@tokenfactory/acc-runner 0.42.0 → 0.44.0

package/dist/task-runner.js

@@ -20,7 +20,7 @@ import path from "node:path";
 import { join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { execa } from "execa";
-import { canServeRepo, loadProfile as defaultLoadProfile, resolveBaseBranch } from "./config.js";
+import { canServeRepo, loadProfile as defaultLoadProfile, localRepoPathFor, resolveBaseBranch } from "./config.js";
 import { normalizeUsage, priceUsdCents, toCliAlias, } from "./cost-pricing.js";
 import { extractResetTime, isCapacityExhausted, isGitProvisionContention, } from "./failure-classifier.js";
 import { getEngine } from "./engines/registry.js";
@@ -46,18 +46,25 @@ import { parseConflictMeta, resolveConflict, MAX_CONFLICT_ATTEMPTS, } from "./ru
 import { parseReworkMeta, renderReworkPrompt, reconcileReworkBranch as defaultReconcileReworkBranch, fetchPrHeadRef as defaultFetchPrHeadRef, } from "./runtime/rework.js";
 import { assertResolutionIntegrity, isConflictResolutionTask, summariseFailures, } from "./runtime/resolution-integrity.js";
 import { runPreprGate as defaultRunPreprGate, } from "./prepr-gate.js";
+import { revalidateMigrationSeq as defaultRevalidateMigrationSeq, } from "./migration-seq-guard.js";
 import { commitGuardSkipRequested, gitConfigHooksEnv, installCommitGuardSync, } from "./commit-guard.js";
 import { readLiveAllowedGlobs } from "./locks/index.js";
 const LOG_BATCH_BYTES = 4 * 1024;
-// M2 (ENGINE-EXTRACT): the coding engine this runner drives. Wave 1 resolves to
-// the default `claude-code` engine — spawn, argv, result-parse, failure-class,
-// and health-probe behavior are byte-identical to the pre-refactor inline logic
-// now owned by src/engines/claude-code.ts.
-const engine = getEngine();
+// M2 (ENGINE-EXTRACT): the coding engine this runner drives. Wave 1 resolved
+// this to a single module-level `claude-code` constant — spawn, argv,
+// result-parse, failure-class, and health-probe behavior were byte-identical
+// to the pre-refactor inline logic now owned by src/engines/claude-code.ts.
+//
+// NS MM-2 (BATCH-ENGINE-DISPATCH): a single module-level engine can no longer
+// be right — a fleet with codex/gemini flagged on runs different tasks on
+// different engines. Every call site below now resolves `getEngine(task.engine)`
+// per task (default param omitted ⇒ `getEngine()` ⇒ claude-code, so a task with
+// no engine stamped — or a runner that never sees a non-default id — is
+// byte-identical to Wave 1).
 // v0.6.0 REG-296: argv builder for `claude --print`, re-exported from the
 // claude-code engine so the historical import surface is preserved.
 export { buildClaudeArgs } from "./engines/claude-code.js";
-function defaultSpawnClaude(cwd, modelId) {
+function defaultSpawnClaude(cwd, modelId, engineId) {
     // RR-4: install the commit-time mechanical guard into this
     // worktree and point the agent's git at it via an ephemeral core.hooksPath env
     // (never a config-file write). The agent then hits an actionable in-session
@@ -76,7 +83,7 @@ function defaultSpawnClaude(cwd, modelId) {
             baseEnv = undefined;
         }
     }
-    return engine.spawn({ cwd, modelId, baseEnv });
+    return getEngine(engineId).spawn({ cwd, modelId, baseEnv });
 }
 async function defaultCheckoutBase(repoPath, baseBranch) {
     // Plain `git checkout <branch>` (not `-B`) so the integration
@@ -306,8 +313,8 @@ export async function defaultReclaimStaleConflictLocks(supabase, conflicts, nowM
     }
     return reclaimed;
 }
-async function defaultHealthProbe() {
-    return engine.healthProbe();
+async function defaultHealthProbe(engineId) {
+    return getEngine(engineId).healthProbe();
 }
 const DEFAULT_CLAUDE_UNAVAILABLE_KNOBS = {
     windowMs: 15 * 60_000,
@@ -413,9 +420,14 @@ async function streamToEvents(stream, supabase, taskId, streamName) {
  * both `--output-format=json` (extracts .result) and plain text. Falls
  * back to the entire stdout (capped) if no `## Summary` heading is
  * present — that way the PR body still tells the reviewer what happened.
+ *
+ * NS MM-2: `engineId` is optional and appended last so every pre-existing
+ * caller (api/github/webhook.ts, the packages/acc-runner test suite) keeps
+ * compiling unchanged and keeps resolving `claude-code` — only the in-file
+ * per-task call site now forwards `task.engine`.
  */
-export function extractReportFromOutput(stdout) {
-    const parsed = engine.parseResult(stdout);
+export function extractReportFromOutput(stdout, engineId) {
+    const parsed = getEngine(engineId).parseResult(stdout);
     const text = parsed?.result ?? stdout;
     const idx = text.indexOf("## Summary");
     if (idx === -1) {
@@ -505,9 +517,13 @@ async function emitFirstCommit(supabase, git, taskId, workdir, baseRef, branch)
  * Build a cost event from claude's stdout. Always returns a payload
  * (zero-cost when usage isn't parseable) so the cap-tracking surface
  * stays consistent: one cost_events row per attempt.
+ *
+ * NS MM-2: `engineId` is optional and appended last for the same reason as
+ * `extractReportFromOutput` — every pre-existing caller keeps resolving
+ * `claude-code` unchanged.
  */
-export function buildCostEvent(taskId, stdout, fallbackModel, runnerId) {
-    const parsed = engine.parseResult(stdout);
+export function buildCostEvent(taskId, stdout, fallbackModel, runnerId, engineId) {
+    const parsed = getEngine(engineId).parseResult(stdout);
     const model = parsed?.model ?? fallbackModel ?? "unknown";
     const usage = normalizeUsage(parsed?.usage);
     return {
@@ -713,7 +729,11 @@ async function runConflictResolutionPath(taskId, task, deps, postState_, appendE
 export function runTask(taskId, deps) {
     const git = deps.git ?? defaultGit;
     const gh = deps.gh ?? defaultGh;
-    const spawnClaude = deps.spawnClaude ?? defaultSpawnClaude;
+    // NS MM-2: `spawnClaude`'s default needs the FETCHED task's `engine` column,
+    // which isn't known this early (claim/transition haven't run yet) — its
+    // binding moves below, right after `const { task } = result;`, so the
+    // default resolves `getEngine(task.engine)` instead of the fixed default.
+    // `deps.spawnClaude` (test override) is unaffected either way.
     const checkoutBase = deps.checkoutBase ?? defaultCheckoutBase;
     const acquireLock = deps.acquireLock ?? defaultAcquireTaskLock;
     const prepareWorktree = deps.prepareWorktree ?? defaultPrepareTaskWorktree;
@@ -723,10 +743,13 @@ export function runTask(taskId, deps) {
         ((args) => defaultPostRunnerStateMessage(deps.supabase, args));
     const loadProfile = deps.loadProfile ?? defaultLoadProfile;
     const loadPromptPreludeFn = deps.loadPromptPrelude ?? loadPromptPrelude;
-    const healthProbe = deps.healthProbe ?? defaultHealthProbe;
+    // NS MM-2: same reason as `spawnClaude` above — `healthProbe`'s default
+    // binds below, after the task (and its `engine`) is fetched.
     const runPreprGate = deps.runPreprGate ??
         ((workdir, baseRef) => defaultRunPreprGate(workdir, { baseRef }));
     const reconcileRework = deps.reconcileReworkBranch ?? defaultReconcileReworkBranch;
+    const revalidateSeq = deps.revalidateMigrationSeq ??
+        ((workdir, opts) => defaultRevalidateMigrationSeq(workdir, opts));
     // FU-9: default seeds the worktree from the warm parent clone (see
     // ensureWorktreeNodeModules); logs via the runner's stderr so a doctor can see it.
     const ensureWorktreeDeps = deps.ensureWorktreeDeps ??
@@ -999,7 +1022,21 @@ export function runTask(taskId, deps) {
                 return { taskId, status: "failed", phase: "fetch", error: msg };
             }
             const result = fetched.data;
-            const { task } = result;
+            const task = result.task;
+            // NS MM-2 (BATCH-ENGINE-DISPATCH): resolve this task's build engine ONCE,
+            // right after the task itself is known — the router (NS MM-1) stamps
+            // `engine` alongside `model_id` on every dispatch path, defaulting to
+            // 'claude-code' on the DB column. `getEngine(null)` (an unstamped/
+            // pre-MM-1 row) resolves the same default Wave 1 always used, so this is
+            // byte-identical for the all-claude-code fleet. Every spawn/parse/classify
+            // call below drives THIS engine instead of a fixed module-level default.
+            const taskEngineId = task.engine ?? null;
+            const taskEngine = getEngine(taskEngineId);
+            // `spawnClaude`/`healthProbe` bind here (not in the sync prologue above)
+            // because their defaults need `taskEngineId`, which isn't known until now.
+            const spawnClaude = deps.spawnClaude ??
+                ((cwd, modelId) => defaultSpawnClaude(cwd, modelId, taskEngineId));
+            const healthProbe = deps.healthProbe ?? (() => defaultHealthProbe(taskEngineId));
             // LOCK-LIFECYCLE-WIRE: re-read the task's CURRENT file
             // scope from the live row so an operator who narrowed a QUEUED task between
             // dispatch and claim has that narrowing honoured for the agent's scope
@@ -1139,13 +1176,27 @@ export function runTask(taskId, deps) {
             // guarded clone step below, inside the provision-mutex. The repo_path_hint
             // operator pin always wins; with the flag off this is byte-identical to
             // the historic `task.repo_path_hint ?? cfg.repoPath` resolution.
+            //
+            // LOCAL-REPO-CLI: a local repo (`local.<frag>/<name>`, migration 0318) has no
+            // remote to clone from — its only copy is the working directory the operator
+            // pointed `acc repo add-local` at, recorded in this machine's config.json.
+            // So its path comes from cfg.localRepos and, critically, the clone cache is
+            // suppressed: cloning a `local.…` slug would try to reach a GitHub repo that
+            // does not exist. An explicit repo_path_hint still wins (an operator pin is
+            // always the last word), and a task for a repo this machine has no local
+            // entry for resolves exactly as before.
             const repoPathHint = task.repo_path_hint?.trim();
-            const useCloneCache = !repoPathHint && !!deps.cfg.cloneOnDemand && !!task.repo?.trim();
+            const localRepoPath = repoPathHint
+                ? null
+                : localRepoPathFor(deps.cfg, task.repo);
+            const useCloneCache = !repoPathHint && !localRepoPath && !!deps.cfg.cloneOnDemand && !!task.repo?.trim();
             const repoPath = repoPathHint
                 ? expandHomePath(repoPathHint)
-                : useCloneCache
-                    ? clonePathForRepo(task.repo.trim())
-                    : deps.cfg.repoPath;
+                : localRepoPath
+                    ? expandHomePath(localRepoPath)
+                    : useCloneCache
+                        ? clonePathForRepo(task.repo.trim())
+                        : deps.cfg.repoPath;
             const targetRepo = task.repo?.trim() || deps.cfg.targetRepo;
             // REG-301: branch base comes from task → cfg → main. cfg.integrationBranch
             // already defaults to "acc/integration" so the third fallback only
@@ -1318,6 +1369,62 @@ export function runTask(taskId, deps) {
                     error: `conflict-resolution integrity guardrail rejected resolution (${summary})`,
                 };
             };
+            /**
+             * MIG-SEQ-GUARD: last thing before `git push`, re-validate this branch's
+             * NEW migration seq against a FRESHLY-FETCHED integration head. The seq was
+             * chosen at worktree-fork time; by push time a sibling migration may have
+             * merged and taken it, and until now that only surfaced as a migration-lint
+             * failure on the PR — a whole run spent on a rename the runner can do
+             * itself. When the number is gone the migration is renumbered to the next
+             * free contiguous seq (filename + self-record + verify messages + every
+             * test that reads it by path) and committed, so the push carries the fix.
+             *
+             * Never blocks: the guard is fail-open by construction and this returns
+             * void. A renumber emits `migration.seq_renumbered` so the move is visible
+             * on the History tab rather than being a silent rewrite.
+             */
+            const runMigrationSeqGuard = async (rework) => {
+                let result;
+                try {
+                    result = await revalidateSeq(workdir, {
+                        integrationBranch,
+                        baseRef: resolvedBaseRef,
+                        remote: "origin",
+                    });
+                }
+                catch (err) {
+                    // The guard already fails open internally; this catches a stub/dep that
+                    // throws so a seq check can never be the reason a push does not happen.
+                    process.stderr.write(`[acc-runner] migration seq guard crashed (push proceeds): ` +
+                        `${err.message?.slice(0, 200)}\n`);
+                    return;
+                }
+                if (!result.renumbered || !result.move) {
+                    // Quiet on the no-op path — the overwhelming majority of pushes touch
+                    // no migration at all, and an event per push would be pure noise.
+                    if (result.skipped && result.skipped !== "no-new-migrations") {
+                        process.stderr.write(`[acc-runner] migration seq guard: ${result.detail}\n`);
+                    }
+                    return;
+                }
+                await appendEvent(deps.supabase, taskId, "log", {
+                    phase: "push",
+                    stream: "stdout",
+                    event: "migration.seq_renumbered",
+                    branch,
+                    rework,
+                    integration_branch: integrationBranch,
+                    from_seq: result.move.fromSeq,
+                    to_seq: result.move.toSeq,
+                    file: result.move.file,
+                    new_file: result.move.newFile,
+                    remote_max_seq: result.remoteMaxSeq ?? null,
+                    message: result.detail,
+                    renumber_output: result.move.output,
+                    runner_id: deps.session.runnerId,
+                });
+                process.stderr.write(`[acc-runner] migration seq guard: ${result.detail}\n`);
+            };
             try {
                 // POOL-P1b: clone-on-demand source provisioning. When the flag is on and
                 // repoPath resolved to the per-repo cache path above, clone the task's
@@ -1715,7 +1822,7 @@ export function runTask(taskId, deps) {
                     // cancellation, retry, and non-zero exit alike. Best-effort: a
                     // failed POST logs to stderr but never bubbles past the runner.
                     {
-                        const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id);
+                        const event = buildCostEvent(taskId, capturedStdout, result.model?.id, result.runner?.id, taskEngineId);
                         try {
                             await postCostEvent(event);
                         }
@@ -1754,7 +1861,7 @@ export function runTask(taskId, deps) {
                 // claude_unavailable only, so this exit-0 capacity case never retries.
                 const classifyIfFailed = (a) => {
                     if (a.exitCode !== 0) {
-                        return engine.classifyFailure(a.exitCode, a.stderr, a.stdout, a.durationMs);
+                        return taskEngine.classifyFailure(a.exitCode, a.stderr, a.stdout, a.durationMs);
                     }
                     if (isCapacityExhausted(a.stdout, a.stderr)) {
                         return {
@@ -1809,7 +1916,7 @@ export function runTask(taskId, deps) {
                     // because v0.63's health probe can upgrade a claude_unavailable exit
                     // to env_broken when the probe proves the host is genuinely broken.
                     let cls = classified ??
-                        engine.classifyFailure(attempt.exitCode, attempt.stderr, attempt.stdout, attempt.durationMs);
+                        taskEngine.classifyFailure(attempt.exitCode, attempt.stderr, attempt.stdout, attempt.durationMs);
                     // FH-1a: capacity exhaustion mid-task is NOT a task failure — but it
                     // must not ABANDON the in-flight task either. v0.56 left the task
                     // 'running' with its signal loop stopped (the outer finally) so the
@@ -2166,6 +2273,11 @@ export function runTask(taskId, deps) {
                             return { taskId, status: "failed", phase: "push", error: msg };
                         }
                     }
+                    // MIG-SEQ-GUARD: after the no-advance check (which compares heads) and
+                    // immediately before the push, so the freshest possible integration head
+                    // decides the seq. A renumber adds a commit, which is also what makes the
+                    // advance check above meaningful on a rework that only moved a number.
+                    await runMigrationSeqGuard(true);
                     try {
                         await git.push(workdir, branch);
                     }
@@ -2325,6 +2437,11 @@ export function runTask(taskId, deps) {
                         runner_id: deps.session.runnerId,
                     });
                 }
+                // MIG-SEQ-GUARD: the LAST thing before the push. It deliberately runs
+                // after the pre-PR gate rather than inside it — the gate's own MIGFIX-01
+                // renumber reads the fork-time worktree snapshot, and only a fresh fetch
+                // here can see a sibling that merged while the gate was running.
+                await runMigrationSeqGuard(false);
                 // 5. Push + open PR. Both run from the worktree so the operator's
                 // shared clone never has the task branch checked out.
                 let prUrl = "";
@@ -2380,7 +2497,7 @@ export function runTask(taskId, deps) {
                     branch,
                 });
                 try {
-                    const report = extractReportFromOutput(capturedStdout);
+                    const report = extractReportFromOutput(capturedStdout, taskEngineId);
                     // V96 (R4): generate the PR-body "Files changed" table FROM the actual
                     // pushed diff at PR-open so the body can never contradict the diff (a
                     // hand-listed file that drifted from reality). Best-effort — if the