@tea-agent/loop-agent 0.33.6 → 0.33.7-beta.1

package/dist/worker/console/static-src/operator-chat/useRuntimeControls.js

@@ -1,44 +1,19 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { formatModelRef, mergeSessionRuntime, sessionRuntimeMatches, } from "../../chat/runtime-selection.js";
+import { formatModelRef, mergeSessionRuntime, runtimeSelectionFromRecord, sessionRuntimeMatches, } from "../../chat/runtime-selection.js";
 import { confirmationToken } from "./format.js";
-import { mergeRuntimeContextWithSnapshot, runtimeSelectionFromSnapshot, } from "./runtime-snapshot-store.js";
 import { buildToolCatalog } from "./tools-catalog.js";
-import { adoptMutationSnapshot, dispatchRuntimeSnapshot, getRuntimeSnapshotState, refreshRuntimeSnapshot, settleMutationLifecycle, useRuntimeSnapshot, } from "./useRuntimeSnapshot.js";
-/**
- * Monotonic mutation sequence shared across switchRuntime calls (RF-04). Each
- * mutation captures its own token; only the LATEST started token may settle
- * mutationBusy/switching, so a slow earlier response can never clear busy
- * while a newer mutation is still in flight.
- */
-let mutationSeq = 0;
 /** Capabilities catalog, model / thinking-level switcher, runtime-context
  *  popover and the outside-click dismissal for both transient menus. */
 export function useRuntimeControls(params) {
     const { origin, session, setSession, refs, setError } = params;
     const [capabilities, setCapabilities] = useState(null);
     const [models, setModels] = useState([]);
-    const [modelsStatus, setModelsStatus] = useState("idle");
-    const [modelsError, setModelsError] = useState(null);
     const [thinkingLevels, setThinkingLevels] = useState([]);
     const [runtimeContext, setRuntimeContext] = useState(null);
-    const [runtimeContextError, setRuntimeContextError] = useState(null);
-    const [switching, setSwitching] = useState(false);
     const [toolsOpen, setToolsOpen] = useState(false);
     const [runtimeContextOpen, setRuntimeContextOpen] = useState(false);
     const toolsMenuRef = useRef(null);
     const runtimeContextMenuRef = useRef(null);
-    const switchTokenRef = useRef(0);
-    // RF3-02: a session switch immediately abandons the in-flight mutation
-    // lifecycle — the local token is invalidated and switching cleared, so a
-    // late response from the previous session can never settle the new
-    // session's busy/switching. (The store side is reset synchronously by
-    // attachRuntimeSnapshotController's mutation-reset.)
-    useEffect(() => {
-        switchTokenRef.current = -1;
-        setSwitching(false);
-    }, [session?.sessionId, setSwitching]);
-    const snapshotState = useRuntimeSnapshot();
-    const snapshot = snapshotState.snapshot;
     const loadCapabilities = useCallback(async () => {
         try {
             const res = await fetch(`${origin}/api/operator/v1/chat/capabilities`);
@@ -54,202 +29,106 @@ export function useRuntimeControls(params) {
     useEffect(() => {
         void loadCapabilities();
     }, [loadCapabilities]);
-    // Models + thinking levels: AC-01/AC-06 — the GET may reopen a historical
-    // session server-side; a failure is a STRUCTURED error state (with retry),
-    // never silently folded into an empty list.
-    const loadModels = useCallback(async () => {
+    useEffect(() => {
         if (!session) {
             setModels([]);
-            setModelsStatus("idle");
+            setRuntimeContext(null);
             return;
         }
         const sessionId = session.sessionId;
-        setModelsStatus("loading");
-        setModelsError(null);
-        try {
-            const res = await fetch(`${origin}/api/operator/v1/chat/sessions/${encodeURIComponent(sessionId)}/models`, { credentials: "include" });
-            const body = (await res.json().catch(() => null));
+        const base = `${origin}/api/operator/v1/chat/sessions/${encodeURIComponent(sessionId)}`;
+        void fetch(`${base}/models`, { credentials: "include" })
+            .then((r) => (r.ok ? r.json() : null))
+            .then((body) => {
             // Guard against a stale response landing after the user switched/
             // created/forked a session: only adopt models for the session we
             // actually requested them for.
-            if (refs.sessionRef.current?.sessionId !== sessionId)
-                return;
-            if (!res.ok || !body) {
-                setModelsStatus("error");
-                setModelsError(body
-                    ?.error?.message ?? `模型列表读取失败（HTTP ${res.status}）`);
+            if (!body || refs.sessionRef.current?.sessionId !== sessionId)
                 return;
-            }
             setModels(body.models ?? []);
             setThinkingLevels(body.thinkingLevels ?? []);
-            setModelsStatus("ready");
-        }
-        catch (reason) {
-            if (refs.sessionRef.current?.sessionId !== sessionId)
-                return;
-            setModelsStatus("error");
-            setModelsError(reason instanceof Error ? reason.message : String(reason));
-        }
-    }, [origin, session, refs]);
-    useEffect(() => {
-        void loadModels();
-    }, [loadModels]);
-    useEffect(() => {
-        if (!session) {
-            setRuntimeContext(null);
-            setRuntimeContextError(null);
-            return;
-        }
-        const sessionId = session.sessionId;
-        const base = `${origin}/api/operator/v1/chat/sessions/${encodeURIComponent(sessionId)}`;
-        setRuntimeContextError(null);
+        });
         void fetch(`${base}/runtime-context`, { credentials: "include" })
-            .then(async (r) => {
-            const body = await r.json().catch(() => null);
+            .then((r) => (r.ok ? r.json() : null))
+            .then((body) => {
             // Stale-response guard: a slow runtime-context reply for session A
             // must not overwrite the context/session state of the now-current
             // session B.
             if (!body?.context || refs.sessionRef.current?.sessionId !== sessionId)
                 return;
-            // RF5: the response body NEVER writes model/thinkingLevel — it
-            // carries no revision semantics, so a late reply for the same
-            // session could hold a stale selection. Selection is derived only
-            // from the LATEST adopted snapshot, read HERE at .then time (right
-            // before the setRuntimeContext functional updater runs) via the
-            // production read-only accessor getRuntimeSnapshotState() — the
-            // only immediate authority when the store has already adopted a
-            // new revision but this component has not rerendered yet. A
-            // render-synchronized value (snapshotRef) could still be the old
-            // revision in that window, so it is removed entirely.
-            // systemPrompt/resources/suffix/readOnly still come from the
-            // response. Zero session writes and zero store writes: the
-            // snapshot hydration effect never re-runs and the menu/popover
-            // selection never jumps back.
+            setRuntimeContext(body.context);
             const ctx = body.context;
-            const adoptedSnapshot = getRuntimeSnapshotState().snapshot;
-            setRuntimeContext((current) => mergeRuntimeContextWithSnapshot(current, ctx, adoptedSnapshot, sessionId));
-        })
-            .catch(() => {
-            if (refs.sessionRef.current?.sessionId !== sessionId)
-                return;
-            setRuntimeContextError("注入上下文读取失败，请重试");
+            const patch = {
+                model: ctx.model,
+                thinkingLevel: ctx.thinkingLevel,
+            };
+            setSession((current) => {
+                if (!current || current.sessionId !== sessionId)
+                    return current;
+                if (sessionRuntimeMatches(current, patch))
+                    return current;
+                const merged = mergeSessionRuntime(current, patch);
+                refs.sessionRef.current = merged;
+                return merged;
+            });
         });
-    }, [origin, session?.sessionId, refs]);
-    // AC-01/RF3-01: hydrate the Composer from the unified snapshot — real
-    // model and thinking selection; `auto` displays the Pi actual effective
-    // level. Derived session/runtimeContext state ONLY comes from a snapshot
-    // the reducer guards accepted: the mutation success branch never writes
-    // session/runtimeContext directly, so this effect re-runs on adoption and
-    // is a no-op for rejected/missing snapshots (zero derived writes).
-    useEffect(() => {
-        if (!snapshot || !session || snapshot.sessionId !== session.sessionId)
+    }, [origin, session?.sessionId, refs, setSession]);
+    const switchRuntime = useCallback(async (body) => {
+        if (!session)
+            return;
+        // Capture the target session so a slow model/thinking response cannot
+        // write its result into a different (newly created/forked/switched)
+        // session the user has since moved to.
+        const targetSessionId = session.sessionId;
+        const res = await fetch(`${origin}/api/operator/v1/chat/sessions/${encodeURIComponent(session.sessionId)}/model`, {
+            method: "POST",
+            credentials: "include",
+            headers: {
+                "content-type": "application/json",
+                "x-loop-console-confirmation": confirmationToken(),
+            },
+            body: JSON.stringify(body),
+        });
+        if (!res.ok) {
+            // Only surface the failure for the session that still owns it.
+            if (refs.sessionRef.current?.sessionId === targetSessionId)
+                setError("模型或思考等级切换失败");
+            return;
+        }
+        const payload = (await res.json().catch(() => ({})));
+        if (!payload.session)
+            return;
+        // Drop the result entirely if the active session changed mid-flight.
+        if (refs.sessionRef.current?.sessionId !== targetSessionId)
             return;
-        const patch = runtimeSelectionFromSnapshot(snapshot);
         setSession((current) => {
-            if (!current || current.sessionId !== snapshot.sessionId)
+            if (!current || current.sessionId !== targetSessionId)
                 return current;
+            const patch = runtimeSelectionFromRecord(payload.session);
             if (sessionRuntimeMatches(current, patch))
                 return current;
             const merged = mergeSessionRuntime(current, patch);
             refs.sessionRef.current = merged;
             return merged;
         });
-        setRuntimeContext((current) => {
-            if (!current)
-                return current;
-            const next = {
+        setRuntimeContext((current) => current
+            ? {
                 ...current,
-                ...(patch.model ? { model: patch.model } : {}),
-                ...(patch.thinkingLevel
-                    ? { thinkingLevel: patch.thinkingLevel }
+                ...(payload.session.modelProvider && payload.session.modelId
+                    ? {
+                        model: {
+                            provider: payload.session.modelProvider,
+                            modelId: payload.session.modelId,
+                        },
+                    }
                     : {}),
-            };
-            if (next.model?.provider === current.model?.provider &&
-                next.model?.modelId === current.model?.modelId &&
-                next.thinkingLevel === current.thinkingLevel) {
-                return current;
-            }
-            return next;
-        });
-    }, [snapshot, session?.sessionId, refs, setSession, setRuntimeContext]);
-    const switchRuntime = useCallback(async (body) => {
-        if (!session)
-            return false;
-        // Capture the target session so a slow model/thinking response cannot
-        // write its result into a different (newly created/forked/switched)
-        // session the user has since moved to.
-        const targetSessionId = session.sessionId;
-        // RF-04: token the mutation start; only the latest token's settle
-        // clears mutationBusy/switching (stale earlier settles can't win).
-        const token = ++mutationSeq;
-        switchTokenRef.current = token;
-        dispatchRuntimeSnapshot({ type: "mutation-start", token });
-        setSwitching(true);
-        try {
-            const res = await fetch(`${origin}/api/operator/v1/chat/sessions/${encodeURIComponent(session.sessionId)}/model`, {
-                method: "POST",
-                credentials: "include",
-                headers: {
-                    "content-type": "application/json",
-                    "x-loop-console-confirmation": confirmationToken(),
-                },
-                body: JSON.stringify(body),
-            });
-            const payload = (await res.json().catch(() => ({})));
-            // RF2-02: an out-of-order response (its token is no longer the
-            // latest started mutation) is dropped ENTIRELY on BOTH the success
-            // and the failure branch: no setSession/setRuntimeContext, no
-            // mutation-adopt, no busy settle, no refresh — the newest mutation
-            // owns the UI and a slow earlier reply can never overwrite it.
-            if (switchTokenRef.current !== token)
-                return false;
-            if (!res.ok) {
-                // RF2-01: a non-2xx response (e.g. 503 PI_RUNTIME_UNAVAILABLE —
-                // the mutation already applied server-side but the snapshot
-                // projection failed) for the still-current session shows the
-                // structured error, then triggers a REAL GET
-                // /runtime-snapshot so the store converges on the server
-                // selection via the load-success revision guard. When the
-                // session switched or the response is stale: no error, no
-                // refresh, no state writes.
-                if (refs.sessionRef.current?.sessionId === targetSessionId) {
-                    setError(payload.error?.message ??
-                        `模型或思考等级切换失败（HTTP ${res.status}）`);
-                    void refreshRuntimeSnapshot();
-                }
-                return false;
+                ...(payload.session.thinkingLevel
+                    ? { thinkingLevel: payload.session.thinkingLevel }
+                    : body.thinkingLevel
+                        ? { thinkingLevel: body.thinkingLevel }
+                        : {}),
             }
-            if (!payload.session)
-                return false;
-            // Drop the result entirely if the active session changed mid-flight.
-            if (refs.sessionRef.current?.sessionId !== targetSessionId)
-                return false;
-            // RF3-01: derived session/runtimeContext state is ONLY written from
-            // a snapshot the reducer's three guards (latest mutationToken,
-            // current sessionId, monotonic revision) accepted — no direct
-            // setSession/setRuntimeContext here. A missing snapshot returns
-            // false with zero derived writes; on adoption the hydrate effect
-            // derives session + runtimeContext from the adopted snapshot.
-            return adoptMutationSnapshot(token, targetSessionId, payload.snapshot);
-        }
-        catch (reason) {
-            // RF2-02: stale out-of-order network failures are dropped too —
-            // no error, no refresh, no state writes for an expired token.
-            if (switchTokenRef.current !== token)
-                return false;
-            if (refs.sessionRef.current?.sessionId === targetSessionId)
-                setError(reason instanceof Error ? reason.message : String(reason));
-            return false;
-        }
-        finally {
-            // RF3-02: settle only when the target session is still active and
-            // the token is still the latest — a late old-session response
-            // neither dispatches an effective settle nor clears the current
-            // busy/switching.
-            const settled = settleMutationLifecycle(token, targetSessionId, refs);
-            if (settled && switchTokenRef.current === token)
-                setSwitching(false);
-        }
+            : current);
     }, [origin, session, refs, setSession, setError]);
     // Close tools catalog on outside click / Escape.
     useEffect(() => {
@@ -300,46 +179,18 @@ export function useRuntimeControls(params) {
     const toolCatalog = useMemo(() => buildToolCatalog(capabilities), [
         capabilities,
     ]);
-    // Snapshot is the single source of truth when ready; the /models fetch
-    // result is the fallback (both hit the same backend, never fake-empty).
-    const effectiveModels = snapshot
-        ? (snapshot.models ?? []).map((model) => ({
-            provider: model.provider,
-            id: model.id,
-            ...(model.name ? { name: model.name } : {}),
-            ...(model.hasCredentials !== undefined
-                ? { hasCredentials: model.hasCredentials }
-                : {}),
-        }))
-        : models;
-    const effectiveThinkingLevels = snapshot?.thinkingLevels?.length
-        ? snapshot.thinkingLevels.map((option) => option.value)
-        : thinkingLevels;
     const activeModel = session?.model ?? runtimeContext?.model;
     const activeModelRef = activeModel
         ? formatModelRef(activeModel.provider, activeModel.modelId)
         : "";
-    // AC-01/AC-02: thinking selection shows "auto" when no explicit override,
-    // with the Pi effective level available separately for the badge.
-    const activeThinkingLevel = snapshot?.selection?.thinkingSelection ?? session?.thinkingLevel ?? "";
-    const effectiveThinkingLevel = snapshot?.selection?.effectiveThinkingLevel ??
-        session?.thinkingLevel ??
-        undefined;
+    const activeThinkingLevel = session?.thinkingLevel ?? runtimeContext?.thinkingLevel ?? "";
     const activeModelListed = !activeModelRef ||
-        effectiveModels.some((model) => formatModelRef(model.provider, model.id) === activeModelRef);
+        models.some((model) => formatModelRef(model.provider, model.id) === activeModelRef);
     return {
         capabilities,
-        models: effectiveModels,
-        modelsStatus,
-        modelsError,
-        onRetryModels: () => void loadModels(),
-        thinkingLevels: effectiveThinkingLevels,
+        models,
+        thinkingLevels,
         runtimeContext,
-        runtimeContextError,
-        onRetryRuntimeContext: () => {
-            setRuntimeContextError(null);
-            void refreshRuntimeSnapshot();
-        },
         toolsOpen,
         setToolsOpen,
         runtimeContextOpen,
@@ -347,12 +198,10 @@ export function useRuntimeControls(params) {
         toolsMenuRef,
         runtimeContextMenuRef,
         switchRuntime,
-        switching,
         toolCatalog,
         activeModel,
         activeModelRef,
         activeThinkingLevel,
-        effectiveThinkingLevel,
         activeModelListed,
     };
 }

package/dist/worker/delivery/final-verification.js

@@ -1,7 +1,8 @@
+import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { runResilientGitCommand } from "../../shared/resilient-git.js";
+import { promisify } from "node:util";
 import YAML from "yaml";
 import { controllerIdentitiesMatch, controllerIdentityExpectationFailure, resolveControllerIdentity, } from "../loop-agent/loop-agent-client.js";
 import { acceptanceSpecSchema } from "../task-graph/acceptance-schema.js";
@@ -14,6 +15,7 @@ import { taskSpecSchema } from "../task-spec/schema.js";
 import { preflightTargetRepo } from "../preflight.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
 import { buildFeatureVerificationBundle, writeFeatureVerificationBundle, } from "./verification-bundle.js";
+const execFileAsync = promisify(execFile);
 /**
  * Canonical Delivery evidence locations written by `feature verify-final`
  * (ADR 0007). Paths are repo-relative with forward slashes.
@@ -287,16 +289,6 @@ export async function writeEvidencePairAtomic(evidenceDir, value, fs = { rm }) {
     if (backedUp)
         await fs.rm(backup, { recursive: true, force: true }).catch(() => { });
 }
-async function git(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    if (result.code !== 0)
-        throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    return result.stdout.trim();
-}
-async function gitRaw(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    if (result.code !== 0)
-        throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    return result.stdout;
-}
+async function git(repoRoot, args) { return (await execFileAsync("git", args, { cwd: repoRoot, encoding: "utf8" })).stdout.trim(); }
+async function gitRaw(repoRoot, args) { return (await execFileAsync("git", args, { cwd: repoRoot, encoding: "utf8" })).stdout; }
 function isNotFound(error) { return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT"); }

package/dist/worker/delivery/package.js

@@ -1,7 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
+import { execFile } from "node:child_process";
 import { mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { isResilientGitCommandError, runResilientGitCommand } from "../../shared/resilient-git.js";
+import { promisify } from "node:util";
 import YAML from "yaml";
 import { z } from "zod";
 import { controllerIdentitiesMatch, LOOP_AGENT_PACKAGE_NAME, } from "../loop-agent/loop-agent-client.js";
@@ -12,6 +13,7 @@ import { validateFeatureTaskGraph } from "../task-graph/validate.js";
 import { taskSpecSchema } from "../task-spec/schema.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
 import { readVerifiedBundle, verifyBundleCurrentStateBindings, verifyBundleOutcomes, verifyBundleTaskSpecBindings } from "./verification-bundle.js";
+const execFileAsync = promisify(execFile);
 const hashedRefSchema = z.object({ path: z.string().min(1), sha256: z.string().regex(/^[a-f0-9]{64}$/) }).strict();
 export const acceptanceCoverageArtifactSchema = z.object({
     schemaVersion: z.literal(1),
@@ -89,9 +91,9 @@ export async function prepareFeatureDelivery(input) {
     const now = input.now ?? new Date();
     const record = await readTransaction(repoRoot, featureId, blockers);
     if (record) {
-        const branch = await git(repoRoot, ["branch", "--show-current"]).catch(rethrowInfrastructureOr(""));
-        const head = await git(repoRoot, ["rev-parse", "HEAD"]).catch(rethrowInfrastructureOr(""));
-        const status = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]).catch(rethrowInfrastructureOr("git-error"));
+        const branch = await git(repoRoot, ["branch", "--show-current"]).catch(() => "");
+        const head = await git(repoRoot, ["rev-parse", "HEAD"]).catch(() => "");
+        const status = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]).catch(() => "git-error");
         if (branch !== record.branch)
             blockers.push(`current branch must be ${record.branch}`);
         if (head !== record.lastCheckpoint)
@@ -200,11 +202,11 @@ export async function validateDeliveryPackage(input) {
         blockers.push("Delivery Feature ownership mismatch");
     if (manifest.branch !== record.branch || manifest.baseBranch !== record.baseBranch || manifest.baseSha !== record.baseCommit || manifest.headSha !== record.lastCheckpoint)
         blockers.push("Delivery manifest does not match the Git transaction");
-    const branch = await git(repoRoot, ["branch", "--show-current"]).catch(rethrowInfrastructureOr(""));
-    const head = await git(repoRoot, ["rev-parse", "HEAD"]).catch(rethrowInfrastructureOr(""));
+    const branch = await git(repoRoot, ["branch", "--show-current"]).catch(() => "");
+    const head = await git(repoRoot, ["rev-parse", "HEAD"]).catch(() => "");
     if (branch !== record.branch || head !== record.lastCheckpoint)
         blockers.push("current Git position does not match Delivery");
-    const rawCloseoutStatus = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]).catch(rethrowInfrastructureOr("git-error"));
+    const rawCloseoutStatus = await gitRaw(repoRoot, ["status", "--porcelain=v1", "--untracked-files=all"]).catch(() => "git-error");
     const allowedDirtyPaths = new Set((input.allowedDirtyPaths ?? []).map((item) => item.replace(/\\/g, "/")));
     const closeoutStatus = rawCloseoutStatus.split("\n").filter(Boolean).filter((line) => !allowedDirtyPaths.has(line.slice(3).replace(/\\/g, "/"))).join("\n").trim();
     if (closeoutStatus)
@@ -493,37 +495,23 @@ async function writeDeliveryArtifacts(artifacts, coverage, manifest) {
     }
 }
 function renderPr(manifest) { return `# Summary\n\nFeature ${manifest.featureId} local Delivery Package.\n\n## Feature/base/head\n\n- Branch: ${manifest.branch}\n- Base: ${manifest.baseBranch} @ ${manifest.baseSha}\n- Head: ${manifest.headSha}\n\n## Completed Tasks\n\n${manifest.tasks.map((task) => `- ${task.taskId}: ${task.commit} (${task.changedFiles.join(", ")})`).join("\n")}\n\n## Acceptance Coverage\n\n- Required: ${manifest.acceptanceCoverage.requiredTotal}\n- Covered: ${manifest.acceptanceCoverage.covered}\n- Waived: ${manifest.acceptanceCoverage.waived}\n- Blocked: ${manifest.acceptanceCoverage.blocked}\n\n## Verification\n\n- QA: ${manifest.qa.evidence.path}\n- Final: ${manifest.finalVerification.path}\n\n## Changed Files\n\n${[...new Set(manifest.tasks.flatMap((task) => task.changedFiles))].map((file) => `- ${file}`).join("\n")}\n\n## Risks\n\n- high=${manifest.riskSummary.high}, medium=${manifest.riskSummary.medium}, low=${manifest.riskSummary.low}\n\n## Human Review Checklist\n\n- [ ] Review diff and commits\n- [ ] Confirm required AC coverage and waivers\n- [ ] Confirm QA and final verification evidence\n- [ ] Review risks\n- [ ] Decide whether to push or create a remote PR manually\n`; }
-async function git(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    if (result.code !== 0)
-        throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    return result.stdout.trim();
-}
-async function gitRaw(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    if (result.code !== 0)
-        throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    return result.stdout;
-}
-async function gitOk(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    return result.code === 0;
-}
-function rethrowInfrastructureOr(fallback) {
-    return (error) => {
-        if (isResilientGitCommandError(error))
-            throw error;
-        return fallback;
-    };
+async function git(repoRoot, args) { const result = await execFileAsync("git", args, { cwd: repoRoot, encoding: "utf8" }); return result.stdout.trim(); }
+async function gitRaw(repoRoot, args) { const result = await execFileAsync("git", args, { cwd: repoRoot, encoding: "utf8" }); return result.stdout; }
+async function gitOk(repoRoot, args) { try {
+    await git(repoRoot, args);
+    return true;
 }
+catch {
+    return false;
+} }
 async function checkpointMatches(repoRoot, head, checkpoint, spec) {
     if (!await gitOk(repoRoot, ["merge-base", "--is-ancestor", checkpoint.commit, head]))
         return false;
-    const messageText = await gitRaw(repoRoot, ["show", "-s", "--format=%B", checkpoint.commit]).catch(rethrowInfrastructureOr(""));
+    const messageText = await gitRaw(repoRoot, ["show", "-s", "--format=%B", checkpoint.commit]).catch(() => "");
     for (const trailer of [`Feature: ${spec.feature_id}`, `Task: ${spec.id}`, `Acceptance: ${spec.acceptance_refs.join(", ")}`, `Worker-Run: ${checkpoint.workerRunId}`])
         if (!messageText.split(/\r?\n/).includes(trailer))
             return false;
-    const actual = (await gitRaw(repoRoot, ["diff-tree", "--no-commit-id", "--name-only", "-r", checkpoint.commit]).catch(rethrowInfrastructureOr(""))).split(/\r?\n/).filter(Boolean).sort();
+    const actual = (await gitRaw(repoRoot, ["diff-tree", "--no-commit-id", "--name-only", "-r", checkpoint.commit]).catch(() => "")).split(/\r?\n/).filter(Boolean).sort();
     return JSON.stringify(actual) === JSON.stringify([...checkpoint.changedFiles].sort());
 }
 async function hashedRefValid(repoRoot, ref) { try {

package/dist/worker/delivery/verification-bundle.js

@@ -7,7 +7,6 @@ import { artifactMatchesEvidenceToken, isShellVerificationToken, } from "../outc
 import { readVerifiedOutcome } from "../outcomes/store.js";
 import { getTaskPoolRoot, readFeatureTaskPoolStates } from "../pool/run-store.js";
 import { workflowSchema } from "../task-spec/workflow-routing.js";
-import { runResilientGitCommand } from "../../shared/resilient-git.js";
 import { gitTransactionRecordSchema, transactionRecordPath } from "./git-transaction.js";
 /**
  * Feature Verification Bundle v1 — a hash-bound aggregate of completed typed
@@ -534,11 +533,10 @@ async function readGitRecord(repoRoot, featureId) {
     }
 }
 async function defaultGit(repoRoot, args) {
-    const result = await runResilientGitCommand({ cwd: repoRoot, args, readOnly: true });
-    if (result.code !== 0) {
-        throw new Error(`git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim() || `exit ${result.code}`}`);
-    }
-    return result.stdout.trim();
+    const { execFile } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const execFileAsync = promisify(execFile);
+    return (await execFileAsync("git", args, { cwd: repoRoot, encoding: "utf8" })).stdout.trim();
 }
 // Re-export the workflow schema so consumers can validate typed workflows.
 export { workflowSchema };

package/dist/worker/observe/static/operator-chrome.css

@@ -71,11 +71,8 @@
 	text-decoration: none;
 	white-space: nowrap;
 }
-.och-brand-mark {
-	display: block;
-	width: 32px;
-	height: 32px;
-	object-fit: contain;
+.och-brand svg {
+	color: var(--och-orange);
 	flex-shrink: 0;
 }
 .och-brand:hover {

package/dist/worker/observe/static/operator-chrome.js

@@ -353,12 +353,7 @@ export function mountOperatorChrome(root, config = {}) {
 
 		const brand = el("a", "och-brand");
 		brand.href = model.homeHref;
-		brand.setAttribute("aria-label", `${model.brand} 首页`);
-		const brandMark = el("img", "och-brand-mark");
-		brandMark.src = "/inspect/favicon.svg";
-		brandMark.alt = "";
-		brandMark.setAttribute("aria-hidden", "true");
-		brand.appendChild(brandMark);
+		icon(brand, "radar");
 		brand.appendChild(el("span", null, model.brand));
 		global.appendChild(brand);