@archme/cli 0.14.6 → 0.14.8

package/dist/cli.js

@@ -9653,8 +9653,7 @@ var init_launchctl = __esm({
         let r = await bootstrap();
         if (r.exitCode === 0 || r.exitCode === 17) return;
         if (r.exitCode === 5) {
-          await this.opts.spawner.run("launchctl", ["bootout", SERVICE_TARGET(this.opts.uid)]);
-          await new Promise((resolve7) => setTimeout(resolve7, 500));
+          await this.stop();
           r = await bootstrap();
           if (r.exitCode === 0 || r.exitCode === 17) return;
         }
@@ -9665,9 +9664,22 @@ var init_launchctl = __esm({
           "bootout",
           SERVICE_TARGET(this.opts.uid)
         ]);
-        if (r.exitCode !== 0 && r.exitCode !== 113) {
+        if (r.exitCode === 113) return;
+        if (r.exitCode !== 0 && r.exitCode !== 3) {
           throw new Error(`launchctl bootout failed (exit ${r.exitCode}): ${r.stderr || r.stdout}`);
         }
+        const pollMs = this.opts.stopPollMs ?? 250;
+        const deadline = Date.now() + (this.opts.stopTimeoutMs ?? 25e3);
+        const registered = async () => {
+          const p = await this.opts.spawner.run("launchctl", ["print", SERVICE_TARGET(this.opts.uid)]);
+          return !(p.exitCode === 113 || /Could not find/i.test(p.stderr));
+        };
+        while (await registered()) {
+          if (Date.now() >= deadline) {
+            throw new Error(`launchctl bootout: ${LABEL} is still registered with launchd after ${this.opts.stopTimeoutMs ?? 25e3}ms`);
+          }
+          await new Promise((resolve7) => setTimeout(resolve7, pollMs));
+        }
       }
       async enable() {
         const r = await this.opts.spawner.run("launchctl", ["enable", SERVICE_TARGET(this.opts.uid)]);
@@ -9684,7 +9696,7 @@ var init_launchctl = __esm({
       async inspect() {
         const printRes = await this.opts.spawner.run("launchctl", ["print", SERVICE_TARGET(this.opts.uid)]);
         if (printRes.exitCode === 113 || /Could not find/i.test(printRes.stderr)) {
-          return { loaded: false, running: false, pid: null, enabled: false };
+          return { loaded: false, running: false, pid: null, enabled: await this.enabled() };
         }
         if (printRes.exitCode !== 0) {
           throw new Error(`launchctl print failed (exit ${printRes.exitCode}): ${printRes.stderr || printRes.stdout}`);
@@ -9693,13 +9705,13 @@ var init_launchctl = __esm({
         const stateMatch = printRes.stdout.match(/^\s*state\s*=\s*(\S+)/m);
         const pid = pidMatch ? Number(pidMatch[1]) : null;
         const running = pid != null && stateMatch?.[1] === "running";
+        return { loaded: true, running, pid, enabled: await this.enabled() };
+      }
+      async enabled() {
         const disRes = await this.opts.spawner.run("launchctl", ["print-disabled", DOMAIN(this.opts.uid)]);
-        let enabled = true;
-        if (disRes.exitCode === 0) {
-          const re = new RegExp(`"${LABEL.replace(/\./g, "\\.")}"\\s*=>\\s*true`);
-          if (re.test(disRes.stdout)) enabled = false;
-        }
-        return { loaded: true, running, pid, enabled };
+        if (disRes.exitCode !== 0) return true;
+        const re = new RegExp(`"${LABEL.replace(/\./g, "\\.")}"\\s*=>\\s*true`);
+        return !re.test(disRes.stdout);
       }
     };
   }
@@ -10653,7 +10665,7 @@ function bakedSystemdEnv(unit) {
 function mergeUnitEnv(shell, unit) {
   const out = {};
   for (const k of ENV_KEYS_TO_BAKE) {
-    const v = shell[k] !== void 0 ? shell[k] : unit[k];
+    const v = k === "PATH" ? [...new Set(`${shell.PATH ?? ""}:${unit.PATH ?? ""}`.split(":").filter(Boolean))].join(":") : shell[k] !== void 0 ? shell[k] : unit[k];
     if (v) out[k] = v;
   }
   return out;
@@ -19354,6 +19366,31 @@ var init_imageManifest = __esm({
   }
 });
 
+// src/daemon/claimStance.ts
+function claimStance(configured, gate) {
+  if (!gate || gate.allowsClaims()) return { kind: "claim", mode: configured };
+  if (gate.isFailing?.()) return { kind: "presence_only", mode: "required_unavailable" };
+  return { kind: "hold" };
+}
+function claimRpcParams(a2) {
+  return {
+    p_device_id: a2.deviceId,
+    p_worker_id: a2.workerId,
+    p_lease_seconds: a2.leaseSeconds,
+    // Stamps presence + gates against daemon_min_version (migration 067);
+    // NULL (read failure) is below any floor server-side.
+    p_daemon_version: a2.daemonVersion,
+    // Recorded on presence only; never gates (R3 §3.4).
+    p_claude_version: a2.claudeVersion,
+    p_sandbox_mode: a2.sandboxMode
+  };
+}
+var init_claimStance = __esm({
+  "src/daemon/claimStance.ts"() {
+    "use strict";
+  }
+});
+
 // src/daemon/sandboxJob/result.ts
 import { readFile as readFile13 } from "node:fs/promises";
 function isValidNonce(nonce) {
@@ -19654,6 +19691,10 @@ var init_confinement = __esm({
       allowsClaims() {
         return this.opts.mode !== "required" || !this.failing && !this.probing;
       }
+      /** A probe has failed and no re-probe has passed since (re-probes included). */
+      isFailing() {
+        return this.failing;
+      }
       schedule(ms) {
         if (this.stopped) return;
         if (this.handle !== null) this.timers.clearTimeout(this.handle);
@@ -21829,18 +21870,18 @@ The sub-agent returns its findings; **you then apply** the fixes yourself \u2014
 ${patchSection}
 ${DIFF_RULES}`;
 }
-async function rpcClaim(ctx, deviceId) {
+async function rpcClaim(ctx, deviceId, mode) {
+  const claudeVersion = await claudeCodeVersion();
   const { data, error } = await withAuthRetry(
     "claim",
-    () => ctx.supabase.rpc("claim_archme_job", {
-      p_device_id: deviceId,
-      p_worker_id: ctx.workerId,
-      p_lease_seconds: ctx.leaseSeconds,
-      // Stamps daemon_presence.daemon_version + gates against
-      // daemon_min_version (migration 067). NULL — read failure — is
-      // treated as below any floor server-side.
-      p_daemon_version: daemonVersion
-    }),
+    () => ctx.supabase.rpc("claim_archme_job", claimRpcParams({
+      deviceId,
+      workerId: ctx.workerId,
+      leaseSeconds: ctx.leaseSeconds,
+      daemonVersion,
+      claudeVersion,
+      sandboxMode: mode
+    })),
     ctx.reLogin
   );
   if (error) {
@@ -21972,11 +22013,14 @@ async function rpcDefer(ctx, jobId, deviceId, reason, detail) {
   }
   return data != null;
 }
-async function rpcFail(ctx, jobId, deviceId, message2, metrics, logs) {
+async function rpcFail(ctx, jobId, deviceId, message2, metrics, logs, opts = {}) {
   const result = await callJobCompletionEndpoint(ctx, "fail", jobId, deviceId, {
     error: message2.slice(0, 4e3),
     metrics,
-    logs
+    logs,
+    // retry:false fails the job for good now (migration 141); absent, it
+    // requeues while attempts remain.
+    ...opts
   });
   if (!result.ok) console.error(`[${jobId}] fail error:`, result.error);
 }
@@ -22785,7 +22829,7 @@ ${logs.stderr}`, sentPrompt);
     );
     if (route2.kind === "terminal") {
       console.log(`[${job.id}] failed (sandbox request cap, not deferred): ${route2.message}`);
-      await rpcFail(ctx, job.id, deviceId, route2.message, metrics, logs);
+      await rpcFail(ctx, job.id, deviceId, route2.message, metrics, logs, { retry: false });
       return;
     }
     const plan = route2.kind === "defer" ? route2.plan : null;
@@ -22853,7 +22897,18 @@ async function dispatch(sched) {
     }
     pauseUntilMs = null;
   }
-  if (confinementGate && !confinementGate.allowsClaims()) return;
+  const stance = claimStance(sandboxMode, confinementGate);
+  if (stance.kind === "hold") return;
+  if (stance.kind === "presence_only") {
+    sched.dispatching = true;
+    try {
+      for (const { ctx, deviceId } of claimUnits(sched)) await sched.claim(ctx, deviceId, stance.mode);
+    } finally {
+      sched.dispatching = false;
+    }
+    return;
+  }
+  const mode = stance.mode;
   sched.dispatching = true;
   try {
     let atCap = false;
@@ -22865,7 +22920,7 @@ async function dispatch(sched) {
           atCap = true;
           break;
         }
-        const claimed = await claimRoundRobin(sched);
+        const claimed = await claimRoundRobin(sched, mode);
         if (!claimed) {
           slot();
           break;
@@ -22886,16 +22941,20 @@ async function dispatch(sched) {
     sched.dispatching = false;
   }
 }
-async function claimRoundRobin(sched) {
+function claimUnits(sched) {
   const units = [];
   for (const ctx of sched.sessions) {
     if (ctx.auth && ctx.auth.getRefreshToken() === null && ctx.auth.getAccessToken() === null) continue;
     for (const d of ctx.devices) units.push({ ctx, deviceId: d.deviceId });
   }
+  return units;
+}
+async function claimRoundRobin(sched, mode) {
+  const units = claimUnits(sched);
   const n2 = units.length;
   for (let i2 = 0; i2 < n2; i2++) {
     const u2 = units[(sched.rrIndex + i2) % n2];
-    const job = await sched.claim(u2.ctx, u2.deviceId);
+    const job = await sched.claim(u2.ctx, u2.deviceId, mode);
     if (job && job.id) {
       sched.rrIndex = (sched.rrIndex + i2 + 1) % n2;
       return { job, ctx: u2.ctx, deviceId: u2.deviceId };
@@ -23044,6 +23103,7 @@ async function runDaemon() {
     }
     exitDaemon(1);
   }
+  sandboxMode = sandboxSettings.mode;
   if (process.env.ARCHME_SANDBOX_SLOTS !== void 0) {
     console.log("  ARCHME_SANDBOX_SLOTS is no longer read; sandbox slots follow MAX_CONCURRENT_JOBS");
   }
@@ -23310,7 +23370,7 @@ ${signal} received, shutting down`);
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
 }
-var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, confinementGate, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
+var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, confinementGate, sandboxMode, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
 var init_run = __esm({
   "src/daemon/run.ts"() {
     "use strict";
@@ -23354,6 +23414,8 @@ var init_run = __esm({
     init_localPoller();
     init_setting();
     init_imageManifest();
+    init_claimStance();
+    init_claudeVersion();
     init_host();
     init_runSandboxedJob();
     init_inputDir();
@@ -23391,6 +23453,7 @@ var init_run = __esm({
     deviceByJob = /* @__PURE__ */ new Map();
     sandboxHost = null;
     confinementGate = null;
+    sandboxMode = "off";
     boxedJobs = /* @__PURE__ */ new Set();
     leaseLost = /* @__PURE__ */ new Set();
     prefetchOverride = null;
@@ -23574,6 +23637,9 @@ ${ANCHOR_VERIFICATION}`;
       setConfinementGate(gate) {
         confinementGate = gate;
       },
+      setSandboxMode(mode) {
+        sandboxMode = mode;
+      },
       // Daemon-version hooks for tests / introspection. The real value is
       // populated at runDaemon boot from package.json; tests can stub.
       setDaemonVersion(v) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.14.6",
+  "version": "0.14.8",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -38,7 +38,7 @@
     "build": "node scripts/build.mjs",
     "build:check": "node scripts/smoke-build.mjs",
     "prepublishOnly": "npm run build:check",
-    "test": "npx tsx --test --experimental-test-module-mocks 'src/**/*.test.ts'",
+    "test": "node --liftoff-only --import tsx --test --experimental-test-module-mocks 'src/**/*.test.ts'",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/sandbox-image.json

@@ -1,4 +1,4 @@
 {
   "image": "ghcr.io/architectme/archme-job",
-  "digest": "sha256:5fb1cc6d6fc5199820c05599db9ebe085b180950357686c87cfae4b9440f564b"
+  "digest": "sha256:9e4d5cd98c8d72bd14fadcf5063b3cd8c45dc2f65e2fe2ad44e141f5bfe0edbf"
 }