Files
PaperClipAI/server/src/services/execution-projection.ts
T
Devin FoleyandPaperclip d21fe31243 Retry pooled execution projection reads after disconnects (#15300)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Task run lists show current execution and recovery state.
> - Their execution projection reads runs, finalizations, pending
interactions, and recovery records.
> - A temporary database disconnect in one lookup makes the run list
fail.
> - This pull request uses the existing bounded retry policy for these
read-only lookups.
> - It keeps transaction reads, authorization, and liveness writes
outside the retry scope.

## Linked Issues or Issue Description

Refs #15248. This extends the same bounded SELECT retry policy to the
execution projection used by task run lists.

A wrapped `CONNECTION_CLOSED` error from the pending-interaction SELECT
makes `GET /issues/:id/runs` fail. These lookups are safe to repeat on
the pooled database connection. The shared projection helper also serves
transaction callers, so retries must remain an explicit opt-in.

## What Changed

- Opt the activity run list into per-query projection retries. Keep the
default path single-attempt for transaction callers.
- Rebuild only the failed SELECT. Use the existing three-attempt limit
and 50/100 ms delays.
- Keep completed reads, route authorization, and liveness backfill
writes outside the retry callbacks.
- Test each query, exhaustion, exact error preservation, non-transient
errors, empty results, transaction defaults, run-list backfill behavior,
and denied route access.
- Document the pooled-read boundary.

## Verification

- Frozen install passed with Node 24.21.0 and pnpm 9.15.4.
- 92 focused tests passed across execution projection, activity
service/routes, prior service-read retries, and the shared retry policy.
- Independent review passed 56 projection, retry-policy, and route
authorization tests with no blocking findings.
- `git diff --check` and the staged diff and PR-text secret/PII scan
passed.
- Full workspace `pnpm -r typecheck` and `pnpm build` passed.
- Greptile scored exact head `78783e84a5` 5/5 with no findings or open
review threads.
- Initial CI had one Runner test timeout: `stops and closes a timed-out
consumer even when the caller requested a warm session` exceeded 5
seconds. Its fixture uses a 1 ms session timeout. The Runner package is
unchanged from the base. The focused case passed locally (1 passed, 138
skipped). One unchanged-head rerun of that job passed all 1,219 Runner
tests and the additional native-runtime integration test. All other CI
lanes passed on the initial run.
- Full Linux CI passed on exact head `78783e84a5`: 53 successful checks,
two intentional Storybook skips, and no pending checks. It provides
aggregate test coverage. A full local aggregate was not launched. The
same host's prior aggregate exposed three known macOS immutable-cache
rename failures in unchanged company-skills code, documented in #15298.

## Risks

- An affected lookup can take up to two additional connection attempts
plus 150 ms of delay. Persistent failures still return the final error.
- The opt-in is only used by the pooled activity read path. No
transaction, mutation, full request, or provider action is replayed.
- No schema or response-shape changes.

## Model Used

OpenAI GPT-6 through Codex, with reasoning, repository editing, code
execution, and independent agent review. The exact deployment model ID
and context window are not exposed in this session.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub references)
- [x] My branch name describes the change and contains no internal
Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass (focused suites; aggregate
coverage is described above)
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-10-05 20:09:18 -07:00

327 lines
12 KiB
TypeScript

import { and, desc, eq, inArray, sql } from "drizzle-orm";
import {
heartbeatRuns,
issueRecoveryActions,
issueThreadInteractions,
nativeRunFinalizations,
type Db,
} from "@paperclipai/db";
import type { ExecutionProjection } from "@paperclipai/shared";
import { EXECUTION_CONTROL_DEADLINE_MS } from "./execution-control-deadline.js";
import { executionFailureRetryCount } from "./execution-recovery-attempt.js";
import { retryIdempotentDatabaseOperation } from "../database-retry.js";
const text = (v: unknown) => (typeof v === "string" ? v : null);
const executionRunColumns = {
id: heartbeatRuns.id,
errorCode: heartbeatRuns.errorCode,
executionControlDeadlineAt: heartbeatRuns.executionControlDeadlineAt,
finishedAt: heartbeatRuns.finishedAt,
lastOutputAt: heartbeatRuns.lastOutputAt,
lastUsefulActionAt: heartbeatRuns.lastUsefulActionAt,
nativeIssueId: heartbeatRuns.nativeIssueId,
nextAction: heartbeatRuns.nextAction,
processPid: heartbeatRuns.processPid,
retryOfRunId: heartbeatRuns.retryOfRunId,
runtimeMode: heartbeatRuns.runtimeMode,
scheduledRetryAt: heartbeatRuns.scheduledRetryAt,
scheduledRetryAttempt: heartbeatRuns.scheduledRetryAttempt,
scheduledRetryReason: heartbeatRuns.scheduledRetryReason,
startedAt: heartbeatRuns.startedAt,
status: heartbeatRuns.status,
contextSnapshot: sql<Record<string, unknown>>`jsonb_build_object(
'issueId', ${heartbeatRuns.contextSnapshot}->'issueId',
'failureRetriesBeforeAiConnectionWait', ${heartbeatRuns.contextSnapshot}->'failureRetriesBeforeAiConnectionWait',
'failureRetriesBeforeWorkspaceWait', ${heartbeatRuns.contextSnapshot}->'failureRetriesBeforeWorkspaceWait')`,
};
type Run = Pick<typeof heartbeatRuns.$inferSelect, keyof typeof executionRunColumns>;
type Coordinator = typeof nativeRunFinalizations.$inferSelect;
type Recovery = Pick<
typeof issueRecoveryActions.$inferSelect,
"cause" | "nextAction"
> &
Partial<
Pick<typeof issueRecoveryActions.$inferSelect, "status" | "evidence">
>;
/** Batched reads; list consumers do not perform per-task polling. */
export async function executionProjectionsForRuns(
db: Db,
companyId: string,
runIds: string[],
now = new Date(),
options: { retryDatabaseReads?: boolean } = {},
) {
const projections = new Map<string, ExecutionProjection>();
if (!runIds.length) return projections;
// Opt in only with a pooled Db outside a transaction. Issue enrichment also
// calls this helper with a transaction, whose failed reads must not replay.
const read = <T>(query: () => Promise<T>) => options.retryDatabaseReads
? retryIdempotentDatabaseOperation(query)
: query();
const runs = await read(async () => db
.select(executionRunColumns)
.from(heartbeatRuns)
.where(
and(
eq(heartbeatRuns.companyId, companyId),
inArray(heartbeatRuns.id, runIds),
),
));
const coordinators = await read(async () => db
.select()
.from(nativeRunFinalizations)
.where(
and(
eq(nativeRunFinalizations.companyId, companyId),
inArray(nativeRunFinalizations.runId, runIds),
),
));
const issueIds = [
...new Set(
runs
.map((run) => run.nativeIssueId ?? text(run.contextSnapshot?.issueId))
.filter((id): id is string => !!id),
),
];
const pending = issueIds.length
? await read(async () => db
.select({
issueId: issueThreadInteractions.issueId,
kind: issueThreadInteractions.kind,
})
.from(issueThreadInteractions)
.where(
and(
eq(issueThreadInteractions.companyId, companyId),
inArray(issueThreadInteractions.issueId, issueIds),
eq(issueThreadInteractions.status, "pending"),
),
))
: [];
const recovery = issueIds.length
? await read(async () => db
.select({
issueId: issueRecoveryActions.sourceIssueId,
cause: issueRecoveryActions.cause,
nextAction: issueRecoveryActions.nextAction,
evidence: issueRecoveryActions.evidence,
status: issueRecoveryActions.status,
})
.from(issueRecoveryActions)
.where(
and(
eq(issueRecoveryActions.companyId, companyId),
inArray(issueRecoveryActions.sourceIssueId, issueIds),
inArray(issueRecoveryActions.status, [
"active",
"escalated",
"resolved",
]),
),
)
.orderBy(desc(issueRecoveryActions.updatedAt)))
: [];
const coordinatorByRun = new Map(coordinators.map((row) => [row.runId, row]));
for (const run of runs) {
const issueId = run.nativeIssueId ?? text(run.contextSnapshot?.issueId);
const matching = recovery.filter(
(row) =>
row.issueId === issueId &&
(row.status !== "resolved" || row.evidence.executionReconciliation || row.evidence.automaticRecovery) &&
(row.evidence.runId === run.id || row.evidence.sourceRunId === run.id),
);
const action =
matching.find((row) => row.status !== "resolved") ?? matching[0];
projections.set(
run.id,
projectExecution(
run,
coordinatorByRun.get(run.id),
pending.filter((row) => row.issueId === issueId),
action,
now,
),
);
}
return projections;
}
export async function executionProjectionForRun(
db: Db,
companyId: string,
runId: string,
now = new Date(),
): Promise<ExecutionProjection | null> {
return (
(await executionProjectionsForRuns(db, companyId, [runId], now)).get(
runId,
) ?? null
);
}
export function projectExecution(
run: Run,
coordinator: Coordinator | undefined,
pending: Array<{ kind: string }>,
recoveryAction: Recovery | undefined,
now = new Date(),
): ExecutionProjection {
const detail = coordinator?.failureDetail ?? {};
const successorRunId = text(detail.successorRunId);
const projection: ExecutionProjection = {
phase: "queued",
label: "Queued",
cause: run.errorCode ?? coordinator?.failureCode ?? null,
lastConfirmedActivityAt:
(
run.lastUsefulActionAt ??
run.lastOutputAt ??
run.startedAt
)?.toISOString() ?? null,
retryAt:
(coordinator?.nextAttemptAt ?? run.scheduledRetryAt)?.toISOString() ??
null,
attempt: coordinator?.attempt ?? executionFailureRetryCount(run) + 1,
maxAttempts: 3,
recoveryOwner: null,
nextAction: text(detail.nextAction) ?? run.nextAction,
permittedActions: ["inspect_run"],
predecessorRunId: run.retryOfRunId,
successorRunId,
};
const set = (phase: ExecutionProjection["phase"], label: string) =>
Object.assign(projection, { phase, label });
if (recoveryAction?.status === "resolved" && recoveryAction.evidence?.automaticRecovery) {
projection.cause = recoveryAction.cause;
projection.nextAction = recoveryAction.nextAction;
const continuation = recoveryAction.evidence.explicitUserContinuation as
{ previousRunId?: unknown; runId?: unknown } | undefined;
const explicitSuccessor = text(continuation?.runId);
if (continuation?.previousRunId === run.id && explicitSuccessor && explicitSuccessor !== run.id) {
// The admission transaction already recorded the user's successor. Keep
// the old failure diagnostic without making it hold the newer attempt.
projection.successorRunId = explicitSuccessor;
projection.nextAction = null;
return set("completed", "Continued in another run");
}
// Diagnostic projection only: no user decision or replay affordance.
return set("recovery_needed", "Stopped");
}
if (
recoveryAction?.status === "resolved" &&
recoveryAction.evidence?.executionReconciliation
) {
if (recoveryAction.evidence.continuationDelivery === "invalidated") {
projection.cause = "continuation_ownership_changed";
projection.nextAction =
"The task was closed or reassigned before delivery. Inspect the current task owner and status.";
return set("failed", "Continuation cancelled");
}
const deliveredRunId = text(recoveryAction.evidence.continuationRunId);
projection.successorRunId = deliveredRunId;
projection.cause = null;
projection.nextAction = deliveredRunId
? null
: "The previous execution is reconciled. Its continuation is queued for delivery.";
return set(
deliveredRunId ? "completed" : "queued",
deliveredRunId ? "Continued in another run" : "Continuation queued",
);
}
if (
(run.status === "running" &&
(run.executionControlDeadlineAt || coordinator?.controlDeadlineAt)) ||
[
"result_persisted",
"ready_for_assessment",
"arbitrating",
"workspace_pending",
].includes(coordinator?.phase ?? "")
)
return set("finishing", "Finishing");
if (successorRunId) return set("completed", "Continued in another run");
if (run.status === "scheduled_retry" && run.scheduledRetryReason === "ai_connection_busy") {
projection.nextAction = "Waiting for the AI subscription's current execution to finish; the scheduled check will revalidate access.";
return set("retry_scheduled", "Waiting for AI subscription");
}
if (run.status === "scheduled_retry" && run.scheduledRetryReason === "workspace_busy") {
projection.nextAction = "Waiting for the live workspace holder to finish; the scheduled check will revalidate ownership.";
return set("retry_scheduled", "Waiting for workspace");
}
// Cleanup can fail before a finalization coordinator exists. The missing
// row must not turn a quarantined native session into an ordinary Retry.
const cleanupQuarantined = run.runtimeMode === "native" &&
["failed", "timed_out"].includes(run.status) &&
run.errorCode === "native_session_cleanup_quarantined";
if (!cleanupQuarantined && (
coordinator?.phase === "retryable_failure" ||
run.status === "scheduled_retry"
)) {
projection.recoveryOwner = "agent";
return set(
projection.retryAt && new Date(projection.retryAt) > now
? "retry_scheduled"
: "reconnecting",
projection.retryAt && new Date(projection.retryAt) > now
? "Retry scheduled"
: "Reconnecting",
);
}
if (coordinator?.phase === "terminal_failure" || recoveryAction || cleanupQuarantined) {
if (
!cleanupQuarantined &&
coordinator?.failureCode === "native_provider_terminal_failed" &&
!detail.replacementDenied &&
run.finishedAt &&
now.getTime() - run.finishedAt.getTime() < EXECUTION_CONTROL_DEADLINE_MS
) {
projection.recoveryOwner = "agent";
projection.nextAction =
"Checking that the previous provider stopped and its action outcomes are known before continuing.";
return set("reconnecting", "Checking recovery");
}
projection.recoveryOwner = "board";
projection.cause =
recoveryAction?.cause ??
text(detail.replacementDenied) ??
projection.cause;
projection.nextAction = recoveryAction?.nextAction ?? projection.nextAction;
if (cleanupQuarantined && !projection.nextAction) {
projection.nextAction = "Verify the stopped session and its saved work before starting a new attempt.";
}
projection.permittedActions.push("inspect_recovery");
return set("recovery_needed", "Recovery needed");
}
if (run.status === "succeeded") {
if (pending.length)
return set(
pending.some((row) => row.kind === "connection_intent")
? "waiting_for_access"
: "waiting_for_answer",
pending.some((row) => row.kind === "connection_intent")
? "Waiting for access"
: "Waiting for answer",
);
return set("completed", "Completed");
}
if (["failed", "cancelled", "timed_out", "interrupted"].includes(run.status))
return set("failed", run.status === "cancelled" ? "Cancelled" : "Failed");
if (run.status === "running") {
const leaseConfirmed =
coordinator?.phase === "observed" &&
coordinator.leaseExpiresAt &&
coordinator.leaseExpiresAt > now;
let processConfirmed = false;
if (run.runtimeMode === "legacy" && run.processPid) {
try {
process.kill(run.processPid, 0);
processConfirmed = true;
} catch {
/* No execution confirmation. */
}
}
return leaseConfirmed || processConfirmed
? set("working", "Working")
: set("reconnecting", "Confirming execution");
}
return projection;
}