fix: F1 fallback - add inferProviderFromBaseURL for bare model names

- Add inferProviderFromBaseURL() helper using URL API (hostname.endsWith)
- Add short-circuit guard to prevent baseURL from overriding qualified model refs
- Fix void 0 to undefined for consistency

Addresses F1 feedback from PR #618 review

Author: jlin53882

index.ts

@@ -702,6 +702,29 @@ function splitProviderModel(modelRef: string): { provider?: string; model?: stri
   return { model: s };
 }
 
+/**
+ * 當 modelRef 是 bare name（無 / 前綴）時，從 baseURL 推斷 provider。
+ * 使用 hostname.endsWith() 避免 fake-minimax.io 這類攻擊
+ */
+function inferProviderFromBaseURL(baseURL: string | undefined): string | undefined {
+  if (!baseURL) return undefined;
+
+  try {
+    const url = new URL(baseURL);
+    const hostname = url.hostname.toLowerCase();
+
+    // 使用 endsWith 避免子網域欺騙
+    if (hostname.endsWith("minimax.io")) return "minimax-portal";
+    if (hostname.endsWith("openai.com")) return "openai";
+    if (hostname.endsWith("anthropic.com")) return "anthropic";
+
+    return undefined;
+  } catch {
+    // 無效 URL 回傳 undefined
+    return undefined;
+  }
+}
+
 function asNonEmptyString(value: unknown): string | undefined {
   if (typeof value !== "string") return undefined;
   const trimmed = value.trim();
@@ -1158,9 +1181,14 @@ async function generateReflectionText(params: {
       onLog: onRetryLog,
       execute: async () => {
         const runEmbeddedPiAgent = await loadEmbeddedPiRunner();
-        const modelRef = resolveAgentPrimaryModelRef(params.cfg, params.agentId)
-          ?? (((params.cfg as Record<string, unknown>)?.llm as Record<string, unknown>)?.model as string | undefined);
-        const { provider, model } = modelRef ? splitProviderModel(modelRef) : { provider: void 0, model: void 0 };
+        const cfg = params.cfg as Record<string, unknown>;
+        const llmConfig = cfg?.llm as Record<string, unknown> | undefined;
+        const modelRef =
+          (resolveAgentPrimaryModelRef(params.cfg, params.agentId) as string | undefined)
+          ?? (llmConfig?.model as string | undefined);
+        const split = modelRef ? splitProviderModel(modelRef) : { provider: undefined, model: undefined };
+        const provider = split.provider ?? inferProviderFromBaseURL(llmConfig?.baseURL as string | undefined);
+        const model = split.model;
         const embeddedTimeoutMs = Math.max(params.timeoutMs + 5000, 15000);
 
         return await withTimeout(

src/store.ts

@@ -64,6 +64,11 @@ async function loadLockfile(): Promise<any> {
   return lockfileModule;
 }
 
+/** For unit testing: override the lockfile module with a mock. */
+export function __setLockfileModuleForTests(module: any): void {
+  lockfileModule = module;
+}
+
 export const loadLanceDB = async (): Promise<
   typeof import("@lancedb/lancedb")
 > => {
@@ -209,11 +214,70 @@ export class MemoryStore {
       try { mkdirSync(dirname(lockPath), { recursive: true }); } catch {}
       try { const { writeFileSync } = await import("node:fs"); writeFileSync(lockPath, "", { flag: "wx" }); } catch {}
     }
+    // 【修復 #415】調整 retries：max wait 從 ~3100ms → ~151秒
+    // 指數退避：1s, 2s, 4s, 8s, 16s, 30s×5，總計約 151 秒
+    // ECOMPROMISED 透過 onCompromised callback 觸發（非 throw），使用 flag 機制正確處理
+    let isCompromised = false;
+    let compromisedErr: unknown = null;
+    let fnSucceeded = false;
+    let fnError: unknown = null;
+
     const release = await lockfile.lock(lockPath, {
-      retries: { retries: 5, factor: 2, minTimeout: 100, maxTimeout: 2000 },
-      stale: 10000,
+      retries: {
+        retries: 10,       // 從 5 → 10，讓 max wait 可覆蓋更長的 event loop block
+        factor: 2,
+        minTimeout: 1000, // 從 100 → 1000，避免過度密集重試打爆系統
+        maxTimeout: 30000, // 從 2000 → 30000，讓單次重試等待夠長
+      },
+      stale: 10000, // 10 秒後視為 stale，觸發 ECOMPROMISED callback
+                     // 注意：ECOMPROMISED 是 ambiguous degradation 訊號，mtime 無法區分
+                     // "holder 崩潰" vs "holder event loop 阻塞"，所以不嘗試區分
+      onCompromised: (err: unknown) => {
+        // 【修復 #415 關鍵】必須是同步 callback
+        // setLockAsCompromised() 不等待 Promise，async throw 無法傳回 caller
+        isCompromised = true;
+        compromisedErr = err;
+      },
     });
-    try { return await fn(); } finally { await release(); }
+
+    try {
+      const result = await fn();
+      fnSucceeded = true;
+      return result;
+    } catch (e: unknown) {
+      fnError = e;
+      throw e;
+    } finally {
+      if (isCompromised) {
+        // fnError 優先：fn() 失敗時，fn 的錯誤比 compromised 重要
+        if (fnError !== null) {
+          throw fnError;
+        }
+        // fn() 尚未完成就 compromised → throw，讓 caller 知道要重試
+        if (!fnSucceeded) {
+          throw compromisedErr as Error;
+        }
+        // fn() 成功執行，但 lock 在執行期間被標記 compromised
+        // 正確行為：回傳成功結果（資料已寫入），明確告知 caller 不要重試
+        console.warn(
+          `[memory-lancedb-pro] Returning successful result despite compromised lock at "${lockPath}". ` +
+          `Callers must not retry this operation automatically.`,
+        );
+        // 【修復 #415】compromised 後 release() 會回 ERELEASED，忽略即可
+        // 重要：不要在這裡 return！否則 finally 的 return 會覆蓋 try 的 return 值
+        try {
+          await release();
+        } catch (e: unknown) {
+          if ((e as NodeJS.ErrnoException).code === 'ERELEASED') {
+            // ERELEASED 是預期行為，不做任何事，讓 try 的 return 值通過
+          } else {
+            throw e; // 其他錯誤照拋
+          }
+        }
+      } else {
+        await release();
+      }
+    }
   }
 
   get dbPath(): string {
@@ -387,9 +451,10 @@ export class MemoryStore {
     return this.runWithFileLock(async () => {
       try {
         await this.table!.add([fullEntry]);
-      } catch (err: any) {
-        const code = err.code || "";
-        const message = err.message || String(err);
+      } catch (err: unknown) {
+        const e = err as { code?: string; message?: string };
+        const code = e.code || "";
+        const message = e.message || String(err);
         throw new Error(
           `Failed to store memory in "${this.config.dbPath}": ${code} ${message}`,
         );
@@ -444,12 +509,6 @@ export class MemoryStore {
     return res.length > 0;
   }
 
-  /** Lightweight total row count via LanceDB countRows(). */
-  async count(): Promise<number> {
-    await this.ensureInitialized();
-    return await this.table!.countRows();
-  }
-
   async getById(id: string, scopeFilter?: string[]): Promise<MemoryEntry | null> {
     await this.ensureInitialized();
 

test/cross-process-lock.test.mjs

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import jitiFactory from "jiti";
 
 const jiti = jitiFactory(import.meta.url, { interopDefault: true });
-const { MemoryStore } = jiti("../src/store.ts");
+const { MemoryStore, __setLockfileModuleForTests } = jiti("../src/store.ts");
 
 function makeStore() {
   const dir = mkdtempSync(join(tmpdir(), "memory-lancedb-pro-lock-"));
@@ -26,6 +26,46 @@ function makeEntry(i) {
 }
 
 describe("Cross-process file lock", () => {
+  it("returns fn() result when onCompromised fires after fn() succeeds", async () => {
+    // Regression test: fn() succeeded → isCompromised=true → finally must NOT throw
+    // P1 bug: finally { return; } overrides try return with undefined (wrong)
+    // Fix: fnSucceeded flag so finally knows whether fn() completed
+    // Bug 2 fix: release() returns ERELEASED after compromised, finally must handle it
+    const { store, dir } = makeStore();
+    let compromiseCallback;
+    let lockReleased = false; // 模擬 proper-lockfile 的 lock.released 行為
+
+    __setLockfileModuleForTests({
+      lock: async (_lockPath, options) => {
+        compromiseCallback = options.onCompromised;
+        // 模擬 proper-lockfile: onCompromised 會設定 lock.released=true
+        // release() 被呼叫時，若 lockReleased=true，回 ERELEASED
+        return async () => {
+          if (lockReleased) {
+            const e = Object.assign(new Error("Lock is already released"), { code: "ERELEASED" });
+            throw e;
+          }
+        };
+      },
+    });
+
+    try {
+      const result = await store.runWithFileLock(async () => {
+        // Simulate stale timeout firing DURING fn() execution
+        // 這會觸發 onCompromised，設定 lockReleased=true
+        compromiseCallback?.(Object.assign(new Error("stale lock"), { code: "ECOMPROMISED" }));
+        lockReleased = true; // 模擬 setLockAsCompromised 設定 lock.released=true
+        return "success-value";
+      });
+
+      // MUST return the actual result, NOT undefined
+      assert.strictEqual(result, "success-value");
+    } finally {
+      __setLockfileModuleForTests(null);
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("creates .memory-write.lock file on first write", async () => {
     const { store, dir } = makeStore();
     try {
@@ -116,4 +156,77 @@ describe("Cross-process file lock", () => {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  it("fn() error takes priority over compromised error", async () => {
+    // fnError 優先於 compromisedErr：fn() 失敗時，fn 的錯誤比 compromised 重要
+    const { store, dir } = makeStore();
+    let compromiseCallback;
+    let lockReleased = false;
+
+    __setLockfileModuleForTests({
+      lock: async (_lockPath, options) => {
+        compromiseCallback = options.onCompromised;
+        return async () => {
+          if (lockReleased) {
+            throw Object.assign(new Error("Lock is already released"), { code: "ERELEASED" });
+          }
+        };
+      },
+    });
+
+    try {
+      await assert.rejects(
+        async () => {
+          await store.runWithFileLock(async () => {
+            // compromised fires first, then fn() throws
+            compromiseCallback?.(Object.assign(new Error("stale lock"), { code: "ECOMPROMISED" }));
+            lockReleased = true;
+            throw Object.assign(new Error("fn error"), { code: "EFNERROR" });
+          });
+        },
+        (e) => {
+          // 應該 throw fnError，不是 compromisedErr 或 ERELEASED
+          assert.strictEqual(e.code, "EFNERROR", "should throw fnError, not compromisedErr");
+          return true;
+        },
+      );
+    } finally {
+      __setLockfileModuleForTests(null);
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  // 備註：以下情境無法有效測試
+  // "fn() 尚未完成就 compromised"：當 fn() 真的 pending 不結束時，
+  // finally 不會執行（finally 只在 fn() resolve/reject 後才執行）。
+  // 這是 JS Promise 語義，無法從外部打斷。實際行為：caller 會跟著一起 hang。
+  // 此情境的正確處理方式是 caller 自行實作 timeout，runWithFileLock 層面無法處理。
+
+  it("non-compromised release() error propagates", async () => {
+    // 非 compromised 時 release() 失敗，應往外拋
+    const { store, dir } = makeStore();
+
+    __setLockfileModuleForTests({
+      lock: async (_lockPath, _options) => {
+        return async () => {
+          throw Object.assign(new Error("release failed"), { code: "ERLSEFAIL" });
+        };
+      },
+    });
+
+    try {
+      await assert.rejects(
+        async () => {
+          await store.runWithFileLock(async () => "success");
+        },
+        (e) => {
+          assert.strictEqual(e.code, "ERLSEFAIL", "should propagate release error");
+          return true;
+        },
+      );
+    } finally {
+      __setLockfileModuleForTests(null);
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });