@sortedyuan/maybecode 0.3.2 → 0.5.0

package/dist/team-v2.js

@@ -1,18 +1,21 @@
 import { randomUUID } from "node:crypto";
-import { mkdir, open, readFile, realpath, rename, stat } from "node:fs/promises";
+import { mkdir, open, readFile, realpath, stat } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { defineAgent } from "@sortedyuan/application";
-import { createEditTool, createReadTool, createWriteTool } from "@sortedyuan/coding-tools";
-import { loadMayConfig } from "@sortedyuan/config";
-import { CoordinationRuntime, createApplicationAgent, FileArtifactStore, FileSharedBudget, TaskWorkspaceManager } from "@sortedyuan/coordination";
+import { defineAgent } from "@sortedyuan/may";
+import { createEditTool, createReadTool, createWriteTool, createGlobTool, createGrepTool, createFetchTool, } from "@sortedyuan/coding-tools";
+import { TeamExecutionEnvironments } from "./team-execution.js";
+import { loadMayConfig } from "@sortedyuan/may/config";
+import { CoordinationRuntime, createApplicationAgent, FileArtifactStore, FileSharedBudget, TaskWorkspaceManager, } from "@sortedyuan/coordination";
 import { FileCoordinationStore } from "@sortedyuan/coordination/file-store";
-import { resolveRunBudget } from "@sortedyuan/core";
-import { FileSessionStore } from "@sortedyuan/session/file-store";
-import { withFileAccess } from "@sortedyuan/session/file-access";
-import { getDefaultMaybeCodeDataDirectory } from "./configured.js";
+import { resolveRunBudget } from "@sortedyuan/may/core";
+import { FileSessionStore } from "@sortedyuan/may/session/file-store";
+import { hasErrorCode, withFileAccess } from "@sortedyuan/may/storage";
+import writeFileAtomic from "write-file-atomic";
+import { getDefaultMaybeCodeDataDirectory, resolveMaybeCodeRecording } from "./configured.js";
+import { readMaybeCodeSettings } from "./settings.js";
 import { createMaybeCodeModel, selectMaybeCodeModel } from "./model.js";
 import { createListTool } from "./team.js";
-import { createTeamPreset, loadTeamPlan, parseTeamPlan } from "./team-plan.js";
+import { createTeamPreset, loadTeamPlan, parseTeamPlan, } from "./team-plan.js";
 import { TeamVerificationStore } from "./team-verification.js";
 import { inspectTeam, readTeamResolution, retryImpact, teamReviewDigest } from "./team-recovery.js";
 import { applyTeamPatch, createTeamPatch, readTeamPatch, renderTeamPatchDiff } from "./team-patches.js";
@@ -35,21 +38,43 @@ export async function runTeamV2Command(command, dependencies) {
         if (!(await stat(workspace)).isDirectory() || inside(workspace, directory) || inside(directory, workspace))
             throw new Error("Team data directory must be outside and not overlap the source workspace");
         const mode = command.mode ?? "read-only";
-        const plan = command.planPath ? await loadTeamPlan(command.planPath, { mode })
-            : createTeamPreset(command.preset ?? "supervisor", command.value, { mode, ...(command.model ? { model: command.model } : {}) });
+        const plan = command.planPath
+            ? await loadTeamPlan(command.planPath, { mode })
+            : createTeamPreset(command.preset ?? "supervisor", command.value, {
+                mode,
+                ...(command.model ? { model: command.model } : {}),
+            });
         config = await (dependencies.loadConfig ?? loadMayConfig)(command.configPath ? { path: command.configPath } : {});
-        const fallback = command.model ?? (Object.values(plan.roles).every((role) => role.model !== undefined) ? Object.values(plan.roles)[0].model : undefined);
+        const fallback = command.model ??
+            (Object.values(plan.roles).every((role) => role.model !== undefined)
+                ? Object.values(plan.roles)[0].model
+                : undefined);
         const defaultModel = selectMaybeCodeModel(config, fallback ? { model: fallback } : {});
         const roleModels = {};
         for (const [name, role] of Object.entries(plan.roles)) {
             const selected = selectMaybeCodeModel(config, { model: role.model ?? defaultModel.profile });
-            const runBudget = resolveRunBudget(resolveRunBudget(config.apps?.maybecode?.runBudget, DEFAULT_RUN_BUDGET), role.runBudget);
+            const runBudget = resolveRunBudget(resolveRunBudget(readMaybeCodeSettings(config).runBudget, DEFAULT_RUN_BUDGET), role.runBudget);
             roleModels[name] = { profile: selected.profile, fingerprint: modelFingerprint(selected), runBudget };
         }
-        manifest = { format: 1, version: VERSION, id, createdAt: new Date().toISOString(), workspace, configPath: resolve(config.path),
-            model: defaultModel.profile, prompt: command.value, mode, allowChecks: command.allowChecks === true, plan, roleModels,
-            maxModelCalls: command.maxModelCalls ?? 32, maxTotalTokens: command.maxTotalTokens ?? 524_288,
-            maxConcurrent: command.maxConcurrent ?? plan.limits?.maxConcurrent ?? 2 };
+        manifest = {
+            execution: readMaybeCodeSettings(config).execution ?? { mode: "host" },
+            fetch: readMaybeCodeSettings(config).fetch ?? {},
+            format: 1,
+            version: VERSION,
+            id,
+            createdAt: new Date().toISOString(),
+            workspace,
+            configPath: resolve(config.path),
+            model: defaultModel.profile,
+            prompt: command.value,
+            mode,
+            allowChecks: command.allowChecks === true,
+            plan,
+            roleModels,
+            maxModelCalls: command.maxModelCalls ?? 32,
+            maxTotalTokens: command.maxTotalTokens ?? 524_288,
+            maxConcurrent: command.maxConcurrent ?? plan.limits?.maxConcurrent ?? 2,
+        };
         validateManifest(manifest, id);
         await mkdir(directory, { recursive: true, mode: 0o700 });
         await writeJson(join(directory, "manifest.json"), manifest, true);
@@ -69,7 +94,7 @@ export async function runTeamV2Command(command, dependencies) {
             write(`Last acceptance projection (may be stale): ${await withFileAccess(path, "shared", () => readFile(path, "utf8"))}\n`);
         }
         catch (error) {
-            if (!isMissing(error))
+            if (!hasErrorCode(error, "ENOENT"))
                 throw error;
         }
         return 0;
@@ -81,8 +106,10 @@ export async function runTeamV2Command(command, dependencies) {
     }
     const executes = command.action === "run" || command.action === "resume";
     const selections = new Map();
+    let recording;
     if (executes) {
         config ??= await (dependencies.loadConfig ?? loadMayConfig)({ path: manifest.configPath });
+        recording = resolveMaybeCodeRecording(config);
         for (const [name, binding] of Object.entries(manifest.roleModels)) {
             const selected = selectMaybeCodeModel(config, { model: binding.profile });
             if (modelFingerprint(selected) !== binding.fingerprint)
@@ -91,6 +118,13 @@ export async function runTeamV2Command(command, dependencies) {
         }
     }
     const ledger = await FileSharedBudget.open(join(directory, "budget"), id, budgetLimits);
+    const settings = readMaybeCodeSettings({
+        providers: {},
+        models: {},
+        path: manifest.configPath,
+        apps: { maybecode: { execution: manifest.execution ?? { mode: "host" }, fetch: manifest.fetch ?? {} } },
+    });
+    const executionEnvironments = new TeamExecutionEnvironments(settings.execution);
     let workspaces;
     let artifacts;
     let verification;
@@ -99,13 +133,46 @@ export async function runTeamV2Command(command, dependencies) {
     let timer;
     let cancelling;
     let retryAuthorized = false;
-    const cancel = () => { if (runtime)
-        cancelling ??= runtime.cancel(`cancel-${id}`); void cancelling?.catch(() => undefined); };
+    const backgroundTasks = new Set();
+    const backgroundErrors = [];
+    let failBackground;
+    const backgroundFailed = new Promise((resolve) => {
+        failBackground = resolve;
+    });
+    const trackBackground = (operation) => {
+        const task = operation.then(() => {
+            backgroundTasks.delete(task);
+        }, (error) => {
+            backgroundTasks.delete(task);
+            backgroundErrors.push(error);
+            failBackground(error);
+            cancel();
+        });
+        backgroundTasks.add(task);
+    };
+    const cancel = () => {
+        if (runtime && !cancelling) {
+            cancelling = runtime.cancel(`cancel-${id}`);
+            trackBackground(cancelling);
+        }
+    };
     try {
-        artifacts = await FileArtifactStore.open(join(directory, "artifacts"), id, { policyVersion: VERSION,
-            authorizeRead: () => true, maxArtifacts: 256, maxArtifactBytes: 262_144, maxTotalBytes: 16_777_216 });
-        workspaces = await TaskWorkspaceManager.open({ sourceDirectory: manifest.workspace, directory: join(directory, "workspaces") });
-        verification = await TeamVerificationStore.open({ directory: join(directory, "verification"), checks: manifest.plan.checks });
+        artifacts = await FileArtifactStore.open(join(directory, "artifacts"), id, {
+            policyVersion: VERSION,
+            authorizeRead: () => true,
+            maxArtifacts: 256,
+            maxArtifactBytes: 262_144,
+            maxTotalBytes: 16_777_216,
+        });
+        workspaces = await TaskWorkspaceManager.open({
+            sourceDirectory: manifest.workspace,
+            directory: join(directory, "workspaces"),
+        });
+        verification = await TeamVerificationStore.open({
+            directory: join(directory, "verification"),
+            checks: manifest.plan.checks,
+            executionFor: (workspace) => executionEnvironments.get(workspace),
+        });
         const sessionStore = new FileSessionStore(join(directory, "sessions"));
         const models = new Map();
         const modelFor = (name) => {
@@ -115,42 +182,86 @@ export async function runTeamV2Command(command, dependencies) {
                 if (!selected)
                     throw new Error("A host control command cannot start a model");
                 const maxOutputTokens = Math.min(4096, selected.limits?.maxOutputTokens ?? 4096, ...[selected.options.maxTokens, selected.options.maxOutputTokens].filter((n) => typeof n === "number" && n > 0 && Number.isSafeInteger(n)));
-                const selection = { ...selected, options: { ...selected.options, maxTokens: maxOutputTokens, maxOutputTokens },
-                    limits: { ...selected.limits, maxOutputTokens } };
-                model = ledger.wrapModel((dependencies.createModel ?? createMaybeCodeModel)(selection), { reservation: { totalTokens: RESERVATION } });
+                const selection = {
+                    ...selected,
+                    options: { ...selected.options, maxTokens: maxOutputTokens, maxOutputTokens },
+                    limits: { ...selected.limits, maxOutputTokens },
+                };
+                model = ledger.wrapModel((dependencies.createModel ?? createMaybeCodeModel)(selection), {
+                    reservation: { totalTokens: RESERVATION },
+                });
                 models.set(name, model);
             }
             return model;
         };
         const agents = {};
         for (const [name, role] of Object.entries(manifest.plan.roles)) {
-            const scoped = (execution, workspace) => createApplicationAgent({ version: authorityVersion, store: sessionStore,
-                delegation: role.delegateTo.length > 0, messaging: role.messaging,
-                definition: ({ tools }) => {
-                    const available = [createReadTool({ cwd: workspace, maxBytes: 262_144, maxLines: 160 }), createListTool(workspace),
-                        ...artifacts.forTask(execution.task.id).tools(), ...verification.forTask(execution, workspace, { allowCommands: manifest.allowChecks }).tools(),
-                        ...(manifest.mode === "coding" ? [createWriteTool({ cwd: workspace, maxBytes: 262_144 }), createEditTool({ cwd: workspace, maxBytes: 262_144 })] : [])];
-                    const selectedTools = available.filter((tool) => role.tools.includes(tool.name)).map((tool) => {
-                        if (!["write", "edit"].includes(tool.name))
-                            return tool;
-                        return { ...tool, async execute(input, context) {
-                                if ((await verification.snapshot()).checks.some((check) => check.status === "unknown" || (check.taskId === execution.task.id && check.status === "pending")))
-                                    throw new Error("Pending or unknown check effects block editing; stop and reconcile uncertain processes first");
-                                return tool.execute(input, context);
-                            } };
-                    });
-                    const allowed = new Set([...selectedTools, ...tools].map((tool) => tool.name));
-                    const roleBudget = manifest.roleModels[name].runBudget;
-                    const budget = config ? resolveRunBudget(roleBudget, config.apps?.maybecode?.runBudget) : roleBudget;
-                    return defineAgent({ model: modelFor(name), tools: [...selectedTools, ...tools], runBudget: budget,
-                        instructions: instructions(manifest, name, role), toolScope: { workspaceId: workspace },
-                        permissionPolicy: (check) => allowed.has(check.tool.name) ? "allow" : "deny" });
-                },
-            });
+            const scoped = async (execution, workspace) => {
+                const environment = await executionEnvironments.get(workspace);
+                return createApplicationAgent({
+                    version: authorityVersion,
+                    store: sessionStore,
+                    delegation: role.delegateTo.length > 0,
+                    messaging: role.messaging,
+                    definition: ({ tools }) => {
+                        const available = [
+                            createReadTool({ cwd: workspace, maxBytes: 262_144, maxLines: 160 }),
+                            createGlobTool({ cwd: workspace, execution: environment }),
+                            createGrepTool({ cwd: workspace, execution: environment }),
+                            createFetchTool(settings?.fetch ?? {}),
+                            createListTool(workspace),
+                            ...artifacts.forTask(execution.task.id).tools(),
+                            ...verification.forTask(execution, workspace, { allowCommands: manifest.allowChecks }).tools(),
+                            ...(manifest.mode === "coding"
+                                ? [
+                                    createWriteTool({ cwd: workspace, maxBytes: 262_144 }),
+                                    createEditTool({ cwd: workspace, maxBytes: 262_144 }),
+                                ]
+                                : []),
+                        ];
+                        const selectedTools = available
+                            .filter((tool) => role.tools.includes(tool.name))
+                            .map((tool) => {
+                            if (!["write", "edit"].includes(tool.name))
+                                return tool;
+                            return {
+                                ...tool,
+                                async execute(input, context) {
+                                    if ((await verification.snapshot()).checks.some((check) => check.status === "unknown" ||
+                                        (check.taskId === execution.task.id && check.status === "pending")))
+                                        throw new Error("Pending or unknown check effects block editing; stop and reconcile uncertain processes first");
+                                    return tool.execute(input, context);
+                                },
+                            };
+                        });
+                        const allowed = new Set([...selectedTools, ...tools].map((tool) => tool.name));
+                        const roleBudget = manifest.roleModels[name].runBudget;
+                        const budget = config ? resolveRunBudget(roleBudget, readMaybeCodeSettings(config).runBudget) : roleBudget;
+                        if (!recording)
+                            throw new Error("A host control command cannot start a model");
+                        return defineAgent({
+                            ...recording,
+                            model: modelFor(name),
+                            tools: [...selectedTools, ...tools],
+                            runBudget: budget,
+                            instructions: instructions(manifest, name, role),
+                            toolScope: { workspaceId: workspace },
+                            permissionPolicy: (check) => (allowed.has(check.tool.name) ? "allow" : "deny"),
+                        });
+                    },
+                });
+            };
             const publish = async (execution, output) => {
-                await artifacts.forTask(execution.task.id).publish(`${execution.task.dispatchId}-${execution.task.turn ?? 0}-final`, { name: `${execution.task.id.slice(0, 100)}-result.md`, text: output.text, mimeType: "text/markdown" });
+                await artifacts
+                    .forTask(execution.task.id)
+                    .publish(`${execution.task.dispatchId}-${execution.task.turn ?? 0}-final`, {
+                    name: `${execution.task.id.slice(0, 100)}-result.md`,
+                    text: output.text,
+                    mimeType: "text/markdown",
+                });
             };
-            agents[name] = { version: authorityVersion,
+            agents[name] = {
+                version: authorityVersion,
                 async execute(execution, context) {
                     if ((await verification.snapshot()).checks.some((check) => check.status === "unknown"))
                         throw new Error("Unknown check effects block a new Agent Run; reconcile before retrying");
@@ -159,15 +270,25 @@ export async function runTeamV2Command(command, dependencies) {
                     for (const dependency of execution.dependencies) {
                         const source = await workspaces.prepare(dependency.taskId);
                         const acceptance = await verification.acceptance(dependency.taskId, source.directory, executionOf(runtime.snapshot(), dependency.taskId));
-                        const record = { taskId: dependency.taskId, status: acceptance.status, workspaceFingerprint: acceptance.workspaceFingerprint,
-                            checks: acceptance.checks.slice(0, 16), checksTruncated: acceptance.checks.length > 16,
+                        const record = {
+                            taskId: dependency.taskId,
+                            status: acceptance.status,
+                            workspaceFingerprint: acceptance.workspaceFingerprint,
+                            checks: acceptance.checks.slice(0, 16),
+                            checksTruncated: acceptance.checks.length > 16,
                             evidenceValid: acceptance.report?.evidence.every((item) => item.valid) ?? false,
-                            detail: acceptance.detail };
-                        dependencyResults.push({ ...dependency, output: { ...dependency.output,
-                                text: `${dependency.output.text}\n\nHost verification record (scoped to that task's private workspace, not the source checkout or every claim):\n${JSON.stringify(record)}` } });
+                            detail: acceptance.detail,
+                        };
+                        dependencyResults.push({
+                            ...dependency,
+                            output: {
+                                ...dependency.output,
+                                text: `${dependency.output.text}\n\nHost verification record (scoped to that task's private workspace, not the source checkout or every claim):\n${JSON.stringify(record)}`,
+                            },
+                        });
                     }
                     const submitted = { ...execution, dependencies: dependencyResults };
-                    const output = await scoped(submitted, isolated.directory).execute(submitted, context);
+                    const output = await (await scoped(submitted, isolated.directory)).execute(submitted, context);
                     if (!("yielded" in output)) {
                         await publish(execution, output);
                         // Only deterministic file checks run automatically; command checks need explicit invocation.
@@ -178,24 +299,35 @@ export async function runTeamV2Command(command, dependencies) {
                     return output;
                 },
                 async recover(execution) {
-                    const output = await scoped(execution, manifest.workspace).recover(execution);
+                    const output = await (await scoped(execution, manifest.workspace)).recover(execution);
                     if (output.status === "completed")
                         await publish(execution, output.output);
                     return output;
-                }, };
+                },
+            };
         }
-        const options = { id, store: new FileCoordinationStore(join(directory, "coordination")), agents,
-            policy: { version: authorityVersion,
+        const options = {
+            id,
+            store: new FileCoordinationStore(join(directory, "coordination")),
+            agents,
+            policy: {
+                version: authorityVersion,
                 authorize: (task) => Object.hasOwn(manifest.plan.roles, task.agent),
                 authorizeDelegation: (parent, child) => manifest.plan.roles[parent.agent]?.delegateTo.includes(child.agent) === true,
-                authorizeMessage: (sender, recipient) => manifest.plan.roles[sender.agent]?.messaging === true && manifest.plan.roles[recipient.agent]?.messaging === true,
+                authorizeMessage: (sender, recipient) => manifest.plan.roles[sender.agent]?.messaging === true &&
+                    manifest.plan.roles[recipient.agent]?.messaging === true,
                 authorizeRetry: (task, finding) => {
                     if (retryAuthorized)
                         return true;
                     // Dispatch rechecks the exact durable host approval, not an ephemeral CLI flag.
                     const state = runtime?.snapshot(), current = state?.tasks.find((entry) => entry.id === task.id);
                     const previous = current?.attempts?.at(-1);
-                    if (current?.status !== "queued" || !previous || previous.task.dispatchId !== task.dispatchId || previous.task.sessionId !== task.sessionId || previous.finding !== finding || !/^retry-[a-f0-9]{64}$/u.test(previous.commandId))
+                    if (current?.status !== "queued" ||
+                        !previous ||
+                        previous.task.dispatchId !== task.dispatchId ||
+                        previous.task.sessionId !== task.sessionId ||
+                        previous.finding !== finding ||
+                        !/^retry-[a-f0-9]{64}$/u.test(previous.commandId))
                         return false;
                     const receipt = state?.commands[previous.commandId];
                     if (!receipt)
@@ -203,10 +335,26 @@ export async function runTeamV2Command(command, dependencies) {
                     const value = JSON.parse(receipt);
                     return value.type === "retry" && value.taskId === task.id && value.finding === finding;
                 },
-            } };
-        runtime = command.action === "run" ? await CoordinationRuntime.create({ ...options, tasks: manifest.plan.tasks,
-            limits: { maxTasks: 128, maxDepth: 2, maxTaskTurns: 4, maxDurationMs: 600_000, maxOutputBytes: 65_536,
-                maxMessages: 24, maxMessageBytes: 8192, ...manifest.plan.limits, maxConcurrent: manifest.maxConcurrent } }) : await CoordinationRuntime.resume(options);
+            },
+        };
+        runtime =
+            command.action === "run"
+                ? await CoordinationRuntime.create({
+                    ...options,
+                    tasks: manifest.plan.tasks,
+                    limits: {
+                        maxTasks: 128,
+                        maxDepth: 2,
+                        maxTaskTurns: 4,
+                        maxDurationMs: 600_000,
+                        maxOutputBytes: 65_536,
+                        maxMessages: 24,
+                        maxMessageBytes: 8192,
+                        ...manifest.plan.limits,
+                        maxConcurrent: manifest.maxConcurrent,
+                    },
+                })
+                : await CoordinationRuntime.resume(options);
         write(`Team ${id}\nMode: ${manifest.mode}; source application requires a separate reviewed patch confirmation.\nRecords: ${directory}\n`);
         if (manifest.allowChecks)
             write("Configured test processes explicitly authorized; no OS sandbox or automatic dependency installation.\n");
@@ -220,16 +368,20 @@ export async function runTeamV2Command(command, dependencies) {
                             write(`[${task.id}] ${task.status}${task.detail ? `: ${task.detail}` : ""}\n`);
                         }
                 }
-                else if (event.type === "agent.event" && event.event.type === "run.event" && event.event.event.type === "tool.started")
+                else if (event.type === "agent.event" &&
+                    event.event.type === "run.event" &&
+                    event.event.event.type === "tool.started")
                     write(`[${event.taskId}] tool ${event.event.event.call.name}\n`);
                 else if (event.type === "runtime.failed")
                     write("Team runtime failed; inspect recovery records.\n");
             }
         })();
-        void relay.catch(cancel);
+        trackBackground(relay);
         if (command.action === "retry" || command.action === "reconcile") {
             const state = runtime.snapshot(), budget = await ledger.snapshot(), checks = await verification.snapshot();
-            const operation = command.action === "retry" ? retryImpact(state, command.task, command.finding) : await readTeamResolution(command.resolutionPath);
+            const operation = command.action === "retry"
+                ? retryImpact(state, command.task, command.finding)
+                : await readTeamResolution(command.resolutionPath);
             // Resume may repeat evidence inspection and increment revision without changing meaning.
             const { revision: _revision, ...stableState } = state;
             const digest = teamReviewDigest({ operation, state: stableState, budget, checks });
@@ -241,7 +393,8 @@ export async function runTeamV2Command(command, dependencies) {
             if (command.confirm !== digest)
                 throw new Error("Review digest changed or mismatched; inspect a fresh preview");
             if (command.action === "retry") {
-                if ((await ledger.totals()).blocked || checks.checks.some((check) => ["unknown", "pending"].includes(check.status)))
+                if ((await ledger.totals()).blocked ||
+                    checks.checks.some((check) => ["unknown", "pending"].includes(check.status)))
                     throw new Error("Reconcile unknown usage/check effects before retrying; no reset or replay is allowed");
                 retryAuthorized = true;
                 await runtime.retryTask(`retry-${digest}`, command.task, command.finding);
@@ -253,7 +406,10 @@ export async function runTeamV2Command(command, dependencies) {
                 else if (resolution.kind === "check")
                     await verification.reconcile(resolution.commandId, { status: resolution.outcome }, resolution.finding);
                 else
-                    await runtime.resolveRecovery(`resolve-${digest}`, resolution.taskId, resolution.finding, { status: resolution.outcome, detail: resolution.finding });
+                    await runtime.resolveRecovery(`resolve-${digest}`, resolution.taskId, resolution.finding, {
+                        status: resolution.outcome,
+                        detail: resolution.finding,
+                    });
             }
             write("Recorded. No agents or checks executed. Use team resume explicitly when ready.\n");
             return 0;
@@ -266,7 +422,9 @@ export async function runTeamV2Command(command, dependencies) {
                 throw new Error("Settle all active/unknown team work before reviewing or applying a patch");
             if (command.action === "diff") {
                 const taskIds = command.tasks.split(",");
-                if (!taskIds.length || new Set(taskIds).size !== taskIds.length || taskIds.some((id) => state.tasks.find((task) => task.id === id)?.status !== "completed"))
+                if (!taskIds.length ||
+                    new Set(taskIds).size !== taskIds.length ||
+                    taskIds.some((id) => state.tasks.find((task) => task.id === id)?.status !== "completed"))
                     throw new Error("Select distinct completed task ids for review");
                 const patch = await createTeamPatch({ directory, workspaces, taskIds });
                 write(renderTeamPatchDiff(patch));
@@ -274,22 +432,31 @@ export async function runTeamV2Command(command, dependencies) {
                 return 0;
             }
             const patch = await readTeamPatch(directory, command.patch);
-            const uncheckedTasks = patch.taskSnapshots.map((task) => task.taskId).filter((taskId) => !manifest.plan.checks.some((check) => check.taskId === taskId));
+            const uncheckedTasks = patch.taskSnapshots
+                .map((task) => task.taskId)
+                .filter((taskId) => !manifest.plan.checks.some((check) => check.taskId === taskId));
             if (uncheckedTasks.length)
                 write(`Unverified patch tasks (human review only): ${uncheckedTasks.join(", ")}. Other tasks' passing checks do not verify these edits.\n`);
-            if ((await ledger.totals()).blocked || (await verification.snapshot()).checks.some((check) => ["pending", "unknown"].includes(check.status)))
+            if ((await ledger.totals()).blocked ||
+                (await verification.snapshot()).checks.some((check) => ["pending", "unknown"].includes(check.status)))
                 throw new Error("Reconcile unknown team effects before applying source changes");
             for (const checkTaskId of new Set(manifest.plan.checks.map((check) => check.taskId))) {
                 const task = state.tasks.find((task) => task.id === checkTaskId);
                 if (task?.status !== "completed")
                     throw new Error("All configured acceptance tasks must complete before source application");
                 const workspace = await workspaces.prepare(checkTaskId);
-                if ((await verification.acceptance(checkTaskId, workspace.directory, executionOf(state, checkTaskId))).status !== "passed")
+                if ((await verification.acceptance(checkTaskId, workspace.directory, executionOf(state, checkTaskId))).status !==
+                    "passed")
                     throw new Error(`Acceptance is not passed/current for ${checkTaskId}; use team verify and inspect reports`);
             }
             if (!manifest.plan.checks.length)
                 write("No configured acceptance checks: this is an explicit human-reviewed, unverified source application.\n");
-            const result = await applyTeamPatch({ directory, workspaces, patchId: patch.id, confirmDigest: command.confirm });
+            const result = await applyTeamPatch({
+                directory,
+                workspaces,
+                patchId: patch.id,
+                confirmDigest: command.confirm,
+            });
             write(`${JSON.stringify(result, null, 2)}\n`);
             return result.status === "applied" ? 0 : 1;
         }
@@ -305,14 +472,16 @@ export async function runTeamV2Command(command, dependencies) {
                     controller.abort("Team verification cancelled");
                 }
                 catch (error) {
-                    if (!isMissing(error)) {
+                    if (!hasErrorCode(error, "ENOENT")) {
                         controller.abort("Cannot establish cancellation state");
                         throw error;
                     }
                 }
             };
             await observeCancellation();
-            timer = setInterval(() => { void observeCancellation().catch(() => controller.abort("Cancellation monitoring failed")); }, 300);
+            timer = setInterval(() => {
+                trackBackground(observeCancellation());
+            }, 300);
             const state = runtime.snapshot();
             for (const check of manifest.plan.checks) {
                 if (signal.aborted) {
@@ -324,7 +493,11 @@ export async function runTeamV2Command(command, dependencies) {
                     continue;
                 }
                 const workspace = await workspaces.prepare(check.taskId);
-                const result = await verification.runCheck(`host-${randomUUID()}`, check, workspace.directory, { allowCommands: manifest.allowChecks, signal, execution: executionOf(state, check.taskId) });
+                const result = await verification.runCheck(`host-${randomUUID()}`, check, workspace.directory, {
+                    allowCommands: manifest.allowChecks,
+                    signal,
+                    execution: executionOf(state, check.taskId),
+                });
                 write(`Check ${check.id}: ${result.status}${result.detail ? ` (${result.detail})` : ""}\n`);
             }
             const acceptance = await summarizeAcceptance(directory, state, manifest, workspaces, verification);
@@ -338,7 +511,7 @@ export async function runTeamV2Command(command, dependencies) {
                 cancel();
             }
             catch (error) {
-                if (!isMissing(error)) {
+                if (!hasErrorCode(error, "ENOENT")) {
                     cancel();
                     throw error;
                 }
@@ -348,13 +521,21 @@ export async function runTeamV2Command(command, dependencies) {
         await checkCancellation();
         if (dependencies.signal?.aborted)
             cancel();
-        timer = setInterval(() => { void checkCancellation().catch(cancel); }, 300);
+        timer = setInterval(() => {
+            trackBackground(checkCancellation());
+        }, 300);
         await cancelling;
-        if ((await ledger.totals()).blocked || (await verification.snapshot()).checks.some((check) => check.status === "unknown")) {
+        if ((await ledger.totals()).blocked ||
+            (await verification.snapshot()).checks.some((check) => check.status === "unknown")) {
             write("Unknown usage/check effects or exceeded budget block execution. No new Run started; inspect and reconcile explicitly.\n");
             return 1;
         }
-        const result = await runtime.wait();
+        const result = await Promise.race([
+            runtime.wait(),
+            backgroundFailed.then((error) => {
+                throw error;
+            }),
+        ]);
         await cancelling;
         const final = result.tasks.find((task) => task.id === manifest.plan.resultTaskId);
         if (final?.output?.text)
@@ -376,11 +557,26 @@ export async function runTeamV2Command(command, dependencies) {
             clearInterval(timer);
         dependencies.signal?.removeEventListener("abort", cancel);
         try {
-            await runtime?.close();
-            await relay;
+            const results = await Promise.allSettled([...(runtime ? [runtime.close()] : []), ...(relay ? [relay] : [])]);
+            while (backgroundTasks.size)
+                await Promise.all(backgroundTasks);
+            const failures = [
+                ...new Set([
+                    ...backgroundErrors,
+                    ...results.flatMap((result) => (result.status === "rejected" ? [result.reason] : [])),
+                ]),
+            ];
+            if (failures.length)
+                throw new AggregateError(failures, "Team background operations failed");
         }
         finally {
-            await Promise.all([verification?.close(), workspaces?.close(), artifacts?.close(), ledger.close()]);
+            await Promise.all([
+                verification?.close(),
+                workspaces?.close(),
+                artifacts?.close(),
+                ledger.close(),
+                executionEnvironments.close(),
+            ]);
         }
     }
 }
@@ -403,14 +599,33 @@ async function summarizeAcceptance(directory, state, manifest, workspaces, verif
         }
     const required = [...new Set(manifest.plan.checks.map((check) => check.taskId))];
     const failed = Object.values(tasks).some((task) => task.status === "failed");
-    const status = failed ? "failed" : required.length && state.tasks.every((task) => task.status === "completed") && required.every((id) => tasks[id]?.status === "passed") ? "passed" : "unverified";
-    const result = { format: 1, revision: state.revision, status, tasks, note: "Scoped configured checks only, not proof of every natural-language claim. Verify rechecks exact workspace fingerprints." };
+    const status = failed
+        ? "failed"
+        : required.length &&
+            state.tasks.every((task) => task.status === "completed") &&
+            required.every((id) => tasks[id]?.status === "passed")
+            ? "passed"
+            : "unverified";
+    const result = {
+        format: 1,
+        revision: state.revision,
+        status,
+        tasks,
+        note: "Scoped configured checks only, not proof of every natural-language claim. Verify rechecks exact workspace fingerprints.",
+    };
     await writeJson(join(directory, "acceptance.json"), result);
     return result;
 }
 function modelFingerprint(selection) {
-    return teamReviewDigest({ profile: selection.profile, provider: selection.provider, adapter: selection.adapter, model: selection.model,
-        options: selection.options, baseURL: selection.providerConfig.baseURL, limits: selection.limits });
+    return teamReviewDigest({
+        profile: selection.profile,
+        provider: selection.provider,
+        adapter: selection.adapter,
+        model: selection.model,
+        options: selection.options,
+        baseURL: selection.providerConfig.baseURL,
+        limits: selection.limits,
+    });
 }
 async function readManifest(directory, id) {
     const path = join(directory, "manifest.json");
@@ -423,10 +638,22 @@ async function readManifest(directory, id) {
     });
 }
 function validateManifest(value, id) {
-    if (!value || value.format !== 1 || value.version !== VERSION || value.id !== id || !isAbsolute(value.workspace) || !isAbsolute(value.configPath) || typeof value.prompt !== "string" || typeof value.model !== "string" || !["coding", "read-only"].includes(value.mode) || typeof value.allowChecks !== "boolean")
+    if (!value ||
+        value.format !== 1 ||
+        value.version !== VERSION ||
+        value.id !== id ||
+        !isAbsolute(value.workspace) ||
+        !isAbsolute(value.configPath) ||
+        typeof value.prompt !== "string" ||
+        typeof value.model !== "string" ||
+        !["coding", "read-only"].includes(value.mode) ||
+        typeof value.allowChecks !== "boolean")
         throw new Error("Invalid v2 team manifest");
     parseTeamPlan(value.plan, { mode: value.mode });
-    if (![value.maxModelCalls, value.maxTotalTokens, value.maxConcurrent].every((n) => Number.isSafeInteger(n) && n > 0) || value.maxModelCalls > 10_000 || value.maxConcurrent > 8 || value.maxTotalTokens < RESERVATION)
+    if (![value.maxModelCalls, value.maxTotalTokens, value.maxConcurrent].every((n) => Number.isSafeInteger(n) && n > 0) ||
+        value.maxModelCalls > 10_000 ||
+        value.maxConcurrent > 8 ||
+        value.maxTotalTokens < RESERVATION)
         throw new Error("Invalid team limits; token budget must hold at least 32768 tokens");
     if (!value.roleModels || Object.keys(value.roleModels).length !== Object.keys(value.plan.roles).length)
         throw new Error("Invalid role model bindings");
@@ -438,27 +665,30 @@ function validateManifest(value, id) {
     }
 }
 async function writeJson(path, value, exclusive = false) {
+    const contents = `${JSON.stringify(value, null, 2)}\n`;
     await withFileAccess(path, "exclusive", async () => {
-        const target = exclusive ? path : `${path}.${randomUUID()}.tmp`;
-        const file = await open(target, "wx", 0o600);
+        if (!exclusive)
+            return writeFileAtomic(path, contents, { mode: 0o600 });
+        const file = await open(path, "wx", 0o600);
         try {
-            await file.writeFile(`${JSON.stringify(value, null, 2)}\n`);
+            await file.writeFile(contents);
             await file.sync();
         }
         finally {
             await file.close();
         }
-        if (!exclusive)
-            await rename(target, path);
     });
 }
-function inside(root, path) { const child = relative(root, path); return child === "" || (!isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`)); }
+function inside(root, path) {
+    const child = relative(root, path);
+    return child === "" || (!isAbsolute(child) && child !== ".." && !child.startsWith(`..${sep}`));
+}
 async function canonicalPotentialPath(path) {
     try {
         return await realpath(path);
     }
     catch (error) {
-        if (!isMissing(error))
+        if (!hasErrorCode(error, "ENOENT"))
             throw error;
         const parent = dirname(path);
         if (parent === path)
@@ -466,6 +696,7 @@ async function canonicalPotentialPath(path) {
         return join(await canonicalPotentialPath(parent), relative(parent, path));
     }
 }
-function safeTerminal(text) { return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/gu, ""); }
-function isMissing(error) { return !!error && typeof error === "object" && "code" in error && error.code === "ENOENT"; }
+function safeTerminal(text) {
+    return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/gu, "");
+}
 //# sourceMappingURL=team-v2.js.map