@codedology/code-forge 0.5.1 → 0.6.1

package/src/session/spawn.mjs

@@ -33,7 +33,8 @@
  * A coder argv that `isForbidden` matches is refused before anything spawns (§8.4). A
  * reviewer/judge/S2/author level on openai is refused too (`closed-book`, B32: Codex always has a
  * shell); an openai fallback step of such a session is skipped with one stderr line. The opt-in
- * `review.allow_open_book_codex: true` lifts both and builds Codex's read-only argv.
+ * `review.allow_open_book_codex: true` lifts both and builds Codex's read-only argv — except for
+ * the autopilot `delegate` (B46), which the opt-in never opens.
  *
  * `background: true` (coders, §5.2): the child is started detached with stdout/stderr going to
  * `<run-root>/sessions/<id>/session.log`, its pid written to `<run-root>/sessions/<id>/pid.json`
@@ -57,6 +58,8 @@ import { parseSentinel } from '../engines/sentinel.mjs';
 import { parseUsage } from '../engines/usage-parse.mjs';
 import { budgetUsdOf, checkBudget, estimateSessionUsd, priceSession, reservedUsd, reserveBudget, SPEND_UNREADABLE_MESSAGE, withBudgetLock } from '../ledger/spend.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
+import { categoryGate, categoryPlan, RECORD_UNKNOWN_MESSAGE } from '../autopilot/limits.mjs';
+import { StateError } from '../state/paths.mjs';
 import { exec } from '../util/exec.mjs';
 import { isForbidden, mergeForbidden } from '../util/forbidden.mjs';
 import { semaphore } from '../util/locks.mjs';
@@ -64,7 +67,7 @@ import { readStartTime, registerPid, UNKNOWN_START_TIME } from '../util/reaper.m
 import { redact, writeSafe } from '../util/redact.mjs';
 import { currentRunRoot, pidsDir, runRoot, tmpBase, untrustedReason } from '../util/tmp.mjs';
 
-export const ROLES = Object.freeze(['coder', 'reviewer', 'judge', 's2', 'author', 'facts']);
+export const ROLES = Object.freeze(['coder', 'reviewer', 'judge', 's2', 'author', 'facts', 'delegate']);
 export const LEVELS = Object.freeze(['L0', 'L1', 'L2', 'L3']);
 
 /** Default wall-clock cap of one foreground session. */
@@ -476,7 +479,7 @@ function childEnv(/** @type {NodeJS.ProcessEnv} */ env) {
  * @typedef {object} SessionOpts
  * @property {Record<string, any>} cfg - the loaded project config (levels, provider).
  * @property {"L0"|"L1"|"L2"|"L3"} level
- * @property {"coder"|"reviewer"|"judge"|"s2"|"author"|"facts"} role
+ * @property {"coder"|"reviewer"|"judge"|"s2"|"author"|"facts"|"delegate"} role
  * @property {string} promptPath - the brief (coder) or the packet (closed-book).
  * @property {string} [cwd] - coder: the project tree (default `process.cwd()`); facts (B9b.1): an
  *   existing read-only snapshot of the project to run in, inside `<runRoot>/facts/` or the
@@ -507,6 +510,7 @@ function childEnv(/** @type {NodeJS.ProcessEnv} */ env) {
  * @property {NodeJS.ProcessEnv} [env]
  * @property {(ms: number) => Promise<unknown>} [sleep] - B40: the rate-limit backoff wait (tests: a recorder).
  * @property {() => number} [random] - B40: the backoff jitter source, in [0, 1) (default `Math.random`).
+ * @property {() => Date} [now] - B48: the clock the autopilot grant is checked against (default: now).
  */
 
 /**
@@ -761,6 +765,14 @@ function sessionUsd(provider, level, usage) {
  * cost (`estimateSessionUsd`: the packet's bytes / 4 in, a fixed tokens_out per role and level)
  * run under the run's budget lock, so concurrent sessions of one run see each other's holds. No
  * budget (or no run) ⇒ no lock, no reservation.
+ *
+ * B48: with an active autopilot grant that caps the session's category (coder → coding, every
+ * other role → review), the same lock also runs the category check (`categoryGate`, after the
+ * `budget.usd` check): at `stop_at` × cap the session is refused, the grant pauses for the
+ * category and one signed `autopilot.pause` row is written; otherwise the estimate is reserved in
+ * the category too. The plan is re-read UNDER the lock, so the next session sees the pause the
+ * previous one wrote. A run record that cannot be read refuses with reason `autopilot-unknown`.
+ * No grant ⇒ exactly the B41 behaviour.
  * @param {SessionOpts} opts @param {SessionDeps} deps
  * @param {((row: Record<string, any>) => Promise<unknown>) | null} writeRow
  * @param {{write: (s: string) => unknown}} stderr
@@ -769,17 +781,65 @@ function sessionUsd(provider, level, usage) {
  *   the refusal result, or the (idempotent) release of this attempt's reservation.
  */
 async function budgetGate(opts, deps, writeRow, stderr, step) {
-  const budget = budgetUsdOf(opts.cfg);
-  if (budget === null || typeof opts.run !== 'string' || opts.run.length === 0) return { refused: null, release: () => {} };
+  const none = { refused: null, release: () => {} };
+  if (typeof opts.run !== 'string' || opts.run.length === 0) return none;
   const run = opts.run;
+  const budget = budgetUsdOf(opts.cfg);
+  // B48: an active autopilot grant that caps this role's category (null: nothing to meter). Read
+  // once here only to decide whether to lock at all, and again under the lock (below).
+  const now = (deps.now ?? (() => new Date()))();
+  const outside = await readCategoryPlan(run, opts.role, now);
+  if (budget === null && outside.plan === null && !outside.unknown) return none;
   const estimate = estimateSessionUsd({ provider: step.provider, level: opts.level, role: opts.role, tokensIn: packetTokens(opts) });
   return withBudgetLock(run, async () => {
-    const refused = await checkGate(opts, deps, writeRow, stderr, budget, estimate);
-    if (refused) return { refused };
-    return { refused: null, release: reserveBudget(run, estimate) };
+    // under the lock: a fresh clock (the lock may have waited) and a fresh plan, so a pause the
+    // previous session wrote is seen here
+    const lockedNow = (deps.now ?? (() => new Date()))();
+    const { plan, unknown } = await readCategoryPlan(run, opts.role, lockedNow);
+    if (unknown) {
+      writeSafe(stderr, `code-forge: ${RECORD_UNKNOWN_MESSAGE}\n`);
+      return { refused: { status: 'unavailable', reason: 'autopilot-unknown', message: RECORD_UNKNOWN_MESSAGE, answer: null } };
+    }
+    if (budget !== null) {
+      const refused = await checkGate(opts, deps, writeRow, stderr, budget, estimate);
+      if (refused) return { refused };
+    }
+    let releaseCategory = () => {};
+    if (plan !== null) {
+      const slug = opts.slug ?? plan.project;
+      const readRows = deps.readRows ?? (() => readAllRows(slug));
+      const gate = await categoryGate({ plan, run, role: opts.role, block: opts.block ?? null, readRows, writeRow, stderr, now: lockedNow, estimate });
+      if (gate.refused) return { refused: /** @type {SessionResult} */ (gate.refused) };
+      releaseCategory = gate.release;
+    }
+    const releaseRun = budget !== null ? reserveBudget(run, estimate) : () => {};
+    return {
+      refused: null,
+      release: () => {
+        releaseRun();
+        releaseCategory();
+      },
+    };
   });
 }
 
+/**
+ * B48: the category plan, with a known record-read failure turned into `unknown` (fail closed:
+ * a grant we cannot read is never "no grant"); any other error propagates. Accepted on purpose:
+ * an unreadable run record refuses the session even for a run without a grant — the record is
+ * what says whether a grant exists.
+ * @param {string} run @param {string} role @param {Date} now
+ * @returns {Promise<{plan: import('../autopilot/limits.mjs').CategoryPlan | null, unknown: boolean}>}
+ */
+async function readCategoryPlan(run, role, now) {
+  try {
+    return { plan: await categoryPlan(run, role, now), unknown: false };
+  } catch (thrown) {
+    if (thrown instanceof StateError && thrown.code === 'record-unknown') return { plan: null, unknown: true };
+    throw thrown;
+  }
+}
+
 /**
  * The packet's (or brief's) tokens plus the system prompt's, by the ledger's bytes / 4 rule (an
  * unreadable packet counts 0 bytes; tokens_out is still reserved).

package/src/state/run.mjs

@@ -205,14 +205,20 @@ export async function startRun(opts) {
  * source of truth), then one signed `run.reload` row: the changed key PATHS (never values) and
  * the old/new snapshot hashes. A row that cannot be written leaves the reload in place and is
  * reported as `rowError`.
+ *
+ * B48 `guard`: called under the lock after the fixed-key check, with the record, the snapshot in
+ * force (undefined for a record from before snapshots), the new config and the changed key paths
+ * (null without a snapshot); it throws to refuse the reload (nothing written). The autopilot limit
+ * guard (`src/autopilot/limits.mjs`) uses it.
  * @param {{
  *   runId: string, config: Record<string, any>, readPending?: () => string[], effectiveSlug?: string,
  *   writeRow: WriteRow, now?: Date,
+ *   guard?: (record: Record<string, any>, before: Record<string, any> | undefined, config: Record<string, any>, changed: string[] | null) => void | Promise<void>,
  * }} opts
  * @returns {Promise<{changed: string[] | null, oldHash: string | null, newHash: string, pinned: number, rowError: string | null}>}
  *   `changed` is `[]` when nothing changed.
  */
-export async function reloadRun({ runId, config, readPending = () => [], effectiveSlug, writeRow, now = new Date() }) {
+export async function reloadRun({ runId, config, readPending = () => [], effectiveSlug, writeRow, now = new Date(), guard }) {
   return withRunLock(runId, async () => {
     const current = await readRun(runId);
     if (current.status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
@@ -238,6 +244,7 @@ export async function reloadRun({ runId, config, readPending = () => [], effecti
       throw new StateError('immutable-key', `${why.join('; ')} — put ${frozen.length === 1 ? 'it' : 'them'} back, or end the run and start a new one`);
     }
     const changed = state ? changedKeyPaths(before, config) : null;
+    if (guard) await guard(current, state ? before : undefined, config, changed);
     /** @type {Record<string, string>} */
     const pins = {};
     const oldPins = state?.pins && typeof state.pins === 'object' ? state.pins : {};

package/src/util/breadcrumbs.mjs

@@ -25,6 +25,7 @@ import path from 'node:path';
  * @type {Readonly<Record<string, readonly string[]>>}
  */
 export const SUBCOMMANDS = Object.freeze({
+  autopilot: ['start', 'status', 'stop'],
   block: ['open', 'attempt', 'rebase', 'claim', 'close', 'stop', 'waive'],
   gates: ['detect', 'run', 'secret-scan', 'safe-edit', 'scope', 'acceptance', 'transcript-grep'],
   jev: ['ask'],

package/src/util/forbidden.mjs

@@ -276,6 +276,7 @@ export const FORBIDDEN = Object.freeze(
  * They are NOT part of `FORBIDDEN` (whose rendered count other blocks pin); `mergeForbidden()`
  * always appends them, so every list built for a coder carries them.
  *  - `code-forge block waive` — waiving a review finding is human-only;
+ *  - `code-forge autopilot` (any subcommand, B45) — the owner's grant to a delegate;
  *  - `--no-require-reviews` — the human's way out of `block close`'s per-file review check.
  * @type {ReadonlyArray<ForbiddenEntry>}
  */
@@ -290,6 +291,15 @@ export const CODER_ONLY_FORBIDDEN = Object.freeze(
       ],
       description: 'Waive a review finding (forge block waive) — human-only, run by the orchestrator after the human said so (§4.9)',
     },
+    {
+      id: 'code-forge-autopilot-from-coder',
+      kind: 'anyPrefix',
+      prefixes: [
+        ['code-forge', 'autopilot'],
+        ['forge', 'autopilot'],
+      ],
+      description: 'Any autopilot command (forge autopilot start / status / stop / …) — the owner grants, reads and ends autopilot, never a coder',
+    },
     {
       id: 'code-forge-no-require-reviews',
       kind: 'contains',

package/src/util/gh.mjs

@@ -0,0 +1,175 @@
+/**
+ * Shared `gh` helpers (moved out of `cli/logs.mjs`, B27/B28, for B47's tracked waiver issues):
+ * the secret check a body must pass before it leaves the machine, a PATH lookup, and the `gh`
+ * calls — argv only, never a shell, never gh's output in a message (only `exit n`).
+ *
+ *  - {@link findSecret}: the first secret-shaped text in a body (rule name and line only).
+ *  - {@link pathLookup}: whether a command is an executable on PATH.
+ *  - {@link ghRun}: one `gh` call that never throws.
+ *  - {@link ghWithBodyFile}: a `gh` call whose body goes through a private temp file (removed after).
+ *  - {@link findReported}: an earlier issue holding a marker in its body.
+ */
+
+import { accessSync, constants as fsConstants, statSync } from 'node:fs';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { SECRET_LOOKING_PATTERNS } from '../config/secret-patterns.mjs';
+import { exec as realExec } from './exec.mjs';
+import { currentRunRoot } from './tmp.mjs';
+
+/** Every `gh` call gets at most this long. */
+export const GH_TIMEOUT_MS = 60_000;
+
+/**
+ * Secret shapes the final report is checked for, after scrubbing. A hit stops the report.
+ * @type {ReadonlyArray<{name: string, re: RegExp}>}
+ */
+export const REPORT_SECRET_RULES = Object.freeze([
+  { name: 'API key (sk-)', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{10,}/ },
+  { name: 'GitHub token', re: /(?<![A-Za-z0-9_])(?:gh[opsur]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/ },
+  { name: 'Slack token', re: /(?<![A-Za-z0-9_-])xox[abprs]-[A-Za-z0-9-]{10,}/ },
+  { name: 'AWS access key', re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![0-9A-Z])/ },
+  { name: 'private key', re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
+  { name: 'JWT', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/ },
+  // copied without g/y: `.test()` must carry no `lastIndex` state between checks
+  ...SECRET_LOOKING_PATTERNS.map((re) => ({ name: 'secret-shaped token', re: new RegExp(re.source, re.flags.replace(/[gy]/g, '')) })),
+]);
+
+/** @param {string} s @returns {number} Shannon entropy in bits per character */
+export function entropy(s) {
+  /** @type {Map<string, number>} */
+  const freq = new Map();
+  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
+  let bits = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    bits -= p * Math.log2(p);
+  }
+  return bits;
+}
+
+/**
+ * A 32+ character run of `[A-Za-z0-9+/_=-]` with at least two of upper/lower/digit and entropy of
+ * at least 4 bits per character. A hex-only run (`0-9a-f`, either case) is never flagged here: a
+ * hash using all 16 digits evenly reaches exactly 4 bits and would otherwise trip the rule; the
+ * token-shape rules ({@link REPORT_SECRET_RULES}) still apply to it.
+ * @param {string} line
+ * @returns {boolean}
+ */
+function hasHighEntropyRun(line) {
+  for (const m of line.matchAll(/[A-Za-z0-9+/_=-]{32,}/g)) {
+    const run = m[0];
+    if (/^[0-9a-f]+$/i.test(run)) continue; // a hash, not a token
+    const classes = [/[A-Z]/, /[a-z]/, /[0-9]/].filter((re) => re.test(run)).length;
+    if (classes >= 2 && entropy(run) >= 4) return true;
+  }
+  return false;
+}
+
+/**
+ * The first secret-shaped text in `text` (rule name and 1-based line), or null. The matched text
+ * itself is never returned.
+ * @param {string} text
+ * @returns {{rule: string, line: number}|null}
+ */
+export function findSecret(text) {
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i += 1) {
+    for (const r of REPORT_SECRET_RULES) if (r.re.test(lines[i])) return { rule: r.name, line: i + 1 };
+    if (hasHighEntropyRun(lines[i])) return { rule: 'high-entropy string', line: i + 1 };
+  }
+  return null;
+}
+
+/** @param {string} pathEnv @returns {(cmd: string) => boolean} */
+export function pathLookup(pathEnv) {
+  return (cmd) =>
+    pathEnv.split(path.delimiter).some((dir) => {
+      if (!dir) return false;
+      try {
+        const f = path.join(dir, cmd);
+        accessSync(f, fsConstants.X_OK);
+        return statSync(f).isFile();
+      } catch {
+        return false;
+      }
+    });
+}
+
+/**
+ * One `gh` call; a throw from `exec` is a `failed` result with no output.
+ * @param {typeof realExec} exec @param {string[]} argv @param {NodeJS.ProcessEnv} env
+ * @param {{cwd?: string}} [opts]
+ * @returns {Promise<{result: string, code: number|null, timedOut: boolean, stdout: string, stderr: string}>}
+ */
+export async function ghRun(exec, argv, env, opts = {}) {
+  try {
+    return await exec(argv, { env, timeoutMs: GH_TIMEOUT_MS, ...(opts.cwd ? { cwd: opts.cwd } : {}) });
+  } catch {
+    return { result: 'failed', code: null, timedOut: false, stdout: '', stderr: '' };
+  }
+}
+
+/**
+ * Write `text` to a private temp file and run the first argv of `argvsFor(file)`; when it fails
+ * over a label, run the next one (once).
+ * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} text
+ * @param {(file: string) => string[][]} argvsFor
+ * @param {(stdout: string) => void} [onOk]
+ * @returns {Promise<string|null>} null when gh succeeded; else why (`exit n`, never its output).
+ */
+export async function ghWithBodyFile(exec, env, text, argvsFor, onOk) {
+  /** @type {string|null} */
+  let dir = null;
+  try {
+    let res;
+    try {
+      const root = currentRunRoot();
+      await mkdir(root, { recursive: true });
+      dir = await mkdtemp(path.join(root, 'report-'));
+      const bodyFile = path.join(dir, 'body.md');
+      await writeFile(bodyFile, text, { encoding: 'utf8', mode: 0o600 });
+      const [first, retry] = argvsFor(bodyFile);
+      res = await ghRun(exec, first, env);
+      // gh's stderr is matched to decide the retry, never printed
+      if (res.result !== 'ok' && retry && /label/i.test(res.stderr)) res = await ghRun(exec, retry, env);
+    } catch {
+      return 'could not write the report file';
+    }
+    if (res.result !== 'ok') return res.code !== null ? `exit ${res.code}` : res.timedOut ? 'timed out' : 'did not finish';
+    onOk?.(res.stdout);
+    return null;
+  } finally {
+    if (dir !== null) await rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
+/**
+ * An earlier issue holding `needle` in its body (open or closed): `{hit}` (null when there is
+ * none), or `{why}` when the search failed (`gh exit n`; never gh's output). With `opts.match`
+ * the bodies are fetched too and a hit must contain that exact text (GitHub's search is fuzzy);
+ * then a full page (`opts.limit` results, default 5) with no exact hit is `{why: 'too-many-results'}`
+ * — the match may be on a page not read, so the caller must not assume there is none.
+ * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} repo @param {string} needle
+ * @param {{match?: string, limit?: number}} [opts]
+ * @returns {Promise<{hit: {number: number, url: string, state: string}|null} | {why: string}>}
+ */
+export async function findReported(exec, env, repo, needle, opts = {}) {
+  const fields = opts.match === undefined ? 'number,url,state' : 'number,url,state,body';
+  const limit = Number.isInteger(opts.limit) && /** @type {number} */ (opts.limit) > 0 ? /** @type {number} */ (opts.limit) : 5;
+  const res = await ghRun(exec, ['gh', 'issue', 'list', '--repo', repo, '--state', 'all', '--search', `${needle} in:body`, '--json', fields, '--limit', String(limit)], env);
+  if (res.result !== 'ok') return { why: res.code !== null ? `gh exit ${res.code}` : res.timedOut ? 'gh timed out' : 'gh did not finish' };
+  let list;
+  try {
+    list = JSON.parse(res.stdout);
+  } catch {
+    return { why: 'gh gave no list' };
+  }
+  if (!Array.isArray(list)) return { why: 'gh gave no list' };
+  const match = opts.match;
+  const hit = list.find(
+    (i) => Number.isSafeInteger(i?.number) && typeof i?.url === 'string' && /^https:\/\//.test(i.url) && (match === undefined || (typeof i.body === 'string' && i.body.includes(match))),
+  );
+  if (!hit && match !== undefined && list.length >= limit) return { why: 'too-many-results' };
+  return { hit: hit ? { number: hit.number, url: hit.url, state: typeof hit.state === 'string' ? hit.state.toLowerCase() : 'unknown' } : null };
+}

package/src/worker/engine.mjs

@@ -42,7 +42,7 @@ import { planAndRecord, tierOf } from '../review/budget.mjs';
 import { budgetFor } from '../review/packet.mjs';
 import { reviewFile, rulesRisk } from '../review/engine.mjs';
 import { computeFileSet, ownsFile } from '../gates/scope.mjs';
-import { newFileState, runRound } from '../review/fixloop.mjs';
+import { extraRoundsFor, newFileState, reopenForExtraRound, runRound } from '../review/fixloop.mjs';
 import { readRun } from '../state/run.mjs';
 import { redact } from '../util/redact.mjs';
 import { keyedLock } from '../util/locks.mjs';
@@ -297,6 +297,9 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, blockKindOf, key,
     let state = loaded.state;
     if (state === null || state.status === 'complete') state = newFileState({ file: ticket.file, level, l3RungUsed: rungUsed });
     state.l3_rung_used = state.l3_rung_used || rungUsed;
+    // B47: an autopilot extra round raises the file's cap; a file stopped at the old cap reopens
+    const extraRounds = extraRoundsFor(rows, { runId: ctx.runId, block: ticket.block, file: ticket.file, key });
+    reopenForExtraRound(state, extraRounds, ctx.cfg);
 
     if (state.status === 'stopped') {
       return { outcome: /** @type {ReviewOutcome} */ ({ ...loopFields(state, null), status: 'stopped', stopped: state.next?.reason ?? 'stopped', approved: false, engine: 'adaptive', sessions: [], findings: state.open }) };
@@ -310,7 +313,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, blockKindOf, key,
       state.l3_rung_used = true; // the orchestrator ran the block's one L3 patch before this ticket
     }
     const fixed = state;
-    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq: loaded.seq, base, blockKindOf, workDir, factsExcerpt });
+    const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq: loaded.seq, base, blockKindOf, workDir, factsExcerpt, extraRounds });
     // a round that could take the rung keeps the block lock until its state is saved
     if (mayTakeRung(fixed, kind, ctx.cfg, rungUsed)) return { outcome: await round() };
     return { round };
@@ -321,10 +324,10 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, blockKindOf, key,
 /**
  * Run the prepared round and save the file's state: the ticket's outcome.
  * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
- * @param {{state: import('../review/fixloop.mjs').FileState, kind: 'full' | 'recheck' | 'patch_check', where: import('./review-state.mjs').Where, seq: number, base: string | null, blockKindOf: string, workDir: string, factsExcerpt: string}} opts
+ * @param {{state: import('../review/fixloop.mjs').FileState, kind: 'full' | 'recheck' | 'patch_check', where: import('./review-state.mjs').Where, seq: number, base: string | null, blockKindOf: string, workDir: string, factsExcerpt: string, extraRounds?: number}} opts
  * @returns {Promise<ReviewOutcome>}
  */
-async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKindOf, workDir, factsExcerpt }) {
+async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, extraRounds = 0 }) {
   /** @type {Record<string, any> | null} */
   let engineOutcome = null;
   let approvalWritten = false;
@@ -356,6 +359,7 @@ async function playRound(ticket, ctx, { state, kind, where, seq, base, blockKind
         base,
         writeRow,
         factsExcerpt,
+        extraRounds,
         ...(jev ? { jev } : {}),
         review: async () => {
           engineOutcome = await reviewFile({ repoRoot: ctx.repoRoot, file: ticket.file, base, cfg: ctx.cfg, kind: blockKindOf, workDir, factsExcerpt }, { spawn: ctx.spawn, writeRow });

package/src/worker/loop.mjs

@@ -37,6 +37,7 @@
 import { spawn as nodeSpawn } from 'node:child_process';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { expiryChecks } from '../autopilot/limits.mjs';
 import { loadProjectConfig } from '../config/load.mjs';
 import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
@@ -44,7 +45,9 @@ import { spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
 import { readRun, reattachWorker } from '../state/run.mjs';
 import { loadKey, signRow } from '../state/signer.mjs';
+import { logWarning } from '../util/error-log.mjs';
 import { keyedLock } from '../util/locks.mjs';
+import { writeSafe } from '../util/redact.mjs';
 import { runRoot, setRunRoot } from '../util/tmp.mjs';
 import { reviewTicket } from './engine.mjs';
 import { announceWorker, beatWorker, HEARTBEAT_MS, liveWorker, pendingTickets, readTicket, retractWorker, writeResult } from './queue.mjs';
@@ -58,6 +61,24 @@ export const DEFAULT_SESSION_TIMEOUT_S = 300;
 
 /** B42: `review.parallel_tickets` when the config does not set a valid one. */
 export const DEFAULT_PARALLEL_TICKETS = 3;
+
+/** B48: the fixed text of a failed autopilot expiry check in a drain (stderr and the warning log). */
+export const EXPIRY_CHECK_FAILED = 'the autopilot expiry check failed in a worker drain; it runs again at the next drain';
+
+/**
+ * B48: what kind of error an expiry check threw — its code or class only, NEVER its message (a
+ * message can carry a path or a value): `EACCES`, `StateError:record-unknown`, `TypeError`.
+ * Anything that does not look like a plain identifier is `Error`.
+ * @param {unknown} thrown @returns {string}
+ */
+export function errorKind(thrown) {
+  if (!(thrown instanceof Error)) return 'Error';
+  const err = /** @type {any} */ (thrown);
+  const name = typeof err.name === 'string' ? err.name : 'Error';
+  const code = typeof err?.code === 'string' ? err.code : null;
+  const kind = code === null ? name : /^E[A-Z]+$/.test(code) ? code : `${name}:${code}`;
+  return /^[A-Za-z0-9_:.-]{1,64}$/.test(kind) ? kind : 'Error';
+}
 export const MAX_PARALLEL_TICKETS = 16;
 
 /**
@@ -166,6 +187,10 @@ export function loopResult(outcome) {
  * @property {{write: (s: string) => unknown}} [stderr]
  * @property {import('../review/triage.mjs').JevAsk} [jev] - S1 for triage and the recheck (tests
  *   inject a mock); default: `askJev` with the resolved Jev key, none without one.
+ * @property {() => Promise<unknown>} [expiryCheck] - B48: the lazy autopilot checks, run once at the
+ *   start of every drain, before any ticket; default: `expiryChecks(opts.runId, <now>, {writeRow})`
+ *   (grant expiry, expired approvals). A failure is never silent: one stderr line and one
+ *   `autopilot_expiry_check_failed` warning per streak of failures; the next drain tries again.
  */
 
 /**
@@ -180,6 +205,10 @@ export async function createWorker(opts, deps = {}) {
   const loadTicket = deps.readTicket ?? readTicket;
   const writeRow = deps.writeRow ?? ((/** @type {Record<string, any>} */ row) => appendRow(row, { slug }));
   const readRows = deps.readRows ?? (() => readAllRows(slug));
+  // B48: the run's own writer (unsigned base; the checks sign their rows with the run key)
+  const expiryCheck = deps.expiryCheck ?? (() => expiryChecks(runId, new Date(), { writeRow }));
+  const warnStream = deps.stderr ?? process.stderr;
+  let expiryFailing = false; // inside a streak of failed checks: warn once per streak
   const store = deps.store ?? (await createDefaultKeyStore(env));
   const jevKey = await resolveJevKey(cfg, { store, env, opRead: deps.opRead });
   const childEnv = sessionEnv(env, [jevKey, key.toString('hex')]);
@@ -420,6 +449,19 @@ export async function createWorker(opts, deps = {}) {
    * @returns {Promise<number>} how many were completed.
    */
   async function drain() {
+    // B48: the lazy autopilot checks (grant expiry, expired approvals) before any ticket starts;
+    // a failed check never stops the drain (the next drain tries again) and is never silent
+    try {
+      await expiryCheck();
+      expiryFailing = false;
+    } catch (thrown) {
+      if (!expiryFailing) {
+        expiryFailing = true;
+        const text = `${EXPIRY_CHECK_FAILED} (${errorKind(thrown)})`;
+        writeSafe(warnStream, `worker: WARN ${text}\n`);
+        await logWarning({ warning: 'autopilot_expiry_check_failed', message: text }).catch(() => null);
+      }
+    }
     /** @type {number | null} */
     let limit = null;
     let done = 0;