@archme/cli 0.14.7 → 0.14.8

package/dist/cli.js

@@ -19366,6 +19366,31 @@ var init_imageManifest = __esm({
   }
 });
 
+// src/daemon/claimStance.ts
+function claimStance(configured, gate) {
+  if (!gate || gate.allowsClaims()) return { kind: "claim", mode: configured };
+  if (gate.isFailing?.()) return { kind: "presence_only", mode: "required_unavailable" };
+  return { kind: "hold" };
+}
+function claimRpcParams(a2) {
+  return {
+    p_device_id: a2.deviceId,
+    p_worker_id: a2.workerId,
+    p_lease_seconds: a2.leaseSeconds,
+    // Stamps presence + gates against daemon_min_version (migration 067);
+    // NULL (read failure) is below any floor server-side.
+    p_daemon_version: a2.daemonVersion,
+    // Recorded on presence only; never gates (R3 §3.4).
+    p_claude_version: a2.claudeVersion,
+    p_sandbox_mode: a2.sandboxMode
+  };
+}
+var init_claimStance = __esm({
+  "src/daemon/claimStance.ts"() {
+    "use strict";
+  }
+});
+
 // src/daemon/sandboxJob/result.ts
 import { readFile as readFile13 } from "node:fs/promises";
 function isValidNonce(nonce) {
@@ -19666,6 +19691,10 @@ var init_confinement = __esm({
       allowsClaims() {
         return this.opts.mode !== "required" || !this.failing && !this.probing;
       }
+      /** A probe has failed and no re-probe has passed since (re-probes included). */
+      isFailing() {
+        return this.failing;
+      }
       schedule(ms) {
         if (this.stopped) return;
         if (this.handle !== null) this.timers.clearTimeout(this.handle);
@@ -21841,18 +21870,18 @@ The sub-agent returns its findings; **you then apply** the fixes yourself \u2014
 ${patchSection}
 ${DIFF_RULES}`;
 }
-async function rpcClaim(ctx, deviceId) {
+async function rpcClaim(ctx, deviceId, mode) {
+  const claudeVersion = await claudeCodeVersion();
   const { data, error } = await withAuthRetry(
     "claim",
-    () => ctx.supabase.rpc("claim_archme_job", {
-      p_device_id: deviceId,
-      p_worker_id: ctx.workerId,
-      p_lease_seconds: ctx.leaseSeconds,
-      // Stamps daemon_presence.daemon_version + gates against
-      // daemon_min_version (migration 067). NULL — read failure — is
-      // treated as below any floor server-side.
-      p_daemon_version: daemonVersion
-    }),
+    () => ctx.supabase.rpc("claim_archme_job", claimRpcParams({
+      deviceId,
+      workerId: ctx.workerId,
+      leaseSeconds: ctx.leaseSeconds,
+      daemonVersion,
+      claudeVersion,
+      sandboxMode: mode
+    })),
     ctx.reLogin
   );
   if (error) {
@@ -21984,11 +22013,14 @@ async function rpcDefer(ctx, jobId, deviceId, reason, detail) {
   }
   return data != null;
 }
-async function rpcFail(ctx, jobId, deviceId, message2, metrics, logs) {
+async function rpcFail(ctx, jobId, deviceId, message2, metrics, logs, opts = {}) {
   const result = await callJobCompletionEndpoint(ctx, "fail", jobId, deviceId, {
     error: message2.slice(0, 4e3),
     metrics,
-    logs
+    logs,
+    // retry:false fails the job for good now (migration 141); absent, it
+    // requeues while attempts remain.
+    ...opts
   });
   if (!result.ok) console.error(`[${jobId}] fail error:`, result.error);
 }
@@ -22797,7 +22829,7 @@ ${logs.stderr}`, sentPrompt);
     );
     if (route2.kind === "terminal") {
       console.log(`[${job.id}] failed (sandbox request cap, not deferred): ${route2.message}`);
-      await rpcFail(ctx, job.id, deviceId, route2.message, metrics, logs);
+      await rpcFail(ctx, job.id, deviceId, route2.message, metrics, logs, { retry: false });
       return;
     }
     const plan = route2.kind === "defer" ? route2.plan : null;
@@ -22865,7 +22897,18 @@ async function dispatch(sched) {
     }
     pauseUntilMs = null;
   }
-  if (confinementGate && !confinementGate.allowsClaims()) return;
+  const stance = claimStance(sandboxMode, confinementGate);
+  if (stance.kind === "hold") return;
+  if (stance.kind === "presence_only") {
+    sched.dispatching = true;
+    try {
+      for (const { ctx, deviceId } of claimUnits(sched)) await sched.claim(ctx, deviceId, stance.mode);
+    } finally {
+      sched.dispatching = false;
+    }
+    return;
+  }
+  const mode = stance.mode;
   sched.dispatching = true;
   try {
     let atCap = false;
@@ -22877,7 +22920,7 @@ async function dispatch(sched) {
           atCap = true;
           break;
         }
-        const claimed = await claimRoundRobin(sched);
+        const claimed = await claimRoundRobin(sched, mode);
         if (!claimed) {
           slot();
           break;
@@ -22898,16 +22941,20 @@ async function dispatch(sched) {
     sched.dispatching = false;
   }
 }
-async function claimRoundRobin(sched) {
+function claimUnits(sched) {
   const units = [];
   for (const ctx of sched.sessions) {
     if (ctx.auth && ctx.auth.getRefreshToken() === null && ctx.auth.getAccessToken() === null) continue;
     for (const d of ctx.devices) units.push({ ctx, deviceId: d.deviceId });
   }
+  return units;
+}
+async function claimRoundRobin(sched, mode) {
+  const units = claimUnits(sched);
   const n2 = units.length;
   for (let i2 = 0; i2 < n2; i2++) {
     const u2 = units[(sched.rrIndex + i2) % n2];
-    const job = await sched.claim(u2.ctx, u2.deviceId);
+    const job = await sched.claim(u2.ctx, u2.deviceId, mode);
     if (job && job.id) {
       sched.rrIndex = (sched.rrIndex + i2 + 1) % n2;
       return { job, ctx: u2.ctx, deviceId: u2.deviceId };
@@ -23056,6 +23103,7 @@ async function runDaemon() {
     }
     exitDaemon(1);
   }
+  sandboxMode = sandboxSettings.mode;
   if (process.env.ARCHME_SANDBOX_SLOTS !== void 0) {
     console.log("  ARCHME_SANDBOX_SLOTS is no longer read; sandbox slots follow MAX_CONCURRENT_JOBS");
   }
@@ -23322,7 +23370,7 @@ ${signal} received, shutting down`);
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
 }
-var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, confinementGate, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
+var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, confinementGate, sandboxMode, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
 var init_run = __esm({
   "src/daemon/run.ts"() {
     "use strict";
@@ -23366,6 +23414,8 @@ var init_run = __esm({
     init_localPoller();
     init_setting();
     init_imageManifest();
+    init_claimStance();
+    init_claudeVersion();
     init_host();
     init_runSandboxedJob();
     init_inputDir();
@@ -23403,6 +23453,7 @@ var init_run = __esm({
     deviceByJob = /* @__PURE__ */ new Map();
     sandboxHost = null;
     confinementGate = null;
+    sandboxMode = "off";
     boxedJobs = /* @__PURE__ */ new Set();
     leaseLost = /* @__PURE__ */ new Set();
     prefetchOverride = null;
@@ -23586,6 +23637,9 @@ ${ANCHOR_VERIFICATION}`;
       setConfinementGate(gate) {
         confinementGate = gate;
       },
+      setSandboxMode(mode) {
+        sandboxMode = mode;
+      },
       // Daemon-version hooks for tests / introspection. The real value is
       // populated at runDaemon boot from package.json; tests can stub.
       setDaemonVersion(v) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/sandbox-image.json

@@ -1,4 +1,4 @@
 {
   "image": "ghcr.io/architectme/archme-job",
-  "digest": "sha256:1b84fd7691c5d22c289985083532f5642c7c6d028d76ef2e350757d87d7cb3e6"
+  "digest": "sha256:9e4d5cd98c8d72bd14fadcf5063b3cd8c45dc2f65e2fe2ad44e141f5bfe0edbf"
 }