@tokenfactory/acc-runner 0.27.0 → 0.27.1

package/dist/runtime/locks.js

@@ -0,0 +1,103 @@
+/**
+ * Local PID lockfile at `<cache>/locks/<task_id>.pid` so two same-machine
+ * runner processes can't both enter the same task's worktree. Held for the
+ * task lifetime, released in a finally.
+ *
+ * v1.00-B: the cache root resolves through `cacheDir()` (which honours
+ * ACC_RUNNER_CACHE_DIR), not a hardcoded ~/.cache path. This is what lets
+ * two ephemeral runners on one host stay isolated — distinct
+ * ACC_RUNNER_CACHE_DIR values give each its own task-lock namespace, so
+ * they never collide on a shared `locks/` dir.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { cacheDir } from "./cache-dir.js";
+// Lazy so tests can override ACC_RUNNER_CACHE_DIR / HOME between cases.
+export function locksDir() {
+    return path.join(cacheDir(), "locks");
+}
+export class TaskLockHeldError extends Error {
+    taskId;
+    heldByPid;
+    constructor(taskId, heldByPid) {
+        super(`task ${taskId} lock held by pid ${heldByPid}`);
+        this.taskId = taskId;
+        this.heldByPid = heldByPid;
+        this.name = "TaskLockHeldError";
+    }
+}
+export function lockPath(taskId) {
+    return path.join(locksDir(), `${taskId}.pid`);
+}
+export function isProcessAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM = exists but unsignalable — still alive.
+        return err.code === "EPERM";
+    }
+}
+async function readPid(file) {
+    try {
+        const text = await fs.readFile(file, "utf8");
+        const pid = Number.parseInt(text.trim(), 10);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+export async function acquireTaskLock(taskId, pid = process.pid) {
+    await fs.mkdir(locksDir(), { recursive: true });
+    const file = lockPath(taskId);
+    const existing = await readPid(file);
+    if (existing !== null && existing !== pid && isProcessAlive(existing)) {
+        throw new TaskLockHeldError(taskId, existing);
+    }
+    await fs.writeFile(file, `${pid}\n`, "utf8");
+    return {
+        taskId,
+        pidFile: file,
+        async release() {
+            try {
+                // Only delete if we still own it — avoids stomping a recovered lock.
+                const current = await readPid(file);
+                if (current === pid)
+                    await fs.unlink(file);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw err;
+            }
+        },
+    };
+}
+export async function listStaleLocks() {
+    let entries;
+    try {
+        entries = await fs.readdir(locksDir());
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const stale = [];
+    for (const name of entries) {
+        if (!name.endsWith(".pid"))
+            continue;
+        const file = path.join(locksDir(), name);
+        const pid = await readPid(file);
+        if (pid === null || !isProcessAlive(pid)) {
+            stale.push({ taskId: name.slice(0, -4), pidFile: file, pid });
+        }
+    }
+    return stale;
+}
+//# sourceMappingURL=locks.js.map

package/dist/runtime/locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../src/runtime/locks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,wEAAwE;AACxE,MAAM,UAAU,QAAQ;IACtB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC;AAQD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACd;IAAgC;IAA5D,YAA4B,MAAc,EAAkB,SAAiB;QAC3E,KAAK,CAAC,QAAQ,MAAM,qBAAqB,SAAS,EAAE,CAAC,CAAC;QAD5B,WAAM,GAAN,MAAM,CAAQ;QAAkB,cAAS,GAAT,SAAS,CAAQ;QAE3E,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,iDAAiD;QACjD,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,MAAc,OAAO,CAAC,GAAG;IAEzB,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,MAAM;QACN,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,OAAO;YACX,IAAI,CAAC;gBACH,qEAAqE;gBACrE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,OAAO,KAAK,GAAG;oBAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,GAAG,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/runtime/provision-mutex.d.ts

@@ -0,0 +1,37 @@
+/**
+ * v0.21 T-66-1 — in-process provisioning mutex.
+ *
+ * The runner runs up to `concurrencyLimit` tasks at once, but the per-task
+ * worktree-provisioning critical section (`git fetch` + `git worktree
+ * remove`/prune + `git worktree add`) all targets the SAME shared clone.
+ * Two of those running concurrently collide on git's repo-global locks
+ * (`.git/index.lock`, `HEAD.lock`, `packed-refs.lock`, `.git/worktrees/…`),
+ * so the loser throws a git error in the pre-Claude phase and the task dies
+ * (this is how T-65-2 failed in ~5s beside T-65-1; see
+ * planning/T65-2_CONCURRENT_DISPATCH_ROOTCAUSE.md).
+ *
+ * `withProvisionLock` serializes ONLY that critical section, keyed by the
+ * shared clone path. The long phases (the Claude run and the push) stay
+ * concurrent up to `concurrencyLimit`, so the throughput benefit is
+ * preserved — only the few seconds of git plumbing serialize. Serializing
+ * the section also makes the v0.37-A stale-lock guard (`clearGitLocks`)
+ * safe: it can no longer delete a `.git/*.lock` that a concurrent provision
+ * is actively holding, because no concurrent provision against the same
+ * clone can be in flight.
+ *
+ * The lock is a per-key promise chain: each caller appends its critical
+ * section to the tail of the chain for its key and awaits the prior tail.
+ * The chain advances in a `finally`, so a thrown critical section releases
+ * the lock for the next waiter (no deadlock). Keys whose chain has drained
+ * are dropped from the map so it can't grow unbounded.
+ */
+/**
+ * Run `fn` while holding the provisioning lock for `key` (the shared clone
+ * path). Callers for the same key run strictly one-at-a-time, in arrival
+ * order; callers for different keys never block each other. The resolved
+ * value (or thrown error) of `fn` is passed straight through to the caller.
+ */
+export declare function withProvisionLock<T>(key: string, fn: () => Promise<T>): Promise<T>;
+/** Test/diagnostic helper: number of clone keys with a live or pending chain. */
+export declare function activeProvisionKeys(): number;
+//# sourceMappingURL=provision-mutex.d.ts.map

package/dist/runtime/provision-mutex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-mutex.d.ts","sourceRoot":"","sources":["../../src/runtime/provision-mutex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,GAAG,EAAE,MAAM,EACX,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CA2BZ;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C"}

package/dist/runtime/provision-mutex.js

@@ -0,0 +1,67 @@
+/**
+ * v0.21 T-66-1 — in-process provisioning mutex.
+ *
+ * The runner runs up to `concurrencyLimit` tasks at once, but the per-task
+ * worktree-provisioning critical section (`git fetch` + `git worktree
+ * remove`/prune + `git worktree add`) all targets the SAME shared clone.
+ * Two of those running concurrently collide on git's repo-global locks
+ * (`.git/index.lock`, `HEAD.lock`, `packed-refs.lock`, `.git/worktrees/…`),
+ * so the loser throws a git error in the pre-Claude phase and the task dies
+ * (this is how T-65-2 failed in ~5s beside T-65-1; see
+ * planning/T65-2_CONCURRENT_DISPATCH_ROOTCAUSE.md).
+ *
+ * `withProvisionLock` serializes ONLY that critical section, keyed by the
+ * shared clone path. The long phases (the Claude run and the push) stay
+ * concurrent up to `concurrencyLimit`, so the throughput benefit is
+ * preserved — only the few seconds of git plumbing serialize. Serializing
+ * the section also makes the v0.37-A stale-lock guard (`clearGitLocks`)
+ * safe: it can no longer delete a `.git/*.lock` that a concurrent provision
+ * is actively holding, because no concurrent provision against the same
+ * clone can be in flight.
+ *
+ * The lock is a per-key promise chain: each caller appends its critical
+ * section to the tail of the chain for its key and awaits the prior tail.
+ * The chain advances in a `finally`, so a thrown critical section releases
+ * the lock for the next waiter (no deadlock). Keys whose chain has drained
+ * are dropped from the map so it can't grow unbounded.
+ */
+// Per-key tail of the run queue. Resolves when the current holder's critical
+// section (and its release bookkeeping) has settled.
+const chains = new Map();
+/**
+ * Run `fn` while holding the provisioning lock for `key` (the shared clone
+ * path). Callers for the same key run strictly one-at-a-time, in arrival
+ * order; callers for different keys never block each other. The resolved
+ * value (or thrown error) of `fn` is passed straight through to the caller.
+ */
+export async function withProvisionLock(key, fn) {
+    // The predecessor we must wait behind (resolved/rejected — we don't care
+    // which; we only need it to have finished touching the clone).
+    const prior = chains.get(key) ?? Promise.resolve();
+    // Our gate resolves when WE are done, letting the next waiter proceed.
+    let release;
+    const ours = new Promise((resolve) => {
+        release = resolve;
+    });
+    // Append ourselves to the tail BEFORE awaiting, so a third caller queues
+    // behind us, not behind our predecessor.
+    chains.set(key, ours);
+    // Wait for the predecessor to finish. `.catch` so a predecessor that threw
+    // never rejects our wait — its failure is its own caller's problem.
+    await prior.catch(() => undefined);
+    try {
+        return await fn();
+    }
+    finally {
+        release();
+        // Drop the key once our gate is the current tail (no one queued behind
+        // us), so the map doesn't accumulate dead entries over the runner's life.
+        if (chains.get(key) === ours)
+            chains.delete(key);
+    }
+}
+/** Test/diagnostic helper: number of clone keys with a live or pending chain. */
+export function activeProvisionKeys() {
+    return chains.size;
+}
+//# sourceMappingURL=provision-mutex.js.map

package/dist/runtime/provision-mutex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-mutex.js","sourceRoot":"","sources":["../../src/runtime/provision-mutex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,EAAoB;IAEpB,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAEnD,uEAAuE;IACvE,IAAI,OAAoB,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACzC,OAAO,GAAG,OAAO,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,yEAAyE;IACzE,yCAAyC;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAEtB,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;QACV,uEAAuE;QACvE,0EAA0E;QAC1E,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/runtime/quarantine.d.ts

@@ -0,0 +1,30 @@
+import type { ClaudeExitClass } from "../failure-classifier.js";
+export interface QuarantineState {
+    cause: ClaudeExitClass;
+    classifiedAt: string;
+    taskId: string;
+    detail: string;
+    /**
+     * v0.53 T-53-4: how many consecutive instant-empty (heuristic) claude
+     * exits triggered the quarantine. Cache-schema additive — older readers
+     * ignore it; the keychain entry schema and the runner protocol message
+     * shapes are untouched. Definitive machine failures (dyld, exit 127,
+     * usage/auth patterns) record 1; a heuristic env_broken records 2 (the
+     * task-runner only quarantines after the retry also exits instantly).
+     * Optional so a state written by a pre-0.53 runner still parses.
+     */
+    consecutive?: number;
+}
+/**
+ * Path to the quarantine sentinel file. Resolves through the shared
+ * `cacheDir()` (honours ACC_RUNNER_CACHE_DIR), so a per-runner cache dir
+ * gives each ephemeral runner its own quarantine state.
+ */
+export declare function quarantineFile(): string;
+/** Returns the current quarantine state, or null when not quarantined. */
+export declare function getQuarantine(): Promise<QuarantineState | null>;
+/** Write the quarantine sentinel. Creates parent dirs if needed. */
+export declare function setQuarantine(state: QuarantineState): Promise<void>;
+/** Remove the quarantine sentinel. Safe to call when not quarantined. */
+export declare function clearQuarantine(): Promise<void>;
+//# sourceMappingURL=quarantine.d.ts.map

package/dist/runtime/quarantine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQrE;AAED,oEAAoE;AACpE,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,yEAAyE;AACzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/runtime/quarantine.js

@@ -0,0 +1,53 @@
+/**
+ * v0.48: per-runner quarantine state. Written to
+ * ~/.cache/acc-runner/quarantine.json by the watch loop when the failure
+ * classifier flags a machine-level failure (usage_limit | auth_expired |
+ * env_broken). The presence of this file blocks pump() from claiming
+ * new tasks so no further work is burned.
+ *
+ * Clearing the quarantine (after the operator resolves the underlying issue):
+ *   - Delete the file manually, OR
+ *   - Run `acc-runner quarantine clear` (wired in cli.ts).
+ *
+ * `acc-runner doctor` surfaces the quarantine state and its cause.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { cacheDir } from "./cache-dir.js";
+/**
+ * Path to the quarantine sentinel file. Resolves through the shared
+ * `cacheDir()` (honours ACC_RUNNER_CACHE_DIR), so a per-runner cache dir
+ * gives each ephemeral runner its own quarantine state.
+ */
+export function quarantineFile() {
+    return path.join(cacheDir(), "quarantine.json");
+}
+/** Returns the current quarantine state, or null when not quarantined. */
+export async function getQuarantine() {
+    try {
+        const raw = await fs.readFile(quarantineFile(), "utf8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+}
+/** Write the quarantine sentinel. Creates parent dirs if needed. */
+export async function setQuarantine(state) {
+    const file = quarantineFile();
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, JSON.stringify(state, null, 2), "utf8");
+}
+/** Remove the quarantine sentinel. Safe to call when not quarantined. */
+export async function clearQuarantine() {
+    try {
+        await fs.unlink(quarantineFile());
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+}
+//# sourceMappingURL=quarantine.js.map

package/dist/runtime/quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAoB1C;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/runtime/resolution-integrity.d.ts

@@ -0,0 +1,86 @@
+export type IntegrityAssertion = "conflict_markers" | "typecheck" | "version_regression" | "changelog_missing";
+export interface IntegrityFailure {
+    assertion: IntegrityAssertion;
+    /** Human-readable, log-safe (no secrets) explanation of the failure. */
+    detail: string;
+    /** Offending tracked files, when the assertion is file-scoped. */
+    files?: string[];
+}
+export interface ResolutionIntegrityResult {
+    ok: boolean;
+    /** Assertions that actually ran (version checks skip when nothing changed). */
+    checked: IntegrityAssertion[];
+    failures: IntegrityFailure[];
+}
+/** A package.json / CHANGELOG.md pair to version-check, relative to workdir. */
+export interface VersionTarget {
+    packageJsonPath: string;
+    changelogPath: string;
+}
+export interface AssertResolutionOptions {
+    /**
+     * Base ref the resolution should not regress against (e.g. the integration
+     * branch). When omitted, or when the base file can't be read, the version
+     * assertion is skipped — never false-failed.
+     */
+    baseRef?: string;
+    /** Typecheck command (defaults to `pnpm typecheck`). */
+    typecheckCmd?: string;
+    /**
+     * package.json / CHANGELOG.md pairs to version-check. Defaults to the repo
+     * root pair. The runner passes the acc-runner package pair (the #496 site).
+     */
+    versionTargets?: VersionTarget[];
+}
+export interface ResolutionIntegrityDeps {
+    /** Tracked files still carrying a conflict marker. Default: `git grep`. */
+    findConflictMarkers?: (workdir: string) => Promise<string[]>;
+    /** Run the typecheck command. Default: spawn `pnpm typecheck` in workdir. */
+    runTypecheck?: (workdir: string, cmd: string) => Promise<{
+        ok: boolean;
+        output: string;
+    }>;
+    /** Resolved (post-resolution, on-disk) version for a target, or null. */
+    readResolvedVersion?: (workdir: string, target: VersionTarget) => Promise<string | null>;
+    /** Base-ref version for a target, or null when unreadable (→ skip check). */
+    readBaseVersion?: (workdir: string, baseRef: string, target: VersionTarget) => Promise<string | null>;
+    /** CHANGELOG.md text for a target, or null when absent. */
+    readChangelog?: (workdir: string, target: VersionTarget) => Promise<string | null>;
+}
+/**
+ * Conflict-marker line shape: 7 of the same marker char at the start of a
+ * line. `<<<<<<<` and `>>>>>>>` are unambiguous; the `=======` divider is
+ * matched only as a whole line so a 7-equals markdown rule plus trailing text
+ * does not trip it.
+ */
+export declare const CONFLICT_MARKER_RE: RegExp;
+export declare function textHasConflictMarker(text: string): boolean;
+/** Semver compare (a-b sign); tolerant of pre-release/build suffixes. */
+export declare function cmpSemver(a: string, b: string): number;
+/**
+ * True when `changelog` carries an entry for `version`. The version must
+ * appear bounded by non-version characters so 0.14.0 does not match inside
+ * 0.14.00 or 10.14.0.
+ */
+export declare function changelogMentionsVersion(changelog: string, version: string): boolean;
+export declare const DEFAULT_VERSION_TARGET: VersionTarget;
+/**
+ * Assert that a conflict resolution in `workdir` is shippable. Returns a
+ * structured result; `ok === false` means the caller MUST reject the
+ * resolution (do not push, do not mark resolved).
+ */
+export declare function assertResolutionIntegrity(workdir: string, opts?: AssertResolutionOptions, deps?: ResolutionIntegrityDeps): Promise<ResolutionIntegrityResult>;
+/**
+ * True when a task that reaches the worktree/push path is a conflict
+ * resolution and must clear the integrity guardrail. `conflict_resolution`
+ * task types are handled mechanically upstream and never reach the push path,
+ * so the live signal here is the title an operator/manager files when the
+ * mechanical resolver bails and a Claude session takes over the merge.
+ */
+export declare function isConflictResolutionTask(task: {
+    type?: string | null;
+    title?: string | null;
+}): boolean;
+/** One-line, log-safe summary of which assertions failed. */
+export declare function summariseFailures(failures: IntegrityFailure[]): string;
+//# sourceMappingURL=resolution-integrity.d.ts.map

package/dist/runtime/resolution-integrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution-integrity.d.ts","sourceRoot":"","sources":["../../src/runtime/resolution-integrity.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,kBAAkB,GAC1B,kBAAkB,GAClB,WAAW,GACX,oBAAoB,GACpB,mBAAmB,CAAC;AAExB,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,+EAA+E;IAC/E,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7D,6EAA6E;IAC7E,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,CACpB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5B,2DAA2D;IAC3D,aAAa,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,KAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7B;AAMD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAsC,CAAC;AAEtE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQtD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAGT;AAED,eAAO,MAAM,sBAAsB,EAAE,aAGpC,CAAC;AAqGF;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,uBAA4B,EAClC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAgFpC;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAIV;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAEtE"}

package/dist/runtime/resolution-integrity.js

@@ -0,0 +1,248 @@
+/**
+ * v0.57 T-57-2: Conflict-resolution integrity guardrail.
+ *
+ * A reusable post-resolution assertion the conflict-resolution path MUST pass
+ * before a resolution is declared complete / pushed. It exists because agent
+ * conflict resolutions in v0.55–v0.56 repeatedly shipped broken merges that
+ * were still marked "resolved":
+ *   - spliced blocks left stale variable names (task-runner.ts) → CI typecheck
+ *     failure that the runner never re-checked;
+ *   - duplicate declarations (health.ts) → same;
+ *   - a silently dropped version bump (#496 reverted package.json
+ *     0.14.0 → 0.13.0) → a version REGRESSION nobody noticed.
+ *
+ * The guardrail re-verifies the resolution from the runner's own vantage point
+ * (it never trusts the agent's self-reported gate results):
+ *   1. ZERO git conflict markers remain in any tracked file
+ *      (<<<<<<< / ======= / >>>>>>>).
+ *   2. `pnpm typecheck` passes.
+ *   3. If a package.json "version" changed in the resolution, it only moved
+ *      FORWARD (semver-greater than the base, never a regression) AND
+ *      CHANGELOG.md carries a matching entry for the new version.
+ *
+ * On ANY failure the caller MUST reject the resolution: do not push, do not
+ * mark the task resolved; keep it actionable and emit a diagnostic naming the
+ * failed assertion. The default implementations shell out to `git` / `pnpm`,
+ * but every I/O boundary is an injectable dep so the three incident replays
+ * (version regression, stale-var typecheck fail, marker-left-behind) can be
+ * driven without a real worktree.
+ */
+import path from "node:path";
+import fs from "node:fs/promises";
+import { execa } from "execa";
+import { buildEnv } from "../bin-resolve.js";
+// ─────────────────────────────────────────────────────────────────────────────
+// Pure helpers (exported for direct unit coverage)
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Conflict-marker line shape: 7 of the same marker char at the start of a
+ * line. `<<<<<<<` and `>>>>>>>` are unambiguous; the `=======` divider is
+ * matched only as a whole line so a 7-equals markdown rule plus trailing text
+ * does not trip it.
+ */
+export const CONFLICT_MARKER_RE = /^(?:<{7}|>{7})(?:$|\s)|^={7}\s*$/m;
+export function textHasConflictMarker(text) {
+    return CONFLICT_MARKER_RE.test(text);
+}
+/** Semver compare (a-b sign); tolerant of pre-release/build suffixes. */
+export function cmpSemver(a, b) {
+    const parts = (s) => s.split(/[.+-]/).map((x) => Number(x) || 0);
+    const [pa, pb] = [parts(a), parts(b)];
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        if ((pa[i] ?? 0) !== (pb[i] ?? 0))
+            return (pa[i] ?? 0) - (pb[i] ?? 0);
+    }
+    return 0;
+}
+/**
+ * True when `changelog` carries an entry for `version`. The version must
+ * appear bounded by non-version characters so 0.14.0 does not match inside
+ * 0.14.00 or 10.14.0.
+ */
+export function changelogMentionsVersion(changelog, version) {
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^0-9.])${escaped}([^0-9.]|$)`, "m").test(changelog);
+}
+export const DEFAULT_VERSION_TARGET = {
+    packageJsonPath: "package.json",
+    changelogPath: "CHANGELOG.md",
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Default I/O implementations
+// ─────────────────────────────────────────────────────────────────────────────
+async function defaultFindConflictMarkers(workdir) {
+    // `git grep` only scans tracked files. -I skips binaries, -l lists names.
+    // -E with the three marker forms; `=======` constrained to a lone line via
+    // the `\$` anchors git's POSIX-ERE understands.
+    const patterns = ["^<<<<<<<", "^>>>>>>>", "^=======$"];
+    const args = ["grep", "-I", "-l", "-E"];
+    for (let i = 0; i < patterns.length; i++) {
+        args.push(i === 0 ? "-e" : "-e", patterns[i]);
+    }
+    // `--` guards against a pattern being read as a pathspec.
+    args.push("--");
+    const { stdout, exitCode } = await execa("git", args, {
+        cwd: workdir,
+        env: buildEnv(),
+        reject: false,
+    });
+    // git grep exits 1 when there are no matches — that's the clean case.
+    if (exitCode === 1)
+        return [];
+    return stdout
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+async function defaultRunTypecheck(workdir, cmd) {
+    const result = await execa(cmd, {
+        cwd: workdir,
+        env: buildEnv(),
+        shell: true,
+        reject: false,
+    });
+    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+    return { ok: result.exitCode === 0, output };
+}
+async function readJsonVersion(text) {
+    if (text === null)
+        return null;
+    try {
+        const v = JSON.parse(text).version;
+        return typeof v === "string" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadResolvedVersion(workdir, target) {
+    try {
+        const text = await fs.readFile(path.join(workdir, target.packageJsonPath), "utf8");
+        return readJsonVersion(text);
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadBaseVersion(workdir, baseRef, target) {
+    try {
+        const { stdout, exitCode } = await execa("git", ["show", `${baseRef}:${target.packageJsonPath}`], { cwd: workdir, env: buildEnv(), reject: false });
+        if (exitCode !== 0)
+            return null;
+        return readJsonVersion(stdout);
+    }
+    catch {
+        return null;
+    }
+}
+async function defaultReadChangelog(workdir, target) {
+    try {
+        return await fs.readFile(path.join(workdir, target.changelogPath), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// The guardrail
+// ─────────────────────────────────────────────────────────────────────────────
+const OUTPUT_TAIL = 2000;
+/**
+ * Assert that a conflict resolution in `workdir` is shippable. Returns a
+ * structured result; `ok === false` means the caller MUST reject the
+ * resolution (do not push, do not mark resolved).
+ */
+export async function assertResolutionIntegrity(workdir, opts = {}, deps = {}) {
+    const findConflictMarkers = deps.findConflictMarkers ?? defaultFindConflictMarkers;
+    const runTypecheck = deps.runTypecheck ?? defaultRunTypecheck;
+    const readResolvedVersion = deps.readResolvedVersion ?? defaultReadResolvedVersion;
+    const readBaseVersion = deps.readBaseVersion ?? defaultReadBaseVersion;
+    const readChangelog = deps.readChangelog ?? defaultReadChangelog;
+    const typecheckCmd = opts.typecheckCmd?.trim() || "pnpm typecheck";
+    const targets = opts.versionTargets?.length
+        ? opts.versionTargets
+        : [DEFAULT_VERSION_TARGET];
+    const checked = [];
+    const failures = [];
+    // ── 1. Conflict markers ────────────────────────────────────────────────────
+    checked.push("conflict_markers");
+    const markerFiles = await findConflictMarkers(workdir);
+    if (markerFiles.length > 0) {
+        failures.push({
+            assertion: "conflict_markers",
+            detail: `unresolved conflict markers remain in ${markerFiles.length} file(s): ${markerFiles.join(", ")}`,
+            files: markerFiles,
+        });
+    }
+    // ── 2. Typecheck ────────────────────────────────────────────────────────────
+    checked.push("typecheck");
+    const tc = await runTypecheck(workdir, typecheckCmd);
+    if (!tc.ok) {
+        failures.push({
+            assertion: "typecheck",
+            detail: `\`${typecheckCmd}\` failed:\n${tc.output.slice(-OUTPUT_TAIL)}`,
+        });
+    }
+    // ── 3. Version-forward + CHANGELOG ──────────────────────────────────────────
+    // Only meaningful when we have a base to compare against.
+    if (opts.baseRef) {
+        let ranVersionCheck = false;
+        let ranChangelogCheck = false;
+        for (const target of targets) {
+            const baseVersion = await readBaseVersion(workdir, opts.baseRef, target);
+            const resolvedVersion = await readResolvedVersion(workdir, target);
+            // Skip silently when either side is unreadable or the file is new on
+            // this side — there is nothing to regress.
+            if (baseVersion === null || resolvedVersion === null)
+                continue;
+            if (baseVersion === resolvedVersion)
+                continue; // no version change → no checks
+            ranVersionCheck = true;
+            if (cmpSemver(resolvedVersion, baseVersion) <= 0) {
+                failures.push({
+                    assertion: "version_regression",
+                    detail: `${target.packageJsonPath} version regressed ${baseVersion} → ${resolvedVersion} ` +
+                        `(must move forward, never backward)`,
+                    files: [target.packageJsonPath],
+                });
+                // A regressed version can't have a forward CHANGELOG entry to require.
+                continue;
+            }
+            // Version moved forward → a matching CHANGELOG entry is mandatory.
+            ranChangelogCheck = true;
+            const changelog = await readChangelog(workdir, target);
+            if (changelog === null || !changelogMentionsVersion(changelog, resolvedVersion)) {
+                failures.push({
+                    assertion: "changelog_missing",
+                    detail: `${target.packageJsonPath} bumped to ${resolvedVersion} but ` +
+                        `${target.changelogPath} has no entry for it`,
+                    files: [target.changelogPath],
+                });
+            }
+        }
+        if (ranVersionCheck)
+            checked.push("version_regression");
+        if (ranChangelogCheck)
+            checked.push("changelog_missing");
+    }
+    return { ok: failures.length === 0, checked, failures };
+}
+/**
+ * True when a task that reaches the worktree/push path is a conflict
+ * resolution and must clear the integrity guardrail. `conflict_resolution`
+ * task types are handled mechanically upstream and never reach the push path,
+ * so the live signal here is the title an operator/manager files when the
+ * mechanical resolver bails and a Claude session takes over the merge.
+ */
+export function isConflictResolutionTask(task) {
+    if (task.type === "conflict_resolution")
+        return true;
+    const title = (task.title ?? "").toLowerCase();
+    return /merge conflict|resolve\s+conflict|conflict\s+resolution/.test(title);
+}
+/** One-line, log-safe summary of which assertions failed. */
+export function summariseFailures(failures) {
+    return failures.map((f) => f.assertion).join(", ");
+}
+//# sourceMappingURL=resolution-integrity.js.map