@codedology/code-forge 0.15.1 → 0.15.3

package/src/state/block.mjs

@@ -24,9 +24,10 @@ import { isAncestorArgv, revParseArgv } from '../util/git.mjs';
 import { StateError } from './paths.mjs';
 import { assertOwned, blocksOverlap, isExactEntry, ownsFile, scopeGate } from './registry.mjs';
 import { checkWorkerPin, readRun, saveRun, withRunLock, writeSigned } from './run.mjs';
-import { canonicalJSON, verifyRow, loadKey } from './signer.mjs';
+import { canonicalJSON, verifyRow, loadKey, signRow } from './signer.mjs';
+import { readAllRows } from '../ledger/write.mjs';
 import * as reviewQueue from '../worker/queue.mjs';
-import { repoRootOf } from '../worker/ticket.mjs';
+import { contentHash, repoRootOf } from '../worker/ticket.mjs';
 
 /** @typedef {import('./run.mjs').WriteRow} WriteRow */
 
@@ -362,6 +363,11 @@ function refuseConfigOwner(owned, kinds, guarded) {
  * B60: `tests` (`block open --tests <paths…>`, the same path rules as owned entries, else
  * `bad-tests`) is recorded as the entry's `test_files` and on the dispatch row; a gate argv item
  * `{test_files}` expands to them (`gates/expand.mjs`). Left out, neither carries the key.
+ * B148: `after` lists dependencies in this run. Under the same run lock, every dependency must
+ * be closed (`after-not-done`); self-dependency is `bad-after`. Unique ids are recorded on the
+ * entry and dispatch only when supplied, and a later attempt checks only its own supplied list.
+ * B153: `after_outcome` carries the specialist step ids and outcome byte hashes accepted by
+ * the CLI against the run's project root; it is recorded on the entry and dispatch when supplied.
  * B62a: `worktree` (given by `block open` under `proof.isolation: worktree`, `proof/worktree.mjs`;
  * this module never imports it) plans the block's own worktree, or the reuse of the one an earlier
  * entry of the same id recorded (`previous`); its `make()` makes or reuses it. Both are called
@@ -376,9 +382,10 @@ function refuseConfigOwner(owned, kinds, guarded) {
  * @param {{
  *   runId: string, id: string, level: string, owned: string[], acceptance: unknown,
  *   attempt?: number, base?: string, lines?: number, brief?: {path: string, content: Buffer | string},
- *   kind?: string, cfg?: Record<string, any>, writeRow: WriteRow, now?: Date, tests?: string[],
+ *   kind?: string, cfg?: Record<string, any>, writeRow: WriteRow, now?: Date, tests?: string[], after?: string[],
+ *   after_outcome?: {step: string, sha256: string}[],
  *   decision?: {question: 'lane', answer: string, source: 'rules', facts: Record<string, unknown>}, decisionId?: string,
- *   worktree?: (ctx: {baseSha: string, previous: TreeRecord | null}) => Promise<{path: string, make: () => Promise<OpenTree>}>,
+ *   worktree?: (ctx: {baseSha: string, baseExplicit: boolean, previous: TreeRecord | null}) => Promise<{path: string, make: () => Promise<OpenTree>}>,
  * }} opts
  * @returns {Promise<{block: Record<string, any>, pointer: string | null, worktreeReused: boolean}>} `worktreeReused`:
  *   the block took an earlier attempt's worktree as it was.
@@ -395,6 +402,7 @@ export async function openBlock(opts) {
   const acceptance = assertAcceptance(opts.acceptance);
   const humanChecks = acceptance.filter((c) => c.kind === 'human_check').map((c) => c.clause);
   const tests = opts.tests === undefined ? null : [...assertOwned(opts.tests, { label: 'test files', code: 'bad-tests' })];
+  const after = opts.after === undefined ? null : [...new Set(opts.after)];
   const kind = opts.kind === 'light' ? 'light' : blockKind({ owned, declared: opts.kind });
   const dispatched = dispatchLevel({ lane: level, kind, cfg: opts.cfg });
   const pointer = opts.brief ? briefPointer(opts.brief.path, opts.brief.content) : null;
@@ -423,6 +431,14 @@ export async function openBlock(opts) {
     const { block, reused } = await mutateRun(runId, null, writeRow, async (record) => {
       if (record.blocks[id]?.status === 'open') throw new StateError('already-open', `block ${id} is already open`);
       if (record.blocks[id]?.status === 'awaiting_human_check') throw new StateError('already-open', `block ${id} is awaiting a human check`);
+      if (after !== null) {
+        if (after.includes(id)) throw new StateError('bad-after', `block ${id} cannot name itself in --after`);
+        const blocking = after.filter((dependency) => record.blocks[dependency]?.status !== 'closed');
+        if (blocking.length > 0) {
+          const statuses = blocking.map((dependency) => `${dependency} (${record.blocks[dependency]?.status ?? 'not in run'})`);
+          throw new StateError('after-not-done', `block ${id}: --after dependencies not closed: ${statuses.join(', ')}`);
+        }
+      }
       // B57: what each exact owned entry is on disk, under the lock (as `block claim`) — a regular
       // file owns only itself, here and in every later check
       const kinds = ownedKinds(record.workspace, owned);
@@ -433,7 +449,7 @@ export async function openBlock(opts) {
       const branch = await git(['git', 'symbolic-ref', '--quiet', '--short', 'HEAD'], record.workspace, [0, 1]);
       const baseBranch = branch.code === 0 ? branch.stdout.trim() : null;
       // B62a: the tree is planned (read-only checks) before the overlap check, which needs its path
-      const planned = opts.worktree ? await opts.worktree({ baseSha, previous: prior }) : null;
+      const planned = opts.worktree ? await opts.worktree({ baseSha, baseExplicit: opts.base !== undefined, previous: prior }) : null;
       const self = { owned_files: owned, owned_kinds: kinds, worktree: planned ? { path: planned.path } : null };
       for (const [otherId, other] of Object.entries(activeBlocks(record))) {
         const pair = blocksOverlap(self, other);
@@ -443,8 +459,10 @@ export async function openBlock(opts) {
       // passed; a tree made here is rolled back below if the rows or the save then fail
       made = planned ? await planned.make() : null;
       const tree = made;
-      const entry = { block: id, base_sha: baseSha, base_branch: baseBranch, owned_files: [...owned], owned_kinds: { ...kinds }, level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open', tree_at_open: treeOpen, ...(tests ? { test_files: tests } : {}), ...(tree ? { worktree: tree.worktree } : {}) };
+      const outcomeDependencies = opts.after_outcome === undefined ? {} : { after_outcome: opts.after_outcome };
+      const entry = { block: id, base_sha: baseSha, base_branch: baseBranch, owned_files: [...owned], owned_kinds: { ...kinds }, level: dispatched.level, kind, attempt, opened_at: now.toISOString(), acceptance, lines_forecast: lines, status: 'open', tree_at_open: treeOpen, ...(tests ? { test_files: tests } : {}), ...(after !== null ? { after } : {}), ...outcomeDependencies, ...(tree ? { worktree: tree.worktree } : {}) };
       if (humanChecks.length > 0) Object.assign(entry, { human_checks: humanChecks });
+      if (opts.brief) Object.assign(entry, { brief: { path: opts.brief.path } });
       record.blocks[id] = entry;
       const floor = dispatched.trigger === 'docs_floor' ? { requested_level: level, trigger: 'docs_floor' } : {};
       const created = tree?.created ? [{ event: 'worktree.created', block: id, path: tree.worktree.path, branch: tree.worktree.branch, base: tree.worktree.base_sha }] : [];
@@ -453,7 +471,7 @@ export async function openBlock(opts) {
         rows: [
           ...(opts.decision ? [{ ...opts.decision, event: 'decision', decision_id: opts.decisionId ?? randomUUID(), block: id }] : []),
           ...created,
-          { event: 'dispatch', block: id, level: dispatched.level, kind, ...floor, attempt, base_sha: baseSha, base_branch: baseBranch, owned_files: entry.owned_files, lines_forecast: lines, ...(tests ? { test_files: tests } : {}) },
+          { event: 'dispatch', block: id, level: dispatched.level, kind, ...floor, attempt, base_sha: baseSha, base_branch: baseBranch, owned_files: entry.owned_files, lines_forecast: lines, ...(tests ? { test_files: tests } : {}), ...(after !== null ? { after } : {}), ...outcomeDependencies },
         ],
       };
     });
@@ -486,18 +504,19 @@ export async function attemptBlock({ runId, id, writeRow }) {
  * in between touched a file this block owns (that is a conflict ⇒ stop). Rename detection is OFF
  * (`--no-renames`): a rename lists both its old and its new path, so moving an owned file away
  * is a conflict too. Never silent. Owned means `ownsFile` (B57: a directory entry owns the files
- * below it). B62a: refused for an open block with its own worktree (`worktree-rebase`).
- * B134: a closed worktree block instead rebases its branch onto its recorded base branch,
- * retaining every changed owned file's blob; a conflict or changed blob restores the old head.
- * @param {{runId: string, id: string, head?: string, writeRow: WriteRow}} opts
- * @returns {Promise<{old_base: string, new_base: string}>}
+ * below it). Worktree blocks rebase their branch onto the recorded base branch. Open blocks
+ * refuse upstream commits touching owned files; closed blocks retain every changed owned blob.
+ * A refusal restores the head at entry. A rebase check keeps the candidate content available
+ * to the worker, with a signed checkpoint; the recorded base moves only after clearance.
+ * @param {{runId: string, id: string, head?: string, writeRow: WriteRow, acceptChanged?: string[], reason?: string, rebaseCheck?: boolean}} opts
+ * @returns {Promise<{old_base: string, new_base: string, files?: ReturnType<typeof reviewQueue.enqueue>[], pending?: boolean}>}
  */
-export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow }) {
-  if (['closed', 'awaiting_human_check'].includes((await readRun(runId)).blocks[id]?.status)) return rebaseClosedBlock({ runId, id, writeRow });
+export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow, acceptChanged = [], reason, rebaseCheck = false }) {
+  if (acceptChanged.length && (typeof reason !== 'string' || !reason.trim())) throw new StateError('usage', '--accept-changed needs a nonblank --reason');
+  const block = (await readRun(runId)).blocks[id];
+  if (block?.worktree || ['closed', 'awaiting_human_check'].includes(block?.status)) return rebaseWorktreeBlock({ runId, id, writeRow, acceptChanged, reason, rebaseCheck });
+  if (rebaseCheck || acceptChanged.length) throw new StateError('usage', 'rebase clearance requires a worktree block');
   return mutateRun(runId, id, writeRow, async (record, block) => {
-    // B62a: a worktree block's base is the commit its tree started from; moving it would leave the
-    // tree on its old base, so the rebase is refused
-    if (block.worktree) throw new StateError('worktree-rebase', `block ${id} has its own worktree ${block.worktree.path} on branch ${block.worktree.branch}; its base is the base of that tree, so block rebase does not apply — work on the branch in the tree instead`);
     const cwd = record.workspace;
     const newBase = await resolveCommit(head, cwd);
     const ancestor = await git(isAncestorArgv(block.base_sha, newBase), cwd, [0, 1]);
@@ -507,7 +526,7 @@ export async function rebaseBlock({ runId, id, head = 'HEAD', writeRow }) {
     if (conflicts.length > 0) throw new StateError('owned-conflict', `block ${id}: commits since its base changed owned files: ${conflicts.join(', ')}`);
     const moved = { old_base: block.base_sha, new_base: newBase };
     block.base_sha = newBase;
-    return { result: moved, rows: [{ event: 'block.rebase', block: id, ...moved }] };
+    return { result: moved, rows: [{ event: 'block.rebase', block: id, ...moved, changed_reviewed: [], cleared: [] }] };
   });
 }
 
@@ -530,44 +549,91 @@ async function committedBlobs(cwd, ref, files) {
 }
 
 /**
- * Closed blocks have a separate mutation path: check their status again under the lock,
- * restore the branch on failure (including a failed signed write), and retain closed/awaiting status.
- * @param {{runId: string, id: string, writeRow: WriteRow}} opts
- * @returns {Promise<{old_base: string, new_base: string}>}
+ * Recheck worktree block status under the lock, restore the branch on failure (including a
+ * failed signed write), and retain its open/closed/awaiting status.
+ * @param {{runId: string, id: string, writeRow: WriteRow, acceptChanged: string[], reason?: string, rebaseCheck: boolean}} opts
+ * @returns {Promise<{old_base: string, new_base: string, files?: ReturnType<typeof reviewQueue.enqueue>[], pending?: boolean}>}
  */
-async function rebaseClosedBlock({ runId, id, writeRow }) {
+async function rebaseWorktreeBlock({ runId, id, writeRow, acceptChanged, reason, rebaseCheck }) {
   return withRunLock(runId, async () => {
     const record = await readRun(runId);
     if (record.status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
     const block = record.blocks[id];
-    if (!['closed', 'awaiting_human_check'].includes(block?.status) || !block.worktree) throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
+    if (!['open', 'closed', 'awaiting_human_check'].includes(block?.status) || !block.worktree) throw new StateError('no-block', `block ${id} is not open in run ${runId}`);
+    const closed = block.status !== 'open';
     if (!block.base_branch) throw new StateError('rebase-no-base', `block ${id} has no recorded base branch`);
     const tree = block.worktree.path;
     const branch = await git(['git', 'symbolic-ref', '--quiet', 'HEAD'], tree, [0, 1]);
     if (branch.stdout.trim() !== `refs/heads/${block.worktree.branch}`) throw new StateError('worktree-rebase', `block ${id}: its worktree is not on branch ${block.worktree.branch}`);
     // A reset must never discard edits made after close, or abort an earlier rebase.
     const status = await git(['git', 'status', '--porcelain'], tree);
-    if (status.stdout.length > 0) throw new StateError('rebase-conflict', 'rebase-conflict');
+    if (status.stdout.length > 0) throw new StateError(closed ? 'rebase-conflict' : 'rebase-dirty', closed ? 'rebase-conflict' : `rebase-dirty: block ${id}: commit or clean first`);
     const oldHead = await resolveCommit('HEAD', tree);
+    const key = await loadKey(runId);
+    const pending = block.rebase_check;
+    if (pending && (!verifyRow(pending, key).ok || pending.run !== runId || pending.block !== id || pending.old_base !== block.base_sha)) {
+      throw new StateError('rebase-check-invalid', 'the pending rebase checkpoint is invalid');
+    }
+    if (pending && (await git(isAncestorArgv(pending.head, oldHead), tree, [0, 1])).code !== 0) {
+      throw new StateError('rebase-check-invalid', 'the worktree no longer contains the pending rebase');
+    }
+    const reviewedHead = pending?.old_head ?? oldHead;
     const newBase = await resolveCommit(`refs/heads/${block.base_branch}`, record.workspace);
     const top = await repoTop(record.workspace);
     const prefix = path.relative(top, realpathSync(record.workspace)).split(path.sep).join('/');
-    const diff = await git(['git', 'diff', '--no-renames', '--name-only', '-z', block.base_sha, oldHead, '--'], tree);
-    const files = diff.stdout.split('\0').filter((file) => file.length > 0 && (
+    const owns = (/** @type {string} */ file) => (
       ownsFile(block.owned_files, file, block.owned_kinds) ||
       (prefix !== '' && file.startsWith(`${prefix}/`) && ownsFile(block.owned_files, file.slice(prefix.length + 1), block.owned_kinds))
-    )).sort();
-    const before = await committedBlobs(tree, oldHead, files);
+    );
+    let files = [];
+    if (closed) {
+      const diff = await git(['git', 'diff', '--no-renames', '--name-only', '-z', block.base_sha, reviewedHead, '--'], tree);
+      files = diff.stdout.split('\0').filter((file) => file.length > 0 && owns(file)).sort();
+    } else {
+      // Inspect every upstream commit, including changes later reverted and both rename paths.
+      const upstream = await git(['git', 'log', '--format=', '--no-renames', '--name-only', '-z', '-m', `${block.base_sha}..${newBase}`, '--'], tree);
+      const conflicts = [...new Set(upstream.stdout.split('\0').filter((file) => file.length > 0 && owns(file)))].sort();
+      if (conflicts.length > 0) throw new StateError('owned-conflict', `block ${id}: commits since its base changed owned files: ${conflicts.join(', ')}`);
+    }
+    const before = closed ? await committedBlobs(tree, reviewedHead, files) : null;
     const moved = { old_base: block.base_sha, new_base: newBase };
     try {
       const rebased = await exec(['git', '-C', tree, 'rebase', newBase], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
       if (rebased.result !== 'ok') throw new StateError('rebase-conflict', 'rebase-conflict');
-      const after = await committedBlobs(tree, 'HEAD', files);
-      const changed = files.filter((file) => before.get(file) !== after.get(file));
-      if (changed.length > 0) throw new StateError('rebase-changed-reviewed', `rebase-changed-reviewed ${changed.join(', ')}`);
+      const after = before === null ? null : await committedBlobs(tree, 'HEAD', files);
+      const changed = after === null ? [] : files.filter((file) => before.get(file) !== after.get(file));
+      const repoRoot = await repoRootOf(record.workspace);
+      if (rebaseCheck) {
+        // The worker reviews the authoritative worktree, so retain this candidate while leaving
+        // both bases untouched. Sign the original head so a later retry cannot forget changes.
+        block.rebase_check = signRow({ event: 'block.rebase_check', run: runId, block: id, ...moved, old_head: reviewedHead, head: await resolveCommit('HEAD', tree), started_at: pending?.started_at ?? new Date().toISOString() }, key);
+        const queued = changed.map((file) => reviewQueue.enqueue({ repoRoot, run: runId, block: id, file, tree, after: block.rebase_check.started_at }));
+        await saveRun(record);
+        return { ...moved, files: queued, pending: true };
+      }
+      const invalidAccepted = acceptChanged.filter((file) => !changed.includes(file));
+      if (invalidAccepted.length) throw new StateError('usage', `--accept-changed names files not changed by this rebase: ${invalidAccepted.join(', ')}`);
+      const rows = pending ? (await readAllRows(record.project)).filter((row) => row.run === runId && row.block === id && verifyRow(row, key).ok && Date.parse(row.ts) >= Date.parse(pending.started_at)) : [];
+      /** @type {Array<{file: string, via: string, ticket?: string, reason?: string}>} */
+      const cleared = [];
+      for (const file of changed) {
+        if (acceptChanged.includes(file)) {
+          cleared.push({ file, via: 'human', reason });
+          continue;
+        }
+        const hash = contentHash(tree, file);
+        const ticket = reviewQueue.resolveTicket({ repoRoot, run: runId, block: id, file, tree, after: pending?.started_at }).ticket;
+        const relevant = rows.filter((row) => row.file === file && row.content_hash === hash);
+        const approval = relevant.reduce((last, row, index) => row.event === 'review.approved' && (row.ticket === undefined || row.ticket === ticket) ? index : last, -1);
+        const denied = relevant.slice(approval + 1).some((row) => row.event === 'review.cap' || (row.event === 'review.result' && row.approved === false) || (row.event === 'review.round' && row.open_after > 0));
+        if (approval >= 0 && !denied) cleared.push({ file, via: 'review', ticket });
+      }
+      const uncleared = changed.filter((file) => !cleared.some((entry) => entry.file === file));
+      if (uncleared.length) throw new StateError('rebase-changed-reviewed', `rebase-changed-reviewed ${uncleared.join(', ')}\nRe-review: code-forge review-file --rebase-check --block ${id} --run ${runId}\nHuman accept (repeat --accept-changed for each file): code-forge block rebase ${id} --run ${runId} --accept-changed <file> --reason <text>`);
       block.base_sha = newBase;
       block.worktree.base_sha = newBase;
-      await writeSigned(runId, writeRow, { event: 'block.rebase', block: id, ...moved, closed: true });
+      delete block.rebase_check;
+      await writeSigned(runId, writeRow, { event: 'block.rebase', block: id, ...moved, changed_reviewed: changed, cleared, ...(closed ? { closed: true } : { worktree: true }) });
       await saveRun(record);
       return moved;
     } catch (err) {
@@ -679,9 +745,10 @@ export async function closeBlock({ runId, id, rows, writeRow, livePid, probe, ex
 
   let pin = await checkWorkerPin(record, { livePid, probe });
   const pins = record.workers ?? (record.worker ? [record.worker] : []);
+  const reviewPins = [...pins, ...(record.worker_history ?? [])];
   const counted = rows.filter((row) => row.block === id && (row.run === undefined || row.run === runId) && row.event === 'review.result' && !['stale', 'unavailable', 'answers'].includes(row.status) && !(row.status === 'refused' && row.reason === 'other-run'));
   // Ledgers written before B107 omit worker identity and use the run's pin check above.
-  if (counted.some((row) => row.worker !== undefined && !pins.some((p) => p.pid === row.worker?.pid && p.started_at === row.worker?.started_at))) {
+  if (counted.some((row) => row.worker !== undefined && !reviewPins.some((p) => p.pid === row.worker?.pid && p.started_at === row.worker?.started_at))) {
     pin = { ok: false, event: 'worker.replaced', reason: 'a counted review result does not name a pinned worker' };
   }
   if (pin.ok) {

package/src/state/config-snapshot.mjs

@@ -45,7 +45,7 @@ export const IMMUTABLE_KEYS = Object.freeze({
   // B64b: the block-end hook runs a command on the owner's machine at every block end, so only
   // the owner sets it, before the run starts
   'hooks.on_block_end': 'it runs a command on the owner\'s machine at every block end; fixed by the owner before the run starts',
-  // B87: the runner argv proves the coder's own work, so only the owner sets it, before the run starts
+  // B171: existing runner entries stay fixed; immutableChanges permits append-only additions.
   'proof.runners': 'the commands that prove a block are fixed by the owner before the run starts',
   // B93: the coder sandbox profile widens what the coder may write, so only the owner sets it,
   // before the run starts (a coder can never own `.code-forge.yml`)
@@ -138,7 +138,17 @@ function valueAt(cfg, dotted) {
  * @returns {string[]}
  */
 export function immutableChanges(before, after) {
-  return Object.keys(IMMUTABLE_KEYS).filter((k) => canonicalJSON(valueAt(before, k) ?? null) !== canonicalJSON(valueAt(after, k) ?? null));
+  return Object.keys(IMMUTABLE_KEYS).filter((k) => {
+    const oldValue = valueAt(before, k);
+    const newValue = valueAt(after, k);
+    // Additions go at the end: prepending could replace the first match of an existing runner.
+    if (k === 'proof.runners' && Array.isArray(newValue)) {
+      const oldRunners = oldValue ?? [];
+      if (Array.isArray(oldRunners) && newValue.length >= oldRunners.length
+        && oldRunners.every((entry, i) => canonicalJSON(entry) === canonicalJSON(newValue[i]))) return false;
+    }
+    return canonicalJSON(oldValue ?? null) !== canonicalJSON(newValue ?? null);
+  });
 }
 
 /**
@@ -243,7 +253,7 @@ export function blockEndHook(record) {
 }
 
 /**
- * B87: `proof.runners` of the run-start config snapshot (never the live config), as a deep copy
+ * B87: `proof.runners` of the snapshot in force (never the live config), as a deep copy
  * (entries and argv arrays), or null when the key is absent or the record is from before
  * snapshots. `proof/runners.mjs` checks each entry again before it runs one (fail closed).
  * @param {Record<string, any>} record

package/src/state/run.mjs

@@ -275,8 +275,7 @@ export async function reloadRun({ runId, config, readPending = () => [], effecti
       if (config.context?.require_coder_tests === true) frozen.push('context.require_coder_tests');
       // B64b: and never had a block-end hook
       if (config.hooks?.on_block_end !== undefined) frozen.push('hooks.on_block_end');
-      // B87: and never had a proof runner
-      if (config.proof?.runners !== undefined) frozen.push('proof.runners');
+      // B171: a legacy run has no existing runners; adding its first list is safe.
       // B93: and never had a coder sandbox profile
       if (config.coder?.sandbox !== undefined) frozen.push('coder.sandbox');
     }
@@ -324,6 +323,8 @@ export async function reattachWorker({ runId, workerPid, writeRow, probe = proce
     if (current.status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
     const pin = await pinWorker(workerPid, probe);
     const pins = current.workers ?? (current.worker ? [current.worker] : []);
+    // Retired pins still authorize completed reviews, but never live-worker checks or signals.
+    if (!add) current.worker_history = [...(current.worker_history ?? []), ...pins];
     current.workers = add ? [...pins, pin] : [pin];
     current.worker = current.workers[0];
     await writeSigned(runId, writeRow, { event: add ? 'worker.add' : 'worker.reattach', pid: workerPid });

package/src/util/exec.mjs

@@ -8,9 +8,9 @@
  *    indefinitely (callers that spawn a reviewer/coder CLI are expected to always pass one —
  *    this module does not impose a default, since a default here would silently apply to every
  *    caller, including ones with a legitimately long-running command).
- *  - On timeout the whole process GROUP is sent SIGTERM, then SIGKILL — the SIGKILL goes to the
- *    group as soon as the direct child exits (or after a grace period), so a grandchild that
- *    traps SIGTERM cannot outlive the call. The result is `failed`, never a partial success.
+ *  - On timeout the process group receives SIGTERM, then SIGKILL after a grace period while
+ *    the leader lives. On every leader exit, remaining members are captured and stopped
+ *    individually after checking their start times. Timeout always resolves `failed`.
  *  - stdin is `ignore`d by default, so a child that reads stdin when it isn't a TTY (`claude -p`,
  *    for one) sees an immediate EOF instead of blocking forever. With `input` (a string or bytes),
  *    stdin is a pipe: the content is written verbatim and then the pipe is closed, so the child
@@ -50,7 +50,8 @@
  */
 
 import { spawn } from 'node:child_process';
-import { registerPid, unregisterPid } from './reaper.mjs';
+import path from 'node:path';
+import { groupMembers, readStartTime, registerPid, stopMembers, unregisterPid } from './reaper.mjs';
 import { pidsDir } from './tmp.mjs';
 
 /** Grace period after SIGTERM before escalating to SIGKILL, in milliseconds. */
@@ -170,16 +171,32 @@ export function exec(argv, opts = {}) {
   const { cwd, env, timeoutMs, input, okExitCodes = [0], maxBufferBytes = DEFAULT_MAX_BUFFER_BYTES } = opts;
   const [command, ...args] = argv;
 
+  /** @type {NodeJS.ProcessEnv} */
+  const childEnv = { ...(env ?? process.env), CODE_FORGE_OWNER_PID: String(process.pid) };
+  const ownerStart = readStartTime(process.pid);
+  if (ownerStart) childEnv.CODE_FORGE_OWNER_START_TIME = ownerStart;
+  else delete childEnv.CODE_FORGE_OWNER_START_TIME;
+  let spawnRegistry = null;
+  try {
+    spawnRegistry = pidsDir();
+    const rootId = path.basename(path.dirname(spawnRegistry));
+    const runAt = process.argv.indexOf('--run');
+    const inlineRun = process.argv.find((arg) => arg.startsWith('--run='))?.slice('--run='.length);
+    const runId = childEnv.CODE_FORGE_RUN_ID ?? process.env.CODE_FORGE_RUN_ID
+      ?? (runAt >= 0 ? process.argv[runAt + 1] : inlineRun) ?? (/^r-/.test(rootId) ? rootId : undefined);
+    if (runId) childEnv.CODE_FORGE_RUN_ID = runId;
+  } catch { /* registry hygiene must never prevent a spawn */ }
+
   return new Promise((resolve) => {
     const stdinMode = input === undefined ? 'ignore' : 'pipe';
-    const child = spawn(command, args, { cwd, env, shell: false, detached: true, stdio: [stdinMode, 'pipe', 'pipe'] });
+    const child = spawn(command, args, { cwd, env: childEnv, shell: false, detached: true, stdio: [stdinMode, 'pipe', 'pipe'] });
     const pid = child.pid;
     /** @type {string | null} */
     let registryDir = null;
     if (typeof pid === 'number') {
       trackChild(pid);
       try {
-        registryDir = pidsDir();
+        registryDir = spawnRegistry ?? pidsDir();
         registerPid(registryDir, pid, command);
       } catch {
         registryDir = null;
@@ -200,6 +217,7 @@ export function exec(argv, opts = {}) {
     let timedOut = false;
     let overBuffer = false;
     let settled = false;
+    let remaining = Promise.resolve();
     /** @type {NodeJS.Timeout | undefined} */
     let termTimer;
     /** @type {NodeJS.Timeout | undefined} */
@@ -216,12 +234,24 @@ export function exec(argv, opts = {}) {
     const stdoutText = () => Buffer.concat(stdoutChunks).toString(opts.stdoutEncoding ?? 'utf8');
     const stderrText = () => Buffer.concat(stderrChunks).toString('utf8');
 
-    /** @param {ExecResult} result */
-    const settle = (result) => {
+    /** @param {Pick<ExecResult, 'code'|'signal'|'error'>} outcome */
+    const settle = async (outcome) => {
       if (settled) return;
       settled = true;
       if (termTimer) clearTimeout(termTimer);
       if (killTimer) clearTimeout(killTimer);
+      await remaining;
+      // Pipe data can arrive while the remaining group members are being stopped.
+      // Snapshot the output and buffer-limit state only once that wait is over.
+      /** @type {ExecResult} */
+      const result = {
+        ...outcome,
+        result: !outcome.error && !timedOut && !overBuffer && outcome.code !== null && okExitCodes.includes(outcome.code) ? 'ok' : 'failed',
+        stdout: stdoutText(),
+        stderr: stderrText(),
+        timedOut,
+        ...(overBuffer ? { error: 'exec: maxBufferBytes exceeded' } : {}),
+      };
       if (typeof pid === 'number') {
         untrackChild(pid);
         if (registryDir !== null) {
@@ -277,40 +307,27 @@ export function exec(argv, opts = {}) {
 
     child.on('error', (err) => {
       settle({
-        result: 'failed',
         code: null,
         signal: null,
-        stdout: stdoutText(),
-        stderr: stderrText(),
-        timedOut,
         error: err.message,
       });
     });
 
-    // Once we've decided to kill (timeout or over-buffer), don't wait for 'close' — a
-    // grandchild that inherited the pipes can keep them open indefinitely, and 'close' would
-    // then never fire even though the child we care about is dead. 'exit' fires as soon as the
-    // child process itself has terminated, which is what "killed after timeout_ms" means. Before
-    // settling (which cancels the grace timer), SIGKILL the group: a grandchild that trapped the
-    // SIGTERM must not survive just because its parent died first.
+    // Capture the group before unregistering on EVERY leader exit. Never signal the dead
+    // leader/group again: each remaining member has its own synchronous identity check.
     child.on('exit', (code, signal) => {
-      if (timedOut || overBuffer) {
-        killGroup('SIGKILL');
-        settle({
-          result: 'failed',
-          code,
-          signal,
-          stdout: stdoutText(),
-          stderr: stderrText(),
-          timedOut,
-          ...(overBuffer ? { error: 'exec: maxBufferBytes exceeded' } : {}),
-        });
+      if (termTimer) clearTimeout(termTimer);
+      if (killTimer) clearTimeout(killTimer);
+      const members = typeof pid === 'number' ? groupMembers(pid) : new Map();
+      if (typeof pid === 'number') untrackChild(pid);
+      remaining = stopMembers(members, KILL_GRACE_MS).then(() => {});
+      if (timedOut || overBuffer || members.size > 0) {
+        settle({ code, signal });
       }
     });
 
     child.on('close', (code, signal) => {
-      const result = !timedOut && !overBuffer && code !== null && okExitCodes.includes(code) ? 'ok' : 'failed';
-      settle({ result, code, signal, stdout: stdoutText(), stderr: stderrText(), timedOut });
+      settle({ code, signal });
     });
   });
 }