@codedology/code-forge 0.12.0 → 0.14.0

package/src/util/forbidden.mjs

@@ -275,6 +275,7 @@ export const FORBIDDEN = Object.freeze(
  * Coder-only entries (B12b, plan §4.9): verbs only a human (through the orchestrator) may run.
  * They are NOT part of `FORBIDDEN` (whose rendered count other blocks pin); `mergeForbidden()`
  * always appends them, so every list built for a coder carries them.
+ *  - `code-forge block accept-hit` (B127) — accepting a false transcript hit is human-only;
  *  - `code-forge block waive` — waiving a review finding is human-only;
  *  - `code-forge block reopen` (B72) — restarting a stopped or lost file's review is human-only;
  *  - `code-forge autopilot` (any subcommand, B45) — the owner's grant to a delegate;
@@ -324,6 +325,27 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
       tokens: ['--remove-worktree'],
       description: "Remove a block's worktree at close (block close --remove-worktree, B62a) — the orchestrator only",
     },
+    {
+      id: 'code-forge-block-accept-hit-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [
+        ['code-forge', 'block', 'accept-hit'],
+        ['forge', 'block', 'accept-hit'],
+      ],
+      description: 'Accept a false transcript hit — human-only, confirmed in the human terminal (B127)',
+    },
+    {
+      id: 'code-forge-block-unwaive-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [['code-forge', 'block', 'unwaive'], ['forge', 'block', 'unwaive']],
+      description: 'Undo agent waivers — human-only, confirmed in the human terminal (B124b)',
+    },
+    {
+      id: 'code-forge-block-ack-waivers-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [['code-forge', 'block', 'ack-waivers'], ['forge', 'block', 'ack-waivers']],
+      description: 'Acknowledge agent waivers — human-only, confirmed in the human terminal (B124b)',
+    },
   ].map(freezeEntry),
 );
 
@@ -790,6 +812,10 @@ export function renderForCodex(list = FORBIDDEN) {
  * `$ cat ~/.code-forge/runs/r.key`, `Write(.code-forge/reviews/x.json)`, a stream-json
  * `"name":"Write"` followed by the path — is found. It is a grep: a line that merely MENTIONS a
  * forbidden command is a hit too (fail closed; the block gate reports it as `rule_break`, B5).
+ * Codex `exec --json` logs (every non-empty line an object with a string `type`, first event
+ * `thread.started`) scan command_execution commands and file_change paths as writes. Other
+ * items scan whole, except agent_message and reasoning; a command_execution's aggregated_output
+ * is never scanned; non-item events are skipped. Any other log uses the plain-text grep above, unchanged.
  *
  * Linear in the line length: `contains` and `path` entries are evaluated ONCE per line over its
  * tokens (a `write` path entry hits when a write command starts before a token naming the path);
@@ -801,6 +827,17 @@ export function renderForCodex(list = FORBIDDEN) {
  * @returns {{id: string, line: number}[]}
  */
 export function scanTranscript(text, list = FORBIDDEN) {
+  const lines = String(text).split('\n');
+  /** @type {any[] | null} */
+  let events = null;
+  try {
+    const parsed = lines.map((line) => line.trim() === '' ? undefined : JSON.parse(line));
+    const nonEmpty = parsed.filter((event) => event !== undefined);
+    if (nonEmpty[0]?.type === 'thread.started' && nonEmpty.every((event) =>
+      event !== null && typeof event === 'object' && !Array.isArray(event) && typeof event.type === 'string')) events = parsed;
+  } catch {
+    // One bad JSONL line makes the entire transcript a plain-text, fail-closed grep.
+  }
   const commandEntries = list.filter((e) => e.kind === 'prefix' || e.kind === 'commandFlag' || e.kind === 'anyPrefix');
   const firstWords = new Set(['npx', 'bunx', 'pnpm', 'yarn', 'node']);
   for (const e of commandEntries) {
@@ -811,9 +848,21 @@ export function scanTranscript(text, list = FORBIDDEN) {
   const writeStarts = new Set([...WRITE_VERBS, ...WRAPPERS, 'sed', 'perl', 'git']);
   /** @type {{id: string, line: number}[]} */
   const hits = [];
-  String(text)
-    .split('\n')
+  lines
     .forEach((lineText, index) => {
+      if (events !== null) {
+        const event = events[index];
+        if (!event?.type.startsWith('item.') || !event.item) return;
+        const item = event.item;
+        if (item.type === 'agent_message' || item.type === 'reasoning') return;
+        // a command that is not a string is scanned with the rest of its item (fail closed), its output left out
+        if (item.type === 'command_execution') lineText = typeof item.command === 'string' ? item.command : JSON.stringify({ ...item, aggregated_output: undefined });
+        else if (item.type === 'file_change') {
+          lineText = (Array.isArray(item.changes) ? item.changes : [])
+            .filter((change) => typeof change?.path === 'string')
+            .map((change) => `Write(${JSON.stringify(change.path)})`).join(' ');
+        } else lineText = JSON.stringify(item);
+      }
       const tokens = lineText.split(/(>>?)|[\s'"`;|&(),{}[\]]+/).filter((t) => typeof t === 'string' && t.length > 0);
       const ids = new Set();
       let firstWrite = -1;

package/src/worker/engine.mjs

@@ -107,7 +107,7 @@ import { blockTree, worktreeRecord } from '../proof/worktree.mjs';
 import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
 import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
-import { keyedLock } from '../util/locks.mjs';
+import { withLock } from '../util/file-locks.mjs';
 import { blockAnchors, blockRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
 import { assertAnswers } from './queue.mjs';
 import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } from './ticket.mjs';
@@ -536,7 +536,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
   if (!ctx.readRows || !ctx.writeRow) return { status: 'unavailable', reason: 'no-ledger', approved: false, engine: 'adaptive', sessions: [] };
   const readRows = ctx.readRows;
   /** @type {{outcome: ReviewOutcome} | {round: () => Promise<ReviewOutcome>}} */
-  const prepared = await keyedLock(blockLockKey(ctx.runId, ticket.block), async () => {
+  const prepared = await withLock(blockLockKey(ctx.runId, ticket.block), async () => {
     let rows;
     try {
       rows = (await readRows()).filter((r) => r?.run === ctx.runId);

package/src/worker/loop.mjs

@@ -21,8 +21,9 @@
  * snapshots (or none) keeps the config the worker booted with.
  *
  * Ticket pool (B42): the worker runs up to `review.parallel_tickets` (default 3, 1–16) tickets at
- * once, oldest first; when one ends the next pending one starts. Two tickets for the same
- * (block, file) never overlap (a file lock; the later one stays pending without taking a slot),
+ * once, oldest first (or fewest running per block with `review.fair_share`); when one ends the
+ * next pending one starts. Two tickets for the same (block, file) never overlap (a file lock;
+ * the later one stays pending without taking a slot),
  * and the engine takes the block's budget row and L3 rung under a block lock (`engine.mjs`). A
  * throw in one ticket is that ticket's `unavailable` result and never stops the others. `stop()`
  * starts no new ticket and waits for the running ones. With 1 the worker runs exactly as before.
@@ -49,13 +50,13 @@ import { runRecordPath } from '../state/paths.mjs';
 import { readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
 import { logWarning } from '../util/error-log.mjs';
-import { keyedLock } from '../util/locks.mjs';
+import { withLock, tryLock } from '../util/file-locks.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
 import { openFindings } from '../review/gate-check.mjs';
 import { countLines, RouteError, routeTicket } from '../review/route.mjs';
 import { canonicalPath, contentRootFor, reviewTicket } from './engine.mjs';
-import { announceWorker, beatWorker, HEARTBEAT_MS, liveWorker, pendingTickets, readTicket, retractWorker, writeResult } from './queue.mjs';
+import { announceWorker, beatWorker, HEARTBEAT_MS, isDone, liveWorker, pendingTickets, readTicket, retractWorker, workerRegistry, writeResult } from './queue.mjs';
 import { DELETED_HASH, hashBytes, readRegularFileNoFollow, repoRootOf, WorkerError } from './ticket.mjs';
 import { watchTick } from './watch.mjs';
 
@@ -234,6 +235,7 @@ export function recordedVerdict(result) {
  * @property {typeof reviewTicket} [review] - the engine hook (default `./engine.mjs`).
  * @property {typeof spawnSession} [spawn]
  * @property {typeof readRun} [readRun] - the run-record read behind the per-ticket config (a test seam).
+ * @property {{beforeLock?: () => void, afterCount?: (count: number) => Promise<unknown>}} [hooks] - deterministic boot races.
  * @property {typeof readTicket} [readTicket] - the ticket read (a test seam).
  * @property {typeof import('../util/exec.mjs').exec} [watchExec] - watch git exec seam.
  * @property {Parameters<typeof watchTick>[0]['hooks']} [watchHooks] - deterministic watch races.
@@ -277,6 +279,8 @@ export async function createWorker(opts, deps = {}) {
   let stopping = false;
   /** @type {ReturnType<typeof setInterval> | null} */
   let heartbeat = null;
+  /** @type {ReturnType<typeof announceWorker> | null} */
+  let self = null;
   /** @type {(() => void) | null} */
   let wake = null;
   /** @type {(() => void) | null} wakes the pool's wait in `drain` (stop) */
@@ -416,7 +420,7 @@ export async function createWorker(opts, deps = {}) {
       // read, advanced and saved by one ticket at a time; the later one waits here. The key
       // carries the run so two workers in one process (tests) never share a lock.
       const t = ticket;
-      result = await keyedLock(`${runId}\0${fileLockKey(t.block, t.file)}`, () => reviewOne(id, t));
+      result = await withLock(`${runId}\0${fileLockKey(t.block, t.file)}`, () => reviewOne(id, t));
     }
     // Stopping: a ticket whose session our own stop killed ends `unavailable` — leave it queued
     // (no done marker) for the next worker instead of recording the kill as a failure. A ticket
@@ -532,50 +536,50 @@ export async function createWorker(opts, deps = {}) {
   }
 
   /**
-   * B42: how many tickets run at once — `review.parallel_tickets` of the snapshot in force (so a
-   * `run reload` resizes the pool at the next drain), else of the boot config; anything but an
-   * integer 1–16 is the default.
-   * @returns {Promise<number>}
+   * Pool settings from the snapshot in force, else the boot config. A run reload applies at the
+   * next drain; anything but an integer 1–16 uses the default size.
+   * @returns {Promise<{limit: number, fairShare: boolean}>}
    */
-  async function poolSize() {
+  async function poolSettings() {
     let current = cfg;
     try {
       current = await configFor('');
     } catch {
-      // an unreadable record: the boot config's size (each ticket still fails closed on its own)
+      // an unreadable record: the boot settings (each ticket still fails closed on its own)
     }
-    return parallelTickets(current);
+    return { limit: parallelTickets(current), fairShare: current?.review?.fair_share === true };
   }
 
   /**
-   * The (block, file) key of each ticket read so far, by id: a written ticket never changes (its
-   * id is its content's hash), so it is read once for scheduling, however many wake-ups it waits.
+   * The block and (block, file) key of each ticket read so far, by id. A written ticket never
+   * changes (its id is its content's hash), so scheduling reads it once across wake-ups.
    * Dropped once the ticket is done.
-   * @type {Map<string, string>}
+   * @type {Map<string, {key: string, block: string}>}
    */
   const fileKeys = new Map();
 
   /**
-   * The (block, file) a pending ticket names, or null when it cannot be read (it is started
+   * The block and file-lock key a pending ticket names, or null when unreadable (it is started
    * anyway and refused by `processTicket`; a null is not cached). Only a scheduling hint:
    * `processTicket` takes the file lock on the ticket it actually read.
-   * @param {string} id @returns {string | null}
+   * @param {string} id @returns {{key: string, block: string} | null}
    */
   function fileKeyOf(id) {
     const known = fileKeys.get(id);
     if (known !== undefined) return known;
     try {
       const t = loadTicket(repoRoot, id);
-      const key = fileLockKey(t.block, t.file);
-      fileKeys.set(id, key);
-      return key;
+      const file = { key: fileLockKey(t.block, t.file), block: t.block };
+      fileKeys.set(id, file);
+      return file;
     } catch {
       return null;
     }
   }
 
   /**
-   * Serve every pending ticket (B42): up to `review.parallel_tickets` at once, oldest first; when
+   * Serve every pending ticket (B42): up to `review.parallel_tickets` at once, oldest first; with
+   * fair share, each slot goes to the block with fewest running tickets, ties oldest first. When
    * one finishes, the queue is re-read and the next pending ticket starts (no batch barrier; the
    * queue is also re-read every `pollMs` while tickets run, so a new ticket fills a free slot).
    * A ticket whose (block, file) is already running is left pending (it does not take a slot)
@@ -600,11 +604,14 @@ export async function createWorker(opts, deps = {}) {
     }
     /** @type {number | null} */
     let limit = null;
+    let fairShare = false;
     let done = 0;
     /** @type {Map<string, Promise<void>>} */
     const running = new Map();
     /** @type {Set<string>} the (block, file) keys of the running tickets */
     const busy = new Set();
+    /** @type {Map<string, number>} running tickets per block */
+    const runningByBlock = new Map();
     /** @type {Set<string>} */
     const started = new Set();
     for (;;) {
@@ -630,25 +637,54 @@ export async function createWorker(opts, deps = {}) {
           writeSafe(warnStream, `worker: WARN ${text}\n`);
           try { await logWarning({ warning: 'watch_tick_failed', message: text }); } catch { /* a log failure never stops dispatch */ }
         }
-        for (const id of pendingTickets(repoRoot)) {
-          if (poisoned.has(id) || started.has(id)) continue;
-          if (limit === null) limit = await poolSize();
-          if (running.size >= limit || stopping) break;
-          const fileKey = fileKeyOf(id);
-          if (fileKey !== null && busy.has(fileKey)) continue; // waits without a slot
+        const pending = pendingTickets(repoRoot).filter((id) => !poisoned.has(id) && !started.has(id));
+        if (pending.length > 0 && limit === null) ({ limit, fairShare } = await poolSettings());
+        // Cache even unreadable hints for this tick: ranking never reads a ticket twice.
+        /** @type {Map<string, ReturnType<typeof fileKeyOf>>} */
+        const hints = new Map();
+        while (pending.length > 0 && running.size < limit && !stopping) {
+          let next = -1;
+          let fewest = Infinity;
+          for (let i = 0; i < pending.length; i += 1) {
+            const id = pending[i];
+            if (!hints.has(id)) hints.set(id, fileKeyOf(id));
+            const file = hints.get(id);
+            if (file && busy.has(file.key)) continue; // waits without a slot
+            const count = fairShare && file ? runningByBlock.get(file.block) ?? 0 : 0;
+            if (count < fewest) {
+              next = i;
+              fewest = count;
+            }
+            if (count === 0) break; // best possible count; ties stay oldest first
+          }
+          if (next === -1) break;
+          const [id] = pending.splice(next, 1);
+          const claim = await tryLock(`ticket\0${runId}\0${id}`);
+          if (!claim.ok) continue; // another process owns it; no pool slot is taken
+          // Acquisition awaited a process probe: another worker may have completed this ticket
+          // since the pending snapshot, or stop() may have arrived while we waited.
+          if (stopping || isDone(repoRoot, id)) {
+            claim.release();
+            continue;
+          }
+          const file = hints.get(id);
+          const fileKey = file?.key ?? null;
           started.add(id);
           activeTickets.add(id);
           if (fileKey !== null) busy.add(fileKey);
+          if (file) runningByBlock.set(file.block, (runningByBlock.get(file.block) ?? 0) + 1);
           const slot = runOne(id)
             .then((n) => {
               done += n;
             })
             .finally(() => {
+              claim.release(); // the done marker is published before the claim is released
               // the slot is freed on every exit path (`runOne` never rejects)
               running.delete(id);
               activeTickets.delete(id);
               fileKeys.delete(id);
               if (fileKey !== null) busy.delete(fileKey);
+              if (file) runningByBlock.set(file.block, runningByBlock.get(file.block) - 1);
             });
           running.set(id, slot);
         }
@@ -684,7 +720,8 @@ export async function createWorker(opts, deps = {}) {
    * must still see the worker as live the whole time.
    */
   function announce() {
-    const self = announceWorker(repoRoot, { pid: process.pid, run: runId });
+    if (self !== null) return; // boot already announced under the lock
+    self = announceWorker(repoRoot, { pid: process.pid, run: runId });
     stopBeating();
     const timer = setInterval(() => {
       try {
@@ -749,12 +786,16 @@ export async function createWorker(opts, deps = {}) {
   /** Withdraw this process's announcement (`worker.json`) if it is still ours. */
   function release() {
     stopBeating();
-    retractWorker(repoRoot, process.pid);
+    if (self !== null) retractWorker(repoRoot, self.pid, self.start_time);
+    self = null;
   }
 
-  return { processTicket, drain, run, once, stop, release, watchTick: tickWatch, jevKeyResolved: jevKey !== null, sessionEnv: childEnv };
+  return { processTicket, drain, run, once, stop, release, announce, watchTick: tickWatch, jevKeyResolved: jevKey !== null, sessionEnv: childEnv };
 }
 
+/** This block permits one registered worker per queue. */
+const WORKER_LIMIT = 1;
+
 /**
  * Start-up for the `worker` verb: run record, repo root, config, run temp root (owned by this
  * process), run key; refuses when another live worker already serves this queue.
@@ -777,13 +818,22 @@ export async function bootWorker(opts, deps = {}) {
     if (!loaded.ok) throw new WorkerError('config', loaded.message ?? 'the project config cannot be loaded');
     cfg = loaded.config;
   }
-  const other = liveWorker(repoRoot);
-  if (other && other.pid !== process.pid) throw new WorkerError('worker-running', `worker pid ${other.pid} already serves this queue`);
   const tmpRoot = typeof cfg?.tmp?.root === 'string' ? cfg.tmp.root : undefined;
   const runRootDir = runRoot(opts.runId, { root: tmpRoot });
   setRunRoot(runRootDir);
   const key = await loadKey(opts.runId);
   const worker = await createWorker({ runId: opts.runId, repoRoot, cfg, runRootDir, slug: record.project, key, pollMs: opts.pollMs, guardRunRecordPath: runRecordPath(opts.runId) }, deps);
+  deps.hooks?.beforeLock?.();
+  await withLock(`worker-boot:${repoRoot}`, async () => {
+    const entries = workerRegistry(repoRoot, { prune: true });
+    let count = entries.filter((entry) => entry.live).length;
+    // Older workers have only worker.json; do not boot over a live legacy owner.
+    const legacy = liveWorker(repoRoot);
+    if (legacy && !entries.some((entry) => entry.worker?.pid === legacy.pid && entry.worker.start_time === legacy.start_time)) count++;
+    await deps.hooks?.afterCount?.(count);
+    if (count >= WORKER_LIMIT) throw new WorkerError('worker-running', 'a live or unreadable worker entry already serves this queue');
+    worker.announce();
+  });
   return { ...worker, repoRoot, runRootDir };
 }
 
@@ -826,7 +876,7 @@ export async function launchWorker({ runId, workspace, env = process.env, timeou
   child.unref();
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    if (typeof pid === 'number' && liveWorker(repoRoot)?.pid === pid) return { pid, repoRoot };
+    if (typeof pid === 'number' && liveWorker(repoRoot, { pid, registeredOnly: true })) return { pid, repoRoot };
     if (child.exitCode !== null || child.signalCode !== null) break;
     await new Promise((resolve) => setTimeout(resolve, 50));
   }