@polymorphism-tech/morph-spec 9.4.0 → 9.6.0

package/src/lib/e2e/compose-env.js

@@ -11,7 +11,9 @@ import { allocateEnvBlock, portLayout, resolveFleetConfig, resolvePortAliases }
 // Ports come from `portLayout()`, the same function that renders `.morph/worktree.env`. The credentials
 // file loads after the layout but cannot outrank it: a `.env.e2e` copied from a sibling worktree carries
 // that worktree's block. Ignored keys are announced on stderr; stdout carries `morph-spec env` output.
-export function buildComposeEnv({ cwd, config, featureName, gitCommonDir }) {
+// `withCredentials: false` keeps envFile values off stdout (`morph-spec env` lands in transcripts);
+// the withheld names go to stderr.
+export function buildComposeEnv({ cwd, config, featureName, gitCommonDir, withCredentials = true }) {
   const env = {};
   let layoutKeys = null;
 
@@ -38,16 +40,37 @@ export function buildComposeEnv({ cwd, config, featureName, gitCommonDir }) {
   const envFile = config?.e2e?.auth?.envFile;
   if (envFile) {
     const ignored = [];
+    const withheld = [];
+    const foreignPorts = [];
+    const layoutPorts = layoutKeys ? new Set([...layoutKeys].map((key) => env[key])) : null;
     for (const [key, value] of Object.entries(loadEnvFile(join(cwd, envFile)))) {
-      if (layoutKeys?.has(key)) ignored.push(key);
-      else env[key] = value;
+      if (layoutKeys?.has(key)) {
+        ignored.push(key);
+        continue;
+      }
+      if (layoutPorts && /(^|_)PORT$/.test(key) && !layoutPorts.has(value)) foreignPorts.push(`${key}=${value}`);
+      if (withCredentials) env[key] = value;
+      else withheld.push(key);
     }
     if (ignored.length) reportIgnoredLayoutKeys(envFile, ignored, env);
+    if (foreignPorts.length) reportForeignPorts(envFile, foreignPorts);
+    if (withheld.length) {
+      console.warn(chalk.yellow(
+        `  ⚠ ${envFile}: ${withheld.join(', ')} omitida(s) — credenciais não vão para o stdout; use --with-secrets dentro de eval "$(…)".`,
+      ));
+    }
   }
 
   return env;
 }
 
+function reportForeignPorts(envFile, foreignPorts) {
+  console.warn(chalk.yellow(
+    `  ⚠ ${envFile}: ${foreignPorts.join(', ')} não é porta do bloco desta worktree. `
+    + 'Se nomeia uma das portas do layout, declare-a em e2e.portEnvNames (ex.: { "postgres": "PG_PORT" }) e o bloco passa a prevalecer.',
+  ));
+}
+
 function reportIgnoredLayoutKeys(envFile, ignored, env) {
   const shown = ignored.map((key) => `${key}=${env[key]}`).join(', ');
   console.warn(chalk.yellow(

package/src/lib/graph/graphify-runtime.js

@@ -7,7 +7,6 @@ import { execFileSync } from 'node:child_process';
 export const GRAPHIFY_VERSION = '0.9.50';
 export const GRAPHIFY_PACKAGE = 'graphifyy';
 export const GRAPHIFY_BIN = 'graphify';
-export const GRAPHIFY_MCP_BIN = 'graphify-mcp';
 
 const PREFERENCE = ['uv', 'pipx', 'python3', 'python'];
 

package/src/lib/heavy/gate.js

@@ -1,6 +1,7 @@
-import { readHeavyConfig } from '../../../framework/hooks/shared/heavy-config.js';
+import { minFreeMemFor, readHeavyConfig } from '../../../framework/hooks/shared/heavy-config.js';
+import { heavyClass } from '../../../framework/hooks/shared/heavy-command.js';
 import {
-  acquireHeavy, describeBusy, heavyDir, releaseHeavy, updateLease,
+  acquireHeavy, awaitFreeMemory, describeBusy, heavyDir, releaseHeavy, updateLease,
 } from '../../../framework/hooks/shared/heavy-slots.js';
 
 export class HeavyBusyError extends Error {
@@ -11,6 +12,8 @@ export class HeavyBusyError extends Error {
     this.reason = result.reason;
     this.holders = result.holders;
     this.freeGb = result.freeGb;
+    this.minFreeMemGb = result.minFreeMemGb ?? null;
+    this.kind = result.kind ?? null;
     this.waitedMs = result.waitedMs;
   }
 
@@ -28,6 +31,7 @@ export function createHeavyGate({
 } = {}) {
   let entered = false;
   let lease = null;
+  let admittedGb = 0;
   let waitedMs = 0;
   let exitHandler = null;
   let saved = null;
@@ -50,26 +54,40 @@ export function createHeavyGate({
     entered = false;
   };
 
+  const raiseFloor = (kind) => {
+    const floor = minFreeMemFor(config, kind);
+    if (!lease || floor <= admittedGb) return;
+    const result = awaitFreeMemory({
+      minFreeMemGb: floor, waitTimeoutMs: config.waitTimeoutSec * 1000, kind, log, ...deps,
+    });
+    if (result.status === 'busy') throw new HeavyBusyError(result, config);
+    waitedMs += result.waitedMs;
+    admittedGb = floor;
+  };
+
   return {
     config,
     get waitedMs() { return waitedMs; },
 
-    enter(node) {
+    enter(node, kind = heavyClass(node)) {
       if (entered) {
+        raiseFloor(kind);
         updateLease(lease, { node });
         return;
       }
       for (const warning of config.warnings ?? []) log(`heavy: ${warning}`);
 
       if (config.enabled) {
+        const minFreeMemGb = minFreeMemFor(config, kind);
         const result = acquireHeavy({
           dir: heavyDir(env),
           slots: config.slots,
           label,
           feature,
           node,
+          kind,
           cwd: projectPath,
-          minFreeMemGb: config.minFreeMemGb,
+          minFreeMemGb,
           waitTimeoutMs: config.waitTimeoutSec * 1000,
           maxHoldMs: config.maxHoldMinutes * 60_000,
           env,
@@ -78,6 +96,7 @@ export function createHeavyGate({
         });
         if (result.status === 'busy') throw new HeavyBusyError(result, config);
         lease = result.lease;
+        admittedGb = minFreeMemGb;
         waitedMs = result.waitedMs;
       }
 

package/src/lib/heavy/live-stacks.js

@@ -0,0 +1,64 @@
+import { readdirSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { composeProjectName, defaultExec } from '../../../framework/hooks/shared/e2e-check.js';
+import {
+  MORPH_PROJECT_PREFIX, parseDockerJson, resolveGitCommonDir, stackBelongsTo,
+} from '../worktree/docker-audit.js';
+
+// Runs right after a full queue wait: a hung daemon must not add another one.
+const LS_TIMEOUT_MS = 10_000;
+
+// Stacks of every worktree live under the main checkout, and so does `.morph/archive`.
+export function repoMainRoot(cwd) {
+  const common = resolveGitCommonDir(cwd);
+  return common && basename(common) === '.git' ? dirname(common) : cwd;
+}
+
+function dirNames(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return [];
+  }
+}
+
+export function liveE2eStacks(cwd, { exec = defaultExec, root = repoMainRoot(cwd) } = {}) {
+  try {
+    const ls = exec('docker', ['compose', 'ls', '--format', 'json'], { cwd: root, timeout: LS_TIMEOUT_MS });
+    if (ls.code !== 0) return [];
+    const projects = parseDockerJson(ls.output);
+    if (!projects) return [];
+
+    const active = dirNames(join(root, '.morph', 'features'));
+    const owners = new Map(active.map((f) => [composeProjectName(f), { feature: f, state: 'active' }]));
+    for (const f of dirNames(join(root, '.morph', 'archive'))) {
+      const project = composeProjectName(f);
+      if (!owners.has(project)) owners.set(project, { feature: f, state: 'archived' });
+    }
+
+    return projects
+      .filter((p) => String(p?.Name ?? '').startsWith(MORPH_PROJECT_PREFIX) && stackBelongsTo(p, root))
+      .map((p) => {
+        const project = String(p.Name);
+        return { project, status: p.Status ?? null, ...(owners.get(project) ?? { feature: null, state: 'unknown' }) };
+      });
+  } catch {
+    return [];
+  }
+}
+
+function stackLine(s) {
+  if (s.state === 'archived') return `  • ${s.project}: feature ${s.feature} já arquivada — \`morph-spec e2e down ${s.feature}\` devolve a RAM`;
+  if (s.state === 'unknown') return `  • ${s.project}: nenhuma feature deste repo responde por ela — \`docker compose -p ${s.project} down\``;
+  return `  • ${s.project}: feature ${s.feature} em andamento`;
+}
+
+export function describeLiveStacks(stacks) {
+  if (!stacks.length) return '';
+  return `stacks e2e de pé neste repo (seguram RAM):\n${stacks.map(stackLine).join('\n')}`;
+}
+
+export function memoryBusyHint(err, cwd, deps = {}) {
+  if (err?.reason !== 'memory') return '';
+  return describeLiveStacks(liveE2eStacks(cwd, deps));
+}

package/src/lib/mutation/snapshot.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 
 export const md5Of = (bytes) => createHash('md5').update(bytes).digest('hex');
@@ -63,7 +63,3 @@ export function restoreSnapshot(snapshot, { rewrite = true } = {}) {
   writeJournal(snapshot);
   return report;
 }
-
-export function discardSnapshot(snapshot) {
-  rmSync(snapshot.dir, { recursive: true, force: true });
-}

package/src/lib/risk-detector.js

@@ -1,5 +1,7 @@
 import { MAX_SLICES } from './plan/checks.js';
 import { BLOCKER_TYPES, reviewFileName } from './review-reports.js';
+import { isTestPath } from './graph/sanitize.js';
+import { isTestArtifact } from './worktree/ignored-triage.js';
 
 const SECURITY_PATH_RE = /(^|[/._-])(auth|login|senha|password|token|secret|crypto|permiss|rbac|acl|lgpd|pii|privacy|payment|pagamento|billing|cobranca|invoice|asaas|stripe|migrations?)([/._-]|$)/i;
 
@@ -135,8 +137,14 @@ export function verifierModelFor({ promptModelTouched = false, generatesMedia =
   return { model: reasons.length ? 'opus' : 'sonnet', reasons };
 }
 
+// Teste e artefato de teste não são superfície de ataque: `e2e/login.spec.ts` não pede a persona security.
+const E2E_DIR_RE = /(^|\/)e2e\//;
+const isTestOnly = (f) => isTestPath(f) || E2E_DIR_RE.test(f) || isTestArtifact(f);
+
 export function securityReviewFor(changedFiles = []) {
-  const risky = changedFiles.filter((f) => SECURITY_PATH_RE.test(f.replaceAll('\\', '/')));
+  const risky = changedFiles
+    .map((f) => f.replaceAll('\\', '/'))
+    .filter((f) => SECURITY_PATH_RE.test(f) && !isTestOnly(f));
   return { required: risky.length > 0, reasons: risky.length ? [`caminho sensível: ${firstOf(risky)}`] : [] };
 }
 
@@ -379,8 +387,3 @@ export function getRiskSignals(signals) {
 
   return out;
 }
-
-export const RISK_CONSTANTS = {
-  FORCED_PAUSE_WORK_TYPES,
-  E2E_SKIP_CLASSES_THAT_PAUSE,
-};

package/src/lib/stack/stack-profile.js

@@ -9,17 +9,14 @@ const PROFILES = {
   dotnet: {
     isDotnet: true, isNextjs: false,
     defaultValidators: ['packages'],
-    buildCommand: 'dotnet build --no-restore',
   },
   nextjs: {
     isDotnet: false, isNextjs: true,
     defaultValidators: ['nextjs-component'],
-    buildCommand: 'npx tsc --noEmit',
   },
   empty: {
     isDotnet: false, isNextjs: false,
     defaultValidators: [],
-    buildCommand: null,
   },
 };
 
@@ -38,7 +35,6 @@ function mergeProfiles(profiles) {
     isDotnet: profiles.some((p) => p.isDotnet),
     isNextjs: profiles.some((p) => p.isNextjs),
     defaultValidators: [...new Set(profiles.flatMap((p) => p.defaultValidators))],
-    buildCommand: profiles.map((p) => p.buildCommand).find(Boolean) ?? null,
   };
 }
 

package/src/lib/stack/stack-scan.js

@@ -120,8 +120,11 @@ function auditDotnet(files, read) {
     if (major !== null && major < DOTNET_EXPECTED_MAJOR) add('Baixo', `Pacote desatualizado mas compatível (${p} ${packages.get(p)})`, [], `subir para ${DOTNET_EXPECTED_MAJOR}.x`);
   }
 
-  const newGuid = grepFiles(source, read, /Guid\.NewGuid\(\)/);
-  if (newGuid.length > 0) add('Alto', '`Guid.NewGuid()`', newGuid, 'trocar por `Guid.CreateVersion7()`');
+  const analyzers = packages.has('Microsoft.CodeAnalysis.BannedApiAnalyzers');
+  if (!analyzers) {
+    const newGuid = grepFiles(source, read, /Guid\.NewGuid\(\)/);
+    if (newGuid.length > 0) add('Alto', '`Guid.NewGuid()`', newGuid, 'trocar por `Guid.CreateVersion7()`');
+  }
   const repository = grepFiles(source, read, /interface\s+(IRepository\s*<|IUnitOfWork\b)/);
   if (repository.length > 0) {
     const di = grepFiles(source, read, /Add(Scoped|Transient|Singleton)\s*(<\s*(IRepository|IUnitOfWork)|\(\s*typeof\s*\(\s*(IRepository|IUnitOfWork))/);
@@ -135,7 +138,7 @@ function auditDotnet(files, read) {
   if (serviceLayer.length > 0) add('Alto', 'Camada de Service/Manager entre handler e dados', serviceLayer, 'o handler fala com o `ApplicationDbContext` direto');
   const rawSql = grepFiles(source, read, /\b(FromSqlRaw|ExecuteSqlRaw|SqlQueryRaw|ExecuteQuery)\s*\(/);
   if (rawSql.length > 0) add('Alto', 'SQL cru', rawSql, 'LINQ, ou store dedicado com justificativa em ADR');
-  if (projects.length > 0 && !packages.has('Microsoft.CodeAnalysis.BannedApiAnalyzers')) {
+  if (projects.length > 0 && !analyzers) {
     add('Médio', 'Analyzers do stack ausentes (o build não barra `Guid.NewGuid()` nem token não repassado)', [],
       '`Directory.Build.props` + `BannedSymbols.txt` + `morph.globalconfig` na raiz: `morph-spec standards --show backend-dotnet-analyzers#files`');
   }
@@ -144,6 +147,7 @@ function auditDotnet(files, read) {
   return { rows, deviations };
 }
 
+const ESLINT_CONFIGS = ['eslint.config.mjs', 'eslint.config.js', 'eslint.config.cjs'];
 const UI_LIBRARIES = ['@mui/material', 'antd', '@chakra-ui/react', 'bootstrap', 'react-bootstrap', '@mantine/core'];
 
 function auditNextjs(root, read) {
@@ -175,11 +179,18 @@ function auditNextjs(root, read) {
   rows.push({ layer: 'Roteamento', detected: appRouter ? 'App Router' : (pagesRouter ? 'Pages Router' : 'não detectado'), expected: 'App Router', ok: appRouter || !pagesRouter });
   if (pagesRouter && !appRouter) add('Médio', 'Pages Router em vez de App Router', [next.file], 'migrar as rotas para `app/`');
   rows.push({ layer: 'Estilo', detected: next.deps.tailwindcss ? 'Tailwind' : 'ausente', expected: 'Tailwind', ok: Boolean(next.deps.tailwindcss) });
-  rows.push({ layer: 'Motion', detected: next.deps['framer-motion'] || next.deps.motion ? 'Framer Motion' : 'ausente', expected: 'Framer Motion', ok: true });
+  const motionPackages = ['motion', 'framer-motion'].filter((p) => next.deps[p]);
+  rows.push({ layer: 'Motion', detected: motionPackages.join(' + ') || 'ausente', expected: 'motion (`motion/react`)', ok: motionPackages.length < 2 });
+  if (motionPackages.length === 2) add('Baixo', '`motion` e `framer-motion` instalados juntos', [next.file], 'remover `framer-motion`; o import é `motion/react`');
   const shadcn = existsSync(join(root, base, 'components.json'));
   const otherUi = UI_LIBRARIES.filter((lib) => next.deps[lib]);
   rows.push({ layer: 'UI', detected: otherUi.join(', ') || (shadcn ? 'shadcn' : 'ausente'), expected: 'shadcn', ok: otherUi.length === 0 });
   if (otherUi.length > 0) add('Médio', `Biblioteca de UI diferente (${otherUi.join(', ')})`, [next.file], 'shadcn sobre Tailwind');
+  const eslintConfig = ESLINT_CONFIGS.map((name) => `${base}${name}`).find((file) => existsSync(join(root, file)));
+  if (!eslintConfig || !/no-restricted-imports/.test(read(eslintConfig) ?? '')) {
+    add('Médio', 'ESLint do stack ausente (o lint não barra import proibido nem fetch em `useEffect`)', eslintConfig ? [eslintConfig] : [],
+      '`eslint.config.mjs` na raiz do app: `morph-spec standards --show frontend-nextjs-lint#files`');
+  }
   return { rows, deviations };
 }
 

package/src/lib/tasks/eval-node.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, readdirSync, statSync } from 'fs';
-import { join, resolve, sep } from 'path';
+import { join, resolve } from 'path';
 import { tmpdir } from 'os';
 
 import { isInside } from './test-runner.js';
@@ -284,12 +284,6 @@ export function evalColdCacheWarning(summary) {
   return null;
 }
 
-export function relativeToProject(projectPath, target) {
-  const root = resolve(projectPath) + sep;
-  const full = resolve(target);
-  return full.startsWith(root) ? full.slice(root.length).replace(/\\/g, '/') : full;
-}
-
 export function isDirectory(path) {
   try {
     return statSync(path).isDirectory();

package/src/lib/validators/validation-runner.js

@@ -186,46 +186,3 @@ async function runSingleValidator(validatorId, projectPath, featureName, options
       };
   }
 }
-
-export function formatValidationResults(result) {
-  if (result.passed && result.warnings === 0) {
-    const ranCount = Object.keys(result.results || {}).length;
-    const countLabel = ranCount > 0 ? ` (${ranCount} validator${ranCount !== 1 ? 's' : ''})` : '';
-    console.log(chalk.green(`\n  ✅ All validations passed${countLabel}!\n`));
-    return;
-  }
-
-  if (result.passed && result.warnings > 0) {
-    console.log(chalk.yellow(`\n  ⚠️  Passed with ${result.warnings} warning(s)\n`));
-  } else {
-    console.log(chalk.red(`\n  ❌ Validation FAILED: ${result.errors} error(s), ${result.warnings} warning(s)\n`));
-  }
-
-  const errors = result.issues.filter(i => i.level === 'error');
-  const warnings = result.issues.filter(i => i.level === 'warning');
-
-  if (errors.length > 0) {
-    console.log(chalk.red.bold('  Errors:'));
-    for (const issue of errors.slice(0, 10)) {
-      console.log(chalk.red(`    ✗ ${issue.message}`));
-      if (issue.file) console.log(chalk.gray(`      ${issue.file}${issue.line ? ':' + issue.line : ''}`));
-      if (issue.solution) console.log(chalk.cyan(`      Fix: ${issue.solution}`));
-    }
-    if (errors.length > 10) {
-      console.log(chalk.gray(`    ... and ${errors.length - 10} more errors`));
-    }
-  }
-
-  if (warnings.length > 0) {
-    console.log(chalk.yellow('\n  Warnings:'));
-    for (const issue of warnings.slice(0, 5)) {
-      console.log(chalk.yellow(`    ⚠ ${issue.message}`));
-      if (issue.file) console.log(chalk.gray(`      ${issue.file}`));
-    }
-    if (warnings.length > 5) {
-      console.log(chalk.gray(`    ... and ${warnings.length - 5} more warnings`));
-    }
-  }
-
-  console.log('');
-}

package/src/lib/validators/verify-runner.js

@@ -3,6 +3,8 @@ import { existsSync, readFileSync, rmSync } from 'fs';
 import { join, resolve } from 'path';
 
 import { runBuildCheck, getBuildSteps, isDotnetStack } from '../../../framework/hooks/shared/build-check.js';
+import { changedPathsAgainst, detectDefaultBranch } from '../git/default-branch.js';
+import { resolveBaseRef } from '../git/branch-classifier.js';
 import { composeProjectName, runE2eCheck } from '../../../framework/hooks/shared/e2e-check.js';
 import { buildComposeEnv } from '../e2e/compose-env.js';
 import { e2eApplicability } from '../e2e/applicability.js';
@@ -218,8 +220,10 @@ async function runBuildNode({ projectPath, stack, paths: declaredPaths = {}, tim
     return { status: 'skip', command: null, durationMs: 0, reason: 'requested', output: '' };
   }
 
-  const { paths, hint } = resolveDotnetBuild(projectPath, stack, declaredPaths);
-  const steps = getBuildSteps(stack, { cwd: projectPath, frontendPath: paths.frontendPath, backendPath: paths.backendPath, backendTarget: paths.backendTarget });
+  const resolved = resolveDotnetBuild(projectPath, stack, declaredPaths);
+  const { hint } = resolved;
+  const paths = { ...resolved.paths, lintFiles: featureLintFiles(projectPath, stack, resolved.paths.frontendPath) };
+  const steps = getBuildSteps(stack, { cwd: projectPath, frontendPath: paths.frontendPath, backendPath: paths.backendPath, backendTarget: paths.backendTarget, lintFiles: paths.lintFiles });
   if (steps.length === 0) {
     const reason = stack ? `no build command for stack "${stack}"` : 'no stack configured';
     return { status: 'skip', command: null, durationMs: 0, reason, output: '' };
@@ -240,6 +244,18 @@ async function runBuildNode({ projectPath, stack, paths: declaredPaths = {}, tim
   };
 }
 
+const LINTABLE = /\.(?:tsx?|jsx?|mjs|cjs)$/;
+
+/** The feature's own source files under the frontend, relative to it; `[]` when the base does not resolve. */
+export function featureLintFiles(projectPath, stack, frontendPath, { changed } = {}) {
+  if (!/nextjs|react|vue|node/i.test(stack ?? '')) return [];
+  const paths = changed ?? changedPathsAgainst(resolveBaseRef(detectDefaultBranch(projectPath), projectPath), projectPath);
+  const prefix = frontendPath ? `${frontendPath.replace(/\\/g, '/').replace(/\/$/, '')}/` : '';
+  return paths
+    .filter((p) => LINTABLE.test(p) && p.startsWith(prefix) && existsSync(join(projectPath, p)))
+    .map((p) => p.slice(prefix.length));
+}
+
 function appendBuildFeedback(feedback, buildNode) {
   if (buildNode.status !== 'fail') return;
   for (const line of linesOf(buildNode.output)) {

package/src/lib/worktree/docker-audit.js

@@ -12,9 +12,9 @@ import {
 import { allocateEnvBlock, allocatedFeatures, portLayout, resolveFleetConfig } from './env-allocator.js';
 
 const PROJECT_PROBE = 'probe';
-const MORPH_PROJECT_PREFIX = composeProjectName(PROJECT_PROBE).slice(0, -PROJECT_PROBE.length);
+export const MORPH_PROJECT_PREFIX = composeProjectName(PROJECT_PROBE).slice(0, -PROJECT_PROBE.length);
 
-function resolveGitCommonDir(cwd) {
+export function resolveGitCommonDir(cwd) {
   try {
     const common = execFileSync('git', ['rev-parse', '--git-common-dir'], {
       cwd, stdio: 'pipe', encoding: 'utf-8', windowsHide: true,
@@ -57,6 +57,10 @@ function publishedPorts(entry) {
   return ports;
 }
 
+export function stackBelongsTo(entry, root) {
+  return belongsToRoot(entry, norm(root));
+}
+
 function composeProjectOf(entry) {
   const labels = String(entry?.Labels ?? '');
   for (const part of labels.split(',')) {
@@ -73,7 +77,7 @@ function containerNameOf(entry) {
 }
 
 // `null` = unreadable, distinct from `[]` = docker answered with nothing running.
-function parseDockerJson(raw) {
+export function parseDockerJson(raw) {
   const text = String(raw ?? '').trim();
   if (!text) return [];
   const parsed = parseComposePs(text);

package/src/lib/worktree/env-allocator.js

@@ -9,6 +9,22 @@ const DEFAULT_BASE_PORT = 4000;
 const DEFAULT_BLOCK_SIZE = 10;
 const MAX_PORT = 65535;
 
+// Chromium's kRestrictedPorts (net/base/port_util.cc): the browser refuses them with
+// ERR_UNSAFE_PORT, so a block holding one is a stack Playwright and the verifier cannot open.
+const BROWSER_UNSAFE_PORTS = new Set([
+  1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42, 43, 53, 69, 77, 79, 87, 95, 101, 102, 103,
+  104, 109, 110, 111, 113, 115, 117, 119, 123, 135, 137, 139, 143, 161, 179, 389, 427, 465, 512, 513,
+  514, 515, 526, 530, 531, 532, 540, 548, 554, 556, 563, 587, 601, 636, 989, 990, 993, 995, 1719, 1720,
+  1723, 2049, 3659, 4045, 4190, 5060, 5061, 6000, 6566, 6665, 6666, 6667, 6668, 6669, 6679, 6697, 10080,
+]);
+
+export function blockHasUnsafePort(base, blockSize) {
+  for (let port = base; port < base + blockSize; port += 1) {
+    if (BROWSER_UNSAFE_PORTS.has(port)) return true;
+  }
+  return false;
+}
+
 export function registryPath(gitCommonDir) {
   return join(gitCommonDir, 'morph-spec', 'env-registry.json');
 }
@@ -47,23 +63,29 @@ export function resolveFleetConfig(rootPath) {
   }
 }
 
-/** First free index wins, so released slots are reused instead of creeping toward the port ceiling. */
+/**
+ * First free index wins, so released slots are reused instead of creeping toward the port ceiling.
+ * A block with a browser-unsafe port is never handed out, and one recorded before this rule is moved.
+ */
 export function allocateEnvBlock(feature, { gitCommonDir, basePort = DEFAULT_BASE_PORT, blockSize = DEFAULT_BLOCK_SIZE }) {
   const registry = readRegistry(gitCommonDir);
 
   const existing = registry.allocations[feature];
   if (existing && Number.isInteger(existing.index)) {
     const base = basePort + existing.index * blockSize;
-    return { index: existing.index, base, range: [base, base + blockSize - 1], created: false };
+    if (!blockHasUnsafePort(base, blockSize)) {
+      return { index: existing.index, base, range: [base, base + blockSize - 1], created: false };
+    }
   }
 
   const used = new Set(
-    Object.values(registry.allocations)
-      .map((a) => a?.index)
+    Object.entries(registry.allocations)
+      .filter(([name]) => name !== feature)
+      .map(([, a]) => a?.index)
       .filter((i) => Number.isInteger(i)),
   );
   let index = 0;
-  while (used.has(index)) index += 1;
+  while (used.has(index) || blockHasUnsafePort(basePort + index * blockSize, blockSize)) index += 1;
 
   const base = basePort + index * blockSize;
   if (base + blockSize - 1 > MAX_PORT) {

package/src/lib/worktree/ignored-triage.js

@@ -18,6 +18,14 @@ const DISPOSABLE_FILE_RE = /\.tsbuildinfo$/;
 const REPLICABLE_MAX_FILES = 500;
 const REPLICABLE_MAX_BYTES = 8 * 1024 * 1024;
 
+// Narrower than the build set on purpose: an untracked `bin/` may be new code, a `test-results/` never is.
+const TEST_ARTIFACT_DIR_NAMES = new Set(['test-results', 'TestResults', 'playwright-report', 'blob-report']);
+
+/** @param {string} p - forward-slash relative path */
+export function isTestArtifact(p) {
+  return p.split('/').filter(Boolean).some((seg) => TEST_ARTIFACT_DIR_NAMES.has(seg));
+}
+
 /** @param {string} p - forward-slash relative path */
 export function isDisposableBuildArtifact(p) {
   if (DISPOSABLE_FILE_RE.test(p)) return true;

package/src/utils/agents-installer.js

@@ -281,27 +281,23 @@ export const DISPATCH_CONTRACT = [
     'o caminho do relatório e, se houver, o worktree. O resto é este contrato.',
   '',
   '1. RELATÓRIO: GRAVE o arquivo de relatório que o dispatch nomeia (`.morph/features/{feature}/3-implement/reports/F{n}.md`) ' +
-    'ANTES de encerrar — é o retorno autoritativo, não a sua mensagem final. `SendMessage` não é substituto do relatório e não deve ser chamado.',
-  '2. ESTADO: NÃO toque em `plan.md`, `checks.json`, `feature.json`, `state.json` nem no board de sessão — todo estado é gravado exclusivamente pelo orquestrador.',
+    'ANTES de encerrar — é o retorno autoritativo, não a sua mensagem final.',
+  '2. ESTADO: NÃO toque em `plan.md`, `checks.json`, `feature.json` nem `state.json`: o estado é do orquestrador.',
   '3. TESTE: a prova é do orquestrador (`morph-spec verify {feature}`, depois do seu retorno), não sua. Escreva os testes pelo orçamento: ' +
     'um por Cn `prova: teste`, variantes em tabela (`[Theory]`/`it.each`); `leitura` sem teste. NÃO rode teste a cada marco nem faça ciclo red→green: ' +
     'escreva código e testes, compile, e rode SÓ o filtro dos seus testes UMA vez, em primeiro plano, antes do relatório; se falhar, corrija e rode só os que falharam. ' +
     'Grave a saída em arquivo (`… > .morph/logs/test-last.log 2>&1`, sem nada depois) e leia o arquivo — um pipe troca o exit do teste pelo do último comando. ' +
     'Em batch paralelo SEM isolamento, só compile. Com `isolation: "worktree"`, o mesmo vale no seu worktree, e o último ato é o commit na branch dele.',
-  '4. ESCOPO: uma fatia, ~4 arquivos (nunca mais de 8). Escopo maior falha e volta — fatie antes, não depois.',
-  '5. SOBREVIVÊNCIA: o limite de turnos corta sem aviso: commite `chore(F{n}): wip …` a cada marco (um arquivo ou uma fatia escrita), não só ao fim — ' +
-    'e só os seus arquivos (`git add <paths>`, nunca `-A` nem diretório). Sem commit, a retomada recomeça do zero.',
-  '6. PROCESSOS: NUNCA `taskkill /IM node.exe` (derruba os MCPs de todas as sessões). Encerre dev server pelo PID que você mesmo subiu. ' +
-    'Build e suíte pesados rodam por `morph-spec heavy run -- <comando>`, em primeiro plano. Exit 3 é fila cheia depois da espera da própria fila: ' +
-    'não repita nem espere em laço — diga no relatório o que não rodou.',
-  '7. REUSO: antes de criar tipo, componente, hook ou serviço NOVO, verifique se já existe: `morph-spec graph explain <nome>` e ' +
+  '4. SOBREVIVÊNCIA: o limite de turnos corta sem aviso: commite `chore(F{n}): wip …` a cada marco (um arquivo ou uma fatia escrita), não só ao fim — ' +
+    'e só os seus arquivos (`git add <paths>`, nunca diretório). Sem commit, a retomada recomeça do zero.',
+  '5. PROCESSOS: encerre dev server pelo PID que você mesmo subiu. Build e suíte pesados rodam por `morph-spec heavy run -- <comando>`, em primeiro plano; ' +
+    'exit 3 é fila cheia: não repita nem espere em laço, diga no relatório o que não rodou.',
+  '6. REUSO: antes de criar tipo, componente, hook ou serviço NOVO, verifique se já existe: `morph-spec graph explain <nome>` e ' +
     '`graph affected <conceito> --uses-only`; sem grafo (`no-graph`), caia para `grep -rn "<nome>"` e siga — a ausência de grafo nunca bloqueia. ' +
     'Se criar mesmo assim, diga por que em uma linha no relatório.',
-  '8. MUTAÇÃO: nunca altere, reverta, mova ou apague código de produção para ver um teste falhar (`sed`, `mv`, `git show HEAD:… >`, `git stash`, ' +
-    '`git checkout --`). A prova de que o teste morde é do verificador (Gate 3).',
-  '9. ESCRITA: código e teste do projeto só por Write/Edit, nunca pelo Bash — heredoc, redirecionamento, `sed -i` ou script python/node que grava (`cat > X.cs <<EOF`, `sed -i … X.cs`): ' +
-    'os guards de escrita só enxergam Write/Edit.',
-  '10. BLOQUEIO: decisão que não é sua (requisito contra o plano ou um ADR, escolha deixada ao humano) → `BLOQUEADO` na 1ª linha, ' +
+  '7. MUTAÇÃO: nunca altere, reverta, mova ou apague código de produção para ver um teste falhar; a prova de que o teste morde é do verificador.',
+  '8. ESCRITA: código e teste do projeto só por Write/Edit, nunca pelo Bash (heredoc, `sed -i`, script que grava): os guards só enxergam Write/Edit.',
+  '9. BLOQUEIO: decisão que não é sua (requisito contra o plano ou um ADR, escolha deixada ao humano) → `BLOQUEADO` na 1ª linha, ' +
     'com a pergunta e as opções. Dificuldade técnica não é bloqueio.',
   '',
   'Formato do relatório (o `report-check` lê estas marcas):',
@@ -416,11 +412,8 @@ function buildBody(agent, maxTurns) {
       '',
       '## Working fast',
       '',
-      'Independent tool calls go in the SAME response: read every listed file at once, fire the Greps together. ' +
-        'Use Read/Grep/Glob, never grep/sed/cat/find via Bash. Check a library API in the `context7` MCP before guessing ' +
-        '(load a deferred `mcp__` tool with ToolSearch). Write the tests the budget asks for, then run only your own ' +
-        'filter ONCE before the report — no red→green cycles, no `morph-spec verify` (the orchestrator proves it). ' +
-        'Never alter, revert or move production code to watch a test fail: mutation proof belongs to the Gate 3 verifier.',
+      'Independent tool calls go in the SAME response: read every listed file at once, fire the searches together. ' +
+        'Check a library API in the `context7` MCP before guessing (load a deferred `mcp__` tool with ToolSearch).',
     );
   }
 

package/src/utils/claude-settings-manager.js

@@ -7,34 +7,6 @@ const MORPH_MANAGED_KEY = '_morph_managed';
 export { installClaudeHooks, installGlobalStatusline, getHooksVersion } from './hooks-installer.js';
 export { installAgents } from './agents-installer.js';
 
-export async function installEnvVars(targetPath, envVars) {
-  const settings = await loadSettings(targetPath);
-
-  settings.env = settings.env || {};
-
-  const added = [];
-  for (const [key, value] of Object.entries(envVars)) {
-    if (!(key in settings.env)) {
-      settings.env[key] = value;
-      added.push(key);
-    }
-  }
-
-  settings[MORPH_MANAGED_KEY] = settings[MORPH_MANAGED_KEY] || {};
-  settings[MORPH_MANAGED_KEY].env_added =
-    settings[MORPH_MANAGED_KEY].env_added || [];
-  for (const key of added) {
-    if (!settings[MORPH_MANAGED_KEY].env_added.includes(key)) {
-      settings[MORPH_MANAGED_KEY].env_added.push(key);
-    }
-  }
-  settings[MORPH_MANAGED_KEY].generated_at = new Date().toISOString();
-
-  await saveSettings(targetPath, settings);
-
-  return { added, total: Object.keys(settings.env).length };
-}
-
 export async function resetMorphSettings(targetPath) {
   const claudeDir = join(targetPath, '.claude');
   const settingsPath = join(claudeDir, 'settings.local.json');