-byte budgets. + * @returns Complete projection, per-side cap, and encoded-byte target. * @internal */ export function resolveRequestImagePolicy(model: DeepSeekCatalogModel): ImageRequestPolicy { - const maxPixels = model.imagePixelBudget === 'low' - ? DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET - : model.imagePixelBudget ?? DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET + const projection: ImageRequestProjection = model.imagePixelBudget === undefined + ? DEEPSEEK_IMAGE_TOKEN_GRID + : { + kind: 'pixel-budget', + maxPixels: model.imagePixelBudget === 'low' ? DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET : model.imagePixelBudget, + } return { - maxPixels, - maxBytes: model.imageMaxBytes === undefined - ? DEFAULT_REQUEST_IMAGE_MAX_BYTES - : model.imageMaxBytes, + projection, + maxDimension: REQUEST_IMAGE_MAX_DIMENSION, + maxBytes: model.imageMaxBytes ?? DEFAULT_REQUEST_IMAGE_MAX_BYTES, } } @@ -95,7 +102,7 @@ export function deepSeekImageRequestPricing( if (index < offloaded) { return { visualTokens: 0, text: offloadedImageText(ref, resolveAccess?.(ref)) } } - const dimensions = requestImageDimensions(ref.width, ref.height, policy.maxPixels) + const dimensions = requestImageDimensions(ref.width, ref.height, policy) return { visualTokens: deepSeekImageTokens(dimensions.width, dimensions.height), text: requestImageHandleText(ref, dimensions, resolveAccess?.(ref)), diff --git a/packages/llm/llm-deepseek/tests/adapter.spec.ts b/packages/llm/llm-deepseek/tests/adapter.spec.ts index fefe4815b4..4122023b2c 100644 --- a/packages/llm/llm-deepseek/tests/adapter.spec.ts +++ b/packages/llm/llm-deepseek/tests/adapter.spec.ts @@ -20,7 +20,7 @@ import { SessionId } from '@deepseek-ai/dsh-session' import DeepSeekLlmApiExtensionRegistry from '@deepseek-ai/dsh-deepseek-llm-api-extensions' import type { PreparedDeepSeekLlmApiExtensions } from '@deepseek-ai/dsh-deepseek-llm-api-extensions' import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek' -import { DeepSeekAdapter, resolveAdapterOptions } from '@deepseek-ai/dsh-llm-deepseek' +import { DEEPSEEK_IMAGE_TOKEN_GRID, DeepSeekAdapter, resolveAdapterOptions } from '@deepseek-ai/dsh-llm-deepseek' import { httpErrorCode } from '../src/adapter.ts' import { resolveRequestImagePolicy } from '../src/request-pricing.ts' import { assemble } from './assemble.ts' @@ -145,15 +145,15 @@ describe('request image policy', () => { it.each([ [ { id: 'default' }, - { maxPixels: 640_000, maxBytes: 1024 * 1024 }, + { projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, ], [ { id: 'low', imagePixelBudget: 'low' as const }, - { maxPixels: 512 * 512, maxBytes: 1024 * 1024 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, ], [ { id: 'custom', imagePixelBudget: 320_000, imageMaxBytes: 512_000 }, - { maxPixels: 320_000, maxBytes: 512_000 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 320_000 }, maxDimension: 4096, maxBytes: 512_000 }, ], ])('resolves route-owned defaults and overrides for %s', (model, expected) => { expect(resolveRequestImagePolicy(model)).toEqual(expected) @@ -407,7 +407,7 @@ describe('DeepSeekAdapter against a mock server', () => { bytes: 3, }]) expect(signalSeen[0]).toBeInstanceOf(AbortSignal) - expect(policies).toEqual([{ maxPixels: 640_000, maxBytes: 1024 * 1024 }]) + expect(policies).toEqual([{ projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }]) }) it('falls back to one all-base64 request when Files API resolution fails', async () => { @@ -621,7 +621,7 @@ describe('DeepSeekAdapter against a mock server', () => { expect(attachmentMocks.readImageRequest).toHaveBeenCalledWith( recent, - { maxPixels: 640_000, maxBytes: 1024 * 1024 }, + { projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, expect.any(AbortSignal), ) const body = server.requests[0] as { messages: unknown[] } @@ -672,13 +672,13 @@ describe('DeepSeekAdapter against a mock server', () => { expect(attachmentMocks.readImageRequest).toHaveBeenNthCalledWith( 1, imageRef, - { maxPixels: 512 * 512, maxBytes: 512_000 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxDimension: 4096, maxBytes: 512_000 }, expect.any(AbortSignal), ) expect(attachmentMocks.readImageRequest).toHaveBeenNthCalledWith( 2, imageRef, - { maxPixels: 320_000, maxBytes: 1024 * 1024 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 320_000 }, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, expect.any(AbortSignal), ) }) diff --git a/packages/llm/llm-deepseek/tests/request-pricing.spec.ts b/packages/llm/llm-deepseek/tests/request-pricing.spec.ts index ccaec2e51a..b082cbc7ed 100644 --- a/packages/llm/llm-deepseek/tests/request-pricing.spec.ts +++ b/packages/llm/llm-deepseek/tests/request-pricing.spec.ts @@ -44,17 +44,32 @@ describe('DeepSeek request-image pricing', () => { const image = ref('photo', 1920, 1080) const prices = deepSeekImageRequestPricing(connection(), 'vision').priceImages([image]) expect(prices).toEqual([{ - visualTokens: 407, - text: requestImageHandleText(image, { width: 1066, height: 600 }), + visualTokens: 968, + text: requestImageHandleText(image, { width: 1708, height: 961 }), }]) }) - it.each([[8192, 1], [1, 8192]])('prices a %sx%s image at the token cap within the default pixel budget', (width, height) => { + it.each([ + [8192, 1, 4096, 1, 832], + [1, 8192, 1, 4096, 1024], + ])('prices a %sx%s image at its per-side-capped %sx%s request dimensions', (width, height, cappedWidth, cappedHeight, tokens) => { const image = ref('thin', width, height) const prices = deepSeekImageRequestPricing(connection(), 'vision').priceImages([image]) expect(prices).toEqual([{ - visualTokens: 1024, - text: requestImageHandleText(image, { width, height }), + visualTokens: tokens, + text: requestImageHandleText(image, { width: cappedWidth, height: cappedHeight }), + }]) + }) + + it('honors a numeric pixel budget override', () => { + const image = ref('photo', 4096, 4096) + const options = resolveAdapterOptions({ + models: [{ ...VISION_MODEL, imagePixelBudget: 640_000 }], + }) + const prices = deepSeekImageRequestPricing(options, 'vision').priceImages([image]) + expect(prices).toEqual([{ + visualTokens: 422, + text: requestImageHandleText(image, { width: 800, height: 800 }), }]) }) @@ -97,7 +112,7 @@ describe('DeepSeek request-image pricing', () => { }) it('caps each occurrence at the per-image byte target before the byte budget', () => { - // Each 5 MiB source counts as the 1 MiB request target, so a 2 MiB budget + // Each 5 MiB source counts as the 2 MiB request target, so a 4 MiB budget // with a one-byte quantum removes exactly the oldest occurrence. const oversized = 5 * 1024 * 1024 const images = [ @@ -106,7 +121,7 @@ describe('DeepSeek request-image pricing', () => { ref('third', 800, 800, oversized), ] const prices = deepSeekImageRequestPricing( - connection({ maxRequestFilesBytes: 2 * 1024 * 1024, imageOffloadByteQuantum: 1 }), + connection({ maxRequestFilesBytes: 4 * 1024 * 1024, imageOffloadByteQuantum: 1 }), 'vision', ).priceImages(images) expect(prices.map(price => price.visualTokens)).toEqual([0, 422, 422]) diff --git a/packages/llm/llm-pi-ai/src/adapter.ts b/packages/llm/llm-pi-ai/src/adapter.ts index 8dba978c31..c1e0d9b586 100644 --- a/packages/llm/llm-pi-ai/src/adapter.ts +++ b/packages/llm/llm-pi-ai/src/adapter.ts @@ -373,7 +373,7 @@ export class PiAiAdapter extends LlmAdapter { resolveImageAccess: ref => this.config.resolveImageAccess?.(attachments, ref), maxRequestImageBytes: profile.maxRequestImageBytes, requestImagePolicy: { - maxPixels: profile.requestImagePixelBudget, + projection: { kind: 'pixel-budget', maxPixels: profile.requestImagePixelBudget }, maxBytes: profile.requestImageMaxBytes, }, }, onReplayDegrade) diff --git a/packages/llm/llm-pi-ai/src/context.ts b/packages/llm/llm-pi-ai/src/context.ts index 2a4369a5ba..2c072166e8 100644 --- a/packages/llm/llm-pi-ai/src/context.ts +++ b/packages/llm/llm-pi-ai/src/context.ts @@ -272,7 +272,7 @@ async function toPiContextWithImages( ): Promise { const { attachments, resolveImageAccess, maxRequestImageBytes } = images const requestImagePolicy = images.requestImagePolicy ?? { - maxPixels: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, + projection: { kind: 'pixel-budget', maxPixels: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET }, maxBytes: DEFAULT_REQUEST_IMAGE_MAX_BYTES, } assertSupportedImageRoles(options.messages) diff --git a/packages/llm/llm-pi-ai/tests/adapter.spec.ts b/packages/llm/llm-pi-ai/tests/adapter.spec.ts index a54ec17697..4746ee4be1 100644 --- a/packages/llm/llm-pi-ai/tests/adapter.spec.ts +++ b/packages/llm/llm-pi-ai/tests/adapter.spec.ts @@ -325,7 +325,7 @@ describe('PiAiAdapter provider routing', () => { expect(result.finish.kind).toBe('error') expect(readImageRequest).toHaveBeenCalledWith(ref, { - maxPixels: 2048 * 2048, + projection: { kind: 'pixel-budget' as const, maxPixels: 2048 * 2048 }, maxBytes: 1024 * 1024, }, expect.any(AbortSignal)) expect(JSON.stringify(server.requests[0])).toContain(MODEL_IMAGE_PATH) diff --git a/packages/llm/llm-pi-ai/tests/convert.spec.ts b/packages/llm/llm-pi-ai/tests/convert.spec.ts index 74ecb3d71d..650c8222ae 100644 --- a/packages/llm/llm-pi-ai/tests/convert.spec.ts +++ b/packages/llm/llm-pi-ai/tests/convert.spec.ts @@ -119,7 +119,7 @@ describe('toPiContext', () => { expect(readImageRequest).toHaveBeenCalledWith( attachment, - { maxPixels: 2048 * 2048, maxBytes: 1024 * 1024 }, + { projection: { kind: 'pixel-budget' as const, maxPixels: 2048 * 2048 }, maxBytes: 1024 * 1024 }, undefined, ) expect(context.messages[0]).toEqual({ From e17a736cc3823463dbdb00994bf4b979bf2f18ad Mon Sep 17 00:00:00 2001 From: creatixchu Date: Thu, 10 Sep 2026 16:09:20 +0800 Subject: [PATCH 06/26] =?UTF-8?q?docs:=20=E5=90=8C=E6=AD=A5=E8=AF=B7?= =?UTF-8?q?=E6=B1=82=E5=9B=BE=E7=89=87=E6=8A=95=E5=BD=B1=E6=96=87=E6=A1=A3?= =?UTF-8?q?=E4=B8=8E=20Agent=20Note?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 更新 attachment、attachment-local、llm-deepseek 的 README，附件与 LLM 流式子系统文档，配置目录，type-equiv 清单，以及双语配对记录；新增请求图片投影的 Agent Note，并修正 v41 计价 Note 里关于 640,000 像素预算的说明。 --- ...pseek-image-token-calculator-v41.i18n.yaml | 4 +- ...-10-deepseek-image-token-calculator-v41.md | 2 +- ...-deepseek-image-token-calculator-v41.zh.md | 2 +- ...eek-v41-request-image-projection.i18n.yaml | 6 +++ ...0-deepseek-v41-request-image-projection.md | 31 ++++++++++++ ...eepseek-v41-request-image-projection.zh.md | 31 ++++++++++++ docs/config-catalog.i18n.yaml | 4 +- docs/config-catalog.md | 8 +++- docs/config-catalog.zh.md | 8 +++- docs/subsystems/attachment.i18n.yaml | 4 +- docs/subsystems/attachment.md | 48 +++++++++++++++++-- docs/subsystems/attachment.zh.md | 48 +++++++++++++++++-- docs/subsystems/llm-streaming.i18n.yaml | 4 +- docs/subsystems/llm-streaming.md | 2 +- docs/subsystems/llm-streaming.zh.md | 2 +- .../attachment-local/README.i18n.yaml | 4 +- .../attachment/attachment-local/README.md | 2 +- .../attachment/attachment-local/README.zh.md | 2 +- .../attachment/attachment/README.i18n.yaml | 4 +- packages/attachment/attachment/README.md | 4 +- packages/attachment/attachment/README.zh.md | 4 +- packages/llm/llm-deepseek/README.i18n.yaml | 4 +- packages/llm/llm-deepseek/README.md | 4 +- packages/llm/llm-deepseek/README.zh.md | 4 +- scripts/type-equiv.manifest.json | 10 ++++ 25 files changed, 204 insertions(+), 42 deletions(-) create mode 100644 .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml create mode 100644 .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md create mode 100644 .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml index 656c874bda..37a4a4b687 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md -2026-09-10-deepseek-image-token-calculator-v41.md: d8042b04c1ed7824720485aa3ccf584f913d0726 -2026-09-10-deepseek-image-token-calculator-v41.zh.md: 6be386da1c66c469329d03e7b86c8c0e2c22ce3a +2026-09-10-deepseek-image-token-calculator-v41.md: 4e57118987ddb7c2e2574d0dc40b02d8acf49e1a +2026-09-10-deepseek-image-token-calculator-v41.zh.md: 209ddb99616d5d94fd4f390706304a722137bd15 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md index d8042b04c1..4e57118987 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md @@ -24,4 +24,4 @@ The test vectors are re-pinned from the published calculator. The request-pricin ## Consequences -An 800×800 request image costs 422 tokens instead of 349, while a 640×480 image costs 206 instead of 209 and a low-budget 512×512 image costs 184 instead of 201. Compaction pressure changes with the retained image dimensions. The 640,000-pixel budget does not imply a 422-token ceiling: an 8192×1 image stays within that pixel budget and costs 1024 tokens. The estimate no longer carries a three-token conservative margin; provider usage remains the authoritative anchor once a request completes. Sessions replayed through `llm-replay` use their fixture's `imageRequestTokens` and are unaffected. +An 800×800 request image costs 422 tokens instead of 349, while a 640×480 image costs 206 instead of 209 and a low-budget 512×512 image costs 184 instead of 201. Compaction pressure changes with the retained image dimensions. The request projection later moved onto the same grid ([successor](2026-09-10-deepseek-v41-request-image-projection.md)), so the 640,000-pixel budget that made a square request image cost 422 tokens no longer applies. The estimate no longer carries a three-token conservative margin; provider usage remains the authoritative anchor once a request completes. Sessions replayed through `llm-replay` use their fixture's `imageRequestTokens` and are unaffected. diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md index 6be386da1c..209ddb9961 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md @@ -24,4 +24,4 @@ Status: implemented ## 后果 -800×800 请求图片的计价从 349 变为 422 token，640×480 图片从 209 变为 206，低预算下的 512×512 图片从 201 变为 184。压缩压力随保留图片的尺寸变化。640,000 像素预算不意味着 422 token 上限：8192×1 图片在该像素预算内，仍计 1024 token。估算值不再带 3 token 的保守余量；请求完成后，提供方 usage 仍是权威锚点。经 `llm-replay` 回放的会话使用各自 fixture 的 `imageRequestTokens`，不受影响。 +800×800 请求图片的计价从 349 变为 422 token，640×480 图片从 209 变为 206，低预算下的 512×512 图片从 201 变为 184。压缩压力随保留图片的尺寸变化。请求投影后来改为同一套网格（[后续决策](2026-09-10-deepseek-v41-request-image-projection.zh.md)），让正方形请求图片计 422 token 的 640,000 像素预算已不再适用。估算值不再带 3 token 的保守余量；请求完成后，提供方 usage 仍是权威锚点。经 `llm-replay` 回放的会话使用各自 fixture 的 `imageRequestTokens`，不受影响。 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml new file mode 100644 index 0000000000..2a3977f21e --- /dev/null +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml @@ -0,0 +1,6 @@ +# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each +# side as of the last confirmed-consistent state. Both languages carry equal authority; +# after editing either side, bring the other along and re-record with: +# pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md +2026-09-10-deepseek-v41-request-image-projection.md: 32b1eb4251ec12005879551bfad363a98034291b +2026-09-10-deepseek-v41-request-image-projection.zh.md: 0360dcc655e1b366ca7169784b63e2650ee3dd09 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md new file mode 100644 index 0000000000..32b1eb4251 --- /dev/null +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md @@ -0,0 +1,31 @@ +# Agent Note: DeepSeek request images on the published token grid + +Status: implemented + +English | [中文](2026-09-10-deepseek-v41-request-image-projection.zh.md) + +## Problem + +The harness projected every DeepSeek request image under a 640,000 total-pixel budget, a value chosen for the retired V4 vision model and kept unchanged when the [token estimator moved to the `v41` calculator](2026-09-10-deepseek-image-token-calculator-v41.md). The current Flash model retains far more: it pads each edge to whole 14px patches, groups 3×3 patches into one token cell, and keeps the largest aspect-preserving grid whose token count `rows × (columns + 1) + 2` fits 1024. A square image keeps 1302×1302 pixels, a 16:9 image keeps 1708×966, and extreme aspect ratios keep up to about 1.8 million pixels. The 640,000-pixel projection therefore sent a 2000×2000 screenshot as 800×800, roughly 38% of the pixels the model would have used, and the estimator priced that reduced version at 422 tokens instead of the 994 the model charges for the full grid. The Vision guide's "about 1300×1300 total pixels" describes only the square case; the exact rule is the token grid. + +Two smaller gaps sat beside it. The request version had no per-side cap: the provider rejects any image over 4096 pixels per side once a request carries 15 or more images, while normalization admits an 8192-pixel long edge, so a many-image session could fail on one thin image. The 1 MiB encoded-byte target was sized for 640,000-pixel outputs and would push a 1302×1302 photograph down the JPEG quality ladder. + +## Decision + +`ImageRequestPolicy` in `dsh-attachment` becomes a projection rule plus an optional per-side cap plus the byte target. The projection is a closed union: `pixel-budget` keeps the previous total-pixel geometry, and `token-grid` carries the patch size, downsampling ratio, and token cap of the provider grid. `request-projection.ts` owns the grid solver as `tokenGridProjection`, and `deepSeekImageTokens` in `llm-deepseek` reuses it for pricing, so the projection that sizes the request and the estimator that prices it are one solver. `requestImageDimensions` applies the projection, then the per-side cap, and keeps the source long edge exact while rounding the short edge; the local store resizes by the long edge only, so the encoded dimensions equal the predicted ones and the pricing handle text names what is actually sent. The provider pads the short edge to whole patches on its side. + +DeepSeek routes resolve the grid when `imagePixelBudget` is omitted, a `pixel-budget` projection for a positive integer or the 512×512 `low` preset, a 4096-pixel per-side cap on every request image so the image count never changes a projection, and a 2 MiB byte target. The pi-ai route keeps its 2048×2048 pixel budget. The request-image transform version moves to `request-image-v6`, and the cache descriptor records the projection fields in a fixed order and the per-side cap, so no earlier cache entry or upload mapping is reused. Sources within the grid are sent at their own dimensions; small images are never enlarged because the provider scales up below 544×544 pixels itself. + +## Alternatives considered + +**Raise the pixel budget to 1302×1302.** A total-pixel budget is right only for squares: a 16:9 source would be sent at 1.69 million pixels when the grid keeps 1.65 million, and a 4:1 source when it keeps 1.59 million, while extreme ratios would lose detail the grid keeps. One rule that reproduces the provider removes the guesswork. + +**Send the solver's exact dimensions with a fill resize.** The solved grid edges are whole patches and differ from the source aspect ratio by under one patch. Filling that box would distort the image slightly even though the provider does the same on its side; the issue requires the aspect ratio preserved, the padding on the provider side does not change the token count, and pricing reproduces the provider from the sent dimensions either way. + +**A function-valued projection on the policy.** The cache and upload identity is a digest over serialized policy fields, so the projection has to be data. + +**Keep the 1 MiB target.** The target is not a cap: an output over it is still sent at the smallest ladder quality. At 1302×1302 a JPEG photograph at quality 85 lands between 400 KB and 1.2 MB, so 2 MiB keeps most images at the top quality and lets more PNG screenshots pass through losslessly, while the inline base64 fallback still holds about seven such images under its 20 MiB bound. + +## Consequences + +A square source now reaches the model at up to 1302×1302 pixels and 994 tokens instead of 800×800 and 422, so image-heavy sessions reach compaction pressure sooner and the estimator matches provider usage for the sent version. Every existing request-image cache entry and DeepSeek Files API mapping is regenerated on the next request. Thin images keep their full grid until the per-side cap applies: an 8192×78 source costs 396 tokens under the grid but is sent as 4096×39. `llm-replay` does not project images, so keyless snapshots are unchanged, and the `llm-deepseek` adapter tests with mocked attachments pin the resolved policy and the projected handle text. diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md new file mode 100644 index 0000000000..0360dcc655 --- /dev/null +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md @@ -0,0 +1,31 @@ +# Agent Note: DeepSeek 请求图片按官方 token 网格投影 + +Status: implemented + +[English](2026-09-10-deepseek-v41-request-image-projection.md) | 中文 + +## 问题 + +harness 此前把每张 DeepSeek 请求图片投影到 640,000 总像素预算内。这个值是为已下线的 V4 视觉模型选的，[token 预估器改用 `v41` 计算器](2026-09-10-deepseek-image-token-calculator-v41.zh.md)时没有改动它。当前 Flash 模型保留的远多于此：它把每条边补齐到整数个 14 px patch，把 3×3 个 patch 归为一个 token 格，再保留 token 数 `rows × (columns + 1) + 2` 不超过 1024 的最大等比网格。正方形图片保留 1302×1302 像素，16:9 图片保留 1708×966，极端宽高比最多保留约 180 万像素。因此 640,000 像素投影把一张 2000×2000 的截图缩成 800×800 发出，只有模型本可使用像素的约 38%，预估器为这个缩小版计 422 token，而模型对完整网格收 994 token。图像理解指南里的「约 1300×1300 总像素」只描述正方形的情况，确切规则是 token 网格。 + +旁边还有两个较小的缺口。请求版本没有单边上限：请求包含 15 张及以上图片时，提供方拒绝任何单边超过 4096 像素的图片，而规范化允许 8192 像素长边，多图会话可能因一张细长图失败。1 MiB 编码字节目标是按 640,000 像素输出定的，会把 1302×1302 的照片压到 JPEG 质量阶梯的低档。 + +## 决策 + +`dsh-attachment` 里的 `ImageRequestPolicy` 改为投影规则加可选单边上限加字节目标。投影是封闭联合类型：`pixel-budget` 保留原来的总像素几何，`token-grid` 携带提供方网格的 patch 大小、降采样比和 token 上限。`request-projection.ts` 以 `tokenGridProjection` 承载网格求解器，`llm-deepseek` 的 `deepSeekImageTokens` 复用它计价，于是决定请求尺寸的投影和为它计价的预估器是同一个求解器。`requestImageDimensions` 先应用投影，再应用单边上限，保持源图长边精确、短边四舍五入；本地存储只按长边缩放，因此编码后的尺寸等于预测尺寸，计价用的句柄文本写的就是实际发送的尺寸。提供方在自己那侧把短边补齐到整数个 patch。 + +DeepSeek 路由在省略 `imagePixelBudget` 时解析为网格，正整数或 512×512 的 `low` 预设解析为 `pixel-budget` 投影，每张请求图片都加 4096 像素单边上限，使图片数量不会改变投影，字节目标为 2 MiB。pi-ai 路由保留 2048×2048 像素预算。请求图片变换版本升到 `request-image-v6`，缓存描述符按固定顺序记录投影字段和单边上限，因此之前的缓存条目和上传映射都不会被复用。网格内的源图按自身尺寸发送；小图不放大，因为提供方自己会放大 544×544 像素以下的图片。 + +## 备选方案 + +**把像素预算提高到 1302×1302。** 总像素预算只对正方形正确：16:9 的源图会按 169 万像素发送而网格只保留 165 万，4:1 的源图网格只保留 159 万，极端比例又会丢掉网格本会保留的细节。一条复现提供方的规则消除了猜测。 + +**用填充缩放发送求解器的精确尺寸。** 求解出的网格边长是整数个 patch，与源图宽高比相差不到一个 patch。填充到这个框会轻微变形，尽管提供方那侧也会这样做；issue 要求保持宽高比，提供方那侧的补齐不改变 token 数，而计价无论如何都从发送尺寸复现提供方。 + +**策略里放函数形式的投影。** 缓存和上传身份是序列化策略字段的摘要，投影必须是数据。 + +**保留 1 MiB 目标。** 目标不是上限：超过它的输出仍会以阶梯最小质量发送。1302×1302 的 JPEG 照片在质量 85 时约 400 KB 到 1.2 MB，2 MiB 让多数图片停在最高质量，也让更多 PNG 截图无损直发，而内联 base64 回退在 20 MiB 上界内仍能容纳约七张这样的图片。 + +## 后果 + +正方形源图现在最多以 1302×1302 像素、994 token 到达模型，而不是 800×800 和 422，因此图片密集的会话更早触及 compaction 压力，预估器对发送版本的计价与提供方 usage 一致。所有已有的请求图片缓存条目和 DeepSeek Files API 映射在下次请求时重新生成。细长图在单边上限生效前保留完整网格：8192×78 的源图在网格下计 396 token，但以 4096×39 发送。`llm-replay` 不投影图片，keyless 快照不变；`llm-deepseek` 适配器用 mock 附件的测试固定了解析出的策略和投影后的句柄文本。 diff --git a/docs/config-catalog.i18n.yaml b/docs/config-catalog.i18n.yaml index 35f35a3352..46500b4add 100644 --- a/docs/config-catalog.i18n.yaml +++ b/docs/config-catalog.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/config-catalog.md -config-catalog.md: 7c975892a0a5f04a80dd13186ef2b3732b419400 -config-catalog.zh.md: 57dac94311814e87a2bf7385c404811a910d3d4b +config-catalog.md: 259cbe8afe509cf448a54fa9fcddf297d4f2f588 +config-catalog.zh.md: 49e1064239f20fc6236c3dde6f2698791a9a1183 diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 7c975892a0..259cbe8afe 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -1079,7 +1079,11 @@ export interface DeepSeekCatalogModel { maxTokens?: number /** Accepted request modalities; omission is text-only. */ inputModalities?: ModelModality[] - /** Total-pixel budget for one deterministic request preview, or the 512-by-512 `low` preset. */ + /** + * Total-pixel budget replacing the published token-grid projection for one + * deterministic request preview, or the 512-by-512 `low` preset; omission + * projects onto the token grid. + */ imagePixelBudget?: number | 'low' /** Encoded-byte target for one deterministic request preview; the smallest quality-ladder output is used when no quality fits. */ imageMaxBytes?: number @@ -1094,7 +1098,7 @@ export interface DeepSeekCatalogModel { Depends on: [`ModelModality`](../packages/llm/llm/src/index.ts) · [`RetryPolicyConfig`](../packages/llm/llm/src/index.ts) · [`SystemPromptUpdate`](../packages/llm/llm/src/index.ts) -Source: [`packages/llm/llm-deepseek/src/index.ts:134`](../packages/llm/llm-deepseek/src/index.ts) +Source: [`packages/llm/llm-deepseek/src/index.ts:128`](../packages/llm/llm-deepseek/src/index.ts) diff --git a/docs/config-catalog.zh.md b/docs/config-catalog.zh.md index 57dac94311..49e1064239 100644 --- a/docs/config-catalog.zh.md +++ b/docs/config-catalog.zh.md @@ -1081,7 +1081,11 @@ export interface DeepSeekCatalogModel { maxTokens?: number /** Accepted request modalities; omission is text-only. */ inputModalities?: ModelModality[] - /** Total-pixel budget for one deterministic request preview, or the 512-by-512 `low` preset. */ + /** + * Total-pixel budget replacing the published token-grid projection for one + * deterministic request preview, or the 512-by-512 `low` preset; omission + * projects onto the token grid. + */ imagePixelBudget?: number | 'low' /** Encoded-byte target for one deterministic request preview; the smallest quality-ladder output is used when no quality fits. */ imageMaxBytes?: number @@ -1096,7 +1100,7 @@ export interface DeepSeekCatalogModel { 依赖：[`ModelModality`](../packages/llm/llm/src/index.ts) · [`RetryPolicyConfig`](../packages/llm/llm/src/index.ts) · [`SystemPromptUpdate`](../packages/llm/llm/src/index.ts) -来源：[`packages/llm/llm-deepseek/src/index.ts:134`](../packages/llm/llm-deepseek/src/index.ts) +来源：[`packages/llm/llm-deepseek/src/index.ts:128`](../packages/llm/llm-deepseek/src/index.ts) diff --git a/docs/subsystems/attachment.i18n.yaml b/docs/subsystems/attachment.i18n.yaml index 3e121e78c9..faa0c08226 100644 --- a/docs/subsystems/attachment.i18n.yaml +++ b/docs/subsystems/attachment.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/subsystems/attachment.md -attachment.md: 53b3e51e5b1c87625256178287061386342bc055 -attachment.zh.md: 549c06cc5abe542e5d6feeba10b24ebf6ba8dfd1 +attachment.md: bbcf438646eb4cae78ef5b86ccbf9e04b927fa55 +attachment.zh.md: 0e3c58fc59cb319bde681bdfa7124c852cb6da19 diff --git a/docs/subsystems/attachment.md b/docs/subsystems/attachment.md index 53b3e51e5b..bbcf438646 100644 --- a/docs/subsystems/attachment.md +++ b/docs/subsystems/attachment.md @@ -125,11 +125,51 @@ interface StoredImageAttachment { } ``` +```ts type-equiv +/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ +type ImageRequestProjection = + | { + /** Hard cap on width multiplied by height. */ + kind: 'pixel-budget' + /** Maximum width multiplied by height after projection. */ + maxPixels: number + } + | { + /** + * Largest aspect-preserving patch grid whose token count + * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. + */ + kind: 'token-grid' + /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ + patchSize: number + /** Patches per token cell along each axis. */ + downsampleRatio: number + /** Token cap for one image. */ + maxTokens: number + } +``` + +```ts type-equiv +/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ +interface TokenGridProjection { + /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ + width: number + /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + height: number + /** Tokens charged for the retained grid. */ + tokens: number + /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ + unscaled: boolean +} +``` + ```ts type-equiv /** Deterministic request-image policy selected by one exact model route. */ interface ImageRequestPolicy { - /** Maximum width multiplied by height after aspect-preserving projection. */ - maxPixels: number + /** Downscale rule applied before the per-side cap. */ + projection: ImageRequestProjection + /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ + maxDimension?: number /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ maxBytes: number } @@ -157,7 +197,7 @@ interface RequestImageAttachment { } ``` -`saveImage()` prepares and atomically commits a provider-independent normalized attachment before returning its `ImageAttachmentRef`. `saveImages()` prepares every validated attachment once before publishing the batch, so validation rejection leaves no partial objects and publication does not repeat decoding or quality selection. `admitPromptContent()` accepts the complete ordered Host prompt after file receipt resolution, replaces base64 image uploads with durable references, and passes durable file references unchanged. `admitEncodedImages()` supports other wire entries and delegates count, aggregate-byte, and ordered batch admission to `saveImages()`. `admitEncodedFile()` gives encoded protocol adapters the same service-owned canonical-base64 admission, and `isAttachmentError()` lets those adapters recognize stable attachment failures without importing implementation helpers. `readImage()` verifies a normalized attachment from an authorized session path. `imageHostPath()` exposes only the provider-owned host object location; it does not decide whether the current tool execution world can read it. `readImageRequest()` derives and caches one deterministic request version under an exact route pixel and byte budget. That version contains encoded bytes and metadata but no execution-world path. New entries are fully decoded before publication, while cache hits use a bounded metadata probe. Callers use `Promise.all` over the singular method when they need an ordered batch. The local implementation lazily encodes preferred candidates, singleflights equal request identities, lets each waiter cancel independently, stops shared work when no waiter remains, and bounds all transforms with its instance-level limiter, which defaults to two simultaneous transformations. The service is retention-neutral: resumed and forked sessions may share objects, so reference-aware garbage collection is deferred rather than tied to one session's deletion. +`saveImage()` prepares and atomically commits a provider-independent normalized attachment before returning its `ImageAttachmentRef`. `saveImages()` prepares every validated attachment once before publishing the batch, so validation rejection leaves no partial objects and publication does not repeat decoding or quality selection. `admitPromptContent()` accepts the complete ordered Host prompt after file receipt resolution, replaces base64 image uploads with durable references, and passes durable file references unchanged. `admitEncodedImages()` supports other wire entries and delegates count, aggregate-byte, and ordered batch admission to `saveImages()`. `admitEncodedFile()` gives encoded protocol adapters the same service-owned canonical-base64 admission, and `isAttachmentError()` lets those adapters recognize stable attachment failures without importing implementation helpers. `readImage()` verifies a normalized attachment from an authorized session path. `imageHostPath()` exposes only the provider-owned host object location; it does not decide whether the current tool execution world can read it. `readImageRequest()` derives and caches one deterministic request version under an exact route projection rule, optional per-side cap, and encoded-byte target. That version contains encoded bytes and metadata but no execution-world path. New entries are fully decoded before publication, while cache hits use a bounded metadata probe. Callers use `Promise.all` over the singular method when they need an ordered batch. The local implementation lazily encodes preferred candidates, singleflights equal request identities, lets each waiter cancel independently, stops shared work when no waiter remains, and bounds all transforms with its instance-level limiter, which defaults to two simultaneous transformations. The service is retention-neutral: resumed and forked sessions may share objects, so reference-aware garbage collection is deferred rather than tied to one session's deletion. @@ -280,7 +320,7 @@ fileHostPath(ref: FileAttachmentRef): string | undefined /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - exact route pixel budget and encoded-byte target; a target no ladder quality meets yields the smallest ladder output. + * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ diff --git a/docs/subsystems/attachment.zh.md b/docs/subsystems/attachment.zh.md index 549c06cc5a..0e3c58fc59 100644 --- a/docs/subsystems/attachment.zh.md +++ b/docs/subsystems/attachment.zh.md @@ -125,11 +125,51 @@ interface StoredImageAttachment { } ``` +```ts type-equiv +/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ +type ImageRequestProjection = + | { + /** Hard cap on width multiplied by height. */ + kind: 'pixel-budget' + /** Maximum width multiplied by height after projection. */ + maxPixels: number + } + | { + /** + * Largest aspect-preserving patch grid whose token count + * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. + */ + kind: 'token-grid' + /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ + patchSize: number + /** Patches per token cell along each axis. */ + downsampleRatio: number + /** Token cap for one image. */ + maxTokens: number + } +``` + +```ts type-equiv +/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ +interface TokenGridProjection { + /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ + width: number + /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + height: number + /** Tokens charged for the retained grid. */ + tokens: number + /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ + unscaled: boolean +} +``` + ```ts type-equiv /** Deterministic request-image policy selected by one exact model route. */ interface ImageRequestPolicy { - /** Maximum width multiplied by height after aspect-preserving projection. */ - maxPixels: number + /** Downscale rule applied before the per-side cap. */ + projection: ImageRequestProjection + /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ + maxDimension?: number /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ maxBytes: number } @@ -157,7 +197,7 @@ interface RequestImageAttachment { } ``` -`saveImage()` 准备并原子提交提供方无关的规范化附件，然后直接返回 `ImageAttachmentRef`。`saveImages()` 在发布批次前为每个成员各准备一次经过验证的附件，因此校验拒绝不会留下部分对象，发布也不会重复解码或选择质量。`admitPromptContent()` 在文件凭证解析后接收完整且有序的 Host prompt，把 base64 图片上传替换为持久引用，并让持久文件引用原样通过。`admitEncodedImages()` 支持其他 wire 入口，把张数、聚合字节和有序批量准入交给 `saveImages()`。`admitEncodedFile()` 让编码协议适配器使用服务拥有的规范 base64 准入，`isAttachmentError()` 让这些适配器无需导入实现辅助函数即可识别稳定的附件错误。`readImage()` 校验来自已授权会话路径的规范化附件。`imageHostPath()` 只公开提供方所持对象的宿主位置，不判断当前工具执行环境能否读取它。`readImageRequest()` 按确切路由的像素和字节预算派生并缓存确定性请求版本。该版本包含编码字节和元数据，不包含执行环境路径。新条目在发布前完整解码，缓存命中只做有界元数据探测。调用方需要有序批次时，对单数方法使用 `Promise.all`。本地实现按需编码首选候选、合并相同请求身份的并发任务、允许每个等待方单独取消、没有等待方时停止共享任务，并通过实例级限流器限制全部变换，默认同时执行两项。该服务不规定保留策略：恢复和 fork 后的会话可能共享对象，因此基于引用的垃圾回收会延期实现，不与单个会话的删除绑定。 +`saveImage()` 准备并原子提交提供方无关的规范化附件，然后直接返回 `ImageAttachmentRef`。`saveImages()` 在发布批次前为每个成员各准备一次经过验证的附件，因此校验拒绝不会留下部分对象，发布也不会重复解码或选择质量。`admitPromptContent()` 在文件凭证解析后接收完整且有序的 Host prompt，把 base64 图片上传替换为持久引用，并让持久文件引用原样通过。`admitEncodedImages()` 支持其他 wire 入口，把张数、聚合字节和有序批量准入交给 `saveImages()`。`admitEncodedFile()` 让编码协议适配器使用服务拥有的规范 base64 准入，`isAttachmentError()` 让这些适配器无需导入实现辅助函数即可识别稳定的附件错误。`readImage()` 校验来自已授权会话路径的规范化附件。`imageHostPath()` 只公开提供方所持对象的宿主位置，不判断当前工具执行环境能否读取它。`readImageRequest()` 按确切路由的投影规则、可选单边上限和编码字节目标派生并缓存确定性请求版本。该版本包含编码字节和元数据，不包含执行环境路径。新条目在发布前完整解码，缓存命中只做有界元数据探测。调用方需要有序批次时，对单数方法使用 `Promise.all`。本地实现按需编码首选候选、合并相同请求身份的并发任务、允许每个等待方单独取消、没有等待方时停止共享任务，并通过实例级限流器限制全部变换，默认同时执行两项。该服务不规定保留策略：恢复和 fork 后的会话可能共享对象，因此基于引用的垃圾回收会延期实现，不与单个会话的删除绑定。 @@ -280,7 +320,7 @@ fileHostPath(ref: FileAttachmentRef): string | undefined /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - exact route pixel budget and encoded-byte target; a target no ladder quality meets yields the smallest ladder output. + * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ diff --git a/docs/subsystems/llm-streaming.i18n.yaml b/docs/subsystems/llm-streaming.i18n.yaml index 8ae88da75e..a31580cd95 100644 --- a/docs/subsystems/llm-streaming.i18n.yaml +++ b/docs/subsystems/llm-streaming.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/subsystems/llm-streaming.md -llm-streaming.md: 77d3313b3c1a025f756e984453bd041abd7b0534 -llm-streaming.zh.md: cac7897ab412f45bd5b5ab20c6460644f18f4ff2 +llm-streaming.md: b3d2468a41833139e3c9c9ded69cbb863e5fd8d3 +llm-streaming.zh.md: 2d849206746ee44736ff402a364f913301ed87a8 diff --git a/docs/subsystems/llm-streaming.md b/docs/subsystems/llm-streaming.md index 77d3313b3c..b3d2468a41 100644 --- a/docs/subsystems/llm-streaming.md +++ b/docs/subsystems/llm-streaming.md @@ -249,7 +249,7 @@ interface LlmFailure { ## Request-image pricing -An adapter whose provider charges visual tokens for request images declares per-route pricing by overriding `LlmAdapter.imageRequestPricing`, and `ctx.llm.imageRequestPricing(provider, model)` resolves it synchronously for consumers. The token meter resolves the routed model's pricing on every measurement so compaction pressure, retention, and range selection price image history as the routed request actually sends it; the DeepSeek adapter reproduces its own request projection (per-model pixel budget, oldest-first offload) and prices retained images with the published vision accounting, while provider usage remains the authoritative anchor for completed requests. +An adapter whose provider charges visual tokens for request images declares per-route pricing by overriding `LlmAdapter.imageRequestPricing`, and `ctx.llm.imageRequestPricing(provider, model)` resolves it synchronously for consumers. The token meter resolves the routed model's pricing on every measurement so compaction pressure, retention, and range selection price image history as the routed request actually sends it; the DeepSeek adapter reproduces its own request projection (per-model projection and per-side cap, oldest-first offload) and prices retained images with the published vision accounting, while provider usage remains the authoritative anchor for completed requests. ```ts type-equiv /** diff --git a/docs/subsystems/llm-streaming.zh.md b/docs/subsystems/llm-streaming.zh.md index cac7897ab4..2d84920674 100644 --- a/docs/subsystems/llm-streaming.zh.md +++ b/docs/subsystems/llm-streaming.zh.md @@ -251,7 +251,7 @@ interface LlmFailure { ## 请求图片定价 -提供方对请求图片收取视觉 token 的适配器通过覆写 `LlmAdapter.imageRequestPricing` 声明按路由的定价，消费方经 `ctx.llm.imageRequestPricing(provider, model)` 同步解析。token 计量服务在每次计量时解析路由模型的定价，使 compaction 的压力、保留与选段都按路由请求实际发送的形式为图片历史计价；DeepSeek 适配器复现自身的请求投影（按模型的像素预算、最旧优先 offload），并用官方公布的视觉计量为保留图片定价，已完成请求仍以 provider usage 为权威锚点。 +提供方对请求图片收取视觉 token 的适配器通过覆写 `LlmAdapter.imageRequestPricing` 声明按路由的定价，消费方经 `ctx.llm.imageRequestPricing(provider, model)` 同步解析。token 计量服务在每次计量时解析路由模型的定价，使 compaction 的压力、保留与选段都按路由请求实际发送的形式为图片历史计价；DeepSeek 适配器复现自身的请求投影（按模型的投影与单边上限、最旧优先 offload），并用官方公布的视觉计量为保留图片定价，已完成请求仍以 provider usage 为权威锚点。 ```ts type-equiv /** diff --git a/packages/attachment/attachment-local/README.i18n.yaml b/packages/attachment/attachment-local/README.i18n.yaml index ebacfdd1df..9e2317f470 100644 --- a/packages/attachment/attachment-local/README.i18n.yaml +++ b/packages/attachment/attachment-local/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/attachment/attachment-local/README.md -README.md: a14490f855268cdaa65bc0d3d8968ece56d25bf3 -README.zh.md: 44e8205dfdc7debd625c1ad4819f56bcfbe94728 +README.md: 3689ee4d497cf2e6dbf74450a9ec71c5138170c3 +README.zh.md: 3c208d1626daa1d93c6e1cc6bd483ded21338f75 diff --git a/packages/attachment/attachment-local/README.md b/packages/attachment/attachment-local/README.md index a14490f855..3689ee4d49 100644 --- a/packages/attachment/attachment-local/README.md +++ b/packages/attachment/attachment-local/README.md @@ -85,7 +85,7 @@ Objects land at `/attachments/v1/objects//`; eq Admission accepts up to 20 images and 200 MiB of source bytes per message; one source may use up to 20 MiB, 64 million pixels, and 8192 pixels per side. It applies orientation, removes metadata and color profiles, and normalizes under a 2048×2048 total-pixel budget, an 8192-pixel long edge, and a 4 MiB encoded-byte target. Extreme aspect ratios therefore retain their short-edge resolution. Clean single-frame 8-bit sRGB/sRGBA PNG, JPEG, or WebP input already within those limits passes through byte-identically; GIF, animation, metadata, orientation, 16-bit PNG, and incompatible color spaces force conversion. -Request versions live below `/attachments/v1/request-images/`. `readImageRequest` scales without enlargement to a route pixel budget, then applies a separate encoded-byte target through the same alpha routing and quality ladder. Its cache identity includes the attachment id, transform version, budgets, and fixed encoder settings; cached bytes are header-probed for format, 8-bit sRGB/sRGBA, dimensions, and alpha facts, and a mismatch regenerates the entry. Concurrent callers share one transform and cache write, while cancellation stops shared work only when no waiter remains. `imageHostPath` derives the normalized object's host path, and the mounted filesystem may map that path into its execution world without writing it to durable history. +Request versions live below `/attachments/v1/request-images/`. `readImageRequest` scales without enlargement to the route projection, a total-pixel budget or a provider token grid, then to the route per-side cap; it resizes by the long edge only, so the encoder rounds the short edge exactly as the projection predicts, and then applies a separate encoded-byte target through the same alpha routing and quality ladder. Its cache identity includes the attachment id, transform version, projection, per-side cap, byte target, and fixed encoder settings; cached bytes are header-probed for format, 8-bit sRGB/sRGBA, dimensions, and alpha facts, and a mismatch regenerates the entry. Concurrent callers share one transform and cache write, while cancellation stops shared work only when no waiter remains. `imageHostPath` derives the normalized object's host path, and the mounted filesystem may map that path into its execution world without writing it to durable history. Generic-file bytes have one canonical object at `/attachments/v1/file-objects//`. Each reference path at `/attachments/v1/files///` is a read-only hard link, so different names for equal bytes do not duplicate disk content. `readFileStream` reads the reference path in bounded chunks and verifies the complete digest and recorded byte count before a consumer can finish successfully. A missing, changed, or truncated object fails its consumer instead of producing a complete export with different bytes. diff --git a/packages/attachment/attachment-local/README.zh.md b/packages/attachment/attachment-local/README.zh.md index 44e8205dfd..3c208d1626 100644 --- a/packages/attachment/attachment-local/README.zh.md +++ b/packages/attachment/attachment-local/README.zh.md @@ -85,7 +85,7 @@ kind: "package-reference" 准入允许每条消息最多 20 张图片与 200 MiB 源字节；单个源图最多 20 MiB、6400 万像素与单边 8192 像素。系统应用方向、移除元数据与色彩配置，并把规范化结果限制在 2048×2048 总像素预算、8192 像素长边和 4 MiB 编码字节目标内，因此，即使宽高比极端，图片也会保留短边分辨率。已经满足限制的干净、单帧、8-bit sRGB/sRGBA PNG、JPEG 或 WebP 会逐字节直通；GIF、动画、元数据、方向、16-bit PNG 与不兼容色彩空间会触发转换。 -请求版本位于 `/attachments/v1/request-images/`。`readImageRequest` 在不放大的前提下缩放到路由像素预算，再通过相同的 alpha 路由与质量阶梯应用独立编码字节目标。缓存身份包含附件 id、变换版本、预算与固定编码参数；缓存字节会先通过文件头探测格式、8-bit sRGB/sRGBA、尺寸与 alpha 信息，不匹配时重新生成。并发调用方共享一次变换与缓存写入，且只在没有等待方时由取消停止共享工作。`imageHostPath` 派生规范化对象的宿主路径，挂载的文件系统可以把该路径映射进执行世界，而不会写入持久历史。 +请求版本位于 `/attachments/v1/request-images/`。`readImageRequest` 在不放大的前提下先缩放到路由投影，即总像素预算或提供方 token 网格，再缩放到路由单边上限。缩放只按长边给定，短边由编码器四舍五入，与投影预测的尺寸一致。随后通过相同的 alpha 路由与质量阶梯应用独立编码字节目标。缓存身份包含附件 id、变换版本、投影、单边上限、字节目标与固定编码参数；缓存字节会先通过文件头探测格式、8-bit sRGB/sRGBA、尺寸与 alpha 信息，不匹配时重新生成。并发调用方共享一次变换与缓存写入，且只在没有等待方时由取消停止共享工作。`imageHostPath` 派生规范化对象的宿主路径，挂载的文件系统可以把该路径映射进执行世界，而不会写入持久历史。 通用文件字节的唯一规范对象位于 `/attachments/v1/file-objects//`。每条引用路径 `/attachments/v1/files///` 都是只读硬链接，所以名称不同但字节相同的文件不会重复占用磁盘。`readFileStream` 以有界分块读取引用路径，并在消费方成功结束前校验完整摘要与记录的字节数。对象缺失、被改写或截断时，消费方会失败，不会得到字节已经变化的完整导出。 diff --git a/packages/attachment/attachment/README.i18n.yaml b/packages/attachment/attachment/README.i18n.yaml index 6a5e2093df..bab63d6a8a 100644 --- a/packages/attachment/attachment/README.i18n.yaml +++ b/packages/attachment/attachment/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/attachment/attachment/README.md -README.md: 35fde71833fa13b26662244cfa68cec17b90b663 -README.zh.md: b0e98d1e4a0c35082a8eef23f69659f47916d3f7 +README.md: e17d6bea53127d54babad919bdd546388b742d5f +README.zh.md: 5bf061304684cbdd8be00709ba9d1224b6c68ffa diff --git a/packages/attachment/attachment/README.md b/packages/attachment/attachment/README.md index 35fde71833..e17d6bea53 100644 --- a/packages/attachment/attachment/README.md +++ b/packages/attachment/attachment/README.md @@ -66,13 +66,13 @@ This section explains the design decisions behind the seam and the service opera - **Normalize and persist before event.** Every source is prepared and verified before the batch publishes in order, so the session log never references a partial or failed normalization. - **Immutable and retention-neutral.** Objects are immutable once published; resumed and forked sessions may share them, so reference-aware garbage collection is deferred rather than tied to any one session's deletion. - **Verify on read.** Reads check bytes and metadata against the logged reference before returning them, and request projections fully decode cached bytes, so a missing, corrupted, or swapped object fails closed. -- **Role-neutral image blocks.** The `ImageBlock` content block in `dsh-llm` carries an `ImageAttachmentRef`; provider adapters resolve it into deterministic request versions with explicit pixel and byte budgets, while execution filesystems may map the immutable host object to a model-readable process path. +- **Role-neutral image blocks.** The `ImageBlock` content block in `dsh-llm` carries an `ImageAttachmentRef`; provider adapters resolve it into deterministic request versions under an explicit projection rule, per-side cap, and byte target, while execution filesystems may map the immutable host object to a model-readable process path. - **Error routing by code.** `AttachmentError` re-implements the `HarnessError` shape instead of extending it because the base lives in `dsh-llm`, which depends on this package; consumers use `isAttachmentError` and route on `code`, never on the prototype chain. - **Files are verbatim, images are normalized.** `saveFile` commits an existing byte array, `saveFileStream` commits bounded chunks with backpressure and cancellation, `readFileStream` verifies and returns bounded chunks, and `fileHostPath` locates the stored object for read-on-demand projection; neither file write path applies admission limits. The image path keeps its separate normalization, limits, and request-version pipeline. The `FileBlock` content block in `dsh-llm` carries a `FileAttachmentRef`, and request assembly projects it to deterministic handle text for every route. ### Service operations -The service family runs one admission-and-storage flow: every entry point enforces source batch limits and canonical base64, prepares provider-independent normalized attachments before publishing any member, and commits them durably in input order without partial results. Host prompt consumers pass ordered text, encoded images, and already resolved file references to `ctx.attachments.admitPromptContent()`; the method persists images and passes file references unchanged. Encoded protocol adapters call `ctx.attachments.admitEncodedFile()`, which checks canonical base64 before delegating to `saveFile`; adapters recognize attachment failures through `ctx.attachments.isAttachmentError()`. Generic-file callers choose `saveFile` for existing bytes or `saveFileStream` for a bounded asynchronous byte source; both return the same durable reference, while `readFileStream` verifies its digest and length during a bounded read. `readImageRequest` derives deterministic route-sized variants whose identity includes the attachment id, transform version, pixel and byte budgets, and encoder settings. The pure `requestImageDimensions` export computes each projection's aspect-preserving dimensions from a total-pixel budget, so providers and request pricing share one geometry. `imageHostPath` exposes an implementation-owned host location only to trusted same-process consumers that need execution-world mapping. Callers compose ordered batches while the implementation owns compression concurrency, caching, and singleflight. Reads, streamed writes, and projections preserve caller cancellation. Failures carry stable machine-readable codes, and the caller-correctable admission subset is recognizable at runtime so each protocol adapter maps its own vocabulary; the exact per-operation contracts live in [`src/index.ts`](src/index.ts) and [`src/error.ts`](src/error.ts). +The service family runs one admission-and-storage flow: every entry point enforces source batch limits and canonical base64, prepares provider-independent normalized attachments before publishing any member, and commits them durably in input order without partial results. Host prompt consumers pass ordered text, encoded images, and already resolved file references to `ctx.attachments.admitPromptContent()`; the method persists images and passes file references unchanged. Encoded protocol adapters call `ctx.attachments.admitEncodedFile()`, which checks canonical base64 before delegating to `saveFile`; adapters recognize attachment failures through `ctx.attachments.isAttachmentError()`. Generic-file callers choose `saveFile` for existing bytes or `saveFileStream` for a bounded asynchronous byte source; both return the same durable reference, while `readFileStream` verifies its digest and length during a bounded read. `readImageRequest` derives deterministic route-sized variants whose identity includes the attachment id, transform version, projection rule, per-side cap, byte target, and encoder settings. The pure `requestImageDimensions` and `tokenGridProjection` exports compute each projection's aspect-preserving dimensions from a total-pixel budget or a provider token grid, so providers and request pricing share one geometry. `imageHostPath` exposes an implementation-owned host location only to trusted same-process consumers that need execution-world mapping. Callers compose ordered batches while the implementation owns compression concurrency, caching, and singleflight. Reads, streamed writes, and projections preserve caller cancellation. Failures carry stable machine-readable codes, and the caller-correctable admission subset is recognizable at runtime so each protocol adapter maps its own vocabulary; the exact per-operation contracts live in [`src/index.ts`](src/index.ts) and [`src/error.ts`](src/error.ts). ### Source map diff --git a/packages/attachment/attachment/README.zh.md b/packages/attachment/attachment/README.zh.md index b0e98d1e4a..5bf0613046 100644 --- a/packages/attachment/attachment/README.zh.md +++ b/packages/attachment/attachment/README.zh.md @@ -66,13 +66,13 @@ kind: "package-reference" - **事件前完成规范化与持久化。** 每个源图都会在批次按序发布前完成准备与校验，因此会话日志绝不会引用部分完成或规范化失败的对象。 - **不可变且保留策略中立。** 对象一经发布即不可变；恢复和 fork 后的会话可能共享它们，因此引用感知的垃圾回收被推迟，而不是与任何单个会话的删除绑定。 - **读取时校验。** 读取在返回前把字节和元数据与记录的引用比对，请求投影还会完整解码缓存字节，因此缺失、损坏或被替换的对象不会通过校验。 -- **角色无关的图片块。** `dsh-llm` 中的 `ImageBlock` 内容块携带 `ImageAttachmentRef`；提供方适配器以显式像素与字节预算把引用解析为确定性请求版本，执行文件系统则可以把不可变宿主对象映射为模型可读的进程路径。 +- **角色无关的图片块。** `dsh-llm` 中的 `ImageBlock` 内容块携带 `ImageAttachmentRef`；提供方适配器按显式的投影规则、单边上限与字节目标把引用解析为确定性请求版本，执行文件系统则可以把不可变宿主对象映射为模型可读的进程路径。 - **按错误码路由。** `AttachmentError` 重新实现 `HarnessError` 的结构而不是继承它，因为基类位于 `dsh-llm`，而后者依赖本包；消费方用 `isAttachmentError` 识别错误并按 `code` 路由，绝不依赖原型链。 - **文件原样，图片规范化。**`saveFile` 提交已有字节数组，`saveFileStream` 以背压和取消语义提交有界分块，`readFileStream` 校验并返回有界分块，`fileHostPath` 定位存储对象供按需读取投影；两种文件写入路径都不设准入限制。图片路径保留其独立的规范化、限额与请求版本流水线。`dsh-llm` 中的 `FileBlock` 内容块承载 `FileAttachmentRef`，请求组装会为每条路由将其投影为确定性的句柄文本。 ### 服务操作 -服务族运行同一条准入与存储流程：每个入口都强制执行源批次限制与规范 base64，在发布任何成员前准备提供方无关的规范化附件，再按输入顺序持久提交而不产生部分结果。Host 提示词消费方把有序文本、编码图片和已经解析的文件引用交给 `ctx.attachments.admitPromptContent()`；该方法持久化图片，并让文件引用原样通过。编码协议适配器调用 `ctx.attachments.admitEncodedFile()`，由该方法检查规范 base64 后委托给 `saveFile`；适配器通过 `ctx.attachments.isAttachmentError()` 识别附件错误。通用文件调用方可以用 `saveFile` 提交已有字节，或用 `saveFileStream` 提交有界异步字节源；两者返回相同的持久引用，`readFileStream` 则在有界读取过程中校验摘要与长度。`readImageRequest` 派生确定性的路由尺寸变体，其身份包含附件 id、变换版本、像素与字节预算及编码参数。纯函数导出 `requestImageDimensions` 会按总像素预算计算每个投影保持宽高比的尺寸，使提供方与请求定价共享同一套几何计算。`imageHostPath` 只向需要把该位置映射到执行环境的受信任同进程消费方暴露实现拥有的宿主位置。调用方组合有序批次，而实现负责管理压缩并发、缓存与 singleflight。读取、流式写入和投影保留调用方的取消语义。失败带有稳定且机器可读的错误码，运行时即可识别可由调用方修正的准入子集，让每个协议适配器映射自己的词汇；各操作的确切约定见 [`src/index.ts`](src/index.ts) 与 [`src/error.ts`](src/error.ts)。 +服务族运行同一条准入与存储流程：每个入口都强制执行源批次限制与规范 base64，在发布任何成员前准备提供方无关的规范化附件，再按输入顺序持久提交而不产生部分结果。Host 提示词消费方把有序文本、编码图片和已经解析的文件引用交给 `ctx.attachments.admitPromptContent()`；该方法持久化图片，并让文件引用原样通过。编码协议适配器调用 `ctx.attachments.admitEncodedFile()`，由该方法检查规范 base64 后委托给 `saveFile`；适配器通过 `ctx.attachments.isAttachmentError()` 识别附件错误。通用文件调用方可以用 `saveFile` 提交已有字节，或用 `saveFileStream` 提交有界异步字节源；两者返回相同的持久引用，`readFileStream` 则在有界读取过程中校验摘要与长度。`readImageRequest` 派生确定性的路由尺寸变体，其身份包含附件 id、变换版本、投影规则、单边上限、字节目标及编码参数。纯函数导出 `requestImageDimensions` 与 `tokenGridProjection` 按总像素预算或提供方 token 网格计算每个投影保持宽高比的尺寸，使提供方与请求定价共享同一套几何计算。`imageHostPath` 只向需要把该位置映射到执行环境的受信任同进程消费方暴露实现拥有的宿主位置。调用方组合有序批次，而实现负责管理压缩并发、缓存与 singleflight。读取、流式写入和投影保留调用方的取消语义。失败带有稳定且机器可读的错误码，运行时即可识别可由调用方修正的准入子集，让每个协议适配器映射自己的词汇；各操作的确切约定见 [`src/index.ts`](src/index.ts) 与 [`src/error.ts`](src/error.ts)。 ### 源码地图 diff --git a/packages/llm/llm-deepseek/README.i18n.yaml b/packages/llm/llm-deepseek/README.i18n.yaml index a33c4084ce..734062fae9 100644 --- a/packages/llm/llm-deepseek/README.i18n.yaml +++ b/packages/llm/llm-deepseek/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/llm/llm-deepseek/README.md -README.md: 41646097f80dfad9cc523595b9d2820c28fde66b -README.zh.md: c7a1e40952dff7a804880dcd266114cecb20918f +README.md: c99431b0d415ef82d4833d7ca38b531b3cd38937 +README.zh.md: 1d515c5ee8a855981e529b7fff03cbf18fa9dde7 diff --git a/packages/llm/llm-deepseek/README.md b/packages/llm/llm-deepseek/README.md index 41646097f8..c99431b0d4 100644 --- a/packages/llm/llm-deepseek/README.md +++ b/packages/llm/llm-deepseek/README.md @@ -74,7 +74,7 @@ The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-a ### Streaming with thinking and images -An image-capable route resolves each durable reference into a deterministic request version under its pixel and byte budgets. `imagePixelBudget` accepts a positive integer or `low`; omission uses 640,000 total pixels, `low` uses 512×512 total pixels, and `imageMaxBytes` defaults to 1 MiB. Alpha images use WebP effort 0 and opaque images use JPEG on the 85/75/60 quality ladder, keeping the smallest output when every candidate exceeds the target. Every retained image is preceded by text naming its complete attachment id and actual request dimensions. When the current filesystem maps the attachment provider's host object, that text also carries a read-only execution-world path and the extension for a writable copy. Text-only and unlisted routes receive stable attachment placeholders while durable history keeps the image references. +An image-capable route resolves each durable reference into a deterministic request version under its projection, per-side cap, and byte target. Omitting `imagePixelBudget` projects onto the published vision token grid of 14px patches, 3:1 downsampling, and at most 1024 tokens per image, so a square image keeps up to 1302×1302 pixels and other aspect ratios keep the largest grid inside the cap; a positive integer replaces the grid with a total-pixel budget, and `low` uses 512×512 total pixels. Every request image is capped at 4096 pixels per side, the provider limit for requests carrying 15 or more images, and `imageMaxBytes` defaults to 2 MiB. Alpha images use WebP effort 0 and opaque images use JPEG on the 85/75/60 quality ladder, keeping the smallest output when every candidate exceeds the target. Every retained image is preceded by text naming its complete attachment id and actual request dimensions. When the current filesystem maps the attachment provider's host object, that text also carries a read-only execution-world path and the extension for a writable copy. Text-only and unlisted routes receive stable attachment placeholders while durable history keeps the image references. The adapter normally uploads those exact request bytes through the DeepSeek Files API and sends file-id blocks. A failed or timed-out file resolution rebuilds the whole chat request with the same request versions as base64 data URLs; one request never mixes file ids and inline images. Cached ids are scoped by endpoint and API key, refreshed before expiry, invalidated from provider stale-file errors, and resolved through singleflight with waiter-local cancellation. Quota failure deletes one configured batch of the oldest harness-owned files before one upload retry. @@ -190,8 +190,6 @@ These limits define where the adapter stops and future work begins. They are cur - **Images are input-only durable attachments** — direct external URLs and assistant image output are not supported; DeepSeek input normally uses the Files API and uses inline base64 only for per-request recovery. - The default catalog pre-registers `deepseek-flash` and its text/image and in-history capabilities without probing gateway availability. Requests can fail with `INVALID_REQUEST` until the gateway enables the id. With `DEEPSEEK_API_KEY` and a supporting gateway configured, `DEEPSEEK_FLASH_E2E=1` enables the Chat Completions check in [this package's e2e suite](tests/adapter.e2e.ts). -- The default request-image projection caps total pixels at 640,000, below the provider's roughly 1300×1300 processing budget, so it can discard usable detail. Each model's `imagePixelBudget` can override this default; changing the default affects request content and needs separate snapshot verification ([decision](../../../.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md)). - ### Dev Note diff --git a/packages/llm/llm-deepseek/README.zh.md b/packages/llm/llm-deepseek/README.zh.md index c7a1e40952..1d515c5ee8 100644 --- a/packages/llm/llm-deepseek/README.zh.md +++ b/packages/llm/llm-deepseek/README.zh.md @@ -74,7 +74,7 @@ kind: "package-reference" ### 带 thinking 与图片的流式调用 -支持图片的路由会在自身像素与字节预算内把每个持久引用解析为确定性请求版本。`imagePixelBudget` 接受正整数或 `low`；省略时使用总计 640,000 像素，`low` 使用总计 512×512 像素，`imageMaxBytes` 默认为 1 MiB。带 alpha 的图片使用 effort 0 的 WebP，不透明图片使用 JPEG，并采用 85/75/60 质量阶梯；全部候选都超过目标时保留最小输出。每张保留图片前都有文本，注明完整附件 id 与实际请求尺寸。当前文件系统可以映射附件提供方的宿主对象时，该文本还携带只读执行世界路径与可写副本使用的扩展名。纯文本与未列出路由接收稳定附件占位符，而持久历史继续保留图片引用。 +支持图片的路由会在自身投影、单边上限与字节目标内把每个持久引用解析为确定性请求版本。省略 `imagePixelBudget` 时按官方公布的视觉 token 网格投影，即 14 px patch、3:1 降采样、单图最多 1024 token，因此正方形图片最多保留 1302×1302 像素，其他宽高比保留上限内最大的网格；正整数会用总像素预算取代网格，`low` 使用总计 512×512 像素。每张请求图片单边最多 4096 像素，这是提供方对包含 15 张及以上图片的请求的限制；`imageMaxBytes` 默认为 2 MiB。带 alpha 的图片使用 effort 0 的 WebP，不透明图片使用 JPEG，并采用 85/75/60 质量阶梯；全部候选都超过目标时保留最小输出。每张保留图片前都有文本，注明完整附件 id 与实际请求尺寸。当前文件系统可以映射附件提供方的宿主对象时，该文本还携带只读执行世界路径与可写副本使用的扩展名。纯文本与未列出路由接收稳定附件占位符，而持久历史继续保留图片引用。 适配器通常通过 DeepSeek Files API 上传这些确切请求字节，并发送 file-id 块。文件解析失败或超时会用相同请求版本的 base64 data URL 重建整份 chat 请求；一次请求绝不混用 file id 与内联图片。缓存 id 按端点与 API key 限定作用域，在到期前刷新，根据提供方的陈旧文件错误失效，并通过带等待方局部取消的 singleflight 解析。配额失败会先删除一批配置数量的最旧 harness 文件，再重试一次上传。 @@ -190,8 +190,6 @@ loop 保留的响应块会追加到下一个请求，并保留其更早的可复 - **图片是仅用于输入的持久附件**——不支持直接外部 URL 与 assistant 图片输出；DeepSeek 输入通常使用 Files API，仅在单次请求恢复时使用内联 base64。 - 默认目录预注册 `deepseek-flash` 及其文本、图片和历史内更新能力，不探测网关可用性。网关开放该 ID 前，请求可能以 `INVALID_REQUEST` 失败。配置 `DEEPSEEK_API_KEY` 和支持该 ID 的网关后，设置 `DEEPSEEK_FLASH_E2E=1` 可启用[本包 e2e 测试文件](tests/adapter.e2e.ts)中的 Chat Completions 协议验证。 -- 默认请求图片投影限制为 640,000 总像素，低于提供方约 1300×1300 的处理预算，可能丢弃可用细节。每个模型的 `imagePixelBudget` 可以覆盖默认值。更改默认值会改变请求内容，需要单独验证快照（[决策](../../../.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md)）。 - ### 开发备注 diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json index e7436d98be..cd6f18083a 100644 --- a/scripts/type-equiv.manifest.json +++ b/scripts/type-equiv.manifest.json @@ -1001,6 +1001,16 @@ "symbol": "StoredImageAttachment", "source": "packages/attachment/attachment/src/types.ts" }, + { + "doc": "docs/subsystems/attachment.md", + "symbol": "ImageRequestProjection", + "source": "packages/attachment/attachment/src/types.ts" + }, + { + "doc": "docs/subsystems/attachment.md", + "symbol": "TokenGridProjection", + "source": "packages/attachment/attachment/src/types.ts" + }, { "doc": "docs/subsystems/attachment.md", "symbol": "ImageRequestPolicy", From ba30b73f7b387d153ee46744ad1e8babd5d5debd Mon Sep 17 00:00:00 2001 From: creatixchu Date: Thu, 10 Sep 2026 16:46:28 +0800 Subject: [PATCH 07/26] =?UTF-8?q?refactor(attachment):=20=E6=B1=82?= =?UTF-8?q?=E8=A7=A3=E5=99=A8=E7=95=99=E5=9C=A8=20llm-deepseek=EF=BC=8C?= =?UTF-8?q?=E5=AD=98=E5=82=A8=E5=B1=82=E5=8F=AA=E6=8E=A5=E6=94=B6=E7=9B=AE?= =?UTF-8?q?=E6=A0=87=E5=B0=BA=E5=AF=B8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ImageRequestPolicy 改为 ImageRequestTarget，只含目标宽、高和字节目标；dsh-attachment 删除 token-grid 投影联合和 tokenGridProjection，只保留提供方无关的 requestImageDimensions 与 longEdgeDimensions。v41 求解器回到 llm-deepseek 的 image-tokens.ts，新增 deepSeekRequestImageDimensions，resolveRequestImageTarget 为每张图算出目标并加 4096 单边上限；pi-ai 路由按自身像素预算推导目标。 按 review 意见修正：v41 计价 Note 里已删除常量的过期句子就地改写；ProjectedDimensions 登记到 attachment 子系统页与 type-equiv 清单；Note 区分发送尺寸与提供方补齐后的网格；短边取整的措辞改为「按路由预测」。 --- ...pseek-image-token-calculator-v41.i18n.yaml | 4 +- ...-10-deepseek-image-token-calculator-v41.md | 2 +- ...-deepseek-image-token-calculator-v41.zh.md | 2 +- ...eek-v41-request-image-projection.i18n.yaml | 4 +- ...0-deepseek-v41-request-image-projection.md | 12 +- ...eepseek-v41-request-image-projection.zh.md | 12 +- docs/config-catalog.i18n.yaml | 4 +- docs/config-catalog.md | 2 +- docs/config-catalog.zh.md | 2 +- docs/subsystems/attachment.i18n.yaml | 4 +- docs/subsystems/attachment.md | 56 ++----- docs/subsystems/attachment.zh.md | 56 ++----- docs/subsystems/llm-streaming.i18n.yaml | 4 +- docs/subsystems/llm-streaming.md | 2 +- docs/subsystems/llm-streaming.zh.md | 2 +- .../attachment-local/README.i18n.yaml | 4 +- .../attachment/attachment-local/README.md | 2 +- .../attachment/attachment-local/README.zh.md | 2 +- .../attachment/attachment-local/src/index.ts | 12 +- .../attachment-local/src/normalization.ts | 12 +- .../attachment-local/src/request-image.ts | 85 ++++------ .../attachment-local/tests/index.spec.ts | 2 +- .../tests/request-image-verification.spec.ts | 2 +- .../tests/request-image.spec.ts | 71 ++++---- .../attachment/attachment/README.i18n.yaml | 4 +- packages/attachment/attachment/README.md | 4 +- packages/attachment/attachment/README.zh.md | 4 +- packages/attachment/attachment/src/index.ts | 14 +- .../attachment/src/request-projection.ts | 126 +++----------- packages/attachment/attachment/src/types.ts | 42 +---- .../attachment/attachment/tests/index.spec.ts | 8 +- .../tests/request-projection.spec.ts | 70 ++------ .../extensions/tool-cordis/src/api-catalog.ts | 12 +- packages/llm/llm-deepseek/README.i18n.yaml | 4 +- packages/llm/llm-deepseek/README.md | 2 +- packages/llm/llm-deepseek/README.zh.md | 2 +- packages/llm/llm-deepseek/src/adapter.ts | 11 +- packages/llm/llm-deepseek/src/image-tokens.ts | 154 +++++++++++++++--- packages/llm/llm-deepseek/src/index.ts | 5 +- .../llm/llm-deepseek/src/request-pricing.ts | 62 ++++--- .../llm/llm-deepseek/tests/adapter.e2e.ts | 4 +- .../llm/llm-deepseek/tests/adapter.spec.ts | 31 ++-- .../llm-deepseek/tests/dynamic-config.spec.ts | 4 +- .../llm-deepseek/tests/image-tokens.spec.ts | 25 ++- packages/llm/llm-pi-ai/src/adapter.ts | 2 +- packages/llm/llm-pi-ai/src/context.ts | 24 ++- packages/llm/llm-pi-ai/tests/adapter.spec.ts | 9 +- packages/llm/llm-pi-ai/tests/context.spec.ts | 4 +- packages/llm/llm-pi-ai/tests/convert.spec.ts | 10 +- .../llm/llm-pi-ai/tests/provider-apis.e2e.ts | 4 +- scripts/gen-cordis-catalog.ts | 3 +- scripts/type-equiv.manifest.json | 11 +- 52 files changed, 463 insertions(+), 552 deletions(-) diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml index 37a4a4b687..2ff4007876 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md -2026-09-10-deepseek-image-token-calculator-v41.md: 4e57118987ddb7c2e2574d0dc40b02d8acf49e1a -2026-09-10-deepseek-image-token-calculator-v41.zh.md: 209ddb99616d5d94fd4f390706304a722137bd15 +2026-09-10-deepseek-image-token-calculator-v41.md: 668738221ebe3e634be7e4fe9d07c9627e0ceb4a +2026-09-10-deepseek-image-token-calculator-v41.zh.md: a483282c6da667c2b8e32accb091e065419d44fc diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md index 4e57118987..668738221e 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.md @@ -12,7 +12,7 @@ English | [中文](2026-09-10-deepseek-image-token-calculator-v41.zh.md) `image-tokens.ts` is rewritten as a verbatim port of the `v41` configuration. The constants are a 14px patch, 3:1 per-axis downsampling, a 544×544 total-pixel floor, and a 1024-token cap. The grid formula is `rows × (cols + 1) + 2` with no odd-row extra row, no parity correction, and no even-row trimming in the solver. There is no alignment pad, so the estimate is exact rather than a worst-case upper bound, and there is no aspect-ratio clamp, so extreme aspect ratios reach the cap through the solver's one-row and one-column branches. The over-budget path is a single closed-form solve followed by the published assertion; the decrementing retry loop existed only for the odd-row layout. The provider's fixpoint iteration over the projected dimensions is unchanged. -The test vectors are re-pinned from the published calculator. The request-pricing tests, package README, and this note carry the new numbers; the pixel budget the harness applies before pricing (`DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET`, 640,000 total pixels) and the catalog model ids are unchanged. +The test vectors are re-pinned from the published calculator. The request-pricing tests, package README, and this note carry the new numbers. This change left the 640,000 total-pixel projection the harness applied before pricing and the catalog model ids as they were; the [successor](2026-09-10-deepseek-v41-request-image-projection.md) later replaced that projection with the same grid, so omitting `imagePixelBudget` now projects onto the token grid while a positive integer or `low` keeps a total-pixel budget. ## Alternatives considered diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md index 209ddb9961..a483282c6d 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-image-token-calculator-v41.zh.md @@ -12,7 +12,7 @@ Status: implemented `image-tokens.ts` 重写为 `v41` 配置的逐句移植。常量为 14px patch、每轴 3:1 降采样、544×544 总像素下限、1024 token 上限。网格公式为 `rows × (cols + 1) + 2`，没有奇数行额外行、没有奇偶校正、求解器也不再把行数截成偶数。没有对齐 pad，所以估算值是精确值而非最坏情况上界；没有宽高比钳制，所以极端长宽比会经求解器的单行和单列分支到达上限。超预算路径是一次闭式求解加上公开的断言；逐步递减的重试循环只服务于奇数行布局。提供方对投影尺寸的定点迭代保持不变。 -测试向量按公开计算器重新固定。request-pricing 测试、包 README 和本 note 使用新数字；harness 在定价前应用的像素预算（`DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET`，640,000 总像素）和 catalog 模型 id 不变。 +测试向量按公开计算器重新固定。request-pricing 测试、包 README 和本 note 使用新数字。本次改动保留了 harness 在定价前应用的 640,000 总像素投影和 catalog 模型 id；[后续决策](2026-09-10-deepseek-v41-request-image-projection.zh.md)把该投影换成了同一套网格，现在省略 `imagePixelBudget` 走 token 网格，正整数或 `low` 仍走总像素预算。 ## 备选方案 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml index 2a3977f21e..964d3e2a81 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md -2026-09-10-deepseek-v41-request-image-projection.md: 32b1eb4251ec12005879551bfad363a98034291b -2026-09-10-deepseek-v41-request-image-projection.zh.md: 0360dcc655e1b366ca7169784b63e2650ee3dd09 +2026-09-10-deepseek-v41-request-image-projection.md: 87f79f244dcf61039fe27ef170ba654ee7a1a62a +2026-09-10-deepseek-v41-request-image-projection.zh.md: a5d8a4e99a3c7b4f3fc26f385ae1e764b535fe15 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md index 32b1eb4251..87f79f244d 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md @@ -6,26 +6,26 @@ English | [中文](2026-09-10-deepseek-v41-request-image-projection.zh.md) ## Problem -The harness projected every DeepSeek request image under a 640,000 total-pixel budget, a value chosen for the retired V4 vision model and kept unchanged when the [token estimator moved to the `v41` calculator](2026-09-10-deepseek-image-token-calculator-v41.md). The current Flash model retains far more: it pads each edge to whole 14px patches, groups 3×3 patches into one token cell, and keeps the largest aspect-preserving grid whose token count `rows × (columns + 1) + 2` fits 1024. A square image keeps 1302×1302 pixels, a 16:9 image keeps 1708×966, and extreme aspect ratios keep up to about 1.8 million pixels. The 640,000-pixel projection therefore sent a 2000×2000 screenshot as 800×800, roughly 38% of the pixels the model would have used, and the estimator priced that reduced version at 422 tokens instead of the 994 the model charges for the full grid. The Vision guide's "about 1300×1300 total pixels" describes only the square case; the exact rule is the token grid. +The harness projected every DeepSeek request image under a 640,000 total-pixel budget, a value chosen for the retired V4 vision model and kept unchanged when the [token estimator moved to the `v41` calculator](2026-09-10-deepseek-image-token-calculator-v41.md). The current Flash model retains far more: it pads each edge to whole 14px patches, groups 3×3 patches into one token cell, and keeps the largest aspect-preserving grid whose token count `rows × (columns + 1) + 2` fits 1024. A square image keeps 1302×1302 pixels, a 16:9 image keeps a 1708×966 grid, and extreme aspect ratios keep up to about 1.8 million pixels. The 640,000-pixel projection therefore sent a 2000×2000 screenshot as 800×800, roughly 38% of the pixels the model would have used, and the estimator priced that reduced version at 422 tokens instead of the 994 the model charges for the full grid. The Vision guide's "about 1300×1300 total pixels" describes only the square case; the exact rule is the token grid. Two smaller gaps sat beside it. The request version had no per-side cap: the provider rejects any image over 4096 pixels per side once a request carries 15 or more images, while normalization admits an 8192-pixel long edge, so a many-image session could fail on one thin image. The 1 MiB encoded-byte target was sized for 640,000-pixel outputs and would push a 1302×1302 photograph down the JPEG quality ladder. ## Decision -`ImageRequestPolicy` in `dsh-attachment` becomes a projection rule plus an optional per-side cap plus the byte target. The projection is a closed union: `pixel-budget` keeps the previous total-pixel geometry, and `token-grid` carries the patch size, downsampling ratio, and token cap of the provider grid. `request-projection.ts` owns the grid solver as `tokenGridProjection`, and `deepSeekImageTokens` in `llm-deepseek` reuses it for pricing, so the projection that sizes the request and the estimator that prices it are one solver. `requestImageDimensions` applies the projection, then the per-side cap, and keeps the source long edge exact while rounding the short edge; the local store resizes by the long edge only, so the encoded dimensions equal the predicted ones and the pricing handle text names what is actually sent. The provider pads the short edge to whole patches on its side. +The route chooses each request image's dimensions; the attachment provider only resizes and encodes to them. `ImageRequestPolicy` in `dsh-attachment` becomes `ImageRequestTarget`: a width, a height, and the byte target for one attachment. `readImageRequest` resizes by the source long edge alone without enlargement, so the encoder derives the short edge as the route predicted, and keys its cache by the attachment id, target dimensions, byte target, encoder settings, and the new `request-image-v6` transform version, so no earlier cache entry or upload mapping is reused. `dsh-attachment` keeps two provider-neutral geometry exports: `requestImageDimensions` for a total-pixel budget and `longEdgeDimensions` for an exact long edge with a rounded short edge. -DeepSeek routes resolve the grid when `imagePixelBudget` is omitted, a `pixel-budget` projection for a positive integer or the 512×512 `low` preset, a 4096-pixel per-side cap on every request image so the image count never changes a projection, and a 2 MiB byte target. The pi-ai route keeps its 2048×2048 pixel budget. The request-image transform version moves to `request-image-v6`, and the cache descriptor records the projection fields in a fixed order and the per-side cap, so no earlier cache entry or upload mapping is reused. Sources within the grid are sent at their own dimensions; small images are never enlarged because the provider scales up below 544×544 pixels itself. +`llm-deepseek` owns the provider rule. `image-tokens.ts` keeps the verbatim `v41` solver and adds `deepSeekRequestImageDimensions`: the source itself when its patch-padded grid fits the cap, otherwise the source aspect ratio at the solved grid's long edge, so a 3840×2160 source is sent as 1708×961 and the provider pads it to its 1708×966 grid. `resolveRequestImageTarget` applies that solver when `imagePixelBudget` is omitted, `requestImageDimensions` for a positive integer or the 512×512 `low` preset, then a 4096-pixel per-side cap on every request image so the image count never changes a target, and the route's 2 MiB byte target. Pricing prices `deepSeekImageTokens` of the same target, so the estimator and the sent image come from one solver. The pi-ai route derives its targets from its unchanged 2048×2048 pixel budget. Small images are never enlarged because the provider scales up below 544×544 pixels itself. ## Alternatives considered **Raise the pixel budget to 1302×1302.** A total-pixel budget is right only for squares: a 16:9 source would be sent at 1.69 million pixels when the grid keeps 1.65 million, and a 4:1 source when it keeps 1.59 million, while extreme ratios would lose detail the grid keeps. One rule that reproduces the provider removes the guesswork. -**Send the solver's exact dimensions with a fill resize.** The solved grid edges are whole patches and differ from the source aspect ratio by under one patch. Filling that box would distort the image slightly even though the provider does the same on its side; the issue requires the aspect ratio preserved, the padding on the provider side does not change the token count, and pricing reproduces the provider from the sent dimensions either way. +**A `token-grid` projection kind on the attachment policy, with the solver in `dsh-attachment`.** This was built first: the policy became a closed union of `pixel-budget` and `token-grid`, the solver moved into `request-projection.ts`, and `deepSeekImageTokens` imported it back. It put one provider's layout formula and patch constants into the provider-neutral package under a generic-looking name, needed an `unscaled` flag so the store could tell "send the source" from "send the solved size", and would grow a new union member for every provider rule. Handing the store a finished target keeps the provider rule beside the provider's pricing and leaves the store with no projection vocabulary at all. -**A function-valued projection on the policy.** The cache and upload identity is a digest over serialized policy fields, so the projection has to be data. +**Send the solver's exact grid dimensions with a fill resize.** The solved grid edges are whole patches and differ from the source aspect ratio by under one patch. Filling that box would distort the image slightly even though the provider does the same on its side; the issue requires the aspect ratio preserved, the padding on the provider side does not change the token count, and pricing reproduces the provider from the sent dimensions either way. **Keep the 1 MiB target.** The target is not a cap: an output over it is still sent at the smallest ladder quality. At 1302×1302 a JPEG photograph at quality 85 lands between 400 KB and 1.2 MB, so 2 MiB keeps most images at the top quality and lets more PNG screenshots pass through losslessly, while the inline base64 fallback still holds about seven such images under its 20 MiB bound. ## Consequences -A square source now reaches the model at up to 1302×1302 pixels and 994 tokens instead of 800×800 and 422, so image-heavy sessions reach compaction pressure sooner and the estimator matches provider usage for the sent version. Every existing request-image cache entry and DeepSeek Files API mapping is regenerated on the next request. Thin images keep their full grid until the per-side cap applies: an 8192×78 source costs 396 tokens under the grid but is sent as 4096×39. `llm-replay` does not project images, so keyless snapshots are unchanged, and the `llm-deepseek` adapter tests with mocked attachments pin the resolved policy and the projected handle text. +A square source now reaches the model at up to 1302×1302 pixels and 994 tokens instead of 800×800 and 422, so image-heavy sessions reach compaction pressure sooner and the estimator matches provider usage for the sent version. Every existing request-image cache entry and DeepSeek Files API mapping is regenerated on the next request. Thin images keep their full grid until the per-side cap applies: an 8192×78 source costs 396 tokens under the grid but is sent as 4096×39. `llm-replay` does not project images, so keyless snapshots cannot record the sent dimensions; the `llm-deepseek` adapter tests pin the resolved targets and the projected handle text against a mock server, and the local store tests resize real images to targets. diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md index 0360dcc655..a5d8a4e99a 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md @@ -6,26 +6,26 @@ Status: implemented ## 问题 -harness 此前把每张 DeepSeek 请求图片投影到 640,000 总像素预算内。这个值是为已下线的 V4 视觉模型选的，[token 预估器改用 `v41` 计算器](2026-09-10-deepseek-image-token-calculator-v41.zh.md)时没有改动它。当前 Flash 模型保留的远多于此：它把每条边补齐到整数个 14 px patch，把 3×3 个 patch 归为一个 token 格，再保留 token 数 `rows × (columns + 1) + 2` 不超过 1024 的最大等比网格。正方形图片保留 1302×1302 像素，16:9 图片保留 1708×966，极端宽高比最多保留约 180 万像素。因此 640,000 像素投影把一张 2000×2000 的截图缩成 800×800 发出，只有模型本可使用像素的约 38%，预估器为这个缩小版计 422 token，而模型对完整网格收 994 token。图像理解指南里的「约 1300×1300 总像素」只描述正方形的情况，确切规则是 token 网格。 +harness 此前把每张 DeepSeek 请求图片投影到 640,000 总像素预算内。这个值是为已下线的 V4 视觉模型选的，[token 预估器改用 `v41` 计算器](2026-09-10-deepseek-image-token-calculator-v41.zh.md)时没有改动它。当前 Flash 模型保留的远多于此：它把每条边补齐到整数个 14 px patch，把 3×3 个 patch 归为一个 token 格，再保留 token 数 `rows × (columns + 1) + 2` 不超过 1024 的最大等比网格。正方形图片保留 1302×1302 像素，16:9 图片保留 1708×966 的网格，极端宽高比最多保留约 180 万像素。因此 640,000 像素投影把一张 2000×2000 的截图缩成 800×800 发出，只有模型本可使用像素的约 38%，预估器为这个缩小版计 422 token，而模型对完整网格收 994 token。图像理解指南里的「约 1300×1300 总像素」只描述正方形的情况，确切规则是 token 网格。 旁边还有两个较小的缺口。请求版本没有单边上限：请求包含 15 张及以上图片时，提供方拒绝任何单边超过 4096 像素的图片，而规范化允许 8192 像素长边，多图会话可能因一张细长图失败。1 MiB 编码字节目标是按 640,000 像素输出定的，会把 1302×1302 的照片压到 JPEG 质量阶梯的低档。 ## 决策 -`dsh-attachment` 里的 `ImageRequestPolicy` 改为投影规则加可选单边上限加字节目标。投影是封闭联合类型：`pixel-budget` 保留原来的总像素几何，`token-grid` 携带提供方网格的 patch 大小、降采样比和 token 上限。`request-projection.ts` 以 `tokenGridProjection` 承载网格求解器，`llm-deepseek` 的 `deepSeekImageTokens` 复用它计价，于是决定请求尺寸的投影和为它计价的预估器是同一个求解器。`requestImageDimensions` 先应用投影，再应用单边上限，保持源图长边精确、短边四舍五入；本地存储只按长边缩放，因此编码后的尺寸等于预测尺寸，计价用的句柄文本写的就是实际发送的尺寸。提供方在自己那侧把短边补齐到整数个 patch。 +请求图片的尺寸由路由决定，附件提供方只负责缩放和编码。`dsh-attachment` 里的 `ImageRequestPolicy` 改为 `ImageRequestTarget`，即一张附件的目标宽、高和字节目标。`readImageRequest` 只按源图长边缩放且不放大，编码器按路由预测的方式推出短边；缓存按附件 id、目标尺寸、字节目标、编码参数和新的 `request-image-v6` 变换版本取键，因此之前的缓存条目和上传映射都不会被复用。`dsh-attachment` 保留两个提供方无关的几何导出：按总像素预算的 `requestImageDimensions`，以及长边精确、短边四舍五入的 `longEdgeDimensions`。 -DeepSeek 路由在省略 `imagePixelBudget` 时解析为网格，正整数或 512×512 的 `low` 预设解析为 `pixel-budget` 投影，每张请求图片都加 4096 像素单边上限，使图片数量不会改变投影，字节目标为 2 MiB。pi-ai 路由保留 2048×2048 像素预算。请求图片变换版本升到 `request-image-v6`，缓存描述符按固定顺序记录投影字段和单边上限，因此之前的缓存条目和上传映射都不会被复用。网格内的源图按自身尺寸发送；小图不放大，因为提供方自己会放大 544×544 像素以下的图片。 +提供方规则归 `llm-deepseek`。`image-tokens.ts` 保留逐字移植的 `v41` 求解器，并新增 `deepSeekRequestImageDimensions`：补齐 patch 后的网格在上限内就发源图本身，否则按源图宽高比取求解网格的长边，于是 3840×2160 的源图以 1708×961 发送，提供方再把它补齐到 1708×966 的网格。`resolveRequestImageTarget` 在省略 `imagePixelBudget` 时用这个求解器，正整数或 512×512 的 `low` 预设用 `requestImageDimensions`，然后对每张请求图片加 4096 像素单边上限，使图片数量不会改变目标，最后带上路由的 2 MiB 字节目标。计价对同一个目标算 `deepSeekImageTokens`，预估器和发出的图片来自同一个求解器。pi-ai 路由从它不变的 2048×2048 像素预算推导目标。小图不放大，因为提供方自己会放大 544×544 像素以下的图片。 ## 备选方案 **把像素预算提高到 1302×1302。** 总像素预算只对正方形正确：16:9 的源图会按 169 万像素发送而网格只保留 165 万，4:1 的源图网格只保留 159 万，极端比例又会丢掉网格本会保留的细节。一条复现提供方的规则消除了猜测。 -**用填充缩放发送求解器的精确尺寸。** 求解出的网格边长是整数个 patch，与源图宽高比相差不到一个 patch。填充到这个框会轻微变形，尽管提供方那侧也会这样做；issue 要求保持宽高比，提供方那侧的补齐不改变 token 数，而计价无论如何都从发送尺寸复现提供方。 +**在附件策略上加 `token-grid` 投影种类，求解器放进 `dsh-attachment`。** 最初就是这样做的：策略变成 `pixel-budget` 和 `token-grid` 的封闭联合，求解器搬进 `request-projection.ts`，`deepSeekImageTokens` 再从那里引回来。这把一家提供方的布局公式和 patch 常量放进了提供方无关的包，还起了个看似通用的名字；存储层需要一个 `unscaled` 标志来区分「发源图」和「发求解尺寸」；以后每多一家提供方规则，联合就要多长一个分支。把算好的目标交给存储层，提供方规则和它的计价放在一起，存储层不需要任何投影词汇。 -**策略里放函数形式的投影。** 缓存和上传身份是序列化策略字段的摘要，投影必须是数据。 +**用填充缩放发送求解器的精确网格尺寸。** 求解出的网格边长是整数个 patch，与源图宽高比相差不到一个 patch。填充到这个框会轻微变形，尽管提供方那侧也会这样做；issue 要求保持宽高比，提供方那侧的补齐不改变 token 数，而计价无论如何都从发送尺寸复现提供方。 **保留 1 MiB 目标。** 目标不是上限：超过它的输出仍会以阶梯最小质量发送。1302×1302 的 JPEG 照片在质量 85 时约 400 KB 到 1.2 MB，2 MiB 让多数图片停在最高质量，也让更多 PNG 截图无损直发，而内联 base64 回退在 20 MiB 上界内仍能容纳约七张这样的图片。 ## 后果 -正方形源图现在最多以 1302×1302 像素、994 token 到达模型，而不是 800×800 和 422，因此图片密集的会话更早触及 compaction 压力，预估器对发送版本的计价与提供方 usage 一致。所有已有的请求图片缓存条目和 DeepSeek Files API 映射在下次请求时重新生成。细长图在单边上限生效前保留完整网格：8192×78 的源图在网格下计 396 token，但以 4096×39 发送。`llm-replay` 不投影图片，keyless 快照不变；`llm-deepseek` 适配器用 mock 附件的测试固定了解析出的策略和投影后的句柄文本。 +正方形源图现在最多以 1302×1302 像素、994 token 到达模型，而不是 800×800 和 422，因此图片密集的会话更早触及 compaction 压力，预估器对发送版本的计价与提供方 usage 一致。所有已有的请求图片缓存条目和 DeepSeek Files API 映射在下次请求时重新生成。细长图在单边上限生效前保留完整网格：8192×78 的源图在网格下计 396 token，但以 4096×39 发送。`llm-replay` 不投影图片，keyless 快照记录不到发送尺寸；`llm-deepseek` 适配器测试对着 mock 服务器固定了解析出的目标和投影后的句柄文本，本地存储测试把真实图片缩放到目标尺寸。 diff --git a/docs/config-catalog.i18n.yaml b/docs/config-catalog.i18n.yaml index 46500b4add..24421501fa 100644 --- a/docs/config-catalog.i18n.yaml +++ b/docs/config-catalog.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/config-catalog.md -config-catalog.md: 259cbe8afe509cf448a54fa9fcddf297d4f2f588 -config-catalog.zh.md: 49e1064239f20fc6236c3dde6f2698791a9a1183 +config-catalog.md: de3b5c686121781860fae92a20f02e848508ee55 +config-catalog.zh.md: 9a2f1e86168ce5ebfe6a07ea258b4a94bba4c3fc diff --git a/docs/config-catalog.md b/docs/config-catalog.md index 259cbe8afe..de3b5c6861 100644 --- a/docs/config-catalog.md +++ b/docs/config-catalog.md @@ -1098,7 +1098,7 @@ export interface DeepSeekCatalogModel { Depends on: [`ModelModality`](../packages/llm/llm/src/index.ts) · [`RetryPolicyConfig`](../packages/llm/llm/src/index.ts) · [`SystemPromptUpdate`](../packages/llm/llm/src/index.ts) -Source: [`packages/llm/llm-deepseek/src/index.ts:128`](../packages/llm/llm-deepseek/src/index.ts) +Source: [`packages/llm/llm-deepseek/src/index.ts:129`](../packages/llm/llm-deepseek/src/index.ts) diff --git a/docs/config-catalog.zh.md b/docs/config-catalog.zh.md index 49e1064239..9a2f1e8616 100644 --- a/docs/config-catalog.zh.md +++ b/docs/config-catalog.zh.md @@ -1100,7 +1100,7 @@ export interface DeepSeekCatalogModel { 依赖：[`ModelModality`](../packages/llm/llm/src/index.ts) · [`RetryPolicyConfig`](../packages/llm/llm/src/index.ts) · [`SystemPromptUpdate`](../packages/llm/llm/src/index.ts) -来源：[`packages/llm/llm-deepseek/src/index.ts:128`](../packages/llm/llm-deepseek/src/index.ts) +来源：[`packages/llm/llm-deepseek/src/index.ts:129`](../packages/llm/llm-deepseek/src/index.ts) diff --git a/docs/subsystems/attachment.i18n.yaml b/docs/subsystems/attachment.i18n.yaml index faa0c08226..b0560c8499 100644 --- a/docs/subsystems/attachment.i18n.yaml +++ b/docs/subsystems/attachment.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/subsystems/attachment.md -attachment.md: bbcf438646eb4cae78ef5b86ccbf9e04b927fa55 -attachment.zh.md: 0e3c58fc59cb319bde681bdfa7124c852cb6da19 +attachment.md: db1c1cfa15f5d0815236f96b6472cbbd864decbd +attachment.zh.md: 82379de5049012c0912734dc94257d6b8f354ad1 diff --git a/docs/subsystems/attachment.md b/docs/subsystems/attachment.md index bbcf438646..db1c1cfa15 100644 --- a/docs/subsystems/attachment.md +++ b/docs/subsystems/attachment.md @@ -126,52 +126,22 @@ interface StoredImageAttachment { ``` ```ts type-equiv -/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ -type ImageRequestProjection = - | { - /** Hard cap on width multiplied by height. */ - kind: 'pixel-budget' - /** Maximum width multiplied by height after projection. */ - maxPixels: number - } - | { - /** - * Largest aspect-preserving patch grid whose token count - * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. - */ - kind: 'token-grid' - /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ - patchSize: number - /** Patches per token cell along each axis. */ - downsampleRatio: number - /** Token cap for one image. */ - maxTokens: number - } -``` - -```ts type-equiv -/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ -interface TokenGridProjection { - /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ +/** Deterministic request-image target selected by one exact model route for one attachment. */ +interface ImageRequestTarget { + /** Target width in pixels; a target above the source keeps the source width. */ width: number - /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + /** Target height in pixels; a target above the source keeps the source height. */ height: number - /** Tokens charged for the retained grid. */ - tokens: number - /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ - unscaled: boolean + /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ + maxBytes: number } ``` ```ts type-equiv -/** Deterministic request-image policy selected by one exact model route. */ -interface ImageRequestPolicy { - /** Downscale rule applied before the per-side cap. */ - projection: ImageRequestProjection - /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ - maxDimension?: number - /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ - maxBytes: number +/** Integer width and height of one projected image. */ +interface ProjectedDimensions { + width: number + height: number } ``` @@ -197,7 +167,7 @@ interface RequestImageAttachment { } ``` -`saveImage()` prepares and atomically commits a provider-independent normalized attachment before returning its `ImageAttachmentRef`. `saveImages()` prepares every validated attachment once before publishing the batch, so validation rejection leaves no partial objects and publication does not repeat decoding or quality selection. `admitPromptContent()` accepts the complete ordered Host prompt after file receipt resolution, replaces base64 image uploads with durable references, and passes durable file references unchanged. `admitEncodedImages()` supports other wire entries and delegates count, aggregate-byte, and ordered batch admission to `saveImages()`. `admitEncodedFile()` gives encoded protocol adapters the same service-owned canonical-base64 admission, and `isAttachmentError()` lets those adapters recognize stable attachment failures without importing implementation helpers. `readImage()` verifies a normalized attachment from an authorized session path. `imageHostPath()` exposes only the provider-owned host object location; it does not decide whether the current tool execution world can read it. `readImageRequest()` derives and caches one deterministic request version under an exact route projection rule, optional per-side cap, and encoded-byte target. That version contains encoded bytes and metadata but no execution-world path. New entries are fully decoded before publication, while cache hits use a bounded metadata probe. Callers use `Promise.all` over the singular method when they need an ordered batch. The local implementation lazily encodes preferred candidates, singleflights equal request identities, lets each waiter cancel independently, stops shared work when no waiter remains, and bounds all transforms with its instance-level limiter, which defaults to two simultaneous transformations. The service is retention-neutral: resumed and forked sessions may share objects, so reference-aware garbage collection is deferred rather than tied to one session's deletion. +`saveImage()` prepares and atomically commits a provider-independent normalized attachment before returning its `ImageAttachmentRef`. `saveImages()` prepares every validated attachment once before publishing the batch, so validation rejection leaves no partial objects and publication does not repeat decoding or quality selection. `admitPromptContent()` accepts the complete ordered Host prompt after file receipt resolution, replaces base64 image uploads with durable references, and passes durable file references unchanged. `admitEncodedImages()` supports other wire entries and delegates count, aggregate-byte, and ordered batch admission to `saveImages()`. `admitEncodedFile()` gives encoded protocol adapters the same service-owned canonical-base64 admission, and `isAttachmentError()` lets those adapters recognize stable attachment failures without importing implementation helpers. `readImage()` verifies a normalized attachment from an authorized session path. `imageHostPath()` exposes only the provider-owned host object location; it does not decide whether the current tool execution world can read it. `readImageRequest()` derives and caches one deterministic request version at an exact route-chosen target size and encoded-byte target. That version contains encoded bytes and metadata but no execution-world path. New entries are fully decoded before publication, while cache hits use a bounded metadata probe. Callers use `Promise.all` over the singular method when they need an ordered batch. The local implementation lazily encodes preferred candidates, singleflights equal request identities, lets each waiter cancel independently, stops shared work when no waiter remains, and bounds all transforms with its instance-level limiter, which defaults to two simultaneous transformations. The service is retention-neutral: resumed and forked sessions may share objects, so reference-aware garbage collection is deferred rather than tied to one session's deletion. @@ -320,11 +290,11 @@ fileHostPath(ref: FileAttachmentRef): string | undefined /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. + * @param target - route-chosen dimensions and byte target; an unmet byte target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ -readImageRequest( ref: ImageAttachmentRef, policy: ImageRequestPolicy, signal?: AbortSignal, ): Promise +readImageRequest( ref: ImageAttachmentRef, target: ImageRequestTarget, signal?: AbortSignal, ): Promise ``` Source: [`packages/attachment/attachment/src/index.ts`](../../packages/attachment/attachment/src/index.ts) diff --git a/docs/subsystems/attachment.zh.md b/docs/subsystems/attachment.zh.md index 0e3c58fc59..82379de504 100644 --- a/docs/subsystems/attachment.zh.md +++ b/docs/subsystems/attachment.zh.md @@ -126,52 +126,22 @@ interface StoredImageAttachment { ``` ```ts type-equiv -/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ -type ImageRequestProjection = - | { - /** Hard cap on width multiplied by height. */ - kind: 'pixel-budget' - /** Maximum width multiplied by height after projection. */ - maxPixels: number - } - | { - /** - * Largest aspect-preserving patch grid whose token count - * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. - */ - kind: 'token-grid' - /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ - patchSize: number - /** Patches per token cell along each axis. */ - downsampleRatio: number - /** Token cap for one image. */ - maxTokens: number - } -``` - -```ts type-equiv -/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ -interface TokenGridProjection { - /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ +/** Deterministic request-image target selected by one exact model route for one attachment. */ +interface ImageRequestTarget { + /** Target width in pixels; a target above the source keeps the source width. */ width: number - /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + /** Target height in pixels; a target above the source keeps the source height. */ height: number - /** Tokens charged for the retained grid. */ - tokens: number - /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ - unscaled: boolean + /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ + maxBytes: number } ``` ```ts type-equiv -/** Deterministic request-image policy selected by one exact model route. */ -interface ImageRequestPolicy { - /** Downscale rule applied before the per-side cap. */ - projection: ImageRequestProjection - /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ - maxDimension?: number - /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ - maxBytes: number +/** Integer width and height of one projected image. */ +interface ProjectedDimensions { + width: number + height: number } ``` @@ -197,7 +167,7 @@ interface RequestImageAttachment { } ``` -`saveImage()` 准备并原子提交提供方无关的规范化附件，然后直接返回 `ImageAttachmentRef`。`saveImages()` 在发布批次前为每个成员各准备一次经过验证的附件，因此校验拒绝不会留下部分对象，发布也不会重复解码或选择质量。`admitPromptContent()` 在文件凭证解析后接收完整且有序的 Host prompt，把 base64 图片上传替换为持久引用，并让持久文件引用原样通过。`admitEncodedImages()` 支持其他 wire 入口，把张数、聚合字节和有序批量准入交给 `saveImages()`。`admitEncodedFile()` 让编码协议适配器使用服务拥有的规范 base64 准入，`isAttachmentError()` 让这些适配器无需导入实现辅助函数即可识别稳定的附件错误。`readImage()` 校验来自已授权会话路径的规范化附件。`imageHostPath()` 只公开提供方所持对象的宿主位置，不判断当前工具执行环境能否读取它。`readImageRequest()` 按确切路由的投影规则、可选单边上限和编码字节目标派生并缓存确定性请求版本。该版本包含编码字节和元数据，不包含执行环境路径。新条目在发布前完整解码，缓存命中只做有界元数据探测。调用方需要有序批次时，对单数方法使用 `Promise.all`。本地实现按需编码首选候选、合并相同请求身份的并发任务、允许每个等待方单独取消、没有等待方时停止共享任务，并通过实例级限流器限制全部变换，默认同时执行两项。该服务不规定保留策略：恢复和 fork 后的会话可能共享对象，因此基于引用的垃圾回收会延期实现，不与单个会话的删除绑定。 +`saveImage()` 准备并原子提交提供方无关的规范化附件，然后直接返回 `ImageAttachmentRef`。`saveImages()` 在发布批次前为每个成员各准备一次经过验证的附件，因此校验拒绝不会留下部分对象，发布也不会重复解码或选择质量。`admitPromptContent()` 在文件凭证解析后接收完整且有序的 Host prompt，把 base64 图片上传替换为持久引用，并让持久文件引用原样通过。`admitEncodedImages()` 支持其他 wire 入口，把张数、聚合字节和有序批量准入交给 `saveImages()`。`admitEncodedFile()` 让编码协议适配器使用服务拥有的规范 base64 准入，`isAttachmentError()` 让这些适配器无需导入实现辅助函数即可识别稳定的附件错误。`readImage()` 校验来自已授权会话路径的规范化附件。`imageHostPath()` 只公开提供方所持对象的宿主位置，不判断当前工具执行环境能否读取它。`readImageRequest()` 按确切的路由目标尺寸和编码字节目标派生并缓存确定性请求版本。该版本包含编码字节和元数据，不包含执行环境路径。新条目在发布前完整解码，缓存命中只做有界元数据探测。调用方需要有序批次时，对单数方法使用 `Promise.all`。本地实现按需编码首选候选、合并相同请求身份的并发任务、允许每个等待方单独取消、没有等待方时停止共享任务，并通过实例级限流器限制全部变换，默认同时执行两项。该服务不规定保留策略：恢复和 fork 后的会话可能共享对象，因此基于引用的垃圾回收会延期实现，不与单个会话的删除绑定。 @@ -320,11 +290,11 @@ fileHostPath(ref: FileAttachmentRef): string | undefined /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. + * @param target - route-chosen dimensions and byte target; an unmet byte target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ -readImageRequest( ref: ImageAttachmentRef, policy: ImageRequestPolicy, signal?: AbortSignal, ): Promise +readImageRequest( ref: ImageAttachmentRef, target: ImageRequestTarget, signal?: AbortSignal, ): Promise ``` Source: [`packages/attachment/attachment/src/index.ts`](../../packages/attachment/attachment/src/index.ts) diff --git a/docs/subsystems/llm-streaming.i18n.yaml b/docs/subsystems/llm-streaming.i18n.yaml index a31580cd95..d543a5f4e7 100644 --- a/docs/subsystems/llm-streaming.i18n.yaml +++ b/docs/subsystems/llm-streaming.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write docs/subsystems/llm-streaming.md -llm-streaming.md: b3d2468a41833139e3c9c9ded69cbb863e5fd8d3 -llm-streaming.zh.md: 2d849206746ee44736ff402a364f913301ed87a8 +llm-streaming.md: 28492b46435e3288609129b0dfc5cb40dd5f7296 +llm-streaming.zh.md: fe02e2ebe5b558162e849e26ff05b8d633c07ba0 diff --git a/docs/subsystems/llm-streaming.md b/docs/subsystems/llm-streaming.md index b3d2468a41..28492b4643 100644 --- a/docs/subsystems/llm-streaming.md +++ b/docs/subsystems/llm-streaming.md @@ -249,7 +249,7 @@ interface LlmFailure { ## Request-image pricing -An adapter whose provider charges visual tokens for request images declares per-route pricing by overriding `LlmAdapter.imageRequestPricing`, and `ctx.llm.imageRequestPricing(provider, model)` resolves it synchronously for consumers. The token meter resolves the routed model's pricing on every measurement so compaction pressure, retention, and range selection price image history as the routed request actually sends it; the DeepSeek adapter reproduces its own request projection (per-model projection and per-side cap, oldest-first offload) and prices retained images with the published vision accounting, while provider usage remains the authoritative anchor for completed requests. +An adapter whose provider charges visual tokens for request images declares per-route pricing by overriding `LlmAdapter.imageRequestPricing`, and `ctx.llm.imageRequestPricing(provider, model)` resolves it synchronously for consumers. The token meter resolves the routed model's pricing on every measurement so compaction pressure, retention, and range selection price image history as the routed request actually sends it; the DeepSeek adapter reproduces its own request projection (per-model request target, oldest-first offload) and prices retained images with the published vision accounting, while provider usage remains the authoritative anchor for completed requests. ```ts type-equiv /** diff --git a/docs/subsystems/llm-streaming.zh.md b/docs/subsystems/llm-streaming.zh.md index 2d84920674..fe02e2ebe5 100644 --- a/docs/subsystems/llm-streaming.zh.md +++ b/docs/subsystems/llm-streaming.zh.md @@ -251,7 +251,7 @@ interface LlmFailure { ## 请求图片定价 -提供方对请求图片收取视觉 token 的适配器通过覆写 `LlmAdapter.imageRequestPricing` 声明按路由的定价，消费方经 `ctx.llm.imageRequestPricing(provider, model)` 同步解析。token 计量服务在每次计量时解析路由模型的定价，使 compaction 的压力、保留与选段都按路由请求实际发送的形式为图片历史计价；DeepSeek 适配器复现自身的请求投影（按模型的投影与单边上限、最旧优先 offload），并用官方公布的视觉计量为保留图片定价，已完成请求仍以 provider usage 为权威锚点。 +提供方对请求图片收取视觉 token 的适配器通过覆写 `LlmAdapter.imageRequestPricing` 声明按路由的定价，消费方经 `ctx.llm.imageRequestPricing(provider, model)` 同步解析。token 计量服务在每次计量时解析路由模型的定价，使 compaction 的压力、保留与选段都按路由请求实际发送的形式为图片历史计价；DeepSeek 适配器复现自身的请求投影（按模型的请求目标、最旧优先 offload），并用官方公布的视觉计量为保留图片定价，已完成请求仍以 provider usage 为权威锚点。 ```ts type-equiv /** diff --git a/packages/attachment/attachment-local/README.i18n.yaml b/packages/attachment/attachment-local/README.i18n.yaml index 9e2317f470..082dc5f45f 100644 --- a/packages/attachment/attachment-local/README.i18n.yaml +++ b/packages/attachment/attachment-local/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/attachment/attachment-local/README.md -README.md: 3689ee4d497cf2e6dbf74450a9ec71c5138170c3 -README.zh.md: 3c208d1626daa1d93c6e1cc6bd483ded21338f75 +README.md: cf055cf7682c7c97de25a58795ee15e4797ae63b +README.zh.md: 0b14fed2c2eb972e12d655aba31fd0cfbd9e1473 diff --git a/packages/attachment/attachment-local/README.md b/packages/attachment/attachment-local/README.md index 3689ee4d49..cf055cf768 100644 --- a/packages/attachment/attachment-local/README.md +++ b/packages/attachment/attachment-local/README.md @@ -85,7 +85,7 @@ Objects land at `/attachments/v1/objects//`; eq Admission accepts up to 20 images and 200 MiB of source bytes per message; one source may use up to 20 MiB, 64 million pixels, and 8192 pixels per side. It applies orientation, removes metadata and color profiles, and normalizes under a 2048×2048 total-pixel budget, an 8192-pixel long edge, and a 4 MiB encoded-byte target. Extreme aspect ratios therefore retain their short-edge resolution. Clean single-frame 8-bit sRGB/sRGBA PNG, JPEG, or WebP input already within those limits passes through byte-identically; GIF, animation, metadata, orientation, 16-bit PNG, and incompatible color spaces force conversion. -Request versions live below `/attachments/v1/request-images/`. `readImageRequest` scales without enlargement to the route projection, a total-pixel budget or a provider token grid, then to the route per-side cap; it resizes by the long edge only, so the encoder rounds the short edge exactly as the projection predicts, and then applies a separate encoded-byte target through the same alpha routing and quality ladder. Its cache identity includes the attachment id, transform version, projection, per-side cap, byte target, and fixed encoder settings; cached bytes are header-probed for format, 8-bit sRGB/sRGBA, dimensions, and alpha facts, and a mismatch regenerates the entry. Concurrent callers share one transform and cache write, while cancellation stops shared work only when no waiter remains. `imageHostPath` derives the normalized object's host path, and the mounted filesystem may map that path into its execution world without writing it to durable history. +Request versions live below `/attachments/v1/request-images/`. `readImageRequest` scales without enlargement to the route-chosen target, resizing by the long edge only so the encoder derives the short edge as the route predicts, then applies a separate encoded-byte target through the same alpha routing and quality ladder. Its cache identity includes the attachment id, transform version, target dimensions, byte target, and fixed encoder settings; cached bytes are header-probed for format, 8-bit sRGB/sRGBA, dimensions, and alpha facts, and a mismatch regenerates the entry. Concurrent callers share one transform and cache write, while cancellation stops shared work only when no waiter remains. `imageHostPath` derives the normalized object's host path, and the mounted filesystem may map that path into its execution world without writing it to durable history. Generic-file bytes have one canonical object at `/attachments/v1/file-objects//`. Each reference path at `/attachments/v1/files///` is a read-only hard link, so different names for equal bytes do not duplicate disk content. `readFileStream` reads the reference path in bounded chunks and verifies the complete digest and recorded byte count before a consumer can finish successfully. A missing, changed, or truncated object fails its consumer instead of producing a complete export with different bytes. diff --git a/packages/attachment/attachment-local/README.zh.md b/packages/attachment/attachment-local/README.zh.md index 3c208d1626..0b14fed2c2 100644 --- a/packages/attachment/attachment-local/README.zh.md +++ b/packages/attachment/attachment-local/README.zh.md @@ -85,7 +85,7 @@ kind: "package-reference" 准入允许每条消息最多 20 张图片与 200 MiB 源字节；单个源图最多 20 MiB、6400 万像素与单边 8192 像素。系统应用方向、移除元数据与色彩配置，并把规范化结果限制在 2048×2048 总像素预算、8192 像素长边和 4 MiB 编码字节目标内，因此，即使宽高比极端，图片也会保留短边分辨率。已经满足限制的干净、单帧、8-bit sRGB/sRGBA PNG、JPEG 或 WebP 会逐字节直通；GIF、动画、元数据、方向、16-bit PNG 与不兼容色彩空间会触发转换。 -请求版本位于 `/attachments/v1/request-images/`。`readImageRequest` 在不放大的前提下先缩放到路由投影，即总像素预算或提供方 token 网格，再缩放到路由单边上限。缩放只按长边给定，短边由编码器四舍五入，与投影预测的尺寸一致。随后通过相同的 alpha 路由与质量阶梯应用独立编码字节目标。缓存身份包含附件 id、变换版本、投影、单边上限、字节目标与固定编码参数；缓存字节会先通过文件头探测格式、8-bit sRGB/sRGBA、尺寸与 alpha 信息，不匹配时重新生成。并发调用方共享一次变换与缓存写入，且只在没有等待方时由取消停止共享工作。`imageHostPath` 派生规范化对象的宿主路径，挂载的文件系统可以把该路径映射进执行世界，而不会写入持久历史。 +请求版本位于 `/attachments/v1/request-images/`。`readImageRequest` 在不放大的前提下缩放到路由选定的目标尺寸，缩放只按长边给定，短边由编码器按路由预测的方式推出，随后通过相同的 alpha 路由与质量阶梯应用独立编码字节目标。缓存身份包含附件 id、变换版本、目标尺寸、字节目标与固定编码参数；缓存字节会先通过文件头探测格式、8-bit sRGB/sRGBA、尺寸与 alpha 信息，不匹配时重新生成。并发调用方共享一次变换与缓存写入，且只在没有等待方时由取消停止共享工作。`imageHostPath` 派生规范化对象的宿主路径，挂载的文件系统可以把该路径映射进执行世界，而不会写入持久历史。 通用文件字节的唯一规范对象位于 `/attachments/v1/file-objects//`。每条引用路径 `/attachments/v1/files///` 都是只读硬链接，所以名称不同但字节相同的文件不会重复占用磁盘。`readFileStream` 以有界分块读取引用路径，并在消费方成功结束前校验完整摘要与记录的字节数。对象缺失、被改写或截断时，消费方会失败，不会得到字节已经变化的完整导出。 diff --git a/packages/attachment/attachment-local/src/index.ts b/packages/attachment/attachment-local/src/index.ts index 7415bf940f..0a37a3304a 100644 --- a/packages/attachment/attachment-local/src/index.ts +++ b/packages/attachment/attachment-local/src/index.ts @@ -8,7 +8,7 @@ import type { FileAttachmentRef, ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveFileAttachment, SaveFileStreamAttachment, @@ -244,20 +244,20 @@ export class LocalAttachmentStore extends AttachmentStore { override async readImageRequest( ref: ImageAttachmentRef, - policy: ImageRequestPolicy, + target: ImageRequestTarget, signal?: AbortSignal, ): Promise { - return this.requestVersion(ref, policy, undefined, signal) + return this.requestVersion(ref, target, undefined, signal) } private requestVersion( ref: ImageAttachmentRef, - policy: ImageRequestPolicy, + target: ImageRequestTarget, stored: StoredImageAttachment | undefined, signal: AbortSignal | undefined, ): Promise { signal?.throwIfAborted() - const variantId = requestImageVariantId(ref, policy) + const variantId = requestImageVariantId(ref, target) const key = String(variantId) let operation = this.requestInflight.get(key) if (operation?.controller.signal.aborted) { @@ -269,7 +269,7 @@ export class LocalAttachmentStore extends AttachmentStore { const request = await readRequestImageFile( this.root, stored ?? await this.readImage(ref, sharedSignal), - policy, + target, sharedSignal, ) return request diff --git a/packages/attachment/attachment-local/src/normalization.ts b/packages/attachment/attachment-local/src/normalization.ts index 199a50af6b..7d514786a2 100644 --- a/packages/attachment/attachment-local/src/normalization.ts +++ b/packages/attachment/attachment-local/src/normalization.ts @@ -79,10 +79,14 @@ function preparedPipeline(data: Uint8Array, width: number, height: number): Shar /** Dimensions under the total-pixel budget, then the long-edge cap, without changing aspect ratio. */ function initialDimensions(detected: DetectedImage, policy: NormalizationPolicy): { width: number; height: number } { - return requestImageDimensions(detected.width, detected.height, { - projection: { kind: 'pixel-budget', maxPixels: policy.maxPixels }, - maxDimension: policy.maxDimension, - }) + const budgeted = requestImageDimensions(detected.width, detected.height, policy.maxPixels) + const longEdge = Math.max(budgeted.width, budgeted.height) + if (longEdge <= policy.maxDimension) return budgeted + const scale = policy.maxDimension / longEdge + return { + width: Math.max(1, Math.floor(budgeted.width * scale)), + height: Math.max(1, Math.floor(budgeted.height * scale)), + } } /** diff --git a/packages/attachment/attachment-local/src/request-image.ts b/packages/attachment/attachment-local/src/request-image.ts index f1bfe435c6..76873742c6 100644 --- a/packages/attachment/attachment-local/src/request-image.ts +++ b/packages/attachment/attachment-local/src/request-image.ts @@ -4,12 +4,11 @@ import { createHash, randomUUID } from 'node:crypto' import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises' import { dirname, join } from 'node:path' import sharp, { type Sharp } from 'sharp' -import { AttachmentError, ImageVariantId, requestImageDimensions } from '@deepseek-ai/dsh-attachment' +import { AttachmentError, ImageVariantId } from '@deepseek-ai/dsh-attachment' import type { ImageMediaType, ImageAttachmentRef, - ImageRequestPolicy, - ImageRequestProjection, + ImageRequestTarget, RequestImageAttachment, StoredImageAttachment, } from '@deepseek-ai/dsh-attachment' @@ -47,38 +46,19 @@ function checkedInteger(value: number, name: string): number { return value } -function validatePolicy(policy: ImageRequestPolicy): void { - const { projection } = policy - if (projection.kind === 'pixel-budget') { - checkedInteger(projection.maxPixels, 'Image request maxPixels') - } else { - checkedInteger(projection.patchSize, 'Image request patchSize') - checkedInteger(projection.downsampleRatio, 'Image request downsampleRatio') - checkedInteger(projection.maxTokens, 'Image request maxTokens') - } - if (policy.maxDimension !== undefined) checkedInteger(policy.maxDimension, 'Image request maxDimension') - checkedInteger(policy.maxBytes, 'Image request maxBytes') +function validateTarget(target: ImageRequestTarget): void { + checkedInteger(target.width, 'Image request width') + checkedInteger(target.height, 'Image request height') + checkedInteger(target.maxBytes, 'Image request maxBytes') } -/** Projection fields in a fixed key order so equal policies digest identically. */ -function projectionDescriptor(projection: ImageRequestProjection): Record { - return projection.kind === 'pixel-budget' - ? { kind: projection.kind, maxPixels: projection.maxPixels } - : { - kind: projection.kind, - patchSize: projection.patchSize, - downsampleRatio: projection.downsampleRatio, - maxTokens: projection.maxTokens, - } -} - -function descriptor(attachment: ImageAttachmentRef, policy: ImageRequestPolicy): string { +function descriptor(attachment: ImageAttachmentRef, target: ImageRequestTarget): string { return JSON.stringify({ transformVersion: REQUEST_IMAGE_TRANSFORM_VERSION, attachmentId: attachment.attachmentId, - projection: projectionDescriptor(policy.projection), - maxDimension: policy.maxDimension ?? null, - encodedByteBudget: policy.maxBytes, + targetWidth: target.width, + targetHeight: target.height, + encodedByteBudget: target.maxBytes, encoding: { webpQualities: IMAGE_ENCODING_QUALITIES, webpEffort: WEBP_ENCODING_EFFORT, @@ -90,23 +70,23 @@ function descriptor(attachment: ImageAttachmentRef, policy: ImageRequestPolicy): } /** - * Complete deterministic identity for one attachment and route-owned request policy. + * Complete deterministic identity for one attachment and route-chosen request target. * @param attachment - provider-independent durable normalized attachment reference. - * @param policy - route-owned projection, per-side cap, and byte policy. + * @param target - route-chosen dimensions and byte target. * @returns branded digest over every request transform input. */ export function requestImageVariantId( attachment: ImageAttachmentRef, - policy: ImageRequestPolicy, + target: ImageRequestTarget, ): ReturnType { - return ImageVariantId(`sha256:${digest(descriptor(attachment, policy))}`) + return ImageVariantId(`sha256:${digest(descriptor(attachment, target))}`) } -/** Resize by the source long edge only, so the encoder rounds the short edge exactly as the projection did. */ -function pipeline(attachment: StoredImageAttachment, width: number, height: number): Sharp { +/** Resize by the source long edge only, so the encoder derives the short edge as the route predicts. */ +function pipeline(attachment: StoredImageAttachment, target: ImageRequestTarget): Sharp { const byWidth = attachment.ref.width >= attachment.ref.height return sourcePipeline(attachment) - .resize({ ...byWidth ? { width } : { height }, withoutEnlargement: true }) + .resize({ ...byWidth ? { width: target.width } : { height: target.height }, withoutEnlargement: true }) } function sourcePipeline(attachment: StoredImageAttachment): Sharp { @@ -115,13 +95,12 @@ function sourcePipeline(attachment: StoredImageAttachment): Sharp { async function createRequestImage( attachment: StoredImageAttachment, - policy: ImageRequestPolicy, + target: ImageRequestTarget, hasAlpha: boolean, ): Promise { - const dimensions = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy) - if (dimensions.width === attachment.ref.width - && dimensions.height === attachment.ref.height - && attachment.data.byteLength <= policy.maxBytes) { + if (target.width >= attachment.ref.width + && target.height >= attachment.ref.height + && attachment.data.byteLength <= target.maxBytes) { return { data: attachment.data, mediaType: attachment.ref.mediaType, @@ -130,8 +109,8 @@ async function createRequestImage( } } const encodedVersion = await encodeFirstWithinLimit( - encodingLadder(pipeline(attachment, dimensions.width, dimensions.height), hasAlpha), - policy.maxBytes, + encodingLadder(pipeline(attachment, target), hasAlpha), + target.maxBytes, ) return isExhaustedEncoding(encodedVersion) ? encodedVersion.smallest : encodedVersion } @@ -142,17 +121,15 @@ function cachePath(root: string, hash: string): string { async function readCached( path: string, - attachment: StoredImageAttachment, - policy: ImageRequestPolicy, + target: ImageRequestTarget, expectedAlpha: boolean, signal?: AbortSignal, ): Promise { try { const data = new Uint8Array(await readFile(path, { signal })) const detected = await probeImage(data) - const maximum = requestImageDimensions(attachment.ref.width, attachment.ref.height, policy) if (detected.depth !== 'uchar' || detected.space !== 'srgb' - || detected.width > maximum.width || detected.height > maximum.height + || detected.width > target.width || detected.height > target.height || !encodedAlphaIsCompatible(expectedAlpha, detected)) return undefined return { data, mediaType: detected.mediaType, width: detected.width, height: detected.height, hasAlpha: detected.hasAlpha } } catch (error: unknown) { @@ -193,24 +170,24 @@ async function writeCached(path: string, data: Uint8Array): Promise { * Generate or reuse one request image below the local attachment root. * @param root - absolute versioned attachment storage root. * @param attachment - verified normalized attachment bytes and reference. - * @param policy - exact route request-image policy. + * @param target - exact route-chosen dimensions and byte target; a target above the source keeps the source size. * @param signal - optional cancellation for cache I/O and image transformation. * @returns verified request bytes and deterministic variant identity. */ export async function readRequestImageFile( root: string, attachment: StoredImageAttachment, - policy: ImageRequestPolicy, + target: ImageRequestTarget, signal?: AbortSignal, ): Promise { signal?.throwIfAborted() - validatePolicy(policy) + validateTarget(target) const source = await probeImage(attachment.data) - const variantId = requestImageVariantId(attachment.ref, policy) + const variantId = requestImageVariantId(attachment.ref, target) const hash = String(variantId).slice('sha256:'.length) const path = cachePath(root, hash) - const cached = await readCached(path, attachment, policy, source.hasAlpha, signal) - const created = cached ?? await createRequestImage(attachment, policy, source.hasAlpha) + const cached = await readCached(path, target, source.hasAlpha, signal) + const created = cached ?? await createRequestImage(attachment, target, source.hasAlpha) const version = cached ?? (created.data === attachment.data ? { ...created, hasAlpha: source.hasAlpha } : await verifyRequestImage(created, source.hasAlpha)) diff --git a/packages/attachment/attachment-local/tests/index.spec.ts b/packages/attachment/attachment-local/tests/index.spec.ts index a46d6f0b10..00a427e16e 100644 --- a/packages/attachment/attachment-local/tests/index.spec.ts +++ b/packages/attachment/attachment-local/tests/index.spec.ts @@ -85,7 +85,7 @@ describe('local attachment service', () => { String(ref.attachmentId).slice('sha256:'.length), )) await expect(readFile(hostPath)).resolves.toEqual(Buffer.from(data)) - const request = await service.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1024 }) + const request = await service.readImageRequest(ref, { width: 1, height: 1, maxBytes: 1024 }) expect(request).not.toHaveProperty('access') const fileData = Uint8Array.of(0, 1, 2, 255) diff --git a/packages/attachment/attachment-local/tests/request-image-verification.spec.ts b/packages/attachment/attachment-local/tests/request-image-verification.spec.ts index eabc735229..693b36f737 100644 --- a/packages/attachment/attachment-local/tests/request-image-verification.spec.ts +++ b/packages/attachment/attachment-local/tests/request-image-verification.spec.ts @@ -38,7 +38,7 @@ describe('request image verification', () => { const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) control.mismatch = true - await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 })) + await expect(attachments.readImageRequest(attachment, { width: 22, height: 11, maxBytes: 1024 * 1024 })) .rejects.toMatchObject({ code: 'ATTACHMENT_WRITE_FAILED', message: 'Encoded model-request image does not match its verified 8-bit sRGB metadata.', diff --git a/packages/attachment/attachment-local/tests/request-image.spec.ts b/packages/attachment/attachment-local/tests/request-image.spec.ts index 73c0c366b1..4aa63865a3 100644 --- a/packages/attachment/attachment-local/tests/request-image.spec.ts +++ b/packages/attachment/attachment-local/tests/request-image.spec.ts @@ -48,7 +48,7 @@ describe('local request-image cache', () => { const first = await attachments.saveImage({ data: await image(8, 4), mediaType: 'image/png' }) const second = await attachments.saveImage({ data: await image(4, 8), mediaType: 'image/png' }) const firstStored = await attachments.readImage(first) - const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 1_000 }, maxBytes: 1024 * 1024 } + const policy = { width: 8, height: 8, maxBytes: 1024 * 1024 } const request = await attachments.readImageRequest(first, policy) const batch = await Promise.all([first, second].map( @@ -59,56 +59,51 @@ describe('local request-image cache', () => { expect(batch.map(value => value.attachment.attachmentId)).toEqual([first.attachmentId, second.attachmentId]) }) - it('rejects invalid request policies', async () => { + it('rejects invalid request targets', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(8, 4), mediaType: 'image/png' }) - await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 0 }, maxBytes: 100 })) - .rejects.toThrow('Image request maxPixels must be a positive integer') - await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 100 }, maxBytes: 0 })) + await expect(attachments.readImageRequest(attachment, { width: 0, height: 4, maxBytes: 100 })) + .rejects.toThrow('Image request width must be a positive integer') + await expect(attachments.readImageRequest(attachment, { width: 8, height: 1.5, maxBytes: 100 })) + .rejects.toThrow('Image request height must be a positive integer') + await expect(attachments.readImageRequest(attachment, { width: 8, height: 4, maxBytes: 0 })) .rejects.toThrow('Image request maxBytes must be a positive integer') - await expect(attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 100 }, maxDimension: 0, maxBytes: 100 })) - .rejects.toThrow('Image request maxDimension must be a positive integer') - for (const field of ['patchSize', 'downsampleRatio', 'maxTokens'] as const) { - const projection = { kind: 'token-grid' as const, patchSize: 14, downsampleRatio: 3, maxTokens: 1024, [field]: 1.5 } - await expect(attachments.readImageRequest(attachment, { projection, maxBytes: 100 })) - .rejects.toThrow(`Image request ${field} must be a positive integer`) - } }) - it('projects onto a token grid, caps the long edge, and keys the cache by projection', async () => { + it('resizes by the long edge to the exact target and keys the cache by target', async () => { const attachments = await store() - const grid = { kind: 'token-grid' as const, patchSize: 14, downsampleRatio: 3, maxTokens: 1024 } + const maxBytes = 2 * 1024 * 1024 const square = await attachments.saveImage({ data: await image(2048, 2048), mediaType: 'image/png' }) const small = await attachments.saveImage({ data: await image(800, 800), mediaType: 'image/png' }) const thin = await attachments.saveImage({ data: await image(8000, 40), mediaType: 'image/png' }) const wide = await attachments.saveImage({ data: await image(1920, 1080), mediaType: 'image/png' }) const tall = await attachments.saveImage({ data: await image(1080, 1920), mediaType: 'image/png' }) - const squareRequest = await attachments.readImageRequest(square, { projection: grid, maxBytes: 2 * 1024 * 1024 }) - const smallRequest = await attachments.readImageRequest(small, { projection: grid, maxBytes: 2 * 1024 * 1024 }) - const thinRequest = await attachments.readImageRequest(thin, { projection: grid, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }) - const budgeted = await attachments.readImageRequest(square, { projection: { kind: 'pixel-budget' as const, maxPixels: 1302 * 1302 }, maxBytes: 2 * 1024 * 1024 }) - const uncapped = await attachments.readImageRequest(thin, { projection: grid, maxBytes: 2 * 1024 * 1024 }) - const wideRequest = await attachments.readImageRequest(wide, { projection: grid, maxBytes: 2 * 1024 * 1024 }) - const tallRequest = await attachments.readImageRequest(tall, { projection: grid, maxBytes: 2 * 1024 * 1024 }) + const squareRequest = await attachments.readImageRequest(square, { width: 1302, height: 1302, maxBytes }) + const smallRequest = await attachments.readImageRequest(small, { width: 800, height: 800, maxBytes }) + const thinRequest = await attachments.readImageRequest(thin, { width: 4096, height: 20, maxBytes }) + const wideRequest = await attachments.readImageRequest(wide, { width: 1708, height: 961, maxBytes }) + const tallRequest = await attachments.readImageRequest(tall, { width: 961, height: 1708, maxBytes }) + const smaller = await attachments.readImageRequest(square, { width: 1024, height: 1024, maxBytes }) + const enlarged = await attachments.readImageRequest(thin, { width: 9000, height: 45, maxBytes }) expect(squareRequest).toMatchObject({ width: 1302, height: 1302, mediaType: 'image/jpeg' }) expect(smallRequest).toMatchObject({ width: 800, height: 800, mediaType: 'image/png' }) expect(smallRequest.data).toEqual((await attachments.readImage(small)).data) expect(thinRequest).toMatchObject({ width: 4096, height: 20 }) - expect(uncapped).toMatchObject({ width: 8000, height: 40 }) expect(wideRequest).toMatchObject({ width: 1708, height: 961 }) expect(tallRequest).toMatchObject({ width: 961, height: 1708 }) - expect(budgeted.variantId).not.toBe(squareRequest.variantId) - expect(uncapped.variantId).not.toBe(thinRequest.variantId) + expect(enlarged).toMatchObject({ width: 8000, height: 40 }) + expect(smaller.variantId).not.toBe(squareRequest.variantId) + expect(enlarged.variantId).not.toBe(thinRequest.variantId) }) it('keeps the smallest ladder output when the encoded-byte target is unreachable', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(1, 1), mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 }) + const request = await attachments.readImageRequest(attachment, { width: 1, height: 1, maxBytes: 1 }) expect(request.mediaType).toBe('image/jpeg') expect(request.bytes).toBeGreaterThan(1) @@ -118,7 +113,7 @@ describe('local request-image cache', () => { it('regenerates invalid, oversized, incompatible, or mismatched cached variants', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(64, 32), mediaType: 'image/png' }) - const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 4_096 } + const policy = { width: 22, height: 11, maxBytes: 4_096 } const initial = await attachments.readImageRequest(attachment, policy) const hash = String(initial.variantId).slice('sha256:'.length) const path = join(attachments.root, 'request-images', hash.slice(0, 2), hash) @@ -167,10 +162,10 @@ describe('local request-image cache', () => { data: await image(2048, 1024), mediaType: 'image/png', name: 'wide.png', }) - const squareRequest = await attachments.readImageRequest(square, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) - const wideRequest = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) - const repeated = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) - const low = await attachments.readImageRequest(wide, { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxBytes: 1024 * 1024 }) + const squareRequest = await attachments.readImageRequest(square, { width: 800, height: 800, maxBytes: 1024 * 1024 }) + const wideRequest = await attachments.readImageRequest(wide, { width: 1130, height: 565, maxBytes: 1024 * 1024 }) + const repeated = await attachments.readImageRequest(wide, { width: 1130, height: 565, maxBytes: 1024 * 1024 }) + const low = await attachments.readImageRequest(wide, { width: 724, height: 362, maxBytes: 1024 * 1024 }) expect(squareRequest).toMatchObject({ width: 800, height: 800 }) expect(wideRequest).toMatchObject({ width: 1130, height: 565 }) @@ -210,8 +205,8 @@ describe('local request-image cache', () => { const photo = await attachments.saveImage({ data: photoSource, mediaType: 'image/png' }) const alpha = await attachments.saveImage({ data: alphaSource, mediaType: 'image/png' }) - const photoRequest = await attachments.readImageRequest(photo, { projection: { kind: 'pixel-budget' as const, maxPixels: 128 * 128 }, maxBytes: 1024 * 1024 }) - const alphaRequest = await attachments.readImageRequest(alpha, { projection: { kind: 'pixel-budget' as const, maxPixels: 128 * 128 }, maxBytes: 4_096 }) + const photoRequest = await attachments.readImageRequest(photo, { width: 128, height: 128, maxBytes: 1024 * 1024 }) + const alphaRequest = await attachments.readImageRequest(alpha, { width: 128, height: 128, maxBytes: 4_096 }) expect(photoRequest.mediaType).toBe('image/jpeg') expect(alphaRequest.mediaType).toBe('image/webp') @@ -227,7 +222,7 @@ describe('local request-image cache', () => { }).toColourspace('rgb16').png().toBuffer()) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { width: 22, height: 11, maxBytes: 1024 * 1024 }) expect(request.bytes).toBeLessThanOrEqual(1024 * 1024) expect(request.width * request.height).toBeLessThanOrEqual(16 * 16) @@ -241,7 +236,7 @@ describe('local request-image cache', () => { const source = await complexOpaqueAlphaImage(64, 32) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 16 * 16 }, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { width: 22, height: 11, maxBytes: 1024 * 1024 }) expect(request.mediaType).toBe('image/webp') await expect(sharp(request.data).metadata()).resolves.toMatchObject({ hasAlpha: false }) @@ -263,7 +258,7 @@ describe('local request-image cache', () => { }).png().toBuffer()) const attachment = await attachments.saveImage({ data: source, mediaType: 'image/png' }) - const request = await attachments.readImageRequest(attachment, { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }) + const request = await attachments.readImageRequest(attachment, { width: 800, height: 800, maxBytes: 1024 * 1024 }) expect(request).toMatchObject({ width: 800, height: 800 }) expect(request.bytes).toBeLessThanOrEqual(1024 * 1024) @@ -276,7 +271,7 @@ describe('local request-image cache', () => { }) const run = vi.spyOn(CompressionLimiter.prototype, 'run') const controller = new AbortController() - const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 } + const policy = { width: 1130, height: 565, maxBytes: 1024 * 1024 } const cancelled = attachments.readImageRequest(attachment, policy, controller.signal) const completed = attachments.readImageRequest(attachment, policy) @@ -306,7 +301,7 @@ describe('local request-image cache', () => { const controller = new AbortController() const request = attachments.readImageRequest( attachment, - { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 }, + { width: 1130, height: 565, maxBytes: 1024 * 1024 }, controller.signal, ) await vi.waitFor(() => { @@ -339,7 +334,7 @@ describe('local request-image cache', () => { return actualRead(ref, signal) }) const controller = new AbortController() - const policy = { projection: { kind: 'pixel-budget' as const, maxPixels: 640_000 }, maxBytes: 1024 * 1024 } + const policy = { width: 1130, height: 565, maxBytes: 1024 * 1024 } const cancelled = attachments.readImageRequest(attachment, policy, controller.signal) await vi.waitFor(() => { expect(calls).toBe(1) diff --git a/packages/attachment/attachment/README.i18n.yaml b/packages/attachment/attachment/README.i18n.yaml index bab63d6a8a..87d9bd1b78 100644 --- a/packages/attachment/attachment/README.i18n.yaml +++ b/packages/attachment/attachment/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/attachment/attachment/README.md -README.md: e17d6bea53127d54babad919bdd546388b742d5f -README.zh.md: 5bf061304684cbdd8be00709ba9d1224b6c68ffa +README.md: d2a667e2d12deadc5e82a83cca6565f0b5a6aae0 +README.zh.md: b5598eb8ccca39d8b5be346c585fd84d3dd38468 diff --git a/packages/attachment/attachment/README.md b/packages/attachment/attachment/README.md index e17d6bea53..d2a667e2d1 100644 --- a/packages/attachment/attachment/README.md +++ b/packages/attachment/attachment/README.md @@ -66,13 +66,13 @@ This section explains the design decisions behind the seam and the service opera - **Normalize and persist before event.** Every source is prepared and verified before the batch publishes in order, so the session log never references a partial or failed normalization. - **Immutable and retention-neutral.** Objects are immutable once published; resumed and forked sessions may share them, so reference-aware garbage collection is deferred rather than tied to any one session's deletion. - **Verify on read.** Reads check bytes and metadata against the logged reference before returning them, and request projections fully decode cached bytes, so a missing, corrupted, or swapped object fails closed. -- **Role-neutral image blocks.** The `ImageBlock` content block in `dsh-llm` carries an `ImageAttachmentRef`; provider adapters resolve it into deterministic request versions under an explicit projection rule, per-side cap, and byte target, while execution filesystems may map the immutable host object to a model-readable process path. +- **Role-neutral image blocks.** The `ImageBlock` content block in `dsh-llm` carries an `ImageAttachmentRef`; provider adapters resolve it into deterministic request versions at an explicit route-chosen target size and byte target, while execution filesystems may map the immutable host object to a model-readable process path. - **Error routing by code.** `AttachmentError` re-implements the `HarnessError` shape instead of extending it because the base lives in `dsh-llm`, which depends on this package; consumers use `isAttachmentError` and route on `code`, never on the prototype chain. - **Files are verbatim, images are normalized.** `saveFile` commits an existing byte array, `saveFileStream` commits bounded chunks with backpressure and cancellation, `readFileStream` verifies and returns bounded chunks, and `fileHostPath` locates the stored object for read-on-demand projection; neither file write path applies admission limits. The image path keeps its separate normalization, limits, and request-version pipeline. The `FileBlock` content block in `dsh-llm` carries a `FileAttachmentRef`, and request assembly projects it to deterministic handle text for every route. ### Service operations -The service family runs one admission-and-storage flow: every entry point enforces source batch limits and canonical base64, prepares provider-independent normalized attachments before publishing any member, and commits them durably in input order without partial results. Host prompt consumers pass ordered text, encoded images, and already resolved file references to `ctx.attachments.admitPromptContent()`; the method persists images and passes file references unchanged. Encoded protocol adapters call `ctx.attachments.admitEncodedFile()`, which checks canonical base64 before delegating to `saveFile`; adapters recognize attachment failures through `ctx.attachments.isAttachmentError()`. Generic-file callers choose `saveFile` for existing bytes or `saveFileStream` for a bounded asynchronous byte source; both return the same durable reference, while `readFileStream` verifies its digest and length during a bounded read. `readImageRequest` derives deterministic route-sized variants whose identity includes the attachment id, transform version, projection rule, per-side cap, byte target, and encoder settings. The pure `requestImageDimensions` and `tokenGridProjection` exports compute each projection's aspect-preserving dimensions from a total-pixel budget or a provider token grid, so providers and request pricing share one geometry. `imageHostPath` exposes an implementation-owned host location only to trusted same-process consumers that need execution-world mapping. Callers compose ordered batches while the implementation owns compression concurrency, caching, and singleflight. Reads, streamed writes, and projections preserve caller cancellation. Failures carry stable machine-readable codes, and the caller-correctable admission subset is recognizable at runtime so each protocol adapter maps its own vocabulary; the exact per-operation contracts live in [`src/index.ts`](src/index.ts) and [`src/error.ts`](src/error.ts). +The service family runs one admission-and-storage flow: every entry point enforces source batch limits and canonical base64, prepares provider-independent normalized attachments before publishing any member, and commits them durably in input order without partial results. Host prompt consumers pass ordered text, encoded images, and already resolved file references to `ctx.attachments.admitPromptContent()`; the method persists images and passes file references unchanged. Encoded protocol adapters call `ctx.attachments.admitEncodedFile()`, which checks canonical base64 before delegating to `saveFile`; adapters recognize attachment failures through `ctx.attachments.isAttachmentError()`. Generic-file callers choose `saveFile` for existing bytes or `saveFileStream` for a bounded asynchronous byte source; both return the same durable reference, while `readFileStream` verifies its digest and length during a bounded read. `readImageRequest` derives deterministic route-sized variants whose identity includes the attachment id, transform version, target dimensions, byte target, and encoder settings. The pure `requestImageDimensions` and `longEdgeDimensions` exports compute aspect-preserving dimensions from a total-pixel budget or an exact long edge, so routes and request pricing share one geometry. `imageHostPath` exposes an implementation-owned host location only to trusted same-process consumers that need execution-world mapping. Callers compose ordered batches while the implementation owns compression concurrency, caching, and singleflight. Reads, streamed writes, and projections preserve caller cancellation. Failures carry stable machine-readable codes, and the caller-correctable admission subset is recognizable at runtime so each protocol adapter maps its own vocabulary; the exact per-operation contracts live in [`src/index.ts`](src/index.ts) and [`src/error.ts`](src/error.ts). ### Source map diff --git a/packages/attachment/attachment/README.zh.md b/packages/attachment/attachment/README.zh.md index 5bf0613046..b5598eb8cc 100644 --- a/packages/attachment/attachment/README.zh.md +++ b/packages/attachment/attachment/README.zh.md @@ -66,13 +66,13 @@ kind: "package-reference" - **事件前完成规范化与持久化。** 每个源图都会在批次按序发布前完成准备与校验，因此会话日志绝不会引用部分完成或规范化失败的对象。 - **不可变且保留策略中立。** 对象一经发布即不可变；恢复和 fork 后的会话可能共享它们，因此引用感知的垃圾回收被推迟，而不是与任何单个会话的删除绑定。 - **读取时校验。** 读取在返回前把字节和元数据与记录的引用比对，请求投影还会完整解码缓存字节，因此缺失、损坏或被替换的对象不会通过校验。 -- **角色无关的图片块。** `dsh-llm` 中的 `ImageBlock` 内容块携带 `ImageAttachmentRef`；提供方适配器按显式的投影规则、单边上限与字节目标把引用解析为确定性请求版本，执行文件系统则可以把不可变宿主对象映射为模型可读的进程路径。 +- **角色无关的图片块。** `dsh-llm` 中的 `ImageBlock` 内容块携带 `ImageAttachmentRef`；提供方适配器按路由显式选定的目标尺寸与字节目标把引用解析为确定性请求版本，执行文件系统则可以把不可变宿主对象映射为模型可读的进程路径。 - **按错误码路由。** `AttachmentError` 重新实现 `HarnessError` 的结构而不是继承它，因为基类位于 `dsh-llm`，而后者依赖本包；消费方用 `isAttachmentError` 识别错误并按 `code` 路由，绝不依赖原型链。 - **文件原样，图片规范化。**`saveFile` 提交已有字节数组，`saveFileStream` 以背压和取消语义提交有界分块，`readFileStream` 校验并返回有界分块，`fileHostPath` 定位存储对象供按需读取投影；两种文件写入路径都不设准入限制。图片路径保留其独立的规范化、限额与请求版本流水线。`dsh-llm` 中的 `FileBlock` 内容块承载 `FileAttachmentRef`，请求组装会为每条路由将其投影为确定性的句柄文本。 ### 服务操作 -服务族运行同一条准入与存储流程：每个入口都强制执行源批次限制与规范 base64，在发布任何成员前准备提供方无关的规范化附件，再按输入顺序持久提交而不产生部分结果。Host 提示词消费方把有序文本、编码图片和已经解析的文件引用交给 `ctx.attachments.admitPromptContent()`；该方法持久化图片，并让文件引用原样通过。编码协议适配器调用 `ctx.attachments.admitEncodedFile()`，由该方法检查规范 base64 后委托给 `saveFile`；适配器通过 `ctx.attachments.isAttachmentError()` 识别附件错误。通用文件调用方可以用 `saveFile` 提交已有字节，或用 `saveFileStream` 提交有界异步字节源；两者返回相同的持久引用，`readFileStream` 则在有界读取过程中校验摘要与长度。`readImageRequest` 派生确定性的路由尺寸变体，其身份包含附件 id、变换版本、投影规则、单边上限、字节目标及编码参数。纯函数导出 `requestImageDimensions` 与 `tokenGridProjection` 按总像素预算或提供方 token 网格计算每个投影保持宽高比的尺寸，使提供方与请求定价共享同一套几何计算。`imageHostPath` 只向需要把该位置映射到执行环境的受信任同进程消费方暴露实现拥有的宿主位置。调用方组合有序批次，而实现负责管理压缩并发、缓存与 singleflight。读取、流式写入和投影保留调用方的取消语义。失败带有稳定且机器可读的错误码，运行时即可识别可由调用方修正的准入子集，让每个协议适配器映射自己的词汇；各操作的确切约定见 [`src/index.ts`](src/index.ts) 与 [`src/error.ts`](src/error.ts)。 +服务族运行同一条准入与存储流程：每个入口都强制执行源批次限制与规范 base64，在发布任何成员前准备提供方无关的规范化附件，再按输入顺序持久提交而不产生部分结果。Host 提示词消费方把有序文本、编码图片和已经解析的文件引用交给 `ctx.attachments.admitPromptContent()`；该方法持久化图片，并让文件引用原样通过。编码协议适配器调用 `ctx.attachments.admitEncodedFile()`，由该方法检查规范 base64 后委托给 `saveFile`；适配器通过 `ctx.attachments.isAttachmentError()` 识别附件错误。通用文件调用方可以用 `saveFile` 提交已有字节，或用 `saveFileStream` 提交有界异步字节源；两者返回相同的持久引用，`readFileStream` 则在有界读取过程中校验摘要与长度。`readImageRequest` 派生确定性的路由尺寸变体，其身份包含附件 id、变换版本、目标尺寸、字节目标及编码参数。纯函数导出 `requestImageDimensions` 与 `longEdgeDimensions` 按总像素预算或精确长边计算保持宽高比的尺寸，使路由与请求定价共享同一套几何计算。`imageHostPath` 只向需要把该位置映射到执行环境的受信任同进程消费方暴露实现拥有的宿主位置。调用方组合有序批次，而实现负责管理压缩并发、缓存与 singleflight。读取、流式写入和投影保留调用方的取消语义。失败带有稳定且机器可读的错误码，运行时即可识别可由调用方修正的准入子集，让每个协议适配器映射自己的词汇；各操作的确切约定见 [`src/index.ts`](src/index.ts) 与 [`src/error.ts`](src/error.ts)。 ### 源码地图 diff --git a/packages/attachment/attachment/src/index.ts b/packages/attachment/attachment/src/index.ts index 312bd2a3e7..d5854336db 100644 --- a/packages/attachment/attachment/src/index.ts +++ b/packages/attachment/attachment/src/index.ts @@ -10,7 +10,7 @@ import type { FileAttachmentRef, ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveFileAttachment, SaveFileStreamAttachment, @@ -22,7 +22,7 @@ export { AttachmentId, ImageVariantId } from './brand.ts' export { AttachmentError, isAttachmentError, isImageAdmissionError } from './error.ts' export type { AttachmentErrorCode, ImageAdmissionErrorCode } from './error.ts' export { admitEncodedFile, admitEncodedImages } from './admission.ts' -export { requestImageDimensions, tokenGridProjection } from './request-projection.ts' +export { longEdgeDimensions, requestImageDimensions } from './request-projection.ts' export type { ProjectedDimensions } from './request-projection.ts' export type { AttachmentId as AttachmentIdType, @@ -33,8 +33,7 @@ export type { FileAttachmentRef, ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, - ImageRequestProjection, + ImageRequestTarget, ImageMediaType, PromptContentPart, RequestImageAttachment, @@ -42,7 +41,6 @@ export type { SaveFileStreamAttachment, SaveImageAttachment, StoredImageAttachment, - TokenGridProjection, } from './types.ts' declare module '@deepseek-ai/cordis' { @@ -244,18 +242,18 @@ export abstract class AttachmentStore extends Service { /** * Generate or read one deterministic model-request version from the stored normalized image. * @param ref - durable provider-independent normalized attachment reference. - * @param policy - route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output. + * @param target - route-chosen dimensions and byte target; an unmet byte target yields the smallest ladder output. * @param signal - optional cancellation. * @returns request bytes and the cache/upload identity covering every transform input. */ readImageRequest( ref: ImageAttachmentRef, - policy: ImageRequestPolicy, + target: ImageRequestTarget, signal?: AbortSignal, ): Promise { signal?.throwIfAborted() void ref - void policy + void target return Promise.reject(new AttachmentError( 'The mounted attachment provider cannot derive model-request images.', 'ATTACHMENT_PROJECTION_UNSUPPORTED', diff --git a/packages/attachment/attachment/src/request-projection.ts b/packages/attachment/attachment/src/request-projection.ts index f1a9d855ed..4e809a3632 100644 --- a/packages/attachment/attachment/src/request-projection.ts +++ b/packages/attachment/attachment/src/request-projection.ts @@ -1,21 +1,26 @@ /** - * Pure request-projection geometry shared by attachment providers and - * provider-side request pricing. @module @deepseek-ai/dsh-attachment/request-projection + * Pure request-projection geometry shared by model routes and provider-side + * request pricing. @module @deepseek-ai/dsh-attachment/request-projection */ -import type { ImageRequestPolicy, ImageRequestProjection, TokenGridProjection } from './types.ts' - /** Integer width and height of one projected image. */ export interface ProjectedDimensions { width: number height: number } -const intDiv = (value: number, divisor: number): number => Math.floor(value / divisor) -const ceilDiv = (value: number, divisor: number): number => Math.floor((value + divisor - 1) / divisor) - -/** Aspect-preserving integer dimensions within a hard total-pixel budget; small images are not enlarged. */ -function pixelBudgetDimensions(width: number, height: number, maxPixels: number): ProjectedDimensions { +/** + * Compute aspect-preserving integer dimensions within a hard total-pixel budget. + * @param width - positive source width. + * @param height - positive source height. + * @param maxPixels - positive width-times-height cap. + * @returns inward-rounded dimensions; small images are not enlarged. + */ +export function requestImageDimensions( + width: number, + height: number, + maxPixels: number, +): ProjectedDimensions { const scale = Math.min(1, Math.sqrt(maxPixels / (width * height))) if (scale === 1) return { width, height } if (width >= height) { @@ -36,103 +41,22 @@ function pixelBudgetDimensions(width: number, height: number, maxPixels: number) return { width: projectedWidth, height: projectedHeight } } -/** Token count of one grid: every row carries a separator, plus two framing tokens. */ -function gridTokens(rows: number, columns: number): number { - return rows * (columns + 1) + 2 -} - /** - * Project one image onto the token grid of a `token-grid` projection. The - * provider pads each edge up to a whole patch, groups patches into token - * cells, and keeps the padded source when its cell grid fits `maxTokens`; - * otherwise it solves the largest aspect-preserving grid inside the cap, whose - * edges are whole patches. The closed-form solve always lands inside the cap. - * @param width - positive integer source width in pixels. - * @param height - positive integer source height in pixels. - * @param grid - patch size, per-axis downsampling ratio, and token cap. - * @returns the dimensions the provider retains and the tokens it charges. + * Compute aspect-preserving integer dimensions with an exact long edge; the + * short edge rounds to the nearest pixel, as an encoder resize by the + * long edge alone. + * @param width - positive source width. + * @param height - positive source height. + * @param longEdge - positive target for the longer source edge. + * @returns the target dimensions; a long edge at or above the source returns the source unchanged. */ -export function tokenGridProjection( +export function longEdgeDimensions( width: number, height: number, - grid: Extract, -): TokenGridProjection { - const { patchSize, downsampleRatio, maxTokens } = grid - const cells = (paddedLength: number): number => ceilDiv(intDiv(paddedLength, patchSize), downsampleRatio) - const paddedWidth = ceilDiv(width, patchSize) * patchSize - const paddedHeight = ceilDiv(height, patchSize) * patchSize - const directTokens = gridTokens(cells(paddedHeight), cells(paddedWidth)) - if (directTokens <= maxTokens) { - return { width: paddedWidth, height: paddedHeight, tokens: directTokens, unscaled: true } - } - const cellSize = patchSize * downsampleRatio - const aspect = height / width - const idealColumns = Math.sqrt((maxTokens - 2) / aspect + 0.25) - 0.5 - const idealRows = idealColumns * aspect - let bestWidth: number - let bestHeight: number - if (idealColumns < 1) { - bestWidth = cellSize - bestHeight = intDiv(maxTokens - 2, 2) * cellSize - } else if (idealRows < 1) { - bestWidth = (maxTokens - 3) * cellSize - bestHeight = cellSize - } else { - const columns = Math.trunc(idealColumns) - const rows = Math.trunc(idealRows) - const scale = Math.min(columns * cellSize / width, rows * cellSize / height) - bestWidth = Math.trunc(width * scale / patchSize) * patchSize - bestHeight = Math.trunc(height * scale / patchSize) * patchSize - } - return { - width: bestWidth, - height: bestHeight, - tokens: gridTokens(cells(bestHeight), cells(bestWidth)), - unscaled: false, - } -} - -/** Aspect-preserving dimensions with an exact long edge; the short edge rounds to the nearest pixel. */ -function fromLongEdge(width: number, height: number, longEdge: number): ProjectedDimensions { + longEdge: number, +): ProjectedDimensions { + if (longEdge >= Math.max(width, height)) return { width, height } return width >= height ? { width: longEdge, height: Math.max(1, Math.round(longEdge * height / width)) } : { width: Math.max(1, Math.round(longEdge * width / height)), height: longEdge } } - -function projectDimensions(width: number, height: number, projection: ImageRequestProjection): ProjectedDimensions { - switch (projection.kind) { - case 'pixel-budget': - return pixelBudgetDimensions(width, height, projection.maxPixels) - case 'token-grid': { - const fit = tokenGridProjection(width, height, projection) - if (fit.unscaled) return { width, height } - return fromLongEdge(width, height, width >= height ? fit.width : fit.height) - } - /* v8 ignore next 4 -- ImageRequestProjection is a closed union; this branch is only the static exhaustiveness guard. */ - default: { - const unreachable: never = projection - throw new Error(`unknown image request projection ${JSON.stringify(unreachable)}`) - } - } -} - -/** - * Compute the aspect-preserving integer dimensions of one request image: - * the policy projection first, then the optional per-side cap. Small images - * are never enlarged. A downscaled result keeps the source long edge exact - * and rounds the short edge, matching a long-edge-only encoder resize. - * @param width - positive source width. - * @param height - positive source height. - * @param policy - route projection rule and optional per-side cap. - * @returns integer dimensions. - */ -export function requestImageDimensions( - width: number, - height: number, - policy: Pick, -): ProjectedDimensions { - const projected = projectDimensions(width, height, policy.projection) - const longEdge = Math.max(projected.width, projected.height) - if (policy.maxDimension === undefined || longEdge <= policy.maxDimension) return projected - return fromLongEdge(width, height, policy.maxDimension) -} diff --git a/packages/attachment/attachment/src/types.ts b/packages/attachment/attachment/src/types.ts index 0c8482a1eb..455d6c9de0 100644 --- a/packages/attachment/attachment/src/types.ts +++ b/packages/attachment/attachment/src/types.ts @@ -132,46 +132,12 @@ export interface StoredImageAttachment { data: Uint8Array } -/** Aspect-preserving downscale rule of one request image; small images are never enlarged. */ -export type ImageRequestProjection = - | { - /** Hard cap on width multiplied by height. */ - kind: 'pixel-budget' - /** Maximum width multiplied by height after projection. */ - maxPixels: number - } - | { - /** - * Largest aspect-preserving patch grid whose token count - * `rows × (columns + 1) + 2` fits `maxTokens`; the DeepSeek published vision layout. - */ - kind: 'token-grid' - /** Patch edge in pixels; a downscaled edge is a whole number of patches. */ - patchSize: number - /** Patches per token cell along each axis. */ - downsampleRatio: number - /** Token cap for one image. */ - maxTokens: number - } - -/** Dimensions a `token-grid` projection retains for one image and the tokens it charges. */ -export interface TokenGridProjection { - /** Retained width: the patch-padded source when it fits, otherwise the solved width. */ +/** Deterministic request-image target selected by one exact model route for one attachment. */ +export interface ImageRequestTarget { + /** Target width in pixels; a target above the source keeps the source width. */ width: number - /** Retained height: the patch-padded source when it fits, otherwise the solved height. */ + /** Target height in pixels; a target above the source keeps the source height. */ height: number - /** Tokens charged for the retained grid. */ - tokens: number - /** Whether the patch-padded source already fits `maxTokens` without downscaling. */ - unscaled: boolean -} - -/** Deterministic request-image policy selected by one exact model route. */ -export interface ImageRequestPolicy { - /** Downscale rule applied before the per-side cap. */ - projection: ImageRequestProjection - /** Maximum width and maximum height after projection; omission bounds the long edge by the projection alone. */ - maxDimension?: number /** Encoded-byte target before base64 expansion or Files API upload; the smallest quality-ladder output is kept when no quality fits. */ maxBytes: number } diff --git a/packages/attachment/attachment/tests/index.spec.ts b/packages/attachment/attachment/tests/index.spec.ts index 63c0471f40..9ce59d2d48 100644 --- a/packages/attachment/attachment/tests/index.spec.ts +++ b/packages/attachment/attachment/tests/index.spec.ts @@ -8,7 +8,7 @@ import AttachmentStore, { isImageAdmissionError, type ImageAttachmentRef, type ImageMediaType, - type ImageRequestPolicy, + type ImageRequestTarget, type RequestImageAttachment, type SaveFileAttachment, type SaveImageAttachment, @@ -56,7 +56,7 @@ class RecordingStore extends AttachmentStore { override readImageRequest( ref: ImageAttachmentRef, - _policy: ImageRequestPolicy, + _target: ImageRequestTarget, ): Promise { this.calls.push(`request:${ref.name}`) return Promise.resolve({ @@ -154,12 +154,12 @@ describe('AttachmentStore.readImageRequest', () => { it('reports unsupported request projection while preserving cancellation', async () => { const store = new UnsupportedProjectionStore(new Context()) const ref = await new RecordingStore(new Context()).saveImage(image(1)) - await expect(store.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 })) + await expect(store.readImageRequest(ref, { width: 1, height: 1, maxBytes: 1 })) .rejects.toMatchObject({ code: 'ATTACHMENT_PROJECTION_UNSUPPORTED' }) const controller = new AbortController() const reason = new Error('cancel unsupported projection') controller.abort(reason) - expect(() => store.readImageRequest(ref, { projection: { kind: 'pixel-budget' as const, maxPixels: 1 }, maxBytes: 1 }, controller.signal)).toThrow(reason) + expect(() => store.readImageRequest(ref, { width: 1, height: 1, maxBytes: 1 }, controller.signal)).toThrow(reason) }) it('rejects generic-file storage and exposes no provider-owned host path by default', async () => { diff --git a/packages/attachment/attachment/tests/request-projection.spec.ts b/packages/attachment/attachment/tests/request-projection.spec.ts index 0a7d604b5b..2db1578863 100644 --- a/packages/attachment/attachment/tests/request-projection.spec.ts +++ b/packages/attachment/attachment/tests/request-projection.spec.ts @@ -1,18 +1,14 @@ import { describe, expect, it } from 'vitest' -import { requestImageDimensions, tokenGridProjection } from '../src/index.ts' -import type { ImageRequestProjection } from '../src/index.ts' +import { longEdgeDimensions, requestImageDimensions } from '../src/index.ts' -const PIXEL_BUDGET: ImageRequestProjection = { kind: 'pixel-budget', maxPixels: 640_000 } -const TOKEN_GRID = { kind: 'token-grid', patchSize: 14, downsampleRatio: 3, maxTokens: 1024 } as const - -describe('pixel-budget projection', () => { +describe('request image dimensions', () => { it.each([ [4096, 4096, 800, 800], [4096, 2048, 1130, 565], [3840, 2160, 1066, 600], [320, 240, 320, 240], ])('projects %sx%s under 640,000 pixels as %sx%s', (width, height, expectedWidth, expectedHeight) => { - const projected = requestImageDimensions(width, height, { projection: PIXEL_BUDGET }) + const projected = requestImageDimensions(width, height, 640_000) expect(projected).toEqual({ width: expectedWidth, height: expectedHeight, @@ -21,65 +17,27 @@ describe('pixel-budget projection', () => { }) it('projects a portrait within the same total-pixel budget', () => { - const projected = requestImageDimensions(2160, 3840, { projection: PIXEL_BUDGET }) + const projected = requestImageDimensions(2160, 3840, 640_000) expect(projected).toEqual({ width: 600, height: 1066 }) expect(projected.width * projected.height).toBeLessThanOrEqual(640_000) }) it('rounds a portrait inward when integer aspect rounding crosses the pixel cap', () => { - expect(requestImageDimensions(2, 4, { projection: { kind: 'pixel-budget', maxPixels: 5 } })).toEqual({ width: 1, height: 2 }) + expect(requestImageDimensions(2, 4, 5)).toEqual({ width: 1, height: 2 }) }) }) -describe('token-grid projection', () => { - it('keeps the patch-padded source when its grid fits the token cap', () => { - expect(tokenGridProjection(800, 800, TOKEN_GRID)).toEqual({ width: 812, height: 812, tokens: 422, unscaled: true }) - expect(tokenGridProjection(1302, 1302, TOKEN_GRID)).toEqual({ width: 1302, height: 1302, tokens: 994, unscaled: true }) +describe('long-edge dimensions', () => { + it('keeps the long edge exact and rounds the short edge', () => { + expect(longEdgeDimensions(8000, 40, 4096)).toEqual({ width: 4096, height: 20 }) + expect(longEdgeDimensions(10_000, 100, 4096)).toEqual({ width: 4096, height: 41 }) + expect(longEdgeDimensions(1080, 2400, 1862)).toEqual({ width: 838, height: 1862 }) + expect(longEdgeDimensions(1, 9000, 4096)).toEqual({ width: 1, height: 4096 }) }) - it.each([ - [1303, 1303, 1302, 1302, 994], - [4096, 4096, 1302, 1302, 994], - [3840, 2160, 1708, 966, 968], - [2160, 3840, 966, 1708, 986], - [4000, 1000, 2520, 630, 917], - ])('solves %sx%s onto the largest in-cap grid %sx%s', (width, height, expectedWidth, expectedHeight, tokens) => { - expect(tokenGridProjection(width, height, TOKEN_GRID)).toEqual({ - width: expectedWidth, - height: expectedHeight, - tokens, - unscaled: false, - }) - expect(expectedWidth % TOKEN_GRID.patchSize).toBe(0) - expect(expectedHeight % TOKEN_GRID.patchSize).toBe(0) - }) - - it('solves one-row and one-column grids for extreme aspect ratios', () => { - expect(tokenGridProjection(100_000, 1, TOKEN_GRID)).toEqual({ width: 42_882, height: 42, tokens: 1024, unscaled: false }) - expect(tokenGridProjection(1, 100_000, TOKEN_GRID)).toEqual({ width: 42, height: 21_462, tokens: 1024, unscaled: false }) - }) - - it('sends a fitting source at its own dimensions and a larger source at the solved grid', () => { - expect(requestImageDimensions(800, 800, { projection: TOKEN_GRID })).toEqual({ width: 800, height: 800 }) - expect(requestImageDimensions(8192, 78, { projection: TOKEN_GRID })).toEqual({ width: 8192, height: 78 }) - expect(requestImageDimensions(2048, 1024, { projection: TOKEN_GRID })).toEqual({ width: 1848, height: 924 }) - }) - - it('keeps the solved long edge and rounds the short edge to the source aspect ratio', () => { - expect(requestImageDimensions(3840, 2160, { projection: TOKEN_GRID })).toEqual({ width: 1708, height: 961 }) - expect(requestImageDimensions(1080, 2400, { projection: TOKEN_GRID })).toEqual({ width: 838, height: 1862 }) - }) -}) - -describe('per-side cap', () => { - it('scales the projected image down to the cap on its long edge', () => { - expect(requestImageDimensions(8192, 78, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 4096, height: 39 }) - expect(requestImageDimensions(1, 8192, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 1, height: 4096 }) - expect(requestImageDimensions(10_000, 100, { projection: PIXEL_BUDGET, maxDimension: 4096 })).toEqual({ width: 4096, height: 41 }) - }) - - it('leaves an image within the cap untouched', () => { - expect(requestImageDimensions(2048, 2048, { projection: TOKEN_GRID, maxDimension: 4096 })).toEqual({ width: 1302, height: 1302 }) + it('never enlarges a source at or below the long edge', () => { + expect(longEdgeDimensions(320, 240, 320)).toEqual({ width: 320, height: 240 }) + expect(longEdgeDimensions(320, 240, 4096)).toEqual({ width: 320, height: 240 }) }) }) diff --git a/packages/extensions/tool-cordis/src/api-catalog.ts b/packages/extensions/tool-cordis/src/api-catalog.ts index c7a984b12a..beb0637aaa 100644 --- a/packages/extensions/tool-cordis/src/api-catalog.ts +++ b/packages/extensions/tool-cordis/src/api-catalog.ts @@ -548,9 +548,9 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [ throws: ['an AttachmentError when the durable reference is invalid.'], }, { - signature: 'readImageRequest( ref: ImageAttachmentRef, policy: ImageRequestPolicy, signal?: AbortSignal, ): Promise', + signature: 'readImageRequest( ref: ImageAttachmentRef, target: ImageRequestTarget, signal?: AbortSignal, ): Promise', description: 'Generate or read one deterministic model-request version from the stored normalized image.', - parameters: [{ name: 'ref', description: 'durable provider-independent normalized attachment reference.' }, { name: 'policy', description: 'route projection, optional per-side cap, and byte target; an unmet target yields the smallest ladder output.' }, { name: 'signal', description: 'optional cancellation.' }], + parameters: [{ name: 'ref', description: 'durable provider-independent normalized attachment reference.' }, { name: 'target', description: 'route-chosen dimensions and byte target; an unmet byte target yields the smallest ladder output.' }, { name: 'signal', description: 'optional cancellation.' }], returns: 'request bytes and the cache/upload identity covering every transform input.', }, ], @@ -4359,12 +4359,8 @@ export const TYPE_API: readonly TypeApiEntry[] = [ declaration: 'export type ImageMediaType = \'image/png\' | \'image/jpeg\' | \'image/webp\' | \'image/gif\';', }, { - name: 'ImageRequestPolicy', - declaration: 'export interface ImageRequestPolicy {\n projection: ImageRequestProjection;\n maxDimension?: number;\n maxBytes: number;\n}', - }, - { - name: 'ImageRequestProjection', - declaration: 'export type ImageRequestProjection = {\n kind: \'pixel-budget\';\n maxPixels: number;\n} | {\n kind: \'token-grid\';\n patchSize: number;\n downsampleRatio: number;\n maxTokens: number;\n};', + name: 'ImageRequestTarget', + declaration: 'export interface ImageRequestTarget {\n width: number;\n height: number;\n maxBytes: number;\n}', }, { name: 'ImageVariantId', diff --git a/packages/llm/llm-deepseek/README.i18n.yaml b/packages/llm/llm-deepseek/README.i18n.yaml index 734062fae9..95851bc4f2 100644 --- a/packages/llm/llm-deepseek/README.i18n.yaml +++ b/packages/llm/llm-deepseek/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/llm/llm-deepseek/README.md -README.md: c99431b0d415ef82d4833d7ca38b531b3cd38937 -README.zh.md: 1d515c5ee8a855981e529b7fff03cbf18fa9dde7 +README.md: b3ccd5bc7ed8c66ac4c0a5212d834fa8551d553d +README.zh.md: edfd5e89292f1e9ad478ccedb5601a7e95daea45 diff --git a/packages/llm/llm-deepseek/README.md b/packages/llm/llm-deepseek/README.md index c99431b0d4..b3ccd5bc7e 100644 --- a/packages/llm/llm-deepseek/README.md +++ b/packages/llm/llm-deepseek/README.md @@ -74,7 +74,7 @@ The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-a ### Streaming with thinking and images -An image-capable route resolves each durable reference into a deterministic request version under its projection, per-side cap, and byte target. Omitting `imagePixelBudget` projects onto the published vision token grid of 14px patches, 3:1 downsampling, and at most 1024 tokens per image, so a square image keeps up to 1302×1302 pixels and other aspect ratios keep the largest grid inside the cap; a positive integer replaces the grid with a total-pixel budget, and `low` uses 512×512 total pixels. Every request image is capped at 4096 pixels per side, the provider limit for requests carrying 15 or more images, and `imageMaxBytes` defaults to 2 MiB. Alpha images use WebP effort 0 and opaque images use JPEG on the 85/75/60 quality ladder, keeping the smallest output when every candidate exceeds the target. Every retained image is preceded by text naming its complete attachment id and actual request dimensions. When the current filesystem maps the attachment provider's host object, that text also carries a read-only execution-world path and the extension for a writable copy. Text-only and unlisted routes receive stable attachment placeholders while durable history keeps the image references. +An image-capable route chooses each durable reference's request target and resolves it into a deterministic request version. Omitting `imagePixelBudget` sizes the target on the published vision token grid of 14px patches, 3:1 downsampling, and at most 1024 tokens per image, so a square image keeps up to 1302×1302 pixels and a 16:9 image is sent as 1708×961 for the provider's 1708×966 grid; a positive integer replaces the grid with a total-pixel budget, and `low` uses 512×512 total pixels. Every request image is capped at 4096 pixels per side, the provider limit for requests carrying 15 or more images, and `imageMaxBytes` defaults to 2 MiB. Alpha images use WebP effort 0 and opaque images use JPEG on the 85/75/60 quality ladder, keeping the smallest output when every candidate exceeds the target. Every retained image is preceded by text naming its complete attachment id and actual request dimensions. When the current filesystem maps the attachment provider's host object, that text also carries a read-only execution-world path and the extension for a writable copy. Text-only and unlisted routes receive stable attachment placeholders while durable history keeps the image references. The adapter normally uploads those exact request bytes through the DeepSeek Files API and sends file-id blocks. A failed or timed-out file resolution rebuilds the whole chat request with the same request versions as base64 data URLs; one request never mixes file ids and inline images. Cached ids are scoped by endpoint and API key, refreshed before expiry, invalidated from provider stale-file errors, and resolved through singleflight with waiter-local cancellation. Quota failure deletes one configured batch of the oldest harness-owned files before one upload retry. diff --git a/packages/llm/llm-deepseek/README.zh.md b/packages/llm/llm-deepseek/README.zh.md index 1d515c5ee8..edfd5e8929 100644 --- a/packages/llm/llm-deepseek/README.zh.md +++ b/packages/llm/llm-deepseek/README.zh.md @@ -74,7 +74,7 @@ kind: "package-reference" ### 带 thinking 与图片的流式调用 -支持图片的路由会在自身投影、单边上限与字节目标内把每个持久引用解析为确定性请求版本。省略 `imagePixelBudget` 时按官方公布的视觉 token 网格投影，即 14 px patch、3:1 降采样、单图最多 1024 token，因此正方形图片最多保留 1302×1302 像素，其他宽高比保留上限内最大的网格；正整数会用总像素预算取代网格，`low` 使用总计 512×512 像素。每张请求图片单边最多 4096 像素，这是提供方对包含 15 张及以上图片的请求的限制；`imageMaxBytes` 默认为 2 MiB。带 alpha 的图片使用 effort 0 的 WebP，不透明图片使用 JPEG，并采用 85/75/60 质量阶梯；全部候选都超过目标时保留最小输出。每张保留图片前都有文本，注明完整附件 id 与实际请求尺寸。当前文件系统可以映射附件提供方的宿主对象时，该文本还携带只读执行世界路径与可写副本使用的扩展名。纯文本与未列出路由接收稳定附件占位符，而持久历史继续保留图片引用。 +支持图片的路由为每个持久引用选定请求目标，再把它解析为确定性请求版本。省略 `imagePixelBudget` 时按官方公布的视觉 token 网格定目标，即 14 px patch、3:1 降采样、单图最多 1024 token，因此正方形图片最多保留 1302×1302 像素，16:9 图片以 1708×961 发送、对应提供方 1708×966 的网格；正整数会用总像素预算取代网格，`low` 使用总计 512×512 像素。每张请求图片单边最多 4096 像素，这是提供方对包含 15 张及以上图片的请求的限制；`imageMaxBytes` 默认为 2 MiB。带 alpha 的图片使用 effort 0 的 WebP，不透明图片使用 JPEG，并采用 85/75/60 质量阶梯；全部候选都超过目标时保留最小输出。每张保留图片前都有文本，注明完整附件 id 与实际请求尺寸。当前文件系统可以映射附件提供方的宿主对象时，该文本还携带只读执行世界路径与可写副本使用的扩展名。纯文本与未列出路由接收稳定附件占位符，而持久历史继续保留图片引用。 适配器通常通过 DeepSeek Files API 上传这些确切请求字节，并发送 file-id 块。文件解析失败或超时会用相同请求版本的 base64 data URL 重建整份 chat 请求；一次请求绝不混用 file id 与内联图片。缓存 id 按端点与 API key 限定作用域，在到期前刷新，根据提供方的陈旧文件错误失效，并通过带等待方局部取消的 singleflight 解析。配额失败会先删除一批配置数量的最旧 harness 文件，再重试一次上传。 diff --git a/packages/llm/llm-deepseek/src/adapter.ts b/packages/llm/llm-deepseek/src/adapter.ts index 432902ca6b..5622209cea 100644 --- a/packages/llm/llm-deepseek/src/adapter.ts +++ b/packages/llm/llm-deepseek/src/adapter.ts @@ -38,7 +38,7 @@ import type { } from '@deepseek-ai/dsh-deepseek-llm-api-extensions' import { serializeRequest, serializeRequestWithImages } from './serialize.ts' import type { ImageWireLocation, RequestDefaults } from './serialize.ts' -import { deepSeekImageRequestPricing, resolveRequestImagePolicy } from './request-pricing.ts' +import { deepSeekImageRequestPricing, resolveRequestImageMaxBytes, resolveRequestImageTarget } from './request-pricing.ts' import { DeepSeekFileStore } from './file-store.ts' import type { DeepSeekFilePolicy } from './file-store.ts' import type { DeepSeekFileId } from './file-id.ts' @@ -229,10 +229,9 @@ async function prepareRequestImages( ): Promise> { const refs = new Map() for (const message of options.messages) collectImageRefs(message.content, refs) - const policy = resolveRequestImagePolicy(model) const orderedRefs = [...refs.values()] const projected = await Promise.all(orderedRefs.map( - ref => attachments.readImageRequest(ref, policy, signal), + ref => attachments.readImageRequest(ref, resolveRequestImageTarget(model, ref), signal), )) return new Map(orderedRefs.map((ref, index) => ( [ref.attachmentId, projected[index] as RequestImageAttachment] @@ -556,18 +555,18 @@ export class DeepSeekAdapter extends LlmAdapter { const fileConnection = { baseURL: connection.baseURL, apiKey } const model = connection.models.find(entry => entry.id === options.model) - const policy = model === undefined ? undefined : resolveRequestImagePolicy(model) + const maxBytes = model === undefined ? undefined : resolveRequestImageMaxBytes(model) const resolveImageAccess = attachments === undefined ? undefined : (ref: ImageAttachmentRef): ImageAttachmentAccess | undefined => this.config.resolveImageAccess?.(attachments, ref) const imageAccessOptions = resolveImageAccess === undefined ? {} : { resolveImageAccess } - const requestMessages = policy === undefined ? options.messages : offloadRequestImagesWithPolicy(options.messages, { + const requestMessages = maxBytes === undefined ? options.messages : offloadRequestImagesWithPolicy(options.messages, { representation: 'raw', maxBytes: connection.maxRequestFilesBytes, maxImages: connection.maxImagesPerRequest, byteQuantum: connection.imageOffloadByteQuantum, countQuantum: connection.imageOffloadCountQuantum, - byteLength: ref => Math.min(ref.bytes, policy.maxBytes), + byteLength: ref => Math.min(ref.bytes, maxBytes), placeholder: ref => offloadedImageText(ref, resolveImageAccess?.(ref)), }) const requestOptions = requestMessages === options.messages ? options : { ...options, messages: [...requestMessages] } diff --git a/packages/llm/llm-deepseek/src/image-tokens.ts b/packages/llm/llm-deepseek/src/image-tokens.ts index 318ee1f399..c5618af0f9 100644 --- a/packages/llm/llm-deepseek/src/image-tokens.ts +++ b/packages/llm/llm-deepseek/src/image-tokens.ts @@ -1,39 +1,139 @@ /** * DeepSeek vision-token accounting: the provider's published image-token - * calculator (api-docs.deepseek.com, Token & Token Usage) in its current - * `v41` configuration. The provider scales an image below 544×544 total - * pixels up, then projects it onto the token grid shared with request - * projection, iterating to a fixpoint. The count is exact: this configuration - * has no alignment pad and no aspect-ratio clamp. Actual usage remains - * authoritative. + * calculator (api-docs.deepseek.com, Token & Token Usage) ported verbatim in + * its current `v41` configuration. The provider scales an image below + * 544×544 total pixels up, aligns it to a 14px-patch grid, downsamples 3:1 + * per axis into token cells, and caps one image at 1024 tokens by solving the + * largest aspect-preserving grid inside that budget. The count is exact: this + * configuration has no alignment pad and no aspect-ratio clamp. Actual usage + * remains authoritative. * * @module dsh-llm-deepseek/image-tokens */ -import { tokenGridProjection } from '@deepseek-ai/dsh-attachment' -import type { ImageRequestProjection, TokenGridProjection } from '@deepseek-ai/dsh-attachment' - -/** Published DeepSeek vision grid: 14px patches, 3:1 per-axis downsampling, at most 1024 tokens per image. */ -export const DEEPSEEK_IMAGE_TOKEN_GRID = { - kind: 'token-grid', - patchSize: 14, - downsampleRatio: 3, - maxTokens: 1024, -} as const satisfies ImageRequestProjection - +import { longEdgeDimensions } from '@deepseek-ai/dsh-attachment' +import type { ProjectedDimensions } from '@deepseek-ai/dsh-attachment' +/** Vision patch edge in pixels. */ +const PATCH_SIZE = 14 +/** Per-axis patch-to-token downsampling ratio. */ +const DOWNSAMPLE_RATIO = 3 +/** Provider cap on tokens for one request image. */ +const MAX_IMAGE_TOKENS = 1024 /** Total-pixel floor; smaller images are scaled up before grid projection. */ const MIN_PIXELS = 544 * 544 +/** Pixels covered by one token cell along either axis. */ +const CELL_SIZE = PATCH_SIZE * DOWNSAMPLE_RATIO -/** One scale-up-then-project pass; the caller iterates it to a fixpoint. */ -function resizeOnce(width: number, height: number): TokenGridProjection { - const pixels = width * height - if (pixels >= MIN_PIXELS) return tokenGridProjection(width, height, DEEPSEEK_IMAGE_TOKEN_GRID) - const scale = Math.sqrt(MIN_PIXELS / pixels) - return tokenGridProjection(Math.trunc(width * scale), Math.trunc(height * scale), DEEPSEEK_IMAGE_TOKEN_GRID) +const intDiv = (value: number, divisor: number): number => Math.floor(value / divisor) +const ceilDiv = (value: number, divisor: number): number => Math.floor((value + divisor - 1) / divisor) + +interface GridResize { + readonly gridHeight: number + readonly gridWidth: number + readonly bestHeight: number + readonly bestWidth: number + readonly numTokens: number } -function sameResize(a: TokenGridProjection, b: TokenGridProjection): boolean { - return a.width === b.width && a.height === b.height && a.tokens === b.tokens +/** Token count of one grid: every row carries a separator, plus two framing tokens. */ +function gridTokens(gridHeight: number, gridWidth: number): number { + return gridHeight * (gridWidth + 1) + 2 +} + +/** Token-cell count along one padded pixel axis. */ +function gridCells(paddedLength: number): number { + return ceilDiv(intDiv(paddedLength, PATCH_SIZE), DOWNSAMPLE_RATIO) +} + +/** Solve the largest grid within `budget` tokens preserving the aspect ratio. */ +function solveResizeRatio(height: number, width: number, budget: number): GridResize { + const aspect = height / width + const idealGridWidth = Math.sqrt((budget - 2) / aspect + 0.25) - 0.5 + const idealGridHeight = idealGridWidth * aspect + let bestHeight: number + let bestWidth: number + if (idealGridWidth < 1) { + const solvedGridWidth = 1 + const solvedGridHeight = intDiv(budget - 2, solvedGridWidth + 1) + bestWidth = solvedGridWidth * CELL_SIZE + bestHeight = solvedGridHeight * CELL_SIZE + } else if (idealGridHeight < 1) { + const solvedGridHeight = 1 + const solvedGridWidth = intDiv(budget - 2, solvedGridHeight) - 1 + bestWidth = solvedGridWidth * CELL_SIZE + bestHeight = solvedGridHeight * CELL_SIZE + } else { + const solvedGridWidth = Math.trunc(idealGridWidth) + const solvedGridHeight = Math.trunc(idealGridHeight) + const scale = Math.min(solvedGridWidth * CELL_SIZE / width, solvedGridHeight * CELL_SIZE / height) + bestWidth = Math.trunc(width * scale / PATCH_SIZE) * PATCH_SIZE + bestHeight = Math.trunc(height * scale / PATCH_SIZE) * PATCH_SIZE + } + const gridHeight = gridCells(bestHeight) + const gridWidth = gridCells(bestWidth) + return { gridHeight, gridWidth, bestHeight, bestWidth, numTokens: gridTokens(gridHeight, gridWidth) } +} + +/** Project padded pixel dimensions onto the largest in-budget token grid. */ +function safeResize(height: number, width: number, paddedHeight: number, paddedWidth: number): GridResize { + const gridHeight = gridCells(paddedHeight) + const gridWidth = gridCells(paddedWidth) + const direct: GridResize = { + gridHeight, + gridWidth, + bestHeight: paddedHeight, + bestWidth: paddedWidth, + numTokens: gridTokens(gridHeight, gridWidth), + } + if (direct.numTokens <= MAX_IMAGE_TOKENS) return direct + const solved = solveResizeRatio(height, width, MAX_IMAGE_TOKENS) + /* v8 ignore next 3 -- the published solver's assertion; the closed-form + solve stays within the budget for every positive geometry. */ + if (solved.numTokens > MAX_IMAGE_TOKENS) { + throw new Error(`deepseek image tokens: no grid fits the token budget for ${width}x${height}`) + } + return solved +} + +/** One scale-pad-project pass; the caller iterates it to a fixpoint. */ +function resizeOnce(width: number, height: number): GridResize { + let scaledWidth = width + let scaledHeight = height + const pixels = scaledWidth * scaledHeight + if (pixels < MIN_PIXELS && pixels > 0) { + const scale = Math.sqrt(MIN_PIXELS / pixels) + scaledWidth = Math.trunc(scaledWidth * scale) + scaledHeight = Math.trunc(scaledHeight * scale) + } + const paddedWidth = ceilDiv(scaledWidth, PATCH_SIZE) * PATCH_SIZE + const paddedHeight = ceilDiv(scaledHeight, PATCH_SIZE) * PATCH_SIZE + return safeResize(scaledHeight, scaledWidth, paddedHeight, paddedWidth) +} + +function sameResize(a: GridResize, b: GridResize): boolean { + return a.gridHeight === b.gridHeight + && a.gridWidth === b.gridWidth + && a.bestHeight === b.bestHeight + && a.bestWidth === b.bestWidth + && a.numTokens === b.numTokens +} + +/** + * Dimensions the harness sends so the provider keeps the whole image: the + * source itself when its patch-padded grid fits the token cap, otherwise the + * source aspect ratio at the solved grid's long edge. The provider pads the + * short edge to whole patches on its side, so the token count equals the + * solved grid's. Small images are never enlarged. + * @param width - positive integer source width in pixels. + * @param height - positive integer source height in pixels. + * @returns the request dimensions to encode. + */ +export function deepSeekRequestImageDimensions(width: number, height: number): ProjectedDimensions { + const paddedWidth = ceilDiv(width, PATCH_SIZE) * PATCH_SIZE + const paddedHeight = ceilDiv(height, PATCH_SIZE) * PATCH_SIZE + if (gridTokens(gridCells(paddedHeight), gridCells(paddedWidth)) <= MAX_IMAGE_TOKENS) return { width, height } + const solved = solveResizeRatio(height, width, MAX_IMAGE_TOKENS) + return longEdgeDimensions(width, height, width >= height ? solved.bestWidth : solved.bestHeight) } /** @@ -46,8 +146,8 @@ function sameResize(a: TokenGridProjection, b: TokenGridProjection): boolean { export function deepSeekImageTokens(width: number, height: number): number { let result = resizeOnce(width, height) for (let iteration = 1; iteration < 10; iteration += 1) { - const next = resizeOnce(result.width, result.height) - if (sameResize(next, result)) return result.tokens + const next = resizeOnce(result.bestWidth, result.bestHeight) + if (sameResize(next, result)) return result.numTokens result = next } /* v8 ignore next 2 -- the published solver's non-convergence guard; every diff --git a/packages/llm/llm-deepseek/src/index.ts b/packages/llm/llm-deepseek/src/index.ts index 1e41a4f5f7..e3f470d6fa 100644 --- a/packages/llm/llm-deepseek/src/index.ts +++ b/packages/llm/llm-deepseek/src/index.ts @@ -65,9 +65,10 @@ export { DEFAULT_REQUEST_IMAGE_MAX_BYTES, REQUEST_IMAGE_MAX_DIMENSION, deepSeekImageRequestPricing, - resolveRequestImagePolicy, + resolveRequestImageMaxBytes, + resolveRequestImageTarget, } from './request-pricing.ts' -export { DEEPSEEK_IMAGE_TOKEN_GRID, deepSeekImageTokens } from './image-tokens.ts' +export { deepSeekImageTokens, deepSeekRequestImageDimensions } from './image-tokens.ts' export { DeepSeekFileStore, MAX_CHAT_IMAGE_BYTES } from './file-store.ts' export type { DeepSeekFileConnection, DeepSeekFilePolicy, DeepSeekFileReference } from './file-store.ts' export { DeepSeekFilesClient, MAX_FILE_EXPIRY_SECONDS, MAX_FILE_UPLOAD_BYTES, MAX_STORED_FILE_BYTES, MAX_STORED_FILE_COUNT, MIN_FILE_EXPIRY_SECONDS } from './files-api.ts' diff --git a/packages/llm/llm-deepseek/src/request-pricing.ts b/packages/llm/llm-deepseek/src/request-pricing.ts index 732038da28..7d6091fcc2 100644 --- a/packages/llm/llm-deepseek/src/request-pricing.ts +++ b/packages/llm/llm-deepseek/src/request-pricing.ts @@ -1,6 +1,6 @@ /** * Provider-side request-image pricing for DeepSeek routes: reproduces the - * adapter's deterministic request projection (per-model projection, + * adapter's deterministic request projection (per-model request target, * oldest-first offload under the raw-byte and count budgets) and prices every * retained image with the published vision-token accounting. Consumed * synchronously by the token meter through `LlmAdapter.imageRequestPricing`; @@ -11,9 +11,9 @@ import { offloadedImageText, offloadedImagePrefixCount, requestImageHandleText, textOnlyImageText } from '@deepseek-ai/dsh-llm' import type { ImageAttachmentAccessResolver, LlmImageRequestPrice, LlmImageRequestPricing } from '@deepseek-ai/dsh-llm' -import { requestImageDimensions } from '@deepseek-ai/dsh-attachment' -import type { ImageAttachmentRef, ImageRequestPolicy, ImageRequestProjection } from '@deepseek-ai/dsh-attachment' -import { DEEPSEEK_IMAGE_TOKEN_GRID, deepSeekImageTokens } from './image-tokens.ts' +import { longEdgeDimensions, requestImageDimensions } from '@deepseek-ai/dsh-attachment' +import type { ImageAttachmentRef, ImageRequestTarget } from '@deepseek-ai/dsh-attachment' +import { deepSeekImageTokens, deepSeekRequestImageDimensions } from './image-tokens.ts' import type { DeepSeekCatalogModel, DeepSeekConnectionOptions } from './adapter.ts' /** Default bound on accumulated file-referenced image bytes per request. */ @@ -31,25 +31,37 @@ export const DEFAULT_REQUEST_IMAGE_MAX_BYTES = 2 * 1024 * 1024 export const REQUEST_IMAGE_MAX_DIMENSION = 4096 /** - * Resolve the request-image policy owned by one DeepSeek model route: the - * published token grid unless the model overrides it with a pixel budget, - * the provider per-side limit, and the encoded-byte target. + * Resolve the encoded-byte target one DeepSeek model route applies to every request image. * @param model - Advertised model route and its optional image overrides. - * @returns Complete projection, per-side cap, and encoded-byte target. + * @returns the route's encoded-byte target. * @internal */ -export function resolveRequestImagePolicy(model: DeepSeekCatalogModel): ImageRequestPolicy { - const projection: ImageRequestProjection = model.imagePixelBudget === undefined - ? DEEPSEEK_IMAGE_TOKEN_GRID - : { - kind: 'pixel-budget', - maxPixels: model.imagePixelBudget === 'low' ? DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET : model.imagePixelBudget, - } - return { - projection, - maxDimension: REQUEST_IMAGE_MAX_DIMENSION, - maxBytes: model.imageMaxBytes ?? DEFAULT_REQUEST_IMAGE_MAX_BYTES, - } +export function resolveRequestImageMaxBytes(model: DeepSeekCatalogModel): number { + return model.imageMaxBytes ?? DEFAULT_REQUEST_IMAGE_MAX_BYTES +} + +/** + * Resolve the deterministic request target one DeepSeek model route chooses + * for one source image: the published token grid unless the model overrides + * it with a pixel budget, then the provider per-side limit, then the route's + * encoded-byte target. Small images are never enlarged. + * @param model - Advertised model route and its optional image overrides. + * @param source - intrinsic dimensions of the normalized attachment. + * @returns Complete request dimensions and encoded-byte target. + * @internal + */ +export function resolveRequestImageTarget( + model: DeepSeekCatalogModel, + source: Pick, +): ImageRequestTarget { + const budget = model.imagePixelBudget === 'low' ? DEFAULT_LOW_DETAIL_IMAGE_PIXEL_BUDGET : model.imagePixelBudget + const projected = budget === undefined + ? deepSeekRequestImageDimensions(source.width, source.height) + : requestImageDimensions(source.width, source.height, budget) + const capped = Math.max(projected.width, projected.height) > REQUEST_IMAGE_MAX_DIMENSION + ? longEdgeDimensions(source.width, source.height, REQUEST_IMAGE_MAX_DIMENSION) + : projected + return { ...capped, maxBytes: resolveRequestImageMaxBytes(model) } } /** @@ -86,11 +98,11 @@ export function deepSeekImageRequestPricing( if (catalogModel?.inputModalities?.includes('image') !== true) { return { priceImages: images => images.map(textOnlyPrice) } } - const policy = resolveRequestImagePolicy(catalogModel) + const maxBytes = resolveRequestImageMaxBytes(catalogModel) return { priceImages: (images) => { const offloaded = offloadedImagePrefixCount( - images.map(ref => Math.min(ref.bytes, policy.maxBytes)), + images.map(ref => Math.min(ref.bytes, maxBytes)), { maxBytes: connection.maxRequestFilesBytes, maxImages: connection.maxImagesPerRequest, @@ -102,10 +114,10 @@ export function deepSeekImageRequestPricing( if (index < offloaded) { return { visualTokens: 0, text: offloadedImageText(ref, resolveAccess?.(ref)) } } - const dimensions = requestImageDimensions(ref.width, ref.height, policy) + const target = resolveRequestImageTarget(catalogModel, ref) return { - visualTokens: deepSeekImageTokens(dimensions.width, dimensions.height), - text: requestImageHandleText(ref, dimensions, resolveAccess?.(ref)), + visualTokens: deepSeekImageTokens(target.width, target.height), + text: requestImageHandleText(ref, target, resolveAccess?.(ref)), } }) }, diff --git a/packages/llm/llm-deepseek/tests/adapter.e2e.ts b/packages/llm/llm-deepseek/tests/adapter.e2e.ts index fc14b03e55..12251be841 100644 --- a/packages/llm/llm-deepseek/tests/adapter.e2e.ts +++ b/packages/llm/llm-deepseek/tests/adapter.e2e.ts @@ -14,7 +14,7 @@ import LocalAttachments from '@deepseek-ai/dsh-attachment-local' import type { ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveImageAttachment, StoredImageAttachment, @@ -92,7 +92,7 @@ class E2eAttachmentStore extends AttachmentStore { override readImageRequest( _ref: ImageAttachmentRef, - _policy: ImageRequestPolicy, + _target: ImageRequestTarget, _signal?: AbortSignal, ): Promise { return Promise.resolve(this.version) diff --git a/packages/llm/llm-deepseek/tests/adapter.spec.ts b/packages/llm/llm-deepseek/tests/adapter.spec.ts index 4122023b2c..3f8c261b3a 100644 --- a/packages/llm/llm-deepseek/tests/adapter.spec.ts +++ b/packages/llm/llm-deepseek/tests/adapter.spec.ts @@ -20,9 +20,9 @@ import { SessionId } from '@deepseek-ai/dsh-session' import DeepSeekLlmApiExtensionRegistry from '@deepseek-ai/dsh-deepseek-llm-api-extensions' import type { PreparedDeepSeekLlmApiExtensions } from '@deepseek-ai/dsh-deepseek-llm-api-extensions' import * as LlmDeepSeek from '@deepseek-ai/dsh-llm-deepseek' -import { DEEPSEEK_IMAGE_TOKEN_GRID, DeepSeekAdapter, resolveAdapterOptions } from '@deepseek-ai/dsh-llm-deepseek' +import { DeepSeekAdapter, resolveAdapterOptions } from '@deepseek-ai/dsh-llm-deepseek' import { httpErrorCode } from '../src/adapter.ts' -import { resolveRequestImagePolicy } from '../src/request-pricing.ts' +import { resolveRequestImageTarget } from '../src/request-pricing.ts' import { assemble } from './assemble.ts' import { closeMockServers, mockServer, textEvents } from './mock-server.ts' import type { Behavior } from './mock-server.ts' @@ -141,22 +141,29 @@ function successfulSseResponse(): Response { }) } -describe('request image policy', () => { +describe('request image target', () => { it.each([ [ { id: 'default' }, - { projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, + { width: 1302, height: 1302, maxBytes: 2 * 1024 * 1024 }, ], [ { id: 'low', imagePixelBudget: 'low' as const }, - { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, + { width: 512, height: 512, maxBytes: 2 * 1024 * 1024 }, ], [ { id: 'custom', imagePixelBudget: 320_000, imageMaxBytes: 512_000 }, - { projection: { kind: 'pixel-budget' as const, maxPixels: 320_000 }, maxDimension: 4096, maxBytes: 512_000 }, + { width: 565, height: 565, maxBytes: 512_000 }, ], - ])('resolves route-owned defaults and overrides for %s', (model, expected) => { - expect(resolveRequestImagePolicy(model)).toEqual(expected) + ])('resolves route-owned defaults and overrides for %s on a 4096x4096 source', (model, expected) => { + expect(resolveRequestImageTarget(model, { width: 4096, height: 4096 })).toEqual(expected) + }) + + it('caps every request image at the provider per-side limit', () => { + expect(resolveRequestImageTarget({ id: 'default' }, { width: 8192, height: 78 })) + .toEqual({ width: 4096, height: 39, maxBytes: 2 * 1024 * 1024 }) + expect(resolveRequestImageTarget({ id: 'custom', imagePixelBudget: 640_000 }, { width: 10_000, height: 100 })) + .toEqual({ width: 4096, height: 41, maxBytes: 2 * 1024 * 1024 }) }) it('answers image request pricing from the current connection snapshot', () => { @@ -407,7 +414,7 @@ describe('DeepSeekAdapter against a mock server', () => { bytes: 3, }]) expect(signalSeen[0]).toBeInstanceOf(AbortSignal) - expect(policies).toEqual([{ projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }]) + expect(policies).toEqual([{ width: 1, height: 1, maxBytes: 2 * 1024 * 1024 }]) }) it('falls back to one all-base64 request when Files API resolution fails', async () => { @@ -621,7 +628,7 @@ describe('DeepSeekAdapter against a mock server', () => { expect(attachmentMocks.readImageRequest).toHaveBeenCalledWith( recent, - { projection: DEEPSEEK_IMAGE_TOKEN_GRID, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, + { width: 1, height: 1, maxBytes: 2 * 1024 * 1024 }, expect.any(AbortSignal), ) const body = server.requests[0] as { messages: unknown[] } @@ -672,13 +679,13 @@ describe('DeepSeekAdapter against a mock server', () => { expect(attachmentMocks.readImageRequest).toHaveBeenNthCalledWith( 1, imageRef, - { projection: { kind: 'pixel-budget' as const, maxPixels: 512 * 512 }, maxDimension: 4096, maxBytes: 512_000 }, + { width: 1, height: 1, maxBytes: 512_000 }, expect.any(AbortSignal), ) expect(attachmentMocks.readImageRequest).toHaveBeenNthCalledWith( 2, imageRef, - { projection: { kind: 'pixel-budget' as const, maxPixels: 320_000 }, maxDimension: 4096, maxBytes: 2 * 1024 * 1024 }, + { width: 1, height: 1, maxBytes: 2 * 1024 * 1024 }, expect.any(AbortSignal), ) }) diff --git a/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts b/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts index ffac6880e5..6f26fd083e 100644 --- a/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts +++ b/packages/llm/llm-deepseek/tests/dynamic-config.spec.ts @@ -8,7 +8,7 @@ import AttachmentStore, { AttachmentId, ImageVariantId } from '@deepseek-ai/dsh- import type { ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveImageAttachment, StoredImageAttachment, @@ -70,7 +70,7 @@ class StaticAttachmentStore extends AttachmentStore { override readImageRequest( ref: ImageAttachmentRef, - _policy: ImageRequestPolicy, + _target: ImageRequestTarget, _signal?: AbortSignal, ): Promise { return Promise.resolve({ diff --git a/packages/llm/llm-deepseek/tests/image-tokens.spec.ts b/packages/llm/llm-deepseek/tests/image-tokens.spec.ts index 0e6b5f5b9b..0f48e22760 100644 --- a/packages/llm/llm-deepseek/tests/image-tokens.spec.ts +++ b/packages/llm/llm-deepseek/tests/image-tokens.spec.ts @@ -1,5 +1,5 @@ import { describe, expect, it } from 'vitest' -import { deepSeekImageTokens } from '../src/image-tokens.ts' +import { deepSeekImageTokens, deepSeekRequestImageDimensions } from '../src/image-tokens.ts' describe('DeepSeek image tokens', () => { // Reference values from the provider's published image token calculator @@ -47,3 +47,26 @@ describe('DeepSeek image tokens', () => { expect(deepSeekImageTokens(89, 2076)).toBe(254) }) }) + +describe('DeepSeek request image dimensions', () => { + it.each([ + [800, 800, 800, 800], + [1302, 1302, 1302, 1302], + [8192, 78, 8192, 78], + [1, 9000, 1, 9000], + ])('sends %sx%s unchanged because its padded grid fits the cap', (width, height, expectedWidth, expectedHeight) => { + expect(deepSeekRequestImageDimensions(width, height)).toEqual({ width: expectedWidth, height: expectedHeight }) + }) + + it.each([ + [1303, 1303, 1302, 1302], + [2048, 2048, 1302, 1302], + [2048, 1024, 1848, 924], + [3840, 2160, 1708, 961], + [1080, 2400, 838, 1862], + ])('downscales %sx%s to %sx%s at the solved long edge', (width, height, expectedWidth, expectedHeight) => { + const sent = deepSeekRequestImageDimensions(width, height) + expect(sent).toEqual({ width: expectedWidth, height: expectedHeight }) + expect(deepSeekImageTokens(sent.width, sent.height)).toBe(deepSeekImageTokens(width, height)) + }) +}) diff --git a/packages/llm/llm-pi-ai/src/adapter.ts b/packages/llm/llm-pi-ai/src/adapter.ts index c1e0d9b586..8dba978c31 100644 --- a/packages/llm/llm-pi-ai/src/adapter.ts +++ b/packages/llm/llm-pi-ai/src/adapter.ts @@ -373,7 +373,7 @@ export class PiAiAdapter extends LlmAdapter { resolveImageAccess: ref => this.config.resolveImageAccess?.(attachments, ref), maxRequestImageBytes: profile.maxRequestImageBytes, requestImagePolicy: { - projection: { kind: 'pixel-budget', maxPixels: profile.requestImagePixelBudget }, + maxPixels: profile.requestImagePixelBudget, maxBytes: profile.requestImageMaxBytes, }, }, onReplayDegrade) diff --git a/packages/llm/llm-pi-ai/src/context.ts b/packages/llm/llm-pi-ai/src/context.ts index 2c072166e8..8126bfc04d 100644 --- a/packages/llm/llm-pi-ai/src/context.ts +++ b/packages/llm/llm-pi-ai/src/context.ts @@ -11,11 +11,12 @@ import type { AttachmentId, AttachmentStore, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, } from '@deepseek-ai/dsh-attachment' import type { Context as PiContext, ImageContent, Message as PiMessage, TextContent, Tool as PiTool } from '@earendil-works/pi-ai' import { toPiAssistant } from './replay.ts' +import { requestImageDimensions } from '@deepseek-ai/dsh-attachment' import { DEFAULT_REQUEST_IMAGE_MAX_BYTES, DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET } from './config.ts' /** Join the text blocks of a harness message. */ @@ -102,14 +103,14 @@ function collectImageRefs( async function prepareRequestImages( messages: readonly Message[], attachments: AttachmentStore, - policy: ImageRequestPolicy, + budget: PiImageRequestBudget, signal?: AbortSignal, ): Promise> { const refs = new Map() for (const message of messages) collectImageRefs(message.content, refs) const orderedRefs = [...refs.values()] const prepared = await Promise.all(orderedRefs.map( - ref => attachments.readImageRequest(ref, policy, signal), + ref => attachments.readImageRequest(ref, requestImageTarget(ref, budget), signal), )) const versions = new Map() for (const [index, ref] of orderedRefs.entries()) { @@ -222,7 +223,20 @@ export interface PiImageRequestContext { /** Request-level bound on base64-encoded image payload; omission leaves every image in place. */ maxRequestImageBytes?: number /** Route pixel and raw encoded-byte budgets. */ - requestImagePolicy?: ImageRequestPolicy + requestImagePolicy?: PiImageRequestBudget +} + +/** Per-route budgets from which each request image's target is derived. */ +export interface PiImageRequestBudget { + /** Total-pixel budget; larger sources are downscaled proportionally. */ + maxPixels: number + /** Encoded-byte target for one request image. */ + maxBytes: number +} + +/** Deterministic request target for one source under the route budgets. */ +function requestImageTarget(ref: ImageAttachmentRef, budget: PiImageRequestBudget): ImageRequestTarget { + return { ...requestImageDimensions(ref.width, ref.height, budget.maxPixels), maxBytes: budget.maxBytes } } /** @@ -272,7 +286,7 @@ async function toPiContextWithImages( ): Promise { const { attachments, resolveImageAccess, maxRequestImageBytes } = images const requestImagePolicy = images.requestImagePolicy ?? { - projection: { kind: 'pixel-budget', maxPixels: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET }, + maxPixels: DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET, maxBytes: DEFAULT_REQUEST_IMAGE_MAX_BYTES, } assertSupportedImageRoles(options.messages) diff --git a/packages/llm/llm-pi-ai/tests/adapter.spec.ts b/packages/llm/llm-pi-ai/tests/adapter.spec.ts index 4746ee4be1..a247b20e42 100644 --- a/packages/llm/llm-pi-ai/tests/adapter.spec.ts +++ b/packages/llm/llm-pi-ai/tests/adapter.spec.ts @@ -4,7 +4,7 @@ import { AttachmentId, AttachmentStore, ImageVariantId } from '@deepseek-ai/dsh- import type { ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveImageAttachment, StoredImageAttachment, @@ -254,7 +254,7 @@ describe('PiAiAdapter provider routing', () => { Promise.resolve({ ref, data: Uint8Array.of(1) })) const readImageRequest = vi.fn(( value: ImageAttachmentRef, - _policy: ImageRequestPolicy, + _target: ImageRequestTarget, _signal?: AbortSignal, ): Promise => ( Promise.resolve({ @@ -299,7 +299,7 @@ describe('PiAiAdapter provider routing', () => { override readImageRequest( value: ImageAttachmentRef, - policy: ImageRequestPolicy, + policy: ImageRequestTarget, signal?: AbortSignal, ): Promise { return readImageRequest(value, policy, signal) @@ -325,7 +325,8 @@ describe('PiAiAdapter provider routing', () => { expect(result.finish.kind).toBe('error') expect(readImageRequest).toHaveBeenCalledWith(ref, { - projection: { kind: 'pixel-budget' as const, maxPixels: 2048 * 2048 }, + width: 1, + height: 1, maxBytes: 1024 * 1024, }, expect.any(AbortSignal)) expect(JSON.stringify(server.requests[0])).toContain(MODEL_IMAGE_PATH) diff --git a/packages/llm/llm-pi-ai/tests/context.spec.ts b/packages/llm/llm-pi-ai/tests/context.spec.ts index 576b84a235..59f952ad86 100644 --- a/packages/llm/llm-pi-ai/tests/context.spec.ts +++ b/packages/llm/llm-pi-ai/tests/context.spec.ts @@ -3,7 +3,7 @@ import { AttachmentId, ImageVariantId } from '@deepseek-ai/dsh-attachment' import type { AttachmentStore, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, } from '@deepseek-ai/dsh-attachment' import { ToolCallId, createMessage, createUserMessage, offloadedImageText } from '@deepseek-ai/dsh-llm' @@ -38,7 +38,7 @@ function requestImage(value: ImageAttachmentRef, data: Uint8Array): RequestImage function projectionStore( readImageRequest: ( value: ImageAttachmentRef, - policy: ImageRequestPolicy, + target: ImageRequestTarget, signal?: AbortSignal, ) => Promise = vi.fn((value: ImageAttachmentRef) => ( Promise.resolve(requestImage(value, Uint8Array.of(1))) diff --git a/packages/llm/llm-pi-ai/tests/convert.spec.ts b/packages/llm/llm-pi-ai/tests/convert.spec.ts index 650c8222ae..4347d74858 100644 --- a/packages/llm/llm-pi-ai/tests/convert.spec.ts +++ b/packages/llm/llm-pi-ai/tests/convert.spec.ts @@ -1,6 +1,6 @@ import { describe, expect, it, vi } from 'vitest' import { AttachmentId, ImageVariantId } from '@deepseek-ai/dsh-attachment' -import type { AttachmentStore, ImageAttachmentRef, ImageRequestPolicy, RequestImageAttachment } from '@deepseek-ai/dsh-attachment' +import type { AttachmentStore, ImageAttachmentRef, ImageRequestTarget, RequestImageAttachment } from '@deepseek-ai/dsh-attachment' import { createUserMessage, ToolCallId, CONTEXT_WINDOW_EXCEEDED_CODE, EMPTY_RESPONSE_CODE, createMessage } from '@deepseek-ai/dsh-llm' import type { ContentBlock, StreamChunk } from '@deepseek-ai/dsh-llm' import type { AssistantMessage, AssistantMessageEvent, Usage } from '@earendil-works/pi-ai' @@ -62,7 +62,7 @@ function requestVersion(ref: ImageAttachmentRef): RequestImageAttachment { function attachmentStore(readImageRequest: ( ref: ImageAttachmentRef, - policy: ImageRequestPolicy, + policy: ImageRequestTarget, signal?: AbortSignal, ) => Promise): AttachmentStore { return { readImageRequest, imageHostPath: () => undefined } as unknown as AttachmentStore @@ -105,7 +105,7 @@ describe('toPiContext', () => { width: 1, height: 1, } - const readImageRequest = vi.fn((value: ImageAttachmentRef, _policy: ImageRequestPolicy) => ( + const readImageRequest = vi.fn((value: ImageAttachmentRef, _target: ImageRequestTarget) => ( Promise.resolve(requestVersion(value)) )) const context = await toPiContext({ @@ -119,7 +119,7 @@ describe('toPiContext', () => { expect(readImageRequest).toHaveBeenCalledWith( attachment, - { projection: { kind: 'pixel-budget' as const, maxPixels: 2048 * 2048 }, maxBytes: 1024 * 1024 }, + { width: 1, height: 1, maxBytes: 1024 * 1024 }, undefined, ) expect(context.messages[0]).toEqual({ @@ -141,7 +141,7 @@ describe('toPiContext', () => { width: 1, height: 1, } - const readImageRequest = vi.fn((value: ImageAttachmentRef, _policy: ImageRequestPolicy) => ( + const readImageRequest = vi.fn((value: ImageAttachmentRef, _target: ImageRequestTarget) => ( Promise.resolve(requestVersion(value)) )) const context = await toPiContext({ diff --git a/packages/llm/llm-pi-ai/tests/provider-apis.e2e.ts b/packages/llm/llm-pi-ai/tests/provider-apis.e2e.ts index c6fd5d6db3..fd917c7a66 100644 --- a/packages/llm/llm-pi-ai/tests/provider-apis.e2e.ts +++ b/packages/llm/llm-pi-ai/tests/provider-apis.e2e.ts @@ -5,7 +5,7 @@ import { AttachmentId, AttachmentStore, ImageVariantId } from '@deepseek-ai/dsh- import type { ImageAttachmentLimits, ImageAttachmentRef, - ImageRequestPolicy, + ImageRequestTarget, RequestImageAttachment, SaveImageAttachment, StoredImageAttachment, @@ -91,7 +91,7 @@ async function harness(image?: StoredImageAttachment): Promise { return Promise.resolve(fixture) } - override readImageRequest(ref: ImageAttachmentRef, _policy: ImageRequestPolicy): Promise { + override readImageRequest(ref: ImageAttachmentRef, _target: ImageRequestTarget): Promise { if (ref.attachmentId !== fixture.ref.attachmentId) { return Promise.reject(new Error('unknown e2e attachment fixture')) } diff --git a/scripts/gen-cordis-catalog.ts b/scripts/gen-cordis-catalog.ts index ed81fccc1f..9bc3374bd0 100644 --- a/scripts/gen-cordis-catalog.ts +++ b/scripts/gen-cordis-catalog.ts @@ -378,7 +378,8 @@ export const LINK_MAP: Readonly> = { SaveFileStreamAttachment: 'attachment.md', ImageAttachmentAccess: 'llm-streaming.md', ImageAttachmentRef: 'attachment.md', - ImageRequestPolicy: 'attachment.md', + ImageRequestTarget: 'attachment.md', + ProjectedDimensions: 'attachment.md', PromptContentPart: 'attachment.md', RequestImageAttachment: 'attachment.md', SaveImageAttachment: 'attachment.md', diff --git a/scripts/type-equiv.manifest.json b/scripts/type-equiv.manifest.json index cd6f18083a..86aba302e1 100644 --- a/scripts/type-equiv.manifest.json +++ b/scripts/type-equiv.manifest.json @@ -1003,18 +1003,13 @@ }, { "doc": "docs/subsystems/attachment.md", - "symbol": "ImageRequestProjection", + "symbol": "ImageRequestTarget", "source": "packages/attachment/attachment/src/types.ts" }, { "doc": "docs/subsystems/attachment.md", - "symbol": "TokenGridProjection", - "source": "packages/attachment/attachment/src/types.ts" - }, - { - "doc": "docs/subsystems/attachment.md", - "symbol": "ImageRequestPolicy", - "source": "packages/attachment/attachment/src/types.ts" + "symbol": "ProjectedDimensions", + "source": "packages/attachment/attachment/src/request-projection.ts" }, { "doc": "docs/subsystems/attachment.md", From 0e6505454e868c08fa3418d0a773da3655bb1d73 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 18:00:01 +0800 Subject: [PATCH 08/26] Align client boot import failure test with reverted Loader --- packages/client/web/README.i18n.yaml | 4 ++-- packages/client/web/README.md | 2 +- packages/client/web/README.zh.md | 2 +- packages/client/web/src/boot-client.ts | 4 ++-- .../client/web/tests/boot-client.client.spec.ts | 14 +++++++++----- 5 files changed, 15 insertions(+), 11 deletions(-) diff --git a/packages/client/web/README.i18n.yaml b/packages/client/web/README.i18n.yaml index 313c9860c2..4ff4a942cd 100644 --- a/packages/client/web/README.i18n.yaml +++ b/packages/client/web/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/client/web/README.md -README.md: 6bc0c4f241d1afb28825cadc19f89b7f54d4b637 -README.zh.md: e2d7ab81e82f1b5b1b93b95e4ed117a80f897a8e +README.md: 7bdcec9e2a964b746cbd808497f9222e2b4150fa +README.zh.md: a7243e52a7bababebb75a0ee9f4e22a99fa83337 diff --git a/packages/client/web/README.md b/packages/client/web/README.md index 6bc0c4f241..7bdcec9e2a 100644 --- a/packages/client/web/README.md +++ b/packages/client/web/README.md @@ -35,7 +35,7 @@ Boot runs in two stages: the module stage adopts the parser-loaded bootstrap bat ### The boot page -The boot page uses plain DOM and local CSS, so bundle and plugin-activation failures remain visible: it shows one spinner node whose CSS arc grows as entries activate, and reports per-entry status. The spinner and its animation phase persist until the full UI replaces the boot page. A plugin that fails import or activation is reported by name with the reason (missing service, import error, or state) instead of a blank page. +The boot page uses plain DOM and local CSS, so bundle and plugin-activation failures remain visible: it shows one spinner node whose CSS arc grows as entries activate, and reports per-entry status. The spinner and its animation phase persist until the full UI replaces the boot page. A plugin that fails import or activation is reported by name with the reason (missing service, import failure, or state) instead of a blank page. The console contains the original import error. ### The shared module table diff --git a/packages/client/web/README.zh.md b/packages/client/web/README.zh.md index e2d7ab81e8..a7243e52a7 100644 --- a/packages/client/web/README.zh.md +++ b/packages/client/web/README.zh.md @@ -35,7 +35,7 @@ kind: "package-library" ### 启动页 -启动页只使用原生 DOM 与本地 CSS，因此 bundle 与插件激活失败保持可见：它显示一个 spinner 节点，其 CSS 圆弧随 entry 激活而增长，并逐 entry 报告状态。spinner 及其动画相位会一直保留，直到完整 UI 替换启动页。导入或激活失败的插件会按名称报告并给出原因（缺失服务、导入错误或状态），而不是白屏。 +启动页只使用原生 DOM 与本地 CSS，因此 bundle 与插件激活失败保持可见：它显示一个 spinner 节点，其 CSS 圆弧随 entry 激活而增长，并逐 entry 报告状态。spinner 及其动画相位会一直保留，直到完整 UI 替换启动页。导入或激活失败的插件会按名称报告并给出原因（缺失服务、导入失败或状态），而不是白屏。控制台包含原始导入错误。 ### 共享模块表 diff --git a/packages/client/web/src/boot-client.ts b/packages/client/web/src/boot-client.ts index 1275c47c55..110d8530cb 100644 --- a/packages/client/web/src/boot-client.ts +++ b/packages/client/web/src/boot-client.ts @@ -27,8 +27,8 @@ export interface ClientBootOptions { /** * Compose the client: `ctx.plugin(Loader)`, `loader.internal = modules`, one * `loader.create({ name })` per manifest row, `loader.await()`, then - * {@link assertEntriesActive}. A row whose module cannot be imported rejects - * `loader.create`, so that import error propagates from here as-is. + * {@link assertEntriesActive}. A row whose module cannot be imported is marked + * failed; the Loader logs its import error and the audit rejects startup. * @param options - context, module system, manifest, optional progress sink. * @returns resolves after every entry is active; rejects with the audit report otherwise. */ diff --git a/packages/client/web/tests/boot-client.client.spec.ts b/packages/client/web/tests/boot-client.client.spec.ts index 478819ca59..43fe974d80 100644 --- a/packages/client/web/tests/boot-client.client.spec.ts +++ b/packages/client/web/tests/boot-client.client.spec.ts @@ -4,7 +4,7 @@ import { createClientModuleSystem, parseBootManifest, type ClientBundleRegistration, type ClientModuleLoader, type ClientModuleLoaderTarget, type WebBootEntry, type WebBootGraph, } from '@deepseek-ai/dsh-client-modules/client' -import { describe, expect, it } from 'vitest' +import { describe, expect, it, onTestFinished, vi } from 'vitest' import { assertEntriesActive, bootClient, type EntryStateLabel } from '../src/boot-client.ts' import { FIBER_STATE } from '../src/loader-status.ts' @@ -77,17 +77,21 @@ describe('bootClient', () => { await ctx.fiber.dispose() }) - it('surfaces the Loader import error for a row that is neither seeded nor a graph row', async () => { + it('reports and logs an import failure for a row that is neither seeded nor a graph row', async () => { const { modules } = modulesOf(graphOf(['seeded']), { seeded: { apply: () => {} } }) const manifest = parseBootManifest(graphOf(['ghost'])) const ctx = new Context() + onTestFinished(() => ctx.fiber.dispose()) + const error = vi.spyOn(ctx.logger, 'error').mockImplementation(() => {}) + onTestFinished(() => { error.mockRestore() }) const sink = stateSink() await expect(bootClient({ ctx, modules, manifest, onEntryState: sink.onEntryState })).rejects.toThrow( - /failed to import loader entry \S+ \(ghost\): client-modules: cannot resolve/, + 'web boot: 1 entry did not activate\nghost: import failed (see console for the import error)', ) - expect(sink.states.get('ghost')).toEqual(['loading']) - await ctx.fiber.dispose() + expect(sink.states.get('ghost')).toEqual(['loading', 'failed']) + expect(error).toHaveBeenCalledOnce() + expect(error.mock.calls[0]?.[0]).toHaveProperty('message', expect.stringContaining('client-modules: cannot resolve')) }) }) From 39e6e6fb891dc9e83b73cb4a67f72187cc5d93fb Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 18:21:19 +0800 Subject: [PATCH 09/26] Retain awaited client cleanup after rebase --- .../client-runtime/README.i18n.yaml | 4 ++-- .../test-support/client-runtime/README.md | 2 +- .../test-support/client-runtime/README.zh.md | 2 +- .../src/assembly/test-client.ts | 7 +++++-- .../tests/assembly-test-client.client.spec.ts | 19 ++++++++++++++++++- 5 files changed, 27 insertions(+), 7 deletions(-) diff --git a/packages/test-support/client-runtime/README.i18n.yaml b/packages/test-support/client-runtime/README.i18n.yaml index addb502c8a..534cc2596a 100644 --- a/packages/test-support/client-runtime/README.i18n.yaml +++ b/packages/test-support/client-runtime/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/test-support/client-runtime/README.md -README.md: e32f7858b32e15e5200f9a986cb88e29309c44cb -README.zh.md: 1b7da6f38723607dedd5eb16a15ade0b974ed135 +README.md: 20f6454012d0d8e4c78d9a0ea0df960d22a71f5a +README.zh.md: d9c6888f17df3f37e699bb6be0f7ee44ce82d373 diff --git a/packages/test-support/client-runtime/README.md b/packages/test-support/client-runtime/README.md index e32f7858b3..20f6454012 100644 --- a/packages/test-support/client-runtime/README.md +++ b/packages/test-support/client-runtime/README.md @@ -87,7 +87,7 @@ The [generic Remote proxy](../remote-mock/README.md#remote-proxy) supports every ### Roster and startup behavior -`webApp` is the `web` profile's browser roster, read when the assembly entry is first imported from its bundles (`dsh-base`, then `dsh-web-app`) as the launcher composes them, except that a patch matching nothing throws here where the launcher warns: each bundle's `dsh.bundle.patch` list is parsed with the include plugin's YAML dialect and composed by its `applyEntryPatches`, and every enabled row whose package declares `dsh.client.platform === 'web'` becomes a row carrying that declaration's `inject` and `immediately`; `bundleRoster(bundles)` does the same for any bundle list. Nothing is copied from the bundles, so a bundle change is visible at the next test run. `webApp.closure(names)` keeps the named rows plus everything they inject, transitively (the rows a spec needs to boot those plugins as the bundle composes them), `webApp.pick(names)` and `webApp.without(names)` cut it down by hand, all three throw on unknown names, and `ClientRoster.of(rows)` builds one inline. `remoteDefaultResponses` holds default responses for exactly the Remote endpoints the roster calls while booting with no sessions, no workspaces, and default settings; a spec layers its own `RemoteTable` on top with `mock.load(table)`, and any call without a rule fails the test at `dispose()` through `mock.assertNoUnmatched()`. `mount` requires a roster that provides `uiRenderer`; `start` fails loud otherwise instead of returning an empty container. `client.connection` is the roster's Connection service (no `Context` augmentation declares it), and `connectTimeoutMs` bounds the readiness wait, whose failure message lists the mock log. `reload(name)` rebuilds one Loader entry the way client-hmr does (registry-first teardown, then `entry.refresh()`), under the worker's boot turn with this client's carrier installed so a rebuilt `connection` row reads its own mock; `unload(name)` removes it; `flush()` settles React inside `act`. jsdom implements neither `EventSource` (client-hmr opens one at apply) nor `ResizeObserver` (layout components observe size at mount), so `start` installs inert stubs for whichever global is absent and `dispose` removes exactly those — a jsdom gap, not a product requirement. The `@deepseek-ai/dsh-api-remotes` row is dropped from every roster: its generated Remote clients exist only in built `lib/`, and `remote.` is what the tier replaces anyway. `start` instead provides one contract-free proxy per `remote.` service the roster injects (plus the namespaces the mock has rules for at that point; a namespace first registered later has no proxy); `ctx.remote..(...args)` becomes a call on the endpoint `/` carrying the positional args, a stream when the mock registered a `stream()` script and a unary call otherwise, with the generated client's outcome folding (`gateway/internal` for carrier throws, `gateway/cancelled` on abort). An endpoint without a rule is still dispatched, so the mock logs it and `dispose()` fails the test. +`webApp` is the `web` profile's browser roster, read when the assembly entry is first imported from its bundles (`dsh-base`, then `dsh-web-app`) as the launcher composes them, except that a patch matching nothing throws here where the launcher warns: each bundle's `dsh.bundle.patch` list is parsed with the include plugin's YAML dialect and composed by its `applyEntryPatches`, and every enabled row whose package declares `dsh.client.platform === 'web'` becomes a row carrying that declaration's `inject` and `immediately`; `bundleRoster(bundles)` does the same for any bundle list. Nothing is copied from the bundles, so a bundle change is visible at the next test run. `webApp.closure(names)` keeps the named rows plus everything they inject, transitively (the rows a spec needs to boot those plugins as the bundle composes them), `webApp.pick(names)` and `webApp.without(names)` cut it down by hand, all three throw on unknown names, and `ClientRoster.of(rows)` builds one inline. `remoteDefaultResponses` holds default responses for exactly the Remote endpoints the roster calls while booting with no sessions, no workspaces, and default settings; a spec layers its own `RemoteTable` on top with `mock.load(table)`, and any call without a rule fails the test at `dispose()` through `mock.assertNoUnmatched()`. `mount` requires a roster that provides `uiRenderer`; `start` fails loud otherwise instead of returning an empty container. `client.connection` is the roster's Connection service (no `Context` augmentation declares it), and `connectTimeoutMs` bounds the readiness wait, whose failure message lists the mock log. `reload(name)` rebuilds one Loader entry the way client-hmr does (registry-first teardown, then `entry.refresh()`), under the worker's boot turn with this client's carrier installed so a rebuilt `connection` row reads its own mock; `unload(name)` removes it and waits for plugin cleanup; `flush()` settles React inside `act`. jsdom implements neither `EventSource` (client-hmr opens one at apply) nor `ResizeObserver` (layout components observe size at mount), so `start` installs inert stubs for whichever global is absent and `dispose` removes exactly those — a jsdom gap, not a product requirement. The `@deepseek-ai/dsh-api-remotes` row is dropped from every roster: its generated Remote clients exist only in built `lib/`, and `remote.` is what the tier replaces anyway. `start` instead provides one contract-free proxy per `remote.` service the roster injects (plus the namespaces the mock has rules for at that point; a namespace first registered later has no proxy); `ctx.remote..(...args)` becomes a call on the endpoint `/` carrying the positional args, a stream when the mock registered a `stream()` script and a unary call otherwise, with the generated client's outcome folding (`gateway/internal` for carrier throws, `gateway/cancelled` on abort). An endpoint without a rule is still dispatched, so the mock logs it and `dispose()` fails the test. ### When to use it diff --git a/packages/test-support/client-runtime/README.zh.md b/packages/test-support/client-runtime/README.zh.md index 1b7da6f387..d9c6888f17 100644 --- a/packages/test-support/client-runtime/README.zh.md +++ b/packages/test-support/client-runtime/README.zh.md @@ -87,7 +87,7 @@ test('registers into the sidebar', async ({ remote, start }) => { ### Roster 与启动行为 -`webApp` 是 `web` profile 的浏览器 roster，首次 import 装配入口时从它的 bundle（先 `dsh-base`、再 `dsh-web-app`）按启动器的方式现读，只是匹配不到任何行的补丁在这里抛错、启动器只警告：每个 bundle 的 `dsh.bundle.patch` 列表用 include 插件的 YAML 方言解析、用它的 `applyEntryPatches` 合成，每个未禁用且其包声明 `dsh.client.platform === 'web'` 的行成为一行，带上该声明的 `inject` 与 `immediately`；`bundleRoster(bundles)` 对任意 bundle 列表做同样的事。没有任何东西从 bundle 拷贝出来，bundle 一改下次跑测试就能看见。`webApp.closure(names)` 保留点名的行及其传递注入的全部行（即按 bundle 组合方式起这些插件所需的行），`webApp.pick(names)` 与 `webApp.without(names)` 手工裁剪，三者都对未知名字抛错，`ClientRoster.of(rows)` 内联构造一份。`remoteDefaultResponses` 是 roster 在没有 session、没有 workspace、默认设置下启动时恰好会打的那些 Remote 端点的默认响应；测试用 `mock.load(table)` 在其上叠加自己的 `RemoteTable`，任何没有规则的调用都会在 `dispose()` 时经 `mock.assertNoUnmatched()` 让测试失败。`mount` 要求 roster 提供 `uiRenderer`；否则 `start` 响亮失败而不是返回一个空容器。`client.connection` 是 roster 的 Connection 服务（没有任何 `Context` 增强声明它），`connectTimeoutMs` 限定等就绪的时长，超时消息列出 mock log。`reload(name)` 按 client-hmr 的方式重建一个 Loader entry（先拆 registry，再 `entry.refresh()`），并在 worker 的启动轮次内装上本客户端的载体，重建的 `connection` 行因此读到自己的 mock；`unload(name)` 移除它；`flush()` 在 `act` 内让 React 落定。jsdom 既没有 `EventSource`（client-hmr 在 apply 时打开一个）也没有 `ResizeObserver`（布局组件挂载时观察尺寸），所以 `start` 对缺失的全局装惰性桩、`dispose` 只移除它装的那些——这是 jsdom 的缺口，不是产品需求。每个 roster 里的 `@deepseek-ai/dsh-api-remotes` 行都会被去掉：它生成的 Remote 客户端只存在于构建后的 `lib/`，而 `remote.` 正是本档要替掉的东西。`start` 改为给 roster 注入的每个 `remote.` 服务（加上此刻 mock 登记过规则的命名空间；之后才首次登记的命名空间没有代理）提供一个无契约代理；`ctx.remote..(...args)` 变成对端点 `/` 的调用，携带位置参数，mock 登记了 `stream()` 脚本的走流、否则走一元，并沿用生成客户端的结果折叠（载体抛错折成 `gateway/internal`，中止折成 `gateway/cancelled`）。没有规则的端点照样发出，所以 mock 会记下它、`dispose()` 让测试失败。 +`webApp` 是 `web` profile 的浏览器 roster，首次 import 装配入口时从它的 bundle（先 `dsh-base`、再 `dsh-web-app`）按启动器的方式现读，只是匹配不到任何行的补丁在这里抛错、启动器只警告：每个 bundle 的 `dsh.bundle.patch` 列表用 include 插件的 YAML 方言解析、用它的 `applyEntryPatches` 合成，每个未禁用且其包声明 `dsh.client.platform === 'web'` 的行成为一行，带上该声明的 `inject` 与 `immediately`；`bundleRoster(bundles)` 对任意 bundle 列表做同样的事。没有任何东西从 bundle 拷贝出来，bundle 一改下次跑测试就能看见。`webApp.closure(names)` 保留点名的行及其传递注入的全部行（即按 bundle 组合方式起这些插件所需的行），`webApp.pick(names)` 与 `webApp.without(names)` 手工裁剪，三者都对未知名字抛错，`ClientRoster.of(rows)` 内联构造一份。`remoteDefaultResponses` 是 roster 在没有 session、没有 workspace、默认设置下启动时恰好会打的那些 Remote 端点的默认响应；测试用 `mock.load(table)` 在其上叠加自己的 `RemoteTable`，任何没有规则的调用都会在 `dispose()` 时经 `mock.assertNoUnmatched()` 让测试失败。`mount` 要求 roster 提供 `uiRenderer`；否则 `start` 响亮失败而不是返回一个空容器。`client.connection` 是 roster 的 Connection 服务（没有任何 `Context` 增强声明它），`connectTimeoutMs` 限定等就绪的时长，超时消息列出 mock log。`reload(name)` 按 client-hmr 的方式重建一个 Loader entry（先拆 registry，再 `entry.refresh()`），并在 worker 的启动轮次内装上本客户端的载体，重建的 `connection` 行因此读到自己的 mock；`unload(name)` 移除它并等待插件清理完成；`flush()` 在 `act` 内让 React 落定。jsdom 既没有 `EventSource`（client-hmr 在 apply 时打开一个）也没有 `ResizeObserver`（布局组件挂载时观察尺寸），所以 `start` 对缺失的全局装惰性桩、`dispose` 只移除它装的那些——这是 jsdom 的缺口，不是产品需求。每个 roster 里的 `@deepseek-ai/dsh-api-remotes` 行都会被去掉：它生成的 Remote 客户端只存在于构建后的 `lib/`，而 `remote.` 正是本档要替掉的东西。`start` 改为给 roster 注入的每个 `remote.` 服务（加上此刻 mock 登记过规则的命名空间；之后才首次登记的命名空间没有代理）提供一个无契约代理；`ctx.remote..(...args)` 变成对端点 `/` 的调用，携带位置参数，mock 登记了 `stream()` 脚本的走流、否则走一元，并沿用生成客户端的结果折叠（载体抛错折成 `gateway/internal`，中止折成 `gateway/cancelled`）。没有规则的端点照样发出，所以 mock 会记下它、`dispose()` 让测试失败。 ### 何时使用 diff --git a/packages/test-support/client-runtime/src/assembly/test-client.ts b/packages/test-support/client-runtime/src/assembly/test-client.ts index 7e26d9bbc8..fd99de38fd 100644 --- a/packages/test-support/client-runtime/src/assembly/test-client.ts +++ b/packages/test-support/client-runtime/src/assembly/test-client.ts @@ -303,11 +303,14 @@ export class TestClient { } /** - * Remove one Loader entry. + * Remove one Loader entry and wait for its plugin cleanup. * @param name - package name of the row. */ async unload(name: string): Promise { - await this.ctx.loader.remove(this.entryOf(name).id) + const entry = this.entryOf(name) + const disposal = entry.fiber?.dispose() + this.ctx.loader.remove(entry.id) + await disposal } /** diff --git a/packages/test-support/client-runtime/tests/assembly-test-client.client.spec.ts b/packages/test-support/client-runtime/tests/assembly-test-client.client.spec.ts index 788c640b7f..b4d28d9fc6 100644 --- a/packages/test-support/client-runtime/tests/assembly-test-client.client.spec.ts +++ b/packages/test-support/client-runtime/tests/assembly-test-client.client.spec.ts @@ -136,7 +136,24 @@ describe('TestClient (jsdom)', () => { await client.reload(SIDEBAR) await client.flush() expect(client.ctx.slots.entries(SIDEBAR_SETTINGS)).toHaveLength(1) - await client.unload(SIDEBAR) + const cleanupStarted = Promise.withResolvers() + const releaseCleanup = Promise.withResolvers() + const sidebar = [...client.ctx.loader.entries()].find(entry => entry.options.name === SIDEBAR)! + sidebar.fiber!.ctx.effect(() => async () => { + cleanupStarted.resolve(undefined) + await releaseCleanup.promise + }) + let unloaded = false + const unloading = client.unload(SIDEBAR).then(() => { unloaded = true }) + try { + await cleanupStarted.promise + await client.flush() + expect(unloaded).toBe(false) + } finally { + releaseCleanup.resolve(undefined) + await unloading + } + expect(unloaded).toBe(true) await client.flush() expect(client.ctx.slots.entries(SIDEBAR_SETTINGS)).toHaveLength(0) await expect(client.reload(SIDEBAR)).rejects.toThrow(`no Loader entry named ${SIDEBAR}`) From 464e1cce496617d98f6c3afed156517dee0ca00d Mon Sep 17 00:00:00 2001 From: turtle1999 <301751225+turtle1999@users.noreply.github.com> Date: Thu, 10 Sep 2026 19:01:00 +0800 Subject: [PATCH 10/26] fix(ci): canonicalize browser dependency scan roots --- scripts/browser-bundled-externals.spec.ts | 12 +++++++++--- scripts/browser-bundled-externals.ts | 6 ++++-- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/scripts/browser-bundled-externals.spec.ts b/scripts/browser-bundled-externals.spec.ts index b4d95cf96d..cadc8fb6ae 100644 --- a/scripts/browser-bundled-externals.spec.ts +++ b/scripts/browser-bundled-externals.spec.ts @@ -1,4 +1,4 @@ -import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs' +import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs' import { tmpdir } from 'node:os' import { dirname, join, resolve } from 'node:path' import { afterEach, describe, expect, it } from 'vitest' @@ -78,7 +78,7 @@ describe('browser dependency discovery', () => { await expect(browserBundledExternals(root)).rejects.toThrow('has no browser build config') }) - it('follows shell workspace aliases, CSS assets and lazy imports without writing output', async () => { + it.each([false, true])('follows shell aliases, CSS and lazy imports without writing output (symlinked root: %s)', async (linked) => { const root = fixture() library(root, 'shell-lib') library(root, 'lazy-lib') @@ -104,7 +104,13 @@ describe('browser dependency discovery', () => { }`) write(root, 'apps/web/dist/sentinel.txt', 'untouched') - expect(await browserBundledExternals(root)).toEqual(new Set(['shell-lib', 'lazy-lib', 'asset-lib'])) + const scanRoot = linked ? join(fixture(), 'linked') : root + if (linked) symlinkSync(root, scanRoot, 'junction') + try { + expect(await browserBundledExternals(scanRoot)).toEqual(new Set(['shell-lib', 'lazy-lib', 'asset-lib'])) + } finally { + if (linked) unlinkSync(scanRoot) + } expect(readFileSync(join(app, 'dist/sentinel.txt'), 'utf8')).toBe('untouched') expect(existsSync(join(app, 'dist/index.html'))).toBe(false) expect(existsSync(join(root, 'packages/client/static/lib'))).toBe(false) diff --git a/scripts/browser-bundled-externals.ts b/scripts/browser-bundled-externals.ts index 85053be30f..9139f6b4c2 100644 --- a/scripts/browser-bundled-externals.ts +++ b/scripts/browser-bundled-externals.ts @@ -1,6 +1,6 @@ /** Resolve direct third-party browser inputs through the shipping build configurations, without emitting files. */ -import { globSync, readFileSync } from 'node:fs' +import { globSync, readFileSync, realpathSync } from 'node:fs' import { createRequire } from 'node:module' import { dirname, resolve } from 'node:path' import { pathToFileURL } from 'node:url' @@ -159,10 +159,12 @@ async function collectShell( /** * Direct third-party packages resolved by published browser builds. - * @param root - Repository root with installed build dependencies; lib/ is not required. + * @param root - Repository root, possibly symlinked, with installed build dependencies; lib/ is not required. * @returns Names of distributed browser inputs, excluding workspace packages and erased types. */ export async function browserBundledExternals(root: string): Promise> { + // Vite resolves HTML inputs to real paths, so its root must use the same spelling. + root = realpathSync(root) const manifests = new Map() for (const glob of ['packages/*/*/package.json', 'vendor/*/package.json']) { for (const path of globSync(glob, { cwd: root }).sort()) { From e46cb49103ef35f4ee3dc12f4fc201906f849737 Mon Sep 17 00:00:00 2001 From: turtle1999 <301751225+turtle1999@users.noreply.github.com> Date: Thu, 10 Sep 2026 23:02:21 +0800 Subject: [PATCH 11/26] fix(ci): derive Windows standby store from workspace volume --- .github/workflows/ci-master.yml | 5 ++--- scripts/ci-workflow.spec.ts | 3 ++- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci-master.yml b/.github/workflows/ci-master.yml index dbb4252fec..be96b7effa 100644 --- a/.github/workflows/ci-master.yml +++ b/.github/workflows/ci-master.yml @@ -249,10 +249,9 @@ jobs: - name: Configure persistent pnpm store shell: pwsh # The store must share the ReFS workspace volume for the clone - # import method below; LOCALAPPDATA (C:) would cross volumes and - # break block clone. See 2026-08-30-windows-refs-store-block-clone-install. + # import method below. Runner workspaces can reside on different drives. run: | - $storeRoot = "F:\.pnpm-store" + $storeRoot = Join-Path ([IO.Path]::GetPathRoot($env:GITHUB_WORKSPACE)) '.pnpm-store' echo "PNPM_CONFIG_STORE_DIR=$storeRoot" >> $env:GITHUB_ENV - name: Install (immutable) diff --git a/scripts/ci-workflow.spec.ts b/scripts/ci-workflow.spec.ts index 26d040eac2..5a7cb17fd8 100644 --- a/scripts/ci-workflow.spec.ts +++ b/scripts/ci-workflow.spec.ts @@ -258,7 +258,8 @@ describe('CI workflow', () => { isRecord(step) && step.name === 'Configure persistent pnpm store' && typeof step.run === 'string' )) expect(serialStore).toBeDefined() - expect(serialStore!.run).toContain('F:\\.pnpm-store') + expect(serialStore!.run).toContain('[IO.Path]::GetPathRoot($env:GITHUB_WORKSPACE)') + expect(serialStore!.run).toContain("'.pnpm-store'") const serialInstall = serialSteps.find((step): step is Record & { run: string } => ( isRecord(step) && step.name === 'Install (immutable)' && typeof step.run === 'string' )) From f0f1988a7a30c6722f61caa0817e22944cdc7088 Mon Sep 17 00:00:00 2001 From: creatixchu Date: Fri, 11 Sep 2026 11:14:33 +0800 Subject: [PATCH 12/26] Clarify token counts after aspect-preserving image projection --- ...-10-deepseek-v41-request-image-projection.i18n.yaml | 4 ++-- ...2026-09-10-deepseek-v41-request-image-projection.md | 4 ++-- ...6-09-10-deepseek-v41-request-image-projection.zh.md | 4 ++-- .../attachment-local/tests/request-image.spec.ts | 10 ++++++++++ packages/llm/llm-deepseek/src/image-tokens.ts | 5 +++-- packages/llm/llm-deepseek/tests/image-tokens.spec.ts | 7 +++++++ .../llm/llm-deepseek/tests/request-pricing.spec.ts | 9 +++++++++ 7 files changed, 35 insertions(+), 8 deletions(-) diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml index 964d3e2a81..ece05b1229 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md -2026-09-10-deepseek-v41-request-image-projection.md: 87f79f244dcf61039fe27ef170ba654ee7a1a62a -2026-09-10-deepseek-v41-request-image-projection.zh.md: a5d8a4e99a3c7b4f3fc26f385ae1e764b535fe15 +2026-09-10-deepseek-v41-request-image-projection.md: 2bf7ac3f7f09ff7aea1067030f4474306d3f9a8e +2026-09-10-deepseek-v41-request-image-projection.zh.md: 4f0a8cfd3a71d54a54bf74d6819235ed7d0749f8 diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md index 87f79f244d..2bf7ac3f7f 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.md @@ -22,10 +22,10 @@ The route chooses each request image's dimensions; the attachment provider only **A `token-grid` projection kind on the attachment policy, with the solver in `dsh-attachment`.** This was built first: the policy became a closed union of `pixel-budget` and `token-grid`, the solver moved into `request-projection.ts`, and `deepSeekImageTokens` imported it back. It put one provider's layout formula and patch constants into the provider-neutral package under a generic-looking name, needed an `unscaled` flag so the store could tell "send the source" from "send the solved size", and would grow a new union member for every provider rule. Handing the store a finished target keeps the provider rule beside the provider's pricing and leaves the store with no projection vocabulary at all. -**Send the solver's exact grid dimensions with a fill resize.** The solved grid edges are whole patches and differ from the source aspect ratio by under one patch. Filling that box would distort the image slightly even though the provider does the same on its side; the issue requires the aspect ratio preserved, the padding on the provider side does not change the token count, and pricing reproduces the provider from the sent dimensions either way. +**Send the solver's exact grid dimensions with a fill resize.** The solved grid edges are whole patches and differ from the source aspect ratio by under one patch. Filling that box would distort the image slightly even though the provider does the same on its side; preserving the source aspect ratio can change how many token cells the rounded short edge covers. A 1224×1429 source is sent as 1187×1386: the published calculator gives 959 tokens for the source and 992 for the sent dimensions. Request generation and pricing share the target dimensions, and pricing applies the published calculator to that target. **Keep the 1 MiB target.** The target is not a cap: an output over it is still sent at the smallest ladder quality. At 1302×1302 a JPEG photograph at quality 85 lands between 400 KB and 1.2 MB, so 2 MiB keeps most images at the top quality and lets more PNG screenshots pass through losslessly, while the inline base64 fallback still holds about seven such images under its 20 MiB bound. ## Consequences -A square source now reaches the model at up to 1302×1302 pixels and 994 tokens instead of 800×800 and 422, so image-heavy sessions reach compaction pressure sooner and the estimator matches provider usage for the sent version. Every existing request-image cache entry and DeepSeek Files API mapping is regenerated on the next request. Thin images keep their full grid until the per-side cap applies: an 8192×78 source costs 396 tokens under the grid but is sent as 4096×39. `llm-replay` does not project images, so keyless snapshots cannot record the sent dimensions; the `llm-deepseek` adapter tests pin the resolved targets and the projected handle text against a mock server, and the local store tests resize real images to targets. +A square source now reaches the model at up to 1302×1302 pixels and 994 tokens instead of 800×800 and 422, so image-heavy sessions reach compaction pressure sooner and the estimator applies the published token rules to the sent target dimensions. Every existing request-image cache entry and DeepSeek Files API mapping is regenerated on the next request. Thin images keep their full grid until the per-side cap applies: an 8192×78 source costs 396 tokens under the grid but is sent as 4096×39. `llm-replay` does not project images, so keyless snapshots cannot record the sent dimensions; the `llm-deepseek` adapter tests pin the resolved targets and the projected handle text against a mock server, and the local store tests resize real images to targets. diff --git a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md index a5d8a4e99a..4f0a8cfd3a 100644 --- a/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md +++ b/.agents/notes/implemented/bug-fix/2026-09-10-deepseek-v41-request-image-projection.zh.md @@ -22,10 +22,10 @@ harness 此前把每张 DeepSeek 请求图片投影到 640,000 总像素预算 **在附件策略上加 `token-grid` 投影种类，求解器放进 `dsh-attachment`。** 最初就是这样做的：策略变成 `pixel-budget` 和 `token-grid` 的封闭联合，求解器搬进 `request-projection.ts`，`deepSeekImageTokens` 再从那里引回来。这把一家提供方的布局公式和 patch 常量放进了提供方无关的包，还起了个看似通用的名字；存储层需要一个 `unscaled` 标志来区分「发源图」和「发求解尺寸」；以后每多一家提供方规则，联合就要多长一个分支。把算好的目标交给存储层，提供方规则和它的计价放在一起，存储层不需要任何投影词汇。 -**用填充缩放发送求解器的精确网格尺寸。** 求解出的网格边长是整数个 patch，与源图宽高比相差不到一个 patch。填充到这个框会轻微变形，尽管提供方那侧也会这样做；issue 要求保持宽高比，提供方那侧的补齐不改变 token 数，而计价无论如何都从发送尺寸复现提供方。 +**用填充缩放发送求解器的精确网格尺寸。** 求解出的网格边长是整数个 patch，与源图宽高比相差不到一个 patch。填充到这个框会轻微变形，尽管提供方那侧也会这样做；保持源图宽高比可能改变取整后短边覆盖的 token 格数。1224×1429 的源图以 1187×1386 发送，官方计算器对源图计 959 token，对发送尺寸计 992 token。请求生成和定价共享目标尺寸，定价按目标尺寸应用官方计算规则。 **保留 1 MiB 目标。** 目标不是上限：超过它的输出仍会以阶梯最小质量发送。1302×1302 的 JPEG 照片在质量 85 时约 400 KB 到 1.2 MB，2 MiB 让多数图片停在最高质量，也让更多 PNG 截图无损直发，而内联 base64 回退在 20 MiB 上界内仍能容纳约七张这样的图片。 ## 后果 -正方形源图现在最多以 1302×1302 像素、994 token 到达模型，而不是 800×800 和 422，因此图片密集的会话更早触及 compaction 压力，预估器对发送版本的计价与提供方 usage 一致。所有已有的请求图片缓存条目和 DeepSeek Files API 映射在下次请求时重新生成。细长图在单边上限生效前保留完整网格：8192×78 的源图在网格下计 396 token，但以 4096×39 发送。`llm-replay` 不投影图片，keyless 快照记录不到发送尺寸；`llm-deepseek` 适配器测试对着 mock 服务器固定了解析出的目标和投影后的句柄文本，本地存储测试把真实图片缩放到目标尺寸。 +正方形源图现在最多以 1302×1302 像素、994 token 到达模型，而不是 800×800 和 422，因此图片密集的会话更早触及 compaction 压力，预估器按发送目标尺寸应用官方 token 计算规则。所有已有的请求图片缓存条目和 DeepSeek Files API 映射在下次请求时重新生成。细长图在单边上限生效前保留完整网格：8192×78 的源图在网格下计 396 token，但以 4096×39 发送。`llm-replay` 不投影图片，keyless 快照记录不到发送尺寸；`llm-deepseek` 适配器测试对着 mock 服务器固定了解析出的目标和投影后的句柄文本，本地存储测试把真实图片缩放到目标尺寸。 diff --git a/packages/attachment/attachment-local/tests/request-image.spec.ts b/packages/attachment/attachment-local/tests/request-image.spec.ts index ef419479fd..bd27d0bf9d 100644 --- a/packages/attachment/attachment-local/tests/request-image.spec.ts +++ b/packages/attachment/attachment-local/tests/request-image.spec.ts @@ -137,6 +137,16 @@ describe('local request-image cache', () => { expect(enlarged.variantId).not.toBe(thinRequest.variantId) }) + it('encodes the rounded short edge at the route target', async () => { + const attachments = await store() + const attachment = await attachments.saveImage({ data: await image(1224, 1429), mediaType: 'image/png' }) + const request = await attachments.readImageRequest(attachment, { + width: 1187, height: 1386, maxBytes: 2 * 1024 * 1024, + }) + expect(request).toMatchObject({ width: 1187, height: 1386 }) + await expect(sharp(request.data).metadata()).resolves.toMatchObject({ width: 1187, height: 1386 }) + }) + it('keeps the smallest ladder output when the encoded-byte target is unreachable', async () => { const attachments = await store() const attachment = await attachments.saveImage({ data: await image(1, 1), mediaType: 'image/png' }) diff --git a/packages/llm/llm-deepseek/src/image-tokens.ts b/packages/llm/llm-deepseek/src/image-tokens.ts index c5618af0f9..dfef215ee6 100644 --- a/packages/llm/llm-deepseek/src/image-tokens.ts +++ b/packages/llm/llm-deepseek/src/image-tokens.ts @@ -122,8 +122,9 @@ function sameResize(a: GridResize, b: GridResize): boolean { * Dimensions the harness sends so the provider keeps the whole image: the * source itself when its patch-padded grid fits the token cap, otherwise the * source aspect ratio at the solved grid's long edge. The provider pads the - * short edge to whole patches on its side, so the token count equals the - * solved grid's. Small images are never enlarged. + * short edge to whole patches on its side. Rounding the aspect-preserving + * short edge can change the token count from the source's solved grid; + * request pricing uses the sent dimensions. Small images are never enlarged. * @param width - positive integer source width in pixels. * @param height - positive integer source height in pixels. * @returns the request dimensions to encode. diff --git a/packages/llm/llm-deepseek/tests/image-tokens.spec.ts b/packages/llm/llm-deepseek/tests/image-tokens.spec.ts index 0f48e22760..0796e3d113 100644 --- a/packages/llm/llm-deepseek/tests/image-tokens.spec.ts +++ b/packages/llm/llm-deepseek/tests/image-tokens.spec.ts @@ -49,6 +49,13 @@ describe('DeepSeek image tokens', () => { }) describe('DeepSeek request image dimensions', () => { + it('can cross a token-cell boundary when preserving the source aspect ratio', () => { + const sent = deepSeekRequestImageDimensions(1224, 1429) + expect(sent).toEqual({ width: 1187, height: 1386 }) + expect(deepSeekImageTokens(1224, 1429)).toBe(959) + expect(deepSeekImageTokens(sent.width, sent.height)).toBe(992) + }) + it.each([ [800, 800, 800, 800], [1302, 1302, 1302, 1302], diff --git a/packages/llm/llm-deepseek/tests/request-pricing.spec.ts b/packages/llm/llm-deepseek/tests/request-pricing.spec.ts index b082cbc7ed..40ae5d874b 100644 --- a/packages/llm/llm-deepseek/tests/request-pricing.spec.ts +++ b/packages/llm/llm-deepseek/tests/request-pricing.spec.ts @@ -61,6 +61,15 @@ describe('DeepSeek request-image pricing', () => { }]) }) + it('prices the sent dimensions when aspect-preserving projection changes the token grid', () => { + const image = ref('portrait', 1224, 1429) + const prices = deepSeekImageRequestPricing(connection(), 'vision').priceImages([image]) + expect(prices).toEqual([{ + visualTokens: 992, + text: requestImageHandleText(image, { width: 1187, height: 1386 }), + }]) + }) + it('honors a numeric pixel budget override', () => { const image = ref('photo', 4096, 4096) const options = resolveAdapterOptions({ From bd4cfc7c46102be71a2794f2e3084c6c001f5a3f Mon Sep 17 00:00:00 2001 From: Turtle Date: Wed, 9 Sep 2026 12:16:38 +0800 Subject: [PATCH 13/26] feat(boot): distinguish required startup failures --- ...onsumer-owned-startup-strictness.i18n.yaml | 6 + ...09-09-consumer-owned-startup-strictness.md | 31 ++ ...09-consumer-owned-startup-strictness.zh.md | 31 ++ apps/cli/tests/built-bin.e2e.ts | 15 +- .../fixtures/invalid-provider.cordis.yml | 2 +- .../stderr.expected.txt | 6 +- .../activation-error.patch.yml | 8 +- .../headless/tests/headless.expected.e2e.ts | 24 +- .../tests/profiles/sdk/keyless-smoke.e2e.ts | 3 +- .../web-best-effort-startup.expected.e2e.ts | 243 ++++++++++++++++ apps/web/tests/scaffold.ts | 4 +- packages/boot/app-boot/README.i18n.yaml | 4 +- packages/boot/app-boot/README.md | 16 +- packages/boot/app-boot/README.zh.md | 16 +- packages/boot/app-boot/src/index.ts | 161 ++++++---- packages/boot/app-boot/tests/app-boot.spec.ts | 274 ++++++++++-------- .../tests/loader-composition.e2e.ts | 4 +- 17 files changed, 635 insertions(+), 213 deletions(-) create mode 100644 .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml create mode 100644 .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md create mode 100644 .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md create mode 100644 apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml new file mode 100644 index 0000000000..a12922007e --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -0,0 +1,6 @@ +# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each +# side as of the last confirmed-consistent state. Both languages carry equal authority; +# after editing either side, bring the other along and re-record with: +# pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +2026-09-09-consumer-owned-startup-strictness.md: b9ffe13901c2adabfe95f8ae3f44d8eba83b6d01 +2026-09-09-consumer-owned-startup-strictness.zh.md: f6aae3922407d04c472b3fde57ce7a4f4f1fb888 diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md new file mode 100644 index 0000000000..b9ffe13901 --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -0,0 +1,31 @@ +# Agent Note: Consumer-owned startup strictness + +Status: implemented + +English | [中文](2026-09-09-consumer-owned-startup-strictness.zh.md) + +## Problem + +Best-effort Loader reconciliation preserves usable plugins, but applications still need a minimum set of capabilities. An HTTP application without its listening server is not running, while an unavailable tool can be omitted without making the remaining application unusable. Cordis cannot infer this distinction from plugin implementation or dependency state. + +## Decision + +DSH owns startup strictness outside vendored Cordis. App-boot audits the settled initial tree against one global list of stable entry ids. A listed entry that is present, enabled, and not active rejects startup and disposes the application. A listed id that is absent or disabled has no effect. Every other inactive entry produces one warning and leaves successful siblings running. + +The required ids are `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution and the endpoints of the shipped Web, headless, ACP, and SDK applications. Their injected providers do not need separate list entries: a missing provider leaves the listed endpoint pending or failed. + +The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair. + +## Alternatives considered + +- **Add transactional and best-effort modes to vendored Loader.** Rejected because strictness belongs to the application or resource owner, while a Loader group contains unrelated plugins. A mode would also expand the vendor patch and leave callers to select a policy at every group. +- **Declare required entries in each profile.** Rejected because the same application endpoints would be duplicated across profile data and custom profiles. A global list treats missing ids as irrelevant while keeping stable shipped ids authoritative. +- **Make every startup failure optional.** Rejected because a process that cannot expose its selected application endpoint must report launch failure. + +## Consequences + +Stable required entry ids are part of application assembly. Renaming one requires updating the list and its tests. Optional plugin failures remain visible in Loader state and stderr without tearing down active siblings. Required failures use the same detailed import, activation, or pending-service diagnostic before app-boot disposes the root. + +## Testing + +App-boot unit tests cover absent and disabled required ids, optional import failure, config evaluation failure, synchronous and asynchronous `apply()` failure, pending dependencies, and required failure teardown. The built Web-profile acceptance serves the full UI with optional failures and exits nonzero when the required HTTP port is occupied. diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md new file mode 100644 index 0000000000..f6aae39224 --- /dev/null +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -0,0 +1,31 @@ +# Agent Note：由 consumer 持有启动严格语义 + +Status: implemented + +[English](2026-09-09-consumer-owned-startup-strictness.md) | 中文 + +## 问题 + +Best-effort Loader reconcile 会保留可用 plugin，但应用仍需一组最小 capability。HTTP 应用没有 listening server 就不算运行，而一个 tool 不可用时可以仅省略该 tool，剩余应用仍然可用。Cordis 无法从 plugin 实现或依赖状态推断这一区别。 + +## 决策 + +DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全局稳定 entry id list 审计已结算的初始 tree。List 中存在、启用且未 active 的 entry 会使启动 reject，并拆卸应用。List 中缺失或禁用的 id 不产生影响。其他 inactive entry 输出一次 warning，并让成功 sibling 继续运行。 + +Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行，以及随附 Web、headless、ACP 和 SDK 应用的 endpoint。其 injected provider 不需要单列：provider 缺失会让已列出的 endpoint 保持 pending 或失败。 + +该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。 + +## 考虑过的替代方案 + +- **给 vendored Loader 增加 transactional 与 best-effort mode。** 拒绝，因为严格语义属于应用或资源 owner，而一个 Loader group 包含互不相关的 plugin。Mode 还会扩大 vendor patch，并要求 caller 为每个 group 选择 policy。 +- **在每个 profile 中声明 required entry。** 拒绝，因为相同应用 endpoint 会在 profile data 与 custom profile 中重复。全局 list 会忽略缺失 id，同时让稳定的随附 id 保持权威。 +- **把所有启动失败都视为 optional。** 拒绝，因为无法暴露所选应用 endpoint 的进程必须报告启动失败。 + +## 后果 + +稳定的 required entry id 是应用 assembly 的一部分。重命名时必须同步更新 list 与测试。Optional plugin failure 会保留在 Loader state 和 stderr 中，但不会拆卸 active sibling。Required failure 使用相同的详细 import、activation 或 pending-service 诊断，然后由 app-boot 拆卸 root。 + +## 测试 + +App-boot 单元测试覆盖缺失和禁用的 required id、optional import failure、config evaluation failure、同步和异步 `apply()` failure、pending dependency，以及 required failure teardown。构建后的 Web-profile acceptance 会在 optional failure 存在时继续提供完整 UI，并在 required HTTP port 被占用时以非零码退出。 diff --git a/apps/cli/tests/built-bin.e2e.ts b/apps/cli/tests/built-bin.e2e.ts index 3697d3fb75..a4f6e2fe5f 100644 --- a/apps/cli/tests/built-bin.e2e.ts +++ b/apps/cli/tests/built-bin.e2e.ts @@ -28,6 +28,7 @@ const SPAWN_TIMEOUT_MS = 60_000 const cliVersion = (JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string }).version const dshBin = join(repoRoot, 'apps/cli/lib/bin.js') const invalidProvider = fileURLToPath(new URL('./fixtures/invalid-provider.cordis.yml', import.meta.url)) +const webReadyExitHook = new URL('./fixtures/web-browser-open/register.mjs', import.meta.url).href async function runBuiltBin( args: readonly string[] = [], @@ -400,7 +401,7 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', } }, SPAWN_TIMEOUT_MS * 3 + 30_000) - it('reports SDK startup failure when stdin reaches EOF first', async () => { + it('ignores an optional SDK plugin import failure before stdin reaches EOF', async () => { const home = mkdtempSync(join(tmpdir(), 'dsh-built-sdk-startup-failure-')) const patch = join(home, 'broken-sdk.cordis.yml') writeFileSync(patch, [ @@ -415,9 +416,9 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', DSH_TELEMETRY_DISABLED: '1', DEEPSEEK_API_KEY: 'built-sdk-startup-failure-no-call', }, home) - expect(result.code).toBe(1) + expect(result.code).toBe(0) expect(result.stdout).toBe('') - expect(result.stderr).toContain('plugin tree failed to load') + expect(result.stderr).toContain('warning: 1 entry did not activate') expect(result.stderr).toContain('@deepseek-ai/dsh-missing-sdk-startup-plugin') } finally { rmSync(home, { recursive: true, force: true }) @@ -756,16 +757,18 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', } }, SPAWN_TIMEOUT_MS + 30_000) - it('reports a patch-overlay boot failure without hanging', async () => { + it('keeps serving when an optional patch-overlay plugin fails', async () => { const home = mkdtempSync(join(tmpdir(), 'dsh-invalid-patch-')) try { const result = await runBuiltBin(['--profile', 'web', '--patch', invalidProvider], { DSH_HOME: home, + DSH_BROWSER_OPEN_TEST_EXIT_ON_READY: '1', DEEPSEEK_API_KEY: 'keyless-invalid-config', DSH_TELEMETRY_DISABLED: '1', + NODE_OPTIONS: `--import=${webReadyExitHook}`, }) - expect(result.code).toBe(1) - expect(result.stdout).toBe('') + expect(result.code).toBe(0) + expect(result.stdout).toMatch(/^dsh web: http:\/\/127\.0\.0\.1:\d+\/\?token=[A-Za-z0-9_-]+$/u) expect(result.stderr).toContain('llm-pi-ai') } finally { rmSync(home, { recursive: true, force: true }) diff --git a/apps/cli/tests/fixtures/invalid-provider.cordis.yml b/apps/cli/tests/fixtures/invalid-provider.cordis.yml index 88534a1680..5aea6833ea 100644 --- a/apps/cli/tests/fixtures/invalid-provider.cordis.yml +++ b/apps/cli/tests/fixtures/invalid-provider.cordis.yml @@ -1,4 +1,4 @@ -# Invalid `--patch` overlay used to prove boot failures settle and exit. +# Invalid optional provider override used to prove best-effort startup continues. - id: llm-pi-ai config: diff --git a/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt b/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt index 74e084a926..1642b96a96 100644 --- a/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt +++ b/apps/cli/tests/profiles/headless/tests/expected/startup-activation-error/stderr.expected.txt @@ -1,3 +1,5 @@ -headless-test-driver: plugin tree failed to load: headless-test-driver: 1 entry did not activate -./activation-error.mjs: Error: startup activation snapshot failure +dsh: warning: 1 entry did not activate +activation-error (./activation-error.mjs): Error: startup activation snapshot failure at activation-error-fixture +dsh: reasoning: +Inspecting the task before the tool call. diff --git a/apps/cli/tests/profiles/headless/tests/fixtures/startup-activation-error/activation-error.patch.yml b/apps/cli/tests/profiles/headless/tests/fixtures/startup-activation-error/activation-error.patch.yml index ce6c7ef949..5acdd928ea 100644 --- a/apps/cli/tests/profiles/headless/tests/fixtures/startup-activation-error/activation-error.patch.yml +++ b/apps/cli/tests/profiles/headless/tests/fixtures/startup-activation-error/activation-error.patch.yml @@ -1,10 +1,4 @@ -# Activation-failure patch over the shipped headless profile. -- id: headless-startup - disabled: true - -- id: headless-runner - disabled: true - +# Unrelated activation failure over the shipped headless profile. - insert: - id: activation-error name: ./activation-error.mjs diff --git a/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts index 48ea951be0..bb31c90060 100644 --- a/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts +++ b/apps/cli/tests/profiles/headless/tests/headless.expected.e2e.ts @@ -271,19 +271,27 @@ describe('headless stream-json snapshots', () => { await expect(result.stderr).toMatchFileSnapshot(headlessFailureExpected) }, LOADER_SMOKE_TEST_TIMEOUT_MS) - it('prints the original Loader activation error through the assembled one-shot app', async () => { + it('warns about an unrelated activation error and completes the headless task', async () => { const result = await runLoaderSmoke({ - label: 'headless startup activation error snapshot', + label: 'headless best-effort startup snapshot', tempDirPrefix: 'headless-snapshot-startup-error-', - binScript, - libBinScript: binScript, + binScript: dshBinScript, configPath: startupFailureConfigPath, - binArgs: [startupFailureConfigPath, 'unreachable task'], + binArgs: [ + '--profile', 'headless', + '--patch', headlessOverlayPath, + '--patch', startupFailureConfigPath, + 'Complete the task despite the unrelated startup failure.', + ], tsconfigPath, - expectedExitCode: 1, + env: { + DSH_PERMISSION_MODE: 'danger-full-access', + DSH_TELEMETRY_DISABLED: '1', + NODE_OPTIONS: [process.env.NODE_OPTIONS, '--disable-warning=ExperimentalWarning'].filter(Boolean).join(' '), + }, }) - expect(result.stdout).toBe('') - await expect(result.stderr.replace(startupFailurePluginUrl, './activation-error.mjs')) + expect(result.stdout).toBe('CLI tool round trip complete: CLI_TOOL_ROUND_TRIP\n') + await expect(result.stderr.replaceAll(startupFailurePluginUrl, './activation-error.mjs')) .toMatchFileSnapshot(startupFailureExpected) }, LOADER_SMOKE_TEST_TIMEOUT_MS) diff --git a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts index 51c85178db..a8630816f7 100644 --- a/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts +++ b/apps/cli/tests/profiles/sdk/keyless-smoke.e2e.ts @@ -355,7 +355,8 @@ describe('Python SDK dsh profile keyless smoke', () => { expect(exitCode, stderr).toBe(1) expect(stdout).toBe('') expect(stderr).toContain('plugin tree failed to load') - expect(stderr).toContain('@deepseek-ai/dsh-sdk-jsonrpc-server: SyntaxError:') + expect(stderr).toContain('required startup failure') + expect(stderr).toContain('sdk-jsonrpc-server (@deepseek-ai/dsh-sdk-jsonrpc-server): SyntaxError') expect(stderr).toContain('sometimes') } finally { await rm(root, { recursive: true, force: true }) diff --git a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts new file mode 100644 index 0000000000..641e10013b --- /dev/null +++ b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts @@ -0,0 +1,243 @@ +/** Built Web-profile acceptance for best-effort initial plugin activation. */ + +import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs' +import { createServer } from 'node:http' +import { tmpdir } from 'node:os' +import { join } from 'node:path' +import type { Readable } from 'node:stream' +import { fileURLToPath, pathToFileURL } from 'node:url' +import { execa } from 'execa' +import { describe, expect, it } from 'vitest' + +const repoRoot = fileURLToPath(new URL('../../../../../../', import.meta.url)) +const dshBin = join(repoRoot, 'apps/cli/lib/bin.js') +const frontendIndex = join(repoRoot, 'apps/web/dist/index.html') +const builtArtifactsExist = existsSync(dshBin) && existsSync(frontendIndex) + +interface Fixture { + root: string + home: string + patch: string + events: string + stop: string +} + +function createFixture(): Fixture { + const root = mkdtempSync(join(tmpdir(), 'dsh-web-best-effort-')) + const home = join(root, 'home') + const events = join(root, 'events.log') + const stop = join(root, 'stop') + mkdirSync(home) + writeFileSync(events, '') + writeFileSync(join(root, 'good.mjs'), [ + "import { appendFileSync, existsSync } from 'node:fs'", + 'export function apply(ctx, config) {', + " appendFileSync(config.events, 'good apply\\n')", + ' let stopping = false', + ' const watcher = setInterval(() => {', + ' if (stopping || !existsSync(config.stop)) return', + ' stopping = true', + " process.emit('SIGTERM')", + ' }, 20)', + ' ctx.effect(() => () => {', + ' clearInterval(watcher)', + " appendFileSync(config.events, 'good dispose\\n')", + ' })', + '}', + '', + ].join('\n')) + writeFileSync(join(root, 'sync-failure.mjs'), 'export function apply() { throw new Error("web sync apply failure") }\n') + writeFileSync(join(root, 'async-failure.mjs'), [ + 'export async function apply() {', + ' await Promise.resolve()', + ' throw new Error("web async apply failure")', + '}', + '', + ].join('\n')) + writeFileSync(join(root, 'pending.mjs'), [ + "export const inject = ['webProbeMissingService']", + 'export function apply() {}', + '', + ].join('\n')) + const patch = join(root, 'failures.patch.yml') + writeFileSync(patch, [ + '- id: tool-todo', + ' disabled: false', + ' config: {}', + '- insert:', + ' - id: web-probe-good', + ` name: ${pathToFileURL(join(root, 'good.mjs')).href}`, + ' config:', + ` events: ${JSON.stringify(events)}`, + ` stop: ${JSON.stringify(stop)}`, + ' - id: web-probe-import-failure', + ` name: ${pathToFileURL(join(root, 'missing.mjs')).href}`, + ' - id: web-probe-sync-failure', + ` name: ${pathToFileURL(join(root, 'sync-failure.mjs')).href}`, + ' - id: web-probe-async-failure', + ` name: ${pathToFileURL(join(root, 'async-failure.mjs')).href}`, + ' - id: web-probe-pending', + ` name: ${pathToFileURL(join(root, 'pending.mjs')).href}`, + '', + ].join('\n')) + return { root, home, patch, events, stop } +} + +async function waitForStartup( + stdout: Readable | null, + stderr: Readable | null, + completion: PromiseLike<{ exitCode?: number }>, +): Promise<{ url: string; stderr: string }> { + if (stdout === null || stderr === null) throw new Error('Web child pipes are unavailable') + stdout.setEncoding('utf8') + stderr.setEncoding('utf8') + let stdoutText = '' + let stderrText = '' + let url: string | undefined + const ready = Promise.withResolvers<{ url: string; stderr: string }>() + let settled = false + const finish = (): void => { + if (settled || url === undefined) return + if (!stderrText.includes('dsh: warning: 5 entries did not activate')) return + if (!stderrText.includes('web async apply failure')) return + if (!stderrText.includes('webProbeMissingService')) return + settled = true + clearTimeout(timer) + ready.resolve({ url, stderr: stderrText }) + } + stdout.on('data', (chunk: string) => { + stdoutText += chunk + url ??= /dsh web: (http:\/\/[^\s]+)/u.exec(stdoutText)?.[1] + finish() + }) + stderr.on('data', (chunk: string) => { + stderrText += chunk + finish() + }) + const timer = setTimeout(() => { + if (settled) return + settled = true + ready.reject(new Error(`Web profile did not report ready and failed entries\nstdout:\n${stdoutText}\nstderr:\n${stderrText}`)) + }, 60_000) + void completion.then((result) => { + if (settled) return + settled = true + clearTimeout(timer) + ready.reject(new Error(`Web profile exited before readiness (code ${String(result.exitCode)})\nstdout:\n${stdoutText}\nstderr:\n${stderrText}`)) + }) + return ready.promise +} + +describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () => { + it('serves the full Web app while unrelated entries fail to start', async () => { + const fixture = createFixture() + const child = execa(process.execPath, [ + dshBin, + '--profile', 'web', + '--patch', fixture.patch, + '--no-open', + '--port', '0', + ], { + cwd: fixture.root, + env: { + ...process.env, + DEEPSEEK_API_KEY: 'keyless-web-best-effort-no-call', + DSH_AGENTS_HOME: join(fixture.root, '.agents'), + DSH_HOME: fixture.home, + DSH_TELEMETRY_DISABLED: '1', + NODE_NO_WARNINGS: '1', + }, + input: '', + reject: false, + timeout: 90_000, + killSignal: 'SIGKILL', + }) + + let result: Awaited + let events = '' + try { + const startup = await waitForStartup(child.stdout, child.stderr, child) + const auth = await fetch(startup.url, { redirect: 'manual' }) + const cookie = auth.headers.get('set-cookie')?.split(';', 1)[0] + if (cookie === undefined) throw new Error('Web authentication response did not set a cookie') + const page = await fetch(new URL('/', startup.url), { headers: { cookie } }) + expect(await page.text()).toContain('
') + expect(readFileSync(fixture.events, 'utf8')).toBe('good apply\n') + expect(startup.stderr).toContain('web-probe-import-failure') + expect(startup.stderr).toContain('@deepseek-ai/dsh-tool-todo') + expect(startup.stderr).toContain('web sync apply failure') + expect(startup.stderr).toContain('web async apply failure') + expect(startup.stderr).toContain('pending (waiting for service: webProbeMissingService)') + } finally { + writeFileSync(fixture.stop, 'stop') + result = await child + events = readFileSync(fixture.events, 'utf8') + rmSync(fixture.root, { recursive: true, force: true }) + } + + expect({ + exitCode: result.exitCode, + timedOut: result.timedOut, + events, + }).toMatchInlineSnapshot(` + { + "events": "good apply + good dispose + ", + "exitCode": 0, + "timedOut": false, + } + `) + }) + + it('fails the full Web profile when its required HTTP server cannot bind', async () => { + const root = mkdtempSync(join(tmpdir(), 'dsh-web-required-bind-')) + const home = join(root, 'home') + mkdirSync(home) + const blocker = createServer() + await new Promise((resolve, reject) => { + const fail = (error: Error): void => { reject(error) } + blocker.once('error', fail) + blocker.listen(0, '127.0.0.1', () => { + blocker.off('error', fail) + resolve() + }) + }) + const address = blocker.address() + if (address === null || typeof address === 'string') { + throw new Error('port blocker did not bind a TCP address') + } + + try { + const result = await execa(process.execPath, [ + dshBin, + '--profile', 'web', + '--no-open', + '--port', String(address.port), + ], { + cwd: root, + env: { + ...process.env, + DEEPSEEK_API_KEY: 'keyless-web-required-bind-no-call', + DSH_AGENTS_HOME: join(root, '.agents'), + DSH_HOME: home, + DSH_TELEMETRY_DISABLED: '1', + NODE_NO_WARNINGS: '1', + }, + input: '', + reject: false, + timeout: 90_000, + killSignal: 'SIGKILL', + }) + expect(result.exitCode).toBe(1) + expect(result.stdout).not.toContain('dsh web: http://') + expect(result.stderr).toContain('required startup failure') + expect(result.stderr).toContain('EADDRINUSE') + } finally { + await new Promise((resolve, reject) => { + blocker.close((error) => { if (error === undefined) resolve(); else reject(error) }) + }) + rmSync(root, { recursive: true, force: true }) + } + }) +}) diff --git a/apps/web/tests/scaffold.ts b/apps/web/tests/scaffold.ts index d1586408fd..c2036bf4af 100644 --- a/apps/web/tests/scaffold.ts +++ b/apps/web/tests/scaffold.ts @@ -57,7 +57,7 @@ import { type NormalizeContext, } from '@deepseek-ai/dsh-session-snapshot' import { - assertEntriesLoaded, + auditStartupEntries, composeEntries, healProfilesModuleFallback, loadOverlayPatches, @@ -711,7 +711,7 @@ export async function launchWebScaffold(options: LaunchOptions = {}): Promise ### Profiles @@ -64,7 +64,18 @@ Before you boot, you can print the exact configuration the app will mount: the d ### What you see when startup fails -Startup failure is a single labelled line plus a nonzero exit — never a silent hang or a raw stack dump. The message names the failing plugin; a plugin that threw keeps its original error, and an entry that never started is reported with the services it was waiting for. +After the Loader settles, app-boot classifies each enabled entry by stable id. Optional failures produce one warning and leave active siblings running. Required failures produce the same entry detail, then dispose the application and reject startup. + +| Failure pattern | Entry result | Startup action | +|---|---|---| +| The root YAML cannot be read or parsed, is not an entry list, or repeats an id in one group | No valid candidate tree | Reject and dispose; no partial application is accepted | +| A plugin module cannot be imported | Entry has no fiber | Warn if optional; reject and dispose if required | +| Config expression evaluation or the plugin's config schema fails during activation | Fiber is `FAILED` with the validation error | Warn if optional; reject and dispose if required | +| Synchronous `apply()` throws | Fiber is `FAILED` with the thrown error | Warn if optional; reject and dispose if required | +| Asynchronous `apply()` rejects | Fiber is `FAILED` with the rejection | Warn if optional; reject and dispose if required | +| Required injected services never appear | Fiber remains `PENDING` and names the missing services | Warn if optional; reject and dispose if required | + +The Loader consumes activation rejections while reconciling the group, and app-boot awaits a failed fiber only to recover its recorded reason. The process-level fail-loud handler is reserved for detached asynchronous failures that no Loader entry owns. If your app owns the terminal, it can hand the terminal back before the process exits, so your shell is never left in raw mode. The handoff is bounded: a stuck cleanup delays the fatal exit but never cancels it. @@ -86,6 +97,7 @@ This section explains how the outcomes above are realized and points at the code - **Channel-neutral library.** The package carries no loader hooks and no dev-mode surface; the [`dsh` app](../../../apps/cli/README.md) owns its Node source-launch hook and consumes these helpers for the boot sequence, and built consumers use plain Node package resolution. - **Two Loader builtins.** `mountRootInclude` registers `cordis:include` and `cordis:group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, and an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name. Both load through the ambient module pipeline rather than the included tree's own specifier resolution. +- **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate generation when they require all-or-nothing setup. - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links. - **One rejection checkpoint.** `assertEntriesActivated` keeps the exact reasons it folds into the boot diagnostic visible through the next process rejection checkpoint, so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. - **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success. diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 50d6096f09..20f0d72f50 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -40,7 +40,7 @@ installFailLoud('dsh') const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT)) ``` -有了这个入口，成功就是每个插件都已激活的运行中应用；失败绝不会悄无声息——一行带标签的信息点名失败的插件与阶段，进程以非零码退出。错误上报前会先拆卸应用上下文，因此不会留下半启动的残留。 +有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行与各应用的 endpoint：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。 ### Profile @@ -64,7 +64,18 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head ### 启动失败时你会看到什么 -启动失败是一行带标签的信息加非零退出码——绝不是静默卡死或原始堆栈转储。信息会点名失败的插件；抛错的插件保留原始错误，从未启动的条目会连同它等待的服务一起报告。 +Loader 结算后，app-boot 按稳定 id 对每个已启用 entry 分类。Optional failure 输出一次警告，并让 active sibling 继续运行。Required failure 输出相同的 entry 详情，然后拆卸应用并拒绝启动。 + +| 失败模式 | Entry 结果 | 启动措施 | +|---|---|---| +| 根 YAML 无法读取或解析、不是 entry list，或同一 group 内 id 重复 | 没有有效 candidate tree | 拒绝并拆卸；不接受部分应用 | +| Plugin module 无法 import | Entry 没有 fiber | Optional 时警告；required 时拒绝并拆卸 | +| Config expression 求值或 plugin config schema 在 activation 时失败 | Fiber 为 `FAILED`，保留校验错误 | Optional 时警告；required 时拒绝并拆卸 | +| 同步 `apply()` throw | Fiber 为 `FAILED`，保留抛出的错误 | Optional 时警告；required 时拒绝并拆卸 | +| 异步 `apply()` reject | Fiber 为 `FAILED`，保留 rejection | Optional 时警告；required 时拒绝并拆卸 | +| 必需的 injected service 始终未出现 | Fiber 保持 `PENDING`，并指出缺失 service | Optional 时警告；required 时拒绝并拆卸 | + +Loader 在 reconcile group 时消费 activation rejection；app-boot 只为取得已记录的原因而 await failed fiber。进程级 fail-loud handler 只处理不属于任何 Loader entry 的 detached asynchronous failure。 如果你的应用持有终端，它可以在进程退出前把终端交还，你的 shell 绝不会残留在 raw 模式。交还过程有界：卡住的清理只会延迟致命退出，而不会取消它。 @@ -86,6 +97,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head - **与渠道无关的库。** 此包不包含 loader 钩子，也不提供开发模式接口；[`dsh` 应用](../../../apps/cli/README.zh.md) 持有自己的 Node 源码启动钩子，并在启动序列中使用这些 helper，构建后的消费方则使用普通 Node 包解析。 - **两个 Loader builtin。** `mountRootInclude` 把 `cordis:include` 与 `cordis:group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，而位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`。两者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。 +- **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 generation。 - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部组合包若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。 - **单一 rejection 检查点。** `assertEntriesActivated` 把折入启动诊断的确切原因保持到下一个进程级 rejection 检查点可见，使 `installFailLoud` 能合并 Loader 的重复通知，而所有无关的未处理 rejection 仍然致命。 - **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。 diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 5f1906e2b4..019892d6bb 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -271,7 +271,8 @@ export async function watchUserPatches( }) await ctx.loader.await() await Promise.allSettled([...ctx.loader.entries()].map(entry => Promise.resolve(entry.fiber?.await()))) - await assertEntriesActivated(ctx, binName) + const failures = await inactiveEntries(ctx) + if (failures.length > 0) ctx.logger.warn(activationDiagnostic(binName, 'warning', failures)) }) try { return await register @@ -614,7 +615,7 @@ export const FAIL_LOUD_RELEASE_TIMEOUT_MS = 2_000 /** * Install before boot to turn a late unhandled plugin-init rejection into one * labelled stderr diagnostic and `exit(1)`. A rejection already included by - * {@link assertEntriesActivated} is ignored during its process checkpoint; + * {@link auditStartupEntries} is ignored during its process checkpoint; * every other rejection remains fatal. Stdout remains untouched for ACP; the * returned function removes the handler. * @@ -682,21 +683,6 @@ export function installFailLoud( return uninstall } -/** - * After the tree settles, reject entries with no fiber and name every plugin - * whose module failed to resolve. Disabled entries are the only valid - * fiber-less state. - * @param ctx - the settled context whose loader entries to audit. - * @param binName - the diagnostic prefix on the thrown error. - */ -export function assertEntriesLoaded(ctx: Context, binName: string): void { - const failed = [...ctx.loader.entries()].filter(entry => entry.fiber === undefined && !entry.disabled) - if (failed.length > 0) { - const names = failed.map(entry => entry.options.name).join(', ') - throw new Error(`${binName}: plugin(s) failed to load: ${names}; Cordis startup failed because these plugin(s) could not be resolved (see the error(s) logged above)`) - } -} - /** * Value mirrors used because Cordis's const enum has no runtime object to import. * Keep aligned with `packages/extensions/tool-cordis/src/fiber-state.ts` and @@ -706,34 +692,68 @@ const FIBER_PENDING = 0 as FiberState.PENDING const FIBER_ACTIVE = 2 as FiberState.ACTIVE const FIBER_FAILED = 3 as FiberState.FAILED -/** Render plugin stacks, nested causes, and aggregate member failures. */ +/** + * Entry ids whose presence defines a usable DSH application. + * + * The list is global rather than profile metadata. Missing or disabled ids do + * not affect startup; an enabled listed entry must activate. Surface endpoints + * cover their injected providers, while `agent-loop` covers shared Agent + * execution. + */ +export const REQUIRED_STARTUP_ENTRY_IDS: readonly string[] = Object.freeze([ + 'agent-loop', + 'webserver', + 'modules', + 'connection', + 'headless-runner', + 'acp', + 'sdk-jsonrpc-server', +]) + +const requiredStartupEntryIds = new Set(REQUIRED_STARTUP_ENTRY_IDS) + +/** Render plugin stacks, nested causes, and aggregate member failures once per error. */ function formatActivationError(error: unknown): string { - if (!(error instanceof Error)) return String(error) - const details = [error.stack ?? error.message] - if (error.cause !== undefined) details.push(formatActivationError(error.cause)) - if (error instanceof AggregateError) details.push(...error.errors.map(formatActivationError)) + const details: string[] = [] + const seen = new Set() + function visit(value: unknown): void { + if (!(value instanceof Error)) { + details.push(String(value)) + return + } + if (seen.has(value)) return + seen.add(value) + details.push(value.stack ?? value.message) + if (value.cause !== undefined) visit(value.cause) + if (value instanceof AggregateError) value.errors.forEach(visit) + } + visit(error) return details.join('\n') } +interface InactiveEntry { + /** Loader entry id used by the required-startup policy. */ + id: string + /** Complete diagnostic beginning with the entry id and module specifier. */ + diagnostic: string +} + /** - * Reject a settled Loader tree when an enabled entry failed or remains inactive. - * Plugin failures include original stacks, nested causes, and aggregate members. - * Pending entries name their unresolved services because no plugin error exists for that state. Active - * entries require no further wait; only failed fibers are awaited to recover - * their private rejection reason. - * @param ctx - the settled context whose Loader entries to audit. - * @param binName - the diagnostic prefix on the thrown error. - * @returns nothing when every enabled entry is active. - * @throws after one process rejection checkpoint when an entry failed to - * import, rejected during activation, or did not become active. + * Collect enabled Loader entries that did not become active. Failed fibers are + * awaited to recover their recorded rejection reason and coalesce duplicate + * Loader notifications through the next process rejection checkpoint. */ -export async function assertEntriesActivated(ctx: Context, binName: string): Promise { - assertEntriesLoaded(ctx, binName) - const failures: string[] = [] +async function inactiveEntries(ctx: Context): Promise { + const failures: InactiveEntry[] = [] const rejectionReasons: unknown[] = [] for (const entry of ctx.loader.entries()) { const fiber = entry.fiber - if (fiber === undefined || entry.disabled) continue + if (entry.disabled) continue + const subject = `${entry.options.id} (${entry.options.name})` + if (fiber === undefined) { + failures.push({ id: entry.options.id, diagnostic: `${subject}: failed to import` }) + continue + } const state = fiber.state if (state === FIBER_ACTIVE) continue if (state === FIBER_FAILED) { @@ -741,24 +761,62 @@ export async function assertEntriesActivated(ctx: Context, binName: string): Pro await fiber.await() } catch (error) { rejectionReasons.push(error) - failures.push(`${entry.options.name}: ${formatActivationError(error)}`) + failures.push({ id: entry.options.id, diagnostic: `${subject}: ${formatActivationError(error)}` }) } continue } if (state === FIBER_PENDING) { const missing = Object.keys(fiber.inject).filter(service => fiber.ctx.get(service) === undefined) - const subject = missing.length === 1 ? 'service' : 'services' - failures.push(`${entry.options.name}: pending (waiting for ${subject}: ${missing.join(', ') || 'unknown'})`) + failures.push({ + id: entry.options.id, + diagnostic: `${subject}: pending (waiting for ${missing.length === 1 ? 'service' : 'services'}: ${missing.join(', ') || 'unknown'})`, + }) } else { - failures.push(`${entry.options.name}: fiber state ${String(state)}`) + failures.push({ id: entry.options.id, diagnostic: `${subject}: fiber state ${String(state)}` }) } } - if (failures.length > 0) { - if (rejectionReasons.length > 0) { - await observeLoaderRejectionCheckpoint(rejectionReasons) - } - const noun = failures.length === 1 ? 'entry' : 'entries' - throw new Error(`${binName}: ${String(failures.length)} ${noun} did not activate\n${failures.join('\n')}`) + if (rejectionReasons.length > 0) await observeLoaderRejectionCheckpoint(rejectionReasons) + return failures +} + +/** Render an inactive-entry diagnostic with a count and severity label. */ +function activationDiagnostic( + binName: string, + severity: 'warning' | 'required startup failure', + failures: readonly InactiveEntry[], +): string { + const noun = failures.length === 1 ? 'entry' : 'entries' + const prefix = binName === '' ? '' : `${binName}: ` + return `${prefix}${severity}: ${String(failures.length)} ${noun} did not activate\n${failures.map(failure => failure.diagnostic).join('\n')}\n` +} + +/** + * Apply DSH startup policy to a settled Loader tree. + * + * Inactive entries from the global required list reject startup. Other + * inactive entries produce one warning and leave successful siblings running. + * Required ids absent from the tree, and disabled required entries, are ignored. + * @param ctx - the settled context whose Loader entries to audit. + * @param binName - the diagnostic prefix on optional-entry warnings. + * @param warn - sink for optional-entry warnings. + * @returns after all optional failures are warned when no required entry failed. + * @throws when an enabled entry in {@link REQUIRED_STARTUP_ENTRY_IDS} is inactive. + */ +export async function auditStartupEntries( + ctx: Context, + binName: string, + warn: (line: string) => void = line => void process.stderr.write(line), +): Promise { + const failures = await inactiveEntries(ctx) + const required: InactiveEntry[] = [] + const optional: InactiveEntry[] = [] + for (const failure of failures) { + const target = requiredStartupEntryIds.has(failure.id) ? required : optional + target.push(failure) + } + if (optional.length > 0) warn(activationDiagnostic(binName, 'warning', optional)) + if (required.length > 0) { + throw new Error(activationDiagnostic('', 'required startup failure', required).trimEnd()) } } @@ -770,10 +828,11 @@ export async function assertEntriesActivated(ctx: Context, binName: string): Pro * is statically imported and mounted as the `cordis:include` builtin, loading * through the ambient module pipeline (vite/tsx/plain ESM). The package build * embeds Include while leaving Loader external, so the built include tree and - * host share one Loader peer. The final audit, {@link assertEntriesActivated}, - * rejects missing, failed, or inactive entries. `boot` disposes its partial - * context on failure and preserves the original activation stack; later unhandled rejections remain - * covered by {@link installFailLoud}. Built bins need the Loader's native + * host share one Loader peer. Loader settlement drains entry work without + * rejecting the whole tree. The final {@link auditStartupEntries} call rejects + * failures in the global required list and warns about other failed, missing, + * and pending entries while successful siblings remain active. Later unhandled + * rejections remain covered by {@link installFailLoud}. Built bins need the Loader's native * helper for bare plugin specifiers; relative specifiers do not. * @param binName - the diagnostic prefix for load-failure errors. * @param absoluteConfigPath - the config to include; must already be absolute @@ -820,7 +879,7 @@ export async function boot( // as asked. Re-check after settlement before auditing the tree. await ctx.get('loader')?.await() if (ctx.get('loader') === undefined) return ctx - await assertEntriesActivated(ctx, binName) + await auditStartupEntries(ctx, binName) return ctx } catch (cause) { // Root-fiber disposal contains cleanup failures per observer (Cordis diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index bfb8e24355..1320a2ae65 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -6,9 +6,10 @@ import { afterAll, describe, expect, it, vi } from 'vitest' import { Context } from '@deepseek-ai/cordis' import SystemPrompt, { renderPrompt } from '@deepseek-ai/dsh-system-prompt' import { - addHarnessSourceSection, assertEntriesActivated, assertEntriesLoaded, boot, + addHarnessSourceSection, auditStartupEntries, boot, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, installFailLoud, loadEnv, loadLayeredEnv, loadOverlayPatches, resolveConfigPath, type FailLoudProcess, + REQUIRED_STARTUP_ENTRY_IDS, } from '../src/index.ts' const NAME = 'dsh-test-bin' @@ -419,10 +420,11 @@ describe('installFailLoud', () => { const proc = fakeProc() installFailLoud(NAME, proc) const error = new Error('assembled activation failure') - const audit = assertEntriesActivated({ + const warn = vi.fn() + const audit = auditStartupEntries({ loader: { entries: () => ['broken-a', 'broken-b'].map(name => ({ - options: { name }, + options: { id: name, name }, fiber: { state: 3, inject: {}, @@ -431,13 +433,14 @@ describe('installFailLoud', () => { }, })), }, - } as unknown as Context, NAME) + } as unknown as Context, NAME, warn) await Promise.resolve() await Promise.resolve() proc.handlers[0]!(error) expect(proc.written).toEqual([]) expect(proc.exits).toEqual([]) - await expect(audit).rejects.toThrow('assembled activation failure') + await audit + expect(warn).toHaveBeenCalledWith(expect.stringContaining('assembled activation failure')) proc.handlers[0]!(error) expect(proc.exits).toEqual([1]) }) @@ -501,36 +504,20 @@ describe('installFailLoud', () => { }) }) -describe('assertEntriesLoaded', () => { - const ctxWith = (entries: Array<{ fiber?: unknown; disabled?: boolean; options: { name?: string } }>): Context => - ({ loader: { entries: () => entries } }) as unknown as Context - - it('passes when every enabled entry has a fiber', () => { - expect(() => { assertEntriesLoaded(ctxWith([ - { fiber: {}, options: { name: 'a' } }, - { disabled: true, options: { name: 'off' } }, - ]), NAME) }).not.toThrow() - }) - - it('throws naming every enabled fiber-less entry', () => { - expect(() => { assertEntriesLoaded(ctxWith([ - { fiber: {}, options: { name: 'ok' } }, - { options: { name: 'broken-a' } }, - { options: { name: 'broken-b' } }, - ]), NAME) }).toThrow(`${NAME}: plugin(s) failed to load: broken-a, broken-b`) - }) -}) - -describe('assertEntriesActivated', () => { - interface FakeFiber { - state: number - inject: Record - ctx: { get(name: string): unknown } - await(): Promise +describe('auditStartupEntries', () => { + interface FakeEntry { + fiber?: { + state: number + inject: Record + ctx: { get(name: string): unknown } + await(): Promise + } + disabled?: boolean + options: { id: string; name: string } } - const ctxWith = (entries: Array<{ fiber?: FakeFiber; disabled?: boolean; options: { name: string } }>): Context => ({ - loader: { entries: () => entries }, + const ctxWith = (entries: FakeEntry[]): Context => ({ + loader: { entries: () => entries.values() }, }) as unknown as Context const fiber = ( @@ -538,95 +525,99 @@ describe('assertEntriesActivated', () => { error?: unknown, inject: Record = {}, services: string[] = [], - ): FakeFiber => ({ + ): NonNullable => ({ state, inject, ctx: { get: name => services.includes(name) ? {} : undefined }, await: error === undefined ? async () => undefined : async () => { throw error }, }) - it('passes active entries and ignores disabled entries', async () => { - let awaitCalls = 0 - const active = fiber(2) - active.await = async () => { - awaitCalls++ - return undefined - } - const disabled = fiber(3, new Error('disabled failure')) - disabled.await = async () => { - awaitCalls++ - throw new Error('disabled failure') - } - await expect(assertEntriesActivated(ctxWith([ - { fiber: active, options: { name: 'active' } }, - { fiber: disabled, disabled: true, options: { name: 'disabled' } }, - ]), NAME)).resolves.toBeUndefined() - expect(awaitCalls).toBe(0) + it('pins the global list to shared execution and application endpoints', () => { + expect(Object.isFrozen(REQUIRED_STARTUP_ENTRY_IDS)).toBe(true) + expect(REQUIRED_STARTUP_ENTRY_IDS).toEqual([ + 'agent-loop', + 'webserver', + 'modules', + 'connection', + 'headless-runner', + 'acp', + 'sdk-jsonrpc-server', + ]) + expect(REQUIRED_STARTUP_ENTRY_IDS).not.toContain('tool-todo') }) - it('reports the plugin name and original activation stack instead of fiber state 3', async () => { - const original = new Error('actual plugin failure') - await expect(assertEntriesActivated(ctxWith([ - { fiber: fiber(3, original), options: { name: 'broken-plugin' } }, - ]), NAME)).rejects.toThrow(`${NAME}: 1 entry did not activate\nbroken-plugin: ${original.stack!}`) + it('ignores active, disabled, and absent required entries', async () => { + const warn = vi.fn() + await expect(auditStartupEntries(ctxWith([ + { fiber: fiber(2), options: { id: 'active', name: 'active' } }, + { fiber: fiber(3, new Error('disabled failure')), disabled: true, options: { id: 'webserver', name: 'disabled' } }, + ]), NAME, warn)).resolves.toBeUndefined() + expect(warn).not.toHaveBeenCalled() }) - it('formats stackless and non-Error activation failures', async () => { - const stackless = new Error('stackless failure') - delete (stackless as { stack?: string }).stack - await expect(assertEntriesActivated(ctxWith([ - { fiber: fiber(3, stackless), options: { name: 'stackless' } }, - { fiber: fiber(3, 'plain failure'), options: { name: 'plain' } }, - ]), NAME)).rejects.toThrow(`${NAME}: 2 entries did not activate\nstackless: stackless failure\nplain: plain failure`) + it('warns once for optional import, apply, and dependency failures', async () => { + const warn = vi.fn() + const original = new Error('todo apply failure') + await auditStartupEntries(ctxWith([ + { options: { id: 'missing-tool', name: './missing.mjs' } }, + { fiber: fiber(3, original), options: { id: 'tool-todo', name: '@deepseek-ai/dsh-tool-todo' } }, + { + fiber: fiber(0, undefined, { ready: {}, missing: {} }, ['ready']), + options: { id: 'waiting-tool', name: './waiting.mjs' }, + }, + ]), NAME, warn) + expect(warn).toHaveBeenCalledOnce() + expect(warn).toHaveBeenCalledWith([ + `${NAME}: warning: 3 entries did not activate`, + 'missing-tool (./missing.mjs): failed to import', + `tool-todo (@deepseek-ai/dsh-tool-todo): ${original.stack!}`, + 'waiting-tool (./waiting.mjs): pending (waiting for service: missing)', + '', + ].join('\n')) }) it('preserves nested activation causes and aggregate member failures', async () => { + const warn = vi.fn() const original = new Error('tool discovery failed') const aggregate = new AggregateError([original, 'transport closed'], 'connection failed', { cause: new Error('server rejected discovery'), }) const wrapper = new Error('plugin activation failed', { cause: aggregate }) - await expect(assertEntriesActivated(ctxWith([ - { fiber: fiber(3, wrapper), options: { name: 'wrapped-plugin' } }, - ]), NAME)).rejects.toThrow([ - `${NAME}: 1 entry did not activate`, - `wrapped-plugin: ${wrapper.stack!}`, + await auditStartupEntries(ctxWith([ + { fiber: fiber(3, wrapper), options: { id: 'wrapped-plugin', name: './wrapped.mjs' } }, + ]), NAME, warn) + expect(warn).toHaveBeenCalledWith([ + `${NAME}: warning: 1 entry did not activate`, + `wrapped-plugin (./wrapped.mjs): ${wrapper.stack!}`, aggregate.stack!, (aggregate.cause as Error).stack!, original.stack!, 'transport closed', + '', ].join('\n')) }) - it('reports unresolved services for pending entries', async () => { - let awaitCalls = 0 - const expected = [ - `${NAME}: 3 entries did not activate`, - 'waiting: pending (waiting for services: missingA, missingB)', - 'single-wait: pending (waiting for service: missing)', - 'unknown-wait: pending (waiting for services: unknown)', - ].join('\n') - const waiting = fiber(0, undefined, { ready: {}, missingA: {}, missingB: {} }, ['ready']) - const singleWait = fiber(0, undefined, { missing: {} }) - const unknownWait = fiber(0) - for (const item of [waiting, singleWait, unknownWait]) { - item.await = async () => { - awaitCalls++ - return undefined - } - } - await expect(assertEntriesActivated(ctxWith([ - { fiber: waiting, options: { name: 'waiting' } }, - { fiber: singleWait, options: { name: 'single-wait' } }, - { fiber: unknownWait, options: { name: 'unknown-wait' } }, - ]), NAME)).rejects.toThrow(expected) - expect(awaitCalls).toBe(0) + it('rejects required failures after warning about optional failures', async () => { + const warn = vi.fn() + const requiredError = new Error('address already in use') + const optionalError = new Error('todo unavailable') + await expect(auditStartupEntries(ctxWith([ + { fiber: fiber(3, requiredError), options: { id: 'webserver', name: '@deepseek-ai/dsh-host-webserver' } }, + { fiber: fiber(3, optionalError), options: { id: 'tool-todo', name: '@deepseek-ai/dsh-tool-todo' } }, + ]), NAME, warn)).rejects.toThrow([ + 'required startup failure: 1 entry did not activate', + `webserver (@deepseek-ai/dsh-host-webserver): ${requiredError.stack!}`, + ].join('\n')) + expect(warn).toHaveBeenCalledWith(`${NAME}: warning: 1 entry did not activate\ntool-todo (@deepseek-ai/dsh-tool-todo): ${optionalError.stack!}\n`) }) - it('retains the numeric diagnostic for a settled unexpected state', async () => { - await expect(assertEntriesActivated(ctxWith([ - { fiber: fiber(4), options: { name: 'disposed' } }, - ]), NAME)).rejects.toThrow('disposed: fiber state 4') + it('rejects a required entry pending on an injected service', async () => { + await expect(auditStartupEntries(ctxWith([{ + fiber: fiber(0, undefined, { webRuntime: {} }), + options: { id: 'connection', name: '@deepseek-ai/dsh-client-connection' }, + }]), NAME, vi.fn())).rejects.toThrow( + 'connection (@deepseek-ai/dsh-client-connection): pending (waiting for service: webRuntime)', + ) }) }) @@ -818,48 +809,86 @@ describe('boot', () => { expect(ctx.get('loader')).toBeUndefined() }) - it('rejects (never exits 0 half-empty) when a config names a plugin that cannot be imported', async () => { - const dir = tmp() - writeFileSync(join(dir, 'cordis.yml'), '- id: ghost\n name: ./missing.mjs\n') - await expect(boot(NAME, join(dir, 'cordis.yml'))).rejects.toThrow( - `${NAME}: plugin tree failed to load: ${NAME}: plugin(s) failed to load: ./missing.mjs`, - ) - }) - - it('labels a deferred config failure with its row and leaves the source file unchanged', async () => { + it('keeps successful entries and warns about optional import, config, sync apply, async apply, and dependency failures', async () => { const dir = tmp() const configPath = join(dir, 'cordis.yml') const config = [ + '- id: good', + ' name: ./good.mjs', + '- id: import-failure', + ' name: ./missing.mjs', '- id: invalid-config', ' name: ./noop.mjs', ' config:', ' value: !!js "JSON.parse(\'invalid\')"', + '- id: sync-failure', + ' name: ./sync-failure.mjs', + '- id: async-failure', + ' name: ./async-failure.mjs', + '- id: waiting', + ' name: ./waiting.mjs', '', ].join('\n') + writeFileSync(join(dir, 'good.mjs'), 'export function apply(ctx) { ctx.provide("goodStarted", true) }\n') writeFileSync(join(dir, 'noop.mjs'), 'export function apply() {}\n') + writeFileSync(join(dir, 'sync-failure.mjs'), 'export function apply() { throw new Error("sync apply failure") }\n') + writeFileSync(join(dir, 'async-failure.mjs'), 'export async function apply() { throw new Error("async apply failure") }\n') + writeFileSync(join(dir, 'waiting.mjs'), 'export const inject = ["neverProvided"]\nexport function apply() {}\n') writeFileSync(configPath, config) - await expect(boot(NAME, configPath)).rejects.toThrow( - './noop.mjs: SyntaxError:', - ) - expect(readFileSync(configPath, 'utf8')).toBe(config) + const write = vi.spyOn(process.stderr, 'write').mockImplementation(() => true) + let ctx: Context | undefined + try { + ctx = await boot(NAME, configPath) + expect(ctx.get('goodStarted')).toBe(true) + const entries = [...ctx.loader.entries()] + expect(entries.find(entry => entry.options.id === 'good')?.fiber?.state).toBe(2) + expect(entries.find(entry => entry.options.id === 'import-failure')?.fiber).toBeUndefined() + for (const id of ['invalid-config', 'sync-failure', 'async-failure']) { + expect(entries.find(entry => entry.options.id === id)?.fiber?.state).toBe(3) + } + expect(entries.find(entry => entry.options.id === 'waiting')?.fiber?.state).toBe(0) + const warning = write.mock.calls.map(call => String(call[0])).join('') + expect(warning).toContain(`${NAME}: warning: 5 entries did not activate`) + expect(warning).toContain('import-failure (./missing.mjs): failed to import') + expect(warning).toContain('SyntaxError: Unexpected token') + expect(warning).toContain('sync apply failure') + expect(warning).toContain('async apply failure') + expect(warning).toContain('waiting for service: neverProvided') + expect(readFileSync(configPath, 'utf8')).toBe(config) + } finally { + write.mockRestore() + await ctx?.fiber.dispose() + } }) - it('appends the deepest cause with its original stack to the load failure', async () => { + it('disposes successful entries and rejects when a required entry fails', async () => { const dir = tmp() - writeFileSync(join(dir, 'failing.mjs'), [ - 'export function apply() {', - " const failure = new Error('pinned activation failure')", - " failure.stack = 'Error: pinned activation failure\\n at failing-fixture'", - ' throw failure', + let disposed = false + writeFileSync(join(dir, 'good.mjs'), [ + 'export function apply(ctx) {', + ' globalThis.__DSH_REQUIRED_TEST_DISPOSED__ = false', + ' ctx.effect(() => () => { globalThis.__DSH_REQUIRED_TEST_DISPOSED__ = true })', '}', '', ].join('\n')) - writeFileSync(join(dir, 'cordis.yml'), '- id: failing\n name: ./failing.mjs\n') + writeFileSync(join(dir, 'required-failure.mjs'), 'export function apply() { throw new Error("required apply failure") }\n') + writeFileSync(join(dir, 'cordis.yml'), [ + '- id: good', + ' name: ./good.mjs', + '- id: webserver', + ' name: ./required-failure.mjs', + '', + ].join('\n')) + await expect(boot(NAME, join(dir, 'cordis.yml'))).rejects.toThrow(new RegExp([ - String.raw`\./failing\.mjs: Error: pinned activation failure\n`, - String.raw` {4}at failing-fixture$`, - ].join(''))) + 'plugin tree failed to load: required startup failure: 1 entry did not activate', + String.raw`webserver \(\.\/required-failure\.mjs\):`, + 'required apply failure', + ].join(String.raw`[\s\S]*`))) + disposed = (globalThis as { __DSH_REQUIRED_TEST_DISPOSED__?: boolean }).__DSH_REQUIRED_TEST_DISPOSED__ ?? false + delete (globalThis as { __DSH_REQUIRED_TEST_DISPOSED__?: boolean }).__DSH_REQUIRED_TEST_DISPOSED__ + expect(disposed).toBe(true) }) it('falls back to the deepest cause message when its stack was erased', async () => { @@ -901,15 +930,6 @@ describe('boot', () => { } }) - it('reports a pending real Loader fiber and the service unresolved in its own context', async () => { - const dir = tmp() - writeFileSync(join(dir, 'waiting.mjs'), 'export const inject = ["neverProvided"]\nexport function apply() {}\n') - writeFileSync(join(dir, 'cordis.yml'), '- id: waiting\n name: ./waiting.mjs\n') - await expect(boot(NAME, join(dir, 'cordis.yml'))).rejects.toThrow([ - `${NAME}: 1 entry did not activate`, - './waiting.mjs: pending (waiting for service: neverProvided)', - ].join('\n')) - }) }) describe('addHarnessSourceSection', () => { diff --git a/packages/session/session-telemetry-otel/tests/loader-composition.e2e.ts b/packages/session/session-telemetry-otel/tests/loader-composition.e2e.ts index 6bc115af75..af28e1e892 100644 --- a/packages/session/session-telemetry-otel/tests/loader-composition.e2e.ts +++ b/packages/session/session-telemetry-otel/tests/loader-composition.e2e.ts @@ -73,7 +73,7 @@ function eventTypes(captures: OtlpCapture[]): string[] { } describe('session-telemetry-otel through the production headless profile', () => { - it('rejects FULL before any session can be uploaded', async () => { + it('continues the headless task without telemetry when FULL is rejected', async () => { const { stdout, stderr } = await runLoaderSmoke({ label: 'session-telemetry-otel rejected FULL loader smoke', tempDirPrefix: 'telemetry-otel-full-e2e-', @@ -82,8 +82,8 @@ describe('session-telemetry-otel through the production headless profile', () => configPath, tsconfigPath: repoTsconfig, env: { DSH_TELEMETRY_E2E_MODE: 'FULL' }, - expectedExitCode: 1, }) + expect(stdout + stderr).toContain('warning: 1 entry did not activate') expect(stdout + stderr).toContain('FULL') }, LOADER_SMOKE_TEST_TIMEOUT_MS) From fbcad258ad1c7c5406d4d8fc3a64ed0a533b7b9a Mon Sep 17 00:00:00 2001 From: Turtle Date: Wed, 9 Sep 2026 13:11:36 +0800 Subject: [PATCH 14/26] test(boot): keep required fixture failures fatal --- .../tests/session-format-guard.expected.e2e.ts | 12 ++++++++---- .../loader-smoke/tests/fixtures/headless-driver.ts | 12 ++++++++++++ 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/apps/cli/tests/profiles/headless/tests/session-format-guard.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/session-format-guard.expected.e2e.ts index 6f45fa4caa..1574c2cab1 100644 --- a/apps/cli/tests/profiles/headless/tests/session-format-guard.expected.e2e.ts +++ b/apps/cli/tests/profiles/headless/tests/session-format-guard.expected.e2e.ts @@ -32,6 +32,10 @@ const binScript = fileURLToPath(new URL('../../../../../../packages/test-support const tsconfigPath = fileURLToPath(new URL('../../../../../../tsconfig.json', import.meta.url)) // The resumed-agent fixture in the shared config resumes exactly this id. const sessionId = SessionId('workspace-context-resume') +const fixtureEnv = { + DSH_SNAPSHOT_FILE: replayFixture, + DSH_LOADER_SMOKE_REQUIRED_ENTRY_ID: 'resumed-agent', +} /** Persist one session with the given header version and events, returning its log path. */ async function seedSession(root: string, cwd: string, version: number, events: SessionEvent[]): Promise { @@ -84,7 +88,7 @@ describe('session format guard through the assembled app', () => { configPath, binArgs: [configPath, 'Continue the migrated session.'], tsconfigPath, - env: { DSH_SNAPSHOT_FILE: replayFixture }, + env: fixtureEnv, prepare: async (runCwd) => { sourcePath = await seedSession(join(runCwd, '.sessions'), runCwd, 0, closedTurn()) source = await readFile(sourcePath) @@ -124,7 +128,7 @@ describe('session format guard through the assembled app', () => { configPath, binArgs: [configPath, 'Try to resume.'], tsconfigPath, - env: { DSH_SNAPSHOT_FILE: replayFixture }, + env: fixtureEnv, expectedExitCode: 1, prepare: async (runCwd) => { sessionPath = await seedSession(join(runCwd, '.sessions'), runCwd, SESSION_FORMAT_VERSION + 99, closedTurn()) @@ -151,7 +155,7 @@ describe('session format guard through the assembled app', () => { configPath, binArgs: [configPath, 'Try to resume.'], tsconfigPath, - env: { DSH_SNAPSHOT_FILE: replayFixture }, + env: fixtureEnv, expectedExitCode: 1, prepare: async (runCwd) => { sourcePath = generationLogPath(join(runCwd, '.sessions'), runCwd, sessionId, 2, 'none') @@ -197,7 +201,7 @@ describe('session format guard through the assembled app', () => { configPath, binArgs: [configPath, 'Try to resume.'], tsconfigPath, - env: { DSH_SNAPSHOT_FILE: replayFixture }, + env: fixtureEnv, expectedExitCode: 1, prepare: async (runCwd) => { sessionPath = await seedSession(join(runCwd, '.sessions'), runCwd, SESSION_FORMAT_VERSION, [ diff --git a/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts b/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts index d617b98794..2ba74cc3d7 100644 --- a/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts +++ b/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts @@ -8,6 +8,8 @@ import type { SessionEvent } from '@deepseek-ai/dsh-session' import { bootProductionProfile } from './production-profile.ts' const NAME = 'headless-test-driver' +const REQUIRED_ENTRY_ENV = 'DSH_LOADER_SMOKE_REQUIRED_ENTRY_ID' +const FIBER_ACTIVE = 2 const [configPath, ...taskParts] = process.argv.slice(2) if (configPath === undefined || taskParts.length === 0 || taskParts.every(part => part.trim() === '')) { throw new Error(`${NAME}: expected `) @@ -22,6 +24,16 @@ try { profile: 'headless', overlayPaths: [resolveConfigPath(configPath, undefined)], }) + const requiredEntryId = process.env[REQUIRED_ENTRY_ENV] + if (requiredEntryId !== undefined) { + const entry = [...ctx.loader.entries()].find(candidate => candidate.options.id === requiredEntryId) + if (entry === undefined) throw new Error(`${NAME}: required fixture entry not found: ${requiredEntryId}`) + if (entry.fiber === undefined) throw new Error(`${NAME}: required fixture entry failed to import: ${requiredEntryId}`) + await entry.fiber.await() + if (entry.fiber.state !== FIBER_ACTIVE) { + throw new Error(`${NAME}: required fixture entry did not activate: ${requiredEntryId}`) + } + } const result = await runFixtureTurn(ctx, { task: taskParts.join(' '), onEvent: (sessionId: string, event: SessionEvent) => { From 941267b197709fcab1b2980dcbcbdd7914a7102e Mon Sep 17 00:00:00 2001 From: Turtle Date: Wed, 9 Sep 2026 13:37:29 +0800 Subject: [PATCH 15/26] test(boot): type fixture fiber state --- .../loader-smoke/tests/fixtures/headless-driver.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts b/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts index 2ba74cc3d7..5afc35a44d 100644 --- a/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts +++ b/packages/test-support/loader-smoke/tests/fixtures/headless-driver.ts @@ -1,7 +1,7 @@ #!/usr/bin/env node /** Snapshot-only Loader driver: stream one fixture turn as canonical JSONL. */ -import type { Context } from '@deepseek-ai/cordis' +import type { Context, FiberState } from '@deepseek-ai/cordis' import { installFailLoud, loadEnv, resolveConfigPath } from '@deepseek-ai/dsh-app-boot' import { runFixtureTurn } from '@deepseek-ai/dsh-loader-smoke' import type { SessionEvent } from '@deepseek-ai/dsh-session' @@ -9,7 +9,7 @@ import { bootProductionProfile } from './production-profile.ts' const NAME = 'headless-test-driver' const REQUIRED_ENTRY_ENV = 'DSH_LOADER_SMOKE_REQUIRED_ENTRY_ID' -const FIBER_ACTIVE = 2 +const FIBER_ACTIVE = 2 as FiberState.ACTIVE const [configPath, ...taskParts] = process.argv.slice(2) if (configPath === undefined || taskParts.length === 0 || taskParts.every(part => part.trim() === '')) { throw new Error(`${NAME}: expected `) From f3087420507ec0d26c1583f7201f3e4eca50b159 Mon Sep 17 00:00:00 2001 From: Turtle Date: Wed, 9 Sep 2026 13:51:38 +0800 Subject: [PATCH 16/26] test(boot): cover startup diagnostic variants --- packages/boot/app-boot/tests/app-boot.spec.ts | 54 +++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 1320a2ae65..4bdb4bd285 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -597,6 +597,60 @@ describe('auditStartupEntries', () => { ].join('\n')) }) + it('describes nested, stackless, non-error, pending, and unexpected failures', async () => { + const warn = vi.fn() + const circular = new Error('circular failure') + ;(circular as { cause?: unknown }).cause = circular + const stackless = new Error('stackless failure') + delete (stackless as { stack?: string }).stack + const deepestWithStack = new Error('deep failure with stack') + const deepestWithoutStack = new Error('deep failure without stack') + delete (deepestWithoutStack as { stack?: string }).stack + const wrappedStack = new Error('wrapped stack', { cause: deepestWithStack }) + const wrappedStackless = new Error('wrapped stackless', { cause: deepestWithoutStack }) + const wrappedValue = new Error('wrapped value', { cause: 'plain cause' }) + + await auditStartupEntries(ctxWith([ + { fiber: fiber(3, circular), options: { id: 'circular', name: './circular.mjs' } }, + { fiber: fiber(3, stackless), options: { id: 'stackless', name: './stackless.mjs' } }, + { + fiber: fiber(3, wrappedStack), + options: { id: 'deep-stack', name: './deep-stack.mjs' }, + }, + { + fiber: fiber(3, wrappedStackless), + options: { id: 'deep-stackless', name: './deep-stackless.mjs' }, + }, + { + fiber: fiber(3, wrappedValue), + options: { id: 'plain-cause', name: './plain-cause.mjs' }, + }, + { fiber: fiber(3, 42), options: { id: 'number-error', name: './number-error.mjs' } }, + { + fiber: fiber(0, undefined, { first: {}, second: {} }), + options: { id: 'multiple-dependencies', name: './multiple-dependencies.mjs' }, + }, + { + fiber: fiber(0), + options: { id: 'unknown-dependency', name: './unknown-dependency.mjs' }, + }, + { fiber: fiber(1), options: { id: 'unexpected-state', name: './unexpected-state.mjs' } }, + ]), NAME, warn) + + expect(warn).toHaveBeenCalledOnce() + const diagnostic = String(warn.mock.calls[0]![0]) + expect(diagnostic).toContain(`${NAME}: warning: 9 entries did not activate`) + expect(diagnostic).toContain(`circular (./circular.mjs): ${circular.stack!}`) + expect(diagnostic).toContain('stackless (./stackless.mjs): stackless failure') + expect(diagnostic).toContain(`deep-stack (./deep-stack.mjs): ${wrappedStack.stack!}\n${deepestWithStack.stack!}`) + expect(diagnostic).toContain(`deep-stackless (./deep-stackless.mjs): ${wrappedStackless.stack!}\ndeep failure without stack`) + expect(diagnostic).toContain(`plain-cause (./plain-cause.mjs): ${wrappedValue.stack!}\nplain cause`) + expect(diagnostic).toContain('number-error (./number-error.mjs): 42') + expect(diagnostic).toContain('multiple-dependencies (./multiple-dependencies.mjs): pending (waiting for services: first, second)') + expect(diagnostic).toContain('unknown-dependency (./unknown-dependency.mjs): pending (waiting for services: unknown)') + expect(diagnostic).toContain('unexpected-state (./unexpected-state.mjs): fiber state 1') + }) + it('rejects required failures after warning about optional failures', async () => { const warn = vi.fn() const requiredError = new Error('address already in use') From f4a7dd607709025bc3ad19dab8ffbb038cd13962 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 18:27:55 +0800 Subject: [PATCH 17/26] fix(boot): preserve failure policy on nontransactional Loader --- ...onsumer-owned-startup-strictness.i18n.yaml | 4 +- ...09-09-consumer-owned-startup-strictness.md | 2 +- ...09-consumer-owned-startup-strictness.zh.md | 2 +- .../web-best-effort-startup.expected.e2e.ts | 52 +++++++++++++++ packages/boot/app-boot/README.i18n.yaml | 4 +- packages/boot/app-boot/README.md | 7 +- packages/boot/app-boot/README.zh.md | 7 +- packages/boot/app-boot/src/index.ts | 24 +++---- packages/boot/app-boot/tests/app-boot.spec.ts | 34 ++++++++++ .../boot/app-boot/tests/config-reload.spec.ts | 65 +++++++++++++++++++ .../boot/app-boot/tests/user-patches.spec.ts | 36 +++++----- 11 files changed, 196 insertions(+), 41 deletions(-) diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml index a12922007e..ef3d69c711 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md -2026-09-09-consumer-owned-startup-strictness.md: b9ffe13901c2adabfe95f8ae3f44d8eba83b6d01 -2026-09-09-consumer-owned-startup-strictness.zh.md: f6aae3922407d04c472b3fde57ce7a4f4f1fb888 +2026-09-09-consumer-owned-startup-strictness.md: eab57329bc33c6a341d1073275deb4fd2355f041 +2026-09-09-consumer-owned-startup-strictness.zh.md: 687017533d114cd1e13205b50373fc415eb99c2a diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md index b9ffe13901..eab57329bc 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -10,7 +10,7 @@ Best-effort Loader reconciliation preserves usable plugins, but applications sti ## Decision -DSH owns startup strictness outside vendored Cordis. App-boot audits the settled initial tree against one global list of stable entry ids. A listed entry that is present, enabled, and not active rejects startup and disposes the application. A listed id that is absent or disabled has no effect. Every other inactive entry produces one warning and leaves successful siblings running. +DSH owns startup strictness outside vendored Cordis. App-boot audits the settled initial tree against one global list of stable entry ids. A listed entry that is present, enabled, and not active rejects startup and disposes the application. A listed id that is absent or disabled has no effect. The bootstrap Include is required by entry identity because a missing or invalid root configuration prevents application assembly. Other inactive entries produce one warning and leave successful siblings running. The required ids are `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution and the endpoints of the shipped Web, headless, ACP, and SDK applications. Their injected providers do not need separate list entries: a missing provider leaves the listed endpoint pending or failed. diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md index f6aae39224..687017533d 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -10,7 +10,7 @@ Best-effort Loader reconcile 会保留可用 plugin，但应用仍需一组最 ## 决策 -DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全局稳定 entry id list 审计已结算的初始 tree。List 中存在、启用且未 active 的 entry 会使启动 reject，并拆卸应用。List 中缺失或禁用的 id 不产生影响。其他 inactive entry 输出一次 warning，并让成功 sibling 继续运行。 +DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全局稳定 entry id list 审计已结算的初始 tree。List 中存在、启用且未 active 的 entry 会使启动 reject，并拆卸应用。List 中缺失或禁用的 id 不产生影响。Bootstrap Include 按 entry 身份被视为 required，因为根配置缺失或无效会阻止应用组装。其他 inactive entry 输出一次 warning，并让成功 sibling 继续运行。 Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行，以及随附 Web、headless、ACP 和 SDK 应用的 endpoint。其 injected provider 不需要单列：provider 缺失会让已列出的 endpoint 保持 pending 或失败。 diff --git a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts index 641e10013b..9b4d3da3d1 100644 --- a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts +++ b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts @@ -175,6 +175,7 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () rmSync(fixture.root, { recursive: true, force: true }) } + expect(result.signal).toBeUndefined() expect({ exitCode: result.exitCode, timedOut: result.timedOut, @@ -229,6 +230,8 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () timeout: 90_000, killSignal: 'SIGKILL', }) + expect(result.timedOut).toBe(false) + expect(result.signal).toBeUndefined() expect(result.exitCode).toBe(1) expect(result.stdout).not.toContain('dsh web: http://') expect(result.stderr).toContain('required startup failure') @@ -240,4 +243,53 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () rmSync(root, { recursive: true, force: true }) } }) + + it('fails and cleans up when detached work rejects after application startup', async () => { + const fixture = createFixture() + const plugin = join(fixture.root, 'detached.mjs') + writeFileSync(plugin, [ + 'export function apply(ctx) {', + ' ctx.effect(() => ctx.get("appReady").onReady(() => {', + ' void Promise.reject(new Error("detached Web failure"))', + ' }))', + '}', + '', + ].join('\n')) + writeFileSync(fixture.patch, readFileSync(fixture.patch, 'utf8') + [ + '- insert:', + ' - id: detached-probe', + ` name: ${pathToFileURL(plugin).href}`, + '', + ].join('\n')) + try { + const result = await execa(process.execPath, [ + dshBin, + '--profile', 'web', + '--patch', fixture.patch, + '--no-open', + '--port', '0', + ], { + cwd: fixture.root, + env: { + ...process.env, + DEEPSEEK_API_KEY: 'keyless-web-detached-no-call', + DSH_AGENTS_HOME: join(fixture.root, '.agents'), + DSH_HOME: fixture.home, + DSH_TELEMETRY_DISABLED: '1', + NODE_NO_WARNINGS: '1', + }, + input: '', + reject: false, + timeout: 90_000, + killSignal: 'SIGKILL', + }) + expect(result.timedOut).toBe(false) + expect(result.signal).toBeUndefined() + expect(result.exitCode).toBe(1) + expect(result.stderr).toContain('fatal load failure: Error: detached Web failure') + expect(readFileSync(fixture.events, 'utf8')).toBe('good apply\ngood dispose\n') + } finally { + rmSync(fixture.root, { recursive: true, force: true }) + } + }) }) diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 73732f183f..5ee3caadec 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: 8b8b141a58ff4facfe4d07002464ef83a990f26f -README.zh.md: 20f0d72f507e8ee5e347287c2d2f09cbf6995b5b +README.md: 28d6cfd622947378367da59b1e6a897c8f9f2664 +README.zh.md: 593e3105bf50a3a04cf70a0df97e8f347081701b diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index 8b8b141a58..28d6cfd622 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -68,14 +68,14 @@ After the Loader settles, app-boot classifies each enabled entry by stable id. O | Failure pattern | Entry result | Startup action | |---|---|---| -| The root YAML cannot be read or parsed, is not an entry list, or repeats an id in one group | No valid candidate tree | Reject and dispose; no partial application is accepted | +| The root YAML cannot be read or parsed, or is not an entry list | Bootstrap Include fails | Reject and dispose; no partial application is accepted | | A plugin module cannot be imported | Entry has no fiber | Warn if optional; reject and dispose if required | | Config expression evaluation or the plugin's config schema fails during activation | Fiber is `FAILED` with the validation error | Warn if optional; reject and dispose if required | | Synchronous `apply()` throws | Fiber is `FAILED` with the thrown error | Warn if optional; reject and dispose if required | -| Asynchronous `apply()` rejects | Fiber is `FAILED` with the rejection | Warn if optional; reject and dispose if required | +| Asynchronous `apply()` throws | Fiber is `FAILED` with the thrown error | Warn if optional; reject and dispose if required | | Required injected services never appear | Fiber remains `PENDING` and names the missing services | Warn if optional; reject and dispose if required | -The Loader consumes activation rejections while reconciling the group, and app-boot awaits a failed fiber only to recover its recorded reason. The process-level fail-loud handler is reserved for detached asynchronous failures that no Loader entry owns. +App-boot reads failed fibers to report their recorded errors and coalesces duplicate Loader rejection notifications through one process checkpoint. Unrelated unhandled rejections remain fatal. Later config HMR reports failures without repeating the required-startup policy or restoring previous plugin config; a valid edit can recover the failed entry. If your app owns the terminal, it can hand the terminal back before the process exits, so your shell is never left in raw mode. The handoff is bounded: a stuck cleanup delays the fatal exit but never cancels it. @@ -99,7 +99,6 @@ This section explains how the outcomes above are realized and points at the code - **Two Loader builtins.** `mountRootInclude` registers `cordis:include` and `cordis:group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, and an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name. Both load through the ambient module pipeline rather than the included tree's own specifier resolution. - **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate generation when they require all-or-nothing setup. - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links. -- **One rejection checkpoint.** `assertEntriesActivated` keeps the exact reasons it folds into the boot diagnostic visible through the next process rejection checkpoint, so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. - **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success. - **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`. Plugin diagnostics include original stacks, nested causes, and aggregate member failures. diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 20f0d72f50..593e3105bf 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -68,14 +68,14 @@ Loader 结算后，app-boot 按稳定 id 对每个已启用 entry 分类。Optio | 失败模式 | Entry 结果 | 启动措施 | |---|---|---| -| 根 YAML 无法读取或解析、不是 entry list，或同一 group 内 id 重复 | 没有有效 candidate tree | 拒绝并拆卸；不接受部分应用 | +| 根 YAML 无法读取或解析，或不是 entry list | Bootstrap Include 失败 | 拒绝并拆卸；不接受部分应用 | | Plugin module 无法 import | Entry 没有 fiber | Optional 时警告；required 时拒绝并拆卸 | | Config expression 求值或 plugin config schema 在 activation 时失败 | Fiber 为 `FAILED`，保留校验错误 | Optional 时警告；required 时拒绝并拆卸 | | 同步 `apply()` throw | Fiber 为 `FAILED`，保留抛出的错误 | Optional 时警告；required 时拒绝并拆卸 | -| 异步 `apply()` reject | Fiber 为 `FAILED`，保留 rejection | Optional 时警告；required 时拒绝并拆卸 | +| 异步 `apply()` throw | Fiber 为 `FAILED`，保留抛出的错误 | Optional 时警告；required 时拒绝并拆卸 | | 必需的 injected service 始终未出现 | Fiber 保持 `PENDING`，并指出缺失 service | Optional 时警告；required 时拒绝并拆卸 | -Loader 在 reconcile group 时消费 activation rejection；app-boot 只为取得已记录的原因而 await failed fiber。进程级 fail-loud handler 只处理不属于任何 Loader entry 的 detached asynchronous failure。 +App-boot 读取 failed fiber 来报告已记录的错误，并在一个进程检查点内合并 Loader 重复的 rejection 通知。无关的未处理 rejection 仍然致命。之后的 config HMR 会报告失败，但不会再次应用 required 启动策略，也不会恢复旧 plugin config；有效修改可以恢复失败的 entry。 如果你的应用持有终端，它可以在进程退出前把终端交还，你的 shell 绝不会残留在 raw 模式。交还过程有界：卡住的清理只会延迟致命退出，而不会取消它。 @@ -99,7 +99,6 @@ Loader 在 reconcile group 时消费 activation rejection；app-boot 只为取 - **两个 Loader builtin。** `mountRootInclude` 把 `cordis:include` 与 `cordis:group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，而位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`。两者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。 - **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 generation。 - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部组合包若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。 -- **单一 rejection 检查点。** `assertEntriesActivated` 把折入启动诊断的确切原因保持到下一个进程级 rejection 检查点可见，使 `installFailLoud` 能合并 Loader 的重复通知，而所有无关的未处理 rejection 仍然致命。 - **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。 - **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`。插件诊断包含原始堆栈、嵌套原因和聚合错误中的各项失败。 diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 019892d6bb..1a961d62f3 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -272,7 +272,7 @@ export async function watchUserPatches( await ctx.loader.await() await Promise.allSettled([...ctx.loader.entries()].map(entry => Promise.resolve(entry.fiber?.await()))) const failures = await inactiveEntries(ctx) - if (failures.length > 0) ctx.logger.warn(activationDiagnostic(binName, 'warning', failures)) + if (failures.length > 0) throw new Error(activationDiagnostic(binName, 'warning', failures).trimEnd()) }) try { return await register @@ -732,8 +732,8 @@ function formatActivationError(error: unknown): string { } interface InactiveEntry { - /** Loader entry id used by the required-startup policy. */ - id: string + /** Loader entry used to identify the bootstrap Include and required ids. */ + entry: Entry /** Complete diagnostic beginning with the entry id and module specifier. */ diagnostic: string } @@ -751,7 +751,7 @@ async function inactiveEntries(ctx: Context): Promise { if (entry.disabled) continue const subject = `${entry.options.id} (${entry.options.name})` if (fiber === undefined) { - failures.push({ id: entry.options.id, diagnostic: `${subject}: failed to import` }) + failures.push({ entry, diagnostic: `${subject}: failed to import` }) continue } const state = fiber.state @@ -761,18 +761,18 @@ async function inactiveEntries(ctx: Context): Promise { await fiber.await() } catch (error) { rejectionReasons.push(error) - failures.push({ id: entry.options.id, diagnostic: `${subject}: ${formatActivationError(error)}` }) + failures.push({ entry, diagnostic: `${subject}: ${formatActivationError(error)}` }) } continue } if (state === FIBER_PENDING) { const missing = Object.keys(fiber.inject).filter(service => fiber.ctx.get(service) === undefined) failures.push({ - id: entry.options.id, + entry, diagnostic: `${subject}: pending (waiting for ${missing.length === 1 ? 'service' : 'services'}: ${missing.join(', ') || 'unknown'})`, }) } else { - failures.push({ id: entry.options.id, diagnostic: `${subject}: fiber state ${String(state)}` }) + failures.push({ entry, diagnostic: `${subject}: fiber state ${String(state)}` }) } } if (rejectionReasons.length > 0) await observeLoaderRejectionCheckpoint(rejectionReasons) @@ -796,11 +796,12 @@ function activationDiagnostic( * Inactive entries from the global required list reject startup. Other * inactive entries produce one warning and leave successful siblings running. * Required ids absent from the tree, and disabled required entries, are ignored. + * The bootstrap Include must activate so unreadable or invalid root config is fatal. * @param ctx - the settled context whose Loader entries to audit. * @param binName - the diagnostic prefix on optional-entry warnings. * @param warn - sink for optional-entry warnings. - * @returns after all optional failures are warned when no required entry failed. - * @throws when an enabled entry in {@link REQUIRED_STARTUP_ENTRY_IDS} is inactive. + * @returns after all optional failures are warned when required startup entries are active. + * @throws when the bootstrap Include or an enabled entry in {@link REQUIRED_STARTUP_ENTRY_IDS} is inactive. */ export async function auditStartupEntries( ctx: Context, @@ -811,7 +812,8 @@ export async function auditStartupEntries( const required: InactiveEntry[] = [] const optional: InactiveEntry[] = [] for (const failure of failures) { - const target = requiredStartupEntryIds.has(failure.id) ? required : optional + const target = failure.entry === bootstrapIncludes.get(ctx) + || requiredStartupEntryIds.has(failure.entry.options.id) ? required : optional target.push(failure) } if (optional.length > 0) warn(activationDiagnostic(binName, 'warning', optional)) @@ -843,7 +845,7 @@ export async function auditStartupEntries( * @param bareModuleBaseUrl - optional installed-host base for bare package * names; use it when the host, rather than the configuration project, owns the * complete plugin set. - * @returns the root context once every entry has started, or as soon as a + * @returns the root context after the initial startup audit, or as soon as a * surface disposed the tree while startup was still in flight. * @throws a labelled error after disposing the partial context — `host * preparation failed` when `prepare` threw before any config-tree entry diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 4bdb4bd285..917fa80b6b 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -916,6 +916,40 @@ describe('boot', () => { } }) + it.each([ + ['missing', undefined, 'config file not found'], + ['malformed', 'invalid: [unclosed\n', 'unexpected end'], + ['non-array', 'entries: []\n', 'top-level array'], + ])('rejects a %s root configuration', async (_kind, content, message) => { + const dir = tmp() + const configPath = join(dir, 'cordis.yml') + if (content !== undefined) writeFileSync(configPath, content) + let ctx: Context | undefined + try { + await expect(boot(NAME, configPath).then((value) => { ctx = value })).rejects.toThrow(message) + } finally { + await ctx?.fiber.dispose() + } + }) + + it.each([ + ['import', undefined, '', 'failed to import'], + ['config schema', 'export const Config = { "~standard": { version: 1, vendor: "app-boot-test", validate() { return { issues: [{ message: "schema failure" }] } } } }\nexport function apply() {}\n', '', 'schema failure'], + ['config expression', 'export function apply() {}\n', ' config: { value: !!js "JSON.parse(\'invalid\')" }\n', 'SyntaxError'], + ['sync apply', 'export function apply() { throw new Error("sync failure") }\n', '', 'sync failure'], + ['async apply', 'export async function apply() { await Promise.resolve(); throw new Error("async failure") }\n', '', 'async failure'], + ['missing dependency', 'export const inject = ["missingRequiredService"]\nexport function apply() {}\n', '', 'missingRequiredService'], + ])('disposes startup after a required %s failure', async (_kind, source, config, message) => { + const dir = tmp() + if (source !== undefined) writeFileSync(join(dir, 'required.mjs'), source) + writeFileSync(join(dir, 'cordis.yml'), `- id: webserver\n name: ./required.mjs\n${config}`) + let disposed = false + await expect(boot(NAME, join(dir, 'cordis.yml'), undefined, (ctx) => { + ctx.effect(() => () => { disposed = true }) + })).rejects.toThrow(message) + expect(disposed).toBe(true) + }) + it('disposes successful entries and rejects when a required entry fails', async () => { const dir = tmp() let disposed = false diff --git a/packages/boot/app-boot/tests/config-reload.spec.ts b/packages/boot/app-boot/tests/config-reload.spec.ts index e53879cf34..4d8dae27e4 100644 --- a/packages/boot/app-boot/tests/config-reload.spec.ts +++ b/packages/boot/app-boot/tests/config-reload.spec.ts @@ -195,6 +195,71 @@ describe('include patches layered over one base', () => { }) }) +describe('best-effort config failure recovery', () => { + it.each([ + ['import', undefined, undefined], + ['sync apply', 'export function apply(_ctx, config) { if (config.fail) throw new Error("reload sync failure") }\n', 3], + ['async apply', 'export async function apply(_ctx, config) { await Promise.resolve(); if (config.fail) throw new Error("reload async failure") }\n', 3], + ['dependency', 'export const inject = ["reloadMissing"]\nexport function apply() {}\n', 0], + ] as const)('keeps siblings after a required-id %s failure during HMR', async (_kind, source, state) => { + const base = '- id: good\n name: ./noop.mjs\n' + const { ctx, dir, include } = await bootTree(base, { + ...source === undefined ? {} : { 'failure.mjs': source }, + 'provider.mjs': 'export function apply(ctx) { ctx.provide("reloadMissing", true) }\n', + }) + try { + const good = [...ctx.loader.entries()].find(entry => entry.options.id === 'good')!.fiber + writeFileSync(join(dir, 'cordis.yml'), base + '- id: webserver\n name: ./failure.mjs\n config: { fail: true }\n') + await include.refresh() + await ctx.loader.await() + const failed = [...ctx.loader.entries()].find(entry => entry.options.id === 'webserver')! + expect(failed.fiber?.state).toBe(state) + expect(good?.state).toBe(2) + expect(ctx.fiber.state).toBe(2) + + const recovery = `- id: webserver\n name: ./${source === undefined ? 'noop' : 'failure'}.mjs\n config: { fail: false }\n` + const provider = state === 0 ? '- id: provider\n name: ./provider.mjs\n' : '' + writeFileSync(join(dir, 'cordis.yml'), base + recovery + provider) + await include.refresh() + await ctx.loader.await() + expect([...ctx.loader.entries()].find(entry => entry.options.id === 'webserver')?.fiber?.state).toBe(2) + expect([...ctx.loader.entries()].find(entry => entry.options.id === 'good')?.fiber).toBe(good) + } finally { + await ctx.fiber.dispose() + } + }) + + it('keeps the previous fiber config after schema rejection and retries a valid edit', async () => { + const config = (value: number | string): string => `- id: webserver\n name: ./schema.mjs\n config: { value: ${JSON.stringify(value)} }\n` + const { ctx, dir, include } = await bootTree(config(1), { + 'schema.mjs': [ + 'export const Config = { "~standard": { version: 1, vendor: "app-boot-test", validate(config) {', + ' return typeof config.value === "number" ? { value: config } : { issues: [{ message: "expected number" }] }', + '} } }', + 'export function apply(ctx, config) { ctx.provide("validatedValue", config.value) }', + '', + ].join('\n'), + }) + try { + writeFileSync(join(dir, 'cordis.yml'), config('invalid')) + await include.refresh() + await ctx.loader.await() + const entry = [...ctx.loader.entries()].find(candidate => candidate.options.id === 'webserver')! + expect(entry.options.config).toEqual({ value: 'invalid' }) + expect(entry.fiber?.config).toEqual({ value: 1 }) + expect(ctx.get('validatedValue')).toBe(1) + + writeFileSync(join(dir, 'cordis.yml'), config(2)) + await include.refresh() + await ctx.loader.await() + expect(entry.fiber?.config).toEqual({ value: 2 }) + expect(ctx.get('validatedValue')).toBe(2) + } finally { + await ctx.fiber.dispose() + } + }) +}) + describe('shipped builtins', () => { it('lets a booted composition share one isolate realm across a group of rows', async () => { // The reason `boot()` registers `cordis:group`: a composition — notably an diff --git a/packages/boot/app-boot/tests/user-patches.spec.ts b/packages/boot/app-boot/tests/user-patches.spec.ts index efb89afb86..22066d2e55 100644 --- a/packages/boot/app-boot/tests/user-patches.spec.ts +++ b/packages/boot/app-boot/tests/user-patches.spec.ts @@ -178,15 +178,15 @@ describe('loadOptionalPatches', () => { }) }) -function writeTree(dir: string): string { +function writeTree(dir: string, id = 'noop', asyncApply = false): string { writeFileSync(join(dir, 'noop.mjs'), [ 'export const name = "noop"', - 'export function apply(_ctx, config = {}) {', + `export ${asyncApply ? 'async ' : ''}function apply(_ctx, config = {}) {`, ' if (config.fail) throw new Error("candidate config failed")', '}', '', ].join('\n')) - writeFileSync(join(dir, 'cordis.yml'), '- id: noop\n name: ./noop.mjs\n config:\n value: base\n') + writeFileSync(join(dir, 'cordis.yml'), `- id: ${id}\n name: ./noop.mjs\n config:\n value: base\n`) return join(dir, 'cordis.yml') } @@ -406,12 +406,16 @@ describe('boot with user patches', () => { } }) - it('applies live patches, reports failures without rollback, and recovers after a later edit', { timeout: 20_000 }, async () => { + it.each([ + { id: 'noop', asyncApply: false }, + { id: 'webserver', asyncApply: false }, + { id: 'webserver', asyncApply: true }, + ])('keeps HMR best effort and recovers ($id, async apply: $asyncApply)', { timeout: 20_000 }, async ({ id, asyncApply }) => { const dir = tmp() const userDir = tmp() const filename = join(userDir, PROFILE_PATCH_FILENAME) - const basePatches = [{ id: 'noop', config: { value: 'generated' } }] - const ctx = await boot(NAME, writeTree(dir), basePatches) + const basePatches = [{ id, config: { value: 'generated' } }] + const ctx = await boot(NAME, writeTree(dir, id, asyncApply), basePatches) onTestFinished(() => ctx.fiber.dispose()) await ctx.plugin(Timer) await ctx.plugin(Hmr, { root: [], ignored: [], debounce: 0 }) @@ -439,29 +443,29 @@ describe('boot with user patches', () => { expect(watchers).toHaveLength(1) const watcher = watchers[0]! try { - writeFileSync(filename, '- id: noop\n config:\n value: live\n') + writeFileSync(filename, `- id: ${id}\n config:\n value: live\n`) watcher.emit('add', filename) - await eventually(() => (entryConfig(ctx, 'noop') as { value?: string }).value === 'live', 'user patch addition was not applied') + await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'live', 'user patch addition was not applied') - writeFileSync(filename, '- id: noop\n config:\n fail: true\n') + writeFileSync(filename, `- id: ${id}\n config:\n fail: true\n`) watcher.emit('change', filename) await eventually(() => failures.length === 1, 'failed candidate was not reported') expect(failures[0]).toBeInstanceOf(Error) - expect(entryConfig(ctx, 'noop')).toMatchObject({ fail: true }) + expect(entryConfig(ctx, id)).toMatchObject({ fail: true }) writeFileSync(filename, 'invalid: [unclosed\n') watcher.emit('change', filename) await eventually(() => failures.length === 2, 'parse failure was not reported') expect(failures[1]).toBeInstanceOf(Error) - expect(entryConfig(ctx, 'noop')).toMatchObject({ fail: true }) + expect(entryConfig(ctx, id)).toMatchObject({ fail: true }) - writeFileSync(filename, '- id: noop\n config:\n value: recovered\n') + writeFileSync(filename, `- id: ${id}\n config:\n value: recovered\n`) watcher.emit('change', filename) - await eventually(() => (entryConfig(ctx, 'noop') as { value?: string }).value === 'recovered', 'valid recovery was not applied') + await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'recovered', 'valid recovery was not applied') unlinkSync(filename) watcher.emit('unlink', filename) - await eventually(() => (entryConfig(ctx, 'noop') as { value?: string }).value === 'generated', 'user patch removal did not restore the app-owned patch') + await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'generated', 'user patch removal did not restore the app-owned patch') expect(failures).toHaveLength(2) // Default compose: the user layer IS the whole patch list, so a @@ -470,9 +474,9 @@ describe('boot with user patches', () => { const disposeDefault = await watchUserPatches(ctx, { binName: NAME, filename }) expect(watchers).toHaveLength(2) try { - writeFileSync(filename, '- id: noop\n config:\n value: identity\n') + writeFileSync(filename, `- id: ${id}\n config:\n value: identity\n`) watchers[1]!.emit('add', filename) - await eventually(() => (entryConfig(ctx, 'noop') as { value?: string }).value === 'identity', 'default-compose user patch was not applied') + await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'identity', 'default-compose user patch was not applied') } finally { await disposeDefault() } From 7fd41b833b7a16bf748d8b22d8cb314960be9b92 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 18:31:07 +0800 Subject: [PATCH 18/26] fix(boot): limit required IDs to application endpoints --- ...2026-09-09-consumer-owned-startup-strictness.i18n.yaml | 4 ++-- .../2026-09-09-consumer-owned-startup-strictness.md | 2 +- .../2026-09-09-consumer-owned-startup-strictness.zh.md | 2 +- packages/boot/app-boot/README.i18n.yaml | 4 ++-- packages/boot/app-boot/README.md | 2 +- packages/boot/app-boot/README.zh.md | 2 +- packages/boot/app-boot/src/index.ts | 2 -- packages/boot/app-boot/tests/app-boot.spec.ts | 8 +++----- 8 files changed, 11 insertions(+), 15 deletions(-) diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml index ef3d69c711..c81bfa90fb 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md -2026-09-09-consumer-owned-startup-strictness.md: eab57329bc33c6a341d1073275deb4fd2355f041 -2026-09-09-consumer-owned-startup-strictness.zh.md: 687017533d114cd1e13205b50373fc415eb99c2a +2026-09-09-consumer-owned-startup-strictness.md: dd93e3867452e4456e2d7e1853e01aff66deb881 +2026-09-09-consumer-owned-startup-strictness.zh.md: dfb84c803ead167807897fe18d39f19d00eecac4 diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md index eab57329bc..dd93e38674 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -12,7 +12,7 @@ Best-effort Loader reconciliation preserves usable plugins, but applications sti DSH owns startup strictness outside vendored Cordis. App-boot audits the settled initial tree against one global list of stable entry ids. A listed entry that is present, enabled, and not active rejects startup and disposes the application. A listed id that is absent or disabled has no effect. The bootstrap Include is required by entry identity because a missing or invalid root configuration prevents application assembly. Other inactive entries produce one warning and leave successful siblings running. -The required ids are `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution and the endpoints of the shipped Web, headless, ACP, and SDK applications. Their injected providers do not need separate list entries: a missing provider leaves the listed endpoint pending or failed. +The required ids are `agent-loop`, `webserver`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution and the endpoints of the shipped Web, headless, ACP, and SDK applications. Their injected providers do not need separate list entries: a missing provider leaves the listed endpoint pending or failed. The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair. diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md index 687017533d..dfb84c803e 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -12,7 +12,7 @@ Best-effort Loader reconcile 会保留可用 plugin，但应用仍需一组最 DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全局稳定 entry id list 审计已结算的初始 tree。List 中存在、启用且未 active 的 entry 会使启动 reject，并拆卸应用。List 中缺失或禁用的 id 不产生影响。Bootstrap Include 按 entry 身份被视为 required，因为根配置缺失或无效会阻止应用组装。其他 inactive entry 输出一次 warning，并让成功 sibling 继续运行。 -Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行，以及随附 Web、headless、ACP 和 SDK 应用的 endpoint。其 injected provider 不需要单列：provider 缺失会让已列出的 endpoint 保持 pending 或失败。 +Required id 为 `agent-loop`、`webserver`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行，以及随附 Web、headless、ACP 和 SDK 应用的 endpoint。其 injected provider 不需要单列：provider 缺失会让已列出的 endpoint 保持 pending 或失败。 该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。 diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 5ee3caadec..87308c0bf7 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: 28d6cfd622947378367da59b1e6a897c8f9f2664 -README.zh.md: 593e3105bf50a3a04cf70a0df97e8f347081701b +README.md: 55689d496dcd1610ba45c0fc6140296968652410 +README.zh.md: 7d320a045d16571576340e5238a1372f4ec6f4ba diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index 28d6cfd622..55689d496d 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -40,7 +40,7 @@ installFailLoud('dsh') const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT)) ``` -With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution and each application's endpoint: `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. +With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution and each application's endpoint: `agent-loop`, `webserver`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. ### Profiles diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 593e3105bf..7d320a045d 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -40,7 +40,7 @@ installFailLoud('dsh') const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT)) ``` -有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行与各应用的 endpoint：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。 +有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行与各应用的 endpoint：`agent-loop`、`webserver`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。 ### Profile diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 1a961d62f3..5b4bba188c 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -703,8 +703,6 @@ const FIBER_FAILED = 3 as FiberState.FAILED export const REQUIRED_STARTUP_ENTRY_IDS: readonly string[] = Object.freeze([ 'agent-loop', 'webserver', - 'modules', - 'connection', 'headless-runner', 'acp', 'sdk-jsonrpc-server', diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 917fa80b6b..b440f73aaa 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -537,8 +537,6 @@ describe('auditStartupEntries', () => { expect(REQUIRED_STARTUP_ENTRY_IDS).toEqual([ 'agent-loop', 'webserver', - 'modules', - 'connection', 'headless-runner', 'acp', 'sdk-jsonrpc-server', @@ -667,10 +665,10 @@ describe('auditStartupEntries', () => { it('rejects a required entry pending on an injected service', async () => { await expect(auditStartupEntries(ctxWith([{ - fiber: fiber(0, undefined, { webRuntime: {} }), - options: { id: 'connection', name: '@deepseek-ai/dsh-client-connection' }, + fiber: fiber(0, undefined, { headlessStartup: {} }), + options: { id: 'headless-runner', name: '@deepseek-ai/dsh-headless' }, }]), NAME, vi.fn())).rejects.toThrow( - 'connection (@deepseek-ai/dsh-client-connection): pending (waiting for service: webRuntime)', + 'headless-runner (@deepseek-ai/dsh-headless): pending (waiting for service: headlessStartup)', ) }) }) From 97d1f7c20397e94881b5bdd6e38f1f3d48538fcb Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Wed, 9 Sep 2026 18:43:53 +0800 Subject: [PATCH 19/26] fix(web-app): gate readiness on required startup entries --- apps/cli/tests/built-bin.e2e.ts | 4 ++-- packages/bundle/web-app/README.i18n.yaml | 4 ++-- packages/bundle/web-app/README.md | 2 +- packages/bundle/web-app/README.zh.md | 2 +- packages/bundle/web-app/src/index.ts | 4 ++-- packages/bundle/web-app/tests/web-app.spec.ts | 21 ++++++++++++++----- 6 files changed, 24 insertions(+), 13 deletions(-) diff --git a/apps/cli/tests/built-bin.e2e.ts b/apps/cli/tests/built-bin.e2e.ts index a4f6e2fe5f..af8be201e1 100644 --- a/apps/cli/tests/built-bin.e2e.ts +++ b/apps/cli/tests/built-bin.e2e.ts @@ -760,14 +760,14 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)', it('keeps serving when an optional patch-overlay plugin fails', async () => { const home = mkdtempSync(join(tmpdir(), 'dsh-invalid-patch-')) try { - const result = await runBuiltBin(['--profile', 'web', '--patch', invalidProvider], { + const result = await runBuiltBin(['--profile', 'web', '--patch', invalidProvider, '--port', '0', '--no-open'], { DSH_HOME: home, DSH_BROWSER_OPEN_TEST_EXIT_ON_READY: '1', DEEPSEEK_API_KEY: 'keyless-invalid-config', DSH_TELEMETRY_DISABLED: '1', NODE_OPTIONS: `--import=${webReadyExitHook}`, }) - expect(result.code).toBe(0) + expect(result.code, result.stderr).toBe(0) expect(result.stdout).toMatch(/^dsh web: http:\/\/127\.0\.0\.1:\d+\/\?token=[A-Za-z0-9_-]+$/u) expect(result.stderr).toContain('llm-pi-ai') } finally { diff --git a/packages/bundle/web-app/README.i18n.yaml b/packages/bundle/web-app/README.i18n.yaml index fa775b7a9a..5c7564c6d3 100644 --- a/packages/bundle/web-app/README.i18n.yaml +++ b/packages/bundle/web-app/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/bundle/web-app/README.md -README.md: 94560cf45affe0ee4c9570054c40c00e9185901b -README.zh.md: c71f56943eaa65363bfa03c94289ec322ed9f448 +README.md: 29f1737a1a3367c5d1f4e9a37e7031fcd6ae9b9f +README.zh.md: 55e3cc26d8f6b70d464280d2acb2ec0cf37bc937 diff --git a/packages/bundle/web-app/README.md b/packages/bundle/web-app/README.md index 94560cf45a..29f1737a1a 100644 --- a/packages/bundle/web-app/README.md +++ b/packages/bundle/web-app/README.md @@ -77,7 +77,7 @@ A patch replaces the targeted row's whole `config`, so each web row restates eve ### Readiness -The URL line and browser handoff are readiness signals: supervisors RPC as soon as they observe the line, and a browser requests the page as soon as it opens, so both run only after the Loader tree settles, every enabled entry passes the activation audit, and Connection authentication is available — or immediately in a hand-built tree without a Loader. A failed tree or a tree disposed mid-boot announces nothing. +The URL line and browser handoff are readiness signals: supervisors RPC as soon as they observe the line, and a browser requests the page as soon as it opens, so both run only after the Loader tree settles, the required-startup audit passes, and Connection authentication is available — or immediately in a hand-built tree without a Loader. Optional plugin failures do not suppress readiness; a required startup failure or a tree disposed mid-boot announces nothing. ### LAN trust sampling diff --git a/packages/bundle/web-app/README.zh.md b/packages/bundle/web-app/README.zh.md index c71f56943e..55e3cc26d8 100644 --- a/packages/bundle/web-app/README.zh.md +++ b/packages/bundle/web-app/README.zh.md @@ -77,7 +77,7 @@ patch 会替换目标行的整个 `config`，因此每个 Web 行都重述自己 ### 就绪宣告 -URL 行与浏览器交接都是就绪信号：监督方一观察到该行就发起 RPC，浏览器一打开就请求页面，因此两者只在 Loader 配置树结算、每个启用的条目通过激活检查且 Connection 认证可用后运行——在没有 Loader 的手工构建树中则立即运行。失败的树或启动中途被释放的树不会宣告任何内容。 +URL 行与浏览器交接都是就绪信号：监督方一观察到该行就发起 RPC，浏览器一打开就请求页面，因此两者只在 Loader 配置树结算、通过 required 启动检查且 Connection 认证可用后运行——在没有 Loader 的手工构建树中则立即运行。可选插件失败不会阻止就绪宣告；required 启动失败或启动中途被释放的树不会宣告任何内容。 ### LAN 信任采样 diff --git a/packages/bundle/web-app/src/index.ts b/packages/bundle/web-app/src/index.ts index b5debdc26f..76c212e4e6 100644 --- a/packages/bundle/web-app/src/index.ts +++ b/packages/bundle/web-app/src/index.ts @@ -18,7 +18,7 @@ import { networkInterfaces } from 'node:os' import { fileURLToPath } from 'node:url' import type { Context } from '@deepseek-ai/cordis' import z from '@deepseek-ai/schemastery' -import { addHarnessSourceSection, assertEntriesActivated } from '@deepseek-ai/dsh-app-boot' +import { addHarnessSourceSection, auditStartupEntries } from '@deepseek-ai/dsh-app-boot' import type {} from '@deepseek-ai/dsh-client-connection' import * as FrontendStatic from '@deepseek-ai/dsh-host-frontend-static' import { launchedThroughSsh, launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment' @@ -285,7 +285,7 @@ export function apply(ctx: Context, config: Config): void { if (settled === undefined) announceReady() else { void settled.then(async () => { - await assertEntriesActivated(connectionCtx, 'dsh web') + await auditStartupEntries(connectionCtx.root, 'dsh web', () => {}) // The tree can be disposed while the boot was in flight (early // SIGTERM); a URL line or browser tab for a dead server would only // mislead, and reading torn-down services would turn a clean shutdown diff --git a/packages/bundle/web-app/tests/web-app.spec.ts b/packages/bundle/web-app/tests/web-app.spec.ts index e963648038..75178e7b80 100644 --- a/packages/bundle/web-app/tests/web-app.spec.ts +++ b/packages/bundle/web-app/tests/web-app.spec.ts @@ -14,6 +14,7 @@ import { PassThrough } from 'node:stream' import { afterEach, beforeEach, describe, expect, it, onTestFinished, vi } from 'vitest' import { Context } from '@deepseek-ai/cordis' import Loader from '@deepseek-ai/cordis-plugin-loader' +import * as AppBoot from '@deepseek-ai/dsh-app-boot' import { createLaunchEnvironmentSnapshot, DSH_LAUNCH_ENVIRONMENT_KEY } from '@deepseek-ai/dsh-launch-environment' import SystemPrompt from '@deepseek-ai/dsh-system-prompt' import type { WebServer } from '@deepseek-ai/dsh-host-webserver' @@ -314,7 +315,10 @@ describe('web-app runtime glue', () => { await torn.fiber.dispose() }) - it('keeps readiness private when Loader settles with a failed sibling', async () => { + it.each([ + { id: 'webserver', announces: false }, + { id: 'optional-tool', announces: true }, + ])('announces readiness=$announces after the $id sibling fails', async ({ id, announces }) => { stageDist() const ctx = new Context() onTestFinished(() => ctx.fiber.dispose()) @@ -323,16 +327,23 @@ describe('web-app runtime glue', () => { provideConnection(ctx) await ctx.plugin(Loader) ctx.loader.builtins.failure = () => { throw new Error('sibling rejected') } - const id = await ctx.loader.create({ name: 'cordis:failure' }) + await ctx.loader.root.update([{ id, name: 'cordis:failure' }]) await ctx.loader.await() await expect(ctx.loader.resolve(id).fiber?.await()).rejects.toThrow('sibling rejected') const log = vi.spyOn(console, 'log').mockImplementation(() => {}) const openBrowser = vi.fn(async () => {}) internals.openBrowser = openBrowser + const audit = vi.spyOn(AppBoot, 'auditStartupEntries') apply(ctx, new Config({ openBrowser: true, printUrl: true, surfaceContext: false, trustedHosts: [] })) - await new Promise(resolve => setImmediate(resolve)) - expect(log).not.toHaveBeenCalled() - expect(openBrowser).not.toHaveBeenCalled() + await vi.waitFor(() => { expect(audit).toHaveBeenCalledOnce() }) + await Promise.allSettled(audit.mock.results.map(result => result.value as Promise)) + if (announces) { + expect(log).toHaveBeenCalledWith('dsh web: http://127.0.0.1:4567/?token=test-token') + expect(openBrowser).toHaveBeenCalledWith('http://127.0.0.1:4567/?token=test-token') + } else { + expect(log).not.toHaveBeenCalled() + expect(openBrowser).not.toHaveBeenCalled() + } }) it('fails loud when the prompt section resolves against a portless webserver', async () => { From f5b5a9da5108d4f17906bbc7015609cb6a5d734c Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 14:26:59 +0800 Subject: [PATCH 20/26] Require Web modules and connection during startup --- ...onsumer-owned-startup-strictness.i18n.yaml | 4 +- ...09-09-consumer-owned-startup-strictness.md | 4 +- ...09-consumer-owned-startup-strictness.zh.md | 4 +- .../web-best-effort-startup.expected.e2e.ts | 41 ++++++++++++++++++- packages/boot/app-boot/README.i18n.yaml | 4 +- packages/boot/app-boot/README.md | 2 +- packages/boot/app-boot/README.zh.md | 2 +- packages/boot/app-boot/src/index.ts | 7 ++-- packages/boot/app-boot/tests/app-boot.spec.ts | 22 ++++++---- packages/bundle/web-app/tests/web-app.spec.ts | 2 + 10 files changed, 70 insertions(+), 22 deletions(-) diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml index c81bfa90fb..2276d49020 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md -2026-09-09-consumer-owned-startup-strictness.md: dd93e3867452e4456e2d7e1853e01aff66deb881 -2026-09-09-consumer-owned-startup-strictness.zh.md: dfb84c803ead167807897fe18d39f19d00eecac4 +2026-09-09-consumer-owned-startup-strictness.md: 1f3007d6bfc134c8fc741b87f001261f3f0ab468 +2026-09-09-consumer-owned-startup-strictness.zh.md: c1b52dc6e3fd9688878eb57c4815f983ed4b11b1 diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md index dd93e38674..1f3007d6bf 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -12,7 +12,7 @@ Best-effort Loader reconciliation preserves usable plugins, but applications sti DSH owns startup strictness outside vendored Cordis. App-boot audits the settled initial tree against one global list of stable entry ids. A listed entry that is present, enabled, and not active rejects startup and disposes the application. A listed id that is absent or disabled has no effect. The bootstrap Include is required by entry identity because a missing or invalid root configuration prevents application assembly. Other inactive entries produce one warning and leave successful siblings running. -The required ids are `agent-loop`, `webserver`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution and the endpoints of the shipped Web, headless, ACP, and SDK applications. Their injected providers do not need separate list entries: a missing provider leaves the listed endpoint pending or failed. +The required ids are `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution, application endpoints, and Web bootstrap/transport. Web needs its client module registry and authenticated connection even when the HTTP server can listen without them. Providers already required through injection need no separate entry: their absence leaves a listed consumer pending or failed. The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair. @@ -28,4 +28,4 @@ Stable required entry ids are part of application assembly. Renaming one require ## Testing -App-boot unit tests cover absent and disabled required ids, optional import failure, config evaluation failure, synchronous and asynchronous `apply()` failure, pending dependencies, and required failure teardown. The built Web-profile acceptance serves the full UI with optional failures and exits nonzero when the required HTTP port is occupied. +App-boot unit tests cover absent and disabled required ids, optional import failure, config evaluation failure, synchronous and asynchronous `apply()` failure, pending dependencies, and required failure teardown. The built Web-profile acceptance serves the full UI with optional failures and exits nonzero without readiness when the required HTTP port is occupied or `modules` or `connection` cannot activate. diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md index dfb84c803e..c1b52dc6e3 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -12,7 +12,7 @@ Best-effort Loader reconcile 会保留可用 plugin，但应用仍需一组最 DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全局稳定 entry id list 审计已结算的初始 tree。List 中存在、启用且未 active 的 entry 会使启动 reject，并拆卸应用。List 中缺失或禁用的 id 不产生影响。Bootstrap Include 按 entry 身份被视为 required，因为根配置缺失或无效会阻止应用组装。其他 inactive entry 输出一次 warning，并让成功 sibling 继续运行。 -Required id 为 `agent-loop`、`webserver`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行，以及随附 Web、headless、ACP 和 SDK 应用的 endpoint。其 injected provider 不需要单列：provider 缺失会让已列出的 endpoint 保持 pending 或失败。 +Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行、应用 endpoint，以及 Web 启动与传输。即使 HTTP server 不依赖它们也能监听，Web 仍需要客户端模块注册表和经过认证的连接。通过注入已成为必需项的 provider 不需要单列：它们缺失时，已列出的消费方会保持 pending 或失败。 该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。 @@ -28,4 +28,4 @@ Required id 为 `agent-loop`、`webserver`、`headless-runner`、`acp` 和 `sdk- ## 测试 -App-boot 单元测试覆盖缺失和禁用的 required id、optional import failure、config evaluation failure、同步和异步 `apply()` failure、pending dependency，以及 required failure teardown。构建后的 Web-profile acceptance 会在 optional failure 存在时继续提供完整 UI，并在 required HTTP port 被占用时以非零码退出。 +App-boot 单元测试覆盖缺失和禁用的 required id、optional import failure、config evaluation failure、同步和异步 `apply()` failure、pending dependency，以及 required failure teardown。构建后的 Web-profile acceptance 会在 optional failure 存在时继续提供完整 UI，并在 required HTTP port 被占用或 `modules`、`connection` 无法激活时以非零码退出，且不报告就绪。 diff --git a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts index 9b4d3da3d1..58c8b23f83 100644 --- a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts +++ b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts @@ -161,7 +161,9 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () const cookie = auth.headers.get('set-cookie')?.split(';', 1)[0] if (cookie === undefined) throw new Error('Web authentication response did not set a cookie') const page = await fetch(new URL('/', startup.url), { headers: { cookie } }) - expect(await page.text()).toContain('
') + const html = await page.text() + expect(html).toContain('
') + expect(html).toContain('__DSH_BOOT__') expect(readFileSync(fixture.events, 'utf8')).toBe('good apply\n') expect(startup.stderr).toContain('web-probe-import-failure') expect(startup.stderr).toContain('@deepseek-ai/dsh-tool-todo') @@ -191,6 +193,43 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () `) }) + it.each(['modules', 'connection'])('fails the full Web profile when required %s cannot activate', async (id) => { + const fixture = createFixture() + writeFileSync(fixture.patch, `${readFileSync(fixture.patch, 'utf8')}- id: ${id}\n inject: [webProbeMissingRequiredService]\n`) + try { + const result = await execa(process.execPath, [ + dshBin, + '--profile', 'web', + '--patch', fixture.patch, + '--no-open', + '--port', '0', + ], { + cwd: fixture.root, + env: { + ...process.env, + DEEPSEEK_API_KEY: 'keyless-web-required-no-call', + DSH_AGENTS_HOME: join(fixture.root, '.agents'), + DSH_HOME: fixture.home, + DSH_TELEMETRY_DISABLED: '1', + NODE_NO_WARNINGS: '1', + }, + input: '', + reject: false, + timeout: 90_000, + killSignal: 'SIGKILL', + }) + expect(result.timedOut).toBe(false) + expect(result.signal).toBeUndefined() + expect(result.exitCode).toBe(1) + expect(result.stdout).not.toContain('dsh web: http://') + expect(result.stderr).toContain('required startup failure') + expect(result.stderr).toContain(`${id} (@deepseek-ai/dsh-client-${id}): pending (waiting for service: webProbeMissingRequiredService)`) + expect(readFileSync(fixture.events, 'utf8')).toBe('good apply\ngood dispose\n') + } finally { + rmSync(fixture.root, { recursive: true, force: true }) + } + }) + it('fails the full Web profile when its required HTTP server cannot bind', async () => { const root = mkdtempSync(join(tmpdir(), 'dsh-web-required-bind-')) const home = join(root, 'home') diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 87308c0bf7..e9ac666b38 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: 55689d496dcd1610ba45c0fc6140296968652410 -README.zh.md: 7d320a045d16571576340e5238a1372f4ec6f4ba +README.md: ee97801e8ca3eedb4cd1fac85d0ed4d669ed8783 +README.zh.md: 2bf1b8e691d1ace0d5bb97fd55641abf727dc589 diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index 55689d496d..ee97801e8c 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -40,7 +40,7 @@ installFailLoud('dsh') const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT)) ``` -With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution and each application's endpoint: `agent-loop`, `webserver`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. +With that entry point, startup keeps every plugin that can activate. An enabled failed plugin produces a labelled warning. A failed required entry makes startup dispose the whole app and exit nonzero; required ids absent from a profile and disabled required entries do not affect startup. The global required list covers shared Agent execution, application endpoints, and Web bootstrap/transport: `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. ### Profiles diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 7d320a045d..2bf1b8e691 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -40,7 +40,7 @@ installFailLoud('dsh') const ctx = await boot('dsh', resolveConfigPath(argv[2], process.env.DSH_SNAPSHOT)) ``` -有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行与各应用的 endpoint：`agent-loop`、`webserver`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。 +有了这个入口，启动会保留所有能够激活的插件。启用但失败的插件会产生带标签的警告。required entry 失败时，启动会拆卸整个应用并以非零码退出；profile 中不存在的 required id 和已禁用的 required entry 不影响启动。全局 required list 覆盖共享 Agent 执行、应用 endpoint，以及 Web 启动与传输：`agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。 ### Profile diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 5b4bba188c..28e11538d5 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -696,13 +696,14 @@ const FIBER_FAILED = 3 as FiberState.FAILED * Entry ids whose presence defines a usable DSH application. * * The list is global rather than profile metadata. Missing or disabled ids do - * not affect startup; an enabled listed entry must activate. Surface endpoints - * cover their injected providers, while `agent-loop` covers shared Agent - * execution. + * not affect startup; an enabled listed entry must activate. The list covers + * shared Agent execution, application endpoints, and Web bootstrap/transport. */ export const REQUIRED_STARTUP_ENTRY_IDS: readonly string[] = Object.freeze([ 'agent-loop', 'webserver', + 'modules', + 'connection', 'headless-runner', 'acp', 'sdk-jsonrpc-server', diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index b440f73aaa..c1b9cbbd14 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -532,11 +532,13 @@ describe('auditStartupEntries', () => { await: error === undefined ? async () => undefined : async () => { throw error }, }) - it('pins the global list to shared execution and application endpoints', () => { + it('pins the global list to shared execution, application endpoints, and Web startup', () => { expect(Object.isFrozen(REQUIRED_STARTUP_ENTRY_IDS)).toBe(true) expect(REQUIRED_STARTUP_ENTRY_IDS).toEqual([ 'agent-loop', 'webserver', + 'modules', + 'connection', 'headless-runner', 'acp', 'sdk-jsonrpc-server', @@ -546,10 +548,14 @@ describe('auditStartupEntries', () => { it('ignores active, disabled, and absent required entries', async () => { const warn = vi.fn() - await expect(auditStartupEntries(ctxWith([ - { fiber: fiber(2), options: { id: 'active', name: 'active' } }, - { fiber: fiber(3, new Error('disabled failure')), disabled: true, options: { id: 'webserver', name: 'disabled' } }, - ]), NAME, warn)).resolves.toBeUndefined() + await expect(auditStartupEntries(ctxWith([]), NAME, warn)).resolves.toBeUndefined() + for (const disabled of [false, true]) { + await expect(auditStartupEntries(ctxWith(REQUIRED_STARTUP_ENTRY_IDS.map(id => ({ + fiber: disabled ? fiber(3, new Error('disabled failure')) : fiber(2), + disabled, + options: { id, name: './required.mjs' }, + }))), NAME, warn)).resolves.toBeUndefined() + } expect(warn).not.toHaveBeenCalled() }) @@ -649,16 +655,16 @@ describe('auditStartupEntries', () => { expect(diagnostic).toContain('unexpected-state (./unexpected-state.mjs): fiber state 1') }) - it('rejects required failures after warning about optional failures', async () => { + it.each(['webserver', 'modules', 'connection'])('rejects required %s failures after warning about optional failures', async (id) => { const warn = vi.fn() const requiredError = new Error('address already in use') const optionalError = new Error('todo unavailable') await expect(auditStartupEntries(ctxWith([ - { fiber: fiber(3, requiredError), options: { id: 'webserver', name: '@deepseek-ai/dsh-host-webserver' } }, + { fiber: fiber(3, requiredError), options: { id, name: './required.mjs' } }, { fiber: fiber(3, optionalError), options: { id: 'tool-todo', name: '@deepseek-ai/dsh-tool-todo' } }, ]), NAME, warn)).rejects.toThrow([ 'required startup failure: 1 entry did not activate', - `webserver (@deepseek-ai/dsh-host-webserver): ${requiredError.stack!}`, + `${id} (./required.mjs): ${requiredError.stack!}`, ].join('\n')) expect(warn).toHaveBeenCalledWith(`${NAME}: warning: 1 entry did not activate\ntool-todo (@deepseek-ai/dsh-tool-todo): ${optionalError.stack!}\n`) }) diff --git a/packages/bundle/web-app/tests/web-app.spec.ts b/packages/bundle/web-app/tests/web-app.spec.ts index 75178e7b80..d1fef51de2 100644 --- a/packages/bundle/web-app/tests/web-app.spec.ts +++ b/packages/bundle/web-app/tests/web-app.spec.ts @@ -317,6 +317,8 @@ describe('web-app runtime glue', () => { it.each([ { id: 'webserver', announces: false }, + { id: 'modules', announces: false }, + { id: 'connection', announces: false }, { id: 'optional-tool', announces: true }, ])('announces readiness=$announces after the $id sibling fails', async ({ id, announces }) => { stageDist() From 25d5efcd86f8b7ede90dfc47e67d3bb1684cbb3d Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 14:33:33 +0800 Subject: [PATCH 21/26] Classify disabled expression errors in startup audits --- ...onsumer-owned-startup-strictness.i18n.yaml | 4 +-- ...09-09-consumer-owned-startup-strictness.md | 2 ++ ...09-consumer-owned-startup-strictness.zh.md | 2 ++ .../web-best-effort-startup.expected.e2e.ts | 24 ++++++++++++--- packages/boot/app-boot/README.i18n.yaml | 4 +-- packages/boot/app-boot/README.md | 1 + packages/boot/app-boot/README.zh.md | 1 + packages/boot/app-boot/src/index.ts | 20 ++++++++----- packages/boot/app-boot/tests/app-boot.spec.ts | 30 +++++++++++++++++-- .../boot/app-boot/tests/user-patches.spec.ts | 18 ++++++++--- 10 files changed, 85 insertions(+), 21 deletions(-) diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml index 2276d49020..a4801495ac 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md -2026-09-09-consumer-owned-startup-strictness.md: 1f3007d6bfc134c8fc741b87f001261f3f0ab468 -2026-09-09-consumer-owned-startup-strictness.zh.md: c1b52dc6e3fd9688878eb57c4815f983ed4b11b1 +2026-09-09-consumer-owned-startup-strictness.md: b9742b91cb66be8f3aa7d052caf16a12c5c35072 +2026-09-09-consumer-owned-startup-strictness.zh.md: dc9d58e8322e47d6f0559e7a5240b46584f0ad14 diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md index 1f3007d6bf..b9742b91cb 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -14,6 +14,8 @@ DSH owns startup strictness outside vendored Cordis. App-boot audits the settled The required ids are `agent-loop`, `webserver`, `modules`, `connection`, `headless-runner`, `acp`, and `sdk-jsonrpc-server`. They represent shared Agent execution, application endpoints, and Web bootstrap/transport. Web needs its client module registry and authenticated connection even when the HTTP server can listen without them. Providers already required through injection need no separate entry: their absence leaves a listed consumer pending or failed. +The audit treats a throwing `disabled` expression as an entry failure, not a disabled entry, because evaluation never established whether to skip it. The same optional/required policy applies to that failure. + The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair. ## Alternatives considered diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md index c1b52dc6e3..dc9d58e832 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -14,6 +14,8 @@ DSH 在 vendored Cordis 之外持有启动严格语义。App-boot 用一份全 Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headless-runner`、`acp` 和 `sdk-jsonrpc-server`。它们分别代表共享 Agent 执行、应用 endpoint，以及 Web 启动与传输。即使 HTTP server 不依赖它们也能监听，Web 仍需要客户端模块注册表和经过认证的连接。通过注入已成为必需项的 provider 不需要单列：它们缺失时，已列出的消费方会保持 pending 或失败。 +审计将 `disabled` 表达式抛出的异常视为 entry 失败，而不是 entry 已禁用，因为求值未能确定是否跳过它。该失败遵循相同的 optional/required 策略。 + 该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。 ## 考虑过的替代方案 diff --git a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts index 58c8b23f83..f8485a7de7 100644 --- a/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts +++ b/apps/cli/tests/profiles/web/tests/web-best-effort-startup.expected.e2e.ts @@ -78,6 +78,9 @@ function createFixture(): Fixture { ` name: ${pathToFileURL(join(root, 'async-failure.mjs')).href}`, ' - id: web-probe-pending', ` name: ${pathToFileURL(join(root, 'pending.mjs')).href}`, + ' - id: web-probe-disabled-failure', + ` name: ${pathToFileURL(join(root, 'good.mjs')).href}`, + ' disabled: !!js "JSON.parse(\'invalid\')"', '', ].join('\n')) return { root, home, patch, events, stop } @@ -98,7 +101,7 @@ async function waitForStartup( let settled = false const finish = (): void => { if (settled || url === undefined) return - if (!stderrText.includes('dsh: warning: 5 entries did not activate')) return + if (!stderrText.includes('dsh: warning: 6 entries did not activate')) return if (!stderrText.includes('web async apply failure')) return if (!stderrText.includes('webProbeMissingService')) return settled = true @@ -170,6 +173,8 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () expect(startup.stderr).toContain('web sync apply failure') expect(startup.stderr).toContain('web async apply failure') expect(startup.stderr).toContain('pending (waiting for service: webProbeMissingService)') + expect(startup.stderr).toContain('web-probe-disabled-failure') + expect(startup.stderr).toContain('disabled expression failed: SyntaxError') } finally { writeFileSync(fixture.stop, 'stop') result = await child @@ -193,9 +198,20 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () `) }) - it.each(['modules', 'connection'])('fails the full Web profile when required %s cannot activate', async (id) => { + it.each([ + ['modules', 'missing dependency'], + ['connection', 'missing dependency'], + ['modules', 'disabled expression'], + ['connection', 'disabled expression'], + ])('fails the full Web profile on required %s %s failure', async (id, failure) => { const fixture = createFixture() - writeFileSync(fixture.patch, `${readFileSync(fixture.patch, 'utf8')}- id: ${id}\n inject: [webProbeMissingRequiredService]\n`) + const patch = failure === 'disabled expression' + ? 'disabled: !!js "JSON.parse(\'invalid\')"' + : 'inject: [webProbeMissingRequiredService]' + const diagnostic = failure === 'disabled expression' + ? 'disabled expression failed: SyntaxError' + : 'pending (waiting for service: webProbeMissingRequiredService)' + writeFileSync(fixture.patch, `${readFileSync(fixture.patch, 'utf8')}- id: ${id}\n ${patch}\n`) try { const result = await execa(process.execPath, [ dshBin, @@ -223,7 +239,7 @@ describe.skipIf(!builtArtifactsExist)('dsh Web profile best-effort startup', () expect(result.exitCode).toBe(1) expect(result.stdout).not.toContain('dsh web: http://') expect(result.stderr).toContain('required startup failure') - expect(result.stderr).toContain(`${id} (@deepseek-ai/dsh-client-${id}): pending (waiting for service: webProbeMissingRequiredService)`) + expect(result.stderr).toContain(`${id} (@deepseek-ai/dsh-client-${id}): ${diagnostic}`) expect(readFileSync(fixture.events, 'utf8')).toBe('good apply\ngood dispose\n') } finally { rmSync(fixture.root, { recursive: true, force: true }) diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index e9ac666b38..1d459ae307 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: ee97801e8ca3eedb4cd1fac85d0ed4d669ed8783 -README.zh.md: 2bf1b8e691d1ace0d5bb97fd55641abf727dc589 +README.md: 90998cedf68be91e9cb033c4dc8e54615c49a4b9 +README.zh.md: 74472de6d91fa5bb365044a928205f137fffd87b diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index ee97801e8c..90998cedf6 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -70,6 +70,7 @@ After the Loader settles, app-boot classifies each enabled entry by stable id. O |---|---|---| | The root YAML cannot be read or parsed, or is not an entry list | Bootstrap Include fails | Reject and dispose; no partial application is accepted | | A plugin module cannot be imported | Entry has no fiber | Warn if optional; reject and dispose if required | +| An entry's `disabled: !!js` expression throws | Entry cannot determine its disabled state; report the evaluation error | Warn if optional; reject and dispose if required | | Config expression evaluation or the plugin's config schema fails during activation | Fiber is `FAILED` with the validation error | Warn if optional; reject and dispose if required | | Synchronous `apply()` throws | Fiber is `FAILED` with the thrown error | Warn if optional; reject and dispose if required | | Asynchronous `apply()` throws | Fiber is `FAILED` with the thrown error | Warn if optional; reject and dispose if required | diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 2bf1b8e691..74472de6d9 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -70,6 +70,7 @@ Loader 结算后，app-boot 按稳定 id 对每个已启用 entry 分类。Optio |---|---|---| | 根 YAML 无法读取或解析，或不是 entry list | Bootstrap Include 失败 | 拒绝并拆卸；不接受部分应用 | | Plugin module 无法 import | Entry 没有 fiber | Optional 时警告；required 时拒绝并拆卸 | +| Entry 的 `disabled: !!js` 表达式抛出异常 | Entry 无法确定禁用状态；报告求值错误 | Optional 时警告；required 时拒绝并拆卸 | | Config expression 求值或 plugin config schema 在 activation 时失败 | Fiber 为 `FAILED`，保留校验错误 | Optional 时警告；required 时拒绝并拆卸 | | 同步 `apply()` throw | Fiber 为 `FAILED`，保留抛出的错误 | Optional 时警告；required 时拒绝并拆卸 | | 异步 `apply()` throw | Fiber 为 `FAILED`，保留抛出的错误 | Optional 时警告；required 时拒绝并拆卸 | diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 28e11538d5..8bf6686e53 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -738,17 +738,22 @@ interface InactiveEntry { } /** - * Collect enabled Loader entries that did not become active. Failed fibers are - * awaited to recover their recorded rejection reason and coalesce duplicate - * Loader notifications through the next process rejection checkpoint. + * Collect Loader activation failures and disabled-expression errors. Failed + * fibers are awaited to recover their recorded rejection reason and coalesce + * duplicate Loader notifications through the next process rejection checkpoint. */ async function inactiveEntries(ctx: Context): Promise { const failures: InactiveEntry[] = [] const rejectionReasons: unknown[] = [] for (const entry of ctx.loader.entries()) { - const fiber = entry.fiber - if (entry.disabled) continue const subject = `${entry.options.id} (${entry.options.name})` + try { + if (entry.disabled) continue + } catch (error) { + failures.push({ entry, diagnostic: `${subject}: disabled expression failed: ${formatActivationError(error)}` }) + continue + } + const fiber = entry.fiber if (fiber === undefined) { failures.push({ entry, diagnostic: `${subject}: failed to import` }) continue @@ -795,12 +800,13 @@ function activationDiagnostic( * Inactive entries from the global required list reject startup. Other * inactive entries produce one warning and leave successful siblings running. * Required ids absent from the tree, and disabled required entries, are ignored. + * A throwing disabled expression is an entry failure, not a disabled entry. * The bootstrap Include must activate so unreadable or invalid root config is fatal. * @param ctx - the settled context whose Loader entries to audit. * @param binName - the diagnostic prefix on optional-entry warnings. * @param warn - sink for optional-entry warnings. - * @returns after all optional failures are warned when required startup entries are active. - * @throws when the bootstrap Include or an enabled entry in {@link REQUIRED_STARTUP_ENTRY_IDS} is inactive. + * @returns after optional warnings if required startup checks pass. + * @throws when the bootstrap Include or a required entry is inactive or its disabled expression throws. */ export async function auditStartupEntries( ctx: Context, diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index c1b9cbbd14..639d475fbd 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -580,6 +580,26 @@ describe('auditStartupEntries', () => { ].join('\n')) }) + it.each([ + { id: 'tool-todo', required: false }, + { id: 'webserver', required: true }, + ])('reports a throwing disabled expression on $id (required: $required)', async ({ id, required }) => { + const error = new Error('disabled evaluation failed') + const warn = vi.fn() + const result = auditStartupEntries(ctxWith([{ + options: { id, name: './plugin.mjs' }, + get disabled(): boolean { throw error }, + }]), NAME, warn) + const detail = `${id} (./plugin.mjs): disabled expression failed: ${error.stack!}` + if (required) { + await expect(result).rejects.toThrow(`required startup failure: 1 entry did not activate\n${detail}`) + expect(warn).not.toHaveBeenCalled() + } else { + await expect(result).resolves.toBeUndefined() + expect(warn).toHaveBeenCalledExactlyOnceWith(`${NAME}: warning: 1 entry did not activate\n${detail}\n`) + } + }) + it('preserves nested activation causes and aggregate member failures', async () => { const warn = vi.fn() const original = new Error('tool discovery failed') @@ -867,7 +887,7 @@ describe('boot', () => { expect(ctx.get('loader')).toBeUndefined() }) - it('keeps successful entries and warns about optional import, config, sync apply, async apply, and dependency failures', async () => { + it('keeps successful entries and warns about optional import, config, disabled, sync apply, async apply, and dependency failures', async () => { const dir = tmp() const configPath = join(dir, 'cordis.yml') const config = [ @@ -879,6 +899,9 @@ describe('boot', () => { ' name: ./noop.mjs', ' config:', ' value: !!js "JSON.parse(\'invalid\')"', + '- id: disabled-failure', + ' name: ./noop.mjs', + ' disabled: !!js "JSON.parse(\'invalid\')"', '- id: sync-failure', ' name: ./sync-failure.mjs', '- id: async-failure', @@ -902,13 +925,15 @@ describe('boot', () => { const entries = [...ctx.loader.entries()] expect(entries.find(entry => entry.options.id === 'good')?.fiber?.state).toBe(2) expect(entries.find(entry => entry.options.id === 'import-failure')?.fiber).toBeUndefined() + expect(entries.find(entry => entry.options.id === 'disabled-failure')?.fiber).toBeUndefined() for (const id of ['invalid-config', 'sync-failure', 'async-failure']) { expect(entries.find(entry => entry.options.id === id)?.fiber?.state).toBe(3) } expect(entries.find(entry => entry.options.id === 'waiting')?.fiber?.state).toBe(0) const warning = write.mock.calls.map(call => String(call[0])).join('') - expect(warning).toContain(`${NAME}: warning: 5 entries did not activate`) + expect(warning).toContain(`${NAME}: warning: 6 entries did not activate`) expect(warning).toContain('import-failure (./missing.mjs): failed to import') + expect(warning).toContain('disabled-failure (./noop.mjs): disabled expression failed: SyntaxError') expect(warning).toContain('SyntaxError: Unexpected token') expect(warning).toContain('sync apply failure') expect(warning).toContain('async apply failure') @@ -940,6 +965,7 @@ describe('boot', () => { ['import', undefined, '', 'failed to import'], ['config schema', 'export const Config = { "~standard": { version: 1, vendor: "app-boot-test", validate() { return { issues: [{ message: "schema failure" }] } } } }\nexport function apply() {}\n', '', 'schema failure'], ['config expression', 'export function apply() {}\n', ' config: { value: !!js "JSON.parse(\'invalid\')" }\n', 'SyntaxError'], + ['disabled expression', 'export function apply() {}\n', ' disabled: !!js "JSON.parse(\'invalid\')"\n', 'required startup failure: 1 entry did not activate\nwebserver (./required.mjs): disabled expression failed: SyntaxError'], ['sync apply', 'export function apply() { throw new Error("sync failure") }\n', '', 'sync failure'], ['async apply', 'export async function apply() { await Promise.resolve(); throw new Error("async failure") }\n', '', 'async failure'], ['missing dependency', 'export const inject = ["missingRequiredService"]\nexport function apply() {}\n', '', 'missingRequiredService'], diff --git a/packages/boot/app-boot/tests/user-patches.spec.ts b/packages/boot/app-boot/tests/user-patches.spec.ts index 22066d2e55..9fac324812 100644 --- a/packages/boot/app-boot/tests/user-patches.spec.ts +++ b/packages/boot/app-boot/tests/user-patches.spec.ts @@ -453,20 +453,30 @@ describe('boot with user patches', () => { expect(failures[0]).toBeInstanceOf(Error) expect(entryConfig(ctx, id)).toMatchObject({ fail: true }) + writeFileSync(filename, `- id: ${id}\n disabled: !!js "JSON.parse('invalid')"\n`) + watcher.emit('change', filename) + await eventually(() => failures.length === 2, 'disabled expression failure was not reported') + expect(failures[1]?.message).toContain(`${id} (./noop.mjs): disabled expression failed: SyntaxError`) + expect([...ctx.loader.entries()].find(entry => entry.options.id === id)?.options.disabled) + .toEqual({ __jsExpr: "JSON.parse('invalid')" }) + writeFileSync(filename, 'invalid: [unclosed\n') watcher.emit('change', filename) - await eventually(() => failures.length === 2, 'parse failure was not reported') - expect(failures[1]).toBeInstanceOf(Error) - expect(entryConfig(ctx, id)).toMatchObject({ fail: true }) + await eventually(() => failures.length === 3, 'parse failure was not reported') + expect(failures[2]).toBeInstanceOf(Error) + expect([...ctx.loader.entries()].find(entry => entry.options.id === id)?.options.disabled) + .toEqual({ __jsExpr: "JSON.parse('invalid')" }) writeFileSync(filename, `- id: ${id}\n config:\n value: recovered\n`) watcher.emit('change', filename) await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'recovered', 'valid recovery was not applied') + await ctx.loader.await() + expect([...ctx.loader.entries()].find(entry => entry.options.id === id)?.fiber?.state).toBe(2) unlinkSync(filename) watcher.emit('unlink', filename) await eventually(() => (entryConfig(ctx, id) as { value?: string }).value === 'generated', 'user patch removal did not restore the app-owned patch') - expect(failures).toHaveLength(2) + expect(failures).toHaveLength(3) // Default compose: the user layer IS the whole patch list, so a // fresh generation replaces the app-owned layer instead of stacking on it. From 4cd20c1a1eb11b0b1e2e84466a34896f2de5e944 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Thu, 10 Sep 2026 22:10:30 +0800 Subject: [PATCH 22/26] fix(app-boot): bound cyclic startup error diagnostics --- ...7-23-client-plugin-loading-model.i18n.yaml | 4 ++-- .../2026-07-23-client-plugin-loading-model.md | 2 +- ...26-07-23-client-plugin-loading-model.zh.md | 2 +- ...tree-boot-and-transport-layering.i18n.yaml | 4 ++-- ...config-tree-boot-and-transport-layering.md | 2 +- ...fig-tree-boot-and-transport-layering.zh.md | 2 +- ...-08-03-per-session-agent-presets.i18n.yaml | 4 ++-- .../2026-08-03-per-session-agent-presets.md | 2 +- ...2026-08-03-per-session-agent-presets.zh.md | 2 +- ...onsumer-owned-startup-strictness.i18n.yaml | 4 ++-- ...09-09-consumer-owned-startup-strictness.md | 2 ++ ...09-consumer-owned-startup-strictness.zh.md | 2 ++ packages/boot/app-boot/README.i18n.yaml | 4 ++-- packages/boot/app-boot/README.md | 2 +- packages/boot/app-boot/README.zh.md | 2 +- packages/boot/app-boot/src/index.ts | 9 +++++++-- packages/boot/app-boot/tests/app-boot.spec.ts | 19 +++++++++++++++++++ 17 files changed, 48 insertions(+), 20 deletions(-) diff --git a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.i18n.yaml index 82efeeb49e..f0da51ef73 100644 --- a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md -2026-07-23-client-plugin-loading-model.md: 21bad78792c6b5aad48b51f454f6c08c0400ad72 -2026-07-23-client-plugin-loading-model.zh.md: 2758f28f3bd34131ece3bed74152fbfe0b36174e +2026-07-23-client-plugin-loading-model.md: c5576b148c5991dd498d3aed605e3c2e3395774b +2026-07-23-client-plugin-loading-model.zh.md: c7d6982c2680995bd4698ddbff052a7708f69997 diff --git a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md index 21bad78792..c5576b148c 100644 --- a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md +++ b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.md @@ -52,7 +52,7 @@ What happens between `dsh web` starting and the UI appearing? Three stages: the **Host side — compose the graph.** -1. The composing app (`apps/cli`) ships the roster as ordinary rows in its `cordis.yml` config tree — client plugin packages are entry rows like every host plugin, including the always-mounted `client-hmr` row. A roster row that fails to import is caught by `assertEntriesLoaded`; a row whose fiber rejects is reported with its original stack by `assertEntriesActivated` ([host boot decision](2026-07-24-web-config-tree-boot-and-transport-layering.md)). +1. The composing app (`apps/cli`) ships the roster as ordinary rows in its `cordis.yml` config tree — client plugin packages are entry rows like every host plugin, including the always-mounted `client-hmr` row. `auditStartupEntries` reports failed imports, activation errors with their original stacks, and pending dependencies; optional entries warn and required entries reject startup ([startup policy](2026-09-09-consumer-owned-startup-strictness.md)). 2. The `dsh-client-modules` node half (the package is dual-face: its browser half is the module table) resolves each live Loader entry through the same `name` and owning-tree `baseUrl` inputs that imported its Host face, then reads the nearest owning package.json `dsh.client` declaration and composes `window.__DSH_BOOT__`: `{ rev, entries: [{ id, url, rev, inject?, immediately?, external? }], batches: [{ phase, url, rev, entries }] }`. The manifest package name is the browser module identity even when an overlay names a relative source or built entry file. Distinct active Loader sources resolving to one package name fail composition; after one source unloads, the surviving source supplies the row without a fiber restart. The row's three optional fields come from manifests, never hand-copied. Composition orders requested dynamic rows before their consumers, rejects synchronous request cycles, and assigns every row to exactly one initial batch. It refuses declared plugins without built `./client` bundles and groups their package/path rows under one required source-build instruction; malformed declaration fields also fail activation, and the Host audit reports either error from the FAILED fiber. 3. Scanning is incremental per package — there is no full-rescan code path. Each cordis `internal/plugin` emission marks the fiber's entry name dirty (entry-less fibers drop O(1)); a microtask flush reconciles each dirty name against live loader entries, with package metadata (including the negative "not a client package" verdict) cached per entry name and owning-tree base URL for the process lifetime and bundle re-hashing reachable only through `rebuilt(id)`. The activation pass seeds the same dirty set from current entries and flushes synchronously, so first scan and steady state share one implementation. Initial rows receive an opaque process nonce plus sequence without hashing their artifacts; startup combo revisions hash the combined script inputs plus indexed map, and the rows plus batch descriptors hash into `graph.rev`. The graph types are single-sourced in the modules package's `./client` export — the webserver knows nothing about the graph, while modules registers the combo route and contributes structured index-injection rows. diff --git a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.zh.md b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.zh.md index 2758f28f3b..c7d6982c26 100644 --- a/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.zh.md +++ b/.agents/notes/implemented/architecture/2026-07-23-client-plugin-loading-model.zh.md @@ -52,7 +52,7 @@ Host 会快照每个已构建插件产物，并把每个调度阶段的有序 ro **host 侧——组合这张图。** -1. 负责组合的 app（`apps/cli`）把名册作为普通行放进它的 `cordis.yml` 配置树——client 插件包与每个 host 插件一样是 entry 行，包括无条件挂载的 `client-hmr` 行。名册行 import 失败由 `assertEntriesLoaded` 捕获；fiber reject 的行则由 `assertEntriesActivated` 报告原始 stack（[host boot 决策](2026-07-24-web-config-tree-boot-and-transport-layering.zh.md)）。 +1. 负责组合的 app（`apps/cli`）把名册作为普通行放进它的 `cordis.yml` 配置树——client 插件包与每个 host 插件一样是 entry 行，包括无条件挂载的 `client-hmr` 行。`auditStartupEntries` 报告 import 失败、带原始 stack 的激活错误，以及待满足的依赖；optional entry 输出 warning，required entry 则使启动失败（[启动策略](2026-09-09-consumer-owned-startup-strictness.zh.md)）。 2. `dsh-client-modules` 的 node 半（该包是双面的：浏览器半就是模块表）使用 Host face import 时相同的 `name` 与所属 tree `baseUrl` 解析每个 live Loader entry，再读取最近归属 package.json 的 `dsh.client` 声明并组合出 `window.__DSH_BOOT__`：`{ rev, entries: [{ id, url, rev, inject?, immediately?, external? }], batches: [{ phase, url, rev, entries }] }`。即使 overlay 指向相对的 source 或 built entry 文件，manifest 包名仍是浏览器模块身份。若不同的 active Loader source 解析到同一包名，组合会失败；一个来源卸载后，仍存活的来源无需重启 fiber 即可提供该 row。Row 的三个可选字段都来自 manifest，永不人肉抄写。组合会把被请求的动态图 row 排到消费者之前、拒绝同步请求环，并把每个 row 恰好分配给一个初始批次。它会拒绝没有已构建 `./client` bundle 的已声明插件，并把它们的 package/path 行归到一条源码构建要求下；畸形声明字段同样会让激活失败，Host 检查会从 FAILED fiber 报告这两类错误。 3. 扫描是单包增量——不存在全量重扫代码路径。每次 cordis `internal/plugin` 发射把该 fiber 的 entry 名标脏（无 entry 的 fiber O(1) 丢弃）；微任务 flush 把每个脏名对账 live loader entries，包元数据（含「非 client 包」的否定结论）按 entry 名与所属 tree base URL 缓存至进程结束，bundle 重哈希只经 `rebuilt(id)` 可达。激活趟从当前 entries 灌同一脏集合并同步 flush，初扫与稳态共享一条实现。初始 row 使用不透明的进程 nonce 加序号，不对其产物求哈希；启动 combo revision 对合并脚本输入及 indexed map 求哈希，row 与批次描述再共同哈希进 `graph.rev`。图类型单源在 modules 包的 `./client` 出口——webserver 对图一无所知；modules 会注册 combo 路由并贡献结构化 index 注入行。 diff --git a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.i18n.yaml b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.i18n.yaml index 43a487556f..4951fbfe77 100644 --- a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md -2026-07-24-web-config-tree-boot-and-transport-layering.md: e7c0781e1504bce12a8b0d2197bd47b37d3e873a -2026-07-24-web-config-tree-boot-and-transport-layering.zh.md: 9a0affa397151a3994c5731bebda4b45a4139b6c +2026-07-24-web-config-tree-boot-and-transport-layering.md: c8a1db3cd7bd715d8912b22a0b41a9ef660c1316 +2026-07-24-web-config-tree-boot-and-transport-layering.zh.md: 41fcf65b06829199c203faa806bd17a310b68bcf diff --git a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md index e7c0781e15..c8a1db3cd7 100644 --- a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md +++ b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md @@ -12,7 +12,7 @@ English | [中文](2026-07-24-web-config-tree-boot-and-transport-layering.zh.md) ## Decision -**Composition is one flat assembled tree.** `apps/cli/config/base.cordis.yml` plus `apps/cli/config/web.cordis.yml` holds every row — the host runtime (32 rows), the `api-gateway` row, the `webserver` row, and the `dsh.client` rows (the browser roster; the modules row is simultaneously a host row). No spine bundle: every plugin is one row and every config field is yml-editable. That stance later became repository-wide, with the rows both surfaces share factored into `apps/cli/config/base.cordis.yml` and each surface reduced to an overlay ([shared-base overlays](../../archived/simplification/2026-07-29-shared-base-config-overlays.md)). The `dsh-client-hmr` row is an ordinary always-on bundle row (originally appended in code by `--dev`; the flag is retired). Row order carries no load semantics; activation is service-availability driven. The shared audit rejects imports with no fiber, awaits only failed fibers to recover original activation errors, and reports services that leave a fiber `PENDING`; before throwing, it marks those exact rejection reasons through one process checkpoint so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. The Node app-boot artifact embeds `@cordisjs/plugin-include` while leaving `@cordisjs/plugin-loader` external, so the include's `EntryTree` and the host bind to one Loader peer instead of splitting a config tree across two Loader implementations. +**Composition is one flat assembled tree.** `apps/cli/config/base.cordis.yml` plus `apps/cli/config/web.cordis.yml` holds every row — the host runtime (32 rows), the `api-gateway` row, the `webserver` row, and the `dsh.client` rows (the browser roster; the modules row is simultaneously a host row). No spine bundle: every plugin is one row and every config field is yml-editable. That stance later became repository-wide, with the rows both surfaces share factored into `apps/cli/config/base.cordis.yml` and each surface reduced to an overlay ([shared-base overlays](../../archived/simplification/2026-07-29-shared-base-config-overlays.md)). The `dsh-client-hmr` row is an ordinary always-on bundle row (originally appended in code by `--dev`; the flag is retired). Row order carries no load semantics; activation is service-availability driven. `auditStartupEntries` reports failed imports, reads failed fibers for original activation errors, and lists services that leave a fiber `PENDING`. The [startup policy](2026-09-09-consumer-owned-startup-strictness.md) makes optional failures warnings and required failures fatal. Reported rejection reasons stay marked through one process checkpoint so `installFailLoud` coalesces Loader's duplicate notification while unrelated unhandled rejections remain fatal. The Node app-boot artifact embeds `@cordisjs/plugin-include` while leaving `@cordisjs/plugin-loader` external, so the include's `EntryTree` and the host bind to one Loader peer instead of splitting a config tree across two Loader implementations. **Boot glue is a class pair.** `AppCLIEntry` (apps/cli) and `AppWebEntry` (the shell kernel) hold only what must exist independently of cordis: argv facts, the composed patch set, the parsed boot manifest, the module system instance, loading-page handles — everything else lives in plugins. `AppCLIEntry.run()` is three stages: layered env (ambient > cwd `.env` > `$DSH_HOME/.env`, closing the defect above) → patch composition → Loader include boot plus the activation audit. `AppWebEntry.run()` mirrors it browser-side: parse `window.__DSH_BOOT__` into a `BootManifest` (two views: npm-package rows for the module table, cordis-plugin rows for entry composition; malformed wire throws), build the module system, render the loading page, prefetch the `immediately` tier in parallel with Context/Loader setup, **await the prefetch before creating entries** (materialization is `tree.import`'s synchronous require, unprotected by fiber inject waiting; cross-package require edges such as i18n → runtime/client need every immediately-tier factory registered first — an empirically found 10–25% boot race otherwise), adopt the modules entry, create the graph rows, settle, sweep. diff --git a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.zh.md b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.zh.md index 9a0affa397..41fcf65b06 100644 --- a/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.zh.md +++ b/.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.zh.md @@ -12,7 +12,7 @@ Status: implemented ## 决策 -**组合结果是一棵平铺配置树。** `apps/cli/config/base.cordis.yml` 与 `apps/cli/config/web.cordis.yml` 共同持有全部行——host 运行时（32 行）、`api-gateway` 行、`webserver` 行、`dsh.client` 行（浏览器 roster；modules 行同时是 host 行）。不做主干 bundle：每插件一行、每个 config 字段 yml 可改。这一立场后来推广到全仓：两个 surface 共享的配置项被抽取进 `apps/cli/config/base.cordis.yml`，各 surface 则收敛为一份 overlay（[共享 base overlay](../../archived/simplification/2026-07-29-shared-base-config-overlays.md)）。`dsh-client-hmr` 行是普通的始终启用的 bundle 行（最初由 `--dev` 在代码中追加；该旗标已废除）。行序无装载语义；激活由服务可用性驱动。共享 audit 会拒绝没有 fiber 的 import、仅等待失败的 fiber 以恢复原始激活错误，并报告让 fiber 停在 `PENDING` 的服务；抛出错误前，审计会通过一个进程级检查点标记这些 rejection 的确切原因，从而让 `installFailLoud` 将 Loader 的重复通知合并为一次，而无关的未处理 rejection 仍然致命。Node app-boot 产物内嵌 `@cordisjs/plugin-include`，但将 `@cordisjs/plugin-loader` 保持为外部依赖，因此 include 的 `EntryTree` 与 host 会绑定到同一个 Loader peer，而不会让一棵配置树横跨两个 Loader 实现。 +**组合结果是一棵平铺配置树。** `apps/cli/config/base.cordis.yml` 与 `apps/cli/config/web.cordis.yml` 共同持有全部行——host 运行时（32 行）、`api-gateway` 行、`webserver` 行、`dsh.client` 行（浏览器 roster；modules 行同时是 host 行）。不做主干 bundle：每插件一行、每个 config 字段 yml 可改。这一立场后来推广到全仓：两个 surface 共享的配置项被抽取进 `apps/cli/config/base.cordis.yml`，各 surface 则收敛为一份 overlay（[共享 base overlay](../../archived/simplification/2026-07-29-shared-base-config-overlays.md)）。`dsh-client-hmr` 行是普通的始终启用的 bundle 行（最初由 `--dev` 在代码中追加；该旗标已废除）。行序无装载语义；激活由服务可用性驱动。`auditStartupEntries` 报告 import 失败、读取失败 fiber 的原始激活错误，并列出让 fiber 停在 `PENDING` 的服务。[启动策略](2026-09-09-consumer-owned-startup-strictness.zh.md)将 optional failure 作为 warning，将 required failure 视为致命错误。已报告的 rejection 原因会保持标记至一个进程级检查点，使 `installFailLoud` 合并 Loader 的重复通知，而无关的未处理 rejection 仍然致命。Node app-boot 产物内嵌 `@cordisjs/plugin-include`，但将 `@cordisjs/plugin-loader` 保持为外部依赖，因此 include 的 `EntryTree` 与 host 会绑定到同一个 Loader peer，而不会让一棵配置树横跨两个 Loader 实现。 **boot 胶水由两个类组成。** `AppCLIEntry`（apps/cli）与 `AppWebEntry`（壳内核）只持有那些必须独立于 cordis、提前存在的东西：argv 事实、合成的 patch 集、解析出的 boot manifest（元数据清单）、模块系统实例、loading 页句柄——其余一律进插件。`AppCLIEntry.run()` 三段：分层 env（ambient > cwd `.env` > `$DSH_HOME/.env`，顺手关掉上述缺陷）→ patch 合成 → Loader include boot 加 activation audit。`AppWebEntry.run()` 在浏览器侧镜像它：把 `window.__DSH_BOOT__` 解析成 `BootManifest`（双视角：npm 包行给模块表、cordis 插件行给 entry 组合；畸形 wire 大声抛）、建模块系统、渲染 loading 页、immediately 层预取与 Context/Loader 准备并行、**create entry 之前等预取齐**（物化是 `tree.import` 的同步 require，不受 fiber inject 等待保护；i18n → runtime/client 这类跨包 require 边要求 immediately 层工厂全部注册完——否则有实测 10–25% 的 boot 竞态）、收编 modules entry、逐一创建图行、settle、sweep。 diff --git a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.i18n.yaml b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.i18n.yaml index 9695955b54..362b1c40a8 100644 --- a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md -2026-08-03-per-session-agent-presets.md: 8af48979b49f08c8e3ac945f648acbb615757a98 -2026-08-03-per-session-agent-presets.zh.md: 2889487e989d093c162848c3c972d46fece3726d +2026-08-03-per-session-agent-presets.md: c2c9f670df480662804e086fbf150c773d8f4fc8 +2026-08-03-per-session-agent-presets.zh.md: 9a4760be9e4a9d1d2de0a7f8d2d3bce755c04480 diff --git a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md index 8af48979b4..c2c9f670df 100644 --- a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md +++ b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.md @@ -33,7 +33,7 @@ The `agent-presets` user-settings namespace carries `modeSelectionEnabled` and ` **The effective default is read per resolution, never snapshotted.** A cached value would need a `watch` subscription and a reload path to stay honest, and the resolved scope already re-reads a hot-reloaded document. The Host setting itself applies when an unnamed session is resolved afterwards. An explicit Web Settings action additionally routes its accepted effective default through the existing blank-session selection path only when the captured session id is still current and blank; it never recomposes a running session or rewrites that session's history. The session log enforces the same invariant from the other side — the header records the id a session was CREATED with and an `agent-preset/selected` event records any later blank-session switch, so a reader resolves the pair (`resolveSessionPreset`) and never the header alone: a resume rebuilds the composition its history was produced under rather than the deployment default at resume time, a cold transcript's presenters resolve in that composition's layer, and the gateway rejects an attempt to adopt a live session under a preset other than the one it currently runs. A snapshot would make the two disagree at exactly the moment the setting changes. -**A directly-plugged subtree is invisible to the boot audit.** It never links itself to an `Entry`, so it is absent from `ctx.loader.entries()` and `assertEntriesActivated` cannot see it. The mount audits its own rows instead, reading the tree through an `Include` subclass that publishes it. +**A directly-plugged subtree is invisible to the boot audit.** It never links itself to an `Entry`, so it is absent from `ctx.loader.entries()` and `auditStartupEntries` cannot see it. The mount reads its own rows through an `Include` subclass that publishes the tree and requires every enabled row to activate, independently of the [application startup policy](2026-09-09-consumer-owned-startup-strictness.md). **A preset can only name a group because the app registers one.** Sharing a realm across rows is a `cordis:group` row, and a preset living outside this workspace — the authored ones under the Harness home, which is the point — cannot resolve `@cordisjs/plugin-group` by name: Node's upward `node_modules` walk never reaches the harness from there. `boot()` therefore registers `cordis:group` beside `cordis:include` as a loader builtin, so both load through the ambient module pipeline rather than through the included tree's own specifier resolution. Without it the `isolate` vocabulary above is expressible one row at a time only, and a provider could never be grouped with its consumers. diff --git a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.zh.md b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.zh.md index 2889487e98..9a4760be9e 100644 --- a/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.zh.md +++ b/.agents/notes/implemented/architecture/2026-08-03-per-session-agent-presets.zh.md @@ -33,7 +33,7 @@ Status: implemented **有效默认值在每次解析时读取，绝不保存快照。** 缓存下来就需要一个 `watch` 订阅和一条重载路径才能保持诚实，而解析后的 scope 本来就会重读热重载过的文档。Host 设置本身会在此后解析未指名会话时生效。Web Settings 中的明确操作还会把已接受的有效默认值送入既有的空白会话选择链路，但只在操作前捕获的会话 id 仍是当前空白会话时对齐；它绝不会重新组装运行中的会话，也不会改写该会话的历史。session 日志从另一侧执行同一条不变量——header 记录会话**创建时**的 id，此后空白期的任何切换由 `agent-preset/selected` 事件记录，因此读取方解析的是两者之和（`resolveSessionPreset`）、绝不单看 header：恢复重建的是其历史所产出的那份组装而不是恢复时的部署默认值，冷读记录的 presenter 在那份组装的层里解析，网关也会拒绝把一个活着的会话收编到它当前运行的 preset 以外的 preset 之下。快照会让两者恰好在设置改变的那一刻各说各话。 -**直接挂载的子树对启动审计不可见。** 它不会把自己关联到 `Entry`，因此不在 `ctx.loader.entries()` 中，`assertEntriesActivated` 也看不到它。改由挂载过程自行校验各行，通过一个会公开自身 tree 的 `Include` 子类读取。 +**直接挂载的子树对启动审计不可见。** 它不会把自己关联到 `Entry`，因此不在 `ctx.loader.entries()` 中，`auditStartupEntries` 也看不到它。挂载过程通过一个会公开自身 tree 的 `Include` 子类读取各行，并要求每个启用行都激活，不受[应用启动策略](2026-09-09-consumer-owned-startup-strictness.zh.md)影响。 **preset 能写出 group，是因为 app 注册了它。** 跨行共享 realm 就是一个 `cordis:group` 行，而住在本工作区之外的 preset——也就是 Harness home 下由人或 agent 创作的那些，正是这套设计的目的——无法按名字解析 `@cordisjs/plugin-group`：Node 向上查找 `node_modules` 的路径从那里永远走不到 harness。因此 `boot()` 把 `cordis:group` 与 `cordis:include` 并排注册为 loader builtin，两者都经由环境模块管线加载，而不依赖被包含树自身的说明符解析。没有它，上文那套 `isolate` 词汇就只能一行一行地表达，提供方也永远无法与它的消费方归入同一组。 diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml index a4801495ac..e3d96b6365 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write .agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md -2026-09-09-consumer-owned-startup-strictness.md: b9742b91cb66be8f3aa7d052caf16a12c5c35072 -2026-09-09-consumer-owned-startup-strictness.zh.md: dc9d58e8322e47d6f0559e7a5240b46584f0ad14 +2026-09-09-consumer-owned-startup-strictness.md: 8e3d5f0141245ba2fa2c85faba607ac1be952e37 +2026-09-09-consumer-owned-startup-strictness.zh.md: 3873b9ceeb6204939e817a53514f5e18767ececc diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md index b9742b91cb..8e3d5f0141 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.md @@ -18,6 +18,8 @@ The audit treats a throwing `disabled` expression as an entry failure, not a dis The audit runs only during initial application boot. Later config HMR remains best effort and keeps the failed candidate visible for repair. +This policy governs [Web host boot](2026-07-24-web-config-tree-boot-and-transport-layering.md), including its [client plugin roster](2026-07-23-client-plugin-loading-model.md). [Per-session presets](2026-08-03-per-session-agent-presets.md) own a separate strict subtree audit. + ## Alternatives considered - **Add transactional and best-effort modes to vendored Loader.** Rejected because strictness belongs to the application or resource owner, while a Loader group contains unrelated plugins. A mode would also expand the vendor patch and leave callers to select a policy at every group. diff --git a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md index dc9d58e832..3873b9ceeb 100644 --- a/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md +++ b/.agents/notes/implemented/architecture/2026-09-09-consumer-owned-startup-strictness.zh.md @@ -18,6 +18,8 @@ Required id 为 `agent-loop`、`webserver`、`modules`、`connection`、`headles 该审计只在应用首次启动时运行。之后的 config HMR 仍采用 best effort，并保留 failed candidate 供后续修复。 +该策略适用于 [Web host 启动](2026-07-24-web-config-tree-boot-and-transport-layering.zh.md)，包括其 [client 插件名册](2026-07-23-client-plugin-loading-model.zh.md)。[按会话的 preset](2026-08-03-per-session-agent-presets.zh.md)持有独立的严格子树审计。 + ## 考虑过的替代方案 - **给 vendored Loader 增加 transactional 与 best-effort mode。** 拒绝，因为严格语义属于应用或资源 owner，而一个 Loader group 包含互不相关的 plugin。Mode 还会扩大 vendor patch，并要求 caller 为每个 group 选择 policy。 diff --git a/packages/boot/app-boot/README.i18n.yaml b/packages/boot/app-boot/README.i18n.yaml index 1d459ae307..415f129789 100644 --- a/packages/boot/app-boot/README.i18n.yaml +++ b/packages/boot/app-boot/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md -README.md: 90998cedf68be91e9cb033c4dc8e54615c49a4b9 -README.zh.md: 74472de6d91fa5bb365044a928205f137fffd87b +README.md: 88679e9d4bc53f36d49e8c5b19dcd724ebf573e8 +README.zh.md: 3336ac4e0c56c92e88525af80e6a88cd44b0c081 diff --git a/packages/boot/app-boot/README.md b/packages/boot/app-boot/README.md index 90998cedf6..88679e9d4b 100644 --- a/packages/boot/app-boot/README.md +++ b/packages/boot/app-boot/README.md @@ -101,7 +101,7 @@ This section explains how the outcomes above are realized and points at the code - **Consumer-owned strictness.** Ordinary Loader groups keep successful siblings. App-boot applies the global required-entry policy after initial settlement; agent presets and dynamic multi-entry compositions own and dispose their separate generation when they require all-or-nothing setup. - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links. - **Update completion.** App boot observes restart failures through the `internal/update` waterfall. Live patch reloads wait for the tree's fibers before auditing activation; `Fiber.update()` and `Entry.update()` alone do not establish restart success. -- **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`. Plugin diagnostics include original stacks, nested causes, and aggregate member failures. +- **Two-stage failure labels.** `boot()` distinguishes `host preparation failed` — `prepare` threw before any config-tree entry mounted — from `plugin tree failed to load`. Plugin diagnostics include original stacks, nested causes, and aggregate member failures. Cyclic causes terminate diagnostic traversal without replacing the original cause. ### Helper behavior diff --git a/packages/boot/app-boot/README.zh.md b/packages/boot/app-boot/README.zh.md index 74472de6d9..3336ac4e0c 100644 --- a/packages/boot/app-boot/README.zh.md +++ b/packages/boot/app-boot/README.zh.md @@ -101,7 +101,7 @@ App-boot 读取 failed fiber 来报告已记录的错误，并在一个进程检 - **由 consumer 持有严格语义。** 普通 Loader group 保留成功 sibling。App-boot 在首次结算后应用全局 required-entry policy；agent preset 与动态多 entry 组合在需要 all-or-nothing setup 时，持有并拆卸各自的独立 generation。 - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部组合包若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。 - **更新完成。** App boot 通过 `internal/update` waterfall 观察重启失败。实时 patch 重载在检查激活状态前等待配置树中的 fiber；单独调用 `Fiber.update()` 或 `Entry.update()` 不能确定重启成功。 -- **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`。插件诊断包含原始堆栈、嵌套原因和聚合错误中的各项失败。 +- **两阶段失败标签。** `boot()` 区分 `host preparation failed`（`prepare` 在任何配置树条目挂载前抛出）与 `plugin tree failed to load`。插件诊断包含原始堆栈、嵌套原因和聚合错误中的各项失败。原因链出现循环时，诊断遍历会终止，不会替换原始原因。 ### Helper 行为 diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 8bf6686e53..5ab7067955 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -854,7 +854,8 @@ export async function auditStartupEntries( * surface disposed the tree while startup was still in flight. * @throws a labelled error after disposing the partial context — `host * preparation failed` when `prepare` threw before any config-tree entry - * mounted, `plugin tree failed to load` afterwards. + * mounted, `plugin tree failed to load` afterwards. Cyclic causes terminate + * diagnostic traversal without replacing the original cause. */ export async function boot( binName: string, @@ -896,7 +897,11 @@ export async function boot( const detail = cause instanceof Error ? cause.message : String(cause) // A wrapper can carry an activation error whose original stack names the failed plugin. let deepest: unknown = cause - while (deepest instanceof Error && deepest.cause !== undefined) deepest = deepest.cause + const seen = new Set() + while (deepest instanceof Error && !seen.has(deepest) && deepest.cause !== undefined) { + seen.add(deepest) + deepest = deepest.cause + } const stack = deepest instanceof AggregateError ? `\n${deepest.stack ?? deepest.message}\n${deepest.errors.map(formatActivationError).join('\n')}` : deepest instanceof Error && deepest !== cause ? `\n${deepest.stack ?? deepest.message}` : '' diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 639d475fbd..4bbf6aaf02 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -1026,6 +1026,25 @@ describe('boot', () => { })).rejects.toThrow(`${NAME}: host preparation failed: host refused`) }) + it.each([false, true])('rejects and disposes when an error cause is cyclic (indirect: %s)', async (indirect) => { + const failure = new Error('cyclic setup failure') + const next = indirect ? new Error('nested failure', { cause: failure }) : failure + let reads = 0 + Object.defineProperty(failure, 'cause', { + get() { + // Bound a regressed synchronous traversal so it cannot hang the test worker. + if (++reads > 10) throw new Error('cause traversal did not terminate') + return next + }, + }) + const dispose = vi.fn() + await expect(boot(NAME, join(tmp(), 'cordis.yml'), [], (ctx) => { + ctx.effect(() => dispose) + throw failure + })).rejects.toThrow(`${NAME}: host preparation failed: cyclic setup failure`) + expect(dispose).toHaveBeenCalledOnce() + }) + it('expands a stackless aggregate at the deepest activation cause', async () => { const dir = tmp() const aggregate = new AggregateError([ From 6894e93a121d36c4d09807d66248f545c8c815d8 Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Fri, 11 Sep 2026 12:42:53 +0800 Subject: [PATCH 23/26] refactor(app-boot): keep required startup policy private --- packages/boot/app-boot/src/index.ts | 4 +-- packages/boot/app-boot/tests/app-boot.spec.ts | 29 ++++++++----------- 2 files changed, 13 insertions(+), 20 deletions(-) diff --git a/packages/boot/app-boot/src/index.ts b/packages/boot/app-boot/src/index.ts index 5ab7067955..cebe39888b 100644 --- a/packages/boot/app-boot/src/index.ts +++ b/packages/boot/app-boot/src/index.ts @@ -699,7 +699,7 @@ const FIBER_FAILED = 3 as FiberState.FAILED * not affect startup; an enabled listed entry must activate. The list covers * shared Agent execution, application endpoints, and Web bootstrap/transport. */ -export const REQUIRED_STARTUP_ENTRY_IDS: readonly string[] = Object.freeze([ +const requiredStartupEntryIds = new Set([ 'agent-loop', 'webserver', 'modules', @@ -709,8 +709,6 @@ export const REQUIRED_STARTUP_ENTRY_IDS: readonly string[] = Object.freeze([ 'sdk-jsonrpc-server', ]) -const requiredStartupEntryIds = new Set(REQUIRED_STARTUP_ENTRY_IDS) - /** Render plugin stacks, nested causes, and aggregate member failures once per error. */ function formatActivationError(error: unknown): string { const details: string[] = [] diff --git a/packages/boot/app-boot/tests/app-boot.spec.ts b/packages/boot/app-boot/tests/app-boot.spec.ts index 4bbf6aaf02..5fc1dedd47 100644 --- a/packages/boot/app-boot/tests/app-boot.spec.ts +++ b/packages/boot/app-boot/tests/app-boot.spec.ts @@ -9,7 +9,6 @@ import { addHarnessSourceSection, auditStartupEntries, boot, FAIL_LOUD_RELEASE_TIMEOUT_MS, HARNESS_SOURCE_SECTION, installFailLoud, loadEnv, loadLayeredEnv, loadOverlayPatches, resolveConfigPath, type FailLoudProcess, - REQUIRED_STARTUP_ENTRY_IDS, } from '../src/index.ts' const NAME = 'dsh-test-bin' @@ -505,6 +504,16 @@ describe('installFailLoud', () => { }) describe('auditStartupEntries', () => { + const requiredIds = [ + 'agent-loop', + 'webserver', + 'modules', + 'connection', + 'headless-runner', + 'acp', + 'sdk-jsonrpc-server', + ] + interface FakeEntry { fiber?: { state: number @@ -532,25 +541,11 @@ describe('auditStartupEntries', () => { await: error === undefined ? async () => undefined : async () => { throw error }, }) - it('pins the global list to shared execution, application endpoints, and Web startup', () => { - expect(Object.isFrozen(REQUIRED_STARTUP_ENTRY_IDS)).toBe(true) - expect(REQUIRED_STARTUP_ENTRY_IDS).toEqual([ - 'agent-loop', - 'webserver', - 'modules', - 'connection', - 'headless-runner', - 'acp', - 'sdk-jsonrpc-server', - ]) - expect(REQUIRED_STARTUP_ENTRY_IDS).not.toContain('tool-todo') - }) - it('ignores active, disabled, and absent required entries', async () => { const warn = vi.fn() await expect(auditStartupEntries(ctxWith([]), NAME, warn)).resolves.toBeUndefined() for (const disabled of [false, true]) { - await expect(auditStartupEntries(ctxWith(REQUIRED_STARTUP_ENTRY_IDS.map(id => ({ + await expect(auditStartupEntries(ctxWith(requiredIds.map(id => ({ fiber: disabled ? fiber(3, new Error('disabled failure')) : fiber(2), disabled, options: { id, name: './required.mjs' }, @@ -675,7 +670,7 @@ describe('auditStartupEntries', () => { expect(diagnostic).toContain('unexpected-state (./unexpected-state.mjs): fiber state 1') }) - it.each(['webserver', 'modules', 'connection'])('rejects required %s failures after warning about optional failures', async (id) => { + it.each(requiredIds)('rejects required %s failures after warning about optional failures', async (id) => { const warn = vi.fn() const requiredError = new Error('address already in use') const optionalError = new Error('todo unavailable') From 464334bc4c72ff7bfb7e352438d738985111f56e Mon Sep 17 00:00:00 2001 From: turtle1999 Date: Fri, 11 Sep 2026 13:10:03 +0800 Subject: [PATCH 24/26] test(boot): keep headless running after optional MCP startup failure --- .../tests/mcp-pagination.expected.e2e.ts | 16 ++++++++++++---- packages/mcp/mcp-client/README.i18n.yaml | 4 ++-- packages/mcp/mcp-client/README.md | 2 +- packages/mcp/mcp-client/README.zh.md | 2 +- .../tests/fixtures/repeated-cursor.patch.yml | 6 ------ 5 files changed, 16 insertions(+), 14 deletions(-) diff --git a/apps/cli/tests/profiles/headless/tests/mcp-pagination.expected.e2e.ts b/apps/cli/tests/profiles/headless/tests/mcp-pagination.expected.e2e.ts index e9e08bb302..dd0730e6f5 100644 --- a/apps/cli/tests/profiles/headless/tests/mcp-pagination.expected.e2e.ts +++ b/apps/cli/tests/profiles/headless/tests/mcp-pagination.expected.e2e.ts @@ -6,24 +6,32 @@ import { LOADER_SMOKE_TEST_TIMEOUT_MS, runLoaderSmoke } from '@deepseek-ai/dsh-l const fixtureRoot = new URL('../../../../../../packages/mcp/mcp-client/tests/fixtures/', import.meta.url) const configPath = fileURLToPath(new URL('repeated-cursor.patch.yml', fixtureRoot)) +const headlessOverlayPath = fileURLToPath(new URL('./fixtures/headless-profile.patch.yml', import.meta.url)) const expectedPath = fileURLToPath(new URL('./expected/mcp-pagination/stderr-cause.txt', import.meta.url)) -it('reports a repeated MCP discovery cursor and exits before starting a turn', async () => { +it('warns about a repeated MCP discovery cursor and completes the headless task', async () => { const { stdout, stderr } = await runLoaderSmoke({ label: 'MCP discovery pagination cycle', tempDirPrefix: 'dsh-mcp-pagination-', binScript: fileURLToPath(new URL('../../../../src/bin.ts', import.meta.url)), libBinScript: fileURLToPath(new URL('../../../../lib/bin.js', import.meta.url)), configPath, - binArgs: ['--profile', 'headless', '--patch', configPath, 'unreachable task'], + binArgs: [ + '--profile', 'headless', + '--patch', headlessOverlayPath, + '--patch', configPath, + 'Complete the task without the failed MCP server.', + ], tsconfigPath: fileURLToPath(new URL('../../../../../../tsconfig.json', import.meta.url)), - expectedExitCode: 1, env: { DSH_MCP_PAGINATION_FIXTURE: fileURLToPath(new URL('repeated-cursor-server.ts', fixtureRoot)), + DSH_PERMISSION_MODE: 'danger-full-access', DSH_TELEMETRY_DISABLED: '1', }, }) - expect(stdout).toBe('') + expect(stdout).toBe('CLI tool round trip complete: CLI_TOOL_ROUND_TRIP\n') + expect(stderr).toContain('dsh: warning: 1 entry did not activate') + expect(stderr).toContain('mcp-pagination-cycle (@deepseek-ai/dsh-mcp-client)') expect(stderr).toContain('initial connection or tool synchronization failed') const cause = stderr.split('\n').find(line => line.startsWith('Error: mcp-client(pagination-cycle):')) await expect(`${cause}\n`).toMatchFileSnapshot(expectedPath) diff --git a/packages/mcp/mcp-client/README.i18n.yaml b/packages/mcp/mcp-client/README.i18n.yaml index 74afb59465..b9f167d303 100644 --- a/packages/mcp/mcp-client/README.i18n.yaml +++ b/packages/mcp/mcp-client/README.i18n.yaml @@ -2,5 +2,5 @@ # side as of the last confirmed-consistent state. Both languages carry equal authority; # after editing either side, bring the other along and re-record with: # pnpm run verify-translation-pairing --write packages/mcp/mcp-client/README.md -README.md: de646256888f1c271ad94a4c863338dfb02551e6 -README.zh.md: fe9aadfa00d68b5cea9d5c1f201731544b963b7e +README.md: 591b93c4bdb922151d246d1eebf46ad0b582cb01 +README.zh.md: 41938dc61b50eaa468cc1915f47bc371107c87e1 diff --git a/packages/mcp/mcp-client/README.md b/packages/mcp/mcp-client/README.md index de64625688..591b93c4bd 100644 --- a/packages/mcp/mcp-client/README.md +++ b/packages/mcp/mcp-client/README.md @@ -67,7 +67,7 @@ Add one entry per server; nothing else is required. After the harness starts, th The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-mcp-client) is the exhaustive source for every accepted field. -After startup, the server's tools appear as `mcp____` — try a prompt that uses one. If the initial connection fails, the harness still starts but no tools from that server appear, and an error is logged; set `failOnStartupError: true` to make a startup failure abort the harness instead. +After startup, the server's tools appear as `mcp____` — try a prompt that uses one. If the initial connection fails, the harness still starts but no tools from that server appear, and an error is logged. Setting `failOnStartupError: true` rejects plugin activation; [app-boot's startup policy](../../boot/app-boot/README.md) still permits an optional MCP entry to fail without aborting the harness. ### Tool naming and coexistence diff --git a/packages/mcp/mcp-client/README.zh.md b/packages/mcp/mcp-client/README.zh.md index fe9aadfa00..41938dc61b 100644 --- a/packages/mcp/mcp-client/README.zh.md +++ b/packages/mcp/mcp-client/README.zh.md @@ -67,7 +67,7 @@ kind: "package-reference" 生成的[配置目录](../../../docs/config-catalog.zh.md#deepseek-aidsh-mcp-client)是每个受支持字段的穷尽式真源。 -启动后，服务器的工具会以 `mcp____` 形式出现——试着用一条提示词调用其中一个。如果初始连接失败，harness 仍会启动，但该服务器的工具不会出现，并会记录一条错误；设置 `failOnStartupError: true` 可让启动失败改为中止 harness。 +启动后，服务器的工具会以 `mcp____` 形式出现——试着用一条提示词调用其中一个。如果初始连接失败，harness 仍会启动，但该服务器的工具不会出现，并会记录一条错误。设置 `failOnStartupError: true` 会拒绝插件激活；[app-boot 的启动策略](../../boot/app-boot/README.zh.md)仍允许可选 MCP 配置项失败，而不中止 harness。 ### 工具命名与共存 diff --git a/packages/mcp/mcp-client/tests/fixtures/repeated-cursor.patch.yml b/packages/mcp/mcp-client/tests/fixtures/repeated-cursor.patch.yml index 1a4d033b5b..aedd2d0e8e 100644 --- a/packages/mcp/mcp-client/tests/fixtures/repeated-cursor.patch.yml +++ b/packages/mcp/mcp-client/tests/fixtures/repeated-cursor.patch.yml @@ -1,9 +1,3 @@ -- id: headless-startup - disabled: true - -- id: headless-runner - disabled: true - - insert: - id: mcp-pagination-cycle name: '@deepseek-ai/dsh-mcp-client' From 96ee6e49f98997eb40c40946b7279949c48d26cc Mon Sep 17 00:00:00 2001 From: turtle1999 <301751225+turtle1999@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:22:14 +0800 Subject: [PATCH 25/26] test(terminal): await PowerShell prompt delivery --- packages/terminal/terminal-bash/tests/local.spec.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/terminal/terminal-bash/tests/local.spec.ts b/packages/terminal/terminal-bash/tests/local.spec.ts index 9800a79d54..2cf46dd9c2 100644 --- a/packages/terminal/terminal-bash/tests/local.spec.ts +++ b/packages/terminal/terminal-bash/tests/local.spec.ts @@ -330,7 +330,9 @@ describe.skipIf(!hasPwsh)('terminal-bash pwsh real shell', () => { timeoutMs: 8_000, }, 'pwsh') const created = await ctx.terminals.spawn(agent, { type: 'shell', name: 'main', cwd: root }) - expect(created.motd).toContain('dsh> ') + // stdin_read can precede delivery of the printable prompt to the PTY reader. + await expect.poll(() => ctx.terminals.read(agent, created.sessionId, { offset: 0, count: 100 }).text, + { timeout: 8_000 }).toContain('dsh> ') const releaseFile = join(root, 'release-command') // Hold the command across the silence settlement without relying on host load. From 40e39f467365c7aef02d55acbde3b8ac4a5c5049 Mon Sep 17 00:00:00 2001 From: turtle1999 <301751225+turtle1999@users.noreply.github.com> Date: Fri, 11 Sep 2026 13:31:22 +0800 Subject: [PATCH 26/26] test(ci): control Python stray UTF-8 fragment delivery --- .../code-runtime-python/tests/runtime.spec.ts | 100 ------------------ .../tests/stray-fragments.spec.ts | 31 ++++++ 2 files changed, 31 insertions(+), 100 deletions(-) diff --git a/packages/experimental/code-runtime-python/tests/runtime.spec.ts b/packages/experimental/code-runtime-python/tests/runtime.spec.ts index 1f3fd6cb1e..287cf8f785 100644 --- a/packages/experimental/code-runtime-python/tests/runtime.spec.ts +++ b/packages/experimental/code-runtime-python/tests/runtime.spec.ts @@ -1494,106 +1494,6 @@ describe('PythonCodeRuntime — programs and bindings', () => { await fiber.dispose() }) - it('bounds an illegal-UTF-8 native residual by its U+FFFD-decoded cost', async () => { - // Every 0xFF byte is illegal in any UTF-8 sequence, so `toString('utf8')` - // renders each as U+FFFD (3 serialized bytes). `accrueStrayCost` must charge - // that 3, not the raw 1: otherwise the newline-free residual grows to a full - // budget's worth of RAW bytes before flushing — a ~3x undercount that near a - // large maxLogBytes retains hundreds of MiB then expands toward a ~1 GiB peak - // in flushStray's concat + toString. Paced single-byte writes (each its own - // `data` chunk, like the sealing case) expose the sub-chunk accrual: charged - // at 3 the residual crosses a 3072-byte budget after ~1024 bytes and flushes; - // charged at 1 it would need ~3072 bytes, so the peak residual triples. The - // largest merged buffer is the discriminator. - const realConcat = Buffer.concat.bind(Buffer) - let maxConcat = 0 - Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer => { - const merged = realConcat(list, total) - if (merged.length > maxConcat) maxConcat = merged.length - return merged - } - let result: CodeRunResult - try { - const { runtime } = await setup({ maxLogBytes: 3072, maxWallMs: 30_000 }) - result = await runtime.run({ - program: [ - 'import os, time', - // One byte per chunk on every host: a plain yield lets a loaded - // reader coalesce, and the coalesced chunk is what the bound below - // measures. The payload stays above the 2048 discriminator, so a - // raw-byte undercount still flushes the whole residual at EOF. - 'for _ in range(3200):', - ' os.write(1, b"\\xff")', - ' time.sleep(0.001)', - 'return None', - ].join('\n'), - bindings: [], - }) - } finally { - Buffer.concat = realConcat - } - expect(result.error).toBeUndefined() - expect(result.logs.at(-1)).toBe(logTruncationMarker(3072)) - // Charged at 3, the residual flushes around 1024 raw bytes; the largest - // merged buffer stays well under 2048. A raw-byte undercount would let it - // reach ~3072 before flushing, so 2048 discriminates. - expect(maxConcat).toBeLessThan(2048) - // The paced payload costs ~3.2s deterministically, which is above the - // 5000ms default the local unit entry grants, so the case carries its own - // bound instead of relying on the lane to widen it. - }, 20_000) - - it('charges a structurally-valid but illegal UTF-8 sequence its U+FFFD-decoded cost', async () => { - // A CESU-8 lone surrogate `ED A0 80` is structurally well-formed (a 3-byte - // lead plus two 0x80–0xBF continuations) but ILLEGAL: `toString('utf8')` - // renders each of the three bytes as its own U+FFFD (serialized cost 9), not - // one width-3 character. The newline-free flush trigger weighs the residual - // through `accrueStrayCost`, which must validate each lead's - // first-continuation range (ED excludes A0–BF) and charge the true 9 — else a - // CESU flood undercounts 3x and the residual grows toward a full budget's raw - // bytes before flushing, the same peak-memory vector as the 0xFF case. The - // bytes are written one at a time (each its own `data` chunk, no pipe - // coalescing) and `Buffer.concat` is wrapped to measure the peak residual. - const realConcat = Buffer.concat.bind(Buffer) - let maxConcat = 0 - Buffer.concat = (list: readonly Uint8Array[], total?: number): Buffer => { - const merged = realConcat(list, total) - if (merged.length > maxConcat) maxConcat = merged.length - return merged - } - let result: CodeRunResult - try { - const { runtime } = await setup({ maxLogBytes: 3072, maxWallMs: 30_000 }) - result = await runtime.run({ - program: [ - 'import os, time', - 'seq = (0xed, 0xa0, 0x80)', - // 1100 sequences are 3300 raw bytes, past the 3072-byte budget a - // raw-byte undercount reaches, so the undercount flushes above the - // 2048 discriminator instead of only at EOF. - 'for _ in range(1100):', - ' for b in seq:', - ' os.write(1, bytes((b,)))', - ' time.sleep(0.001)', - 'return None', - ].join('\n'), - bindings: [], - }) - } finally { - Buffer.concat = realConcat - } - expect(result.error).toBeUndefined() - expect(result.logs.at(-1)).toBe(logTruncationMarker(3072)) - // Each 3-byte sequence costs 9 (three U+FFFD), so single-byte-paced the - // residual crosses the 3072 budget after ~342 raw bytes and flushes; the - // largest merged buffer stays well under 2048. Charging the structural width - // 3 would need ~1024 raw bytes, tripling the peak past 2048. - expect(maxConcat).toBeLessThan(2048) - // The paced payload costs ~3.3s deterministically, which is above the - // 5000ms default the local unit entry grants, so the case carries its own - // bound instead of relying on the lane to widen it. - }, 20_000) - it('charges a lone surrogate its full six escaped bytes, not three', async () => { // A forged `log` frame carrying `\ud800` escapes materializes lone // surrogates after JSON.parse. `Buffer.byteLength` of U+FFFD is 3, but diff --git a/packages/experimental/code-runtime-python/tests/stray-fragments.spec.ts b/packages/experimental/code-runtime-python/tests/stray-fragments.spec.ts index 9ed70c558b..500082b238 100644 --- a/packages/experimental/code-runtime-python/tests/stray-fragments.spec.ts +++ b/packages/experimental/code-runtime-python/tests/stray-fragments.spec.ts @@ -1,5 +1,6 @@ import { Context } from '@deepseek-ai/cordis' import { expect, it, vi } from 'vitest' +import { logTruncationMarker } from '../src/protocol.ts' // Keep the interpreter and pipe lifecycle real; only OS-dependent read sizes // change. Each byte reaches the runtime as its own data event. @@ -54,3 +55,33 @@ it('seals stray fragments without recopying the sealed prefix', async () => { await fiber.dispose() } }, 40_000) + +it.each([ + { name: 'illegal UTF-8 bytes', payload: 'b"\\xff" * 3200' }, + { name: 'CESU-8 lone surrogates', payload: 'b"\\xed\\xa0\\x80" * 1100' }, +])('bounds $name by their U+FFFD-decoded cost', async ({ payload }) => { + const ctx = new Context() + const fiber = await ctx.plugin(PythonCodeRuntime, { maxLogBytes: 3072, maxWallMs: 30_000 }) + const realConcat = Buffer.concat.bind(Buffer) + let maxConcat = 0 + const concat = vi.spyOn(Buffer, 'concat').mockImplementation((list, total) => { + const merged = realConcat(list, total) + maxConcat = Math.max(maxConcat, merged.length) + return merged + }) + try { + const result = await ctx.codeRuntime.run({ + program: `import os\nos.write(1, ${payload})\nreturn None`, + bindings: [], + }) + expect(result.error).toBeUndefined() + expect(result.logs.at(-1)).toBe(logTruncationMarker(3072)) + // Each raw byte decodes to U+FFFD (three UTF-8 bytes), so a 3072-byte + // budget flushes near 1024 raw bytes. Charging raw or structural widths + // instead retains over 2048 bytes before flushing these payloads. + expect(maxConcat).toBeLessThan(2048) + } finally { + concat.mockRestore() + await fiber.dispose() + } +}, 20_000)