Files
msd-core/src/agent-command-router.cts
Tom Boucher 455ad49ae3 feat(#2296): config-gated provider escalation on quota-exceeded (#2458)
* test(#2296): failing-first coverage for provider escalation on quota-exceeded

Covers the provider-escalation ladder layered onto EXEC.CLASSIFY: back-compat
(no escalation block without --failure-class), cap boundaries at
min(max_escalations, list length) at limit-1/limit/limit+1, opt-in gating,
malformed/hostile provider_escalation config, the --failure-class CLI negative
matrix, config-key registration, and a fast-check budget-limit property.

Red until the resolver, CLI flag, and manifest key land.

Refs #2296

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#2296): config-gated provider escalation on quota-exceeded

The dynamic_routing tier ladder escalates within one provider, which does not
help when that provider is what ran out of quota. Add an opt-in provider ladder
layered on the existing EXEC.CLASSIFY seam.

- model-resolver: resolveProviderEscalation walks dynamic_routing.provider_escalation
  capped at min(max_escalations, list length), reporting from/to/attempted/exhausted.
  Invalid entries are dropped (ADR 227 shape validation). Stays a leaf module —
  the quota-class policy decision is the caller's, per the CONTEXT.md contract.
- agent-command-router: export a frozen AGENT_FAILURE_CLASSES so the new CLI
  validator cannot drift from the classifier that produces the values.
- resolve-execution: --failure-class flag; emits an escalation block ONLY when
  passed, so the existing JSON contract is byte-identical for every caller.
- config-schema.manifest: register dynamic_routing.provider_escalation.
- execute-phase step 7.1: auto-escalate, honor Retry-After, fail loudly naming
  every model tried once the ladder is spent.

Refs #2296

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#2296): extract quota recovery to a reference fragment; regen goldens

The step 7.1a addition pushed gsd-core/workflows/execute-phase.md from 93390 to
95111 LF bytes, past the frozen ADR-857 Phase 6 ceiling (hard <93600, margin
<=93400) asserted by tests/fix-2285-claude-orchestration-wiring.test.cjs. The
base sat 10 bytes under the margin, so no inline wording would have fit.

That gate's own rationale is that optional-feature detail belongs in a fragment,
not the host loop. Moved BOTH the new provider-escalation branch and the
pre-existing manual recovery prompt into
gsd-core/references/execute-phase-quota-recovery.md, leaving step 7.1 as a
one-line pointer. execute-phase.md is now 92880 bytes — 510 SMALLER than base.

Also regenerates the fixtures that legitimately moved because three shipped
files changed (gsd-tools.cjs, config-schema.manifest.json, execute-phase.md):
golden-install-parity + install-tree for all 16 runtimes, INVENTORY.md +
INVENTORY-MANIFEST.json for the new reference, and the workflow size baseline.

Refs #2296

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#2351): make the C1 orphan-reaping test load-independent

tests/run-with-timeout.test.cjs C1 asserted the child heartbeat file exists
after a 1s group-kill window, but the child only wrote it on the first 100ms
setInterval tick. Nothing synchronized the two: on a loaded container the group
is SIGKILLed before that tick lands, the file never appears, and the assertion
fails for a reason unrelated to reaping. Observed failing on both linux-node22
and linux-node24.

The behavior actually under test is the FREEZE assertion (heartbeat stops
advancing => descendant was reaped, not orphaned). That is unaffected by
sampling once more at t=0.

Child now writes its first heartbeat synchronously at startup before arming the
interval, and the kill window widens 1s -> 3s to cover child boot under load.
Both remove the timing dependency; neither weakens what the test proves.

Refs #2296

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#2296): backfill pr:2458 in .changeset/rapid-jays-bark.md

* chore(#2296): regenerate fixtures after rebase onto #2402

The rebase conflicted on the generated golden-install-parity fixtures and
workflow-size-baseline.json because #2402 (b6e6a22fc) regenerated the same
artifacts. Conflict resolution picked a side to unblock the rebase; a true
regeneration on the combined tree then produced further drift, confirming the
resolved content was stale and would have dropped #2402's fixture changes.

Regenerated goldens, install-tree, size baseline, and INVENTORY-MANIFEST from
the merged tree. docs/INVENTORY.md keeps BOTH new reference rows.

execute-phase.md is 92782 LF bytes with both #2402's and this PR's extractions
applied — under the frozen ceiling (hard <93600, margin <=93400).

Refs #2296

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-20 14:59:30 -04:00

120 lines
4.1 KiB
TypeScript

/**
* Agent command router — classify-failure subcommand handler.
*
* ADR-457 build-at-publish: the hand-written bin/lib/agent-command-router.cjs
* collapsed to a TypeScript source of truth. Behaviour is preserved byte-for-behaviour
* from the prior hand-written .cjs; only types are added.
*/
// eslint-disable-next-line @typescript-eslint/no-require-imports
import io = require('./io.cjs');
const { output, error, ERROR_REASON } = io;
// ─── Types ────────────────────────────────────────────────────────────────────
type QuotaExceededResult = {
class: 'quota-exceeded';
sentinel: string;
retryAfterSeconds?: number;
};
type ClassifyHandoffBugResult = {
class: 'classify-handoff-bug';
sentinel: string;
};
type UnknownFailureResult = {
class: 'unknown-failure';
};
type AgentFailureResult = QuotaExceededResult | ClassifyHandoffBugResult | UnknownFailureResult;
interface RouteAgentCommandOptions {
args: string[];
raw: boolean;
}
// ─── Constants ────────────────────────────────────────────────────────────────
/**
* #2296 — The runtime enum of failure classes `classifyAgentFailure` can emit.
*
* `AgentFailureResult`'s class strings are TypeScript types, which erase at
* runtime. Any second surface that needs to validate a class (the
* `resolve-execution --failure-class` flag) would otherwise have to re-declare
* the literals, giving two lists that can silently diverge. This frozen enum is
* the single runtime source both surfaces consume.
*/
const AGENT_FAILURE_CLASSES = Object.freeze({
QUOTA_EXCEEDED: 'quota-exceeded',
CLASSIFY_HANDOFF_BUG: 'classify-handoff-bug',
UNKNOWN_FAILURE: 'unknown-failure',
} as const);
const QUOTA_SENTINELS: string[] = [
'429',
'usage_limit_reached',
'usage limit',
'rate limit',
'rate-limited',
'rate_limit',
'resource_exhausted',
'quota',
'too many requests',
'exceeded your',
];
const CLASSIFY_HANDOFF_SENTINEL = 'classifyhandoffifneeded is not defined';
// ─── Implementation ───────────────────────────────────────────────────────────
function parseRetryAfter(body: unknown): number | undefined {
// eslint-disable-next-line @typescript-eslint/no-base-to-string
const match = String(body ?? '').match(/\bretry[-_ ]after[:\s]+(\d+)\b/i);
if (!match) return undefined;
const seconds = Number.parseInt(match[1], 10);
return Number.isFinite(seconds) ? seconds : undefined;
}
function classifyAgentFailure(body: unknown): AgentFailureResult {
// eslint-disable-next-line @typescript-eslint/no-base-to-string
const normalized = String(body ?? '').toLowerCase();
if (normalized.trim() === '') {
return { class: AGENT_FAILURE_CLASSES.UNKNOWN_FAILURE };
}
for (const sentinel of QUOTA_SENTINELS) {
if (normalized.includes(sentinel)) {
const retryAfterSeconds = parseRetryAfter(body);
return retryAfterSeconds === undefined
? { class: AGENT_FAILURE_CLASSES.QUOTA_EXCEEDED, sentinel }
: { class: AGENT_FAILURE_CLASSES.QUOTA_EXCEEDED, sentinel, retryAfterSeconds };
}
}
if (normalized.includes(CLASSIFY_HANDOFF_SENTINEL)) {
return {
class: AGENT_FAILURE_CLASSES.CLASSIFY_HANDOFF_BUG,
sentinel: CLASSIFY_HANDOFF_SENTINEL,
};
}
return { class: AGENT_FAILURE_CLASSES.UNKNOWN_FAILURE };
}
function routeAgentCommand({ args, raw }: RouteAgentCommandOptions): void {
const subcommand = args[1];
if (subcommand !== 'classify-failure') {
error('Unknown agent subcommand. Available: classify-failure', ERROR_REASON.SDK_UNKNOWN_COMMAND);
}
const bodyArgs = args.slice(2).filter((arg) => arg !== '--');
output(classifyAgentFailure(bodyArgs.join(' ')), raw, undefined);
}
export = {
AGENT_FAILURE_CLASSES,
classifyAgentFailure,
routeAgentCommand,
};