@monoes/monomindcli 2.11.8 → 2.11.10

package/dist/src/orgrt/daemon.js

@@ -14,12 +14,14 @@ import { OrgBus } from './bus.js';
 import { captureCheckpoint, generateChecksum, isCheckpointExpired, migrateCheckpoint, restoreMailboxQueue, validateCheckpoint, } from './checkpoint.js';
 import * as checkpointOps from './checkpoint-ops.js';
 import { CodexAgentRunner } from './codex-runner.js';
+import { checkCompletion } from './completion-gate.js';
 import { CopilotAgentRunner } from './copilot-runner.js';
 import * as crossOrg from './cross-org.js';
 import { CrushAgentRunner } from './crush-runner.js';
 import * as decisionOps from './decisions.js';
 import { agentRoles, hasActiveEndpointWait, isEndpointRole, retryQueuedEndpoints, startEndpointRetryLoop, stopEndpointRetries, } from './endpoint-roles.js';
 import { createFenceForRole, loadGlobalFenceConfig, mergeFenceConfigs, } from './fence.js';
+import { fileToolRoots } from './file-roots.js';
 import { attachForwarder } from './forwarder.js';
 import { GrokAgentRunner } from './grok-runner.js';
 import { HermesAgentRunner } from './hermes-runner.js';
@@ -205,6 +207,45 @@ export function activeRoleCount(org) {
             n++;
     return n;
 }
+/** #302: the `org_complete` consent gate's emit-and-return logic, extracted
+ *  (matching `resolvedIdleNudgeCount`'s and `runOutcomeResult`'s precedent)
+ *  so it is unit-testable without a live daemon, a running org, or the SDK's
+ *  own tool-calling loop — none of which a test can drive directly, since
+ *  `queryFn` replaces the whole SDK `query()`, tool orchestration included.
+ *  `onComplete` gathers the facts (needs `this`/`running`) and calls this;
+ *  this does the one decision (`checkCompletion`) and its two possible
+ *  side effects. Returns the refusal string, or `null` to allow — exactly
+ *  what the org_complete tool handler (session.ts) relays as the result. */
+export function resolveOrgComplete(bus, role, outcome, summary, blocker, blockerDetail, runFacts) {
+    const refusal = checkCompletion({ outcome, blocker, blockerDetail, ...runFacts });
+    if (refusal) {
+        // Visible in `org logs` — a silent refusal reads to an operator as a
+        // hung boss, not a boss that was told no.
+        bus.emit({
+            type: 'audit',
+            from: role,
+            reason: 'org-complete-refused',
+            msg: refusal,
+            data: { outcome, blocker, blockerDetail },
+        });
+        return refusal;
+    }
+    // #302 AC6: the blocker must show up in RENDERED output, not just `data`
+    // — `org logs`'s formatter prints an event's `msg` verbatim and never
+    // looks at `data`, so a blocker recorded only there would satisfy a unit
+    // assertion and never reach a human reading the actual log.
+    const blockerSuffix = blocker
+        ? ` (blocker: ${blocker}${blockerDetail ? ` — ${blockerDetail}` : ''})`
+        : '';
+    bus.emit({
+        type: 'status',
+        from: role,
+        reason: 'org-complete',
+        msg: `run outcome: ${outcome}${blockerSuffix}`,
+        data: { outcome, summary, blocker, blockerDetail },
+    });
+    return null;
+}
 export class OrgDaemon {
     root;
     opts;
@@ -448,7 +489,9 @@ export class OrgDaemon {
             // Only this call can have registered the name (the reservation above
             // holds until `finally`), so anything in the map is ours to tear down.
             if (this.orgs.has(name)) {
-                await this.stopOrg(name).catch((stopErr) => console.error(`org ${name}: teardown after failed start failed:`, stopErr instanceof Error ? stopErr.message : stopErr));
+                // #302: tag the real cause so a run's history/report can never read
+                // this as a boss-attributed outcome — nothing here asked the boss.
+                await this.stopOrg(name, { closedBy: 'failed-start' }).catch((stopErr) => console.error(`org ${name}: teardown after failed start failed:`, stopErr instanceof Error ? stopErr.message : stopErr));
             }
             throw err;
         }
@@ -460,6 +503,27 @@ export class OrgDaemon {
      *  reservation guard above runs synchronously, before any `await` in here —
      *  see the bug 2 comment in startOrg(). */
     async startOrgInner(name, taskOverride, options) {
+        // #301: the PRIMARY fix — the stop-side backstops below (finishStop,
+        // process 'exit') can only run for a run that ends through code we
+        // control; a SIGKILL leaves .git/worktrees/<name> metadata behind with
+        // nothing left to clean it up, and so did every run that leaked before
+        // this fix existed. Pruning here turns "did the last run clean up,
+        // however it died?" into "a run always begins clean" — the only thing
+        // that recovers both the SIGKILL case and worktrees already orphaned
+        // before this daemon process started. Unconditional and best-effort for
+        // the same reasons as the stop-side prune (see finishStop): it only
+        // drops metadata whose worktree directory is already gone, so it cannot
+        // touch a live worktree, including the owner's.
+        try {
+            execFileSync('git', ['worktree', 'prune'], {
+                cwd: this.root,
+                stdio: 'ignore',
+                timeout: 30_000,
+            });
+        }
+        catch {
+            /* best-effort: not a git repo, git missing, or a wedged hook */
+        }
         const defPath = join(this.root, ORG_DIR, `${name}.json`);
         const def = OrgDefSchema.parse(JSON.parse(readFileSync(defPath, 'utf8')));
         let run;
@@ -885,6 +949,26 @@ export class OrgDaemon {
             catch {
                 /* best-effort */
             }
+            // #301: `process.on('exit')` is the SECOND termination path — it fires
+            // for a normal stop too (finishStop's own prune above already covers
+            // that case, so this is a harmless idempotent repeat there) but also
+            // for every path that reaches it via an explicit `process.exit()`
+            // (org.ts's SIGTERM/SIGINT/SIGHUP handlers, uncaughtException,
+            // unhandledRejection) — none of which run finishStop's cleanup at all.
+            // execFileSync is already a static top-level import (see the comment
+            // above), so this stays synchronous-safe like the rest of this
+            // handler. SIGKILL cannot reach here — no in-process code runs for
+            // it — which is why prune-at-start exists as the complement.
+            try {
+                execFileSync('git', ['worktree', 'prune'], {
+                    cwd: this.root,
+                    stdio: 'ignore',
+                    timeout: 30_000,
+                });
+            }
+            catch {
+                /* best-effort: not a git repo, git missing, or a wedged hook */
+            }
         };
         process.on('exit', crashCleanup);
         running._crashCleanup = crashCleanup;
@@ -967,7 +1051,11 @@ export class OrgDaemon {
             const idleStop = (msg) => {
                 stopping = true;
                 bus.emit({ type: 'audit', reason: 'idle-stop', msg });
-                this.stopOrg(name).catch((err) => console.error(`org ${name}: idle-stop failed:`, err instanceof Error ? err.message : err));
+                // #302: closedBy: 'idle-stop' — the truth gate at finishStop's
+                // history write reads this to record what actually happened
+                // (including any runnable work left in org_tasks) instead of
+                // letting a null outcome default to a plain "completed".
+                this.stopOrg(name, { closedBy: 'idle-stop' }).catch((err) => console.error(`org ${name}: idle-stop failed:`, err instanceof Error ? err.message : err));
             };
             // #296: publish the projected stop time for `org status --json`. Only
             // written when it changes; a failed write must not throw out of the
@@ -1258,7 +1346,12 @@ export class OrgDaemon {
             maxTokens: role.budget_tokens ?? perRoleBudget,
             maxUsd: role.budget_usd,
             ...(role.policy ?? {}),
-        }, bus, roleCwd);
+        }, bus, roleCwd, 
+        // #303: the file tools (Read/Write/Edit/Glob/Grep) get the same extra
+        // roots the Bash sandbox already treats as writable (role-sandbox.ts) —
+        // $TMPDIR, the org root, and any policy.sandbox.allowWrite entries.
+        // $HOME is deliberately excluded; see file-roots.ts.
+        fileToolRoots({ cwd: roleCwd, orgRoot: this.root }, role.policy?.sandbox));
         policy.setToolContext({
             providerPrefixes: () => roleProviderPrefixes(role),
             trace: () => this.roleTrace(name, role.id),
@@ -1350,14 +1443,35 @@ export class OrgDaemon {
             // true by actually denying tool use while this role has a pending gate,
             // the same way pending approvals already do.
             hasPendingGate: () => this.listGates(name, 'pending').some((g) => g.roleId === role.id),
+            // #302: refuse an unsatisfiable org_complete BEFORE the 'org-complete'
+            // status event ever exists — the bus subscriber at the top of this
+            // function auto-stops the run on that event alone, so a refusal that
+            // still emitted it would be undone by the very next tick regardless of
+            // what this function returns to the tool handler.
             onComplete: role.id === running.bossRoleId
-                ? (r, outcome, summary) => {
-                    bus.emit({
-                        type: 'status',
-                        from: r,
-                        reason: 'org-complete',
-                        msg: `run outcome: ${outcome}`,
-                        data: { outcome, summary },
+                ? (r, outcome, summary, blocker, blockerDetail) => {
+                    let maxBudgetFraction = 0;
+                    for (const rt of running.agents.values()) {
+                        const p = rt.policy;
+                        if (p.policy.maxTokens)
+                            maxBudgetFraction = Math.max(maxBudgetFraction, p.usage / p.policy.maxTokens);
+                        if (p.policy.maxUsd)
+                            maxBudgetFraction = Math.max(maxBudgetFraction, p.usageUsd / p.policy.maxUsd);
+                    }
+                    // Same predicates the idle watchdog uses for its own
+                    // legitimate-wait check (:1316-1328) — a pending gate or an
+                    // unanswered question is the same "genuinely waiting on a
+                    // human" fact either way.
+                    const pendingHumanWaits = this.listGates(name, 'pending').length +
+                        questionOps
+                            .readQuestions(this.root, name)
+                            .questions.filter((q) => q.answer === null).length;
+                    return resolveOrgComplete(bus, r, outcome, summary, blocker, blockerDetail, {
+                        mode: def.run_config.completion ?? 'boss',
+                        maxBudgetFraction,
+                        pendingHumanWaits,
+                        hasActiveBlock: running.taskDag?.hasActiveBlock(Date.now()) ?? false,
+                        hasPendingWork: running.taskDag?.hasPendingWork() ?? false,
                     });
                 }
                 : undefined,
@@ -1543,11 +1657,19 @@ export class OrgDaemon {
                             }
                             if (abortedByStop) {
                                 runtime.status = 'ended';
+                                // #304: `message` here is always an abort string (see abortedByStop
+                                // above) — either "Operation aborted" or the SDK's "Claude Code
+                                // process aborted by user". Echoing it made a planned stop read as
+                                // a human interruption, and made roles of the same run read
+                                // differently. Report WHY the org stopped instead; the raw string
+                                // stays in `data` for debugging.
+                                const why = running.closedBy === 'org-complete' ? 'org_complete' : 'stop requested';
                                 bus.emit({
                                     type: 'status',
                                     from: role.id,
-                                    msg: `agent "${role.id}" stopped with the org (${message})`,
+                                    msg: `agent "${role.id}" stopped with the org (${why})`,
                                     reason: 'agent-stopped',
+                                    data: { agentId: role.id, error: message },
                                 });
                                 return;
                             }
@@ -2000,6 +2122,10 @@ export class OrgDaemon {
             return; // already stopped
         org.pendingRoles?.clear(); // prevent lazy spawns after stop
         this.spawning.delete(name); // clean up spawning tracking for this org
+        // #304: set before the delete below, since that delete is what makes
+        // abortedByStop (role loop) true — the role loop reads it off this same
+        // object reference, not a fresh lookup (the org is gone from the map by then).
+        org.closedBy = opts?.closedBy;
         // Remove immediately (not at the end) so a concurrent stopOrg(name) call —
         // e.g. stopAll() racing a scheduler-triggered stop on SIGINT — joins this
         // shutdown via `stopping` instead of re-running the whole sequence and
@@ -2127,7 +2253,26 @@ export class OrgDaemon {
                 /* best-effort */
             }
         }
-        org.bus.emit({ type: 'status', msg: 'org stopped' });
+        // #302 truth gate: every stop path funnels through here, so this is the
+        // one place that can record how the run ACTUALLY ended, regardless of
+        // which of the five paths triggered it. `closedBy` is undefined only for
+        // a bare manual `stopOrg(name)` (CLI `org stop`, shutdown) — every
+        // automated path above now tags its own real cause. reporting.ts reads
+        // this event (reason: 'org-stopped') to decide whether the run's outcome
+        // may be rendered as a boss-attributed 'partial'/'achieved' at all: only
+        // closedBy === 'org-complete' may be.
+        const runnableTasks = org.taskDag?.pendingTaskCount() ?? 0;
+        // Rendered, not just recorded (#302 AC6, same reasoning as the
+        // blockerSuffix above): `org logs` prints `msg` verbatim.
+        const stopSuffix = closedBy && closedBy !== 'org-complete'
+            ? ` (${closedBy}${runnableTasks > 0 ? `, ${runnableTasks} task(s) left` : ''})`
+            : '';
+        org.bus.emit({
+            type: 'status',
+            reason: 'org-stopped',
+            msg: `org stopped${stopSuffix}`,
+            data: { closedBy, runnableTasks },
+        });
         await org.bus.flush();
         // Append this run's summary to <org>/history.jsonl — read back from the
         // flushed bus.jsonl (the full durable record) rather than the bounded
@@ -2230,6 +2375,43 @@ export class OrgDaemon {
                     }
                 }
             }
+            // #301: roles create their own linked worktrees with Bash (paths the
+            // daemon never recorded — org.worktreePath/agent.worktreePath above are
+            // only ever set for workspace: 'worktree'/'worktree-per-role', empty
+            // for the common workspace: 'repo' shape), and deleting the working
+            // directory from inside a role sandbox leaves .git/worktrees/<name>
+            // behind — `git worktree list` then hides it, and it never gets
+            // cleaned up. Unconditional on purpose: gating this on
+            // org/agent.worktreePath would skip exactly the runs that hit the bug.
+            // prune only drops metadata whose worktree directory is already gone,
+            // so a live worktree — including the owner's — is never touched; it is
+            // idempotent; and the two removals just above already run `git
+            // worktree remove --force` against this same repo from this same cwd,
+            // so this is strictly less invasive than what already ships. Run after
+            // both removal loops so a worktree just removed is also pruned.
+            //
+            // Bounded race, measured rather than assumed (same treatment as the
+            // SIGKILL case above): an entry whose `gitdir` file is absent is
+            // pruned unconditionally, and `--expire` cannot protect it — measured
+            // across every window from `--expire=now` to `--expire=3.months.ago`,
+            // a fresh no-gitdir entry is removed regardless, while `--expire` also
+            // makes an already-deleted worktree SURVIVE, breaking the "a run
+            // always begins clean" guarantee this fix exists to provide. So a
+            // concurrent `git worktree add` by another process in this repo is
+            // vulnerable for the microseconds between its `mkdir` and its
+            // `gitdir` write. A mid-creation state cannot persist longer than
+            // that, so an entry found in that state is dead metadata, not a live
+            // worktree in progress.
+            try {
+                execFileSync('git', ['worktree', 'prune'], {
+                    cwd: this.root,
+                    stdio: 'ignore',
+                    timeout: 30_000,
+                });
+            }
+            catch {
+                /* best-effort: not a git repo, git missing, or a wedged hook */
+            }
         }
         catch {
             /* node:child_process unavailable — skip */