@felixdotgo/aidlc-kit 0.1.1 → 0.2.0

package/dist/assets/.agents/aidlc/scripts/lib/loop-daemon.mjs

@@ -0,0 +1,232 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { requireLocalAuthority } from "./authority.mjs";
+import { isLoopProvider, LOOP_PROVIDER_LIST } from "./loop-drivers.mjs";
+import { validateLimits, validateRoot, readLoopRecord } from "./loop-runtime.mjs";
+import { createIsolatedLocalSupervisor } from "./loop-supervisor-run-local.mjs";
+import { loadState, nextAction } from "./store.mjs";
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+export const DAEMON_POLL_MIN = 1000;
+export const DAEMON_POLL_MAX = 300000;
+export const DEFAULT_DAEMON_POLL_MS = 5000;
+
+export function validateDaemonPollMs(value) {
+  const n = Number(value);
+  if (!Number.isSafeInteger(n) || n < DAEMON_POLL_MIN || n > DAEMON_POLL_MAX) throw new Error(`daemon pollMs must be an integer from ${DAEMON_POLL_MIN} to ${DAEMON_POLL_MAX}`);
+  return n;
+}
+
+/** A task is loop-owned when it was created through loop intake (CLI or web
+ * dashboard: `.agents/data/tasks/<id>/loop-intake.json`) or already has a loop
+ * run record. Tasks created by an interactive lead are not loop-owned, so the
+ * daemon never runs them concurrently with that lead. */
+export function isLoopOwned(root, taskId) {
+  if (!ID.test(taskId ?? "")) return false;
+  try { if (lstatSync(join(root, ".agents", "data", "tasks", taskId, "loop-intake.json")).isFile()) return true; }
+  catch (error) { if (error?.code !== "ENOENT") throw error; }
+  return readLoopRecord(root, taskId) !== null;
+}
+
+/** Path of the singleton daemon lock (one local daemon per project root). */
+export const daemonLockPath = (root) => join(root, ".agents", "data", "loop", "daemon.lock");
+
+const pidAlive = (pid) => {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error?.code !== "ESRCH"; }
+};
+
+const parseDaemonLock = (path) => {
+  let value;
+  try { value = JSON.parse(readFileSync(path, "utf8")); }
+  catch (error) { if (error?.code === "ENOENT") return null; return { corrupt: true }; }
+  if (!value || value.schemaVersion !== 1 || !Number.isSafeInteger(value.pid) || value.pid < 1 || typeof value.token !== "string" || !value.token) return { corrupt: true };
+  return value;
+};
+
+/** Read the daemon lock: `null` when absent, otherwise `{ pid, startedAt, alive }`. */
+export function readDaemonLock(root) {
+  const lock = parseDaemonLock(daemonLockPath(root));
+  if (!lock) return null;
+  if (lock.corrupt) return { pid: null, startedAt: null, alive: false };
+  return { pid: lock.pid, startedAt: lock.startedAt ?? null, alive: pidAlive(lock.pid) };
+}
+
+/** Run `action` under a short-lived exclusive guard file so two starters
+ * cannot both reclaim the same stale lock (one would delete the other's fresh
+ * lock). A guard older than 10s is treated as abandoned. */
+function withReclaimGuard(path, action) {
+  const guard = `${path}.guard`;
+  const deadline = Date.now() + 5000;
+  for (;;) {
+    try { writeFileSync(guard, String(process.pid), { flag: "wx", mode: 0o600 }); break; }
+    catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      try { if (Date.now() - lstatSync(guard).mtimeMs > 10000) { unlinkSync(guard); continue; } }
+      catch (statError) { if (statError?.code === "ENOENT") continue; throw statError; }
+      if (Date.now() >= deadline) throw new Error("Timed out waiting for the loop daemon lock guard");
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+  }
+  try { return action(); }
+  finally { try { unlinkSync(guard); } catch (error) { if (error?.code !== "ENOENT") throw error; } }
+}
+
+/** Acquire the singleton daemon lock. A lock owned by a dead pid (or a corrupt
+ * lock) is reclaimed under a guard after re-checking it is still the same stale
+ * lock; a live owner fails closed. Liveness is a pid probe, like the loop and
+ * supervisor leases, so a recycled pid can keep a stale lock "alive" until the
+ * file is removed by hand. Returns a release function. */
+export function acquireDaemonLock(root) {
+  const path = daemonLockPath(root);
+  mkdirSync(join(root, ".agents", "data", "loop"), { recursive: true });
+  const token = randomUUID();
+  for (let attempt = 0; attempt < 5; attempt += 1) {
+    try {
+      writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, pid: process.pid, token, startedAt: new Date().toISOString() })}\n`, { flag: "wx", mode: 0o600 });
+      return () => {
+        const current = parseDaemonLock(path);
+        if (current && !current.corrupt && current.token === token) { try { unlinkSync(path); } catch (error) { if (error?.code !== "ENOENT") throw error; } }
+      };
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      let stat;
+      try { stat = lstatSync(path); } catch (statError) { if (statError?.code === "ENOENT") continue; throw statError; }
+      if (stat.isSymbolicLink()) throw new Error(`Daemon lock is a symlink: ${path}`);
+      const observed = parseDaemonLock(path);
+      if (!observed) continue;
+      if (!observed.corrupt && pidAlive(observed.pid)) throw new Error(`Loop daemon already running (pid ${observed.pid})`);
+      withReclaimGuard(path, () => {
+        const current = parseDaemonLock(path);
+        const same = current && (observed.corrupt ? current.corrupt : !current.corrupt && current.token === observed.token);
+        if (same) { try { unlinkSync(path); } catch (unlinkError) { if (unlinkError?.code !== "ENOENT") throw unlinkError; } }
+      });
+    }
+  }
+  throw new Error("Could not acquire the loop daemon lock");
+}
+
+/** Enumerate actionable, loop-owned tasks from canonical state in a
+ * deterministic order: every task whose derived nextAction classification is
+ * `run_phase` and that `isOwned` accepts, sorted by updatedAt then id so a task
+ * that just ran moves to the back of the queue. A loop record that cannot be
+ * read counts as owned so its error surfaces through the turn (and backoff)
+ * instead of being silently skipped. */
+export function actionableTasks(state, root, { isOwned = (id) => isLoopOwned(root, id) } = {}) {
+  const owned = (id) => { try { return isOwned(id); } catch { return true; } };
+  return Object.values(state.tasks)
+    .filter((task) => nextAction(task, root).classification === "run_phase" && owned(task.id))
+    .sort((a, b) => String(a.updatedAt ?? "").localeCompare(String(b.updatedAt ?? "")) || a.id.localeCompare(b.id));
+}
+
+export const DAEMON_BACKOFF_MAX_MS = 600000;
+
+/** Exponential retry delay for a task whose turn keeps throwing: the poll
+ * interval doubled per consecutive failure, capped at 10 minutes. */
+export function backoffDelay(pollMs, failures) {
+  if (failures < 1) return 0;
+  return Math.min(pollMs * 2 ** Math.min(failures - 1, 30), DAEMON_BACKOFF_MAX_MS);
+}
+
+/** Run one supervised lead run for an existing task (no requirement intake):
+ * a single runLoop invocation that continues until the next gate, block,
+ * pause, completion, or stop — bounded by the per-run `maxTurns`. A task with a
+ * loop run record is resumed; a freshly intaken task has none and starts. */
+async function runTaskTurn({ root, taskId, agent, workers, workerImages, limits, pollMs, signal, cancelSignal, onEvent }) {
+  const supervisor = createIsolatedLocalSupervisor({ root, taskId, agent, workers, workerImages, limits, pollMs, signal, cancelSignal, untilStop: true, onEvent });
+  const record = readLoopRecord(root, taskId);
+  return record ? supervisor.resume() : supervisor.start();
+}
+
+/**
+ * Local multi-task daemon: a foreground long-running loop (one per project,
+ * enforced by the singleton lock) that polls canonical state and, for every
+ * actionable loop-owned task, runs one supervised lead run via the isolated
+ * local supervisor. Tasks are served one at a time in updatedAt order, so a
+ * long run delays the others until it reaches its next stop. A task that
+ * reaches a gate, blocks, completes, or terminates stops being actionable and
+ * is skipped on the next poll; a task whose run throws is retried with
+ * exponential backoff. Gate approval stays human-only. `signal` stops after the
+ * current turn; `cancelSignal` also cancels the in-flight agent turn.
+ */
+/**
+ * Shared loop daemon (local and fleet): the same singleton lock, round-robin,
+ * backoff, two-stage shutdown, and taskId-stamped events over a loop authority
+ * from `loop-authority.mjs` (`listActionable` + `runTask`). The authority alone
+ * decides which tasks are loop-owned and how one bounded run executes.
+ */
+export async function runLoopDaemon({ root: rootInput, authority, pollMs = DEFAULT_DAEMON_POLL_MS, signal, cancelSignal, onEvent = () => {}, now = Date.now } = {}) {
+  const root = validateRoot(rootInput);
+  if (!authority || typeof authority.listActionable !== "function" || typeof authority.runTask !== "function") throw new Error("Loop daemon requires a loop authority");
+  const poll = validateDaemonPollMs(pollMs);
+  const releaseLock = acquireDaemonLock(root);
+  try {
+    onEvent({ type: "daemon_start", authority: authority.mode ?? "unknown", pid: process.pid });
+    return await daemonLoop({ root, poll, signal, cancelSignal, onEvent, now, listActionable: () => authority.listActionable(), turn: ({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) => authority.runTask({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) });
+  } finally { releaseLock(); }
+}
+
+export async function runLocalDaemon({ root: rootInput, agent, workers = {}, workerImages = {}, limits, pollMs = DEFAULT_DAEMON_POLL_MS, signal, cancelSignal, onEvent = () => {}, now = Date.now } = {}) {
+  requireLocalAuthority();
+  const root = validateRoot(rootInput);
+  if (!isLoopProvider(agent)) throw new Error(`local lead agent must be ${LOOP_PROVIDER_LIST}`);
+  if (!workers || typeof workers !== "object" || Array.isArray(workers) || !Object.keys(workers).length) throw new Error("Loop requires a configured lead and worker providers");
+  for (const [id, provider] of Object.entries(workers)) if (!ID.test(id) || !isLoopProvider(provider)) throw new Error(`invalid local worker: ${id}`);
+  const poll = validateDaemonPollMs(pollMs);
+  // Fail fast on a bad config.loop.limits instead of failing every task turn.
+  if (limits !== undefined) validateLimits(limits);
+  const releaseLock = acquireDaemonLock(root);
+  try {
+    return await daemonLoop({ root, agent, workers, workerImages, limits, poll, signal, cancelSignal, onEvent, now, turn: runTaskTurn });
+  } finally { releaseLock(); }
+}
+
+/** Run results that leave the task actionable without progress; retried with backoff like errors. */
+const RETRY_STATUSES = new Set(["blocked", "reconcile"]);
+
+/** Poll/run loop. Exported for tests (inject `turn`, `now`, and optionally `listActionable`). */
+export async function daemonLoop({ root, agent, workers, workerImages, limits, poll, signal, cancelSignal, onEvent, now = Date.now, turn = runTaskTurn, isOwned, listActionable }) {
+  const backoff = new Map();
+  for (;;) {
+    if (signal?.aborted) return { status: "stopped" };
+    let actionable;
+    try { actionable = listActionable ? await listActionable() : actionableTasks(loadState(root), root, isOwned ? { isOwned } : {}); }
+    catch (error) {
+      // An unreachable authority (e.g. the fleet service) must not stop the daemon.
+      onEvent({ type: "daemon_poll_error", message: error instanceof Error ? error.message : String(error) });
+      try { await sleep(poll, undefined, { signal }); } catch (sleepError) { if (sleepError?.name === "AbortError") return { status: "stopped" }; throw sleepError; }
+      continue;
+    }
+    // Forget backoff for tasks that are no longer actionable (e.g. a human
+    // paused or approved them), so they start fresh when they come back.
+    for (const id of [...backoff.keys()]) if (!actionable.some((task) => task.id === id)) backoff.delete(id);
+    onEvent({ type: "daemon_poll", actionable: actionable.map((task) => task.id), ...(backoff.size ? { backingOff: [...backoff.keys()] } : {}) });
+    for (const task of actionable) {
+      if (signal?.aborted) return { status: "stopped" };
+      const delay = backoff.get(task.id);
+      if (delay && now() < delay.nextAt) continue;
+      // Stamp every event of this run with its task id so the UI can filter.
+      const taskEvent = (event) => onEvent(event && typeof event === "object" && !event.taskId ? { ...event, taskId: task.id } : event);
+      try {
+        const result = await turn({ root, taskId: task.id, agent, workers, workerImages, limits, pollMs: poll, signal, cancelSignal, onEvent: taskEvent });
+        if (result?.status === "gate" && !result.gateEmitted) onEvent({ type: "gate", taskId: task.id, gate: result.gate, gateView: result.gateView });
+        onEvent({ type: "daemon_turn", taskId: task.id, status: result?.status ?? "unknown", ...(result?.gate ? { gate: result.gate } : {}), ...(result?.reason ? { reason: result.reason } : {}) });
+        if (RETRY_STATUSES.has(result?.status)) {
+          const failures = (backoff.get(task.id)?.failures ?? 0) + 1;
+          backoff.set(task.id, { failures, nextAt: now() + backoffDelay(poll, failures) });
+        } else backoff.delete(task.id);
+      } catch (error) {
+        // A failing task must not take the daemon down; surface it, back off, move on.
+        const failures = (backoff.get(task.id)?.failures ?? 0) + 1;
+        const retryInMs = backoffDelay(poll, failures);
+        backoff.set(task.id, { failures, nextAt: now() + retryInMs });
+        onEvent({ type: "daemon_turn_error", taskId: task.id, message: error instanceof Error ? error.message : String(error), failures, retryInMs });
+      }
+    }
+    try { await sleep(poll, undefined, { signal }); }
+    catch (error) { if (error?.name === "AbortError") return { status: "stopped" }; throw error; }
+  }
+}

package/dist/assets/.agents/aidlc/scripts/lib/loop-drivers.mjs

@@ -9,6 +9,7 @@ import { delimiter, join } from "node:path";
 const MAX_LINE_BYTES = 1024 * 1024;
 const MAX_STDERR_BYTES = 4096;
 const MAX_RESULT_CHARS = 8192;
+const MAX_STREAM_CHARS = 4096;
 const MAX_DIAGNOSTICS = 16;
 
 /** One runtime enumeration for every loop provider. Host gates import this
@@ -51,7 +52,7 @@ registerAgentAdapter("codex", {
     if (event.type === "turn.completed") context.complete();
     if (event.type === "turn.failed" || event.type === "error") throw new Error(`codex reported ${event.type}: ${diagnostic(JSON.stringify(event.error ?? event.message ?? "unknown"))}`);
     const item = record(event.item);
-    if (event.type === "item.completed" && item?.type === "agent_message" && typeof item.text === "string") context.result(item.text);
+    if (event.type === "item.completed" && item?.type === "agent_message" && typeof item.text === "string") { context.result(item.text); await context.stream(item.text); }
     if (event.type === "item.completed" && item?.type === "command_execution") await context.commandEvent(item.exit_code, item.status);
   }
 });
@@ -88,8 +89,13 @@ registerAgentAdapter("opencode", {
   },
   parse: async (event, context) => {
     if (event.sessionID !== undefined) await context.captureId(event.sessionID);
+    if (event.type === "error") {
+      const info = record(event.error);
+      throw new Error(`opencode reported an error: ${diagnostic(info?.message ?? info?.type ?? JSON.stringify(event.error ?? "unknown"))}`);
+    }
     const part = record(event.part);
-    if (event.type === "text" && typeof part?.text === "string") context.result(part.text);
+    if (event.type === "text" && typeof part?.text === "string") { context.result(part.text); await context.stream(part.text); }
+    if (event.type === "tool_use" && typeof part?.tool === "string") await context.tool(part.tool);
     if (event.type === "tool_use" && part?.tool === "shell") {
       const state = record(part.state);
       const metadata = record(record(state?.metadata)?.metadata);
@@ -168,11 +174,17 @@ export async function runAgentTurn({ agent, root, sessionId, prompt, timeoutMs,
     await emit(onEvent, { type: "lifecycle_command", exitCode: safeExitCode, status: safeStatus });
     if ((safeExitCode !== null && safeExitCode !== 0) || safeStatus === "failed") addDiagnostic(`commandFailed exitCode=${String(safeExitCode ?? "unknown")} status=${safeStatus}`);
   };
+  const stream = async (text) => {
+    if (typeof text === "string" && text.trim()) await emit(onEvent, { type: "agent_text", text: text.slice(0, MAX_STREAM_CHARS) });
+  };
+  const tool = async (name) => {
+    if (typeof name === "string" && name) await emit(onEvent, { type: "agent_tool", tool: name });
+  };
   const parseEvent = async (line) => {
     let event;
     try { event = JSON.parse(line); } catch { throw new Error(`${agent} emitted malformed JSONL`); }
     if (!record(event) || typeof event.type !== "string") throw new Error(`${agent} emitted malformed event`);
-    await adapter.parse(event, { captureId, commandEvent, toolUses, complete: () => { completed = true; resultSeen = true; }, result: (value) => { resultText = value.slice(0, MAX_RESULT_CHARS); } });
+    await adapter.parse(event, { captureId, commandEvent, toolUses, stream, tool, complete: () => { completed = true; resultSeen = true; }, result: (value) => { resultText = value.slice(0, MAX_RESULT_CHARS); } });
     await emit(onEvent, { type: "agent_event", eventType: event.type });
   };
   const queueLine = (line) => {

package/dist/assets/.agents/aidlc/scripts/lib/loop-fleet-cli.mjs

@@ -1,4 +1,4 @@
-import { chmodSync, existsSync, mkdtempSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { execFileSync, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
@@ -8,11 +8,32 @@ import { runFleetCoordinator, runFleetWorker, validateFleetLimits } from "./loop
 import { runFleetSupervisor } from "./loop-fleet-supervisor.mjs";
 import { createFleetRemoteRepository } from "./loop-fleet-remote.mjs";
 import { createLeadGitHandoff, createIsolatedWorkerGitHandoff } from "./loop-git.mjs";
-import { workerDockerInvocation, OPENCODE_CONTAINER_ERROR } from "./loop-worker-docker.mjs";
+import { workerDockerInvocation, workerCredentialKeys } from "./loop-worker-docker.mjs";
+import { defaultWorkerImageTag, ensureWorkerImage, validWorkerImageTag } from "./loop-worker-image.mjs";
 
 const required = (env, name) => { const value = env[name]; if (typeof value !== "string" || !value.trim()) throw new Error(`${name} is required`); return value; };
-const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Sleep `ms`, resolving early once any given signal aborts. */
+const pause = (ms, ...signals) => new Promise((resolve) => {
+  const live = signals.filter(Boolean);
+  if (live.some((signal) => signal.aborted)) return resolve();
+  const done = () => { clearTimeout(timer); for (const signal of live) signal.removeEventListener("abort", done); resolve(); };
+  const timer = setTimeout(done, ms);
+  for (const signal of live) signal.addEventListener("abort", done, { once: true });
+});
 const provider = (value, name) => { if (!isLoopProvider(value)) throw new Error(`${name} must be ${LOOP_PROVIDER_LIST}`); return value; };
+const pendingFeedback = (task) => {
+  const evidence = Array.isArray(task?.evidence) ? task.evidence : [];
+  const pending = [];
+  for (let i = 0; i < evidence.length; i++) {
+    const entry = evidence[i];
+    if (entry?.kind !== "diagnostic" || typeof entry.detail !== "string") continue;
+    const match = entry.detail.match(/^Cancelled gate wait at (G0_confirm|G1_review|G2_codereview): /);
+    if (!match) continue;
+    const approvedAfter = evidence.slice(i + 1).some((later) => later?.kind === "approval" && later.result === "pass" && later.gate === match[1]);
+    if (!approvedAfter) pending.push(entry.detail);
+  }
+  return pending;
+};
 function workerMapping(env, workerIds, defaultAgent) {
   if (!env.AIDLC_FLEET_WORKER_PROVIDERS) return Object.fromEntries(workerIds.map((id) => [id, defaultAgent]));
   let mapping;
@@ -20,9 +41,46 @@ function workerMapping(env, workerIds, defaultAgent) {
   if (!mapping || typeof mapping !== "object" || Array.isArray(mapping) || Object.keys(mapping).length !== workerIds.length || workerIds.some((id) => !Object.hasOwn(mapping, id) || !isLoopProvider(mapping[id])) || Object.keys(mapping).some((id) => !workerIds.includes(id))) throw new Error(`AIDLC_FLEET_WORKER_PROVIDERS must map every configured worker ID to ${LOOP_PROVIDER_LIST}`);
   return mapping;
 }
+/** This worker's provider: AIDLC_FLEET_WORKER_AGENT, else its entry in
+ * AIDLC_FLEET_WORKER_PROVIDERS (keyed by worker ID), else AIDLC_FLEET_AGENT
+ * (the lead's provider — only a last resort, so a copied lead env cannot
+ * override this worker's own mapping), else undefined. */
+function workerProvider(env, workerId) {
+  if (env.AIDLC_FLEET_WORKER_AGENT !== undefined) return provider(env.AIDLC_FLEET_WORKER_AGENT, "AIDLC_FLEET_WORKER_AGENT");
+  if (env.AIDLC_FLEET_WORKER_PROVIDERS) {
+    let mapping;
+    try { mapping = JSON.parse(env.AIDLC_FLEET_WORKER_PROVIDERS); } catch { throw new Error("AIDLC_FLEET_WORKER_PROVIDERS must be a JSON object"); }
+    if (!mapping || typeof mapping !== "object" || Array.isArray(mapping)) throw new Error("AIDLC_FLEET_WORKER_PROVIDERS must be a JSON object");
+    if (Object.hasOwn(mapping, workerId)) return provider(mapping[workerId], `AIDLC_FLEET_WORKER_PROVIDERS["${workerId}"]`);
+  }
+  return env.AIDLC_FLEET_AGENT === undefined ? undefined : provider(env.AIDLC_FLEET_AGENT, "AIDLC_FLEET_AGENT");
+}
+
+/** Worker image tag: explicit AIDLC_WORKER_DOCKER_IMAGE, else the project's
+ * `.agents/config.json` `loop.workerImage[provider]`, else the default tag
+ * (built from the shipped Dockerfile when missing). */
+function workerImageTag({ env, root, agent, onEvent }) {
+  const requested = env.AIDLC_WORKER_DOCKER_IMAGE;
+  if (typeof requested === "string" && requested.trim()) return requested;
+  if (!agent) throw new Error("AIDLC_WORKER_DOCKER_IMAGE is required when the worker provider is unknown; set AIDLC_FLEET_WORKER_AGENT (or this worker's AIDLC_FLEET_WORKER_PROVIDERS entry) to use the default worker image, or build one with `aidlc-kit loop worker-image --provider <provider>` and set the env var");
+  const configPath = join(root, ".agents", "config.json");
+  let configured;
+  if (existsSync(configPath)) {
+    let config;
+    try { config = JSON.parse(readFileSync(configPath, "utf8")); } catch { throw new Error(`Invalid project config: ${configPath}`); }
+    configured = config?.loop?.workerImage?.[agent];
+    if (configured !== undefined && !validWorkerImageTag(configured)) throw new Error(`Invalid loop.workerImage.${agent} in ${configPath}`);
+  }
+  const image = configured ?? defaultWorkerImageTag(agent);
+  return ensureWorkerImage({ root, provider: agent, image, env, onEvent });
+}
 
-/** Package-local entrypoint. The service wrapper supplies its MCP HTTP client. */
-export async function runFleetCli(argv, { callTool, env = process.env, out = console.log, signal, coordinator: coordinatorOverride } = {}) {
+/** Package-local entrypoint. The service wrapper supplies its MCP HTTP client.
+ * `signal` stops after the current turn; `cancelSignal` also aborts the
+ * in-flight agent turn (result status `stopped`). `onEvent(event)` receives
+ * every emitted event object instead of `out(JSON.stringify(event))`.
+ * `untilStop` applies to role `supervisor` only (see runFleetSupervisor). */
+export async function runFleetCli(argv, { callTool, env = process.env, out = console.log, onEvent, signal, cancelSignal, untilStop = false, coordinator: coordinatorOverride } = {}) {
   const [role, targetId, ...flags] = argv;
   if (!["coordinator", "feature", "worker", "supervisor"].includes(role) || ((role === "coordinator" || role === "feature" || role === "supervisor") && !targetId) || flags.some((arg) => arg !== "--once") || (role === "supervisor" && flags.length) || (role === "worker" && targetId && targetId !== "--once")) throw new Error("Usage: aidlc-fleet coordinator <task-id> [--once] | feature <feature-id> [--once] | supervisor <task-id> | worker [--once]");
   const once = flags.includes("--once") || (role === "worker" && targetId === "--once");
@@ -44,23 +102,21 @@ export async function runFleetCli(argv, { callTool, env = process.env, out = con
   const pollMs = env.AIDLC_FLEET_POLL_MS ? Number(env.AIDLC_FLEET_POLL_MS) : 5000;
   if (!Number.isSafeInteger(pollMs) || pollMs < 1000 || pollMs > 300000) throw new Error("AIDLC_FLEET_POLL_MS must be 1000..300000");
   if (env.AIDLC_FLEET_CODE_ONLY_RETRY && !["0", "1"].includes(env.AIDLC_FLEET_CODE_ONLY_RETRY)) throw new Error("AIDLC_FLEET_CODE_ONLY_RETRY must be 0 or 1");
-  const emit = (event) => out(JSON.stringify(event));
+  const emit = typeof onEvent === "function" ? (event) => onEvent(event) : (event) => out(JSON.stringify(event));
+  const stopRequested = () => Boolean(signal?.aborted || cancelSignal?.aborted);
   if (role === "worker") {
     const workerId = required(env, "AIDLC_FLEET_WORKER_ID");
-    const workerAgentSetting = env.AIDLC_FLEET_WORKER_AGENT ?? env.AIDLC_FLEET_AGENT;
-    const workerAgent = workerAgentSetting === undefined ? undefined : provider(workerAgentSetting, "AIDLC_FLEET_WORKER_AGENT");
-    if (workerAgent === "opencode") throw new Error(OPENCODE_CONTAINER_ERROR);
-    const requestedImage = required(env, "AIDLC_WORKER_DOCKER_IMAGE");
+    const workerAgent = workerProvider(env, workerId);
+    const requestedImage = workerImageTag({ env, root, agent: workerAgent, onEvent: emit });
     if (!/^[a-zA-Z0-9][a-zA-Z0-9._/:@-]{0,255}$/.test(requestedImage)) throw new Error("Invalid Docker worker image");
     const image = execFileSync("docker", ["image", "inspect", "--format", "{{.Id}}", requestedImage], {env:{PATH:env.PATH ?? "/usr/bin:/bin"},encoding:"utf8",timeout:30000,stdio:["ignore","pipe","ignore"]}).trim();
     if (!/^sha256:[a-f0-9]{64}$/.test(image)) throw new Error("Docker worker image lacks immutable image ID");
     const uid = process.getuid?.(), gid = process.getgid?.();
     if (!Number.isSafeInteger(uid) || uid < 1 || !Number.isSafeInteger(gid) || gid < 1) throw new Error("Docker worker requires a non-root host uid and gid");
     const preflight = async (agent) => {
-      const credential = agent === "codex" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY";
       const empty = mkdtempSync(join(tmpdir(), "aidlc-worker-preflight-"));
       try {
-        const invocation = workerDockerInvocation({workspace:empty,image,command:agent,args:["--version"],credentialEnv:[credential],hostEnv:env,uid,gid});
+        const invocation = workerDockerInvocation({workspace:empty,image,command:agent,args:["--version"],credentialEnv:workerCredentialKeys(agent, env),hostEnv:env,uid,gid});
         execFileSync("docker", ["info"], {env:{PATH:invocation.env.PATH},stdio:"ignore",timeout:30000});
         execFileSync("docker", ["image","inspect",image], {env:{PATH:invocation.env.PATH},stdio:"ignore",timeout:30000});
         const name = `aidlc-worker-preflight-${randomUUID()}`;
@@ -90,15 +146,14 @@ export async function runFleetCli(argv, { callTool, env = process.env, out = con
       async discard(args) { try { return await baseHandoff.discard(args); } finally { cleanupSession(args.workspace); } }
     };
     const isolatedDriver = async (turn) => {
-      if (turn.agent === "opencode") throw new Error(OPENCODE_CONTAINER_ERROR);
       const session=sessions.get(turn.root);
       if (!session || session.agent !== turn.agent || (turn.sessionId && turn.sessionId !== session.sessionId)) throw new Error("Docker worker session is not recoverable; reconcile this assignment");
-      const credential = turn.agent === "codex" ? "OPENAI_API_KEY" : "ANTHROPIC_API_KEY";
+      const credentialEnv = workerCredentialKeys(turn.agent, env);
       const name = `aidlc-worker-${randomUUID()}`;
       let started = false;
       try {
-        const result = await runAgentTurn({...turn, root:"/workspace", spawnProcess: (command,args,options) => {
-          const invocation=workerDockerInvocation({workspace:turn.root,image,command,args,credentialEnv:[credential],hostEnv:env,uid,gid,sessionHome:session.home});
+        const result = await runAgentTurn({...turn, root:"/workspace", env, spawnProcess: (command,args,options) => {
+          const invocation=workerDockerInvocation({workspace:turn.root,image,command,args,credentialEnv,hostEnv:env,uid,gid,sessionHome:session.home});
           const dockerArgs=invocation.args.filter((arg,index) => !(index===1 && arg==="--rm"));
           dockerArgs.splice(1,0,"--name",name);
           started = true;
@@ -114,20 +169,20 @@ export async function runFleetCli(argv, { callTool, env = process.env, out = con
       }
     };
     for (;;) {
-      if (signal?.aborted) return { status: "stopped" };
+      if (stopRequested()) return { status: "stopped" };
       let result;
-      try { result = await runFleetWorker({ repository, workerId, workerAgent, preflight, limits, driver: isolatedDriver, handoff, packet: async ({ job, snapshot }) => [
+      try { result = await runFleetWorker({ repository, workerId, workerAgent, preflight, limits, driver: isolatedDriver, handoff, cancelSignal, packet: async ({ job, snapshot }) => [
         `AI-DLC worker assignment ${job.assignmentId}, attempt ${job.attempt}.`,
         `Task: ${snapshot.task.title} (${job.taskId}). Item: ${job.itemId}.`,
         `Only change these owned paths: ${job.ownedPaths.join(", ")}.`,
         `Base commit: ${job.baseCommit}. Assigned branch: ${job.branch}.`,
-        "Complete the scoped item and report remaining risks. The supervisor handles the Git commit and push.",
+        "Complete the scoped item and report remaining risks. The supervisor handles the Git commit and push. End the final answer with a Conventional Commits message on its own line as AI-DLC-COMMIT: type(scope): subject (for example AI-DLC-COMMIT: docs(ui): add web UI improvement proposal), followed by AI-DLC-ITEM-COMPLETE on its own line.",
         ...(env.AIDLC_FLEET_CODE_ONLY_RETRY === "1" ? ["This assignment is declared code-only: perform no external side effects beyond the supervisor's Git handoff."] : [])
       ].join("\n"), onEvent: emit }); }
       finally { for (const [workspace, entry] of sessions) { rmSync(entry.home,{recursive:true,force:true}); sessions.delete(workspace); } }
       emit(result);
-      if (once) return result;
-      await pause(pollMs);
+      if (once || result.status === "stopped") return result;
+      await pause(pollMs, signal, cancelSignal);
     }
   }
   const workerIds = required(env, "AIDLC_FLEET_WORKER_IDS").split(",").map((value) => value.trim()).filter(Boolean);
@@ -142,19 +197,21 @@ export async function runFleetCli(argv, { callTool, env = process.env, out = con
         const raw = execFileSync(process.execPath, [remoteState, "phase", "context", taskId], { cwd: root, env: fleetEnv, encoding: "utf8", timeout: 30000, maxBuffer: 2 * 1024 * 1024 });
         const packet = JSON.parse(raw);
         if (packet?.ok !== true || typeof packet.result?.content !== "string" || !packet.result.content) throw new Error("Remote phase context is empty or invalid");
-        return `${packet.result.content}\n\nFleet supervisor: canonical nextAction is ${JSON.stringify(snapshot.nextAction)}. Use only remote-state.mjs for lifecycle commands. Never approve a gate.`;
+        const feedback = pendingFeedback(snapshot.task);
+        const feedbackBlock = feedback.length ? `Human feedback (revise the current review artifact accordingly, then re-present the gate):\n${feedback.map((text) => `- ${text}`).join("\n")}\n\n` : "";
+        return `${feedbackBlock}${packet.result.content}\n\nFleet supervisor: canonical nextAction is ${JSON.stringify(snapshot.nextAction)}. Use only remote-state.mjs for lifecycle commands. Never approve a gate.`;
       },
       driver: async ({ leadEpoch, prompt, timeoutMs, signal: turnSignal }) => {
         return runAgentTurn({ agent, root, prompt, timeoutMs, signal: turnSignal, env: { ...env, AIDLC_FLEET_LEAD_EPOCH: String(leadEpoch), AIDLC_FLEET_LEAD_OWNER_TOKEN: repository.leadOwnerToken() }, onEvent: emit });
       } });
-  const runTask = async (taskId, reservedJobs = []) => runFleetCoordinator({ repository, taskId, ...leadTaskFor(taskId), reservedJobs, onEvent: emit });
+  const runTask = async (taskId, reservedJobs = []) => runFleetCoordinator({ repository, taskId, ...leadTaskFor(taskId), reservedJobs, stopSignal: signal, cancelSignal, onEvent: emit });
   if (role === "supervisor") {
-    const result = await runFleetSupervisor({ repository, taskId: targetId, ...leadTaskFor(targetId), signal, onEvent: emit, ...(coordinatorOverride ? { coordinator: coordinatorOverride } : {}) });
+    const result = await runFleetSupervisor({ repository, taskId: targetId, ...leadTaskFor(targetId), signal, cancelSignal, untilStop, onEvent: emit, ...(coordinatorOverride ? { coordinator: coordinatorOverride } : {}) });
     emit(result);
     return result;
   }
   for (;;) {
-    if (signal?.aborted) return { status: "stopped" };
+    if (stopRequested()) return { status: "stopped" };
     if (role === "feature") {
       const feature = await repository.getFeature({ featureId: targetId });
       if (!feature) throw new Error(`Unknown feature ${targetId}`);
@@ -167,17 +224,18 @@ export async function runFleetCli(argv, { callTool, env = process.env, out = con
         const reservedJobs = (await repository.listAllJobs()).filter((job) => job.taskId !== member.taskId);
         const result = await runTask(member.taskId, reservedJobs);
         results.push(result); emit(result);
+        if (result.status === "stopped") return { status: "stopped", featureId: targetId, results };
         if (result.status === "gate") return { status: "gate", featureId: targetId, results, blockedTaskIds: readiness.items.filter((item) => !item.ready && item.blockers.length).map((item) => item.taskId) };
       }
       const stopped = results.some((entry) => ["blocked", "reconcile", "paused", "terminal"].includes(entry.status));
       const result = { status: !ready.length || stopped ? "blocked" : "active", featureId: targetId, results, blockedTaskIds: readiness.items.filter((member) => !member.ready && member.blockers.length).map((member) => member.taskId) };
       if (once || result.status === "blocked") return result;
-      await pause(pollMs);
+      await pause(pollMs, signal, cancelSignal);
       continue;
     }
     const result = await runTask(targetId);
     emit(result);
-    if (once || ["terminal", "complete", "blocked", "paused", "reconcile", "gate"].includes(result.status)) return result;
-    await pause(pollMs);
+    if (once || ["terminal", "complete", "blocked", "paused", "reconcile", "gate", "stopped"].includes(result.status)) return result;
+    await pause(pollMs, signal, cancelSignal);
   }
 }

package/dist/assets/.agents/aidlc/scripts/lib/loop-fleet-remote.mjs

@@ -44,6 +44,13 @@ export function createFleetRemoteRepository({ callTool, url, token, workspace, r
     getFeature: async ({ featureId }) => (await fleet()).fleet.features[featureId] ?? null,
     featureReady: async ({ featureId }) => call("feature_ready", { featureId }),
     listAllJobs: async () => Object.values((await fleet()).fleet.jobs).map(normalizeJob),
+    /** Every canonical task in the workspace (unordered), for daemon task discovery. */
+    listTasks: async () => {
+      const value = await call("state_get", {});
+      const tasks = value?.state?.tasks;
+      if (!tasks || typeof tasks !== "object" || Array.isArray(tasks)) throw new Error("Invalid remote workspace state");
+      return Object.values(tasks);
+    },
     readTask: async ({ taskId }) => {
       const value = await call("task_get", { taskId, clientProjectRoot: root });
       return { task: value.task, nextAction: value.nextAction, revision: value.revision };

package/dist/assets/.agents/aidlc/scripts/lib/loop-fleet-supervisor.mjs

@@ -6,14 +6,24 @@ const taskDigest = (task) => createHash("sha256").update(JSON.stringify(task)).d
 const targets = { G0_confirm: "plan", G1_review: "build", G2_codereview: "wrap" };
 
 /** The service owns the checkpoint and atomically binds each run claim to this
- * supervisor. An unavailable or ambiguous checkpoint never authorizes work. */
-export async function runFleetSupervisor({ repository, taskId, limits: inputLimits, pollMs = 5000, signal, onEvent = () => {}, coordinator = runFleetCoordinator, ...options }) {
+ * supervisor. An unavailable or ambiguous checkpoint never authorizes work.
+ *
+ * `signal` stops at the next turn boundary; `cancelSignal` also aborts the
+ * in-flight lead turn. Both end as `{ status: "stopped" }`.
+ *
+ * `untilStop: true` (daemon mode) never polls a human gate: a newly published
+ * gate returns `{ status: "gate", taskId, gate, snapshotId, gateView }` and an
+ * already pending checkpoint returns `{ status: "waiting", taskId, gate,
+ * snapshotId }`. The supervisor lease is released either way; the service
+ * accepts the reviewer approval against the pending checkpoint, and a later
+ * supervisor resumes from the `approved` checkpoint. */
+export async function runFleetSupervisor({ repository, taskId, limits: inputLimits, pollMs = 5000, signal, cancelSignal, untilStop = false, onEvent = () => {}, coordinator = runFleetCoordinator, ...options }) {
   const limits = validateFleetLimits(inputLimits);
   if (!repository || typeof taskId !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(taskId) || !Number.isSafeInteger(pollMs) || pollMs < 1 || pollMs > 300000) throw new Error("Invalid fleet supervisor configuration");
   for (const name of ["claimSupervisor", "renewSupervisor", "releaseSupervisor", "readGateCheckpoint", "readTask", "claimLead"]) if (typeof repository[name] !== "function") throw new Error(`Fleet supervisor requires ${name}`);
   await repository.claimSupervisor({ taskId, leaseMs: limits.leaseMs, idempotencyKey: randomUUID() });
   const controller = new AbortController();
-  const combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+  const combined = AbortSignal.any([signal, cancelSignal, controller.signal].filter(Boolean));
   let failure; let pending = Promise.resolve();
   const timer = setInterval(() => { pending = pending.then(() => repository.renewSupervisor({ taskId, leaseMs: limits.leaseMs })).catch((error) => { failure = error; controller.abort(error); }); }, limits.heartbeatMs);
   timer.unref?.();
@@ -28,12 +38,17 @@ export async function runFleetSupervisor({ repository, taskId, limits: inputLimi
       if (checkpoint?.status === "pending") {
         if (task.status !== "blocked_on_user" || task.gate !== checkpoint.gate || taskDigest(task) !== checkpoint.taskDigest || snapshot.nextAction?.classification !== "await_user") return { status: "blocked", taskId, reason: "Pending checkpoint does not match canonical gate" };
         await onEvent({ type: "waiting", taskId, gate: checkpoint.gate, snapshotId: checkpoint.snapshotId });
+        if (untilStop) return { status: "waiting", taskId, gate: checkpoint.gate, snapshotId: checkpoint.snapshotId };
         try { await sleep(pollMs, undefined, { signal: combined }); } catch (error) { if (error?.name !== "AbortError") throw error; }
         continue;
       }
       if (checkpoint?.status === "consumed") return { status: "blocked", taskId, reason: "Consumed checkpoint requires reconciliation before restart" };
-      if (checkpoint && checkpoint.status !== "approved") return { status: "blocked", taskId, reason: "Approved checkpoint does not match canonical state" };
-      if (checkpoint) {
+      if (checkpoint?.status === "rejected") {
+        if (task.status !== "active" || task.phase !== checkpoint.phase || task.gate !== checkpoint.gate || snapshot.nextAction?.classification !== "run_phase") return { status: "blocked", taskId, reason: "Rejected checkpoint does not match canonical state" };
+      } else if (checkpoint && checkpoint.status !== "approved") {
+        return { status: "blocked", taskId, reason: "Approved checkpoint does not match canonical state" };
+      }
+      if (checkpoint?.status === "approved") {
         // A task snapshot older than the atomic approval is a read race between
         // the two reads, not a mismatch: re-read the canonical task immediately.
         if (Number.isSafeInteger(checkpoint.approvalRevision) && checkpoint.approvalRevision > snapshot.revision) { await onEvent({ type: "resync", taskId, gate: checkpoint.gate }); continue; }
@@ -43,11 +58,12 @@ export async function runFleetSupervisor({ repository, taskId, limits: inputLimi
       await repository.renewSupervisor({ taskId, leaseMs: limits.leaseMs });
       if (combined.aborted) break;
       const claim = await repository.claimLead({ taskId, leaseMs: limits.leaseMs, expectedStateRevision: snapshot.revision, expectedTaskDigest: taskDigest(task), checkpoint, idempotencyKey: randomUUID() });
-      const result = await coordinator({ ...options, repository, taskId, limits, claimedLead: claim, supervisorSignal: combined, onEvent });
+      const result = await coordinator({ ...options, repository, taskId, limits, claimedLead: claim, supervisorSignal: controller.signal, stopSignal: signal, cancelSignal, onEvent });
       if (failure) throw failure;
       if (result?.status !== "gate") return result;
       // gate_snapshot_put stores snapshot and checkpoint in one service transaction.
       await onEvent({ type: "gate", taskId, gate: result.gate, snapshotId: result.snapshotId, gateView: result.gateView });
+      if (untilStop) return { status: "gate", taskId, gate: result.gate, snapshotId: result.snapshotId, gateView: result.gateView };
     }
     if (failure) throw new Error(`Supervisor lease renewal failed: ${failure.message}`);
     return { status: "stopped", taskId };