Files
multica/server/pkg/taskfailure/resume_test.go
Bohan Jiang 30318b79bc MUL-5426: fix(daemon): retire sessions whose history the provider refuses to replay (#6083)
* fix(daemon): retire sessions whose history the provider refuses to replay

A run killed mid-reply (machine shutdown, force-quit, SIGKILL) can leave an
empty assistant message in the agent CLI's transcript. Every later resume
replays it, the provider rejects the request, and the (agent, issue) pair is
bricked with no self-healing and no user-facing recovery.

Multica already has the mechanism for this — poisoned-session classification —
but its detector paired "400" with "invalid_request_error", which is the
Anthropic wire shape. The same defect reported by any other provider carried
neither token, so it classified as agent_error.unknown: resume-safe by
omission. GetLastTaskSession kept handing back the dead session on every
follow-up, manual Rerun resolved it through the same predicate, and the
in-turn fresh-session retry never fired because ResumeRejected is false here
(nothing rejected the resume — the transcript loaded and the provider refused
to replay it).

Add taskfailure.UnresumableHistory, which recognises the defect by what the
provider says is wrong — some content is empty, and here is which message in
the history — rather than by status code or provider name. Both signals are
required, so a tool reporting "field must not be empty" does not match.

Wire it into the four places that decide whether a session survives:

- classifyPoisonedError, so the task is written as api_invalid_request
- shouldRetryWithFreshSession, so the turn recovers on all 17 backends
  instead of the subset whose adapter learned to detect it; the tools == 0
  gate is unchanged, so a run that already used a tool is never re-run
- ResumeUnsafeFailure, covering the manual-Rerun path
- both resume queries, as defense-in-depth for hosts whose daemon predates
  this (self-host daemons upgrade on their own cadence)

Fixes #6066. Also covers the daemon half of #5760.

Co-authored-by: multica-agent <github@multica.ai>

* fix(session): close the Chat and fresh-retry paths that resurrect a poisoned session

Review found the previous commit stopped short in two places, both of which
put the dead transcript back in play.

Chat never consulted the guarded query. The claim handler reads
chat_session.session_id first and only falls back to GetLastChatTaskSession
when it is empty, so a poisoned pointer there bypasses every filter that query
applies. The fail path merely declined to OVERWRITE the pointer, leaving it in
place. It now clears it in the same transaction, matched on session and
runtime so a concurrent turn's newer pointer survives. The promote guard moves
to ResumeUnsafeFailure as well — the reason-only check passed an un-upgraded
daemon's agent_error.unknown row and re-pinned what the clear had just removed.

GetLastChatTaskSession also kept the row-level filter the issue query dropped
in GH #5975: it discarded the newest poisoned row and fell back to an older
completed row carrying the same dead session. It now judges each session by
its latest terminal state, matching GetLastTaskSession.

A recovered turn could not retire anything. A terminal report carried one
session_id, and an empty one meant both "nothing to report" and "forget the
old session", so a fresh-session retry that SUCCEEDED left the id it retried
away from selectable — through an older completed row on the issue, or through
the chat pointer. agent_task_queue.retired_session_id records the abandonment
itself, reported on every terminal path including completed, and both resume
lookups exclude it. This is the contract gap the previous PR deferred; the
fresh-retry path now runs on all backends, so deferring it is not safe.

Also narrows what the cross-backend test claims: it pins the shared decision,
not that all 17 adapters surface the error into Result.Error (#5760 is the
counter-example), and says so.

Co-authored-by: multica-agent <github@multica.ai>

* test(session): require pgx.ErrNoRows in the resume-exclusion assertions

The `if err == nil && prior.SessionID.Valid` form these tests shared is
false-green: any real fault — undefined column, syntax error, dead connection
— makes err non-nil, so the condition is false and the test passes. Run
against a database missing this branch's new column, the exclusion tests
reported PASS on a SQLSTATE 42703, meaning they could not have caught a broken
query.

requireSessionExcluded demands pgx.ErrNoRows specifically and fails loudly on
anything else, so a green run now means the filter worked rather than the
query never ran.

Applied to all nine sites, not just the four this branch added: the other five
guard the same GetLastTaskSession exclusion behaviour that this branch
changes, so leaving them false-green would leave the change under-tested. All
nine pass on a correctly migrated database.

Co-authored-by: multica-agent <github@multica.ai>

---------

Co-authored-by: Bohan-J <bohan@devv.ai>
Co-authored-by: multica-agent <github@multica.ai>
2026-07-29 15:54:51 +08:00

147 lines
4.7 KiB
Go

package taskfailure
import "testing"
// TestUnresumableHistory pins the predicate against the real provider wordings
// collected from the field. The positives are verbatim strings from user
// reports; the negatives are the shapes that must keep resuming, because a
// false positive throws away a healthy conversation.
func TestUnresumableHistory(t *testing.T) {
t.Parallel()
cases := []struct {
name string
errMsg string
want bool
}{
// --- Positives: an empty message is baked into the transcript. ---
{
// GH #6066, verbatim from the reporter's screenshot. Carries
// neither "invalid_request_error" nor a bare "400", which is
// exactly why the Anthropic-shaped detector missed it.
name: "gh6066 invalid request with position and role",
errMsg: "Invalid request: the message at position 37 with role 'assistant' must not be empty",
want: true,
},
{
// GH #5760, from a manual `kimi -S <session> -p ping` repro.
name: "gh5760 kimi provider api_error",
errMsg: "provider.api_error: 400 the message at position 43 with role 'assistant' must not be empty",
want: true,
},
{
name: "kimi wrapped by the acp sniffer",
errMsg: "kimi provider error: the message at position 43 with role 'assistant' must not be empty",
want: true,
},
{
// Anthropic's own wording for the same defect.
name: "anthropic indexed message non-empty content",
errMsg: `API Error: 400 {"type":"error","error":{"type":"invalid_request_error","message":"messages.37: all messages must have non-empty content except for the optional final assistant message"}}`,
want: true,
},
{
name: "openai-compatible indexed content field",
errMsg: "messages[43].content: content must not be empty",
want: true,
},
{
name: "double-quoted role",
errMsg: `Invalid request: the message with role "assistant" must not be empty`,
want: true,
},
{
name: "unspaced role token",
errMsg: "invalid_request: role=assistant content cannot be empty",
want: true,
},
{
name: "prose wording",
errMsg: "The final assistant message must not be empty.",
want: true,
},
// --- Negatives: emptiness complaints that are NOT about history. ---
{
// The single most likely false positive: a tool or validator
// complaining about a field. No locator into the message history.
name: "tool validation error",
errMsg: "validation error: field must not be empty",
want: false,
},
{
name: "git commit message",
errMsg: "Aborting commit due to empty commit message: commit message must not be empty",
want: false,
},
{
name: "empty api key",
errMsg: "config error: api key must not be empty",
want: false,
},
// --- Negatives: history locator without an emptiness complaint. ---
{
name: "oversized image in history",
errMsg: "messages[3].content[0].image.source.base64.data: image dimensions exceed max allowed size",
want: false,
},
{
name: "assistant message mentioned in a normal error",
errMsg: "could not render assistant message: template failure",
want: false,
},
// --- Negatives: transient failures that MUST keep the session. ---
{
name: "rate limit",
errMsg: "API Error: 429 rate_limit_error: too many requests",
want: false,
},
{
name: "provider 5xx",
errMsg: "provider.api_error: 503 upstream temporarily unavailable",
want: false,
},
{
name: "network drop",
errMsg: "Connection closed mid-response",
want: false,
},
{
name: "empty input",
errMsg: "",
want: false,
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
if got := UnresumableHistory(tc.errMsg); got != tc.want {
t.Fatalf("UnresumableHistory(%q) = %v, want %v", tc.errMsg, got, tc.want)
}
})
}
}
// TestUnresumableHistoryIsStatusAndProviderAgnostic is the regression that
// keeps this from sliding back into a per-provider string match. The same
// defect wearing four different provider costumes must classify identically —
// that is the property GH #6066 and GH #5760 both needed and neither had.
func TestUnresumableHistoryIsStatusAndProviderAgnostic(t *testing.T) {
t.Parallel()
sameDefect := []string{
"Invalid request: the message at position 37 with role 'assistant' must not be empty",
"provider.api_error: 400 the message at position 43 with role 'assistant' must not be empty",
"kimi provider error: the message at position 1 with role 'assistant' must not be empty",
"messages.12: all messages must have non-empty content",
}
for _, errMsg := range sameDefect {
if !UnresumableHistory(errMsg) {
t.Errorf("provider wording must not change the verdict, missed: %q", errMsg)
}
}
}