@coreplane/switchboard 1.234.0 → 1.236.0

package/dist/assets/Dockerfile

@@ -87,6 +87,17 @@ RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
   && pi --version | grep -qx '0.85.1' \
   && pi --help | grep -q -- '--mode <mode>'
 
+# OpenCode, the second harness (docs/reference/specs/harness.md): `@opencode/cli`
+# at the EXACT pin held by src/deploy/imageOpenCodeHarness.test.ts, beside pi.
+# The wrapper's postinstall hard-links the platform binary into place, so it
+# is the one install script allowed by name; the grep proves the binary on
+# PATH prints the pin's version text (`opencode v2.0.3`, exactly); the npm
+# cache (a 200 MB tarball) is dropped in the same layer. Dark until a
+# deployment names it: nothing here starts it on its own.
+RUN npm install -g --allow-scripts=@opencode/cli @opencode/cli@2.0.3 \
+  && npm cache clean --force \
+  && opencode --version | grep -qx 'opencode v2.0.3'
+
 # Non-root user; agents run bash with this user's (container-scoped) permissions.
 RUN useradd -m -u 1001 switchboard
 WORKDIR /app

package/dist/assets/config/config.example.yaml

@@ -311,10 +311,15 @@ workspaceDir: ./workspaces
 # them the request is refused naming what is missing. Per unit: at most
 # `maxRounds` review rounds and `maxMinutes` minutes of wall clock — whichever
 # hits first ends the unit, and each child round's own budget is clipped to the
-# remaining time. `maxMinutes` is the ship preset's declared budget: a channel or
-# user `boundary.maxMinutes` and a per-message `budget:` directive clip it like
-# any preset's, and the card says so. Defaults shown; both must be integers >= 1;
-# any other key under `ship` fails the load by name.
+# remaining time. The pipeline is budgeted for the loop, not one round: the
+# coding child's directive is additionally capped to leave two review rounds and
+# one merge poll (11 minutes) on the clock, so a child that uses its whole
+# budget still hands the review its time — which is why `maxMinutes` must be an
+# integer >= 14 (the loop's reserve plus one round). `maxMinutes` is the ship
+# preset's declared budget: a channel or user `boundary.maxMinutes` and a
+# per-message `budget:` directive clip it like any preset's, and the card says
+# so. Defaults shown; `maxRounds` must be an integer >= 1; any other key under
+# `ship` fails the load by name.
 # ship:
 #   maxRounds: 3      # review rounds per unit
 #   maxMinutes: 120   # the ship preset's wall-clock budget in minutes (the registry's default)

package/dist/assets/deploy/cloudflare-memory/worker.ts

@@ -1807,6 +1807,18 @@ export class RunHistoryDO extends DurableObject<Env> {
     this.ctx.storage.transactionSync(() => {
       result = this.upsertInTransaction(record, proposal);
     });
+    // A coordinator child closed OUTSIDE the ledger's finish — the run loop or
+    // a reclaim writing an `interrupted` record, the pi harness's typed restart,
+    // a resume abandoning a lost workspace — still wakes its parent's wait at
+    // once (run-history item 47): the same `run-finished-<runId>` event rides
+    // this commit. The tombstone a run writes at its start is excluded (its
+    // `finishedAt` equals `startedAt`); the parent confirms by `read-record`
+    // before it acts, so a duplicate send is harmless.
+    if (result.stored && record.parentInstanceId !== undefined && record.finishedAt > record.startedAt) {
+      const event = await sendRunFinished(this.env.SHIP_COORDINATOR, record);
+      if (event.kind === "failed")
+        console.warn(`[runs/put] ${record.id} → ${event.type} not delivered to ${event.instance}: ${event.reason}`);
+    }
     if ((await this.ctx.storage.getAlarm()) === null)
       await this.ctx.storage.setAlarm(systemClock() + RUN_SWEEP_INTERVAL_MS);
     return result;

package/dist/assets/deploy/cloudflare-resident/Dockerfile

@@ -201,6 +201,18 @@ RUN npm install -g @earendil-works/pi-coding-agent@0.85.1 \
   && pi --version | grep -qx '0.85.1' \
   && pi --help | grep -q -- '--mode <mode>'
 
+# OpenCode, the second harness (docs/reference/specs/harness.md): `@opencode/cli`
+# at the EXACT pin held by src/deploy/imageOpenCodeHarness.test.ts, beside pi.
+# The wrapper's postinstall hard-links the platform binary into place, so it
+# is the one install script allowed by name; the grep proves the binary on
+# PATH prints the pin's version text (`opencode v2.0.3`, exactly); the npm
+# cache (a 200 MB tarball) is dropped in the same layer, and the proof runs
+# again as worker1 below. Dark until a deployment names it: nothing here
+# starts it on its own.
+RUN npm install -g --allow-scripts=@opencode/cli @opencode/cli@2.0.3 \
+  && npm cache clean --force \
+  && opencode --version | grep -qx 'opencode v2.0.3'
+
 # Agent commands never run as root (repo code runs unprivileged, one user per
 # thread — docs/reference/specs/resident-repos.md). The SDK's exec has no user/uid option
 # (verified against 0.13.0-next.751.1), so the container server itself runs as
@@ -230,6 +242,12 @@ RUN su -s /bin/bash worker1 -c "playwright screenshot --viewport-size=640,480 'd
 # own, named by PI_CODING_AGENT_DIR at start).
 RUN su -s /bin/bash worker1 -c "pi --version | grep -qx '0.85.1'"
 
+# OpenCode once more, as worker1: a run's server is started as the thread's
+# user through the same `su`, so the BUILD proves an unprivileged user finds
+# the pin on PATH and the binary runs without a writable home (its roots are
+# the run's own, named by the XDG variables at start).
+RUN su -s /bin/bash worker1 -c "opencode --version | grep -qx 'opencode v2.0.3'"
+
 # bun once more, as worker1: a thread's `bun install` runs as the thread's user
 # through the same `su`, whose PATH is /etc/environment's rather than this
 # file's — so the BUILD proves that PATH resolves the pin, not the base's bun.

package/dist/assets/deploy/cloudflare-resident/gc.ts

@@ -1,7 +1,7 @@
 // Residency garbage collection — the PURE decision logic, kept free of
 // the Sandbox SDK and DO storage so it runs under plain-Node vitest
 // (gc.test.ts). worker.ts feeds it what it observed (mirror refs, the GitHub
-// pulls list, tree cleanliness, live views) and acts on the answers.
+// pulls list, ops in flight, live views) and acts on the answers.
 //
 // Two mechanisms:
 //   1. Event-triggered reclamation: after every refresh-cycle `fetch --prune`,
@@ -79,9 +79,6 @@ export interface ReclaimInput {
   isDefaultRef: boolean;
   /** Thread exec/read/write currently running on this binding. */
   busy: number;
-  /** Tree cleanliness as the thread user; `null` = the runtime is down, so
-   *  the tree is already gone with the disk and there is nothing to preserve. */
-  clean: boolean | null;
 }
 
 /** The PR that decided the fate (for the audit trail): the open one, else the
@@ -97,13 +94,14 @@ export type ReclaimWhy =
   | "fate-unknown"
   | "busy"
   | "re-attached"
-  | "dirty"
   | Extract<RefFate, "gone" | "merged" | "closed">;
 
 /** Evict this binding now? A finished ref (gone/merged/closed) is reclaimed
- *  only when nothing runs on it and its tree is provably clean — a merged PR
- *  can still have unpushed local commits, and destroying work on a signal is
- *  exactly what this must never do. Keeps are named so the pass is auditable. */
+ *  when nothing runs on it — and nothing else is asked. What its tree holds
+ *  is never a reason to keep it: a run starts from a clean tree, so dirt in a
+ *  tree no run is using protects nothing (the next attach wipes it); the
+ *  Worker measures and records what it removes instead. Keeps are named so
+ *  the pass is auditable. */
 export function reclaimDecision(input: ReclaimInput): { reclaim: boolean; why: ReclaimWhy } {
   if (input.isDefaultRef) return { reclaim: false, why: "default-ref" };
   switch (input.fate) {
@@ -115,7 +113,6 @@ export function reclaimDecision(input: ReclaimInput): { reclaim: boolean; why: R
       return { reclaim: false, why: "fate-unknown" };
   }
   if (input.busy > 0) return { reclaim: false, why: "busy" };
-  if (input.clean === false) return { reclaim: false, why: "dirty" };
   return { reclaim: true, why: input.fate };
 }