fix: serialize /new end→switch boundary on the memory manager worker

Deep review of the cherry-picked #16454 found the ad-hoc flush thread
raced new_session()'s inline on_session_switch(reset=True): memory
providers key off internal _session_id state (MemoryManager.on_session_end
takes no session id), so a late off-thread extraction ran against
post-rotation bindings — misattributing the old transcript to the new
session id, double-ingesting the old turn buffer (supermemory), or
double-committing (openviking already async-finalizes in
on_session_switch).

Redesign: new MemoryManager.commit_session_boundary_async queues
on_session_end + on_session_switch as ONE task on the manager's existing
single-worker background executor (the same worker sync_all already
uses). This preserves the strict end→switch ordering providers depend on,
serializes against per-turn syncs FIFO, keeps /new non-blocking, and
degrades to inline (pre-#16454 behavior) when the executor is
unavailable. No ad-hoc threads; no per-provider changes needed.

The context-engine on_session_end half stays synchronous in
_launch_session_boundary_memory_flush (cheap, must land before
reset_session_state rebinds the engine).

Exit durability: _run_cleanup calls the manager's existing
flush_pending(timeout=10) barrier before shutdown, so '/new then quit'
doesn't drop the queued extraction (shutdown_all's own drain is ~5s and
cancels queued tasks). Bounded well inside the 30s exit watchdog.

Tests: ordering invariant with slow (LLM-like) extraction, FIFO
serialization vs sync_all, switch-fires-even-if-end-raises, no-provider
no-op, CLI snapshot handoff + inline-switch fallback, sync engine
boundary, cleanup flush_pending.
This commit is contained in:
Kshitij Kapoor 2026-07-09 02:48:16 +05:30 committed by kshitij
parent 2a293319b1
commit d8bc4f242f
4 changed files with 314 additions and 57 deletions

88
cli.py
View file

@ -1110,6 +1110,19 @@ def _run_cleanup(*, notify_session_finalize: bool = True):
)
try:
if _active_agent_ref and hasattr(_active_agent_ref, 'shutdown_memory_provider'):
# A /new shortly before exit leaves its end→switch boundary task
# (old-session extraction, LLM-bound) queued on the memory
# manager's serialized worker. shutdown_all()'s drain only waits
# ~5s and cancels queued tasks, so give pending work a bounded
# head start via the manager's own barrier — otherwise a
# "/new then quit" silently drops the old session's extraction.
# The 30s exit watchdog remains the hard backstop.
_mm = getattr(_active_agent_ref, '_memory_manager', None)
if _mm is not None and hasattr(_mm, 'flush_pending'):
try:
_mm.flush_pending(timeout=10)
except Exception:
pass
# Forward the agent's own transcript so memory providers'
# ``on_session_end`` hooks see the real conversation instead of
# an empty list (#15165). ``_session_messages`` is set on
@ -4131,7 +4144,9 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
# Background task tracking: {task_id: threading.Thread}
self._background_tasks: Dict[str, threading.Thread] = {}
self._background_task_counter = 0
self._last_session_boundary_thread: Optional[threading.Thread] = None
# History snapshot staged by _launch_session_boundary_memory_flush for
# the /new end→switch boundary task (see new_session()).
self._session_boundary_snapshot: Optional[list] = None
def _claim_active_session(self, surface: str = "cli", *, stderr: bool = False) -> bool:
"""Claim a global active-session slot for this CLI process."""
@ -6963,26 +6978,38 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
*,
session_id: Optional[str] = None,
) -> None:
"""Kick old-session memory extraction off-thread so /new is responsive."""
self._last_session_boundary_thread = None
"""Stage old-session memory extraction so /new stays responsive.
The context-engine ``on_session_end`` boundary is delivered
synchronously here: it is cheap (local state clear, no LLM call) and
ordering-sensitive it must land before ``reset_session_state()``
rebinds the engine to the new session.
The memory-provider half (LLM-bound extraction, seconds) is NOT run
here. It is queued later in ``new_session()`` via
``MemoryManager.commit_session_boundary_async`` as a single
endswitch task on the manager's serialized background worker, so
extraction can never race the provider rebinding (providers key off
internal ``_session_id`` state a late ``on_session_end`` after
``on_session_switch`` would misattribute the old transcript to the
new session). This method just snapshots the history for that call.
"""
self._session_boundary_snapshot = None
agent = getattr(self, "agent", None)
if not agent or not history_snapshot:
return
def _run_boundary_flush() -> None:
if hasattr(agent, "commit_memory_session"):
try:
agent.commit_memory_session(history_snapshot, session_id=session_id)
except Exception:
pass
engine = getattr(agent, "context_compressor", None)
if engine is not None and hasattr(engine, "on_session_end"):
try:
engine.on_session_end(session_id or "", history_snapshot)
except Exception:
logger.debug(
"Context engine on_session_end failed at /new boundary",
exc_info=True,
)
thread = threading.Thread(
target=_run_boundary_flush,
daemon=True,
name=f"session-boundary-flush-{(session_id or 'unknown')[:24]}",
)
self._last_session_boundary_thread = thread
thread.start()
self._session_boundary_snapshot = list(history_snapshot)
def new_session(self, silent=False, title=None):
"""Start a fresh session with a new session ID and cleared agent state."""
@ -7088,15 +7115,33 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
# per-session state (_session_turns, _turn_counter, _document_id).
# Fires BEFORE the plugin on_session_reset hook (shell hooks only
# see the new id; Python providers see the transition). See #6672.
#
# When the old session has history, end-of-session extraction
# (LLM-bound, seconds) and this switch are queued as ONE task on
# the memory manager's serialized worker — end strictly before
# switch, without blocking /new (#16454). With no history there
# is nothing to extract; switch inline as before.
try:
_mm = getattr(self.agent, "_memory_manager", None)
if _mm is not None:
_mm.on_session_switch(
self.session_id,
parent_session_id=old_session_id or "",
reset=True,
reason="new_session",
_boundary_snapshot = getattr(
self, "_session_boundary_snapshot", None
)
if _boundary_snapshot:
self._session_boundary_snapshot = None
_mm.commit_session_boundary_async(
_boundary_snapshot,
new_session_id=self.session_id,
parent_session_id=old_session_id or "",
reason="new_session",
)
else:
_mm.on_session_switch(
self.session_id,
parent_session_id=old_session_id or "",
reset=True,
reason="new_session",
)
except Exception:
pass
self._notify_session_boundary("on_session_reset")
@ -7108,7 +7153,6 @@ class HermesCLI(CLIAgentSetupMixin, CLICommandsMixin):
print("(^_^)v New session started!")
def _consume_pending_resume_selection(self, text: str) -> bool:
"""Resolve a bare numeric reply that follows a bare ``/resume`` prompt.