@detergent-software/conductor 3.0.0-dev.4 → 3.0.0-dev.40

package/build/manager.js

@@ -2,19 +2,21 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { freePorts, portEnv, releaseLocks } from "./broker.js";
-import { isLive, isStarting, permissionPrompt, SessionGone, turnEnded, } from "./claude.js";
+import { isLive, isStarting, permissionPrompt, SessionGone, trustStep, turnEnded, WorkspaceUntrusted, } from "./claude.js";
 import { formatCondition, parseCondition, prRef, uncheckable } from "./conditions.js";
 import { ConductorError } from "./errors.js";
 import { UNWATCHED_HANDOFFS } from "./inbox.js";
 import { processAlive as defaultProcessAlive } from "./lock.js";
+import { projectPaths } from "./paths.js";
 import { missingPluginSkills, projectSkills } from "./plugin.js";
 import { WAKE_PREFIX } from "./protocol.js";
+import { registeredByCheckout } from "./registry.js";
 import { resolveOpenWait } from "./resolve.js";
 import { findTranscript, formatTokens, lastTurnAt, localDay, projectSlug, readUsage, transcriptFiles, } from "./spend.js";
 import { ACTIVE_STATUSES, openStore, waitSchema, workerSchema, } from "./store.js";
 import { linkedPr } from "./tracker-writes.js";
 import { pendingCall } from "./transcript.js";
-import { BRANCH_PREFIX, worktreePath } from "./worktrees.js";
+import { BRANCH_PREFIX } from "./worktrees.js";
 // A worker as GET /fleet shows it.
 export const fleetWorkerSchema = workerSchema.extend({
     // launching, starting, working, idle, waiting on <x>, parked, stopped, no session
@@ -86,7 +88,7 @@ export function workerLine(w) {
 }
 export const PROBE_PREFIX = 'probe-';
 export const PROBE_PROMPT = 'This is a conductor probe session started by a test run. It works no issue: reply "probe ready" and wait.';
-// conduct-atk starts workers this way; a resume keeps both (ATK-309's open check).
+// Workers start in auto mode; a resume keeps it (ATK-309's open check).
 export const PERMISSION_MODE = 'auto';
 // How long a started or woken worker's session has to report its plugin. A start runs the create
 // hook first only for a launch, which is before the clock starts.
@@ -96,6 +98,9 @@ const ITEM = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const STOP_WAIT_MS = 30_000;
 // A park that failed (the process outlived `claude stop`) is tried again this much later.
 const PARK_RETRY_MS = 5 * 60_000;
+// How long a new session id has to stay listed before the worker follows it. A resuming session is
+// listed for under a second under the id its process started with, before it loads its own (ATK-574).
+const SESSION_ID_SETTLE_MS = 5_000;
 const TRANSCRIPT_SCAN_MS = 60_000;
 // A compaction with no boundary in the transcript this long after it started, its turn over, failed.
 const COMPACT_MINUTES = 10;
@@ -118,7 +123,7 @@ export function eventText(waits) {
     return `${WAKE_PREFIX}${[...facts].map(([fact, at]) => `${fact} ${clock(new Date(at))}`).join('; ')}`;
 }
 export function sessionManager(deps) {
-    const { broker, claude, config, log, openTab, pluginDir, prs, store, worktrees } = deps;
+    const { broker, claude, config, log, pluginDir, prs, store, tabs, worktrees } = deps;
     const now = deps.now ?? (() => new Date());
     const alive = deps.processAlive ?? defaultProcessAlive;
     const sleep = deps.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
@@ -128,6 +133,8 @@ export function sessionManager(deps) {
     const stalls = new Map();
     const transcripts = new Map();
     const transcriptScans = new Map();
+    // worker id → a session id the listing shows for it that it hasn't followed yet, since when
+    const newSessionIds = new Map();
     let sessions = [];
     // Until the first sweep, nothing is known about any session.
     let listed = false;
@@ -138,6 +145,8 @@ export function sessionManager(deps) {
     const held = new Set();
     // Workers whose compaction failed: not tried again while the daemon runs (their inbox item says so).
     const uncompactable = new Set();
+    // worker id → the attach (its attachedAt) a retire was last refused for, so each is logged once.
+    const attachRefusals = new Map();
     // Every session the conductor starts loads its plugin, and a resume whose saved --plugin-dir went
     // missing runs on without it, silently (ATK-522). The mod reports each session start (pluginSeen),
     // so a worker started or woken that doesn't report within PLUGIN_REPORT_MS is a
@@ -228,10 +237,15 @@ export function sessionManager(deps) {
             throw new ConductorError(`project "${found.name}" has a problem: ${found.problem ?? 'no profile'}`);
         if (!found.enabled)
             throw new ConductorError(`project "${found.name}" is disabled`);
+        if (registeredByCheckout(deps.paths, found)) {
+            throw new ConductorError(`project "${found.name}" is registered by the checkout ${found.clone}`, [
+                `the conductor works only in a clone of its own: run \`conduct project add "${found.clone}"\` first`,
+            ]);
+        }
         return { ...found, profile: found.profile };
     };
-    // Where a worker's commands run: its project's main checkout, where conduct-atk starts them too.
-    const rootOf = (worker) => store.listProjects().find((p) => p.name === worker.project)?.root ?? worker.worktree ?? process.cwd();
+    // Where a worker's commands run when it has no worktree: its project's clone.
+    const cloneOf = (worker) => projectPaths(deps.paths, worker.project).clone;
     const sessionOf = (worker) => sessions.find((s) => (worker.sessionId !== null && s.sessionId === worker.sessionId) ||
         (worker.handle !== null && s.id === worker.handle));
     const minutesSince = (iso) => (now().getTime() - Date.parse(iso)) / 60_000;
@@ -269,13 +283,14 @@ export function sessionManager(deps) {
     };
     // ---------- launch ----------
     // The worktree first (design note v2, section 2): its ports from the broker, then `git worktree add`
-    // from origin/<base>, the local files and the profile's setup. The session starts in it.
-    const launchWorker = async (worker, root, profile, prompt) => {
+    // in the project's clone from origin/<base>, the local files and the profile's setup. The session
+    // starts in it.
+    const launchWorker = async (worker, profile, prompt) => {
         let current = worker;
         let stage = 'assign ports';
-        const path = worktreePath(root, worker.name);
-        // A worktree there already (a kept one, or one a person made with `claude --worktree`) isn't
-        // this launch's to remove when it fails.
+        const { clone, worktrees: dir } = projectPaths(deps.paths, worker.project);
+        const path = join(dir, worker.name);
+        // A worktree there already (a kept one) isn't this launch's to remove when it fails.
         const reused = existsSync(join(path, '.git'));
         try {
             // Recorded before it exists: the broker keeps an in-flight worker's ports while its directory
@@ -286,10 +301,11 @@ export function sessionManager(deps) {
             const env = portEnv(ports);
             const worktree = await worktrees.create({
                 base: profile.baseBranch,
+                clone,
                 env: { ...env, CONDUCTOR_ITEM: worker.item, CONDUCTOR_PROJECT: worker.project, CONDUCTOR_WORKTREE: path },
                 ...(profile.localFilesFrom === undefined ? {} : { localFilesFrom: profile.localFilesFrom }),
                 name: worker.name,
-                root,
+                path,
                 sessionEnv: env,
                 setup: profile.setup,
             });
@@ -301,13 +317,23 @@ export function sessionManager(deps) {
                 throw new ConductorError(problem);
             stage = 'start session';
             const started = now().getTime();
-            const handle = await claude.launch({
+            const handle = await claude
+                .launch({
                 cwd: worktree,
                 disallowedTools: DISALLOWED_TOOLS,
                 name: worker.name,
                 permissionMode: PERMISSION_MODE,
                 pluginDir,
                 prompt,
+            })
+                .catch((error) => {
+                // Claude Code's own message names the worktree, which this failed launch removes.
+                if (!(error instanceof WorkspaceUntrusted))
+                    throw error;
+                throw new ConductorError(`Claude Code doesn't trust ${clone}`, [
+                    `${trustStep(clone)}, then \`conduct project check ${worker.project}\``,
+                    ...error.details,
+                ]);
             });
             try {
                 sessions = await claude.agents();
@@ -320,8 +346,8 @@ export function sessionManager(deps) {
             current = update(current, { handle, sessionId: session?.sessionId ?? null, status: 'running' });
             event(current, 'worker.launched', { handle, pluginDir, sessionId: current.sessionId, worktree });
             expectPlugin(current, started);
-            if (profile.workers.tab) {
-                const tab = await openTab({
+            if (tabs.onLaunch) {
+                const tab = await tabs.open({
                     cwd: worktree,
                     handle,
                     title: worker.name,
@@ -336,7 +362,7 @@ export function sessionManager(deps) {
             const cleanup = reused
                 ? { kept: path, keptBecause: 'it was there before the launch' }
                 : current.worktree && existsSync(current.worktree)
-                    ? await removeIfClean(root, current.worktree)
+                    ? await removeIfClean(clone, current.worktree)
                     : {};
             freePorts(store, path, 'launch failed');
             current = update(current, { status: 'failed' });
@@ -346,13 +372,13 @@ export function sessionManager(deps) {
     };
     // A failed launch's worktree, unless it holds work. Its branch goes with it while it still has the
     // name the launch gave it; a renamed one was the worker's.
-    const removeIfClean = async (root, worktree) => {
+    const removeIfClean = async (clone, worktree) => {
         try {
             const work = await worktrees.unfinishedWork(worktree);
             if (work)
                 return { kept: worktree, ...work };
             const branch = await worktrees.branchOf(worktree);
-            await worktrees.remove(root, worktree, { deleteBranch: branch?.startsWith(BRANCH_PREFIX) === true });
+            await worktrees.remove(worktree, { deleteBranch: branch?.startsWith(BRANCH_PREFIX) === true, repo: clone });
             return { removed: worktree };
         }
         catch (error) {
@@ -442,7 +468,7 @@ export function sessionManager(deps) {
         const text = eventText(resolved);
         const started = now().getTime();
         const { copy } = await claude.resume({
-            cwd: session?.cwd ?? worker.worktree ?? rootOf(worker),
+            cwd: session?.cwd ?? worker.worktree ?? cloneOf(worker),
             sessionId: worker.sessionId,
             text,
         });
@@ -491,7 +517,7 @@ export function sessionManager(deps) {
         let copy;
         try {
             ({ copy } = await claude.resume({
-                cwd: session?.cwd ?? worker.worktree ?? rootOf(worker),
+                cwd: session?.cwd ?? worker.worktree ?? cloneOf(worker),
                 sessionId: worker.sessionId,
                 text: COMPACT_TEXT,
             }));
@@ -568,7 +594,7 @@ export function sessionManager(deps) {
                 });
             }
         }
-        // An attached worker is Jason's while he has it open. One whose Handoff is open waits on him,
+        // An attached worker is the operator's while they have it open. One whose Handoff is open waits on them,
         // though no wait says so: its note raised the inbox item already (ATK-416).
         if (!turnEnded(session) || waiting || worker.attachedAt !== null || handedOff(worker)) {
             cleared('idle', state.idle?.reported);
@@ -584,13 +610,13 @@ export function sessionManager(deps) {
         }
         stalls.set(worker.id, state);
     };
-    // The daemon can't see the tab, so attached means "Jason may be in it" only while the session is
+    // The daemon can't see the tab, so attached means "the operator may be in it" only while the session is
     // in use. Once its turn has been over `idleMinutes`, the worker is the daemon's again, and its
     // waits park and resume it as usual. A resolved wait takes it back at once when the transcript
     // shows no turn since the attach: nobody is in it, and the park and resume deliver the wait
     // (ATK-516). A turn, or no transcript to tell, holds it, and the hold is logged once.
     // Only a wait that resolved after the attach releases it: one resolved before was there when
-    // Jason chose to attach, so taking the session back would undo the attach.
+    // The operator chose to attach, so taking the session back would undo the attach.
     // A new attach, or the end of one, starts its spell afresh.
     const forgetAttach = (workerId) => {
         const state = stalls.get(workerId);
@@ -637,14 +663,29 @@ export function sessionManager(deps) {
         let current = worker;
         const session = sessionOf(current);
         // The listing is the truth for ids: fill them in after a launch, and follow a changed short id.
-        if (session && (current.sessionId !== session.sessionId || current.handle !== session.id)) {
-            // A new session id (a /clear) writes a new transcript.
-            if (current.sessionId !== session.sessionId) {
+        // A changed session id is followed once it has stayed listed SESSION_ID_SETTLE_MS.
+        if (session) {
+            let sessionId = current.sessionId;
+            const pending = newSessionIds.get(current.id);
+            if (sessionId === null || session.sessionId === sessionId)
+                newSessionIds.delete(current.id);
+            else if (pending?.sessionId !== session.sessionId) {
+                newSessionIds.set(current.id, { sessionId: session.sessionId, since: now().getTime() });
+            }
+            else if (now().getTime() - pending.since >= SESSION_ID_SETTLE_MS) {
+                newSessionIds.delete(current.id);
+                // A new session id (a /clear) writes a new transcript.
                 transcripts.delete(current.id);
                 transcriptScans.delete(current.id);
+                sessionId = session.sessionId;
+            }
+            sessionId ??= session.sessionId;
+            if (sessionId !== current.sessionId || session.id !== current.handle) {
+                current = update(current, { handle: session.id, sessionId });
             }
-            current = update(current, { handle: session.id, sessionId: session.sessionId });
         }
+        else
+            newSessionIds.delete(current.id);
         const waits = store.waitsOf(current.id);
         const resolved = waits.filter((w) => w.resolvedAt !== null);
         // A listed pid can outlive its process for a moment after a stop.
@@ -692,6 +733,10 @@ export function sessionManager(deps) {
         }
         if (current.status !== 'parked')
             return;
+        // A park needs a wait, so a parked worker with none was stopped by a retire that didn't finish
+        // (ATK-519): the retire, tried again, takes it on.
+        if (waits.length === 0)
+            return;
         if (resolved.length > 0)
             await resume(current, resolved, session);
         else
@@ -832,8 +877,8 @@ export function sessionManager(deps) {
                     });
                     continue;
                 }
-                const root = rootOf(worker);
-                const worktree = worker.worktree ?? worktreePath(root, worker.name);
+                const root = cloneOf(worker);
+                const worktree = worker.worktree ?? join(projectPaths(deps.paths, worker.project).worktrees, worker.name);
                 const reused = store
                     .workerEvents(worker.id, 1000)
                     .some((e) => e.kind === 'worker.launching' && e.data.reused === true);
@@ -872,7 +917,7 @@ export function sessionManager(deps) {
             const problem = uncheckable(parsed, project?.profile ?? null);
             if (problem) {
                 throw new ConductorError(problem, [
-                    `the conductor takes ${worker.project}'s profile from ${project?.profilePath ?? 'its .claude/conductor.json'} when it starts or the file is saved; \`conduct rules\` lists one it refused`,
+                    `the conductor takes ${worker.project}'s profile again when it starts, when ${project?.profilePath ?? 'its machine profile'} is saved, and after each fetch of its clone; \`conduct profile ${worker.project}\` shows it, and \`conduct rules\` lists one it refused`,
                 ]);
             }
             // Stored in its normal full form, so the watchers and `conduct status` read one spelling. A
@@ -914,7 +959,7 @@ export function sessionManager(deps) {
                     // No event text: the session wakes idle and keeps running when the tab closes.
                     started = now().getTime();
                     const { copy } = await claude.resume({
-                        cwd: sessionOf(current)?.cwd ?? current.worktree ?? rootOf(current),
+                        cwd: sessionOf(current)?.cwd ?? current.worktree ?? cloneOf(current),
                         sessionId,
                         text: null,
                     });
@@ -926,16 +971,12 @@ export function sessionManager(deps) {
                 }
                 current = update(current, { attachedAt: now().toISOString(), status: 'running', stoppedAt: null });
                 forgetAttach(current.id);
-                const tab = await openTab({
-                    cwd: current.worktree ?? rootOf(current),
-                    handle,
-                    title: current.name,
-                    window: `${current.probe ? 'probe' : 'Conductor'} · ${current.project}`,
-                });
+                const window = `${current.probe ? 'probe' : 'Conductor'} · ${current.project}`;
+                const tab = await tabs.open({ cwd: current.worktree ?? cloneOf(current), handle, title: current.name, window });
                 event(current, 'worker.attached', { resumed, ...(tab ? { tabError: tab } : {}) });
                 if (started !== null)
                     expectPlugin(current, started);
-                return { resumed, tab, worker: current };
+                return { hint: tab === null ? tabs.hint(window) : null, resumed, tab, worker: current };
             }
             finally {
                 busy.delete(worker.id);
@@ -964,19 +1005,22 @@ export function sessionManager(deps) {
                 project: target.name,
             });
             // A worktree there already isn't the launch's to remove if it fails, after a restart too.
-            const reused = existsSync(join(worktreePath(target.root, name), '.git'));
+            const reused = existsSync(join(projectPaths(deps.paths, target.name).worktrees, name, '.git'));
             event(worker, 'worker.launching', {
                 probe: worker.probe,
                 ...(reused ? { reused } : {}),
                 ...(request.cause === undefined ? {} : { cause: request.cause }),
             });
             busy.add(worker.id);
-            void track(launchWorker(worker, target.root, target.profile, prompt).finally(() => busy.delete(worker.id)));
+            void track(launchWorker(worker, target.profile, prompt).finally(() => busy.delete(worker.id)));
             return worker;
         },
         pluginSeen: (sessionId) => {
             pluginReports.set(sessionId, now().getTime());
-            return store.listWorkers(ACTIVE_STATUSES).find((w) => w.sessionId === sessionId) ?? null;
+            // A /clear's session reports before the worker follows its new id.
+            return (store
+                .listWorkers(ACTIVE_STATUSES)
+                .find((w) => w.sessionId === sessionId || newSessionIds.get(w.id)?.sessionId === sessionId) ?? null);
         },
         retire: async (workerId, { cause, force = false } = {}) => {
             const worker = activeWorker(workerId);
@@ -990,8 +1034,6 @@ export function sessionManager(deps) {
             }
             busy.add(worker.id);
             try {
-                // Fresh: the last sweep's listing can be ten seconds old.
-                const session = (await claude.agents().catch(() => sessions)).find((s) => s.sessionId === worker.sessionId || s.id === worker.handle);
                 const refuse = (reason, transient, work) => {
                     event(worker, 'worker.retire-refused', {
                         reason,
@@ -1001,6 +1043,27 @@ export function sessionManager(deps) {
                     });
                     return { outcome: 'refused', reason, transient, ...(work ? { work } : {}), worker };
                 };
+                // The operator has its session open in a tab (ATK-519). The scheduler tries again every tick,
+                // so it is logged once per attach. Only a running worker is attached: one whose session
+                // stopped unexpectedly keeps the attach it had.
+                const attachedAt = worker.status === 'running' ? worker.attachedAt : null;
+                if (attachedAt !== null && !force) {
+                    const reason = 'attached: retire once its tab is released, or retire --force';
+                    if (attachRefusals.get(worker.id) !== attachedAt) {
+                        attachRefusals.set(worker.id, attachedAt);
+                        event(worker, 'worker.retire-refused', {
+                            attached: true,
+                            reason,
+                            transient: true,
+                            ...(cause === undefined ? {} : { cause }),
+                        });
+                    }
+                    return { attached: true, outcome: 'refused', reason, transient: true, worker };
+                }
+                attachRefusals.delete(worker.id);
+                // Fresh: the last sweep's listing can be ten seconds old. Null when it couldn't be read.
+                const listing = await claude.agents().catch(() => null);
+                const session = (listing ?? sessions).find((s) => s.sessionId === worker.sessionId || s.id === worker.handle);
                 // Removing the worktree while `claude --bg` still sets the session up there strands it.
                 if (session && isStarting(session))
                     return refuse('its session is still starting: try again shortly', true);
@@ -1017,7 +1080,6 @@ export function sessionManager(deps) {
                 const work = fate.remove && worker.worktree ? await worktrees.unfinishedWork(worker.worktree) : null;
                 if (work && !force)
                     return refuse('unfinished work: commit and push it, or retire --force to throw it away', false, work);
-                const root = store.listProjects().find((p) => p.name === worker.project)?.root;
                 const steps = [];
                 const handle = worker.handle;
                 if (handle !== null && session?.pid !== undefined) {
@@ -1039,14 +1101,17 @@ export function sessionManager(deps) {
                 if (worker.worktree !== null) {
                     const worktree = worker.worktree;
                     if (fate.remove) {
-                        await step(steps, 'remove worktree', async () => {
-                            if (!root)
-                                throw new Error(`project ${worker.project} is not registered`);
-                            await worktrees.remove(root, worktree, { deleteBranch: true });
-                        });
+                        // The repository is the worktree's own: one launched before clones is in a person's
+                        // checkout, and retires from there.
+                        await step(steps, 'remove worktree', () => worktrees.remove(worktree, { deleteBranch: true, repo: cloneOf(worker) }));
                     }
                     else if (existsSync(worktree)) {
-                        kept = { branch: await worktrees.branchOf(worktree), reason: fate.reason, worktree };
+                        kept = {
+                            branch: await worktrees.branchOf(worktree),
+                            reason: fate.reason,
+                            repo: await worktrees.repoOf(worktree),
+                            worktree,
+                        };
                     }
                     // No session serves on them any more, kept worktree or not.
                     freePorts(store, worktree, 'worker retired');
@@ -1060,11 +1125,21 @@ export function sessionManager(deps) {
                 if (handle !== null)
                     await step(steps, 'rm', () => claude.rm(handle));
                 const ok = steps.every((s) => s.ok);
-                const current = ok ? update(worker, { status: 'exited', stoppedAt: now().toISOString() }) : worker;
-                if (ok)
+                // Its session no longer runs once the stop succeeded, or when a fresh listing showed it wasn't
+                // live, even when a later step failed. A retire that didn't finish then parks the worker with no
+                // wait, so no sweep reads it as stopped unexpectedly or wakes it, and the retire is tried again
+                // (ATK-519). With no fresh listing to say, the worker stays as it was.
+                const down = steps.some((s) => s.step === 'stop' && s.ok) || (listing !== null && !(session && isLive(session)));
+                const stoppedAt = now().toISOString();
+                const parked = !ok && down;
+                const current = ok
+                    ? update(worker, { status: 'exited', stoppedAt })
+                    : parked
+                        ? update(worker, { attachedAt: null, status: 'parked', stoppedAt })
+                        : worker;
+                if (ok || parked)
                     store.closeWaits(worker.id, 'worker retired');
-                // Its session is stopped by now, even when a later step failed. A probe shares its item with
-                // the live worker, whose locks those are.
+                // A probe shares its item with the live worker, whose locks those are.
                 if (!worker.probe)
                     releaseLocks(store, worker.item, 'worker retired');
                 stalls.delete(worker.id);
@@ -1072,6 +1147,7 @@ export function sessionManager(deps) {
                     forced: force && work !== null,
                     steps,
                     ...(kept === null ? {} : { kept }),
+                    ...(parked ? { parked } : {}),
                     ...(cause === undefined ? {} : { cause }),
                 });
                 return { outcome: ok ? 'retired' : 'partial', steps, worker: current };
@@ -1092,7 +1168,7 @@ export function sessionManager(deps) {
             try {
                 const started = now().getTime();
                 const { copy } = await claude.resume({
-                    cwd: worker.worktree ?? rootOf(worker),
+                    cwd: worker.worktree ?? cloneOf(worker),
                     sessionId: worker.sessionId,
                     text,
                 });