@teamvibe/poller 0.8.6 → 0.8.7-rc.1

package/dist/pool-telemetry.js

@@ -139,6 +139,7 @@ export function emitPoolSelection(msg, selection) {
         selectedAccountLabel: safeText(selection.account.label) ?? 'unlabeled',
         decidedAt: lastSelectionAt,
         candidates: selection.candidates ?? [],
+        ...(selection.pinned ? { pinned: true } : {}),
         ...(selection.switch ? { switch: selection.switch } : {}),
     });
 }

package/dist/redact-text.d.ts

@@ -1,2 +1,4 @@
-/** Redact credentials in diagnostics without initializing poller authentication. */
+export declare function registerConfiguredToken(token: string): void;
+export declare function redactRepoUrl(url: string): string;
+export declare function redactGitDiagnostic(text: string): string;
 export declare function redactStartupText(text: string, configuredTokens?: readonly string[]): string;

package/dist/redact-text.js

@@ -1,4 +1,20 @@
 /** Redact credentials in diagnostics without initializing poller authentication. */
+const issuedTokens = new Set();
+export function registerConfiguredToken(token) { if (token)
+    issuedTokens.add(token); }
+export function redactRepoUrl(url) {
+    return redactGitDiagnostic(url.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1<redacted>@'));
+}
+export function redactGitDiagnostic(text) {
+    let safe = text
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1<redacted>@')
+        .replace(/\b(?:x-access-token|oauth2):[^\s/@]+/gi, match => match.split(':')[0] + ':<redacted>')
+        .replace(/\bgh[pos]_[A-Za-z0-9]{20,}\b/g, '<redacted>');
+    for (const token of issuedTokens)
+        if (token)
+            safe = safe.split(token).join('<redacted>');
+    return safe;
+}
 export function redactStartupText(text, configuredTokens = []) {
     let safe = text
         .replace(/https?:\/\/[^\s/@]+@/gi, 'https://[REDACTED]@')
@@ -7,7 +23,7 @@ export function redactStartupText(text, configuredTokens = []) {
         // Cover both Claude's token name and the opt-in subprocess alias in
         // shell assignments and JSON env diagnostics, even without a token list.
         .replace(/(\b(?:CLAUDE_CODE_OAUTH_TOKEN|TEAMVIBE_CLAUDE_OAUTH_TOKEN)["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
-    for (const token of configuredTokens) {
+    for (const token of [...issuedTokens, ...configuredTokens]) {
         if (token)
             safe = safe.split(token).join('[REDACTED]');
     }

package/dist/session-instance.d.ts

@@ -0,0 +1,9 @@
+export interface SessionInstance {
+    sessionInstanceId: string;
+    createdAt: string;
+}
+export declare function createSessionInstance(): SessionInstance;
+export declare function readSessionOwner(path: string): SessionInstance | undefined;
+export declare function writeSessionOwner(path: string, owner: SessionInstance): void;
+export declare function sameSessionInstance(a: SessionInstance | undefined, b: SessionInstance | undefined): boolean;
+export declare function reportSessionOwnerMismatch(owner: SessionInstance, current?: SessionInstance): void;

package/dist/session-instance.js

@@ -0,0 +1,36 @@
+import { randomUUID } from 'node:crypto';
+import { chmodSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { logger } from './logger.js';
+export function createSessionInstance() {
+    return { sessionInstanceId: randomUUID(), createdAt: new Date().toISOString() };
+}
+export function readSessionOwner(path) {
+    try {
+        const owner = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof owner.sessionInstanceId === 'string' && typeof owner.createdAt === 'string')
+            return owner;
+    }
+    catch { /* Missing or malformed ownership is never permission to delete. */ }
+    return undefined;
+}
+export function writeSessionOwner(path, owner) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify({ sessionInstanceId: owner.sessionInstanceId, createdAt: owner.createdAt }), { mode: 0o600, flag: 'wx' });
+        chmodSync(temporary, 0o600);
+        renameSync(temporary, path);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function sameSessionInstance(a, b) {
+    return a !== undefined && b !== undefined && a.sessionInstanceId === b.sessionInstanceId && a.createdAt === b.createdAt;
+}
+const reported = new Set();
+export function reportSessionOwnerMismatch(owner, current) {
+    if (reported.has(owner.sessionInstanceId))
+        return;
+    reported.add(owner.sessionInstanceId);
+    logger.warn(`[GitCredential] Cleanup ownership changed; retaining successor worktree and credentials (expected ${owner.sessionInstanceId}, actual ${current?.sessionInstanceId ?? 'missing-or-malformed'})`);
+}

package/dist/worktree-manager.d.ts

@@ -1,3 +1,4 @@
+import { type SessionInstance } from './session-instance.js';
 /**
  * Create a fresh worktree for a spawned session. Returns the absolute path of
  * the worktree, which the caller should use as the spawned process's `cwd`.
@@ -5,17 +6,19 @@
  * Idempotent against existing worktrees at the same path: if one is found,
  * it's removed and recreated to guarantee a clean start.
  */
-export declare function createWorktree(brainPath: string, sessionId: string, branch?: string): Promise<string>;
+export declare function createWorktree(brainPath: string, sessionId: string, branch?: string, instance?: SessionInstance): Promise<string>;
 /**
  * Remove a worktree by session ID. Force-removes so dirty state from a crashed
  * session doesn't block cleanup — the contract is that any session work the
  * caller wanted to preserve has already been pushed to `origin/<branch>`.
  */
-export declare function removeWorktree(brainPath: string, sessionId: string): Promise<void>;
+export declare function removeWorktree(brainPath: string, sessionId: string, instance?: SessionInstance | null): Promise<void>;
 /**
  * Sweep orphan worktrees left behind by crashed sessions. Removes every
- * worktree under `<brainPath>/.worktrees/` whose directory mtime is older
- * than `maxAgeMs`. Intended to run once at poller startup.
+ * known-dead instance immediately, or an unregistered/legacy orphan older
+ * than `maxAgeMs`. Live sessions and registered tasks always retain their
+ * worktrees, including those with missing, malformed or changed markers.
+ * Intended to run once at poller startup.
  */
 export declare function cleanupOrphanWorktrees(brainPath: string, maxAgeMs?: number): Promise<{
     removed: string[];

package/dist/worktree-manager.js

@@ -1,4 +1,7 @@
 import { existsSync } from 'fs';
+import { isGitCredentialInstanceRetained, isGitCredentialInstanceKnownDead, registeredWorktreeOwner } from './git-credential-session.js';
+import { logger } from './logger.js';
+import { createSessionInstance, readSessionOwner, writeSessionOwner, sameSessionInstance, reportSessionOwnerMismatch } from './session-instance.js';
 import { mkdir, readdir, stat, appendFile, readFile } from 'fs/promises';
 import { join } from 'path';
 import { execFile } from 'child_process';
@@ -6,8 +9,24 @@ import { promisify } from 'util';
 import { validateBrainId, resolveBrainDir } from './brain-path.js';
 import { readInboxRuntime } from './inbox-manager.js';
 const execFileAsync = promisify(execFile);
+// Serialize creation and deletion at a reusable thread path: ownership must
+// stay stable between the marker check and completion of git worktree remove.
+const worktreeOperations = new Map();
+async function withWorktreeLock(path, operation) {
+    const previous = worktreeOperations.get(path) ?? Promise.resolve();
+    const current = previous.catch(() => { }).then(operation);
+    worktreeOperations.set(path, current);
+    try {
+        return await current;
+    }
+    finally {
+        if (worktreeOperations.get(path) === current)
+            worktreeOperations.delete(path);
+    }
+}
 const WORKTREES_SUBDIR = '.worktrees';
-const EXCLUDE_ENTRY = `${WORKTREES_SUBDIR}/\n`;
+const OWNER_FILE = '.teamvibe-session-owner.json';
+const EXCLUDE_ENTRY = `${WORKTREES_SUBDIR}/\n${OWNER_FILE}\n`;
 /**
  * Spawned (non-foreground) Claude sessions run in isolated git worktrees off
  * the brain repo to avoid the sync-watchdog race in teamvibe.ai#120.
@@ -32,7 +51,7 @@ async function ensureExclude(brainPath) {
     catch {
         // .git/info/exclude may not exist (rare); fall back to creating it
     }
-    if (!current.split('\n').includes(WORKTREES_SUBDIR + '/')) {
+    if (!current.split('\n').includes(OWNER_FILE)) {
         await appendFile(excludePath, EXCLUDE_ENTRY);
     }
 }
@@ -43,46 +62,76 @@ async function ensureExclude(brainPath) {
  * Idempotent against existing worktrees at the same path: if one is found,
  * it's removed and recreated to guarantee a clean start.
  */
-export async function createWorktree(brainPath, sessionId, branch = 'main') {
-    await mkdir(join(brainPath, WORKTREES_SUBDIR), { recursive: true });
-    await ensureExclude(brainPath);
-    const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
-    // Defensive cleanup in case a previous attempt left an orphan
-    try {
-        await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
-    }
-    catch {
-        // Not registered as a worktree — fine
-    }
-    await execFileAsync('git', ['fetch', 'origin', branch, '--quiet'], { cwd: brainPath });
-    await execFileAsync('git', ['worktree', 'add', '--detach', worktreePath, `origin/${branch}`], { cwd: brainPath });
-    return worktreePath;
+export async function createWorktree(brainPath, sessionId, branch = 'main', instance = createSessionInstance()) {
+    return withWorktreeLock(join(brainPath, WORKTREES_SUBDIR, sessionId), async () => {
+        await mkdir(join(brainPath, WORKTREES_SUBDIR), { recursive: true });
+        await ensureExclude(brainPath);
+        const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
+        // Defensive cleanup in case a previous attempt left an orphan
+        try {
+            await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
+        }
+        catch {
+            // Not registered as a worktree — fine
+        }
+        await execFileAsync('git', ['fetch', 'origin', branch, '--quiet'], { cwd: brainPath });
+        await execFileAsync('git', ['worktree', 'add', '--no-checkout', '--detach', worktreePath, `origin/${branch}`], { cwd: brainPath });
+        // Register without checkout first: no usable checkout exists until its
+        // atomic 0600 ownership marker is installed. A crash before that leaves
+        // an incomplete, age-gated orphan rather than an unmarked live worktree.
+        writeSessionOwner(join(worktreePath, OWNER_FILE), instance);
+        await execFileAsync('git', ['reset', '--hard', `origin/${branch}`], { cwd: worktreePath });
+        return worktreePath;
+    });
 }
 /**
  * Remove a worktree by session ID. Force-removes so dirty state from a crashed
  * session doesn't block cleanup — the contract is that any session work the
  * caller wanted to preserve has already been pushed to `origin/<branch>`.
  */
-export async function removeWorktree(brainPath, sessionId) {
+export async function removeWorktree(brainPath, sessionId, instance) {
+    return removeOwnedWorktree(brainPath, sessionId, instance);
+}
+async function removeOwnedWorktree(brainPath, sessionId, instance, orphanCutoff) {
     const worktreePath = join(brainPath, WORKTREES_SUBDIR, sessionId);
-    try {
-        await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
-    }
-    catch {
-        // Already gone, or never registered — fine
-    }
-    // Prune any stale administrative bookkeeping in .git/worktrees/
-    try {
-        await execFileAsync('git', ['worktree', 'prune'], { cwd: brainPath });
-    }
-    catch {
-        // best-effort
-    }
+    const expected = instance === undefined ? readSessionOwner(join(worktreePath, OWNER_FILE)) : instance;
+    return withWorktreeLock(worktreePath, async () => {
+        const current = readSessionOwner(join(worktreePath, OWNER_FILE));
+        if (orphanCutoff !== undefined) {
+            // Recheck under the same lock as creation, including retention before age.
+            if (isGitCredentialInstanceRetained(current, undefined, sessionId))
+                return;
+            if (!(current && isGitCredentialInstanceKnownDead(current)) && (await stat(worktreePath)).mtimeMs >= orphanCutoff)
+                return;
+            if (expected ? !sameSessionInstance(current, expected) : current !== undefined)
+                return;
+        }
+        else if (!expected || !sameSessionInstance(current, expected)) {
+            if (expected)
+                reportSessionOwnerMismatch(expected, current);
+            return;
+        }
+        try {
+            await execFileAsync('git', ['worktree', 'remove', '--force', worktreePath], { cwd: brainPath });
+        }
+        catch {
+            // Already gone, or never registered — fine
+        }
+        // Prune any stale administrative bookkeeping in .git/worktrees/
+        try {
+            await execFileAsync('git', ['worktree', 'prune'], { cwd: brainPath });
+        }
+        catch {
+            // best-effort
+        }
+    });
 }
 /**
  * Sweep orphan worktrees left behind by crashed sessions. Removes every
- * worktree under `<brainPath>/.worktrees/` whose directory mtime is older
- * than `maxAgeMs`. Intended to run once at poller startup.
+ * known-dead instance immediately, or an unregistered/legacy orphan older
+ * than `maxAgeMs`. Live sessions and registered tasks always retain their
+ * worktrees, including those with missing, malformed or changed markers.
+ * Intended to run once at poller startup.
  */
 export async function cleanupOrphanWorktrees(brainPath, maxAgeMs = 24 * 60 * 60 * 1000) {
     const worktreesDir = join(brainPath, WORKTREES_SUBDIR);
@@ -97,15 +146,24 @@ export async function cleanupOrphanWorktrees(brainPath, maxAgeMs = 24 * 60 * 60
     const cutoffMs = Date.now() - maxAgeMs;
     for (const entry of entries) {
         const path = join(worktreesDir, entry);
+        const instance = readSessionOwner(join(path, OWNER_FILE));
         const pending = readInboxRuntime(brainPath, entry);
         if (pending?.pin.resumePending && pending.pin.effectiveCwd === path)
             continue;
         try {
-            const s = await stat(path);
-            if (s.mtimeMs < cutoffMs) {
-                await removeWorktree(brainPath, entry);
-                removed.push(entry);
+            // Retain by thread metadata as well as marker: a corrupt marker cannot
+            // hide a live session or registered task from the shared predicate.
+            if (isGitCredentialInstanceRetained(instance, undefined, entry)) {
+                // Report damaged ownership with both IDs without reading credentials.
+                const expected = registeredWorktreeOwner(entry);
+                if (expected && !sameSessionInstance(instance, expected))
+                    reportSessionOwnerMismatch(expected, instance);
+                logger.info(`[Worktree] Retained ${path}: live session or registered task`);
+                continue;
             }
+            await removeOwnedWorktree(brainPath, entry, instance ?? null, cutoffMs);
+            if (!existsSync(path))
+                removed.push(entry);
         }
         catch {
             // skip entries we can't stat

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.6",
+  "version": "0.8.7-rc.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@teamvibe/poller",
-      "version": "0.8.6",
+      "version": "0.8.7-rc.1",
       "dependencies": {
         "@aws-sdk/client-dynamodb": "3.1108.0",
         "@aws-sdk/client-sqs": "3.1108.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.8.6",
+  "version": "0.8.7-rc.1",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "dist",
+    "bin",
     "npm-shrinkwrap.json"
   ],
   "scripts": {