@open-mercato/cezar 0.9.2 → 0.9.3

package/dist/workflows/run.d.ts

@@ -20,6 +20,14 @@ export declare const AUTOSAVE_INTERVAL_MS = 90000;
  *  noise interleaving PR history. The flushes (`autosaveCommit` at turn end and before
  *  a draft PR) are NOT gated: the branch must still end holding the finished state. */
 export declare function periodicAutosaveEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Explicitly opt out of the repository-root lease for runs that execute in the
+ * current checkout. This covers explicit worktree opt-out, non-Git degradation,
+ * and continuations whose worktree cannot be restored (spec 006 hardening, #438).
+ * This is intentionally unsafe: concurrent agents may overwrite each other's
+ * files or Git state. Isolated worktree runs are unaffected.
+ */
+export declare function repositoryRootLockDisabled(env?: NodeJS.ProcessEnv): boolean;
 export interface StartRunInput {
     task: string;
     model?: string;
@@ -142,8 +150,9 @@ export declare class RunManager {
     private pumpAgain;
     /**
      * Runs normally isolate in worktrees and may execute in parallel. When that
-     * isolation is unavailable (or explicitly disabled), serialize access to
-     * `repoRoot` so two agents can never edit/revert the same files (#438).
+     * isolation is unavailable (or explicitly disabled), access to `repoRoot` is
+     * serialized by default so two agents cannot edit/revert the same files
+     * (#438). `CEZ_DISABLE_REPO_LOCK=1` deliberately bypasses this safety lease.
      */
     private repoRootTail;
     /** `.ai/cezar` — where the per-task handoff files and todos.json live. */
@@ -524,12 +533,23 @@ export declare function makeRunTitle(task: string, workflow: WorkflowDef): strin
  */
 export declare function skillSystemPrompt(skill: Pick<Skill, 'name' | 'description' | 'body'> & Partial<Pick<Skill, 'path' | 'source'>>): string;
 /**
- * Expand a registry-backed slash skill in a live chat message before it reaches
- * a backend. Claude otherwise intercepts an unknown leading slash command, and
+ * Expand a registry-backed slash skill in one prompt string before it reaches a
+ * backend. Claude otherwise intercepts an unknown leading slash command, and
  * Codex/OpenCode have no native slash-skill lookup at all (#676).
  *
- * Only the first text block is eligible, only at character zero, and unknown
- * commands pass through byte-for-byte. The caller persists the original user
- * content before applying this delivery-only rewrite.
+ * Only a match at character zero counts, and unknown commands pass through
+ * byte-for-byte — a backend's OWN slash commands must keep working. The caller
+ * persists the original user text before applying this delivery-only rewrite.
+ *
+ * Both delivery seams route through here: live-session messages via
+ * `expandRegistrySlashSkill`, and a continuation's opening prompt, which becomes
+ * the session's `userPrompt` and never passes through `deliverMessage` at all
+ * (#811).
+ */
+export declare function expandRegistrySlashSkillText(text: string, skills: readonly Skill[]): string;
+/**
+ * `expandRegistrySlashSkillText` over a live chat message: only the first text
+ * block is eligible, and an unchanged block returns the caller's array
+ * identity untouched.
  */
 export declare function expandRegistrySlashSkill(content: ContentBlock[], skills: readonly Skill[]): ContentBlock[];

package/dist/workflows/run.js

@@ -98,6 +98,17 @@ export const AUTOSAVE_INTERVAL_MS = 90_000;
 export function periodicAutosaveEnabled(env = process.env) {
     return env.CEZ_AUTOSAVE === '1';
 }
+/**
+ * Explicitly opt out of the repository-root lease for runs that execute in the
+ * current checkout. This covers explicit worktree opt-out, non-Git degradation,
+ * and continuations whose worktree cannot be restored (spec 006 hardening, #438).
+ * This is intentionally unsafe: concurrent agents may overwrite each other's
+ * files or Git state. Isolated worktree runs are unaffected.
+ */
+export function repositoryRootLockDisabled(env = process.env) {
+    return env.CEZ_DISABLE_REPO_LOCK === '1';
+}
+const REPOSITORY_ROOT_LOCK_DISABLED_NOTE = 'repository-root lock disabled by CEZ_DISABLE_REPO_LOCK=1 (shared checkout is unsafe)';
 /** Safety cap on autonomous auto-continues per run — stops a stuck agent from nudging forever. */
 const MAX_AUTO_CONTINUES = 40;
 const AUTONOMOUS_NUDGE = 'Continue working autonomously until the task is fully complete. Do not ask me for confirmation or clarification — make reasonable assumptions and proceed. When everything is done, end the session with your done signal.';
@@ -234,8 +245,9 @@ export class RunManager {
     pumpAgain = false;
     /**
      * Runs normally isolate in worktrees and may execute in parallel. When that
-     * isolation is unavailable (or explicitly disabled), serialize access to
-     * `repoRoot` so two agents can never edit/revert the same files (#438).
+     * isolation is unavailable (or explicitly disabled), access to `repoRoot` is
+     * serialized by default so two agents cannot edit/revert the same files
+     * (#438). `CEZ_DISABLE_REPO_LOCK=1` deliberately bypasses this safety lease.
      */
     repoRootTail = Promise.resolve();
     /** `.ai/cezar` — where the per-task handoff files and todos.json live. */
@@ -1300,19 +1312,27 @@ export class RunManager {
         this.active.set(runId, state);
         this.starting.delete(runId);
         if (state.cwd === this.repoRoot) {
-            this.store.appendEvent(runId, {
-                type: 'note',
-                message: 'waiting for exclusive access to the repository working tree',
-            });
-            if (!(await this.acquireRepoRoot(runId, state))) {
-                this.store.updateRun(runId, {
-                    status: 'cancelled',
-                    finishedAt: new Date().toISOString(),
-                    currentStepId: undefined,
+            if (repositoryRootLockDisabled()) {
+                this.store.appendEvent(runId, {
+                    type: 'note',
+                    message: REPOSITORY_ROOT_LOCK_DISABLED_NOTE,
                 });
-                this.store.appendEvent(runId, { type: 'lifecycle', message: 'run cancelled' });
-                this.dropActive(runId);
-                return;
+            }
+            else {
+                this.store.appendEvent(runId, {
+                    type: 'note',
+                    message: 'waiting for exclusive access to the repository working tree',
+                });
+                if (!(await this.acquireRepoRoot(runId, state))) {
+                    this.store.updateRun(runId, {
+                        status: 'cancelled',
+                        finishedAt: new Date().toISOString(),
+                        currentStepId: undefined,
+                    });
+                    this.store.appendEvent(runId, { type: 'lifecycle', message: 'run cancelled' });
+                    this.dropActive(runId);
+                    return;
+                }
             }
         }
         this.armAutosave(state);
@@ -1333,6 +1353,17 @@ export class RunManager {
             backend,
         });
         this.store.appendEvent(runId, { type: 'step-start', stepId, name: 'Continue', kind: 'agent', iteration: 1 });
+        // Registry snapshot for `/skill` expansion. `execute` loads this for the workflow's own
+        // sessions; a continuation builds its OWN ActiveRun, and without this the resumed session
+        // expanded against an empty registry and leaked `/om-...` verbatim to the backend, which
+        // answered "Unknown skill" (#811). Best-effort — discovery must never break Continue.
+        //
+        // Loaded AFTER the run is marked `running`, not before: `continueRun` returns the moment it
+        // schedules this, so every await ahead of that write is a window in which the run still
+        // reads with its previous TERMINAL status. A directory scan there is long enough to be
+        // observed. Nothing between here and `startSession` reads `state.skills`, and no message can
+        // be delivered into a session that does not exist yet, so the invariant is unaffected.
+        state.skills = await discoverSkills(this.repoRoot).catch(() => []);
         // Attachments pasted into the follow-up composer, on the same terms as a live-session
         // message (#357): persisted to the run's own image store so the thread renders the bubble's
         // images rather than a bare count, and handed to the agent BOTH as base64 blocks (so it can
@@ -1493,12 +1524,19 @@ export class RunManager {
         const runner = createRunner(continueBackend);
         state.currentStepId = stepId;
         this.beginUsageInvocation(runId, state, stepId);
+        // A continuation's opening message becomes the session's `userPrompt` and never passes
+        // through `deliverMessage`, so it needs the SAME delivery-only `/skill` rewrite the
+        // live path applies (#811). Delivery-only: the `user-message` event above already
+        // persisted the user's original text, and the transcript must keep showing that.
+        const openingPrompt = expandRegistrySlashSkillText(prompt, state.skills ?? []);
         const session = runner.startSession({
             // The Continue step is a fresh agent session on the same run — the
             // run's extra system prompt (already resolved at execute time and
             // echoed on the record) rides along with the handoff contract.
             systemPrompt: composeSystemPrompt(record?.systemPrompt, generateFollowups ? HANDOFF_INSTRUCTIONS : HANDOFF_ONLY_INSTRUCTIONS),
-            userPrompt: attachments.length ? `${prompt}\n\n${pastedAttachmentsText(attachments)}` : prompt,
+            userPrompt: attachments.length
+                ? `${openingPrompt}\n\n${pastedAttachmentsText(attachments)}`
+                : openingPrompt,
             ...(openingImages.length ? { images: openingImages } : {}),
             cwd: state.cwd,
             allowedTools: DEFAULT_ALLOWED_TOOLS,
@@ -1601,7 +1639,8 @@ export class RunManager {
         const repo = await getRepoInfo(this.repoRoot);
         if (repo && input.worktree === false) {
             // Composer opt-out: run in the repo working tree, no branch/worktree. The
-            // repository-root lease serializes these runs so workflows cannot overlap.
+            // repository-root lease serializes these runs by default; the explicit
+            // CEZ_DISABLE_REPO_LOCK=1 escape hatch allows unsafe overlap.
             // Pin the starting commit: the session's Changes and Commits views use it
             // as their stable lower bound while reading the current working copy.
             const startingCommit = await getHeadCommit(repo.root);
@@ -1673,14 +1712,22 @@ export class RunManager {
             emit({ type: 'note', message: 'not a git repository — running in place, one task at a time' });
         }
         if (state.cwd === this.repoRoot) {
-            emit({
-                type: 'note',
-                message: 'waiting for exclusive access to the repository working tree',
-            });
-            // A cancel during the wait leaves the lease ungranted; the step loop
-            // below breaks on `cancelled` before touching the tree and settles the
-            // run through the usual path.
-            await this.acquireRepoRoot(runId, state);
+            if (repositoryRootLockDisabled()) {
+                emit({
+                    type: 'note',
+                    message: REPOSITORY_ROOT_LOCK_DISABLED_NOTE,
+                });
+            }
+            else {
+                emit({
+                    type: 'note',
+                    message: 'waiting for exclusive access to the repository working tree',
+                });
+                // A cancel during the wait leaves the lease ungranted; the step loop
+                // below breaks on `cancelled` before touching the tree and settles the
+                // run through the usual path.
+                await this.acquireRepoRoot(runId, state);
+            }
         }
         // Handoff journal (spec 007) — seeded after the worktree exists so the
         // header can name the branch. Idempotent: an existing file stays as-is.
@@ -1688,6 +1735,8 @@ export class RunManager {
         if (seeded)
             seedHandoffFile(this.dataDir, seeded);
         const skills = await discoverSkills(this.repoRoot);
+        // Every ActiveRun construction site must carry the registry — `runContinuation` builds
+        // its own, and the one that skipped this leaked raw `/skill` text to the backend (#811).
         state.skills = skills;
         const retriesUsed = new Map();
         let checkFailure = null;
@@ -2210,11 +2259,13 @@ export class RunManager {
             // deliberately NEVER a title source; see maybeRefreshTitle below. The
             // one exception is an explicit CEZ:TITLE declaration (applied above).
             if (run.worktreePath && existsSync(run.worktreePath)) {
-                // `taskBranch` is what keeps this number *this task's* (#751): a review/QA run
-                // repoints the worktree onto the branch under review, and without the branch to
-                // compare HEAD against, the stat would claim that whole branch's diff.
+                // `taskBranch` + `runStartedAt` are what keep this number *this task's* (#751): a
+                // review/QA run repoints the worktree onto the branch under review, and without the
+                // branch to compare HEAD against and the moment it was checked out, the stat would
+                // claim that whole branch's diff.
                 const stat = await worktreeShortstat(run.worktreePath, run.baseBranch ?? 'HEAD', {
                     taskBranch: run.branch,
+                    runStartedAt: run.startedAt,
                 });
                 if (stat)
                     this.store.updateRun(runId, { diffStat: stat });
@@ -2586,13 +2637,33 @@ export function skillSystemPrompt(skill) {
     return lines.join('\n');
 }
 /**
- * Expand a registry-backed slash skill in a live chat message before it reaches
- * a backend. Claude otherwise intercepts an unknown leading slash command, and
+ * Expand a registry-backed slash skill in one prompt string before it reaches a
+ * backend. Claude otherwise intercepts an unknown leading slash command, and
  * Codex/OpenCode have no native slash-skill lookup at all (#676).
  *
- * Only the first text block is eligible, only at character zero, and unknown
- * commands pass through byte-for-byte. The caller persists the original user
- * content before applying this delivery-only rewrite.
+ * Only a match at character zero counts, and unknown commands pass through
+ * byte-for-byte — a backend's OWN slash commands must keep working. The caller
+ * persists the original user text before applying this delivery-only rewrite.
+ *
+ * Both delivery seams route through here: live-session messages via
+ * `expandRegistrySlashSkill`, and a continuation's opening prompt, which becomes
+ * the session's `userPrompt` and never passes through `deliverMessage` at all
+ * (#811).
+ */
+export function expandRegistrySlashSkillText(text, skills) {
+    const match = /^\/([A-Za-z0-9][A-Za-z0-9._-]*)(?=\s|$)/.exec(text);
+    if (!match)
+        return text;
+    const skill = skills.find((candidate) => candidate.name === match[1]);
+    if (!skill)
+        return text;
+    const request = text.slice(match[0].length).trim();
+    return request ? `${skillSystemPrompt(skill)}\n\nUser request:\n${request}` : skillSystemPrompt(skill);
+}
+/**
+ * `expandRegistrySlashSkillText` over a live chat message: only the first text
+ * block is eligible, and an unchanged block returns the caller's array
+ * identity untouched.
  */
 export function expandRegistrySlashSkill(content, skills) {
     const textIndex = content.findIndex((block) => block.type === 'text');
@@ -2601,19 +2672,11 @@ export function expandRegistrySlashSkill(content, skills) {
     const block = content[textIndex];
     if (!block || block.type !== 'text')
         return content;
-    const match = /^\/([A-Za-z0-9][A-Za-z0-9._-]*)(?=\s|$)/.exec(block.text);
-    if (!match)
-        return content;
-    const skill = skills.find((candidate) => candidate.name === match[1]);
-    if (!skill)
+    const text = expandRegistrySlashSkillText(block.text, skills);
+    if (text === block.text)
         return content;
-    const request = block.text.slice(match[0].length).trim();
-    const replacement = {
-        type: 'text',
-        text: request ? `${skillSystemPrompt(skill)}\n\nUser request:\n${request}` : skillSystemPrompt(skill),
-    };
     const expanded = [...content];
-    expanded[textIndex] = replacement;
+    expanded[textIndex] = { type: 'text', text };
     return expanded;
 }
 //# sourceMappingURL=run.js.map