car_server_core/
lib.rs

1// Raise the recursion limit so the deeply-nested async block at the
2// `accept_async` -> `run_dispatch` call site doesn't trip the rustc
3// query-depth limit on Windows / Linux. The default 128 is fine on
4// macOS but the larger query graph on the other platforms pushes
5// through the threshold; 256 has comfortable headroom. (Same fix
6// `car-server` carries; the library inherits the same call-site
7// shape.)
8#![recursion_limit = "512"]
9
10//! Transport-neutral library extracted from `car-server`.
11//!
12//! Holds the JSON-RPC dispatcher, per-client session state, and the
13//! WebSocket channel plumbing. The standalone `car-server` binary is
14//! a thin wrapper that loads `~/.car/env`, initializes telemetry,
15//! spawns the dream loop, binds a TCP listener, and on each
16//! connection calls [`run_dispatch`].
17//!
18//! Embedders (e.g. the future `tokhn-daemon` at U7) construct a
19//! [`ServerState`] via [`ServerState::embedded`] (or
20//! [`ServerStateConfig`] for advanced wiring), accept WebSocket
21//! connections in their own listener, and call [`run_dispatch`]
22//! directly — without re-implementing the dispatcher.
23//!
24//! ## Library boundary contract
25//!
26//! Per the U1 plan, this library MUST NOT:
27//! - spawn the dream loop (caller decides),
28//! - initialize telemetry (caller decides),
29//! - load `~/.car/env` (caller decides).
30//!
31//! Those bootstraps stay in the embedder's `main`. This contract
32//! prevents the dual-memgine bug U7 mitigates: if the library
33//! silently spawned its own dream loop, embedded users would end up
34//! with two memgine engines (the embedder's plus the library's).
35//!
36//! ## Lock primitive
37//!
38//! `ClientSession.memgine` uses `Arc<tokio::sync::Mutex<MemgineEngine>>`
39//! per the "one-wrapper rule" — dispatcher handlers can hold the lock
40//! across `.await` points without risking poisoning, and tokio's
41//! `Mutex` does not poison so a panicking handler does not poison the
42//! engine for sibling connections.
43
44pub mod a2a;
45pub mod admission;
46pub mod agent_permissions;
47pub mod assistant;
48pub mod browser_attention;
49pub mod browser_relay;
50pub mod browser_view;
51pub mod command_scheduler;
52// Lifted to car-server-types (#418) so the messaging/parslee/coder surfaces can
53// later extract without a cycle; re-exported here so `crate::approval_core::*` /
54// `crate::channel::*` keep resolving across the dispatcher.
55pub use car_server_types::{approval_core, channel};
56// Messaging adapters extracted to car-messaging (#418 Phase 1); re-exported so
57// `crate::messaging_config::*` / `messaging_orchestrator::*` / `slack_adapter::*`
58// / `fanout::*` / `channel_supervisor::*` keep resolving across the dispatcher
59// with no call-site churn. `channel_supervisor` (the iMessage activation-UX
60// runtime supervisor + per-channel liveness) re-homed into car-messaging
61// alongside the orchestrator it drives.
62pub use car_messaging::{
63    channel_supervisor, fanout, messaging_config, messaging_orchestrator, slack_adapter,
64};
65pub mod coder;
66pub mod evolution;
67pub mod feedback;
68pub mod feedback_drain;
69pub mod fleet;
70pub mod goal_suggest;
71pub mod handler;
72pub use handler::HOST_MANAGEMENT_METHODS;
73pub mod host;
74pub mod host_channel;
75pub mod inference_control;
76pub mod inference_worker;
77pub mod mcp;
78pub mod mcp_assistant;
79pub mod mcp_daemon;
80pub mod meeting;
81pub mod openrouter_auth;
82// Parslee platform integration extracted to car-parslee (#418 Phase 2);
83// re-exported so `crate::parslee_auth::*` etc. keep resolving in the dispatcher.
84pub use car_parslee::{
85    mobile_runtime, parslee_auth, parslee_capabilities, parslee_m365, parslee_tools,
86};
87mod generated_rpc_capabilities;
88pub mod peers;
89pub mod permission_gate;
90pub mod registry_reaper;
91pub mod rpc_manifest;
92pub mod run_store;
93pub mod run_trace;
94pub mod self_update;
95pub mod selfheal;
96mod selfheal_templates;
97pub mod session;
98pub mod supervision;
99pub mod sync;
100pub mod ui_agent_loop;
101pub mod voice_turn;
102pub mod wire_schema;
103
104pub use admission::{InferenceAdmission, ENV_MAX_CONCURRENT};
105/// The self-healing *repair* loop's cadence. Distinct from
106/// [`spawn_selfheal_cadence`], which detects and never writes.
107pub use coder::heal_service::spawn_heal_cadence;
108pub use coder::watchdog::spawn_coder_session_watchdog;
109pub use command_scheduler::spawn_command_scheduler;
110pub use evolution::{seed_evolution_interval, spawn_evolution_cadence};
111pub use feedback_drain::{spawn_feedback_drain, wake_feedback_drain};
112pub use handler::{
113    handle_connection, reap_orphaned_sandboxes_at_boot, reconcile_os_schedules_at_boot,
114    recover_workflow_checkpoints, run_concierge_check, run_dispatch, run_idle_backend_eviction,
115    run_upgrade_nudge_check, seed_memgine_config, JsonRpcError, JsonRpcMessage, JsonRpcResponse,
116};
117pub use registry_reaper::spawn_stale_registry_reaper;
118pub use self_update::{run_update as run_self_update, spawn_auto_update, UpdateOptions};
119pub use selfheal::{
120    spawn_selfheal_cadence, SelfhealEvidence, SelfhealReplayVerbProbe, SelfhealRoute,
121    SelfhealSourceProbe, DEFAULT_SELFHEAL_INTERVAL_SECS, SELFHEAL_INTERVAL_ENV,
122};
123// Unix-only — the underlying `tokio::net::UnixStream` doesn't exist
124// on Windows. Mirror the cfg gate on the function definition itself
125// so consumers that need both transports gate their call sites
126// the same way (`car-server::main::uds_accept_loop` already does).
127pub use approval_core::{ApprovalCore, ResolveOutcome};
128pub use channel::{ChannelConfig, ChannelId, InboundChannel, InboundSink, SlackTokenRef};
129pub use channel_supervisor::{ChannelLiveness, ChannelSupervisor, SharedLiveness};
130pub use fanout::FanoutCoordinator;
131#[cfg(unix)]
132pub use handler::handle_connection_unix;
133pub use inference_worker::{run_mlx_worker, WorkerOffload};
134// Re-export so `car-server` can stamp `~/.car/version.json` on boot without a
135// redundant direct `car-inference` dependency — car-server already depends on
136// car-server-core, which already depends on car-inference.
137pub use car_inference::doctor::{stamp_version, write_version_stamp, StampTransition};
138pub use messaging_orchestrator::{
139    spawn_channel_pollers, MessageSender, MessagingOrchestrator, RealMessageSender,
140};
141pub use run_store::{
142    RetentionConfig, RunStatus, RunStore, RunSummary, DEFAULT_MAX_AGE_DAYS,
143    DEFAULT_MAX_RUNS_PER_AGENT,
144};
145pub use run_trace::record_turns;
146pub use session::{
147    ApprovalGate, ClientSession, RecordRunTurnsOutcome, RunCompletionFenceGate, RunMeta,
148    ServerState, ServerStateConfig, WsChannel, WsMemgineIngestSink, WsSink, WsToolExecutor,
149    WsVoiceEventSink, RECORD_TURNS_RUN_CEILING, RUN_COMPLETE_GRACE,
150};
151pub use slack_adapter::{
152    build_ack_frame, parse_events_api, parse_interactive, parse_socket_frame,
153    parse_socket_url_response, SlackAdapter, SlackInboundEvent, SlackTransport,
154};
car_server_core/lib.rs

car_server_core/
lib.rs
