@amistio/cli 0.1.56 → 0.1.58

package/README.md

@@ -95,15 +95,17 @@ Approved implementation work uses Git as the handoff boundary. During worktree p
 
 Failed or stale work can be requeued from the web Tasks panel. Requeue creates a new linked work attempt and preserves the original terminal attempt for audit history; Requeue safe sends one backend batch that recomputes safe candidates, reports already-active and skipped rows, and still uses linked attempts. Requeue is blocked while equivalent work is already active, when the paired runner does not advertise the needed work kind, or when the latest linked attempt repeats the same sanitized blocker fingerprint. Repeated runner setup, handoff, policy, verification, and worktree blockers require root-cause repair before another linked attempt. Completed implementation status is separate from proof: queue `implementationVerification` from Tasks when a plan needs source-aware evidence before cleanup or implementation status decisions.
 
-Patch-context failures are typed recovery states. If a local tool reports a stale `apply_patch` context miss, such as an expected-lines mismatch, the runner marks the work with patch-drift recovery metadata and safe next actions instead of uploading raw patch output or leaving a generic failed row. Retryable API failures during implementation finalization are staged in the user-level Amistio finalization outbox and replayed before the runner claims more work, so a transient `500` does not require rerunning the local AI tool. When completion queues a required implementation Test gate, the source-work finalization remains pending locally, compatible runners claim the gate before unrelated implementation work, and finalization replays after the gate passes.
+Patch-context failures are typed recovery states. If a local tool reports a stale `apply_patch` context miss, such as an expected-lines mismatch, the runner marks the work with patch-drift recovery metadata and safe next actions instead of uploading raw patch output or leaving a generic failed row. Retryable API failures during implementation finalization are staged in the user-level Amistio finalization outbox and replayed before the runner claims more work, so a transient `500` does not require rerunning the local AI tool. When completion queues a required implementation Test gate, the source-work finalization remains pending locally, compatible runners claim the gate before unrelated implementation work, and finalization replays after the gate passes. If finalization replay finds that the stored work claim belongs to a forgotten, missing, stale, offline, or lease-expired runner, the CLI requests abandoned-claim recovery and retries only after the server safely adopts the claim.
 
 Runner setup and local-tool execution use bounded failure controls. During Git worktree preflight, `amistio run --watch` repairs safe stale Git registrations when the target worktree directory is missing and Git marks the registration prunable; dirty, present, or ambiguous worktrees are preserved. Other Git worktree preflight failures are retried by releasing the claim for another attempt, then fail the work item after `--max-preflight-attempts` attempts, defaulting to 3. Active local-tool runs renew the work lease, and `--tool-timeout-seconds` caps tool execution, defaulting to 1800 seconds.
 
 The environment doctor blocks work before local AI/tool execution when `git`, `node`, Corepack, the package manager, required package scripts, dependencies, setup allowlist, Docker, or the requested execution profile is not ready. Foreground, background, and startup-service runners accept `--execution-profile`; use `--setup-package-manager-install` with `hostWorktreeWithSetup` when the runner may run the fixed package-manager install step in the execution worktree. Work and Runner surfaces receive sanitized profile/readiness metadata only; raw host paths, command lines, environment values, and secrets are not uploaded. Watch mode also performs a Git PATH preflight before auto-sync or work claiming. If the runner reports that Git is not available to the runner PATH, install Git or restart the foreground, background, or startup-service runner from an environment where `git --version` works. On macOS, service and GUI-launched runner environments may not inherit the same PATH as an interactive shell, so restart or reinstall the service after changing PATH.
 
-Runner watch mode defaults to bounded parallel claim lanes, capped at 4. `--max-concurrent-work <count>` lowers or explicitly sets the advertised lane count; use `--max-concurrent-work 1` only when you intentionally want serial execution. The server enforces one active lease per runner lane, honors the advertised capacity, and keeps equivalent implementation scopes serialized through Git worktree locks; use separate lanes for independent work, not multiple attempts at the same ADR scope. Before local tool execution, the runner records a bounded user-level active claim with work item, lane, lease, implementation scope, and worktree key, then releases it on completion or failure; if another local lane already owns the same work or worktree, the runner skips execution and releases the server claim when possible.
+Runner watch mode defaults to bounded parallel claim lanes, capped at 8. `--max-concurrent-work <count>` lowers or explicitly sets the advertised lane count; use `--max-concurrent-work 1` only when you intentionally want serial execution. The server enforces one active lease per runner lane, honors the advertised capacity, and keeps equivalent implementation scopes serialized through Git worktree locks; use separate lanes for independent work, not multiple attempts at the same ADR scope. Before local tool execution, the runner records a bounded user-level active claim with work item, lane, lease, implementation scope, and worktree key, then releases it on completion or failure; if another local lane already owns the same work or worktree, the runner skips execution and releases the server claim when possible.
 
-Watch mode prints a completed-work success once per work item, keeps fresh completion visible briefly, and returns old completed work to the ready state when no queued, running, blocked, failed, review, or runner-readiness action needs attention.
+Current runners recover abandoned server claims without impersonating the old owner. If a work item is still claimed by a forgotten, missing, offline, stale, or lease-expired runner, a compatible runner asks the API to release or adopt that claim through an audited recovery path before normal claiming or pending finalization replay continues. Fresh live claims still reject non-owner renewals, releases, and finalization attempts. If a project has no compatible runner, work waits for setup until one is paired and heartbeating.
+
+Watch mode prints a completed-work success once per work item, keeps fresh completion visible briefly, and returns old completed work to the ready state when no queued, running, blocked, failed, review, or runner-readiness action needs attention. Unchanged idle-ready status is printed once and then stays quiet until the next action changes.
 
 Known validation failures such as `unsafe_context_path` are printed with attention-needed next steps. For project-context refresh path-safety failures, deploy the latest web/API fix, update and restart the runner when applicable, retry the refresh, and capture only bounded non-secret output if it repeats.
 

package/dist/index.js

@@ -9,6 +9,7 @@ import { Command } from "commander";
 
 // ../shared/src/schemas.ts
 import { z } from "zod";
+var runnerMaxConcurrentWorkLimit = 8;
 var isoDateTimeSchema = z.string().datetime({ offset: true });
 var itemTypeSchema = z.enum([
   "account",
@@ -601,6 +602,14 @@ var runnerResourceUsageSchema = z.object({
   systemLoadAverage15m: z.number().nonnegative().optional()
 });
 var runnerClaimLaneIdSchema = z.string().trim().min(1).max(80);
+var abandonedRunnerClaimRecoveryReasonSchema = z.enum([
+  "claimOwnerRemoved",
+  "claimOwnerMissing",
+  "claimOwnerOffline",
+  "claimOwnerStale",
+  "leaseExpired",
+  "pendingFinalizationOwnershipLost"
+]);
 var workIsolationModeSchema = z.enum(["none", "primaryCheckout", "branch", "gitWorktree"]);
 var runnerExecutionEnvironmentProfileSchema = z.enum(["hostWorktree", "hostWorktreeWithSetup", "dockerWorkspace", "cloudSandbox"]);
 var runnerEnvironmentBlockerReasonSchema = z.enum([
@@ -900,6 +909,10 @@ var workItemSchema = baseItemSchema.extend({
   claimLeaseId: z.string().min(1).optional(),
   claimAttempt: z.number().int().nonnegative().optional(),
   leaseExpiresAt: isoDateTimeSchema.optional(),
+  previousClaimedByRunnerId: z.string().min(1).optional(),
+  claimRecoveryReason: abandonedRunnerClaimRecoveryReasonSchema.optional(),
+  claimRecoveredByRunnerId: z.string().min(1).optional(),
+  claimRecoveredAt: isoDateTimeSchema.optional(),
   controllingAdrId: z.string().min(1).optional(),
   implementationScopeId: z.string().min(1).optional(),
   executionBranch: z.string().min(1).optional(),
@@ -948,8 +961,8 @@ var runnerHeartbeatItemSchema = baseItemSchema.extend({
   supportedExecutionEnvironmentProfiles: z.array(runnerExecutionEnvironmentProfileSchema).optional(),
   currentExecutionEnvironmentProfile: runnerExecutionEnvironmentProfileSchema.optional(),
   environmentReadiness: runnerEnvironmentReadinessSchema.optional(),
-  maxConcurrentWork: z.number().int().min(1).max(4).optional(),
-  activeClaimLaneIds: z.array(runnerClaimLaneIdSchema).max(4).optional(),
+  maxConcurrentWork: z.number().int().min(1).max(runnerMaxConcurrentWorkLimit).optional(),
+  activeClaimLaneIds: z.array(runnerClaimLaneIdSchema).max(runnerMaxConcurrentWorkLimit).optional(),
   currentWorkItemId: z.string().min(1).optional(),
   currentImplementationScopeId: z.string().min(1).optional(),
   currentWorktreeKey: z.string().min(1).optional(),
@@ -1902,11 +1915,20 @@ var implementationTestGateItemSchema = baseItemSchema.extend({
   source: implementationTestGateSourceSchema.default("system"),
   sourceWorkItemId: z.string().min(1),
   gateWorkItemId: z.string().min(1).optional(),
+  generatedDraftId: z.string().min(1).optional(),
+  changeId: z.string().min(1).optional(),
   repositoryLinkId: z.string().min(1).optional(),
+  implementationScopeId: z.string().min(1).optional(),
   runnerId: z.string().min(1).optional(),
   planDocumentId: z.string().min(1).optional(),
   planDocumentRevision: z.number().int().nonnegative().optional(),
   testProfileId: z.string().min(1).optional(),
+  autopilotAuthorization: autopilotAuthorizationSchema.optional(),
+  autopilotAuthorizationId: z.string().min(1).optional(),
+  autopilotCandidateId: z.string().min(1).optional(),
+  autopilotCandidateType: autopilotCandidateTypeSchema.optional(),
+  autopilotClassificationOutcome: autopilotClassificationOutcomeSchema.optional(),
+  autopilotPolicyVersion: z.string().trim().min(1).max(80).optional(),
   outcome: implementationTestGateOutcomeSchema.optional(),
   result: implementationTestGateResultSchema.optional(),
   summary: z.string().trim().min(1).max(2e3).optional(),
@@ -2890,6 +2912,9 @@ var AmistioApiError = class extends Error {
 function isForgottenRunnerApiError(error) {
   return error instanceof AmistioApiError && error.status === 403 && error.detail.includes("This runner was forgotten");
 }
+function isWorkItemNotClaimedByRunnerApiError(error) {
+  return error instanceof AmistioApiError && error.status === 403 && error.detail.includes("Work item is not claimed by this runner.");
+}
 function isRetryableApiError(error) {
   if (error instanceof AmistioApiError) {
     return error.status === 408 || error.status === 429 || error.status >= 500;
@@ -3146,6 +3171,21 @@ var ApiClient = class {
       }
     );
   }
+  async recoverAbandonedWorkClaim(projectId, workItemId, input) {
+    return this.request(
+      `/projects/${projectId}/work-items/${workItemId}/claim-recovery`,
+      z3.object({
+        status: z3.enum(["recovered", "notNeeded"]),
+        workItem: workItemSchema,
+        message: z3.string(),
+        recoveryReason: abandonedRunnerClaimRecoveryReasonSchema.optional()
+      }),
+      {
+        method: "POST",
+        body: JSON.stringify(input)
+      }
+    );
+  }
   async submitBrainGenerationResult(projectId, workItemId, result) {
     return this.request(
       `/projects/${projectId}/work-items/${workItemId}/generation-result`,
@@ -5822,7 +5862,7 @@ function shouldPrintWatchState(action, previous, nowMs, reminderMs = watchStateR
   if (!previous || previous.key !== key) {
     return true;
   }
-  if (action.kind === "workCompleted") {
+  if (action.kind === "workCompleted" || action.kind === "idle") {
     return false;
   }
   return nowMs - previous.printedAtMs >= reminderMs;
@@ -11221,7 +11261,7 @@ var DEFAULT_MAX_PREFLIGHT_ATTEMPTS = 3;
 var DEFAULT_TOOL_TIMEOUT_SECONDS = 30 * 60;
 var RUNNER_WORK_LEASE_SECONDS = 300;
 var RUNNER_WORK_LEASE_RENEWAL_MS = 12e4;
-var MAX_CONCURRENT_RUNNER_WORK = 4;
+var MAX_CONCURRENT_RUNNER_WORK = runnerMaxConcurrentWorkLimit;
 var runnerSupportedWorkKinds = ["brainGeneration", "implementation", "promptBatch", "planRevision", "assistantQuestion", "impactPreview", "issueDiagnosis", "securityPostureScan", "appEvaluationScan", "brainConsolidationScan", "projectContextRefresh", "implementationVerification", "testQualityScan", "implementationTestGate"];
 program.name("amistio").description("Amistio project brain CLI").version(CLI_VERSION);
 program.command("init").description("Create Amistio control-plane folders for a new project").option("--root <path>", "Repository root", defaultRoot).action(async (options) => {
@@ -13512,13 +13552,24 @@ async function submitImplementationFinalizationEntry(apiClient, entry, options =
         ...entry.telemetry,
         message: message2,
         blockerReason: message2,
-        releaseClaim: true
+        releaseClaim: true,
+        releaseReason: "implementationTestGatePending"
       }).catch((releaseError) => {
         console.error(`Could not release implementation work ${entry.workItemId} while waiting for its test gate: ${truncateLogExcerpt(errorMessage7(releaseError))}`);
       });
       console.log(message2);
       return { status: "deferred", message: message2, retryable: true };
     }
+    if (isWorkItemNotClaimedByRunnerApiError(error)) {
+      const recovered = await recoverPendingImplementationFinalizationClaim(apiClient, entry);
+      if (recovered) {
+        return submitImplementationFinalizationEntry(apiClient, entry, options);
+      }
+      await markImplementationFinalizationRetry(entry, "pending_finalization_ownership_lost");
+      const message2 = `Pending implementation finalization ${entry.workItemId} is waiting for abandoned claim recovery before replay can continue.`;
+      console.log(message2);
+      return { status: "deferred", message: message2, retryable: true };
+    }
     const detail = truncateLogExcerpt(errorMessage7(error));
     if (isRetryableApiError(error)) {
       const updated = await markImplementationFinalizationRetry(entry, detail);
@@ -13548,6 +13599,28 @@ async function submitImplementationFinalizationEntry(apiClient, entry, options =
   }
   return { status: "completed", workItem: response.workItem };
 }
+async function recoverPendingImplementationFinalizationClaim(apiClient, entry) {
+  console.log(`Work claim owner is gone for ${entry.workItemId}; requesting abandoned-claim recovery before retrying finalization.`);
+  try {
+    const recovery = await apiClient.recoverAbandonedWorkClaim(entry.projectId, entry.workItemId, {
+      runnerId: entry.runnerId,
+      repositoryLinkId: entry.repositoryLinkId,
+      reason: "pendingFinalizationOwnershipLost",
+      mode: "adopt",
+      ...entry.telemetry.claimLaneId ? { claimLaneId: entry.telemetry.claimLaneId } : {},
+      ...entry.telemetry.machineId ? { machineId: entry.telemetry.machineId } : {},
+      leaseSeconds: RUNNER_WORK_LEASE_SECONDS,
+      supportedWorkKinds: runnerSupportedWorkKinds,
+      supportsBranchIsolation: true,
+      supportsGitWorktreeIsolation: true,
+      maxConcurrentWork: 1
+    });
+    return recovery.workItem.claimedByRunnerId === entry.runnerId;
+  } catch (error) {
+    console.error(`Could not recover abandoned claim for ${entry.workItemId}: ${truncateLogExcerpt(errorMessage7(error))}`);
+    return false;
+  }
+}
 function runnerMilestoneStatusFromWorkStatus(status) {
   if (status === "completed" || status === "failed" || status === "running" || status === "blocked") return status;
   if (status === "approved" || status === "drafted") return "queued";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amistio/cli",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "type": "module",
   "repository": {
     "type": "git",