car-server-core 0.31.0

Transport-neutral library for the CAR daemon JSON-RPC dispatcher (used by car-server and tokhn-daemon)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109

// Raise the recursion limit so the deeply-nested async block at the
// `accept_async` -> `run_dispatch` call site doesn't trip the rustc
// query-depth limit on Windows / Linux. The default 128 is fine on
// macOS but the larger query graph on the other platforms pushes
// through the threshold; 256 has comfortable headroom. (Same fix
// `car-server` carries; the library inherits the same call-site
// shape.)
#![recursion_limit = "512"]

//! Transport-neutral library extracted from `car-server`.
//!
//! Holds the JSON-RPC dispatcher, per-client session state, and the
//! WebSocket channel plumbing. The standalone `car-server` binary is
//! a thin wrapper that loads `~/.car/env`, initializes telemetry,
//! spawns the dream loop, binds a TCP listener, and on each
//! connection calls [`run_dispatch`].
//!
//! Embedders (e.g. the future `tokhn-daemon` at U7) construct a
//! [`ServerState`] via [`ServerState::embedded`] (or
//! [`ServerStateConfig`] for advanced wiring), accept WebSocket
//! connections in their own listener, and call [`run_dispatch`]
//! directly — without re-implementing the dispatcher.
//!
//! ## Library boundary contract
//!
//! Per the U1 plan, this library MUST NOT:
//! - spawn the dream loop (caller decides),
//! - initialize telemetry (caller decides),
//! - load `~/.car/env` (caller decides).
//!
//! Those bootstraps stay in the embedder's `main`. This contract
//! prevents the dual-memgine bug U7 mitigates: if the library
//! silently spawned its own dream loop, embedded users would end up
//! with two memgine engines (the embedder's plus the library's).
//!
//! ## Lock primitive
//!
//! `ClientSession.memgine` uses `Arc<tokio::sync::Mutex<MemgineEngine>>`
//! per the "one-wrapper rule" — dispatcher handlers can hold the lock
//! across `.await` points without risking poisoning, and tokio's
//! `Mutex` does not poison so a panicking handler does not poison the
//! engine for sibling connections.

pub mod a2a;
pub mod admission;
// Lifted to car-server-types (#418) so the messaging/parslee/coder surfaces can
// later extract without a cycle; re-exported here so `crate::approval_core::*` /
// `crate::channel::*` keep resolving across the dispatcher.
pub use car_server_types::{approval_core, channel};
// Messaging adapters extracted to car-messaging (#418 Phase 1); re-exported so
// `crate::messaging_config::*` / `messaging_orchestrator::*` / `slack_adapter::*`
// / `fanout::*` / `channel_supervisor::*` keep resolving across the dispatcher
// with no call-site churn. `channel_supervisor` (the iMessage activation-UX
// runtime supervisor + per-channel liveness) re-homed into car-messaging
// alongside the orchestrator it drives.
pub use car_messaging::{
    channel_supervisor, fanout, messaging_config, messaging_orchestrator, slack_adapter,
};
pub mod coder;
pub mod handler;
pub mod host;
pub mod mcp;
pub mod meeting;
// Parslee platform integration extracted to car-parslee (#418 Phase 2);
// re-exported so `crate::parslee_auth::*` etc. keep resolving in the dispatcher.
pub use car_parslee::{parslee_auth, parslee_capabilities, parslee_m365, parslee_tools};
pub mod run_store;
pub mod run_trace;
pub mod session;
pub mod ui_agent_loop;
pub mod voice_turn;

pub use admission::{InferenceAdmission, ENV_MAX_CONCURRENT};
pub use handler::{
    handle_connection, reconcile_os_schedules_at_boot, recover_workflow_checkpoints,
    run_concierge_check, run_dispatch, run_idle_backend_eviction, run_upgrade_nudge_check,
    JsonRpcError, JsonRpcMessage, JsonRpcResponse,
};
// Unix-only — the underlying `tokio::net::UnixStream` doesn't exist
// on Windows. Mirror the cfg gate on the function definition itself
// so consumers that need both transports gate their call sites
// the same way (`car-server::main::uds_accept_loop` already does).
#[cfg(unix)]
pub use handler::handle_connection_unix;
pub use approval_core::{ApprovalCore, ResolveOutcome};
pub use channel::{ChannelConfig, ChannelId, InboundChannel, InboundSink, SlackTokenRef};
pub use channel_supervisor::{ChannelLiveness, ChannelSupervisor, SharedLiveness};
pub use fanout::FanoutCoordinator;
// Re-export so `car-server` can stamp `~/.car/version.json` on boot without a
// redundant direct `car-inference` dependency — car-server already depends on
// car-server-core, which already depends on car-inference.
pub use car_inference::doctor::write_version_stamp;
pub use messaging_orchestrator::{
    spawn_channel_pollers, MessageSender, MessagingOrchestrator, RealMessageSender,
};
pub use slack_adapter::{
    build_ack_frame, parse_events_api, parse_interactive, parse_socket_frame,
    parse_socket_url_response, SlackAdapter, SlackInboundEvent, SlackTransport,
};
pub use run_store::{
    RetentionConfig, RunStatus, RunStore, RunSummary, DEFAULT_MAX_AGE_DAYS,
    DEFAULT_MAX_RUNS_PER_AGENT,
};
pub use run_trace::record_turns;
pub use session::{
    ApprovalGate, ClientSession, RecordRunTurnsOutcome, RunMeta, ServerState, ServerStateConfig,
    WsChannel, WsMemgineIngestSink, WsSink, WsToolExecutor, WsVoiceEventSink,
    RECORD_TURNS_RUN_CEILING, RUN_COMPLETE_GRACE,
};