@triflux/remote 10.42.0 → 10.44.0

package/hub/team/swarm-hypervisor.mjs

@@ -21,6 +21,7 @@ import {
 } from "@triflux/core/hub/dynamic-routing-engine.mjs";
 import { cleanupShardProcesses } from "@triflux/core/hub/lib/process-utils.mjs";
 import { getHostConfig } from "@triflux/core/hub/lib/ssh-command.mjs";
+import { DEFAULT_SWARM_LOCK_TTL_MS } from "@triflux/core/hub/lib/timeout-defaults.mjs";
 import { buildWorkerPrompt } from "./build-worker-prompt.mjs";
 import { registerSwarmShard } from "./claude-native-bridge.mjs";
 import { createConductor, STATES } from "./conductor.mjs";
@@ -189,7 +190,6 @@ function isInteractiveNativeBridgeShard(shard) {
  * @param {number} [opts.maxRestarts=2] — per-shard max restarts
  * @param {boolean} [opts.nativeBridge=false] — expose local shards in Claude agents
  * @param {number} [opts.graceMs=10000] — conductor shutdown grace period
- * @param {number} [opts.integrationTimeoutMs=60000] — max time for integration phase
  * @param {boolean} [opts.keepFailedWorktrees=false] — preserve failed shard worktrees for debugging
  * @param {object} [opts.probeOpts] — health probe overrides
  * @param {object} [opts.deps] — dependency injection for testing
@@ -205,7 +205,6 @@ export function createSwarmHypervisor(opts) {
     nativeBridge = false,
     graceMs = 10_000,
     keepFailedWorktrees = false,
-    _integrationTimeoutMs = 60_000,
     probeOpts = {},
     _deps = {},
   } = opts;
@@ -679,6 +678,7 @@ export function createSwarmHypervisor(opts) {
     const config = {
       id: buildSwarmSessionId(shard),
       agent: shard.agent,
+      role: shard.role,
       // #125: append Completion Protocol appendix so workers emit a
       // sentinel-framed JSON payload that conductor can reliably capture.
       prompt: buildWorkerPrompt(shard.prompt, {
@@ -1911,6 +1911,7 @@ export function createSwarmHypervisor(opts) {
    */
   /** Hub keepalive — Hub crash recovery (idle timeout은 기본 비활성이므로 crash 복구 용도) */
   let hubKeepaliveTimer = null;
+  let lockRenewTimer = null;
   function startHubKeepalive() {
     // 5분마다 Hub /status 핑 — crash 감지 시 ensureHubAlive로 재시작
     hubKeepaliveTimer = setInterval(
@@ -1960,6 +1961,22 @@ export function createSwarmHypervisor(opts) {
     }
   }
 
+  function startLockRenewal() {
+    lockRenewTimer = setInterval(() => {
+      if (!lockManager) return;
+      for (const shardName of workers.keys()) {
+        if (!completedShards.has(shardName) && !failures.has(shardName))
+          lockManager.renew(shardName);
+      }
+    }, DEFAULT_SWARM_LOCK_TTL_MS / 2);
+    lockRenewTimer.unref?.();
+  }
+
+  function stopLockRenewal() {
+    if (lockRenewTimer) clearInterval(lockRenewTimer);
+    lockRenewTimer = null;
+  }
+
   async function launch(swarmPlan) {
     if (state !== SWARM_STATES.PLANNING) {
       throw new Error(`Cannot launch in state "${state}"`);
@@ -2053,6 +2070,7 @@ export function createSwarmHypervisor(opts) {
       persistPath: join(workdir, ".triflux", "swarm-locks.json"),
     });
 
+    startLockRenewal();
     // Hub keepalive 시작
     startHubKeepalive();
 
@@ -2108,6 +2126,7 @@ export function createSwarmHypervisor(opts) {
    */
   async function shutdown(reason = "shutdown") {
     stopHubKeepalive();
+    stopLockRenewal();
     eventLog.append("swarm_shutdown", { reason, state });
 
     const shutdowns = [];

package/hub/team/swarm-locks.mjs

@@ -5,8 +5,9 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
+import { DEFAULT_SWARM_LOCK_TTL_MS } from "@triflux/core/hub/lib/timeout-defaults.mjs";
 
-const LOCK_TTL_MS = 10 * 60_000; // 10 minutes default TTL
+const LOCK_TTL_MS = DEFAULT_SWARM_LOCK_TTL_MS;
 
 // Distribution-critical paths. A swarm worker that modifies these without
 // having them explicitly listed in its shard lease is almost certainly a
@@ -208,6 +209,20 @@ export function createSwarmLocks(opts = {}) {
     return count;
   }
 
+  function renew(workerId) {
+    pruneExpired();
+    const ts = now();
+    let count = 0;
+    for (const entry of locks.values()) {
+      if (entry.workerId === workerId) {
+        entry.acquiredAt = ts;
+        count += 1;
+      }
+    }
+    if (count > 0) persist();
+    return count;
+  }
+
   /**
    * Check if a file write would violate any lease.
    * @param {string} workerId — the worker attempting the write
@@ -308,6 +323,7 @@ export function createSwarmLocks(opts = {}) {
   return Object.freeze({
     acquire,
     release,
+    renew,
     check,
     validateChanges,
     snapshot,

package/hub/team/swarm-preflight.mjs

@@ -1,6 +1,7 @@
 // hub/team/swarm-preflight.mjs — PRD swarm preflight report/gate (#188)
 // Predicts launch-time blockers before any worker session or worktree spawn.
 
+import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
 import { readHosts, resolveHost } from "@triflux/core/hub/lib/hosts-compat.mjs";
 import { whichCommand } from "@triflux/core/hub/platform.mjs";
@@ -83,6 +84,44 @@ function checkSensitive(plan, sensitiveDeny) {
   return makeCheck("sensitiveDeny", true, { matches });
 }
 
+function parseTrackedStatus(rawStatus) {
+  const files = [];
+  const records = String(rawStatus || "").split("\0");
+  for (let index = 0; index < records.length; index++) {
+    const record = records[index];
+    if (record.length < 4) continue;
+    const status = record.slice(0, 2);
+    files.push(normalizePath(record.slice(3)));
+    if (/[RC]/u.test(status) && records[index + 1]) {
+      files.push(normalizePath(records[++index]));
+    }
+  }
+  return unique(files);
+}
+
+function checkRootDirtyLease(plan, repoRoot, deps = {}) {
+  const gitStatus =
+    deps.gitStatus ||
+    ((cwd) =>
+      execFileSync(
+        "git",
+        ["status", "--porcelain=v1", "-z", "--untracked-files=no"],
+        { cwd, encoding: "utf8", windowsHide: true },
+      ));
+  const dirtyFiles = parseTrackedStatus(gitStatus(repoRoot));
+  const leasedFiles = unique(
+    [...plan.leaseMap.values()].flat().map(normalizePath),
+  );
+  const leaseSet = new Set(leasedFiles);
+  const overlappingFiles = dirtyFiles.filter((file) => leaseSet.has(file));
+
+  return makeCheck("rootDirtyLease", overlappingFiles.length === 0, {
+    dirtyFiles,
+    leasedFiles,
+    overlappingFiles,
+  });
+}
+
 function checkHosts(plan, repoRoot) {
   const registry = readHosts(repoRoot);
   const missing = [];
@@ -216,6 +255,13 @@ function collectMessages(checks) {
     );
   }
 
+  const rootDirtyLease = checks.rootDirtyLease;
+  if (rootDirtyLease && !rootDirtyLease.ok) {
+    errors.push(
+      `rootDir tracked changes overlap shard leases: ${rootDirtyLease.overlappingFiles.join(", ")}`,
+    );
+  }
+
   return { errors: unique(errors), warnings: unique(warnings) };
 }
 
@@ -258,6 +304,7 @@ export function runSwarmPreflight(prdPath, opts = {}) {
     leases: makeCheck("leases", plan.conflicts.length === 0, {
       conflicts: [...plan.conflicts],
     }),
+    rootDirtyLease: checkRootDirtyLease(plan, repoRoot, opts.deps),
     sensitiveDeny: checkSensitive(plan, sensitiveDeny),
     hosts: checkHosts(plan, repoRoot),
     workerCli: checkLocalWorkerClis(plan, opts.deps),

package/hub/team/uds-orchestrator.mjs

@@ -6,6 +6,11 @@ import { tmpdir } from "node:os";
 import { join as pathJoin } from "node:path";
 
 import { execute as defaultExecuteCodex } from "@triflux/core/hub/codex-adapter.mjs";
+import {
+  createActivityLifecycle,
+  isActivityLifecycleEnabled,
+  resolveHardCeilingMs,
+} from "@triflux/core/hub/lib/worker-lifecycle.mjs";
 import { JsonRpcWsUdsClient } from "../workers/lib/jsonrpc-ws-uds.mjs";
 import {
   buildClaudePromptDispatchPayload,
@@ -141,8 +146,11 @@ export async function runUdsOrchestration({ mode, task, claude, codex } = {}) {
   throw new Error(`Unsupported UDS orchestration mode: ${selectedMode}`);
 }
 
-function scanMessage(message, marker, state) {
+function scanMessage(message, marker, state, onActivity = () => {}) {
   const scan = (text) => {
+    // Only stream/snapshot content advances liveness. "state" heartbeats do
+    // not keep an otherwise silent turn alive forever.
+    onActivity();
     state.streamBytes += Buffer.byteLength(text);
     state.stream.push(text);
     if (/⏺/.test(stripAnsi(text))) state.assistantStarted = true;
@@ -167,7 +175,10 @@ export function subscribeClaudeUntilMarker(
   controlSock,
   short,
   marker,
-  { timeoutMs = DEFAULT_TIMEOUT_MS } = {},
+  {
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxTurnMs = Math.min(resolveHardCeilingMs(), 15 * 60_000),
+  } = {},
 ) {
   return new Promise((resolve) => {
     const socket = net.connect(controlSock);
@@ -185,7 +196,23 @@ export function subscribeClaudeUntilMarker(
       stream: [],
       assistantStarted: false,
     };
-    const timer = setTimeout(() => finish({ timedOut: true }), timeoutMs);
+    const activityEnabled = isActivityLifecycleEnabled();
+    const lifecycle = createActivityLifecycle({
+      enabled: activityEnabled,
+      interventionMs: timeoutMs,
+      hardCeilingMs: maxTurnMs,
+    });
+    let timer = null;
+
+    const armTimer = () => {
+      timer = setTimeout(async () => {
+        if (!activityEnabled) return finish({ timedOut: true });
+        const reason = await lifecycle.check();
+        if (reason) return finish({ timedOut: true, timeoutReason: reason });
+        armTimer();
+      }, timeoutMs);
+    };
+    armTimer();
 
     function finish(extra = {}) {
       if (finished) return;
@@ -209,7 +236,9 @@ export function subscribeClaudeUntilMarker(
         data = data.slice(index + 1);
         if (!line) continue;
         try {
-          scanMessage(JSON.parse(line), marker, state);
+          scanMessage(JSON.parse(line), marker, state, () =>
+            lifecycle.observe(),
+          );
         } catch (_error) {
           state.messageCount += 1;
         }
@@ -263,6 +292,7 @@ export function createClaudeUdsEndpoint({
   daemonPaths = deriveClaudeDaemonPaths(),
   cwd = process.cwd(),
   timeoutMs = DEFAULT_TIMEOUT_MS,
+  maxTurnMs = Math.min(resolveHardCeilingMs(), 15 * 60_000),
   markerFactory = () =>
     `TFX_UDS_ORCH_DONE_${crypto.randomBytes(6).toString("hex")}`,
   shortFactory,
@@ -299,7 +329,7 @@ export function createClaudeUdsEndpoint({
         sock,
         payload.short,
         marker,
-        { timeoutMs },
+        { timeoutMs, maxTurnMs },
       );
       await teardownDaemonJob({
         controlSock: sock,
@@ -441,6 +471,7 @@ export function createCodexAppServerUdsEndpoint({
   cwd = process.cwd(),
   model,
   timeoutMs = DEFAULT_CODEX_APP_SERVER_UDS_TIMEOUT_MS,
+  maxTurnMs = Math.min(resolveHardCeilingMs(), 15 * 60_000),
   bootstrapTimeoutMs = DEFAULT_CODEX_APP_SERVER_UDS_BOOTSTRAP_MS,
   clientFactory = (opts) => new JsonRpcWsUdsClient(opts),
   spawnFn = spawn,
@@ -536,10 +567,12 @@ export function createCodexAppServerUdsEndpoint({
         let offDelta = () => {};
         let offError = () => {};
         let offDone = () => {};
+        let offActivity = () => {};
         const cleanup = () => {
           offDelta();
           offError();
           offDone();
+          offActivity();
         };
         const completion = new Promise((resolve) => {
           offDelta = client.onNotification(
@@ -566,12 +599,32 @@ export function createCodexAppServerUdsEndpoint({
           { threadId, input: [{ type: "text", text: prompt }] },
           timeoutMs,
         );
+        const activityEnabled = isActivityLifecycleEnabled();
+        const lifecycle = createActivityLifecycle({
+          enabled: activityEnabled,
+          interventionMs: timeoutMs,
+          hardCeilingMs: maxTurnMs,
+        });
+        offActivity = client.onNotification("*", () => lifecycle.observe());
         let timeoutHandle = null;
         const timeoutPromise = new Promise((resolve) => {
-          timeoutHandle = setTimeout(() => {
-            cleanup();
-            resolve({ status: "timeout" });
-          }, timeoutMs);
+          const arm = () => {
+            timeoutHandle = setTimeout(async () => {
+              if (!activityEnabled) {
+                cleanup();
+                resolve({ status: "timeout" });
+                return;
+              }
+              const reason = await lifecycle.check();
+              if (reason) {
+                cleanup();
+                resolve({ status: "timeout", reason });
+                return;
+              }
+              arm();
+            }, timeoutMs);
+          };
+          arm();
         });
         let settled;
         try {

package/hub/team/worktree-lifecycle.mjs

@@ -4,8 +4,16 @@
 // Remote support: host option → SSH-based git operations via remote-session.mjs.
 
 import { execFile } from "node:child_process";
-import { access, mkdir, readdir, realpath, rm } from "node:fs/promises";
-import { normalize, relative, resolve } from "node:path";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readdir,
+  realpath,
+  rm,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, normalize, relative, resolve } from "node:path";
 import { remoteGit, validateHost } from "./remote-session.mjs";
 
 const SWARM_ROOT = ".codex-swarm";
@@ -327,24 +335,23 @@ export async function rebaseShardOntoIntegration({
     }
   }
 
-  // #127 BUG-E: capture caller's branch BEFORE any checkout. Without
-  // restoring it in finally, this function leaks main repo HEAD onto
-  // integrationBranch and every subsequent Edit/commit lands on the swarm
-  // temp branch silently (observed 2026-04-20: probe + edits + commits all
-  // ended up on swarm/.../merge while user thought they were on main).
-  let originalBranch = null;
-  try {
-    const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-    if (head && head !== "HEAD") originalBranch = head;
-  } catch {
-    /* detached HEAD or unknown — skip restore */
-  }
-
-  // Backup integration HEAD for rollback
+  // #127 BUG-E accident history: this function used to checkout the
+  // integration branch in rootDir, leak rootDir HEAD, and redirect later user
+  // edits/commits into swarm/.../merge. Integration now happens exclusively in
+  // a disposable worktree, so rootDir HEAD never moves and needs no restore.
+  //
+  // #129 BUG-J accident history: checkout failure was followed by a blind
+  // reset --hard (or branch -f rollback) against rootDir, which rewound the
+  // caller branch. Rollback now resets only the disposable worktree; there is
+  // no rootDir reset path and therefore no stash-create last-resort path.
   const backupCommit = await git(["rev-parse", integrationBranch], rootDir);
 
   let shaList = [];
   let ffError = null;
+  let integrationWorktreeAdded = false;
+  const integrationWorktree = await mkdtemp(
+    join(tmpdir(), "tfx-swarm-integration-"),
+  );
 
   try {
     const log = await git(
@@ -361,11 +368,15 @@ export async function rebaseShardOntoIntegration({
       .map((s) => s.trim())
       .filter(Boolean);
 
-    await git(["checkout", integrationBranch], rootDir);
+    await git(
+      ["worktree", "add", "--quiet", integrationWorktree, integrationBranch],
+      rootDir,
+    );
+    integrationWorktreeAdded = true;
 
     try {
-      await git(["merge", "--ff-only", shardBranch], rootDir);
-      const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+      await git(["merge", "--ff-only", shardBranch], integrationWorktree);
+      const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
       return {
         ok: true,
         headCommit,
@@ -376,12 +387,15 @@ export async function rebaseShardOntoIntegration({
     } catch (err) {
       ffError = err;
       try {
-        await git(["merge", "--abort"], rootDir);
+        await git(["merge", "--abort"], integrationWorktree);
       } catch {
         /* ff-only usually leaves no merge state */
       }
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        // Safe destructive operation: this cwd is the disposable integration
+        // worktree, never rootDir. It restores the integration ref before the
+        // cherry-pick fallback without touching user files.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
         /* fallback below will report if cherry-pick also fails */
       }
@@ -391,10 +405,10 @@ export async function rebaseShardOntoIntegration({
     // fail when histories diverge or a shard branch is checked out by a swarm
     // worktree. Cherry-pick reads commits without moving the shard branch ref.
     for (const sha of shaList) {
-      await git(["cherry-pick", sha], rootDir);
+      await git(["cherry-pick", sha], integrationWorktree);
     }
 
-    const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+    const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
     return {
       ok: true,
       headCommit,
@@ -406,42 +420,17 @@ export async function rebaseShardOntoIntegration({
         : "cherry-pick fallback",
     };
   } catch (err) {
-    try {
-      await git(["cherry-pick", "--abort"], rootDir);
-    } catch {
-      /* already clean */
-    }
-
-    // #129 BUG-J: Roll back integrationBranch without mutating whatever
-    // branch HEAD currently points at. The previous implementation did a
-    // blind `reset --hard backupCommit` on current HEAD — if the earlier
-    // `git checkout integrationBranch` inside the try block failed (e.g.
-    // integrationBranch was already checked out by a swarm worktree) the
-    // caller's branch silently rewound to integrationBranch's backup commit.
-    // Observed 2026-04-20: fix branch tree lost to main HEAD during swarm
-    // probe, requiring `git merge --ff-only origin/<branch>` recovery.
-    let currentBranch = null;
-    try {
-      const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-      if (head && head !== "HEAD") currentBranch = head;
-    } catch {
-      /* detached — fall through to ref-only update */
-    }
-
-    if (currentBranch === integrationBranch) {
-      // HEAD is on integrationBranch — reset advances this branch only.
+    if (integrationWorktreeAdded) {
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        await git(["cherry-pick", "--abort"], integrationWorktree);
       } catch {
-        /* best-effort */
+        /* already clean */
       }
-    } else {
-      // HEAD is elsewhere (originalBranch, detached, or another branch).
-      // Update the integrationBranch ref directly; never touch current HEAD.
       try {
-        await git(["branch", "-f", integrationBranch, backupCommit], rootDir);
+        // #129 rollback is now local to the disposable integration worktree.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
-        /* best-effort: branch may be checked out in another worktree */
+        /* best-effort */
       }
     }
 
@@ -453,14 +442,22 @@ export async function rebaseShardOntoIntegration({
       fallbackReason: ffError?.message || null,
     };
   } finally {
-    // Always restore caller's branch. Skip if originalBranch is null
-    // (detached HEAD case) or already on target.
-    if (originalBranch) {
+    if (integrationWorktreeAdded) {
       try {
-        await git(["checkout", originalBranch], rootDir);
+        await git(
+          ["worktree", "remove", "--force", integrationWorktree],
+          rootDir,
+        );
       } catch {
-        /* best-effort — caller will see HEAD on integrationBranch */
+        await rm(integrationWorktree, { recursive: true, force: true });
+        try {
+          await git(["worktree", "prune"], rootDir);
+        } catch {
+          /* best-effort metadata cleanup */
+        }
       }
+    } else {
+      await rm(integrationWorktree, { recursive: true, force: true });
     }
   }
 }

package/hub/tools.mjs

@@ -2,6 +2,11 @@
 // register/status/publish/ask/poll/handoff/HITL + team proxy
 // 모든 도구 응답: { ok: boolean, error?: { code, message }, data?: ... }
 
+import {
+  DEFAULT_ASSIGN_TIMEOUT_MS,
+  DEFAULT_ASSIGN_TTL_MS,
+  DEFAULT_HANDOFF_TTL_MS,
+} from "@triflux/core/hub/lib/timeout-defaults.mjs";
 import { createPipeline, ensurePipelineTable } from "@triflux/core/hub/pipeline/index.mjs";
 import {
   initPipelineState,
@@ -148,6 +153,14 @@ export function createTools(store, router, hitl, pipe = null) {
           },
           topics: { type: "array", items: { type: "string" }, maxItems: 64 },
           metadata: { type: "object" },
+          project_id: { type: "string", pattern: "^prj_[A-Za-z0-9_-]{22}$" },
+          session_id: { type: "string", minLength: 1, maxLength: 256 },
+          host_id: { type: "string", pattern: "^hst_[A-Za-z0-9_-]+$" },
+          transport_locators_json: {
+            description:
+              "tfx.transport-locator.v1 객체 배열 또는 그 JSON 문자열",
+            oneOf: [{ type: "array", items: { type: "object" } }, { type: "string" }],
+          },
           heartbeat_ttl_ms: {
             type: "integer",
             minimum: 10000,
@@ -359,7 +372,7 @@ export function createTools(store, router, hitl, pipe = null) {
             type: "integer",
             minimum: 1000,
             maximum: 86400000,
-            default: 600000,
+            default: DEFAULT_HANDOFF_TTL_MS,
           },
           trace_id: { type: "string" },
           correlation_id: { type: "string" },
@@ -396,13 +409,13 @@ export function createTools(store, router, hitl, pipe = null) {
             type: "integer",
             minimum: 1000,
             maximum: 86400000,
-            default: 600000,
+            default: DEFAULT_ASSIGN_TTL_MS,
           },
           timeout_ms: {
             type: "integer",
             minimum: 1000,
             maximum: 86400000,
-            default: 600000,
+            default: DEFAULT_ASSIGN_TIMEOUT_MS,
           },
           max_retries: { type: "integer", minimum: 0, maximum: 20, default: 0 },
           trace_id: { type: "string" },