mirror of
https://github.com/multica-ai/multica.git
synced 2026-08-05 09:30:05 +02:00
* fix(daemon): retire sessions whose history the provider refuses to replay A run killed mid-reply (machine shutdown, force-quit, SIGKILL) can leave an empty assistant message in the agent CLI's transcript. Every later resume replays it, the provider rejects the request, and the (agent, issue) pair is bricked with no self-healing and no user-facing recovery. Multica already has the mechanism for this — poisoned-session classification — but its detector paired "400" with "invalid_request_error", which is the Anthropic wire shape. The same defect reported by any other provider carried neither token, so it classified as agent_error.unknown: resume-safe by omission. GetLastTaskSession kept handing back the dead session on every follow-up, manual Rerun resolved it through the same predicate, and the in-turn fresh-session retry never fired because ResumeRejected is false here (nothing rejected the resume — the transcript loaded and the provider refused to replay it). Add taskfailure.UnresumableHistory, which recognises the defect by what the provider says is wrong — some content is empty, and here is which message in the history — rather than by status code or provider name. Both signals are required, so a tool reporting "field must not be empty" does not match. Wire it into the four places that decide whether a session survives: - classifyPoisonedError, so the task is written as api_invalid_request - shouldRetryWithFreshSession, so the turn recovers on all 17 backends instead of the subset whose adapter learned to detect it; the tools == 0 gate is unchanged, so a run that already used a tool is never re-run - ResumeUnsafeFailure, covering the manual-Rerun path - both resume queries, as defense-in-depth for hosts whose daemon predates this (self-host daemons upgrade on their own cadence) Fixes #6066. Also covers the daemon half of #5760. Co-authored-by: multica-agent <github@multica.ai> * fix(session): close the Chat and fresh-retry paths that resurrect a poisoned session Review found the previous commit stopped short in two places, both of which put the dead transcript back in play. Chat never consulted the guarded query. The claim handler reads chat_session.session_id first and only falls back to GetLastChatTaskSession when it is empty, so a poisoned pointer there bypasses every filter that query applies. The fail path merely declined to OVERWRITE the pointer, leaving it in place. It now clears it in the same transaction, matched on session and runtime so a concurrent turn's newer pointer survives. The promote guard moves to ResumeUnsafeFailure as well — the reason-only check passed an un-upgraded daemon's agent_error.unknown row and re-pinned what the clear had just removed. GetLastChatTaskSession also kept the row-level filter the issue query dropped in GH #5975: it discarded the newest poisoned row and fell back to an older completed row carrying the same dead session. It now judges each session by its latest terminal state, matching GetLastTaskSession. A recovered turn could not retire anything. A terminal report carried one session_id, and an empty one meant both "nothing to report" and "forget the old session", so a fresh-session retry that SUCCEEDED left the id it retried away from selectable — through an older completed row on the issue, or through the chat pointer. agent_task_queue.retired_session_id records the abandonment itself, reported on every terminal path including completed, and both resume lookups exclude it. This is the contract gap the previous PR deferred; the fresh-retry path now runs on all backends, so deferring it is not safe. Also narrows what the cross-backend test claims: it pins the shared decision, not that all 17 adapters surface the error into Result.Error (#5760 is the counter-example), and says so. Co-authored-by: multica-agent <github@multica.ai> * test(session): require pgx.ErrNoRows in the resume-exclusion assertions The `if err == nil && prior.SessionID.Valid` form these tests shared is false-green: any real fault — undefined column, syntax error, dead connection — makes err non-nil, so the condition is false and the test passes. Run against a database missing this branch's new column, the exclusion tests reported PASS on a SQLSTATE 42703, meaning they could not have caught a broken query. requireSessionExcluded demands pgx.ErrNoRows specifically and fails loudly on anything else, so a green run now means the filter worked rather than the query never ran. Applied to all nine sites, not just the four this branch added: the other five guard the same GetLastTaskSession exclusion behaviour that this branch changes, so leaving them false-green would leave the change under-tested. All nine pass on a correctly migrated database. Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Bohan-J <bohan@devv.ai> Co-authored-by: multica-agent <github@multica.ai>
147 lines
4.7 KiB
Go
147 lines
4.7 KiB
Go
package taskfailure
|
|
|
|
import "testing"
|
|
|
|
// TestUnresumableHistory pins the predicate against the real provider wordings
|
|
// collected from the field. The positives are verbatim strings from user
|
|
// reports; the negatives are the shapes that must keep resuming, because a
|
|
// false positive throws away a healthy conversation.
|
|
func TestUnresumableHistory(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
cases := []struct {
|
|
name string
|
|
errMsg string
|
|
want bool
|
|
}{
|
|
// --- Positives: an empty message is baked into the transcript. ---
|
|
{
|
|
// GH #6066, verbatim from the reporter's screenshot. Carries
|
|
// neither "invalid_request_error" nor a bare "400", which is
|
|
// exactly why the Anthropic-shaped detector missed it.
|
|
name: "gh6066 invalid request with position and role",
|
|
errMsg: "Invalid request: the message at position 37 with role 'assistant' must not be empty",
|
|
want: true,
|
|
},
|
|
{
|
|
// GH #5760, from a manual `kimi -S <session> -p ping` repro.
|
|
name: "gh5760 kimi provider api_error",
|
|
errMsg: "provider.api_error: 400 the message at position 43 with role 'assistant' must not be empty",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "kimi wrapped by the acp sniffer",
|
|
errMsg: "kimi provider error: the message at position 43 with role 'assistant' must not be empty",
|
|
want: true,
|
|
},
|
|
{
|
|
// Anthropic's own wording for the same defect.
|
|
name: "anthropic indexed message non-empty content",
|
|
errMsg: `API Error: 400 {"type":"error","error":{"type":"invalid_request_error","message":"messages.37: all messages must have non-empty content except for the optional final assistant message"}}`,
|
|
want: true,
|
|
},
|
|
{
|
|
name: "openai-compatible indexed content field",
|
|
errMsg: "messages[43].content: content must not be empty",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "double-quoted role",
|
|
errMsg: `Invalid request: the message with role "assistant" must not be empty`,
|
|
want: true,
|
|
},
|
|
{
|
|
name: "unspaced role token",
|
|
errMsg: "invalid_request: role=assistant content cannot be empty",
|
|
want: true,
|
|
},
|
|
{
|
|
name: "prose wording",
|
|
errMsg: "The final assistant message must not be empty.",
|
|
want: true,
|
|
},
|
|
|
|
// --- Negatives: emptiness complaints that are NOT about history. ---
|
|
{
|
|
// The single most likely false positive: a tool or validator
|
|
// complaining about a field. No locator into the message history.
|
|
name: "tool validation error",
|
|
errMsg: "validation error: field must not be empty",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "git commit message",
|
|
errMsg: "Aborting commit due to empty commit message: commit message must not be empty",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "empty api key",
|
|
errMsg: "config error: api key must not be empty",
|
|
want: false,
|
|
},
|
|
|
|
// --- Negatives: history locator without an emptiness complaint. ---
|
|
{
|
|
name: "oversized image in history",
|
|
errMsg: "messages[3].content[0].image.source.base64.data: image dimensions exceed max allowed size",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "assistant message mentioned in a normal error",
|
|
errMsg: "could not render assistant message: template failure",
|
|
want: false,
|
|
},
|
|
|
|
// --- Negatives: transient failures that MUST keep the session. ---
|
|
{
|
|
name: "rate limit",
|
|
errMsg: "API Error: 429 rate_limit_error: too many requests",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "provider 5xx",
|
|
errMsg: "provider.api_error: 503 upstream temporarily unavailable",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "network drop",
|
|
errMsg: "Connection closed mid-response",
|
|
want: false,
|
|
},
|
|
{
|
|
name: "empty input",
|
|
errMsg: "",
|
|
want: false,
|
|
},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
if got := UnresumableHistory(tc.errMsg); got != tc.want {
|
|
t.Fatalf("UnresumableHistory(%q) = %v, want %v", tc.errMsg, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestUnresumableHistoryIsStatusAndProviderAgnostic is the regression that
|
|
// keeps this from sliding back into a per-provider string match. The same
|
|
// defect wearing four different provider costumes must classify identically —
|
|
// that is the property GH #6066 and GH #5760 both needed and neither had.
|
|
func TestUnresumableHistoryIsStatusAndProviderAgnostic(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
sameDefect := []string{
|
|
"Invalid request: the message at position 37 with role 'assistant' must not be empty",
|
|
"provider.api_error: 400 the message at position 43 with role 'assistant' must not be empty",
|
|
"kimi provider error: the message at position 1 with role 'assistant' must not be empty",
|
|
"messages.12: all messages must have non-empty content",
|
|
}
|
|
for _, errMsg := range sameDefect {
|
|
if !UnresumableHistory(errMsg) {
|
|
t.Errorf("provider wording must not change the verdict, missed: %q", errMsg)
|
|
}
|
|
}
|
|
}
|