@codedology/code-forge 0.15.2 → 0.15.4

package/src/cli/review-file.mjs

@@ -67,30 +67,91 @@
  * needs its own review.
  */
 
-import { readFileSync, realpathSync, rmSync } from 'node:fs';
+import { lstatSync, readdirSync, readFileSync, realpathSync, rmSync, statSync, watch } from 'node:fs';
 import path from 'node:path';
-import { answersTicketId, assertAnswers, blockTickets, deliverBlockFindings, dropDoneIf, enqueue, enqueueAnswers, isDone, liveWorker, MAX_ANSWERS, queueDir, resolveTicket } from '../worker/queue.mjs';
+import { setTimeout as delay } from 'node:timers/promises';
+import { answersTicketId, assertAnswers, blockTickets, clearDone, deliverBlockFindings, dropDoneIf, enqueue, enqueueAnswers, enqueueHash, isDone, liveWorker, MAX_ANSWERS, queueDir, resolveHashTicket, resolveTicket, reviewExclusionFor } from '../worker/queue.mjs';
 import { assertBlockId, assertInsideRoot, assertTicketId, contentHash, mainRootOf, normalizeRequestPath, repoRootOf, WorkerError } from '../worker/ticket.mjs';
-import { blockFileSet, namedOnHash } from '../review/gate-check.mjs';
+import { changedFiles, checkBlockReviews, namedOnHash, ownsAt } from '../review/gate-check.mjs';
+import { AUTO_REQUEUE_REASON, isAutomaticReopen, reopenFile, stopContentHash } from '../review/reopen.mjs';
+import { loadState } from '../worker/review-state.mjs';
 import { STOP_EXITS } from '../review/stop-exits.mjs';
 import { budgetFor } from '../review/packet.mjs';
 import { ownsFile } from '../state/registry.mjs';
-import { readAllRows } from '../ledger/write.mjs';
+import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { assertRunId } from '../state/paths.mjs';
-import { readRun } from '../state/run.mjs';
+import { readRun, writeSigned } from '../state/run.mjs';
+import { loadKey } from '../state/signer.mjs';
+import { rebaseBlock } from '../state/block.mjs';
 import { configInForce } from '../state/config-snapshot.mjs';
+import { reviewExcludeRule } from '../config/validate.mjs';
 import { blockTree } from '../proof/worktree.mjs';
 import { writeSafe } from '../util/redact.mjs';
+import { daemonRequest } from '../util/native.mjs';
+import { runRootPath } from '../util/tmp.mjs';
 
 const USAGE =
-  'usage: code-forge review-file <path> --block <id> [--run <id>] [--fresh] | review-file --wait <ticket> [--max <seconds>s]\n' +
+  'usage: code-forge review-file [--cwd <dir>] <path> --block <id> [--run <id>] [--fresh] | review-file --wait <ticket> [--max <seconds>s]\n' +
   '       code-forge review-file --wait-block <id> --run <id> [--max <seconds>s]\n' +
-  '       code-forge review-file <answering file> --block <id> --answers <id,id,…> --of <source> [--run <id>]\n';
+  '       code-forge review-file --rebase-check --block <id> --run <id>\n' +
+  '       code-forge review-file <answering file> --block <id> --answers <id,id,…> --of <source> [--run <id>]\n' +
+  '       --cwd <dir> applies to queueing and both wait modes\n';
 
 export const DEFAULT_WAIT_MS = 90_000;
 const POLL_MS = 200;
+const MAX_IDLE_MS = 5000;
+
+/** Metadata only: never open file content during an idle poll.
+ * @param {string} file @returns {string}
+ */
+function fileStamp(file) {
+  try {
+    const s = lstatSync(file);
+    return `${s.mtimeMs}:${s.size}:${s.mode}:${s.ino}`;
+  } catch (err) {
+    if (err.code === 'ENOENT' || err.code === 'ENOTDIR') return 'missing';
+    throw err;
+  }
+}
+
+/** Scan literal ownership prefixes, including directory entries so new files are noticed.
+ * @param {string} tree @param {string[]} owned @param {string[]} gitPaths
+ */
+function waitTreeStamp(tree, owned, gitPaths) {
+  const entries = new Map();
+  /** @param {string} full */
+  function visit(full) {
+    if (entries.has(full)) return;
+    const stamp = fileStamp(full);
+    entries.set(full, stamp);
+    if (stamp !== 'missing' && lstatSync(full).isDirectory()) {
+      for (const name of readdirSync(full).sort()) {
+        if (name !== '.git' && name !== '.code-forge') visit(path.join(full, name));
+      }
+    }
+  }
+  for (const pattern of owned) {
+    const segments = pattern.split('/');
+    const glob = segments.findIndex((s) => /[*?{]/.test(s));
+    visit(path.join(tree, ...(glob < 0 ? segments : segments.slice(0, glob))));
+  }
+  for (const full of gitPaths) visit(full);
+  return JSON.stringify([...entries].sort(([a], [b]) => a.localeCompare(b)));
+}
+
+/** Git may store worktree metadata outside the content tree.
+ * @param {string} tree @returns {string[]}
+ */
+function waitGitPaths(tree) {
+  let gitDir = path.join(tree, '.git');
+  if (lstatSync(gitDir).isFile()) gitDir = path.resolve(tree, readFileSync(gitDir, 'utf8').trim().replace(/^gitdir: /, ''));
+  let common = gitDir;
+  try { common = path.resolve(gitDir, readFileSync(path.join(gitDir, 'commondir'), 'utf8').trim()); }
+  catch (err) { if (err.code !== 'ENOENT') throw err; }
+  return [path.join(tree, '.gitignore'), ...new Set([gitDir, common])].flatMap((dir, i) => i === 0 ? [dir] : ['HEAD', 'index', 'packed-refs', 'refs', 'info/exclude'].map((f) => path.join(dir, f)));
+}
 
 /**
  * `90s`, `90`, `1500ms` → milliseconds.
@@ -394,9 +455,11 @@ export function fixList(result) {
  * B100: read block scope from the workspace mirror, never the private run record. This is a
  * progress summary, not an approval: block close still verifies the authoritative signed rows.
  * @param {string} repoRoot @param {string} cwd @param {string} run @param {string} block
- * @returns {Promise<{entry: Record<string, any>, tree: string}>}
+ * @param {{scopeFile: string, stamp: string, entry: Record<string, any>, tree: string, cfg: Record<string, any> | null, project: string} | null} [cached]
+ * @returns {Promise<{scopeFile: string, stamp: string, entry: Record<string, any>, tree: string, cfg: Record<string, any> | null, project: string}>}
  */
-async function waitBlockScope(repoRoot, cwd, run, block) {
+async function waitBlockScope(repoRoot, cwd, run, block, cached = null) {
+  if (cached && fileStamp(cached.scopeFile) === cached.stamp) return cached;
   const top = await repoRootOf(cwd);
   const candidates = new Set([repoRoot]);
   for (let dir = realpathSync(cwd); ; dir = path.dirname(dir)) {
@@ -416,7 +479,8 @@ async function waitBlockScope(repoRoot, cwd, run, block) {
       throw new WorkerError('block-scope-unreadable', 'the block scope cannot be read');
     }
     const tree = (await blockTree(record.workspace, entry))?.top ?? repoRoot;
-    return { entry, tree };
+    const scopeFile = path.join(dir, '.code-forge', 'runs', `${run}.json`);
+    return { entry, tree, cfg: configInForce(record), project: record.project, scopeFile, stamp: fileStamp(scopeFile) };
   }
   throw new WorkerError('block-scope-unreadable', 'the block scope cannot be read');
 }
@@ -445,42 +509,173 @@ function blockTicketOutcome(marker) {
   return 'unavailable';
 }
 
+/** Completion timings are progress metadata; old markers remain readable.
+ * @param {Record<string, any> | null} value @returns {Record<string, any>} */
+function ticketTimings(value) {
+  return Object.fromEntries(['queued_at', 'started_at', 'finished_at', 'duration_ms']
+    .filter((key) => value && Object.hasOwn(value, key)).map((key) => [key, value[key]]));
+}
+
+/** Restart only verified stopped reviews whose findings were not waived and whose bytes changed.
+ * Shared by the join and close; ordinary progress polling needs no signing key.
+ * @param {{repoRoot: string, run: string, block: string, tree: string, files: string[], print: (line: string) => unknown}} opts
+ * @returns {Promise<Map<string, string>>} restart timestamp by file
+ */
+export async function requeueStoppedFiles({ repoRoot, run, block, tree, files, print }) {
+  const restarted = new Map();
+  if (files.length === 0) return restarted;
+  const record = await readRun(run);
+  const entry = record.blocks?.[block];
+  if (entry?.status !== 'open') return restarted;
+  if (realpathSync(await mainRootOf(record.workspace)) !== realpathSync(repoRoot)) throw new WorkerError('other-workspace', 'the run belongs to another workspace');
+  const recordedTree = (await blockTree(record.workspace, entry))?.top ?? repoRoot;
+  if (realpathSync(recordedTree) !== realpathSync(tree)) throw new WorkerError('worktree-mismatch', 'the block scope does not match the recorded content tree');
+  const owns = ownsAt(path.relative(realpathSync(repoRoot), realpathSync(record.workspace)).split(path.sep).join('/'));
+  const key = await loadKey(run);
+  const rows = (await readAllRows(record.project)).filter((row) => row.run === run);
+  const root = configInForce(record)?.tmp?.root;
+  const runRootDir = runRootPath(run, root == null ? {} : { root });
+  const where = realpathSync(tree) === realpathSync(repoRoot) ? {} : { tree: realpathSync(tree) };
+  const writeRow = (row) => appendRow(row, { slug: record.project });
+  for (const file of files) {
+    if (!owns(entry.owned_files, file, entry.owned_kinds) || reviewExcludeRule(configInForce(record), file) !== null) continue;
+    if (Object.entries(record.blocks).some(([id, other]) => id !== block && other.status === 'open' && owns(other.owned_files, file, other.owned_kinds))) continue;
+    const loaded = loadState({ runId: run, block, file, key, rows, runRootDir, contentRoot: tree, migrate: false });
+    if (!['ok', 'restored'].includes(loaded.status) || loaded.state?.status !== 'stopped' || !loaded.state.open?.length) continue;
+    const fromHash = stopContentHash(loaded.state, rows, { runId: run, block, file, key });
+    const currentHash = contentHash(tree, file);
+    if (fromHash === null || fromHash === currentHash) continue;
+    // A newer accepted review wins over a stopped snapshot. At the stopped hash, use the
+    // same waiver rules as the gate, including severity and signature checks.
+    const needsReview = (hash) => checkBlockReviews({ runId: run, block, key,
+      rows: rows.filter((row) => row.file === undefined || row.file === file),
+      files: [{ file, content_hash: hash }], proofFiles: [], highPaths: [],
+    }).refusals.some((value) => value.file === file && ['unreviewed', 'unsigned', 'not_approved', 'review_cap', 'autopilot_waiver_invalid'].includes(value.code));
+    if (!needsReview(currentHash) || !needsReview(fromHash)) continue;
+    const result = await reopenFile({ runId: run, id: block, file, reason: AUTO_REQUEUE_REASON,
+      record, rows, key, writeRow, writeSigned, automatic: true,
+      io: {
+        owns, loadState: () => loaded, contentHash: (f) => contentHash(tree, f),
+        clearDone: (f) => clearDone({ repoRoot, run, block, file: f, ...where }).removed,
+        enqueue: (f, row) => enqueue({ repoRoot, run, block, file: f, ...where, after: row.ts }).ticket,
+      },
+    });
+    restarted.set(file, result.row.ts);
+    if (!result.existing) print(`auto-requeue ${file}: content changed after stopped review (ticket ${result.ticket})\n`);
+  }
+  return restarted;
+}
+
 /**
- * A block wait uses unsigned results only to classify retries; it never reads the signing key.
- * Re-scan current content on every poll. Deliver unseen findings of the newest earlier ticket
- * before rechecking a blind edit; the next join queues the fix. Stopped files stay finished.
- * @param {{repoRoot: string, cwd: string, block: string, run: string, maxMs: number, pollMs: number, say: (obj: Record<string, any>) => unknown, dropDone?: typeof dropDoneIf}} opts
+ * Ordinary block progress uses unsigned results. Restarting changed stopped findings verifies
+ * the durable state and writes a signed restart before queuing the new attempt.
+ * Re-scan metadata each poll and read content only after its stamp changes. Deliver unseen findings of the newest earlier ticket
+ * before rechecking a blind edit; the next join queues the fix. Changed stopped findings restart.
+ * @param {{repoRoot: string, cwd: string, block: string, run: string, maxMs: number, pollMs: number, say: (obj: Record<string, any>) => unknown, print: (line: string) => unknown, dropDone?: typeof dropDoneIf, now?: () => number, sleep?: (ms: number, signal?: AbortSignal) => Promise<unknown>}} opts
  */
-async function waitBlock({ repoRoot, cwd, block, run, maxMs, pollMs, say, dropDone = dropDoneIf }) {
-  const { entry, tree } = await waitBlockScope(repoRoot, cwd, run, block);
+async function waitBlock({ repoRoot, cwd, block, run, maxMs, pollMs, say, print, dropDone = dropDoneIf, now = Date.now, sleep = (ms, signal) => delay(ms, undefined, { signal }).catch((err) => { if (err.name !== 'AbortError') throw err; }) }) {
+  let scope = await waitBlockScope(repoRoot, cwd, run, block);
+  const { tree } = scope;
+  const gitPaths = waitGitPaths(tree);
   const where = realpathSync(tree) === realpathSync(repoRoot) ? {} : { tree: realpathSync(tree) };
-  const deadline = Date.now() + maxMs;
+  const deadline = now() + maxMs;
+  let interval = pollMs;
+  let seen = '';
+  let treeStamp = '';
+  /** @type {string[]} */
+  let current = [];
+  /** @type {Map<string, {stamp: string, content_hash: string}>} */
+  const hashes = new Map();
   let downPolls = 0;
   const deliveredHere = new Set();
+  let changed = false;
+  /** @type {(() => void) | null} */
+  let wake = null;
+  /** @type {import('node:fs').FSWatcher | undefined} */
+  let watcher;
+  const notify = () => { changed = true; wake?.(); };
+  // Install before scanning so a completion between the scan and the wait is retained.
+  // Queue .done markers are already published after their results, on macOS and Linux.
+  try {
+    watcher = watch(queueDir(repoRoot), (_event, name) => {
+      if (name === null || String(name).endsWith('.done')) notify();
+    });
+    watcher.on('error', () => { watcher.close(); notify(); });
+  } catch { /* unavailable watches retain the existing backoff polling */ }
+  try {
   for (;;) {
+    changed = false;
+    scope = await waitBlockScope(repoRoot, cwd, run, block, scope);
+    // Keep one daemon join for the remaining deadline: it retains findings already
+    // delivered while other files are pending, just like deliveredHere below.
+    const answer = await daemonRequest(run, { method: 'wait-block', block, max_ms: Math.max(0, deadline - now()) }, { config: scope.cfg });
+    // A stopped review may need a signed automatic reopen. Keep that mutation
+    // on the existing Node path; ordinary pending/completed polls stay read-free.
+    if (answer && !answer.files.some((/** @type {Record<string, any>} */ file) => file.outcome === 'stopped')) {
+      if (answer.reason === 'wait_timeout' && now() < deadline) continue;
+      // Go serializes map keys alphabetically; retain the CLI's byte order.
+      const files = answer.files.map((/** @type {Record<string, any>} */ f) => ({
+        file: f.file, ticket: f.ticket, status: f.status, outcome: f.outcome,
+        ...(f.rule !== undefined ? { rule: f.rule } : {}), ...ticketTimings(f),
+      }));
+      say({ block, files, done: answer.done,
+        ...(answer.status !== undefined ? { status: answer.status } : {}),
+        ...(answer.reason !== undefined ? { reason: answer.reason } : {}),
+        ...(answer.next !== undefined ? { next: answer.next } : {}),
+      });
+      return answer.status === 'worker_down' ? 3 : 0;
+    }
     const worker = liveWorker(repoRoot);
     const live = worker?.run === run;
     downPolls = live ? 0 : downPolls + 1;
     const tickets = blockTickets({ repoRoot, run, block, ...where });
-    const current = await blockFileSet({ repoRoot: tree, base: entry.base_sha, owned: entry.owned_files, ownedKinds: entry.owned_kinds });
-    const files = current.map(({ file }) => {
-      const opts = { repoRoot, run, block, file, ...where };
-      const { ticket } = resolveTicket(opts);
-      const previous = tickets.filter((t) => t.file === file);
+    scope = await waitBlockScope(repoRoot, cwd, run, block, scope);
+    const { entry, cfg, project } = scope;
+    const stamp = waitTreeStamp(tree, entry.owned_files, gitPaths) + scope.stamp;
+    if (stamp !== treeStamp) {
+      current = (await changedFiles({ repoRoot: tree, base: entry.base_sha })).filter((file) => ownsFile(entry.owned_files, file, entry.owned_kinds));
+      treeStamp = stamp;
+    }
+    const stopped = current.filter((file) => {
+      const latest = tickets.filter((ticket) => ticket.file === file).at(-1);
+      return latest && blockTicketMarker(repoRoot, latest.ticket)?.status === 'stopped'
+        && doneResult(repoRoot, latest.ticket)?.findings?.length > 0;
+    });
+    const restarted = live ? await requeueStoppedFiles({ repoRoot, run, block, tree, files: stopped, print }) : new Map();
+    // Progress only, like answersPrecheck: sandboxed callers may not read the private ledger.
+    // Reopens issued here also renew the workspace ticket, which needs no private read to join.
+    let rows = [];
+    try { rows = await readAllRows(project); } catch { /* The worker verifies the signed row. */ }
+    const reopens = new Map();
+    for (const row of rows) {
+      if (row.event !== 'review.reopened' || row.run !== run || row.block !== block || !Number.isFinite(Date.parse(row.ts))) continue;
+      if (row.by !== 'human' && !(row.by === 'agent' && row.verdict?.verdict === 'agree') && !isAutomaticReopen(row)) continue;
+      if (!reopens.has(row.file) || row.ts > reopens.get(row.file)) reopens.set(row.file, row.ts);
+    }
+    for (const [file, ts] of restarted) reopens.set(file, ts);
+    const files = current.map((file) => {
+      const rule = reviewExcludeRule(cfg, file);
+      if (rule !== null) return { file, ticket: null, status: 'excluded', outcome: null, rule };
+      const after = reopens.get(file);
+      const stamp = fileStamp(path.join(tree, file));
+      if (hashes.get(file)?.stamp !== stamp) hashes.set(file, { stamp, content_hash: contentHash(tree, file) });
+      const opts = { repoRoot, run, block, file, ...where, after, content_hash: hashes.get(file).content_hash };
+      const { ticket } = resolveHashTicket(opts);
+      const previous = tickets.filter((t) => t.file === file && (after === undefined || Date.parse(t.enqueued_at) > Date.parse(after)));
       let present = previous.find((t) => t.ticket === ticket);
       if (!present && previous.length > 0) {
         const newest = previous[previous.length - 1];
         const marker = blockTicketMarker(repoRoot, newest.ticket);
-        if (marker?.status === 'stopped') return { file, ticket: newest.ticket, status: 'done', outcome: blockTicketOutcome(marker) };
+        if (marker?.status === 'stopped') return { file, ticket: newest.ticket, status: 'done', outcome: blockTicketOutcome(marker), ...ticketTimings(marker) };
         if (marker?.status === 'reviewed' && marker.open_findings === true && live) {
           if (deliveredHere.has(newest.ticket) || deliverBlockFindings({ repoRoot, block, file, ticket: newest.ticket })) {
             deliveredHere.add(newest.ticket);
-            return { file, ticket: newest.ticket, status: 'findings', outcome: blockTicketOutcome(marker) };
+            return { file, ticket: newest.ticket, status: 'findings', outcome: blockTicketOutcome(marker), ...ticketTimings(marker) };
           }
         }
       }
       if (!present && live) {
-        enqueue(opts);
+        enqueueHash(opts);
         present = { ...previous[previous.length - 1], ticket };
       }
       let marker = present ? blockTicketMarker(repoRoot, ticket) : null;
@@ -488,7 +683,7 @@ async function waitBlock({ repoRoot, cwd, block, run, maxMs, pollMs, say, dropDo
         dropFreshDone({ repoRoot, ticket, file, dropDone, once: true, statuses: RETRY_STATUSES });
         marker = blockTicketMarker(repoRoot, ticket);
       }
-      return { file, ticket: present ? ticket : null, status: !present ? 'not_queued' : marker ? 'done' : 'pending', outcome: blockTicketOutcome(marker) };
+      return { file, ticket: present ? ticket : null, status: !present ? 'not_queued' : marker ? 'done' : 'pending', outcome: blockTicketOutcome(marker), ...ticketTimings(marker) };
     });
     if (downPolls >= 2) {
       say({ block, files, done: false, status: 'worker_down' });
@@ -499,38 +694,72 @@ async function waitBlock({ repoRoot, cwd, block, run, maxMs, pollMs, say, dropDo
       say({ block, files, done: false, reason: 'split_required', next: `The owner raises review.budgets for ${split.file}, runs run reload, then review-file ${split.file} --fresh.` });
       return 0;
     }
-    if (live && files.every((f) => f.status === 'done' || f.status === 'findings')) {
+    if (live && files.every((f) => f.status === 'done' || f.status === 'findings' || f.status === 'excluded')) {
       say({ block, files, done: true });
       return 0;
     }
-    if (live && (files.some((f) => f.status === 'not_queued') || Date.now() >= deadline)) {
+    if (live && (files.some((f) => f.status === 'not_queued') || now() >= deadline)) {
       say({ block, files, done: false, reason: files.some((f) => f.status === 'not_queued') ? 'not_queued' : 'wait_timeout' });
       return 0;
     }
-    await new Promise((resolve) => setTimeout(resolve, pollMs));
+    const ticketIds = [...new Set([...tickets.map((t) => t.ticket), ...files.map((f) => f.ticket).filter(Boolean)])].sort();
+    const state = JSON.stringify([stamp, live, ticketIds, files]);
+    if (!changed) {
+      interval = seen === state ? Math.min(MAX_IDLE_MS, interval * 2) : pollMs;
+      seen = state;
+      const abort = new AbortController();
+      try {
+        const event = new Promise((resolve) => { wake = () => resolve(undefined); });
+        await Promise.race([event, sleep(Math.min(interval, Math.max(0, deadline - now())), abort.signal)]);
+      } finally { wake = null; abort.abort(); }
+    }
   }
+  } finally { watcher?.close(); }
 }
 
 /**
  * @param {string[]} args
- * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, cwd?: string, pollMs?: number, dropDone?: typeof dropDoneIf}} [deps] - `dropDone`: B75's claim, for tests.
+ * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, cwd?: string, pollMs?: number, dropDone?: typeof dropDoneIf, now?: () => number, sleep?: (ms: number, signal?: AbortSignal) => Promise<unknown>}} [deps] - `dropDone`: B75's claim, for tests.
  * @returns {Promise<number>}
  */
 export async function runReviewFile(args, deps = {}) {
   const stdout = deps.stdout ?? process.stdout;
   const stderr = deps.stderr ?? process.stderr;
   const say = (/** @type {Record<string, any>} */ obj) => writeSafe(stdout, `${JSON.stringify(obj)}\n`);
-  const cwd = deps.cwd ?? process.cwd();
   try {
-    const { flags, positionals } = parseFlags(args, { values: ['block', 'run', 'wait', 'wait-block', 'max', 'answers', 'of'], booleans: ['fresh'] });
+    const { flags, positionals } = parseFlags(args, { values: ['cwd', 'block', 'run', 'wait', 'wait-block', 'max', 'answers', 'of'], booleans: ['fresh', 'rebase-check'] });
+    let cwd = deps.cwd ?? process.cwd();
+    if (typeof flags.cwd === 'string') {
+      cwd = path.resolve(cwd, flags.cwd);
+      try {
+        if (!statSync(cwd).isDirectory()) throw new Error('not a directory');
+      } catch {
+        throw new WorkerError('usage', '--cwd must name an existing directory');
+      }
+    }
     // the queue and the worker: the main tree, also from inside a block's worktree
     const repoRoot = await mainRootOf(cwd);
 
+    if (flags['rebase-check'] === true) {
+      if (positionals.length || typeof flags.block !== 'string' || typeof flags.run !== 'string' || ['wait', 'wait-block', 'max', 'answers', 'of', 'fresh'].some((key) => flags[key] !== undefined)) {
+        throw new WorkerError('usage', '--rebase-check takes --block and --run only');
+      }
+      const block = assertBlockId(flags.block);
+      const runId = assertRunId(flags.run);
+      const worker = liveWorker(repoRoot);
+      if (!worker || worker.run !== runId) { say({ status: 'worker_down', block }); return 3; }
+      const record = await readRun(runId);
+      if (await mainRootOf(record.workspace) !== repoRoot) throw new WorkerError('other-workspace', 'the run belongs to another workspace');
+      const result = await rebaseBlock({ runId, id: block, rebaseCheck: true, writeRow: (row) => appendRow(row, { slug: record.project }) });
+      say({ block, status: 'queued', ...result, next: `code-forge block rebase ${block} --run ${runId}` });
+      return 0;
+    }
+
     if (flags['wait-block'] !== undefined) {
       if (positionals.length > 0 || flags.block !== undefined || flags.wait !== undefined || flags.answers !== undefined || flags.of !== undefined || flags.fresh === true || typeof flags.run !== 'string') {
         throw new WorkerError('usage', '--wait-block takes a block, --run and --max only');
       }
-      return await waitBlock({ repoRoot, cwd, block: assertBlockId(flags['wait-block']), run: assertRunId(flags.run), maxMs: flags.max === undefined ? DEFAULT_WAIT_MS : parseMax(flags.max), pollMs: deps.pollMs ?? POLL_MS, say, dropDone: deps.dropDone });
+      return await waitBlock({ repoRoot, cwd, block: assertBlockId(flags['wait-block']), run: assertRunId(flags.run), maxMs: flags.max === undefined ? DEFAULT_WAIT_MS : parseMax(flags.max), pollMs: deps.pollMs ?? POLL_MS, say, print: (line) => writeSafe(stderr, line), dropDone: deps.dropDone, now: deps.now, sleep: deps.sleep });
     }
 
     if (typeof flags.wait === 'string') {
@@ -542,7 +771,7 @@ export async function runReviewFile(args, deps = {}) {
       for (;;) {
         if (isDone(repoRoot, ticket)) {
           const result = doneResult(repoRoot, ticket);
-          say({ ticket, status: 'done', result, ...fixList(result) });
+          say({ ticket, status: 'done', result, ...ticketTimings(result), ...fixList(result) });
           return 0;
         }
         downPolls = liveWorker(repoRoot) ? 0 : downPolls + 1;
@@ -561,9 +790,23 @@ export async function runReviewFile(args, deps = {}) {
     if (positionals.length !== 1 || typeof flags.block !== 'string' || flags.max !== undefined) throw new WorkerError('usage', 'give one path and --block');
     const block = assertBlockId(flags.block);
     if (flags.fresh === true && (flags.answers !== undefined || flags.of !== undefined)) throw new WorkerError('usage', '--fresh takes no --answers or --of');
-    if (flags.answers !== undefined || flags.of !== undefined) return await enqueueAnswersTicket({ flags, answering: positionals[0], block, cwd, repoRoot, say });
     const file = normalizeRequestPath(positionals[0], cwd, await repoRootOf(cwd));
     const worker = liveWorker(repoRoot);
+    let cfg = null;
+    const requestedRun = typeof flags.run === 'string' ? flags.run : worker?.run;
+    if (requestedRun) {
+      try { cfg = configInForce(await readRun(requestedRun)); }
+      catch { /* The workspace mirror below also serves sandboxed callers. */ }
+    }
+    const candidates = [file, ...(typeof flags.of === 'string' ? [normalizeRequestPath(flags.of, cwd, await repoRootOf(cwd))] : [])];
+    for (const candidate of candidates) {
+      const rule = requestedRun ? reviewExclusionFor(repoRoot, requestedRun, candidate, cfg) : reviewExcludeRule(cfg, candidate);
+      if (rule !== null) {
+        writeSafe(stdout, `not reviewed (review.exclude ${rule}): ${candidate}\n`);
+        return 0;
+      }
+    }
+    if (flags.answers !== undefined || flags.of !== undefined) return await enqueueAnswersTicket({ flags, answering: positionals[0], block, cwd, repoRoot, say });
     if (!worker || (typeof flags.run === 'string' && flags.run !== worker.run)) {
       say({ status: 'worker_down', file });
       return 3;
@@ -574,12 +817,6 @@ export async function runReviewFile(args, deps = {}) {
     const tree = recorded === null ? await repoRootOf(cwd) : (recorded.top ?? repoRoot);
     assertInsideRoot(tree, file); // the path, re-checked in the tree its content is read from
     const where = realpathSync(tree) === realpathSync(repoRoot) ? {} : { tree };
-    let cfg = null;
-    try {
-      cfg = configInForce(await readRun(worker.run));
-    } catch {
-      // No readable snapshot: retain the existing cache and --fresh rules.
-    }
     if (flags.fresh === true) return freshTicket({ repoRoot, run: worker.run, block, file, where, say, cfg, stderr, ...(deps.dropDone ? { dropDone: deps.dropDone } : {}) });
     const queued = enqueue({ repoRoot, run: worker.run, block, file, ...where });
     const cached = queued.status === 'done' ? doneResult(repoRoot, queued.ticket) : null;

package/src/cli/run.mjs

@@ -40,7 +40,8 @@ import { configInForce } from '../state/config-snapshot.mjs';
 import { endRun, processStartTime, readRun, reattachWorker, RUN_MODES, startRun, stopPinnedWorker } from '../state/run.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { withLock } from '../util/file-locks.mjs';
-import { sweepRoots, tmpBase } from '../util/tmp.mjs';
+import { sweepProcesses } from '../util/reaper.mjs';
+import { tmpBase } from '../util/tmp.mjs';
 import { launchWorker, repinWorker } from '../worker/loop.mjs';
 import { liveWorker, workerRegistry } from '../worker/queue.mjs';
 import { repoRootOf } from '../worker/ticket.mjs';
@@ -173,7 +174,7 @@ export async function runRun(args, deps = {}) {
       const project = slugFor(loaded.config, workspace);
       const engine = typeof flags.engine === 'string' ? flags.engine : undefined;
       const tmpRoot = typeof loaded.config?.tmp?.root === 'string' ? loaded.config.tmp.root : undefined;
-      await sweepRoots({ root: tmpBase(tmpRoot) }); // dead runs' temp roots and orphans (§9.6, V12)
+      await sweepProcesses({ apply: true, root: tmpBase(tmpRoot), zombies: false });
       let record = await startRun({ workspace, project, config: loaded.config, engine, mode, runId, workerPid, writeRow: ledgerWriter(project), probe });
       if (!record.worker && startWorker) {
         const launched = await startWorker({ runId: record.run_id, workspace });

package/src/cli/status.mjs

@@ -54,9 +54,11 @@ import { budgetUsdOf } from '../ledger/spend.mjs';
 import { readAllRows } from '../ledger/write.mjs';
 import { findingsKey, openFindingsOf } from '../review/open-findings.mjs';
 import { briefStatus } from '../state/brief-status.mjs';
+import { configInForce } from '../state/config-snapshot.mjs';
 import { parseFlags } from '../state/cli-args.mjs';
 import { runsDir, StateError } from '../state/paths.mjs';
 import { readRun } from '../state/run.mjs';
+import { daemonRequest } from '../util/native.mjs';
 import { writeSafe } from '../util/redact.mjs';
 
 const USAGE = 'usage: code-forge status [--run <id>] [--json]\n';
@@ -80,15 +82,18 @@ async function realOr(p) {
 /**
  * The status data of one run.
  * @param {Record<string, any>} record
+ * @param {Array<Record<string, any>> | null | undefined} [cachedRows] - daemon's incrementally read ledger
  * @returns {Promise<RunStatus>}
  */
-async function statusOf(record) {
+export async function statusOf(record, cachedRows) {
   /** @type {Array<Record<string, any>> | null} null: the ledger cannot be read */
-  let rows = null;
-  try {
-    rows = await readAllRows(record.project);
-  } catch {
-    rows = null;
+  let rows = cachedRows ?? null;
+  if (cachedRows === undefined) {
+    try {
+      rows = await readAllRows(record.project);
+    } catch {
+      rows = null;
+    }
   }
   let budget = null;
   try {
@@ -113,6 +118,22 @@ async function statusOf(record) {
     ...(awaiting.length > 0 ? { awaiting_human_check: awaiting } : {}) };
 }
 
+/** Restore the Node renderer's insertion order after Go's sorted JSON map encoding.
+ * @param {Record<string, any>} s @returns {RunStatus}
+ */
+function daemonStatus(s) {
+  return {
+    run_id: s.run_id, status: s.status, mode: s.mode, spent_usd: s.spent_usd,
+    unknown_usd_sessions: s.unknown_usd_sessions, budget_usd: s.budget_usd,
+    blocks: s.blocks.map((/** @type {Record<string, any>} */ b) => ({
+      id: b.id, state: b.state, level: b.level, model: b.model,
+      gate: { result: b.gate.result, name: b.gate.name }, findings: b.findings,
+    })),
+    more: s.more, closed: s.closed, stopped: s.stopped,
+    ...(s.awaiting_human_check ? { awaiting_human_check: s.awaiting_human_check } : {}),
+  };
+}
+
 /**
  * Every run that is not ended whose workspace is `root`, newest first.
  * @param {string} root
@@ -155,7 +176,7 @@ export function runLines(s) {
   const lines = [`run ${s.run_id} · ${s.status ?? '-'} · ${s.mode} · spent ${spent}${s.budget_usd !== null ? ` of ${usd(s.budget_usd)}` : ''}`];
   const tally = s.closed + s.stopped > 0 ? `closed ${s.closed} · stopped ${s.stopped}` : null;
   const awaiting = s.awaiting_human_check?.length ? `awaiting_human_check: ${JSON.stringify(s.awaiting_human_check)}` : null;
-  const room = STATUS_MAX_LINES - 1 - (tally === null ? 0 : 1) - (awaiting === null ? 0 : 1);
+  const room = STATUS_MAX_LINES - lines.length - (tally === null ? 0 : 1) - (awaiting === null ? 0 : 1);
   const shown = s.blocks.length <= room ? s.blocks : s.blocks.slice(0, room - 1);
   for (const b of shown) {
     lines.push(`${b.id} ${b.state} ${b.level ?? '-'} · ${b.model ?? '-'} · gate ${b.gate.result}${b.gate.name ? ` (${b.gate.name})` : ''} · findings ${b.findings}`);
@@ -198,9 +219,22 @@ export default async function status(args) {
       records = await activeRunsFor(projectRootFor(process.cwd()));
     }
     const shown = [];
-    for (const record of records) shown.push(await statusOf(record));
+    for (const record of records) {
+      let config;
+      try {
+        config = configInForce(record);
+        if (!config) {
+          const loaded = await loadProjectConfig(record.workspace);
+          config = loaded.ok ? loaded.config : { native: { daemon: false } };
+        }
+      } catch { config = { native: { daemon: false } }; }
+      const answer = await daemonRequest(String(record.run_id), { method: 'status' }, { config });
+      let summary;
+      try { summary = answer ? daemonStatus(answer.runs[0]) : null; } catch { summary = null; }
+      shown.push(summary ?? await statusOf(record));
+    }
     if (json) {
-      out(`${JSON.stringify({ runs: shown })}\n`); // briefStatus builds exactly the clause-3 run object
+      out(`${JSON.stringify({ runs: shown })}\n`);
       return 0;
     }
     if (shown.length === 0) {

package/src/cli/sweep.mjs

@@ -0,0 +1,28 @@
+import { parseFlags } from '../state/cli-args.mjs';
+import { sweepProcesses } from '../util/reaper.mjs';
+import { writeSafe } from '../util/redact.mjs';
+
+const HELP = 'usage: code-forge sweep [--apply] [--json]\nDry run by default: list stale workers, dead-run registry children and marked orphans with RSS and total MB.\n--apply stops proven stale processes with SIGTERM, then SIGKILL after a grace period.\nZombies are reported by parent only; neither they nor their parents are signalled. Live engines have no memory limit.\n';
+
+/** @param {string[]} args @param {{sweep?:typeof sweepProcesses}} [deps] */
+export default async function runSweep(args, deps = {}) {
+  let flags;
+  try {
+    const parsed = parseFlags(args, { booleans: ['apply', 'json', 'help'] });
+    if (parsed.positionals.length) throw new Error('unexpected positional argument');
+    flags = parsed.flags;
+  } catch {
+    writeSafe(process.stderr, HELP);
+    return 2;
+  }
+  if (flags.help) { writeSafe(process.stdout, HELP); return 0; }
+  const report = await (deps.sweep ?? sweepProcesses)({ apply: flags.apply === true });
+  if (flags.json) writeSafe(process.stdout, `${JSON.stringify(report)}\n`);
+  else {
+    for (const item of report.items) writeSafe(process.stdout,
+      `${report.apply ? item.action ?? 'stopped' : 'would stop'} ${item.kind} pid ${item.pid} ${item.rssMb.toFixed(1)} MB ${item.command}\n`);
+    for (const group of report.zombies) writeSafe(process.stdout, `${group.count} zombies (parent ${group.ppid} ${group.command}) — report only\n`);
+    writeSafe(process.stdout, `${report.apply ? 'sweep' : 'dry run'}: ${report.items.length} processes, total ${report.totalRssMb.toFixed(1)} MB; ${report.registryRoots.length} dead-run roots\n`);
+  }
+  return 0;
+}

package/src/cli/validate.mjs

@@ -11,6 +11,7 @@ import { loadConfigFile, DEFAULT_CONFIG_FILENAME } from '../config/load.mjs';
 import { loadSeenInCache } from '../config/refresh.mjs';
 import { maskSecretTokens } from '../config/secret-patterns.mjs';
 import { validateConfig } from '../config/validate.mjs';
+import { loadPipeline } from '../pipeline/pipeline.mjs';
 import * as log from '../util/log.mjs';
 
 /** Provider -> the CLI binary name `engine: subprocess` would spawn for it. */
@@ -100,6 +101,11 @@ export default async function validate(args) {
   }
 
   if (result.valid) {
+    const pipeline = loadPipeline(path.dirname(parsed.file));
+    if (pipeline.exists && !pipeline.ok) {
+      for (const problem of pipeline.problems) log.error(maskSecretTokens(problem));
+      return 1;
+    }
     log.info(`${parsed.file}: valid (${result.warnings.length} warning${result.warnings.length === 1 ? '' : 's'})`);
     return 0;
   }