Module session 

Server-side session state — shared across all connections.

Structs

ApprovalGate

Builder for constructing a ServerState with embedder-supplied dependencies. Embedders (e.g. tokhn-daemon) use this to inject their own memgine handle and other shared infrastructure; the Approval-gate policy for high-risk WS methods.

ChatSession

In-flight agents.chat session bookkeeping. Created when a host client calls agents.chat, removed when the agent emits a terminal agent.chat.event (kind: "done" or "error"), when either side disconnects, or when the host cancels via agents.chat.cancel.

ClientSession

Per-client session.

RunMeta

Daemon-side record of a single agent run (agent run tracing, U1).

ServerState

Global server state shared across all connections.

ServerStateConfig

standalone car-server binary uses ServerState::standalone which calls with_config under the hood.

WsChannel

Shared write half of the WebSocket, plus pending callback channels. write is type-erased via WsSink so the dispatcher can run against any transport-specific WebSocketStream (TCP or UDS today; axum-bridged in future) without templatizing every consumer.

WsMemgineIngestSink

Per-meeting fanout sink that ingests transcript text into a session-scoped memgine using the Arc<tokio::sync::Mutex<...>> wrapper, then forwards every event upstream untouched.

WsToolExecutor

Tool executor that sends callbacks to the client over WebSocket.

WsVoiceEventSink

Voice event sink that forwards events to a specific WebSocket client as voice.event JSON-RPC notifications.

Enums

A2aRouteAuth

Server-side credentials for continuing an A2A-owned A2UI surface.

RecordRunTurnsOutcome

Outcome of ServerState::record_run_turns — distinguishes the three reasons a batch can fail to land so the caller maps each to the right runs.record_turns drop reason (ADV-1). Before this enum the function returned a bare usize (the new total, or 0 for “nothing appended”), which collapsed an under-lock CEILING refusal and an unknown/terminal run into the same 0 — the handler then mislabeled a ceiling refusal as run_terminal.

Constants

DEFAULT_TOOL_TIMEOUT_MS

Default ceiling for the daemon→host tools.execute callback wait when an action carries no explicit timeout_ms. Overridable via CAR_TOOL_TIMEOUT (seconds). Raised from the old hardcoded 60s — real tools (build steps, CLI drivers, slow APIs) routinely run longer, and a 60s ceiling reaped them regardless of the agent’s budget (Parslee-ai/car#259).

RECORD_TURNS_RUN_CEILING

Per-run turn ceiling — a runaway-loop backstop sized well above any healthy main-agent-only cycle (tens of turns), never a trimmer. This is a TRUE hard cap, and it is enforced HERE — inside ServerState::record_run_turns, under the runs lock — not only in the WS handler’s pre-check. The handler keeps a fast-path pre-check off a lock-free snapshot, but the dispatcher spawns a task per frame, so pipelined runs.record_turns batches can all read a sub-ceiling snapshot and pass that pre-check before any of them appends. Only the under-lock check below is atomic with the append, so it is the one that actually bounds the run (ADV-1). A batch that would take the run PAST this many recorded turns is refused WHOLE.

RUN_COMPLETE_GRACE

Grace window applied on disconnect before a still-open run is marked Incomplete (agent run tracing, U1 — R5). Short on purpose: it only has to cover the gap between a healthy runs.complete being dispatched on a spawned task and its terminal record landing, not any real work. Long enough to absorb that scheduling jitter, short enough that a genuinely abandoned run is reported Incomplete promptly.

Type Aliases

WsSink

Type-erased WebSocket sink. The dispatch loop accepts either a WebSocketStream<TcpStream> (the legacy car-server TCP listener) or a WebSocketStream<UnixStream> (the daemon-as-default UDS listener) — both implement Sink<Message, Error = WsError> after the tungstenite handshake. Erasing the type here avoids cascading a generic parameter through every WsChannel / Session / ServerState touchpoint in the dispatcher.