@kbediako/codex-orchestrator 0.1.2 → 0.1.4

package/dist/orchestrator/src/cli/run/runPaths.js

@@ -7,6 +7,13 @@ export function resolveRunPaths(env, runId) {
     const heartbeatPath = join(runDir, '.heartbeat');
     const resumeTokenPath = join(runDir, '.resume-token');
     const logPath = join(runDir, 'runner.ndjson');
+    const eventsPath = join(runDir, 'events.jsonl');
+    const controlPath = join(runDir, 'control.json');
+    const controlAuthPath = join(runDir, 'control_auth.json');
+    const controlEndpointPath = join(runDir, 'control_endpoint.json');
+    const confirmationsPath = join(runDir, 'confirmations.json');
+    const questionsPath = join(runDir, 'questions.json');
+    const delegationTokensPath = join(runDir, 'delegation_tokens.json');
     const commandsDir = join(runDir, 'commands');
     const errorsDir = join(runDir, 'errors');
     const compatDir = join(env.runsRoot, env.taskId, 'mcp', safeRunId);
@@ -18,6 +25,13 @@ export function resolveRunPaths(env, runId) {
         heartbeatPath,
         resumeTokenPath,
         logPath,
+        eventsPath,
+        controlPath,
+        controlAuthPath,
+        controlEndpointPath,
+        confirmationsPath,
+        questionsPath,
+        delegationTokensPath,
         commandsDir,
         errorsDir,
         compatDir,

package/dist/orchestrator/src/cli/services/commandRunner.js

@@ -12,7 +12,7 @@ import { EnvUtils } from '../../../../packages/shared/config/index.js';
 import { findPackageRoot } from '../utils/packageInfo.js';
 const MAX_BUFFERED_OUTPUT_BYTES = 64 * 1024;
 const EMIT_COMMAND_STREAM_MIRRORS = EnvUtils.getBoolean('CODEX_ORCHESTRATOR_EMIT_COMMAND_STREAMS', false);
-const MAX_CAPTURED_CHUNK_EVENTS = EnvUtils.getInt('CODEX_ORCHESTRATOR_EXEC_EVENT_MAX_CHUNKS', 0);
+export const MAX_CAPTURED_CHUNK_EVENTS = EnvUtils.getInt('CODEX_ORCHESTRATOR_EXEC_EVENT_MAX_CHUNKS', 500);
 const PACKAGE_ROOT = findPackageRoot();
 export async function runCommandStage(context, hooks = {}) {
     const { env, paths, manifest, stage, index, events, persister, envOverrides } = context;
@@ -129,7 +129,7 @@ export async function runCommandStage(context, hooks = {}) {
             CODEX_ORCHESTRATOR_RUN_DIR: paths.runDir,
             CODEX_ORCHESTRATOR_RUNS_DIR: env.runsRoot,
             CODEX_ORCHESTRATOR_OUT_DIR: env.outRoot,
-            CODEX_ORCHESTRATOR_REPO_ROOT: env.repoRoot,
+            CODEX_ORCHESTRATOR_ROOT: env.repoRoot,
             CODEX_ORCHESTRATOR_PACKAGE_ROOT: PACKAGE_ROOT
         };
         const execEnv = { ...baseEnv, ...stage.env };

package/dist/orchestrator/src/cli/services/controlPlaneService.js

@@ -1,5 +1,7 @@
 import process from 'node:process';
-import { buildRunRequestV2, ControlPlaneDriftReporter, ControlPlaneValidationError, ControlPlaneValidator } from '../../control-plane/index.js';
+import { ControlPlaneDriftReporter } from '../../control-plane/drift-reporter.js';
+import { buildRunRequestV2 } from '../../control-plane/request-builder.js';
+import { ControlPlaneValidationError, ControlPlaneValidator } from '../../control-plane/validator.js';
 import { relativeToRepo } from '../run/runPaths.js';
 import { appendSummary } from '../run/manifest.js';
 import { persistManifest } from '../run/manifestPersister.js';

package/dist/orchestrator/src/cli/services/execRuntime.js

@@ -1,6 +1,5 @@
 import { spawn } from 'node:child_process';
-import { ExecSessionManager, UnifiedExecRunner, ToolOrchestrator } from '../../../../packages/orchestrator/src/index.js';
-import { RemoteExecHandleService } from '../../../../packages/orchestrator/src/exec/handle-service.js';
+import { ExecSessionManager, UnifiedExecRunner, ToolOrchestrator, RemoteExecHandleService } from '../../../../packages/orchestrator/src/index.js';
 import { PrivacyGuard } from '../../privacy/guard.js';
 import { resolveEnforcementMode } from '../utils/enforcementMode.js';
 class CliExecSessionHandle {

package/dist/orchestrator/src/cli/services/pipelineResolver.js

@@ -1,8 +1,12 @@
 import process from 'node:process';
-import { loadUserConfig } from '../config/userConfig.js';
+import { loadPackageConfig, loadUserConfig } from '../config/userConfig.js';
 import { resolvePipeline } from '../pipelines/index.js';
 import { loadDesignConfig, shouldActivateDesignPipeline, designPipelineId } from '../../../../packages/shared/config/index.js';
 import { logger } from '../../logger.js';
+const DEVTOOLS_PIPELINE_ALIASES = new Map([
+    ['implementation-gate-devtools', 'implementation-gate'],
+    ['frontend-testing-devtools', 'frontend-testing']
+]);
 export class PipelineResolver {
     async loadDesignConfig(rootDir) {
         const designConfig = await loadDesignConfig({ rootDir });
@@ -19,9 +23,15 @@ export class PipelineResolver {
         logger.info(`PipelineResolver.resolve loaded design config from ${designConfig.path}`);
         const userConfig = await loadUserConfig(env);
         logger.info(`PipelineResolver.resolve loaded user config`);
-        const requestedPipelineId = options.pipelineId ??
+        const pipelineCandidate = options.pipelineId ??
             (shouldActivateDesignPipeline(designConfig) ? designPipelineId(designConfig) : undefined);
+        const resolvedAlias = this.resolvePipelineAlias(pipelineCandidate);
+        const requestedPipelineId = resolvedAlias.pipelineId;
         const envOverrides = this.resolveDesignEnvOverrides(designConfig, requestedPipelineId);
+        if (resolvedAlias.devtoolsRequested) {
+            envOverrides.CODEX_REVIEW_DEVTOOLS = '1';
+            logger.warn(`[pipeline] ${resolvedAlias.aliasId} is deprecated; use ${requestedPipelineId} with CODEX_REVIEW_DEVTOOLS=1.`);
+        }
         try {
             const { pipeline, source } = resolvePipeline(env, {
                 pipelineId: requestedPipelineId,
@@ -31,6 +41,17 @@ export class PipelineResolver {
             return { pipeline, userConfig, designConfig, source, envOverrides };
         }
         catch (error) {
+            if (requestedPipelineId === 'rlm' && userConfig?.source === 'repo') {
+                const packageConfig = await loadPackageConfig(env);
+                if (packageConfig) {
+                    const { pipeline, source } = resolvePipeline(env, {
+                        pipelineId: requestedPipelineId,
+                        config: packageConfig
+                    });
+                    logger.info(`PipelineResolver.resolve selected package pipeline ${pipeline.id}`);
+                    return { pipeline, userConfig: packageConfig, designConfig, source, envOverrides };
+                }
+            }
             logger.error(`PipelineResolver.resolve failed for ${requestedPipelineId ?? '<default>'}: ${error.message}`);
             throw error;
         }
@@ -44,4 +65,14 @@ export class PipelineResolver {
         }
         return envOverrides;
     }
+    resolvePipelineAlias(pipelineId) {
+        if (!pipelineId) {
+            return { pipelineId, devtoolsRequested: false };
+        }
+        const target = DEVTOOLS_PIPELINE_ALIASES.get(pipelineId);
+        if (!target) {
+            return { pipelineId, devtoolsRequested: false };
+        }
+        return { pipelineId: target, devtoolsRequested: true, aliasId: pipelineId };
+    }
 }

package/dist/orchestrator/src/cli/services/runPreparation.js

@@ -62,11 +62,17 @@ export async function prepareRun(options) {
         planPreview
     };
 }
-export function resolvePipelineForResume(env, manifest, config) {
+export function resolvePipelineForResume(env, manifest, config, fallbackConfig = null) {
     const existing = findPipeline(config ?? null, manifest.pipeline_id);
     if (existing) {
         return existing;
     }
+    if (manifest.pipeline_id === 'rlm' && fallbackConfig) {
+        const fallback = findPipeline(fallbackConfig, manifest.pipeline_id);
+        if (fallback) {
+            return fallback;
+        }
+    }
     const { pipeline } = resolvePipeline(env, { pipelineId: manifest.pipeline_id, config });
     return pipeline;
 }

package/dist/orchestrator/src/cli/services/schedulerService.js

@@ -1,6 +1,6 @@
 import { sanitizeTaskId } from '../run/environment.js';
 import { persistManifest } from '../run/manifestPersister.js';
-import { buildSchedulerRunSummary, createSchedulerPlan, finalizeSchedulerPlan, serializeSchedulerPlan } from '../../scheduler/index.js';
+import { buildSchedulerRunSummary, createSchedulerPlan, finalizeSchedulerPlan, serializeSchedulerPlan } from '../../scheduler/plan.js';
 import { isoTimestamp } from '../utils/time.js';
 export class SchedulerService {
     now;

package/dist/orchestrator/src/cli/utils/devtools.js

@@ -5,6 +5,7 @@ import process from 'node:process';
 import { EnvUtils } from '../../../../packages/shared/config/env.js';
 export const DEVTOOLS_SKILL_NAME = 'chrome-devtools';
 export const DEVTOOLS_CONFIG_OVERRIDE = 'mcp_servers.chrome-devtools.enabled=true';
+const CONFIG_OVERRIDE_ENV_KEYS = ['CODEX_MCP_CONFIG_OVERRIDES', 'CODEX_CONFIG_OVERRIDES'];
 const DEVTOOLS_CONFIG_FILENAME = 'config.toml';
 const DEVTOOLS_MCP_COMMAND = [
     'mcp',
@@ -86,16 +87,18 @@ export function buildDevtoolsSetupPlan(env = process.env) {
     };
 }
 export function resolveCodexCommand(args, env = process.env) {
+    const overrides = parseConfigOverrides(env);
     if (!isDevtoolsEnabled(env)) {
-        return { command: 'codex', args };
+        return { command: 'codex', args: applyConfigOverrides(overrides, args) };
     }
     const readiness = resolveDevtoolsReadiness(env);
     if (readiness.status !== 'ok') {
         throw new Error(formatDevtoolsPreflightError(readiness));
     }
+    const mergedOverrides = dedupeOverrides([DEVTOOLS_CONFIG_OVERRIDE, ...overrides]);
     return {
         command: 'codex',
-        args: ['-c', DEVTOOLS_CONFIG_OVERRIDE, ...args]
+        args: applyConfigOverrides(mergedOverrides, args)
     };
 }
 export function formatDevtoolsPreflightError(readiness) {
@@ -187,6 +190,34 @@ function hasDevtoolsConfigEntry(raw) {
     }
     return false;
 }
+function parseConfigOverrides(env) {
+    const overrides = [];
+    for (const key of CONFIG_OVERRIDE_ENV_KEYS) {
+        const raw = env[key];
+        if (!raw) {
+            continue;
+        }
+        const parts = raw
+            .split(/[,;\n]/)
+            .map((part) => part.trim())
+            .filter((part) => part.length > 0);
+        overrides.push(...parts);
+    }
+    return dedupeOverrides(overrides);
+}
+function applyConfigOverrides(overrides, args) {
+    if (overrides.length === 0) {
+        return args;
+    }
+    const configArgs = [];
+    for (const override of overrides) {
+        configArgs.push('-c', override);
+    }
+    return [...configArgs, ...args];
+}
+function dedupeOverrides(overrides) {
+    return Array.from(new Set(overrides.filter((override) => override.trim().length > 0)));
+}
 function stripTomlComment(line) {
     const index = line.indexOf('#');
     if (index === -1) {

package/dist/orchestrator/src/cli/utils/specGuardRunner.js

@@ -3,7 +3,9 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import process from 'node:process';
 import { logger } from '../../logger.js';
-const specGuardPath = join(process.cwd(), 'scripts', 'spec-guard.mjs');
+import { resolveEnvironmentPaths } from '../../../../scripts/lib/run-manifests.js';
+const { repoRoot } = resolveEnvironmentPaths();
+const specGuardPath = join(repoRoot, 'scripts', 'spec-guard.mjs');
 if (!existsSync(specGuardPath)) {
     logger.warn(`[spec-guard] skipped: ${specGuardPath} not found`);
     process.exit(0);

package/dist/orchestrator/src/cli/utils/strings.js

@@ -1,8 +1,10 @@
+import { slugify as sharedSlugify } from '../../../../packages/shared/utils/strings.js';
 export function slugify(value, fallback = 'command') {
-    const cleaned = value.trim().replace(/[^a-zA-Z0-9]+/g, '-').replace(/-+/g, '-');
-    const normalized = cleaned.replace(/^-|-$/g, '');
-    if (!normalized) {
-        return fallback;
-    }
-    return normalized.slice(0, 80);
+    return sharedSlugify(value, {
+        fallback,
+        maxLength: 80,
+        lowercase: false,
+        pattern: /[^a-zA-Z0-9]+/g,
+        collapseDashes: true
+    });
 }

package/dist/orchestrator/src/persistence/ExperienceStore.js

@@ -1,9 +1,11 @@
 import { randomBytes } from 'node:crypto';
-import { readFile, mkdir, rm, readdir } from 'node:fs/promises';
+import { createReadStream } from 'node:fs';
+import { appendFile, mkdir, open, rm } from 'node:fs/promises';
 import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { listDirectories, resolveEnvironmentPaths } from '../../../scripts/lib/run-manifests.js';
 import { acquireLockWithRetry } from './lockFile.js';
 import { sanitizeTaskId } from './sanitizeTaskId.js';
-import { writeAtomicFile } from './writeAtomicFile.js';
 export class ExperienceStoreLockError extends Error {
     taskId;
     constructor(message, taskId) {
@@ -21,14 +23,16 @@ export class ExperienceStore {
     lockRetry;
     now;
     constructor(options = {}) {
-        this.outDir = options.outDir ?? join(process.cwd(), 'out');
-        this.runsDir = options.runsDir ?? join(process.cwd(), '.runs');
+        const envPaths = resolveEnvironmentPaths();
+        this.outDir = options.outDir ?? envPaths.outRoot;
+        this.runsDir = options.runsDir ?? envPaths.runsRoot;
         this.maxWords = Math.max(1, options.maxSummaryWords ?? DEFAULT_MAX_WORDS);
         const defaults = {
             maxAttempts: 5,
             initialDelayMs: 100,
             backoffFactor: 2,
-            maxDelayMs: 1000
+            maxDelayMs: 1000,
+            staleMs: 5 * 60 * 1000
         };
         const overrides = options.lockRetry ?? {};
         const sanitizedOverrides = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
@@ -50,10 +54,10 @@ export class ExperienceStore {
             const targetDir = join(this.outDir, taskId);
             await mkdir(targetDir, { recursive: true });
             const filePath = join(targetDir, 'experiences.jsonl');
-            const existing = await this.readRecords(filePath);
             const nextRecords = inputs.map((input) => this.prepareRecord(input, manifestPath));
-            const serialized = [...existing, ...nextRecords].map((record) => JSON.stringify(record)).join('\n');
-            await writeAtomicFile(filePath, `${serialized}\n`);
+            await this.ensureTrailingNewline(filePath);
+            const payload = nextRecords.map((record) => JSON.stringify(record)).join('\n');
+            await appendFile(filePath, `${payload}\n`, 'utf8');
             return nextRecords;
         }
         finally {
@@ -70,36 +74,26 @@ export class ExperienceStore {
         if (limit === 0) {
             return [];
         }
-        const allRecords = taskFilter
-            ? await this.readRecords(join(this.outDir, taskFilter, 'experiences.jsonl'))
-            : await this.readAllRecords();
-        const filtered = allRecords.filter((record) => {
+        const collector = createTopKCollector(limit, params.minReward);
+        const applyRecord = (record) => {
             if (record.domain !== safeDomain) {
-                return false;
+                return;
             }
             if (taskFilter && record.taskId !== taskFilter) {
-                return false;
+                return;
             }
-            return true;
-        });
-        const scored = filtered
-            .map((record) => ({
-            record,
-            score: record.reward.gtScore + record.reward.relativeRank
-        }))
-            .filter((entry) => {
-            if (params.minReward === undefined) {
-                return true;
-            }
-            return entry.score >= params.minReward;
-        })
-            .sort((a, b) => {
-            if (b.score === a.score) {
-                return b.record.createdAt.localeCompare(a.record.createdAt);
+            collector.add(record);
+        };
+        if (taskFilter) {
+            await this.scanRecords(join(this.outDir, taskFilter, 'experiences.jsonl'), applyRecord);
+        }
+        else {
+            const directories = await listDirectories(this.outDir);
+            for (const dir of directories) {
+                await this.scanRecords(join(this.outDir, dir, 'experiences.jsonl'), applyRecord);
             }
-            return b.score - a.score;
-        });
-        return scored.slice(0, limit).map((entry) => entry.record);
+        }
+        return collector.finalize();
     }
     verifyStamp(record) {
         return HEX_STAMP_PATTERN.test(record.stampSignature);
@@ -154,46 +148,109 @@ export class ExperienceStore {
     async releaseLock(lockPath) {
         await rm(lockPath, { force: true });
     }
-    async readRecords(filePath) {
+    async scanRecords(filePath, onRecord) {
         try {
-            const raw = await readFile(filePath, 'utf8');
-            return raw
-                .split('\n')
-                .filter(Boolean)
-                .map((line) => JSON.parse(line));
+            const stream = createReadStream(filePath, { encoding: 'utf8' });
+            const reader = createInterface({ input: stream, crlfDelay: Infinity });
+            for await (const line of reader) {
+                const trimmed = line.trim();
+                if (!trimmed) {
+                    continue;
+                }
+                try {
+                    const record = JSON.parse(trimmed);
+                    onRecord(record);
+                }
+                catch {
+                    continue;
+                }
+            }
         }
         catch (error) {
             if (error.code === 'ENOENT') {
-                return [];
+                return;
             }
             throw error;
         }
     }
-    async readAllRecords() {
-        const directories = await listDirectories(this.outDir);
-        const all = [];
-        for (const dir of directories) {
-            const filePath = join(this.outDir, dir, 'experiences.jsonl');
-            all.push(...(await this.readRecords(filePath)));
-        }
-        return all;
+    async ensureTrailingNewline(filePath) {
+        try {
+            const handle = await open(filePath, 'r');
+            let needsNewline = false;
+            try {
+                const { size } = await handle.stat();
+                if (size === 0) {
+                    return;
+                }
+                const buffer = Buffer.alloc(1);
+                await handle.read(buffer, 0, 1, size - 1);
+                needsNewline = buffer[0] !== 0x0a;
+            }
+            finally {
+                await handle.close();
+            }
+            if (needsNewline) {
+                await appendFile(filePath, '\n', 'utf8');
+            }
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return;
+            }
+            throw error;
+        }
     }
     generateId() {
         const suffix = randomBytes(3).toString('hex');
         return `exp-${Date.now().toString(36)}-${suffix}`;
     }
 }
-async function listDirectories(path) {
-    try {
-        const entries = await readdir(path, { withFileTypes: true });
-        return entries.filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            return [];
+function createTopKCollector(limit, minReward) {
+    const entries = [];
+    const threshold = typeof minReward === 'number' ? minReward : null;
+    const compare = (a, b) => {
+        if (a.score !== b.score) {
+            return a.score - b.score;
         }
-        throw error;
-    }
+        const aTime = a.record.createdAt ?? '';
+        const bTime = b.record.createdAt ?? '';
+        return aTime.localeCompare(bTime);
+    };
+    const add = (record) => {
+        const score = record.reward.gtScore + record.reward.relativeRank;
+        if (threshold !== null && score < threshold) {
+            return;
+        }
+        const entry = { record, score };
+        if (entries.length === 0) {
+            entries.push(entry);
+            return;
+        }
+        const worst = entries[0];
+        if (entries.length >= limit && worst && compare(entry, worst) <= 0) {
+            return;
+        }
+        let index = 0;
+        while (index < entries.length && compare(entries[index], entry) <= 0) {
+            index += 1;
+        }
+        entries.splice(index, 0, entry);
+        if (entries.length > limit) {
+            entries.shift();
+        }
+    };
+    const finalize = () => entries
+        .slice()
+        .sort((a, b) => {
+        if (a.score !== b.score) {
+            return b.score - a.score;
+        }
+        const aTime = a.record.createdAt ?? '';
+        const bTime = b.record.createdAt ?? '';
+        return bTime.localeCompare(aTime);
+    })
+        .map((entry) => entry.record);
+    return { add, finalize };
 }
 function truncateSummary(value, maxWords) {
     const tokens = value.trim().split(/\s+/u).filter(Boolean);

package/dist/orchestrator/src/persistence/PersistenceCoordinator.js

@@ -33,10 +33,12 @@ export class PersistenceCoordinator {
     }
     async handleRunCompleted(summary) {
         let stateStoreError = null;
-        try {
-            await this.stateStore.recordRun(summary);
-        }
-        catch (error) {
+        const [stateResult, manifestResult] = await Promise.allSettled([
+            this.stateStore.recordRun(summary),
+            this.manifestWriter.write(summary)
+        ]);
+        if (stateResult.status === 'rejected') {
+            const error = stateResult.reason;
             stateStoreError = error;
             if (error instanceof TaskStateStoreLockError) {
                 logger.warn(`Task state snapshot skipped for task ${summary.taskId} (run ${summary.runId}): ${error.message}`);
@@ -45,10 +47,8 @@ export class PersistenceCoordinator {
                 logger.error(`Task state snapshot failed for task ${summary.taskId} (run ${summary.runId})`, error);
             }
         }
-        try {
-            await this.manifestWriter.write(summary);
-        }
-        catch (error) {
+        if (manifestResult.status === 'rejected') {
+            const error = manifestResult.reason;
             this.options.onError?.(error, summary);
             if (!this.options.onError) {
                 logger.error(`PersistenceCoordinator manifest write error for task ${summary.taskId} (run ${summary.runId})`, error);

package/dist/orchestrator/src/persistence/TaskStateStore.js

@@ -2,7 +2,7 @@ import { mkdir, readFile, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { acquireLockWithRetry } from './lockFile.js';
 import { sanitizeTaskId } from './sanitizeTaskId.js';
-import { writeAtomicFile } from './writeAtomicFile.js';
+import { writeAtomicFile } from '../utils/atomicWrite.js';
 export class TaskStateStoreLockError extends Error {
     taskId;
     constructor(message, taskId) {
@@ -27,7 +27,8 @@ export class TaskStateStore {
             maxAttempts: 5,
             initialDelayMs: 100,
             backoffFactor: 2,
-            maxDelayMs: 1000
+            maxDelayMs: 1000,
+            staleMs: 5 * 60 * 1000
         };
         const overrides = options.lockRetry ?? {};
         const sanitizedOverrides = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));

package/dist/orchestrator/src/persistence/lockFile.js

@@ -1,8 +1,9 @@
-import { open } from 'node:fs/promises';
+import { open, rm, stat } from 'node:fs/promises';
 import { setTimeout as delay } from 'node:timers/promises';
 export async function acquireLockWithRetry(params) {
     await params.ensureDirectory();
     const { maxAttempts, initialDelayMs, backoffFactor, maxDelayMs } = params.retry;
+    const staleMs = params.retry.staleMs ?? 0;
     let attempt = 0;
     let delayMs = initialDelayMs;
     while (attempt < maxAttempts) {
@@ -16,6 +17,13 @@ export async function acquireLockWithRetry(params) {
             if (error.code !== 'EEXIST') {
                 throw error;
             }
+            if (staleMs > 0) {
+                const cleared = await clearStaleLock(params.lockPath, staleMs);
+                if (cleared) {
+                    attempt -= 1;
+                    continue;
+                }
+            }
             if (attempt >= maxAttempts) {
                 throw params.createError(params.taskId, attempt);
             }
@@ -24,3 +32,20 @@ export async function acquireLockWithRetry(params) {
         }
     }
 }
+async function clearStaleLock(lockPath, staleMs) {
+    try {
+        const stats = await stat(lockPath);
+        const ageMs = Date.now() - stats.mtimeMs;
+        if (!Number.isFinite(ageMs) || ageMs <= staleMs) {
+            return false;
+        }
+        await rm(lockPath, { force: true });
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return false;
+        }
+        return false;
+    }
+}

package/dist/orchestrator/src/persistence/sanitizeIdentifier.js

@@ -1,4 +1,4 @@
-import { WINDOWS_FORBIDDEN_CHARACTERS } from './identifierGuards.js';
+const WINDOWS_FORBIDDEN_CHARACTERS = new Set(['<', '>', ':', '"', '|', '?', '*']);
 export function sanitizeIdentifier(kind, value) {
     const label = kind === 'task' ? 'task' : 'run';
     if (!value) {

package/dist/orchestrator/src/sync/CloudSyncWorker.js

@@ -52,7 +52,7 @@ export class CloudSyncWorker {
         }
         catch (error) {
             this.options.onError?.(error, summary, 0);
-            await this.appendAuditLog({
+            await this.safeAppendAuditLog({
                 level: 'error',
                 message: 'Failed to read manifest before sync',
                 summary,
@@ -74,7 +74,7 @@ export class CloudSyncWorker {
                     idempotencyKey
                 });
                 this.options.onSuccess?.(result, summary);
-                await this.appendAuditLog({
+                await this.safeAppendAuditLog({
                     level: 'info',
                     message: 'Cloud sync completed',
                     summary,
@@ -84,7 +84,7 @@ export class CloudSyncWorker {
             }
             catch (error) {
                 this.options.onError?.(error, summary, attempt);
-                await this.appendAuditLog({
+                await this.safeAppendAuditLog({
                     level: 'error',
                     message: 'Cloud sync attempt failed',
                     summary,
@@ -120,6 +120,19 @@ export class CloudSyncWorker {
         });
         await appendFile(logPath, `${line}\n`, 'utf-8');
     }
+    async safeAppendAuditLog(entry) {
+        try {
+            await this.appendAuditLog(entry);
+        }
+        catch (error) {
+            try {
+                this.options.onError?.(error, entry.summary, 0);
+            }
+            catch {
+                // swallow audit log failures
+            }
+        }
+    }
     shouldRetry(error) {
         if (this.options.retryDecider) {
             return this.options.retryDecider(error);
@@ -160,7 +173,7 @@ export class CloudSyncWorker {
             if (repaired) {
                 try {
                     const parsed = JSON.parse(repaired);
-                    await this.appendAuditLog({
+                    await this.safeAppendAuditLog({
                         level: 'info',
                         message: 'Recovered manifest from partial JSON',
                         summary,