@tokenfactory/acc-runner 0.47.17 → 0.47.18

package/dist/task-runner.js

@@ -1,3 +1,7 @@
+import { writeTaskHookContext } from "./task-write-hook.js";
+import { readTaskStatus, assertTaskWritable, TERMINAL_STATUSES, TaskWriteClosedError } from "./task-liveness.js";
+import { cancellationTokenSpend, retainOrphanWork, terminatePane } from "./orphan-work.js";
+import { processTreeRegistry } from "./process-tree.js";
 /**
  * Task execution path. Called by watch.ts when a task_assigned broadcast
  * lands on the runner channel.
@@ -61,7 +65,7 @@ import { assertResolutionIntegrity, isConflictResolutionTask, summariseFailures,
 import { depsMissingGateResult, depsStaleGateResult, gateFailureBlockReason, gateRunnerCrashResult, runPreprGate as defaultRunPreprGate, classifyDanglingParentDeps, DEPS_MISSING_CLASSIFICATION, DEPS_STALE_CLASSIFICATION, GATE_TOOL_CRASHED_CLASSIFICATION, PREPR_GATE_FAILED_CLASSIFICATION, PREPR_GATES, } from "./prepr-gate.js";
 import { revalidateMigrationSeq as defaultRevalidateMigrationSeq, } from "./migration-seq-guard.js";
 import { readAppliedMigrationSeqs } from "./applied-seq-roster.js";
-import { commitGuardSkipRequested, gitConfigHooksEnv, installCommitGuardSync, } from "./commit-guard.js";
+import { gitConfigHooksEnv, installCommitGuardSync, } from "./commit-guard.js";
 import { readLiveAllowedGlobs } from "./locks/index.js";
 import { declaredLockPaths, planClaimLockLoss, } from "./locks/claim-lock-policy.js";
 import { resolveCredentialIdentity } from "./credential-identity.js";
@@ -124,18 +128,16 @@ function defaultSpawnClaude(cwd, modelId, engineId, codexApiKey = null) {
     // worktree and point the agent's git at it via an ephemeral core.hooksPath env
     // (never a config-file write). The agent then hits an actionable in-session
     // block if it tries to commit a NUL-byte / invalid-UTF-8 / binary-blob text
-    // file — the defect that got PR #265 rejected four times. Best-effort: a guard
-    // install failure must not block the task (the pre-PR gate in prepr-gate.ts is
-    // the backstop), and unit tests inject their own spawnClaude so this never
-    // runs there.
+    // file. Installation is mandatory because these hooks also fence terminal
+    // tasks and closed PRs. Unit tests can inject spawnClaude.
     let baseEnv;
-    if (!commitGuardSkipRequested(process.env)) {
+    {
         try {
-            const hooksDir = installCommitGuardSync(cwd);
+            const hooksDir = installCommitGuardSync(cwd, undefined, true);
             baseEnv = gitConfigHooksEnv(hooksDir);
         }
-        catch {
-            baseEnv = undefined;
+        catch (err) {
+            throw new Error(`Cannot install task write fence: ${err.message}`);
         }
     }
     if (codexApiKey) {
@@ -641,7 +643,7 @@ async function ensureBranchReadyForPr(git, workdir, baseRef, branch, taskId) {
     }
     return { ok: true };
 }
-async function streamToEvents(stream, supabase, taskId, streamName) {
+async function streamToEvents(stream, supabase, taskId, streamName, onChunk) {
     let captured = "";
     let pending = "";
     const flush = async () => {
@@ -654,6 +656,7 @@ async function streamToEvents(stream, supabase, taskId, streamName) {
     };
     for await (const raw of stream) {
         const text = typeof raw === "string" ? raw : raw.toString("utf8");
+        onChunk?.(text);
         pending += text;
         if (pending.length >= LOG_BATCH_BYTES)
             await flush();
@@ -1063,11 +1066,20 @@ export function runTask(taskId, deps) {
     // deps stale and the remediation install couldn't fix it. Distinct from
     // `worktreeDepsMissing` (nothing was ever seeded) so triage names the right fault.
     let worktreeDepsStale = null;
-    const runPreprGate = async (workdir, baseRef) => worktreeDepsMissing !== null
-        ? depsMissingGateResult(worktreeDepsMissing)
-        : worktreeDepsStale !== null
-            ? depsStaleGateResult(worktreeDepsStale.repoPath, worktreeDepsStale.detail)
-            : runPreprGateRaw(workdir, baseRef);
+    const runPreprGate = async (workdir, baseRef) => {
+        await checkTerminal();
+        if (orphanReason)
+            throw new Error(orphanReason);
+        const result = worktreeDepsMissing !== null
+            ? depsMissingGateResult(worktreeDepsMissing)
+            : worktreeDepsStale !== null
+                ? depsStaleGateResult(worktreeDepsStale.repoPath, worktreeDepsStale.detail)
+                : await runPreprGateRaw(workdir, baseRef);
+        await checkTerminal();
+        if (orphanReason)
+            throw new Error(orphanReason);
+        return result;
+    };
     const emitGateTimeoutBreadcrumb = async (fail) => {
         if (!fail.wallClockTimeout)
             return;
@@ -1125,7 +1137,37 @@ export function runTask(taskId, deps) {
     // inject a mock. Drop in v0.7.
     void checkoutBase;
     let child = null;
+    let paneActive = false;
+    let cancellationVerb = "runner.terminal_cancelled";
     let cancelled = false;
+    let orphanReason = null;
+    let cancelledAt = null;
+    let cancellationOutput = "";
+    let observedOutput = "";
+    let paneEngine = null;
+    let panePid = null;
+    let originTaskId;
+    const startedAt = Date.now();
+    const cancelOrphan = (reason, terminalSignal = true) => {
+        if (orphanReason)
+            return;
+        orphanReason = reason;
+        cancellationVerb = terminalSignal ? "runner.terminal_cancelled" : "runner.write_refused";
+        cancelledAt = Date.now();
+        cancellationOutput = observedOutput;
+        cancelled = true;
+        if (child && paneActive)
+            terminatePane(child);
+        // Gate processes are detached groups tracked by the production gate runner.
+        processTreeRegistry.reapTask(taskId);
+    };
+    const checkTerminal = async () => {
+        for (const id of new Set([taskId, originTaskId].filter((v) => !!v))) {
+            const status = await readTaskStatus(deps.supabase, id);
+            if (TERMINAL_STATUSES.has(status))
+                cancelOrphan(`${id}:${status}`);
+        }
+    };
     // v0.14-MESSAGING-RUNTIME-WIRE: convenience wrapper that scopes every
     // bus message to this task + this runner. Best-effort: an underlying
     // RPC failure is logged inside defaultPostRunnerStateMessage and never
@@ -1275,15 +1317,19 @@ export function runTask(taskId, deps) {
         }
     };
     const scheduleSignal = () => {
-        if (signalStopped)
+        if (signalStopped || cancelled)
             return;
         signalTimer = setTimeout(async () => {
-            if (signalStopped)
+            if (signalStopped || cancelled)
                 return;
             try {
-                await updateSignal();
+                await checkTerminal();
+                if (!cancelled)
+                    await updateSignal();
+            }
+            catch (err) {
+                process.stderr.write(`[acc-runner] terminal poll failed: ${err.message}\n`);
             }
-            catch { /* logged inside */ }
             scheduleSignal();
         }, signalIntervalMs);
         // Detach so an in-flight signal timer doesn't keep the process
@@ -1314,6 +1360,15 @@ export function runTask(taskId, deps) {
         // in SQL (acc._declared_lock_paths) so the DB overlap key is file-granular
         // too; this read is a best-effort breadcrumb + input to the conflict
         // back-off below and never fails the claim.
+        // Claim-time read refuses terminal tasks before the claim RPC can revive them.
+        try {
+            await checkTerminal();
+            if (cancelled)
+                return { taskId, status: "cancelled" };
+        }
+        catch (err) {
+            return { taskId, status: "failed", phase: "claim_locks", error: err.message };
+        }
         let claimLockScope = [];
         try {
             claimLockScope = declaredLockPaths(await readLiveAllowedGlobs(deps.supabase, taskId));
@@ -1581,6 +1636,11 @@ export function runTask(taskId, deps) {
             }
             const result = fetched.data;
             const task = result.task;
+            if (TERMINAL_STATUSES.has(task.status)) {
+                cancelOrphan(`${taskId}:${task.status}`);
+                return { taskId, status: "cancelled" };
+            }
+            paneEngine = task.engine ?? null;
             // NS MM-2 (BATCH-ENGINE-DISPATCH): resolve this task's build engine ONCE,
             // right after the task itself is known — the router (NS MM-1) stamps
             // `engine` alongside `model_id` on every dispatch path, defaulting to
@@ -1719,6 +1779,7 @@ export function runTask(taskId, deps) {
                     repo: task.repo,
                     branch: task.branch,
                 });
+                originTaskId = reworkMeta?.origin_task_id || undefined;
                 if (!reworkMeta) {
                     const msg = "rework task missing PR metadata (acc-rework sentinel or pr_number + repo on task row)";
                     await appendEvent(deps.supabase, taskId, "error", { phase: "rework", error: msg });
@@ -1873,6 +1934,17 @@ export function runTask(taskId, deps) {
             // return that follows.
             let worktree = null;
             let workdir = repoPath;
+            const fenceWrites = async () => {
+                if (orphanReason)
+                    throw new Error(orphanReason);
+                try {
+                    await assertTaskWritable({ db: deps.supabase, taskId, originTaskId, gh, workdir, branch });
+                }
+                catch (err) {
+                    cancelOrphan(err.message, err instanceof TaskWriteClosedError);
+                    throw err;
+                }
+            };
             // v0.19 T-64-1: the ref the task branch is actually forked from, set
             // once the base is resolved below. Used as the `base..branch` range for
             // the first-commit SLO so the signal stays accurate now that FRESH
@@ -2702,8 +2774,18 @@ export function runTask(taskId, deps) {
                 let useRoutedModel = true;
                 let pinRefusalLogged = false;
                 const runClaudeOnce = async () => {
+                    await checkTerminal();
+                    if (cancelled)
+                        return { exitCode: null, stdout: "", stderr: "", durationMs: 0 };
                     const spawnedAt = Date.now();
+                    // Persist only public hook context before spawn. Hook installation is mandatory
+                    // for the production engine path, including when the byte-scan escape hatch is set.
+                    if (!deps.spawnClaude) {
+                        writeTaskHookContext(workdir, { cfg: deps.cfg, taskId, branch, originTaskId });
+                    }
                     child = spawnClaude(workdir, useRoutedModel ? spawnModel.model : undefined);
+                    paneActive = true;
+                    panePid = child.pid ?? null;
                     // Log the refused pin once, only on the routed path (shouldLogPinRefusal).
                     if (shouldLogPinRefusal(useRoutedModel, spawnModel) && !pinRefusalLogged) {
                         pinRefusalLogged = true;
@@ -2721,7 +2803,7 @@ export function runTask(taskId, deps) {
                         child.stdin.end();
                     }
                     const stdoutPromise = child.stdout
-                        ? streamToEvents(child.stdout, deps.supabase, taskId, "stdout")
+                        ? streamToEvents(child.stdout, deps.supabase, taskId, "stdout", text => { observedOutput += text; })
                         : Promise.resolve("");
                     const stderrPromise = child.stderr
                         ? streamToEvents(child.stderr, deps.supabase, taskId, "stderr")
@@ -2731,6 +2813,7 @@ export function runTask(taskId, deps) {
                         stdoutPromise,
                         stderrPromise,
                     ]);
+                    paneActive = false;
                     // One cost_events row per attempt so cap tracking captures success,
                     // cancellation, retry, and non-zero exit alike. Best-effort: a
                     // failed POST logs to stderr but never bubbles past the runner.
@@ -3427,6 +3510,8 @@ export function runTask(taskId, deps) {
                     // class as a gate TOOL that crashed — it judged nothing, so it parks
                     // the task instead of charging the crash to the diff (still no push).
                     const reworkGate = await runPreprGate(workdir, resolvedBaseRef).catch((err) => gateRunnerCrashResult(err));
+                    if (orphanReason)
+                        return { taskId, status: "cancelled" };
                     if (!reworkGate.skipped && reworkGate.crash) {
                         return handleGateToolCrash(reworkGate, reworkGate.crash, true);
                     }
@@ -3499,6 +3584,7 @@ export function runTask(taskId, deps) {
                     const reworkConformance = await runConformanceGate(true, capturedStdout);
                     if (reworkConformance)
                         return reworkConformance;
+                    await fenceWrites();
                     try {
                         await git.push(workdir, branch);
                     }
@@ -3598,6 +3684,8 @@ export function runTask(taskId, deps) {
                 // CLOSED (`ok: false` — no PR is opened off a check that never ran), but
                 // it is reported as infra (`crash`), not as a verdict on the diff.
                 const prepr = await runPreprGate(workdir, resolvedBaseRef).catch((err) => gateRunnerCrashResult(err));
+                if (orphanReason)
+                    return { taskId, status: "cancelled" };
                 if (!prepr.skipped && prepr.crash) {
                     return handleGateToolCrash(prepr, prepr.crash, false);
                 }
@@ -3714,6 +3802,7 @@ export function runTask(taskId, deps) {
                 // renumber reads the fork-time worktree snapshot, and only a fresh fetch
                 // here can see a sibling that merged while the gate was running.
                 await runMigrationSeqGuard(false);
+                await fenceWrites();
                 const ready = await ensureBranchReadyForPr(git, workdir, resolvedBaseRef, branch, taskId);
                 if (!ready.ok) {
                     const readinessClass = /no commits on branch/.test(ready.reason)
@@ -3748,6 +3837,7 @@ export function runTask(taskId, deps) {
                 // The §7 report the PR-open path extracts, kept so the
                 // session-end hook below can file it on the board.
                 let sessionReport = null;
+                await fenceWrites();
                 try {
                     await git.push(workdir, branch);
                 }
@@ -4010,7 +4100,33 @@ export function runTask(taskId, deps) {
                 // lock on every completion path (success, failure, cancellation,
                 // unexpected throw). Both legs are best-effort — leaking either
                 // resource is preferable to masking the original return value.
-                if (worktree) {
+                if (orphanReason) {
+                    let artifact = null;
+                    try {
+                        artifact = await retainOrphanWork(workdir, taskId, orphanReason);
+                    }
+                    catch (err) {
+                        process.stderr.write(`[acc-runner] orphan manifest failed; worktree retained at ${workdir}: ${err.message}\n`);
+                    }
+                    const spend = cancellationTokenSpend(getEngine(paneEngine).parseResult(cancellationOutput)?.usage);
+                    const payload = {
+                        task_id: taskId, pane_id: panePid, runner_id: deps.session.runnerId,
+                        cancelled_at: new Date(cancelledAt ?? Date.now()).toISOString(),
+                        elapsed_ms: (cancelledAt ?? Date.now()) - startedAt, reason: orphanReason,
+                        ...spend,
+                        artifact, worktree: workdir, summary: `Retained orphaned work for ${taskId} at ${workdir}; see git status and git diff HEAD`,
+                    };
+                    process.stderr.write(`[acc-runner] orphan retained: ${JSON.stringify(payload)}\n`);
+                    try {
+                        const logged = await deps.supabase.rpc("log_activity", { p_verb: cancellationVerb, p_target_id: taskId, p_target_type: "task", p_payload: payload });
+                        if (logged.error)
+                            process.stderr.write(`[acc-runner] cancellation activity failed: ${logged.error.message}\n`);
+                    }
+                    catch (err) {
+                        process.stderr.write(`[acc-runner] cancellation activity failed: ${err.message}\n`);
+                    }
+                }
+                if (worktree && !orphanReason) {
                     // v0.37-A: clear any stale .git/HEAD.lock or index.lock so the
                     // `git worktree remove` + `prune` inside cleanup() don't trip on
                     // a leftover lock from the prior worktree add or claude run.
@@ -4064,7 +4180,11 @@ export function runTask(taskId, deps) {
             // task's newer claim on the same runner is preserved.
             await writeRunnerCurrentTask(null);
         }
-    })();
+    })().catch((err) => {
+        if (orphanReason)
+            return { taskId, status: "cancelled", error: orphanReason };
+        throw err;
+    });
     return {
         taskId,
         promise,