2 Commits

Include renames

Author	SHA1	Message	Date
4 people	d96da46fa0	fix: honor runtime-lowered concurrency limit + cancel queued waiters on disconnect (#149) ... * fix: honor runtime-lowered concurrency limit + cancel queued waiters on disconnect Fixes three findings from an independent concurrency audit of the -p/stream-json wait-queue (lib/tui/semaphore.mjs, reused by server.mjs as `claudeSemaphore`) and its acquireClaudeSlot()/callClaudeTui() callers in server.mjs: F1 (MEDIUM) — release() handed a freed slot straight to the next queued waiter without re-checking `this.limit`, so a PATCH /settings maxConcurrent decrease was silently ignored until every already-inflight task happened to finish on its own. release() now only re-grants when post-decrement inflight is still under the current limit, and a new setLimit() wakes queued waiters immediately when the limit is raised instead of only on the next incidental release(). F2 (MEDIUM) — a request queued behind the concurrency limit had no link to its HTTP connection, so a client that disconnected while still queued would still get a claude process spawned for it once a slot freed — burning subscription quota for a dead socket. acquire() now accepts an optional AbortSignal; server.mjs derives one from the client's res "close" event (closeSignalFor) and passes it into claudeSemaphore.acquire() / tuiSemaphore.acquire() while queued. On abort the waiter is spliced out of the queue (not just flagged), so `queued` accounting stays exact; the same "close" signal is wired into acquireClaudeSlot() (-p path, non-streaming + streaming + singleflight-wrapped) and callClaudeTui() (TUI path). If the response is already destroyed by the time we try to queue, we reject immediately without ever entering the queue. F8 (cosmetic) — acquireClaudeSlot() set `stats.queued = claudeSemaphore.queued + 1` BEFORE calling acquire(), over-reporting /health's queued count by 1 whenever a slot was granted immediately (the common, non-queued case). acquire() already updates its internal queue synchronously before returning a Promise, so reading claudeSemaphore.queued right AFTER calling it (instead of guessing "+1" before) is exact. No /health field was added, removed, or renamed. ALIGNMENT.md: this PR touches request-handler code (callClaude, callClaudeStreaming, callClaudeTui, acquireClaudeSlot) but is local concurrency-control/queue-accounting infrastructure with no cli.js wire analogue — it does not add, rename, or change any endpoint, header, request field, or response field, and does not touch the /v1/messages forwarding path or the OAuth bearer machinery (the two Class A surfaces this repo governs). The /health response shape is unchanged (same field set, same nesting; only the *value* of the pre-existing `stats.queued` field is corrected). Per CLAUDE.md hard-requirement #1, a cli.js citation is therefore declared ABSENT: there is no corresponding cli.js operation to cite because this is not a cli.js-mirror (Class A) change and not a Class B endpoint-contract change either. Tests: added 6 unit tests to test-features.mjs against the shared TuiSemaphore (lowering the limit mid-load does not over-admit; raising the limit wakes queued waiters up to the new headroom, FIFO; a queued waiter cancelled via AbortSignal is spliced out and never later acquires; an already-aborted signal never touches the queue; cancelling one of several queued waiters preserves FIFO for the rest). 238 pre-existing tests remain green; suite is now 244/244. Verification: `node --check server.mjs && node --check lib/tui/semaphore.mjs && npm test` — 244 passed, 0 failed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: singleflight follower retry on leader disconnect + quiet disconnect handling (review M1/L1/L2) Addresses the independent reviewer's APPROVE-WITH-CHANGES findings on PR #149: M1 (MEDIUM, F2 regression) — when a singleflight LEADER disconnected while queued, its RequestDisconnectedError rejected the SHARED promise, so live followers fell into respondUpstreamError's generic branch and got a spurious 500 on a healthy socket. Fix: keys.mjs singleflight() gains an optional follower-side `retryIf` predicate. When a follower joins an existing flight and the shared promise rejects with an error retryIf() accepts, the follower does NOT inherit the rejection — it re-enters singleflight with its OWN fn (the map entry is guaranteed already deleted: the delete-finally is attached upstream of the promise followers await), becoming the new leader or joining a retrying sibling's fresh flight. The leader's own rejection is never retried (it IS that client's disconnect). server.mjs passes retryIf = (err) => err instanceof RequestDisconnectedError && !res.destroyed, so a follower whose own client is also gone still propagates quietly. Callers without retryIf keep byte-for-byte pre-existing share-everything semantics (pinned by the existing failure-fan-out test). L1 (LOW) — a disconnect-while-queued on the non-streaming paths was recorded as a usage FAILURE row and logged as a [proxy] error: metric noise for a non-error. Both non-streaming catch blocks now early-return on RequestDisconnectedError without recordUsage(success:false) and without console.error — mirroring the streaming path, which returns silently. The disconnect remains observable at info level (concurrency_wait_cancelled, now also emitted with path:"tui" from callClaudeTui for parity with acquireClaudeSlot's -p log). L2 (LOW, test gap) — added a unit test for the abort-after-grant race: a waiter granted its slot whose signal aborts afterward must see no rejection, no queue corruption, and its slot released exactly once via the normal path (the semaphore detaches the abort listener at grant; the onAbort idx===-1 guard is the in-dispatch backstop). Tests: +3 (2× M1 in the singleflight section, 1× L2 in the F2 section) — suite is now 247/247 green. ALIGNMENT.md: unchanged declaration — still local concurrency/dedup infrastructure with no cli.js wire analogue; no endpoint, header, request field, or response field added or changed; /health shape untouched. cli.js citation declared ABSENT per CLAUDE.md hard-requirement #1 (not a Class A mirror change, not a Class B contract change). Verification: node --check server.mjs lib/tui/semaphore.mjs keys.mjs && npm test — 247 passed, 0 failed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: dtzp555 <dtzp555@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-07 23:04:13 +10:00
4 people	3322d7bdae	feat(tui): per-path concurrency limit + /health observability (PR-B) (#139) ... Two P1 audit fixes for the TUI subscription-pool bridge (ADR 0007). The default path (CLAUDE_TUI_MODE unset) is unchanged except the additive /health `tui` block (enabled:false when off). C-4 — TUI path had NO concurrency bound. The global MAX_CONCURRENT gate lives in spawnClaudeProcess (the -p/stream-json path); callClaudeTui never calls it — it calls runTuiTurn, which cold-boots a full interactive claude in tmux. So N concurrent TUI requests spawned N simultaneous cold boots (a family burst of 5 on a Pi 4 = OOM risk + subscription rate-limit pressure). Adds an independent in-process limiter (lib/tui/semaphore.mjs, TuiSemaphore) gating callClaudeTui: OCP_TUI_MAX_CONCURRENT (default 2 — a TUI turn is heavy: per-request cold-boot + up to 120s wallclock). Queues rather than rejects (mirrors MAX_CONCURRENT intent), with a bounded wait queue (default 32x the limit) → tui_queue_full (503) on overflow rather than unbounded growth. The slot releases in a finally, so PR-A's honesty-gate throws / timeouts / paste failures never leak a slot. C-5 — no operator-visible TUI drift surface. The tui_entrypoint_mismatch warning only reached journald; after the 6/15 flip a silent sdk-cli drift (the documented top risk) would drain metered credits invisibly. Adds an additive `tui` block to /health: { enabled, entrypointMode, lastEntrypoint, entrypointMismatches, inflight, queued, maxConcurrent }. lastEntrypoint / entrypointMismatches are recorded in callClaudeTui (same mismatch branch the journald warning covers); inflight/queued come from the C-4 semaphore. ALIGNMENT (Class B): cli.js does NOT perform this operation — both the TUI path and /health are OCP-owned, so no cli.js citation applies. /health is a grandfathered B.2 endpoint (ADR 0006, frozen at v3.16.4). The response-shape change is authorized by the ADR 0007 PR-B amendment added in this commit and is behaviour-preserving: the `tui` block is NEW fields only — no existing /health field is changed, renamed, removed, or re-typed, and no existing semantics change, so existing consumers (dashboard, ocp-connect, monitoring) are unaffected. Per ALIGNMENT.md's grandfather provision, an additive behaviour-preserving change to a grandfathered B.2 endpoint is authorized by an ADR; ADR 0007 is the authority for the TUI observability surface. No Class A forwarding path, no alignment.yml, no models.json touched — alignment blacklist is unaffected (zero new network tokens). Tests: 11 new (lib/tui/semaphore.mjs is importable, so the semaphore + the two pure /health helpers are tested directly): limit=1 serializes two overlapping calls; limit=2 runs two + queues the third; slot released on throw; bounded queue → tui_queue_full; mismatch counter increments on cli→other drift; auto mode never counts a mismatch; /health tui block shape + live inflight/queued. npm test: 235 passed, 0 failed (was 224). Co-authored-by: dtzp555 <dtzp555@gmail.com> Co-authored-by: Claude <claude-opus> <noreply@anthropic.com>	2026-06-10 21:54:07 +10:00