@harness-engineering/orchestrator 0.2.13 → 0.2.15

package/dist/index.js

@@ -676,7 +676,26 @@ function handleTick(state, event, config) {
       continue;
     }
     const scopeTier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
-    const signals = event.concernSignals?.get(issue.id) ?? [];
+    const signals = [...event.concernSignals?.get(issue.id) ?? []];
+    let suggestedPersona;
+    try {
+      const personaRecs = event.personaRecommendations?.get(issue.id);
+      if (personaRecs && personaRecs.length > 0) {
+        suggestedPersona = personaRecs[0].persona;
+        if (personaRecs[0].weightedScore < 0.3) {
+          signals.push({
+            name: "lowExpertise",
+            reason: `Top persona "${suggestedPersona}" scored ${personaRecs[0].weightedScore.toFixed(2)} (below 0.3 threshold)`
+          });
+        }
+      } else if (personaRecs && personaRecs.length === 0) {
+        signals.push({
+          name: "noPersonaMatch",
+          reason: "No persona recommendations available for this issue's systems"
+        });
+      }
+    } catch {
+    }
     const decision = routeIssue(scopeTier, signals, escalationConfig);
     if (decision.action === "needs-human") {
       next.claimed.add(issue.id);
@@ -692,6 +711,12 @@ function handleTick(state, event, config) {
     }
     const backend = resolveBackend(decision.action, !!config.agent.localBackend);
     claimAndDispatch(next, issue, backend, nowMs, effects);
+    if (suggestedPersona) {
+      const lastEffect = effects[effects.length - 1];
+      if (lastEffect && lastEffect.type === "claim") {
+        lastEffect.suggestedPersona = suggestedPersona;
+      }
+    }
   }
   pruneCompleted(next);
   return { nextState: next, effects };
@@ -818,7 +843,7 @@ function handleAgentUpdate(state, issueId, event) {
   }
   return { nextState: next, effects };
 }
-function handleRetryFired(state, issueId, candidates, config, nowMs) {
+function handleRetryFired(state, issueId, candidates, config, nowMs, concernSignals) {
   const next = cloneState(state);
   const effects = [];
   const retryEntry = next.retryAttempts.get(issueId);
@@ -875,7 +900,8 @@ function handleRetryFired(state, issueId, candidates, config, nowMs) {
   }
   const escalationConfig = resolveEscalationConfig(config);
   const scopeTier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
-  const decision = routeIssue(scopeTier, [], escalationConfig);
+  const signals = [...concernSignals?.get(issue.id) ?? []];
+  const decision = routeIssue(scopeTier, signals, escalationConfig);
   if (decision.action === "needs-human") {
     effects.push(
       buildEscalateEffect(issue.id, issue.identifier, decision.reasons, {
@@ -955,7 +981,14 @@ function applyEvent(state, event, config) {
     case "agent_update":
       return handleAgentUpdate(state, event.issueId, event.event);
     case "retry_fired":
-      return handleRetryFired(state, event.issueId, event.candidates, config, event.nowMs);
+      return handleRetryFired(
+        state,
+        event.issueId,
+        event.candidates,
+        config,
+        event.nowMs,
+        event.concernSignals
+      );
     case "stall_detected":
       return handleStallDetected(state, event.issueId, config);
     case "claim_rejected":
@@ -2407,10 +2440,15 @@ var WorkspaceHooks = class {
       return (0, import_types7.Ok)(void 0);
     }
     return new Promise((resolve6) => {
-      const child = (0, import_node_child_process3.spawn)(command, {
-        shell: true,
+      const filteredEnv = {};
+      for (const [k, v] of Object.entries(process.env)) {
+        if (v != null && !k.includes("SECRET") && !k.includes("TOKEN") && !k.includes("PASSWORD")) {
+          filteredEnv[k] = v;
+        }
+      }
+      const child = (0, import_node_child_process3.spawn)("/bin/sh", ["-c", command], {
         cwd,
-        env: process.env
+        env: filteredEnv
       });
       const timeout = setTimeout(() => {
         child.kill();
@@ -2519,11 +2557,12 @@ var import_node_events = require("events");
 var path15 = __toESM(require("path"));
 var import_node_crypto7 = require("crypto");
 var import_core9 = require("@harness-engineering/core");
-var import_intelligence2 = require("@harness-engineering/intelligence");
+var import_intelligence3 = require("@harness-engineering/intelligence");
 var import_graph = require("@harness-engineering/graph");
 
 // src/intelligence/pipeline-runner.ts
 var path7 = __toESM(require("path"));
+var import_intelligence = require("@harness-engineering/intelligence");
 var import_core2 = require("@harness-engineering/core");
 var CONNECTION_ERROR_PATTERNS = [
   "Connection error",
@@ -2552,6 +2591,7 @@ var IntelligencePipelineRunner = class {
     this.graphLoaded = true;
     await this.loadGraphStore();
     await this.hydrateSpecCache();
+    this.refreshSpecializationProfiles();
   }
   /**
    * Runs the full intelligence pipeline for the given candidates:
@@ -2605,11 +2645,39 @@ var IntelligencePipelineRunner = class {
     } catch (err) {
       this.ctx.logger.warn("Auto-publish analyses failed", { error: String(err) });
     }
-    return { concernSignals, enrichedSpecs, complexityScores, simulationResults };
+    this.refreshSpecializationProfiles();
+    setTickActivity("analyzing", "Scoring persona recommendations");
+    const personaRecommendations = this.computePersonaRecommendations(candidates);
+    return {
+      concernSignals,
+      enrichedSpecs,
+      complexityScores,
+      simulationResults,
+      personaRecommendations
+    };
   }
   // ---------------------------------------------------------------------------
   // Private helpers
   // ---------------------------------------------------------------------------
+  /**
+   * Refresh specialization profiles from the graph store. This recomputes
+   * expertise scores for all personas with execution_outcome nodes and
+   * persists them to .harness/specialization-profiles.json. Non-fatal.
+   */
+  refreshSpecializationProfiles() {
+    if (!this.ctx.graphStore) return;
+    try {
+      const store = (0, import_intelligence.refreshProfiles)(this.ctx.projectRoot, this.ctx.graphStore);
+      const personaCount = Object.keys(store.profiles).length;
+      if (personaCount > 0) {
+        this.ctx.logger.info(`Refreshed specialization profiles for ${personaCount} persona(s)`);
+      }
+    } catch (err) {
+      this.ctx.logger.warn("Failed to refresh specialization profiles", {
+        error: String(err)
+      });
+    }
+  }
   async loadGraphStore() {
     try {
       const graphDir = path7.join(this.ctx.config.workspace.root, "..", "graph");
@@ -2768,7 +2836,22 @@ var IntelligencePipelineRunner = class {
     const scopeTier = detectScopeTier(issue, artifactPresenceFromIssue(issue));
     try {
       const result = await this.ctx.pipeline.preprocessIssue(issue, scopeTier, escalationConfig);
-      if (result.signals.length > 0) concernSignals.set(issue.id, result.signals);
+      const signals = [...result.signals];
+      if (result.spec) {
+        if (result.spec.unknowns.length > 3) {
+          signals.push({
+            name: "high-unknowns",
+            reason: `Enriched spec has ${result.spec.unknowns.length} unknowns (threshold: 3)`
+          });
+        }
+        if (result.spec.ambiguities.length > 5) {
+          signals.push({
+            name: "high-ambiguities",
+            reason: `Enriched spec has ${result.spec.ambiguities.length} ambiguities (threshold: 5)`
+          });
+        }
+      }
+      if (signals.length > 0) concernSignals.set(issue.id, signals);
       if (result.spec) {
         enrichedSpecs.set(issue.id, result.spec);
         this.ctx.enrichedSpecsByIssue.set(issue.id, result.spec);
@@ -2815,6 +2898,30 @@ var IntelligencePipelineRunner = class {
       return true;
     });
   }
+  /**
+   * Compute persona recommendations for each candidate using the specialization
+   * scorer. Extracts system node IDs from issue labels prefixed with `system:`
+   * or `module:`. Failures are non-fatal — returns an empty map on error.
+   */
+  computePersonaRecommendations(candidates) {
+    const results = /* @__PURE__ */ new Map();
+    if (!this.ctx.graphStore) return results;
+    try {
+      for (const issue of candidates) {
+        const systemNodeIds = issue.labels.filter((l) => l.startsWith("system:") || l.startsWith("module:")).map((l) => l.split(":")[1]).filter((id) => id.length > 0);
+        if (systemNodeIds.length === 0) continue;
+        const recs = (0, import_intelligence.weightedRecommendPersona)(this.ctx.graphStore, { systemNodeIds });
+        if (recs.length > 0) {
+          results.set(issue.id, recs);
+        }
+      }
+    } catch (err) {
+      this.ctx.logger.warn("Persona recommendation scoring failed", {
+        error: String(err)
+      });
+    }
+    return results;
+  }
   async analyzeCandidates(eligibleCandidates, escalationConfig, nowForCache, failureTtl, circuitBreakerThreshold, concernSignals, enrichedSpecs, complexityScores, setTickActivity) {
     let processed = 0;
     let consecutiveConnErrors = 0;
@@ -2892,10 +2999,27 @@ var CompletionHandler = class {
   // ---------------------------------------------------------------------------
   // Private helpers
   // ---------------------------------------------------------------------------
+  /**
+   * Infer a TaskType from issue labels.
+   * Looks for common label patterns: bug/bugfix → 'bugfix', feat/feature → 'feature', etc.
+   */
+  inferTaskType(labels) {
+    const joined = labels.map((l) => l.toLowerCase()).join(" ");
+    if (/\bbug(fix)?\b/.test(joined)) return "bugfix";
+    if (/\bfeat(ure)?\b/.test(joined)) return "feature";
+    if (/\brefactor\b/.test(joined)) return "refactor";
+    if (/\bdoc(s|umentation)?\b/.test(joined)) return "docs";
+    if (/\btest(s|ing)?\b/.test(joined)) return "test";
+    if (/\bchore\b/.test(joined)) return "chore";
+    return void 0;
+  }
   async recordOutcomeIfPipelineEnabled(issueId, reason, attempt, error, entry) {
     if (!this.ctx.pipeline) return;
     const enrichedSpec = this.ctx.enrichedSpecsByIssue.get(issueId);
     const affectedSystemNodeIds = enrichedSpec ? enrichedSpec.affectedSystems.filter((s) => s.graphNodeId !== null).map((s) => s.graphNodeId) : [];
+    const agentPersona = entry?.session?.backendName ?? this.ctx.config.agent.backend ?? "default";
+    const labels = entry?.issue?.labels ?? [];
+    const taskType = this.inferTaskType(labels);
     const outcome = {
       id: `outcome:${issueId}:${attempt ?? 0}`,
       issueId,
@@ -2906,7 +3030,9 @@ var CompletionHandler = class {
       durationMs: entry ? Date.now() - new Date(entry.startedAt).getTime() : 0,
       linkedSpecId: enrichedSpec?.id ?? null,
       affectedSystemNodeIds,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      agentPersona,
+      ...taskType ? { taskType } : {}
     };
     try {
       this.ctx.pipeline.recordOutcome(outcome);
@@ -4948,7 +5074,7 @@ function extractChunks(event) {
 }
 
 // src/server/routes/analyze.ts
-var import_intelligence = require("@harness-engineering/intelligence");
+var import_intelligence2 = require("@harness-engineering/intelligence");
 var import_zod4 = require("zod");
 var AnalyzeRequestSchema = import_zod4.z.object({
   title: import_zod4.z.string().min(1),
@@ -4978,7 +5104,7 @@ async function runPipeline(res, pipeline, parsed) {
     disconnected = true;
   });
   emit2(res, { type: "status", text: "Converting to work item..." });
-  const rawItem = (0, import_intelligence.manualToRawWorkItem)({
+  const rawItem = (0, import_intelligence2.manualToRawWorkItem)({
     title: parsed.title,
     description: parsed.description ?? "",
     labels: parsed.labels ?? []
@@ -5021,7 +5147,7 @@ async function runPipeline(res, pipeline, parsed) {
     }
   }
   if (disconnected) return;
-  const signals = (0, import_intelligence.scoreToConcernSignals)(score);
+  const signals = (0, import_intelligence2.scoreToConcernSignals)(score);
   if (signals.length > 0) {
     emit2(res, { type: "signals", data: signals });
   }
@@ -5619,6 +5745,37 @@ var PlanWatcher = class {
 };
 
 // src/server/http.ts
+var RATE_LIMIT = Number(process.env["HARNESS_RATE_LIMIT"]) || 100;
+var WINDOW_MS = 6e4;
+var rateBuckets = /* @__PURE__ */ new Map();
+var ratePruneTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [ip, bucket] of rateBuckets) {
+    if (bucket.resetAt <= now) rateBuckets.delete(ip);
+  }
+}, 6e4);
+ratePruneTimer.unref();
+function isLocalhost(ip) {
+  return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
+}
+function checkRateLimit(req, res) {
+  const ip = req.socket.remoteAddress ?? "unknown";
+  if (!process.env["HARNESS_RATE_LIMIT_LOCALHOST"] && isLocalhost(ip)) return true;
+  const now = Date.now();
+  let bucket = rateBuckets.get(ip);
+  if (!bucket || bucket.resetAt <= now) {
+    bucket = { count: 0, resetAt: now + WINDOW_MS };
+    rateBuckets.set(ip, bucket);
+  }
+  bucket.count++;
+  if (bucket.count > RATE_LIMIT) {
+    const retryAfter = Math.ceil((bucket.resetAt - now) / 1e3);
+    res.writeHead(429, { "Content-Type": "application/json", "Retry-After": String(retryAfter) });
+    res.end(JSON.stringify({ error: "Too Many Requests" }));
+    return false;
+  }
+  return true;
+}
 function getBindHost() {
   return process.env["HOST"] ?? "127.0.0.1";
 }
@@ -5706,6 +5863,9 @@ var OrchestratorServer = class {
     if (this.handleStateEndpoint(req, res)) {
       return;
     }
+    if (!checkRateLimit(req, res)) {
+      return;
+    }
     if (this.handleApiRoutes(req, res)) {
       return;
     }
@@ -6326,6 +6486,18 @@ var MaintenanceScheduler = class {
 // src/maintenance/reporter.ts
 var fs14 = __toESM(require("fs"));
 var path14 = __toESM(require("path"));
+var import_zod9 = require("zod");
+var RunResultSchema = import_zod9.z.object({
+  taskId: import_zod9.z.string(),
+  startedAt: import_zod9.z.string(),
+  completedAt: import_zod9.z.string(),
+  status: import_zod9.z.enum(["success", "failure", "skipped", "no-issues"]),
+  findings: import_zod9.z.number(),
+  fixed: import_zod9.z.number(),
+  prUrl: import_zod9.z.string().nullable(),
+  prUpdated: import_zod9.z.boolean(),
+  error: import_zod9.z.string().optional()
+});
 var MAX_HISTORY = 500;
 var fallbackLogger = {
   info: () => {
@@ -6351,9 +6523,9 @@ var MaintenanceReporter = class {
       await fs14.promises.mkdir(this.persistDir, { recursive: true });
       const filePath = path14.join(this.persistDir, "history.json");
       const data = await fs14.promises.readFile(filePath, "utf-8");
-      const parsed = JSON.parse(data);
-      if (Array.isArray(parsed)) {
-        this.history = parsed.slice(0, MAX_HISTORY);
+      const parsed = import_zod9.z.array(RunResultSchema).safeParse(JSON.parse(data));
+      if (parsed.success) {
+        this.history = parsed.data.slice(0, MAX_HISTORY);
       }
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ENOENT") {
@@ -6504,7 +6676,8 @@ var TaskRunner = class {
         const prResult = await this.prManager.ensurePR(task, summary);
         prUrl = prResult.prUrl;
         prUpdated = prResult.prUpdated;
-      } catch {
+      } catch (err) {
+        console.warn(`[maintenance] PR creation failed for task ${task.id}: ${String(err)}`);
       }
     }
     return {
@@ -6555,7 +6728,8 @@ var TaskRunner = class {
         const prResult = await this.prManager.ensurePR(task, summary);
         prUrl = prResult.prUrl;
         prUpdated = prResult.prUpdated;
-      } catch {
+      } catch (err) {
+        console.warn(`[maintenance] PR creation failed for task ${task.id}: ${String(err)}`);
       }
     }
     return {
@@ -6665,6 +6839,10 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   enrichedSpecsByIssue = /* @__PURE__ */ new Map();
   /** Tracks recently-failed intelligence analysis to avoid re-requesting every tick */
   analysisFailureCache = /* @__PURE__ */ new Map();
+  /** Abort controllers and PIDs for running agent tasks — used by stopIssue to cancel in-flight work.
+   *  The PID is stored here because the running entry may be deleted by the state machine
+   *  before the stop effect executes (e.g., stall_detected removes the entry first). */
+  abortControllers = /* @__PURE__ */ new Map();
   /** Guards against overlapping ticks when a tick takes longer than the polling interval */
   tickInProgress = false;
   /** Timestamp of the last stale branch sweep (at most once per hour) */
@@ -6795,33 +6973,63 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   }
   /**
    * Creates a TaskRunner for the maintenance scheduler.
-   * Provides stub implementations for check/agent/command execution.
-   * Phase 4 (PRManager) and Phase 5 (Reporter) will enhance these.
+   * CheckCommandRunner and CommandExecutor use real child_process execution.
+   * AgentDispatcher remains stubbed (requires full skill dispatch integration).
    */
   createMaintenanceTaskRunner(maintenanceConfig) {
-    this.logger.warn(
-      "Maintenance task runner using stub implementations \u2014 tasks will not execute real checks or dispatch agents. Real implementations will be wired in a follow-up."
-    );
+    const logger = this.logger;
     const checkRunner = {
       run: async (command, cwd) => {
-        this.logger.info("Maintenance check runner invoked (stub)", { command, cwd });
-        return { passed: true, findings: 0, output: "" };
+        const { execFile: execFile6 } = await import("child_process");
+        const { promisify: promisify3 } = await import("util");
+        const execFileAsync = promisify3(execFile6);
+        const [cmd, ...args] = command;
+        if (!cmd) return { passed: true, findings: 0, output: "" };
+        try {
+          const { stdout } = await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+          const findingsMatch = stdout.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
+          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 0;
+          return { passed: findings === 0, findings, output: stdout };
+        } catch (err) {
+          const error = err;
+          const output = [error.stdout, error.stderr].filter(Boolean).join("\n");
+          const findingsMatch = output.match(/(\d+)\s+(?:finding|issue|violation|error)/i);
+          const findings = findingsMatch ? parseInt(findingsMatch[1], 10) : 1;
+          return { passed: false, findings, output };
+        }
       }
     };
     const agentDispatcher = {
       dispatch: async (skill, branch, backendName, cwd) => {
-        this.logger.info("Maintenance agent dispatcher invoked (stub)", {
-          skill,
-          branch,
-          backendName,
-          cwd
-        });
+        logger.info(
+          "Maintenance agent dispatcher invoked (stub \u2014 skill dispatch integration pending)",
+          {
+            skill,
+            branch,
+            backendName,
+            cwd
+          }
+        );
         return { producedCommits: false, fixed: 0 };
       }
     };
     const commandExecutor = {
       exec: async (command, cwd) => {
-        this.logger.info("Maintenance command executor invoked (stub)", { command, cwd });
+        const { execFile: execFile6 } = await import("child_process");
+        const { promisify: promisify3 } = await import("util");
+        const execFileAsync = promisify3(execFile6);
+        const [cmd, ...args] = command;
+        if (!cmd) return;
+        try {
+          await execFileAsync(cmd, args, { cwd, timeout: 12e4 });
+        } catch (err) {
+          logger.warn("Maintenance command execution failed", {
+            command,
+            cwd,
+            error: String(err)
+          });
+          throw err;
+        }
       }
     };
     return new TaskRunner({
@@ -6851,19 +7059,18 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       historyProvider: reporter,
       onTaskDue: async (task) => {
         this.logger.info(`Maintenance task due: ${task.id}`, { taskId: task.id });
-        this.server?.broadcastMaintenance("maintenance:started", {
-          taskId: task.id,
-          startedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
+        const startPayload = { taskId: task.id, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        this.server?.broadcastMaintenance("maintenance:started", startPayload);
+        this.emit("maintenance:started", startPayload);
         const result = await taskRunner.run(task);
         await reporter.record(result);
         if (result.status === "failure") {
-          this.server?.broadcastMaintenance("maintenance:error", {
-            taskId: task.id,
-            error: result.error
-          });
+          const errorPayload = { taskId: task.id, error: result.error };
+          this.server?.broadcastMaintenance("maintenance:error", errorPayload);
+          this.emit("maintenance:error", errorPayload);
         } else {
           this.server?.broadcastMaintenance("maintenance:completed", result);
+          this.emit("maintenance:completed", result);
         }
         this.logger.info(`Maintenance task completed: ${task.id}`, {
           taskId: task.id,
@@ -6916,7 +7123,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const peslModel = intel.models?.pesl ?? this.config.agent.model;
     const store = new import_graph.GraphStore();
     this.graphStore = store;
-    return new import_intelligence2.IntelligencePipeline(provider, store, {
+    return new import_intelligence3.IntelligencePipeline(provider, store, {
       ...peslModel !== void 0 && { peslModel }
     });
   }
@@ -6939,7 +7146,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       const apiKey = this.config.agent.localApiKey ?? "ollama";
       const model = selModel ?? this.config.agent.localModel;
       this.logger.info(`Intelligence pipeline using local backend at ${endpoint}`);
-      return new import_intelligence2.OpenAICompatibleAnalysisProvider({
+      return new import_intelligence3.OpenAICompatibleAnalysisProvider({
         apiKey,
         baseUrl: endpoint,
         ...model !== void 0 && { defaultModel: model },
@@ -6952,7 +7159,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     if (backend === "anthropic" || backend === "claude") {
       const apiKey = this.config.agent.apiKey ?? process.env.ANTHROPIC_API_KEY;
       if (apiKey) {
-        return new import_intelligence2.AnthropicAnalysisProvider({
+        return new import_intelligence3.AnthropicAnalysisProvider({
           apiKey,
           ...selModel !== void 0 && { defaultModel: selModel }
         });
@@ -6961,7 +7168,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     if (backend === "openai") {
       const apiKey = this.config.agent.apiKey ?? process.env.OPENAI_API_KEY;
       if (apiKey) {
-        return new import_intelligence2.OpenAICompatibleAnalysisProvider({
+        return new import_intelligence3.OpenAICompatibleAnalysisProvider({
           apiKey,
           baseUrl: "https://api.openai.com/v1",
           ...selModel !== void 0 && { defaultModel: selModel }
@@ -6970,7 +7177,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     }
     if (backend === "claude" || backend === "anthropic") {
       this.logger.info("Intelligence pipeline using Claude CLI (no API key configured)");
-      return new import_intelligence2.ClaudeCliAnalysisProvider({
+      return new import_intelligence3.ClaudeCliAnalysisProvider({
         command: this.config.agent.command,
         ...selModel !== void 0 && { defaultModel: selModel },
         ...intel?.requestTimeoutMs !== void 0 && { timeoutMs: intel.requestTimeoutMs }
@@ -6987,13 +7194,13 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       if (!apiKey2) {
         throw new Error("Intelligence pipeline: no Anthropic API key found.");
       }
-      return new import_intelligence2.AnthropicAnalysisProvider({
+      return new import_intelligence3.AnthropicAnalysisProvider({
         apiKey: apiKey2,
         ...selModel !== void 0 && { defaultModel: selModel }
       });
     }
     if (provider.kind === "claude-cli") {
-      return new import_intelligence2.ClaudeCliAnalysisProvider({
+      return new import_intelligence3.ClaudeCliAnalysisProvider({
         command: this.config.agent.command,
         ...selModel !== void 0 && { defaultModel: selModel },
         ...this.config.intelligence?.requestTimeoutMs !== void 0 && {
@@ -7004,7 +7211,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     const apiKey = provider.apiKey ?? this.config.agent.apiKey ?? "ollama";
     const baseUrl = provider.baseUrl ?? "http://localhost:11434/v1";
     const intel = this.config.intelligence;
-    return new import_intelligence2.OpenAICompatibleAnalysisProvider({
+    return new import_intelligence3.OpenAICompatibleAnalysisProvider({
       apiKey,
       baseUrl,
       ...selModel !== void 0 && { defaultModel: selModel },
@@ -7051,7 +7258,13 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       (phase, detail, progress) => this.setTickActivity(phase, detail, progress)
     ) : void 0;
     this.setTickActivity("dispatching", "Applying state machine");
-    const { concernSignals, enrichedSpecs, complexityScores, simulationResults } = pipelineResult ?? {};
+    const {
+      concernSignals,
+      enrichedSpecs,
+      complexityScores,
+      simulationResults,
+      personaRecommendations
+    } = pipelineResult ?? {};
     const tickEvent = {
       type: "tick",
       candidates,
@@ -7060,7 +7273,8 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       ...concernSignals !== void 0 && { concernSignals },
       ...enrichedSpecs !== void 0 && { enrichedSpecs },
       ...complexityScores !== void 0 && { complexityScores },
-      ...simulationResults !== void 0 && { simulationResults }
+      ...simulationResults !== void 0 && { simulationResults },
+      ...personaRecommendations !== void 0 && { personaRecommendations }
     };
     let { nextState, effects } = applyEvent(this.state, tickEvent, this.config);
     this.state = nextState;
@@ -7070,7 +7284,8 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         type: "retry_fired",
         issueId,
         candidates,
-        nowMs
+        nowMs,
+        ...concernSignals !== void 0 && { concernSignals }
       };
       const result = applyEvent(this.state, retryEvent, this.config);
       this.state = result.nextState;
@@ -7079,6 +7294,35 @@ var Orchestrator = class extends import_node_events.EventEmitter {
     for (const effect of effects) {
       await this.handleEffect(effect);
     }
+    const stallTimeoutMs = this.config.agent.stallTimeoutMs;
+    if (stallTimeoutMs > 0) {
+      const stalledIds = [];
+      for (const [runId, runEntry] of this.state.running) {
+        const lastTs = runEntry.session?.lastTimestamp;
+        if (!lastTs) continue;
+        const silentMs = nowMs - new Date(lastTs).getTime();
+        if (silentMs >= stallTimeoutMs) {
+          stalledIds.push(runId);
+        }
+      }
+      for (const runId of stalledIds) {
+        const runEntry = this.state.running.get(runId);
+        if (!runEntry) continue;
+        this.logger.warn(
+          `Agent stalled for ${runEntry.identifier}: ${Math.round((nowMs - new Date(runEntry.session?.lastTimestamp ?? 0).getTime()) / 1e3)}s since last event`,
+          { issueId: runId }
+        );
+        const stallEvent = {
+          type: "stall_detected",
+          issueId: runId
+        };
+        const stallResult = applyEvent(this.state, stallEvent, this.config);
+        this.state = stallResult.nextState;
+        for (const eff of stallResult.effects) {
+          await this.handleEffect(eff);
+        }
+      }
+    }
     const openPrNumbers = [];
     for (const [, runEntry] of this.state.running) {
       const externalId = runEntry.issue.externalId;
@@ -7125,9 +7369,6 @@ var Orchestrator = class extends import_node_events.EventEmitter {
    */
   async handleEffect(effect) {
     switch (effect.type) {
-      case "dispatch":
-        await this.dispatchIssue(effect.issue, effect.attempt, effect.backend);
-        break;
       case "stop":
         await this.stopIssue(effect.issueId);
         break;
@@ -7138,6 +7379,11 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         break;
       case "releaseClaim":
         break;
+      case "scheduleRetry":
+        this.logger.info(
+          `Retry scheduled for ${effect.issueId} (attempt ${effect.attempt}, delay ${effect.delayMs}ms)`
+        );
+        break;
       case "cleanWorkspace":
         await this.cleanWorkspaceWithGuard(effect.identifier, effect.issueId);
         break;
@@ -7163,6 +7409,7 @@ var Orchestrator = class extends import_node_events.EventEmitter {
           `Branch "${branch}" not found on remote for ${identifier}, cleaning up worktree`,
           { issueId }
         );
+        await this.runBeforeRemoveHook(identifier);
         await this.workspace.removeWorkspace(identifier);
         return;
       }
@@ -7197,8 +7444,17 @@ var Orchestrator = class extends import_node_events.EventEmitter {
         return;
       }
     }
+    await this.runBeforeRemoveHook(identifier);
     await this.workspace.removeWorkspace(identifier);
   }
+  /** Run the beforeRemove hook for a workspace. Failures are logged but non-fatal. */
+  async runBeforeRemoveHook(identifier) {
+    const wsPath = this.workspace.resolvePath(identifier);
+    const result = await this.hooks.beforeRemove(wsPath);
+    if (!result.ok) {
+      this.logger.warn(`beforeRemove hook failed for ${identifier}: ${result.error.message}`);
+    }
+  }
   /**
    * Delegates to PRDetector.filterCandidatesWithOpenPRs.
    * @see PRDetector#filterCandidatesWithOpenPRs
@@ -7368,7 +7624,11 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       if (!result.ok) {
         this.logger.warn(`Lifecycle comment failed for ${identifier}: ${result.error.message}`);
       }
-    } catch {
+    } catch (err) {
+      this.logger.debug("Lifecycle comment failed (best-effort)", {
+        identifier,
+        error: String(err)
+      });
     }
   }
   /**
@@ -7385,6 +7645,12 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
       const workspacePath = workspaceResult.value;
+      const afterCreateResult = await this.hooks.afterCreate(workspacePath);
+      if (!afterCreateResult.ok) {
+        this.logger.warn(
+          `afterCreate hook failed for ${issue.identifier}: ${afterCreateResult.error.message}`
+        );
+      }
       const hookResult = await this.hooks.beforeRun(workspacePath);
       if (!hookResult.ok) throw hookResult.error;
       const scanResult = await scanWorkspaceConfig(workspacePath);
@@ -7494,21 +7760,54 @@ var Orchestrator = class extends import_node_events.EventEmitter {
   runAgentInBackgroundTask(issue, workspacePath, prompt, attempt, runner) {
     const activeRunner = runner ?? this.runner;
     this.logger.info(`Starting background task for ${issue.identifier}`);
+    const abortController = new AbortController();
+    this.abortControllers.set(issue.id, { controller: abortController, pid: null });
     (async () => {
       try {
         this.logger.info(`Calling runner.runSession for ${issue.identifier}`);
         const sessionGen = activeRunner.runSession(issue, workspacePath, prompt);
         for await (const event of sessionGen) {
+          if (abortController.signal.aborted) {
+            this.logger.info(`Agent session aborted for ${issue.identifier}`);
+            break;
+          }
+          if (event.type === "session_started" && event.content) {
+            const pid = event.content.pid;
+            if (pid) {
+              const tracked = this.abortControllers.get(issue.id);
+              if (tracked) tracked.pid = pid;
+            }
+          }
           await this.processAgentEvent(issue, event);
           if (event.type === "turn_start") {
             await this.awaitRateLimitClearance(issue.identifier);
           }
         }
         this.logger.info(`Session generator finished for ${issue.identifier}`);
-        await this.emitWorkerExit(issue.id, "normal", attempt);
+        const afterRunResult = await this.hooks.afterRun(workspacePath);
+        if (!afterRunResult.ok) {
+          this.logger.warn(
+            `afterRun hook failed for ${issue.identifier}: ${afterRunResult.error.message}`
+          );
+        }
+        if (abortController.signal.aborted) {
+          if (this.state.running.has(issue.id)) {
+            await this.emitWorkerExit(issue.id, "error", attempt, "Stopped by reconciliation");
+          }
+        } else {
+          await this.emitWorkerExit(issue.id, "normal", attempt);
+        }
       } catch (error) {
         this.logger.error(`Agent runner failed for ${issue.identifier}`, { error: String(error) });
+        const afterRunResult = await this.hooks.afterRun(workspacePath);
+        if (!afterRunResult.ok) {
+          this.logger.warn(
+            `afterRun hook failed for ${issue.identifier}: ${afterRunResult.error.message}`
+          );
+        }
         await this.emitWorkerExit(issue.id, "error", attempt, String(error));
+      } finally {
+        this.abortControllers.delete(issue.id);
       }
     })().catch((err) => {
       this.logger.error("Fatal error in background task", { error: String(err) });
@@ -7534,6 +7833,19 @@ var Orchestrator = class extends import_node_events.EventEmitter {
    */
   async stopIssue(issueId) {
     this.logger.info(`Stopping issue: ${issueId}`);
+    const tracked = this.abortControllers.get(issueId);
+    if (tracked) {
+      tracked.controller.abort();
+      this.logger.info(`Abort signal sent for ${issueId}`);
+    }
+    const pid = tracked?.pid ?? this.state.running.get(issueId)?.session?.agentPid;
+    if (pid) {
+      try {
+        process.kill(pid, "SIGTERM");
+        this.logger.info(`Sent SIGTERM to agent PID ${pid} for ${issueId}`);
+      } catch {
+      }
+    }
   }
   /**
    * Dispatch a work item immediately, bypassing the normal tick → roadmap cycle.