@kylecheng3146/agent-ops 0.3.5 → 0.3.7

package/dist/runtime/src/hooks/completion-gate.js

@@ -6,7 +6,7 @@ import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../secur
 import { checkTaskCompletionEvidence, findIncompleteSubtask } from "../task/completion.js";
 import { collectBaseChangePaths, collectChangeSurface } from "../verify/change-surface.js";
 import { calculateSourceFingerprint } from "../verify/source-fingerprint.js";
-import { readWorktreeRecord } from "../parallel/service.js";
+import { NOTES_REF, noteSessionLine, readWorktreeRecord } from "../parallel/service.js";
 const FINGERPRINT = /^[a-f0-9]{64}$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;
 function gateDirectory(root) {
@@ -248,12 +248,32 @@ export class CompletionGateService {
             event.event === "command-batch" ? event.commands : [];
         return commands.some(({ command, args }) => [command, ...args].includes("allow-stop"));
     }
+    /**
+     * Whether `worktree finish` merged this session's reviewed work: a note
+     * naming the session on a commit HEAD contains, and nothing uncommitted on
+     * top. finish moves the task into that note, so the checkout has none left.
+     */
+    async #finishedByWorktree(sessionId) {
+        const runner = this.#options.gitRunner;
+        if ((await collectChangeSurface(runner)).paths.length > 0)
+            return false;
+        // ponytail: newest 500 commits only; older merges need a one-time allow-stop
+        const log = await runner.run(["log", `--notes=${NOTES_REF}`, "--format=%N%x00", "-n", "500", "HEAD"]);
+        if (log.exitCode !== 0)
+            return false;
+        const line = noteSessionLine(sessionId);
+        return new TextDecoder().decode(log.stdout).split("\0").some((note) => note.split("\n").includes(line));
+    }
     async #validateTask(sessionId) {
         let stored;
         try {
             stored = await this.#options.taskService.status({ sessionId });
         }
         catch (error) {
+            if (error instanceof AgentOpsError && error.code === "TASK_SESSION_UNATTACHED" &&
+                await this.#finishedByWorktree(sessionId)) {
+                return null;
+            }
             return error instanceof AgentOpsError && error.code === "TASK_SESSION_UNATTACHED"
                 ? gateResult("block", "FAIL", "COMPLETION_GATE_TASK_REQUIRED", `Attach this conversation to a formal task: agent-ops task create --title <title> --criterion <json> --criterion <json> (two to five criteria), then agent-ops task attach --task <task-id> --session ${shellQuote(sessionId)}.`)
                 : gateResult("block", "UNKNOWN", "COMPLETION_GATE_TASK_UNAVAILABLE", "Repair task state with agent-ops doctor before stopping.");

package/dist/runtime/src/install/doctor.js

@@ -475,6 +475,10 @@ async function checkReviewTargets(config, probe, checkAuth, selectedTargets = []
             failures.push(check("review-targets", "FAIL", `${target} did not answer in time.`, undefined, "Re-run: agent-ops doctor --check-auth"));
             continue;
         }
+        if (result === "network-unreachable") {
+            failures.push(check("review-targets", "FAIL", `${target} could not reach the network, so its login state is unknown.`, undefined, "Run agent-ops outside the sandbox, or grant it escalated execution, then re-run: agent-ops doctor --check-auth"));
+            continue;
+        }
         if (result === "capability-unavailable") {
             failures.push(check("review-targets", "FAIL", `${target} could not complete its read-only capability probe.`, undefined, "Run agent-ops review on a host with network and loopback permission, then retry."));
             continue;

package/dist/runtime/src/parallel/finish.js

@@ -5,8 +5,7 @@ import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
 import { currentGateFingerprint } from "../hooks/completion-gate.js";
 import { collectChangeSurface } from "../verify/change-surface.js";
 import { aggregateVerificationStatus, executeConfiguredCommand } from "../verify/command-executor.js";
-import { assertWorktreeName, parseWorktreeListPorcelain, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
-export const NOTES_REF = "agent-ops";
+import { assertWorktreeName, NOTES_REF, noteSessionLine, parseWorktreeListPorcelain, readWorktreeRecord, removeCheckout, resolveCheckouts, worktreePath } from "./service.js";
 const LOCK_NAME = "agent-ops-finish.lock";
 const LOCK_POLL_MS = 2_000;
 const LOCK_WAIT_MS = 30 * 60 * 1000;
@@ -180,6 +179,7 @@ function taskTree(tasks) {
 function noteText(record, tasks) {
     return [
         `worktree: ${record.name} (${record.branch})`,
+        noteSessionLine(record.sessionId),
         ...tasks.flatMap(({ task, depth }) => {
             const indent = "  ".repeat(depth);
             return [
@@ -314,8 +314,11 @@ export async function finishWorktree(deps, options) {
         if (gateEnabled) {
             await attempt("gate", async () => {
                 const mainGate = await deps.gate(mainRoot, mainConfig);
-                await mainGate.redirect(record.sessionId, null);
-                await mainGate.rebase(before, await currentGateFingerprint(mainRoot, mainRunner));
+                const after = await currentGateFingerprint(mainRoot, mainRunner);
+                await mainGate.rebase(before, after);
+                // rebase only moves baselines equal to `before`; a main that moved since
+                // this session began would leave it reading the merge as its own change.
+                await mainGate.seed(record.sessionId, after);
             });
         }
         await attempt("trust", async () => await deps.trust.revoke(record.path, worktreeConfig));

package/dist/runtime/src/parallel/service.js

@@ -15,6 +15,10 @@ import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../secur
 export const WORKTREE_DIRECTORY = ".worktrees";
 export const WORKTREE_BRANCH_PREFIX = "agent-ops/";
 export const WORKTREE_RECORD_PATH = ".agent-ops/tasks/worktree.json";
+/** The notes ref `worktree finish` records a merge in. */
+export const NOTES_REF = "agent-ops";
+/** The note line binding a merge to the session that finished it. */
+export const noteSessionLine = (sessionId) => `session: ${sessionId}`;
 const EXCLUDE_LINE = `/${WORKTREE_DIRECTORY}/`;
 const NAME = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/u;
 const SESSION = /^[^\0\r\n]{1,256}$/u;

package/dist/runtime/src/review/execute.js

@@ -8,7 +8,7 @@ import { answeredNothing, conversationIdOf, deniedToolsOf, extractFinalMessage,
 import { buildTargetInvocation } from "./invocation.js";
 import { reviewReportResults, reviewReportStatus, validateReviewReport } from "./report.js";
 import { detectHostTarget, planReviewTargets } from "./roles.js";
-import { detectHostRestriction } from "./host-sandbox.js";
+import { detectHostRestriction, isNetworkFailure } from "./host-sandbox.js";
 import { buildAdversarialPrompt, buildReviewPrompt } from "./runner.js";
 import { MAX_ADVERSARIAL_PROMPT_BYTES } from "./runner.js";
 import { extractUsage, sumUsage } from "./usage.js";
@@ -143,6 +143,8 @@ function preflightUnavailableReason(result) {
             return "timeout";
         case "unauthenticated":
             return "login-required";
+        case "network-unreachable":
+            return "network-unreachable";
         case "ineligible":
             return "capability-unavailable";
         case "capability-unavailable":
@@ -171,6 +173,9 @@ function rejectedCallReason(output) {
     if (/\b(?:quota|rate limit|usage limit|too many requests)\b/iu.test(output)) {
         return "quota-exhausted";
     }
+    if (isNetworkFailure(output)) {
+        return "network-unreachable";
+    }
     if (/\b(?:not logged in|login required|log in to|authentication required|unauthenticated|unauthorized)\b/iu.test(output) ||
         /\b(?:invalid|expired)\s+(?:api key|token|credential)/iu.test(output) ||
         /\b401\b/u.test(output)) {

package/dist/runtime/src/review/host-sandbox.js

@@ -1,7 +1,42 @@
-import { createServer } from "node:net";
+import { connect, createServer } from "node:net";
 /** Targets that need a loopback listener of their own to answer at all. */
 export const BIND_DEPENDENT_TARGETS = ["agy"];
 const BIND_PROBE_TIMEOUT_MS = 2_000;
+/**
+ * A reviewer that cannot reach its API host says so in its own words. Reading
+ * that as "not logged in" sent users to re-login an authenticated CLI when the
+ * host sandbox was what withheld the network.
+ */
+const NETWORK_FAILURE = /\b(?:ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH)\b|getaddrinfo|fetch failed|network is unreachable|could not resolve host|no such host|dial tcp/iu;
+export function isNetworkFailure(output) {
+    return NETWORK_FAILURE.test(output);
+}
+/** The host each reviewer talks to, so a reachability check tests its real path. */
+export const TARGET_API_HOST = {
+    agy: "cloudcode-pa.googleapis.com",
+    codex: "api.openai.com",
+    claude: "api.anthropic.com"
+};
+export const REACH_TIMEOUT_MS = 2_000;
+/**
+ * DNS plus a TCP connect to `host:443`, nothing sent. Diagnostic only: it
+ * refines a failed probe's reason and never gates a review, so a proxy-only
+ * network that fails it still gets the review attempted.
+ */
+export async function probeHostReachable(host, port = 443) {
+    return await new Promise((resolve) => {
+        const socket = connect({ host, port });
+        const finish = (value) => {
+            clearTimeout(timer);
+            socket.destroy();
+            resolve(value);
+        };
+        const timer = setTimeout(() => finish(false), REACH_TIMEOUT_MS);
+        timer.unref();
+        socket.once("connect", () => finish(true));
+        socket.once("error", () => finish(false));
+    });
+}
 /**
  * Opens and immediately closes a loopback listener on an ephemeral port.
  * Cheap enough to run before every review, and it exercises exactly the

package/dist/runtime/src/review/probe.js

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { extractFinalMessage } from "./extract.js";
 import { isolatedReviewEnvironment } from "./execute.js";
+import { isNetworkFailure, probeHostReachable, TARGET_API_HOST } from "./host-sandbox.js";
 import { buildProbeInvocation } from "./invocation.js";
 const PROBE_PROMPT = "Reply with the single word OK and nothing else.";
 /**
@@ -99,10 +100,18 @@ export async function probeReviewTarget(target, options) {
         if (!deep) {
             return spawned.status === "PASS" ? "ok" : "unauthenticated";
         }
-        return spawned.status === "PASS" &&
-            extractFinalMessage(target, spawned.stdout) !== undefined
-            ? "ok"
-            : "unauthenticated";
+        if (spawned.status === "PASS" &&
+            extractFinalMessage(target, spawned.stdout) !== undefined) {
+            return "ok";
+        }
+        // An unreachable API host outranks whatever the CLI printed: a sandbox that
+        // withholds the network makes an authenticated CLI say "not logged in".
+        if (isNetworkFailure(`${spawned.stderr}\n${spawned.stdout}`)) {
+            return "network-unreachable";
+        }
+        return (await (options.reachable ?? probeHostReachable)(TARGET_API_HOST[target]))
+            ? "unauthenticated"
+            : "network-unreachable";
     }
     finally {
         if (deep) {

package/dist/runtime/src/review/render.js

@@ -83,6 +83,11 @@ export function renderReviewResult(result) {
             result.attempts?.some((attempt) => attempt.reason === "login-required")) {
             lines.push("Run: agent-ops doctor --check-auth to verify target authentication.");
         }
+        if (result.reason === "network-unreachable" ||
+            result.attempts?.some((attempt) => attempt.reason === "network-unreachable")) {
+            lines.push("The reviewer could not reach the network. This is not a login " +
+                "problem: run agent-ops outside the sandbox, or grant it escalated execution.");
+        }
         // Evidence is pinned to the source it was produced from, so any edit to a
         // changed file after the verifier ran — a doc rewritten by a later step
         // counts — voids it. Without the next command the caller reads

package/docs/en/guides/configuration.md

@@ -130,10 +130,17 @@ never rewritten.
 targets are permitted, `--yes` decides whether to spend money now.
 
 Reviewer failures are classified conservatively from their output: recognizable
-authentication messages become `login-required`, quota messages become
-`quota-exhausted`, and other non-zero exits become `capability-unavailable`.
-The review suggests `doctor --check-auth` only when an authentication failure
-was detected. Confirm target authentication with:
+network errors (`ENOTFOUND`, `fetch failed`, `getaddrinfo` and similar) become
+`network-unreachable`, authentication messages become `login-required`, quota
+messages become `quota-exhausted`, and other non-zero exits become
+`capability-unavailable`. A sandbox that withholds the network therefore is not
+reported as a logged-out CLI: `network-unreachable` tells you to run outside the
+sandbox instead of running `<target> login`. When a `--check-auth` probe or the
+review preflight finds a target unauthenticated, a 2-second TCP connection to
+that target's API host on port 443 (`cloudcode-pa.googleapis.com` for agy,
+`api.openai.com` for codex, `api.anthropic.com` for claude) decides between the
+two; it only refines the reported reason and never blocks a review. The review suggests
+`doctor --check-auth` only when an authentication failure was detected. Confirm target authentication with:
 
 ```bash
 agent-ops doctor              # presence only: no tokens, no network
@@ -213,7 +220,13 @@ evidence. Give each editing conversation its own worktree instead:
   another worktree is refused, naming that path. If the target moved, it rebases; a clean rebase whose own patch
   is unchanged is re-verified before merging, and a conflict is reported with
   the `refs/notes/agent-ops` intent of the work that landed first. The note
-  records every task of the worktree, subtasks indented under their parent.
+  records every task of the worktree, subtasks indented under their parent,
+  and a `session: <id>` line naming the session that finished it. Finish
+  also resets that session's gate baseline to the merged source, so the
+  session can stop although the task now lives only in the note. As a
+  fallback, the gate lets an unattached session stop when the checkout is
+  clean and a note with its `session:` line sits within the newest 500
+  commits of `HEAD`; older merges need a one-time `allow-stop`.
 - `worktree list`, `resume <name> --session <id>` and `remove <name>` manage
   what is left; `remove --force` discards work and asks the user first.
   `doctor` reports worktrees idle for more than seven days.

package/docs/zh-TW/guides/configuration.md

@@ -111,8 +111,15 @@ task ID 必須明確指定，且永遠使用該 task 的原始 criteria；不能
 每次執行 review 仍需 `--yes`：init 的勾選決定「允許哪些目標」，
 `--yes` 決定「現在是否要花錢」。
 
-Reviewer 失敗會依輸出採保守分類：可辨識的認證訊息為 `login-required`，
+Reviewer 失敗會依輸出採保守分類：網路錯誤（`ENOTFOUND`、`fetch failed`、
+`getaddrinfo` 等）為 `network-unreachable`，可辨識的認證訊息為 `login-required`，
 quota 訊息為 `quota-exhausted`，其他非零退出則為 `capability-unavailable`。
+因此沙盒擋住網路時不會被誤報成 CLI 未登入：`network-unreachable` 會提示改在
+沙盒外執行，而不是執行 `<target> login`。當 `--check-auth` 探測或 review
+preflight 判定目標未認證時，會再對該目標的 API 主機（agy 為
+`cloudcode-pa.googleapis.com`、codex 為 `api.openai.com`、claude 為
+`api.anthropic.com`）的 443 埠做 2 秒 TCP 連線測試，據此在兩種原因間擇一；
+它只修正回報的原因，不會阻擋 review。
 只有偵測到認證失敗時，review 才會建議執行 `doctor --check-auth`。
 可用以下指令確認目標的認證狀態：
 
@@ -183,7 +190,12 @@ fingerprint，因此兩個對話修改同一個 checkout 會互相作廢對方
   target 的 ref，checkout、檔案與未 commit 的變更都不會被動到。Target 若被其他
   worktree checkout 則拒絕，並指出該路徑。Target 若已前進會先 rebase；沒有衝突且自身 patch 不變的 rebase 會先
   重新驗證再合併；衝突則連同先合併那份工作在 `refs/notes/agent-ops` 的意圖一起
-  回報。Note 會記錄 worktree 的每個 task，subtask 縮排在其 parent 之下。
+  回報。Note 會記錄 worktree 的每個 task，subtask 縮排在其 parent 之下，並附上
+  一行 `session: <id>`，標明完成這次 finish 的 session。Finish 也會把該 session
+  的 gate baseline 重設為合併後的原始碼，所以即使 task 現在只存在於 note 裡，
+  session 仍可停止。作為後備，gate 在 checkout 乾淨、且 `HEAD` 最近 500 個 commit
+  內有帶該 `session:` 行的 note 時，會讓未附著 task 的 session 停止；更舊的合併需要
+  一次性的 `allow-stop`。
 - `worktree list`、`resume <name> --session <id>` 與 `remove <name>` 管理剩下的
   worktree；`remove --force` 會丟棄工作，執行前會先詢問使用者。`doctor` 會回報
   閒置超過七天的 worktree。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Evidence-driven development loops for agy, Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",