2 Commits

Include renames

Author	SHA1	Message	Date
taodengandClaude Fable 5	26b09af5a8	fix: honor runtime-lowered concurrency limit + cancel queued waiters on disconnect ... Fixes three findings from an independent concurrency audit of the -p/stream-json wait-queue (lib/tui/semaphore.mjs, reused by server.mjs as `claudeSemaphore`) and its acquireClaudeSlot()/callClaudeTui() callers in server.mjs: F1 (MEDIUM) — release() handed a freed slot straight to the next queued waiter without re-checking `this.limit`, so a PATCH /settings maxConcurrent decrease was silently ignored until every already-inflight task happened to finish on its own. release() now only re-grants when post-decrement inflight is still under the current limit, and a new setLimit() wakes queued waiters immediately when the limit is raised instead of only on the next incidental release(). F2 (MEDIUM) — a request queued behind the concurrency limit had no link to its HTTP connection, so a client that disconnected while still queued would still get a claude process spawned for it once a slot freed — burning subscription quota for a dead socket. acquire() now accepts an optional AbortSignal; server.mjs derives one from the client's res "close" event (closeSignalFor) and passes it into claudeSemaphore.acquire() / tuiSemaphore.acquire() while queued. On abort the waiter is spliced out of the queue (not just flagged), so `queued` accounting stays exact; the same "close" signal is wired into acquireClaudeSlot() (-p path, non-streaming + streaming + singleflight-wrapped) and callClaudeTui() (TUI path). If the response is already destroyed by the time we try to queue, we reject immediately without ever entering the queue. F8 (cosmetic) — acquireClaudeSlot() set `stats.queued = claudeSemaphore.queued + 1` BEFORE calling acquire(), over-reporting /health's queued count by 1 whenever a slot was granted immediately (the common, non-queued case). acquire() already updates its internal queue synchronously before returning a Promise, so reading claudeSemaphore.queued right AFTER calling it (instead of guessing "+1" before) is exact. No /health field was added, removed, or renamed. ALIGNMENT.md: this PR touches request-handler code (callClaude, callClaudeStreaming, callClaudeTui, acquireClaudeSlot) but is local concurrency-control/queue-accounting infrastructure with no cli.js wire analogue — it does not add, rename, or change any endpoint, header, request field, or response field, and does not touch the /v1/messages forwarding path or the OAuth bearer machinery (the two Class A surfaces this repo governs). The /health response shape is unchanged (same field set, same nesting; only the *value* of the pre-existing `stats.queued` field is corrected). Per CLAUDE.md hard-requirement #1, a cli.js citation is therefore declared ABSENT: there is no corresponding cli.js operation to cite because this is not a cli.js-mirror (Class A) change and not a Class B endpoint-contract change either. Tests: added 6 unit tests to test-features.mjs against the shared TuiSemaphore (lowering the limit mid-load does not over-admit; raising the limit wakes queued waiters up to the new headroom, FIFO; a queued waiter cancelled via AbortSignal is spliced out and never later acquires; an already-aborted signal never touches the queue; cancelling one of several queued waiters preserves FIFO for the rest). 238 pre-existing tests remain green; suite is now 244/244. Verification: `node --check server.mjs && node --check lib/tui/semaphore.mjs && npm test` — 244 passed, 0 failed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 22:59:02 +10:00
4 people	3322d7bdae	feat(tui): per-path concurrency limit + /health observability (PR-B) (#139) ... Two P1 audit fixes for the TUI subscription-pool bridge (ADR 0007). The default path (CLAUDE_TUI_MODE unset) is unchanged except the additive /health `tui` block (enabled:false when off). C-4 — TUI path had NO concurrency bound. The global MAX_CONCURRENT gate lives in spawnClaudeProcess (the -p/stream-json path); callClaudeTui never calls it — it calls runTuiTurn, which cold-boots a full interactive claude in tmux. So N concurrent TUI requests spawned N simultaneous cold boots (a family burst of 5 on a Pi 4 = OOM risk + subscription rate-limit pressure). Adds an independent in-process limiter (lib/tui/semaphore.mjs, TuiSemaphore) gating callClaudeTui: OCP_TUI_MAX_CONCURRENT (default 2 — a TUI turn is heavy: per-request cold-boot + up to 120s wallclock). Queues rather than rejects (mirrors MAX_CONCURRENT intent), with a bounded wait queue (default 32x the limit) → tui_queue_full (503) on overflow rather than unbounded growth. The slot releases in a finally, so PR-A's honesty-gate throws / timeouts / paste failures never leak a slot. C-5 — no operator-visible TUI drift surface. The tui_entrypoint_mismatch warning only reached journald; after the 6/15 flip a silent sdk-cli drift (the documented top risk) would drain metered credits invisibly. Adds an additive `tui` block to /health: { enabled, entrypointMode, lastEntrypoint, entrypointMismatches, inflight, queued, maxConcurrent }. lastEntrypoint / entrypointMismatches are recorded in callClaudeTui (same mismatch branch the journald warning covers); inflight/queued come from the C-4 semaphore. ALIGNMENT (Class B): cli.js does NOT perform this operation — both the TUI path and /health are OCP-owned, so no cli.js citation applies. /health is a grandfathered B.2 endpoint (ADR 0006, frozen at v3.16.4). The response-shape change is authorized by the ADR 0007 PR-B amendment added in this commit and is behaviour-preserving: the `tui` block is NEW fields only — no existing /health field is changed, renamed, removed, or re-typed, and no existing semantics change, so existing consumers (dashboard, ocp-connect, monitoring) are unaffected. Per ALIGNMENT.md's grandfather provision, an additive behaviour-preserving change to a grandfathered B.2 endpoint is authorized by an ADR; ADR 0007 is the authority for the TUI observability surface. No Class A forwarding path, no alignment.yml, no models.json touched — alignment blacklist is unaffected (zero new network tokens). Tests: 11 new (lib/tui/semaphore.mjs is importable, so the semaphore + the two pure /health helpers are tested directly): limit=1 serializes two overlapping calls; limit=2 runs two + queues the third; slot released on throw; bounded queue → tui_queue_full; mismatch counter increments on cli→other drift; auto mode never counts a mismatch; /health tui block shape + live inflight/queued. npm test: 235 passed, 0 failed (was 224). Co-authored-by: dtzp555 <dtzp555@gmail.com> Co-authored-by: Claude <claude-opus> <noreply@anthropic.com>	2026-06-10 21:54:07 +10:00