OpenViking

2,152 Commits 162 Branches 105 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
t0sakiand7487	a61c57bf59	fix(codex): preserve transcript cursors across commit and compaction (#4191 ) * fix(#4058): [Bug]: Codex memory plugin replays historical turns after resume or transcript compaction Fixes #4058 Ref: https://github.com/volcengine/OpenViking/issues/4058 * fix(codex): retire committed cursors and keep activity-based concurrency Preserving the transcript cursor after a commit stops the replay, but it also means nothing deletes state files any more: clearState() lost its last caller, so every codex session — including ones that never captured a turn — leaves a file behind, and listStates() reads all of them on every SessionStart. The sweep now retires cursor-only states in the same pass: a real cursor is kept for resume until OPENVIKING_CODEX_COMMITTED_TTL_MS (default 30 days, past the life of the codex rollout it indexes), and a state that never captured anything goes on the idle schedule, which is what the old sweep did with it. Releasing ovSessionId also wrote lastUpdatedAt, making a committed session look freshly active; saveState() takes touch:false so the field keeps meaning "last transcript activity" for both the active window and retention. Requiring a live ovSessionId to count as recently-active made the heuristic miss sessions PreCompact had just committed, which can still be running: the count is back on activity alone, and only a state with a live session is committed. Also name the shrink predicate: role === "user" covers tool results too (normalizeCaptureRole maps them onto the user role), so findLastHumanTurnIndex requires a text part, and the no-human-turn fallback to a full replay is now visible in the log instead of silent. --------- Co-authored-by: 7487 <1042653432@qq.com>	2026-08-26 11:44:40 +08:00
t0saki	33043cb1b8	feat(plugins): expose session commit trace IDs (#3977 ) Preserve result.trace_id across plugin HTTP wrappers, include it in commit success and failure logs, and surface it in user-visible commit confirmations where supported.	2026-08-13 23:29:41 +08:00
t0saki TRAE CLI qin-ctx	2cc96e393e	feat(retrieval): assemble auto-recall context server-side via /search mode="context" (#3534 ) * feat(retrieval): assemble auto-recall context server-side via /search mode="context" Auto-recall assembly lived in every harness plugin: each one searched per memory type, read hits back one by one, and stitched a context block with its own budget and degradation rules. The implementations drifted, and the shared weaknesses showed up in production injections — roughly half of the entries degraded to a bare URI plus a score, character budgets distorted up to 6x on CJK text, and adjacent turns re-injected the same memories. This moves assembly into the server as one round trip. /find stays an unchanged stateless primitive. /search gains mode="context" (mode="list" is the default and byte-identical to before), and /recall becomes a thin preset over the same kernel with its v1 field names folded onto the new contract. New assembly kernel under openviking/retrieve/context_assembler/: - Token budgeting with a CJK-aware estimate replaces the character budget. - detail="auto" fills breadth-first then deepens: every candidate gets a readable floor, then overview, then full for high-scoring entries. An oversized tier falls back to the previous one instead of being truncated, bounded by max_tokens / candidates * 2 per entry. - Overview extraction dispatches by source: memory files use their leading Summary section, code files reuse code_outline signatures, long documents use a heading tree plus first paragraph. - Directory hits start at overview and read their .overview.md sidecar, since directories carry no stored abstract; their full tier stays capped at overview. v1 injected the sidecar as if it were a whole file. - Quotas generalize beyond memory types to resources and skills, with purpose presets supplying ratios when quotas are absent. - dedup_turns keeps a per-session ledger at {session_uri}/.recall_log.json so every harness inherits cross-turn dedup; exclude_uris remains as the stateless fallback. - Rendering flattens to one <memory uri=... type=... score=... detail=...> element per entry. Every tier carries its URI, so the model can always drill down through the MCP read tool. - Query expansion and digest rewriting are opt-in and fail closed: both have timeout fuses, and a failed rewrite still returns the unrewritten block. Retrieval failures are counted into stats rather than silently yielding an empty block. Plugins now send one context request, falling back to /recall and then to raw find on older deployments, and cache that outcome so only the first turn pays for the probe. The tri-state recallRewrite knob chooses between local host-CLI compression and the server digest, and client-side settings move to a plugin section in ovcli.conf. * refactor(retrieval): give context tiers a per-category default The tier ladder assumed `abstract` is a cheap summary. For memory files it is not: the memory writer stores the whole stripped body in that scalar because it doubles as the embedding text, so `abstract` costs the same as `full` and the ladder runs `uri < overview < abstract = full`. Two of the model's properties fell out of that: exempting `abstract` from the per-entry cap let a single entry eat several times the budget, and `detail` — which only ever set a ceiling — collapsed to two distinguishable behaviours across its four values, since `auto` already allowed `full` for memory. Tiers now come from a per-category constant table that treats the storage shape as a given: `events` starts at overview (the one memory type whose `# Summary` extraction is a real compression) and may deepen to full on leftover budget; every other category is served at `abstract`, which for memory already is the complete file at zero read cost and for resources and skills is the generated 256-char summary. The table carries the note to move `events` back to `abstract` once the writer stores a separate summary scalar. Falling out of that: prefetch now reads only the candidates whose planned tier needs a body rather than every candidate, `detail` becomes a real pin (start and ceiling) and additionally accepts a per-category map, and `full_score_threshold` is gone — leftover budget is spent in score order instead of behind an absolute threshold the observed score band cannot support. `auto` is still accepted on the wire as a synonym for "unset". Assembly fixes found alongside: - Removing the abstract cap exemption would turn an oversized abstract into a bare URI, so it now falls back to overview first — for memory that is a cheaper substitute, not a step up. - Rewrite timeouts were reported as failures on Python 3.10, where `asyncio.TimeoutError` is a separate class from the builtin. - `stats.rewrite_usage` read `token_tracker` off `VLMConfig`, which has no such attribute; usage was structurally always null. It now reads the model instance's tracker and reports only when the call count moved by exactly one, since that tracker is shared. - A single malformed ledger record made every deduped recall in that session fail, and the file was never rewritten, so it could not heal. Records are now coerced on read and dropped on the next write, along with records left ahead of the clock by an archive rotation. - Entries served as a bare URI no longer enter the dedup cooldown: they lost to budget pressure, not to the reader having already seen them. - The render envelope only neutralised a literal `</memory>`, so a body could forge a sibling entry with its own uri, type and score. - Flat-mode gathering re-derived the category from the URI, reading `viking://resources/backup/memories/events/log.md` as an event. - Cooled and excluded URIs are compensated with extra rows, so a fully cooled bucket falls through to the next-best hits instead of coming back empty. - `/recall` quotas overlay the v1 bucket defaults again; `{"events": 5}` had started dropping the other three buckets. - The MCP `recall` signature sent its own defaults as if the caller had, which resolved a different profile than `POST /recall`; an unknown `detail` value raised `KeyError` through the whole call instead of degrading. * feat(codex): inject profile context on session start Reuse the shared profile builder for startup, clear, and resume hooks while preserving archive injection and orphan-session status output. Co-authored-by: TRAE CLI <noreply@bytedance.com> * fix(retrieval): raise rewrite timeout default to 30s * docs(agents): document low-latency recall settings * fix(codex): prefer luna as recall compressor fallback * refactor(plugins): unify recall compression setting * feat(plugins): enable recall compression by default * docs(agents): use absolute links in image docs * fix(retrieval): address context assembly review feedback Co-authored-by: TRAE CLI <noreply@bytedance.com> * test: trim redundant context assembly coverage * fix(retrieval): address second-round context assembly review - Drop the backticked `/search` from the deprecated-recall row in both API overviews. The reference checker scans the whole row after the method cell for backticked paths, so it read the description as a route named `POST /search` and Build Docs failed on an unknown, undocumented route. - Accept ovcli.conf's full field set in both Python readers. The file's schema belongs to the Rust CLI, which writes `root_api_key`, `output`, `echo_command`, `show_progress` and `verbose` and ignores unknown keys; the two Python readers had drifted into stricter subsets, so the shipped example already failed to load in both. Adding the new `plugin` section to a working ovcli.conf would have broken `ov doctor` and every SDK client the same way. - Return 400 from `mode="context"` for a request `mode="list"` also rejects. Retrieval validates query and image_url before searching, and the gather fuse swallowed that rejection along with genuine scope failures, so a body of `{"mode":"context"}` came back 200 with an empty block instead of the documented parameter error. Runtime failures still degrade into `stats.retrieval_errors`. - Let a context request that asks for a server-side digest outlast the server's rewrite fuse. The plugin's ordinary 15s request timeout is shorter than the 30s fuse, so a rewrite that finished inside its own budget was aborted client-side, discarding the whole response — including the uncompressed block the server returns when a rewrite fails — and falling back to `/recall`. The deadline is only extended when the body actually requests a rewrite, and `OPENVIKING_RECALL_CONTEXT_TIMEOUT_MS` / `plugin.recallContextTimeoutMs` pins it. * chore(plugins): sync shared modules into the zcode snapshot * fix(retrieval): align context quotas and plugin defaults Restore cross-domain coding recall, reuse authoritative actor resource scopes, and make bucket quotas the sole width control in purpose mode. Keep plugin defaults server-owned while preserving explicit legacy limit settings through quota conversion. Co-authored-by: TRAE CLI <noreply@bytedance.com> * fix(retrieval): preserve recall compatibility Restore the deprecated recall threshold default, distinguish successful empty rewrites from compressor failures, and document legacy quota floors across coding-agent plugins. Co-authored-by: TRAE CLI <noreply@bytedance.com> --------- Co-authored-by: TRAE CLI <noreply@bytedance.com> Co-authored-by: qin-ctx <qinhaojie.exe@bytedance.com>	2026-08-05 12:31:21 +08:00

Author

SHA1

Message

Date

t0sakiand7487

a61c57bf59

fix(codex): preserve transcript cursors across commit and compaction (#4191 )

* fix(#4058): [Bug]: Codex memory plugin replays historical turns after resume or transcript compaction

Fixes #4058

Ref: https://github.com/volcengine/OpenViking/issues/4058

* fix(codex): retire committed cursors and keep activity-based concurrency

Preserving the transcript cursor after a commit stops the replay, but it also
means nothing deletes state files any more: clearState() lost its last caller,
so every codex session — including ones that never captured a turn — leaves a
file behind, and listStates() reads all of them on every SessionStart.

The sweep now retires cursor-only states in the same pass: a real cursor is
kept for resume until OPENVIKING_CODEX_COMMITTED_TTL_MS (default 30 days, past
the life of the codex rollout it indexes), and a state that never captured
anything goes on the idle schedule, which is what the old sweep did with it.

Releasing ovSessionId also wrote lastUpdatedAt, making a committed session look
freshly active; saveState() takes touch:false so the field keeps meaning "last
transcript activity" for both the active window and retention.

Requiring a live ovSessionId to count as recently-active made the heuristic
miss sessions PreCompact had just committed, which can still be running: the
count is back on activity alone, and only a state with a live session is
committed.

Also name the shrink predicate: role === "user" covers tool results too
(normalizeCaptureRole maps them onto the user role), so findLastHumanTurnIndex
requires a text part, and the no-human-turn fallback to a full replay is now
visible in the log instead of silent.

---------

Co-authored-by: 7487 <1042653432@qq.com>

2026-08-26 11:44:40 +08:00

t0saki

33043cb1b8

feat(plugins): expose session commit trace IDs (#3977 )

Preserve result.trace_id across plugin HTTP wrappers, include it in commit success and failure logs, and surface it in user-visible commit confirmations where supported.

2026-08-13 23:29:41 +08:00

2cc96e393e

feat(retrieval): assemble auto-recall context server-side via /search mode="context" (#3534 )

* feat(retrieval): assemble auto-recall context server-side via /search mode="context"

Auto-recall assembly lived in every harness plugin: each one searched per
memory type, read hits back one by one, and stitched a context block with its
own budget and degradation rules. The implementations drifted, and the shared
weaknesses showed up in production injections — roughly half of the entries
degraded to a bare URI plus a score, character budgets distorted up to 6x on
CJK text, and adjacent turns re-injected the same memories.

This moves assembly into the server as one round trip. /find stays an unchanged
stateless primitive. /search gains mode="context" (mode="list" is the default
and byte-identical to before), and /recall becomes a thin preset over the same
kernel with its v1 field names folded onto the new contract.

New assembly kernel under openviking/retrieve/context_assembler/:

- Token budgeting with a CJK-aware estimate replaces the character budget.
- detail="auto" fills breadth-first then deepens: every candidate gets a
readable floor, then overview, then full for high-scoring entries. An
oversized tier falls back to the previous one instead of being truncated,
bounded by max_tokens / candidates * 2 per entry.
- Overview extraction dispatches by source: memory files use their leading
Summary section, code files reuse code_outline signatures, long documents use
a heading tree plus first paragraph.
- Directory hits start at overview and read their .overview.md sidecar, since
directories carry no stored abstract; their full tier stays capped at
overview. v1 injected the sidecar as if it were a whole file.
- Quotas generalize beyond memory types to resources and skills, with purpose
presets supplying ratios when quotas are absent.
- dedup_turns keeps a per-session ledger at {session_uri}/.recall_log.json so
every harness inherits cross-turn dedup; exclude_uris remains as the
stateless fallback.
- Rendering flattens to one <memory uri=... type=... score=... detail=...>
element per entry. Every tier carries its URI, so the model can always drill
down through the MCP read tool.
- Query expansion and digest rewriting are opt-in and fail closed: both have
timeout fuses, and a failed rewrite still returns the unrewritten block.
Retrieval failures are counted into stats rather than silently yielding an
empty block.

Plugins now send one context request, falling back to /recall and then to raw
find on older deployments, and cache that outcome so only the first turn pays
for the probe. The tri-state recallRewrite knob chooses between local host-CLI
compression and the server digest, and client-side settings move to a plugin
section in ovcli.conf.

* refactor(retrieval): give context tiers a per-category default

The tier ladder assumed `abstract` is a cheap summary. For memory files it
is not: the memory writer stores the whole stripped body in that scalar
because it doubles as the embedding text, so `abstract` costs the same as
`full` and the ladder runs `uri < overview < abstract = full`. Two of the
model's properties fell out of that: exempting `abstract` from the per-entry
cap let a single entry eat several times the budget, and `detail` — which
only ever set a ceiling — collapsed to two distinguishable behaviours across
its four values, since `auto` already allowed `full` for memory.

Tiers now come from a per-category constant table that treats the storage
shape as a given: `events` starts at overview (the one memory type whose
`# Summary` extraction is a real compression) and may deepen to full on
leftover budget; every other category is served at `abstract`, which for
memory already is the complete file at zero read cost and for resources and
skills is the generated 256-char summary. The table carries the note to move
`events` back to `abstract` once the writer stores a separate summary scalar.

Falling out of that: prefetch now reads only the candidates whose planned
tier needs a body rather than every candidate, `detail` becomes a real pin
(start and ceiling) and additionally accepts a per-category map, and
`full_score_threshold` is gone — leftover budget is spent in score order
instead of behind an absolute threshold the observed score band cannot
support. `auto` is still accepted on the wire as a synonym for "unset".

Assembly fixes found alongside:

- Removing the abstract cap exemption would turn an oversized abstract into
a bare URI, so it now falls back to overview first — for memory that is a
cheaper substitute, not a step up.
- Rewrite timeouts were reported as failures on Python 3.10, where
`asyncio.TimeoutError` is a separate class from the builtin.
- `stats.rewrite_usage` read `token_tracker` off `VLMConfig`, which has no
such attribute; usage was structurally always null. It now reads the model
instance's tracker and reports only when the call count moved by exactly
one, since that tracker is shared.
- A single malformed ledger record made every deduped recall in that session
fail, and the file was never rewritten, so it could not heal. Records are
now coerced on read and dropped on the next write, along with records left
ahead of the clock by an archive rotation.
- Entries served as a bare URI no longer enter the dedup cooldown: they lost
to budget pressure, not to the reader having already seen them.
- The render envelope only neutralised a literal `</memory>`, so a body could
forge a sibling entry with its own uri, type and score.
- Flat-mode gathering re-derived the category from the URI, reading
`viking://resources/backup/memories/events/log.md` as an event.
- Cooled and excluded URIs are compensated with extra rows, so a fully cooled
bucket falls through to the next-best hits instead of coming back empty.
- `/recall` quotas overlay the v1 bucket defaults again; `{"events": 5}` had
started dropping the other three buckets.
- The MCP `recall` signature sent its own defaults as if the caller had, which
resolved a different profile than `POST /recall`; an unknown `detail` value
raised `KeyError` through the whole call instead of degrading.

* feat(codex): inject profile context on session start

Reuse the shared profile builder for startup, clear, and resume hooks while preserving archive injection and orphan-session status output.

Co-authored-by: TRAE CLI <noreply@bytedance.com>

* fix(retrieval): raise rewrite timeout default to 30s

* docs(agents): document low-latency recall settings

* fix(codex): prefer luna as recall compressor fallback

* refactor(plugins): unify recall compression setting

* feat(plugins): enable recall compression by default

* docs(agents): use absolute links in image docs

* fix(retrieval): address context assembly review feedback

Co-authored-by: TRAE CLI <noreply@bytedance.com>

* test: trim redundant context assembly coverage

* fix(retrieval): address second-round context assembly review

- Drop the backticked `/search` from the deprecated-recall row in both API
overviews. The reference checker scans the whole row after the method cell
for backticked paths, so it read the description as a route named
`POST /search` and Build Docs failed on an unknown, undocumented route.
- Accept ovcli.conf's full field set in both Python readers. The file's schema
belongs to the Rust CLI, which writes `root_api_key`, `output`,
`echo_command`, `show_progress` and `verbose` and ignores unknown keys; the
two Python readers had drifted into stricter subsets, so the shipped example
already failed to load in both. Adding the new `plugin` section to a working
ovcli.conf would have broken `ov doctor` and every SDK client the same way.
- Return 400 from `mode="context"` for a request `mode="list"` also rejects.
Retrieval validates query and image_url before searching, and the gather
fuse swallowed that rejection along with genuine scope failures, so a body
of `{"mode":"context"}` came back 200 with an empty block instead of the
documented parameter error. Runtime failures still degrade into
`stats.retrieval_errors`.
- Let a context request that asks for a server-side digest outlast the
server's rewrite fuse. The plugin's ordinary 15s request timeout is shorter
than the 30s fuse, so a rewrite that finished inside its own budget was
aborted client-side, discarding the whole response — including the
uncompressed block the server returns when a rewrite fails — and falling
back to `/recall`. The deadline is only extended when the body actually
requests a rewrite, and `OPENVIKING_RECALL_CONTEXT_TIMEOUT_MS` /
`plugin.recallContextTimeoutMs` pins it.

* chore(plugins): sync shared modules into the zcode snapshot

* fix(retrieval): align context quotas and plugin defaults

Restore cross-domain coding recall, reuse authoritative actor resource
scopes, and make bucket quotas the sole width control in purpose mode.
Keep plugin defaults server-owned while preserving explicit legacy limit
settings through quota conversion.

Co-authored-by: TRAE CLI <noreply@bytedance.com>

* fix(retrieval): preserve recall compatibility

Restore the deprecated recall threshold default, distinguish successful empty rewrites from compressor failures, and document legacy quota floors across coding-agent plugins.

Co-authored-by: TRAE CLI <noreply@bytedance.com>

---------

Co-authored-by: TRAE CLI <noreply@bytedance.com>
Co-authored-by: qin-ctx <qinhaojie.exe@bytedance.com>

2026-08-05 12:31:21 +08:00