| 1 | //! Sub-agent concurrency/timeout limits and their clamp resolvers. |
| 2 | //! |
| 3 | //! Pure numeric/string limit constants plus the two private clamp helpers that |
| 4 | //! operate solely on them. Extracted verbatim from `config.rs`; the constants |
| 5 | //! are re-exported via `pub use subagent_limits::*;` (preserving each item's |
| 6 | //! `pub`/`pub(crate)` visibility) and the resolvers are pulled back into |
| 7 | //! `config.rs` with a private `use`, so no new external surface is created |
| 8 | //! (#3311). |
| 9 | |
| 10 | /// Temporary high-throughput default while the shared-context cutover makes |
| 11 | /// agent fanout cheap. This should eventually be governed by API/backpressure |
| 12 | /// budgets rather than memory-driven count throttles. |
| 13 | pub const DEFAULT_MAX_SUBAGENTS: usize = 64; |
| 14 | /// User-configurable ceiling for concurrent sub-agent execution. Keep this |
| 15 | /// above the default so operators can opt into larger API-bound fanout without |
| 16 | /// code changes while the full resource budget gate lands. |
| 17 | pub const MAX_SUBAGENTS: usize = 128; |
| 18 | /// Upper bound for queued + running sub-agent admissions. This is deliberately |
| 19 | /// higher than the instantaneous concurrency cap so Workflow-style fanout can |
| 20 | /// opt into large bounded populations without unbounded queue growth. |
| 21 | pub const MAX_SUBAGENT_ADMISSION: usize = 1024; |
| 22 | /// Default per-step DeepSeek API timeout for sub-agent requests, in seconds. |
| 23 | /// Raised from the legacy 120s: a live-but-slow reasoning call routinely |
| 24 | /// outlasts two minutes, and a timed-out attempt is now retried with backoff |
| 25 | /// before the step interrupts, so the default should only trip on genuinely |
| 26 | /// stuck calls (FINISH-0.9.4 entry #40). Applies when `[subagents] |
| 27 | /// api_timeout_secs` is unset (#1806, #1808). |
| 28 | pub const DEFAULT_SUBAGENT_API_TIMEOUT_SECS: u64 = 600; |
| 29 | /// Minimum accepted `[subagents] api_timeout_secs`. Anything lower (including |
| 30 | /// `0`, which would otherwise produce an immediate timeout footgun) clamps |
| 31 | /// up to this value before the runtime sees it. |
| 32 | pub const MIN_SUBAGENT_API_TIMEOUT_SECS: u64 = 1; |
| 33 | /// Maximum accepted `[subagents] api_timeout_secs` (60 minutes). The cap |
| 34 | /// keeps a misconfigured per-step timeout from masking real model/network |
| 35 | /// hangs forever. |
| 36 | pub const MAX_SUBAGENT_API_TIMEOUT_SECS: u64 = 3600; |
| 37 | /// Default wall-clock budget for a single sub-agent tool execution, in |
| 38 | /// seconds. This is the single source of truth for the default: |
| 39 | /// `tools::subagent::DEFAULT_TOOL_TIMEOUT` derives from it, so the heartbeat |
| 40 | /// floor below and the timeout actually applied to a running tool can never |
| 41 | /// drift apart. |
| 42 | pub const DEFAULT_SUBAGENT_TOOL_TIMEOUT_SECS: u64 = 300; |
| 43 | /// Default wall-clock interval without manager-visible sub-agent progress |
| 44 | /// before a running child can be auto-cancelled to release its slot (#2614). |
| 45 | pub const DEFAULT_SUBAGENT_HEARTBEAT_TIMEOUT_SECS: u64 = 300; |
| 46 | /// Minimum accepted `[subagents] heartbeat_timeout_secs`. |
| 47 | pub const MIN_SUBAGENT_HEARTBEAT_TIMEOUT_SECS: u64 = 30; |
| 48 | /// Maximum accepted `[subagents] heartbeat_timeout_secs` (1 hour). |
| 49 | pub const MAX_SUBAGENT_HEARTBEAT_TIMEOUT_SECS: u64 = 3600; |
| 50 | /// Default per-SSE-chunk idle timeout, in seconds. |
| 51 | pub const DEFAULT_STREAM_CHUNK_TIMEOUT_SECS: u64 = 900; |
| 52 | /// Minimum accepted stream chunk timeout. |
| 53 | pub const MIN_STREAM_CHUNK_TIMEOUT_SECS: u64 = 1; |
| 54 | /// Maximum accepted stream chunk timeout. |
| 55 | pub const MAX_STREAM_CHUNK_TIMEOUT_SECS: u64 = 3600; |
| 56 | pub(crate) const STREAM_CHUNK_TIMEOUT_ENV: &str = "CODEWHALE_STREAM_IDLE_TIMEOUT_SECS"; |
| 57 | /// Legacy alias for [`STREAM_CHUNK_TIMEOUT_ENV`]. |
| 58 | pub(crate) const LEGACY_STREAM_CHUNK_TIMEOUT_ENV: &str = "DEEPSEEK_STREAM_IDLE_TIMEOUT_SECS"; |
| 59 | |
| 60 | pub(crate) fn resolve_subagent_api_timeout_secs(raw: Option<u64>) -> u64 { |
| 61 | let raw = raw.unwrap_or(DEFAULT_SUBAGENT_API_TIMEOUT_SECS); |
| 62 | if raw == 0 { |
| 63 | return DEFAULT_SUBAGENT_API_TIMEOUT_SECS; |
| 64 | } |
| 65 | raw.clamp(MIN_SUBAGENT_API_TIMEOUT_SECS, MAX_SUBAGENT_API_TIMEOUT_SECS) |
| 66 | } |
| 67 | |
| 68 | pub(crate) fn resolve_subagent_heartbeat_timeout_secs( |
| 69 | raw: Option<u64>, |
| 70 | api_timeout_secs: u64, |
| 71 | tool_timeout_secs: u64, |
| 72 | ) -> u64 { |
| 73 | let raw = raw.unwrap_or(DEFAULT_SUBAGENT_HEARTBEAT_TIMEOUT_SECS); |
| 74 | let configured = if raw == 0 { |
| 75 | DEFAULT_SUBAGENT_HEARTBEAT_TIMEOUT_SECS |
| 76 | } else { |
| 77 | raw.clamp( |
| 78 | MIN_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 79 | MAX_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 80 | ) |
| 81 | }; |
| 82 | let min_for_api = api_timeout_secs.saturating_add(30).clamp( |
| 83 | MIN_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 84 | MAX_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 85 | ); |
| 86 | // A single tool execution may legitimately run up to `tool_timeout_secs` |
| 87 | // without the child touching its progress heartbeat (activity is recorded |
| 88 | // at step boundaries, not mid-tool), so the floor must also sit above the |
| 89 | // tool timeout. Deriving it from `api_timeout_secs` alone let a low |
| 90 | // `[subagents] api_timeout_secs` pull the floor under a long tool, and |
| 91 | // cleanup then killed a legitimately-working child (2026-08-04 sub-agent |
| 92 | // hunt, finding 4). |
| 93 | let min_for_tool = tool_timeout_secs.saturating_add(30).clamp( |
| 94 | MIN_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 95 | MAX_SUBAGENT_HEARTBEAT_TIMEOUT_SECS, |
| 96 | ); |
| 97 | configured.max(min_for_api).max(min_for_tool) |
| 98 | } |
| 99 |