@triflux/remote 10.43.0 → 10.45.0

package/hub/team/worktree-lifecycle.mjs

@@ -4,8 +4,16 @@
 // Remote support: host option → SSH-based git operations via remote-session.mjs.
 
 import { execFile } from "node:child_process";
-import { access, mkdir, readdir, realpath, rm } from "node:fs/promises";
-import { normalize, relative, resolve } from "node:path";
+import {
+  access,
+  mkdir,
+  mkdtemp,
+  readdir,
+  realpath,
+  rm,
+} from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, normalize, relative, resolve } from "node:path";
 import { remoteGit, validateHost } from "./remote-session.mjs";
 
 const SWARM_ROOT = ".codex-swarm";
@@ -327,24 +335,23 @@ export async function rebaseShardOntoIntegration({
     }
   }
 
-  // #127 BUG-E: capture caller's branch BEFORE any checkout. Without
-  // restoring it in finally, this function leaks main repo HEAD onto
-  // integrationBranch and every subsequent Edit/commit lands on the swarm
-  // temp branch silently (observed 2026-04-20: probe + edits + commits all
-  // ended up on swarm/.../merge while user thought they were on main).
-  let originalBranch = null;
-  try {
-    const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-    if (head && head !== "HEAD") originalBranch = head;
-  } catch {
-    /* detached HEAD or unknown — skip restore */
-  }
-
-  // Backup integration HEAD for rollback
+  // #127 BUG-E accident history: this function used to checkout the
+  // integration branch in rootDir, leak rootDir HEAD, and redirect later user
+  // edits/commits into swarm/.../merge. Integration now happens exclusively in
+  // a disposable worktree, so rootDir HEAD never moves and needs no restore.
+  //
+  // #129 BUG-J accident history: checkout failure was followed by a blind
+  // reset --hard (or branch -f rollback) against rootDir, which rewound the
+  // caller branch. Rollback now resets only the disposable worktree; there is
+  // no rootDir reset path and therefore no stash-create last-resort path.
   const backupCommit = await git(["rev-parse", integrationBranch], rootDir);
 
   let shaList = [];
   let ffError = null;
+  let integrationWorktreeAdded = false;
+  const integrationWorktree = await mkdtemp(
+    join(tmpdir(), "tfx-swarm-integration-"),
+  );
 
   try {
     const log = await git(
@@ -361,11 +368,15 @@ export async function rebaseShardOntoIntegration({
       .map((s) => s.trim())
       .filter(Boolean);
 
-    await git(["checkout", integrationBranch], rootDir);
+    await git(
+      ["worktree", "add", "--quiet", integrationWorktree, integrationBranch],
+      rootDir,
+    );
+    integrationWorktreeAdded = true;
 
     try {
-      await git(["merge", "--ff-only", shardBranch], rootDir);
-      const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+      await git(["merge", "--ff-only", shardBranch], integrationWorktree);
+      const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
       return {
         ok: true,
         headCommit,
@@ -376,12 +387,15 @@ export async function rebaseShardOntoIntegration({
     } catch (err) {
       ffError = err;
       try {
-        await git(["merge", "--abort"], rootDir);
+        await git(["merge", "--abort"], integrationWorktree);
       } catch {
         /* ff-only usually leaves no merge state */
       }
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        // Safe destructive operation: this cwd is the disposable integration
+        // worktree, never rootDir. It restores the integration ref before the
+        // cherry-pick fallback without touching user files.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
         /* fallback below will report if cherry-pick also fails */
       }
@@ -391,10 +405,10 @@ export async function rebaseShardOntoIntegration({
     // fail when histories diverge or a shard branch is checked out by a swarm
     // worktree. Cherry-pick reads commits without moving the shard branch ref.
     for (const sha of shaList) {
-      await git(["cherry-pick", sha], rootDir);
+      await git(["cherry-pick", sha], integrationWorktree);
     }
 
-    const headCommit = await git(["rev-parse", "HEAD"], rootDir);
+    const headCommit = await git(["rev-parse", "HEAD"], integrationWorktree);
     return {
       ok: true,
       headCommit,
@@ -406,42 +420,17 @@ export async function rebaseShardOntoIntegration({
         : "cherry-pick fallback",
     };
   } catch (err) {
-    try {
-      await git(["cherry-pick", "--abort"], rootDir);
-    } catch {
-      /* already clean */
-    }
-
-    // #129 BUG-J: Roll back integrationBranch without mutating whatever
-    // branch HEAD currently points at. The previous implementation did a
-    // blind `reset --hard backupCommit` on current HEAD — if the earlier
-    // `git checkout integrationBranch` inside the try block failed (e.g.
-    // integrationBranch was already checked out by a swarm worktree) the
-    // caller's branch silently rewound to integrationBranch's backup commit.
-    // Observed 2026-04-20: fix branch tree lost to main HEAD during swarm
-    // probe, requiring `git merge --ff-only origin/<branch>` recovery.
-    let currentBranch = null;
-    try {
-      const head = await git(["rev-parse", "--abbrev-ref", "HEAD"], rootDir);
-      if (head && head !== "HEAD") currentBranch = head;
-    } catch {
-      /* detached — fall through to ref-only update */
-    }
-
-    if (currentBranch === integrationBranch) {
-      // HEAD is on integrationBranch — reset advances this branch only.
+    if (integrationWorktreeAdded) {
       try {
-        await git(["reset", "--hard", backupCommit], rootDir);
+        await git(["cherry-pick", "--abort"], integrationWorktree);
       } catch {
-        /* best-effort */
+        /* already clean */
       }
-    } else {
-      // HEAD is elsewhere (originalBranch, detached, or another branch).
-      // Update the integrationBranch ref directly; never touch current HEAD.
       try {
-        await git(["branch", "-f", integrationBranch, backupCommit], rootDir);
+        // #129 rollback is now local to the disposable integration worktree.
+        await git(["reset", "--hard", backupCommit], integrationWorktree);
       } catch {
-        /* best-effort: branch may be checked out in another worktree */
+        /* best-effort */
       }
     }
 
@@ -453,14 +442,22 @@ export async function rebaseShardOntoIntegration({
       fallbackReason: ffError?.message || null,
     };
   } finally {
-    // Always restore caller's branch. Skip if originalBranch is null
-    // (detached HEAD case) or already on target.
-    if (originalBranch) {
+    if (integrationWorktreeAdded) {
       try {
-        await git(["checkout", originalBranch], rootDir);
+        await git(
+          ["worktree", "remove", "--force", integrationWorktree],
+          rootDir,
+        );
       } catch {
-        /* best-effort — caller will see HEAD on integrationBranch */
+        await rm(integrationWorktree, { recursive: true, force: true });
+        try {
+          await git(["worktree", "prune"], rootDir);
+        } catch {
+          /* best-effort metadata cleanup */
+        }
       }
+    } else {
+      await rm(integrationWorktree, { recursive: true, force: true });
     }
   }
 }

package/hub/tools.mjs

@@ -2,6 +2,11 @@
 // register/status/publish/ask/poll/handoff/HITL + team proxy
 // 모든 도구 응답: { ok: boolean, error?: { code, message }, data?: ... }
 
+import {
+  DEFAULT_ASSIGN_TIMEOUT_MS,
+  DEFAULT_ASSIGN_TTL_MS,
+  DEFAULT_HANDOFF_TTL_MS,
+} from "@triflux/core/hub/lib/timeout-defaults.mjs";
 import { createPipeline, ensurePipelineTable } from "@triflux/core/hub/pipeline/index.mjs";
 import {
   initPipelineState,
@@ -10,7 +15,6 @@ import {
 } from "@triflux/core/hub/pipeline/state.mjs";
 import { sendInputToConductorSession } from "./team/conductor-registry.mjs";
 import { getTeamBridge } from "@triflux/core/hub/team-bridge.mjs";
-import { DEFAULT_ASSIGN_TIMEOUT_MS, DEFAULT_ASSIGN_TTL_MS, DEFAULT_HANDOFF_TTL_MS } from "@triflux/core/hub/lib/timeout-defaults.mjs";
 
 const TEAM_BRIDGE_NOT_REGISTERED = "bridge_not_registered";
 
@@ -149,6 +153,19 @@ export function createTools(store, router, hitl, pipe = null) {
           },
           topics: { type: "array", items: { type: "string" }, maxItems: 64 },
           metadata: { type: "object" },
+          project_id: { type: "string", pattern: "^prj_[A-Za-z0-9_-]{22}$" },
+          session_id: { type: "string", minLength: 1, maxLength: 256 },
+          host_id: { type: "string", pattern: "^hst_[A-Za-z0-9_-]+$" },
+          transport_locators_json: {
+            description:
+              "tfx.transport-locator.v1 객체 배열 또는 그 JSON 문자열",
+            oneOf: [
+              { type: "array", items: { type: "object" } },
+              { type: "string" },
+            ],
+          },
+          hub_instance_id: { type: "string" },
+          store_fingerprint: { type: "string" },
           heartbeat_ttl_ms: {
             type: "integer",
             minimum: 10000,
@@ -174,6 +191,8 @@ export function createTools(store, router, hitl, pipe = null) {
           agent_id: { type: "string" },
           trace_id: { type: "string" },
           include_metrics: { type: "boolean", default: true },
+          hub_instance_id: { type: "string" },
+          store_fingerprint: { type: "string" },
         },
       },
       handler: wrap("STATUS_FAILED", (args) => {
@@ -194,6 +213,8 @@ export function createTools(store, router, hitl, pipe = null) {
           agent_id: { type: "string", pattern: "^[a-zA-Z0-9._:-]{3,64}$" },
           reason: { type: "string" },
           requested_by: { type: "string" },
+          hub_instance_id: { type: "string" },
+          store_fingerprint: { type: "string" },
         },
       },
       handler: wrap("TAKEOVER_ROLE_FAILED", (args) => {

package/hub/workers/codex-mcp.mjs

@@ -8,6 +8,7 @@ import { fileURLToPath } from "node:url";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 
+import { normalizeCodexProfileName } from "../../scripts/lib/codex-profile-config.mjs";
 import {
   CODEX_MCP_EXECUTION_EXIT_CODE,
   CODEX_MCP_TRANSPORT_EXIT_CODE,
@@ -134,11 +135,13 @@ function readTomlScalar(raw, key) {
 export function resolveCodexProfileConfig(profileName) {
   const result = { model: null, reasoningEffort: null };
   if (typeof profileName !== "string" || !profileName) return result;
+  const normalizedProfileName = normalizeCodexProfileName(profileName);
+  if (!normalizedProfileName) return result;
 
   const codexHome = process.env.CODEX_HOME || join(homedir(), ".codex");
   try {
     const raw = readFileSync(
-      join(codexHome, `${profileName}.config.toml`),
+      join(codexHome, `${normalizedProfileName}.config.toml`),
       "utf8",
     );
     result.model = readTomlScalar(raw, "model");
@@ -146,9 +149,13 @@ export function resolveCodexProfileConfig(profileName) {
   } catch {
     // Profile file absent (non-file alias). Derive effort from the naming
     // convention; leave model unset so codex uses its config.toml default.
-    const suffix = /_(xhigh|high|med|medium|low)$/.exec(profileName);
+    const suffix = /_(ultra|max|xhigh|high|med|medium|low)$/.exec(
+      normalizedProfileName,
+    );
     if (suffix) {
       const map = {
+        ultra: "ultra",
+        max: "max",
         xhigh: "xhigh",
         high: "high",
         med: "medium",
@@ -193,16 +200,27 @@ export function buildCodexArguments(prompt, opts = {}) {
   // profile effort merges on top of any opts.config.
   if (typeof opts.profile === "string" && opts.profile) {
     const resolved = resolveCodexProfileConfig(opts.profile);
-    if (resolved.model && typeof args.model !== "string") {
-      args.model = resolved.model;
+    const profileDerivedUltra =
+      resolved.reasoningEffort?.toLowerCase() === "ultra";
+    if (typeof args.model !== "string") {
+      if (profileDerivedUltra) args.model = "gpt-6-astra";
+      else if (resolved.model) args.model = resolved.model;
     }
     if (resolved.reasoningEffort) {
       args.config = {
         ...(args.config || {}),
-        model_reasoning_effort: resolved.reasoningEffort,
+        model_reasoning_effort: profileDerivedUltra
+          ? "max"
+          : resolved.reasoningEffort,
       };
     }
   }
+  if (typeof opts.reasoningEffort === "string" && opts.reasoningEffort) {
+    args.config = {
+      ...(args.config || {}),
+      model_reasoning_effort: opts.reasoningEffort,
+    };
+  }
 
   return args;
 }
@@ -694,6 +712,9 @@ function parseCliArgs(argv) {
       case "--model":
         options.model = next();
         break;
+      case "--reasoning-effort":
+        options.reasoningEffort = next();
+        break;
       case "--approval-policy":
         options.approvalPolicy = next();
         break;

package/hub/workers/delegator-mcp.mjs

@@ -11,6 +11,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import * as z from "zod";
+import { resolveCodexAgentPolicy } from "../../scripts/lib/agent-route-policy.mjs";
 import { resolveBashExecutable } from "@triflux/core/hub/lib/bash-path.mjs";
 import { runHeadlessWithCleanup } from "../team/headless.mjs";
 import { buildWorkerSandboxEnv } from "../team/worker-sandbox.mjs";
@@ -33,57 +34,11 @@ const { buildPromptHint, getCodexMcpConfig, SUPPORTED_MCP_PROFILES } =
   await import(pathToFileURL(mcpFilterPath).href);
 const SERVER_INFO = { name: "triflux-delegator", version: "1.0.0" };
 const DEFAULT_CONTEXT_BYTES = 32 * 1024;
-const DEFAULT_ROUTE_TIMEOUT_SEC = 120;
 const DIRECT_PROGRESS_START = 5;
 const DIRECT_PROGRESS_RUNNING = 60;
 const DIRECT_PROGRESS_DONE = 100;
 const SEARCH_ENGINE_CACHE_PATH = [".omc", "state", "search-engines.json"];
 
-const AGENT_TIMEOUT_SEC = Object.freeze({
-  executor: 1080,
-  "build-fixer": 540,
-  debugger: 900,
-  "deep-executor": 3600,
-  architect: 3600,
-  planner: 3600,
-  critic: 3600,
-  analyst: 3600,
-  "code-reviewer": 1800,
-  "security-reviewer": 1800,
-  "quality-reviewer": 1800,
-  scientist: 1440,
-  "scientist-deep": 3600,
-  "document-specialist": 1440,
-  designer: 900,
-  writer: 900,
-  explore: 300,
-  verifier: 1200,
-  "test-engineer": 300,
-  "qa-tester": 300,
-  spark: 180,
-});
-
-const CODEX_PROFILE_BY_AGENT = Object.freeze({
-  executor: "gpt56_terra_high",
-  "build-fixer": "gpt56_luna_low",
-  debugger: "gpt56_sol_xhigh",
-  "deep-executor": "gpt56_sol_xhigh",
-  architect: "gpt56_sol_xhigh",
-  planner: "gpt56_sol_xhigh",
-  critic: "gpt56_sol_xhigh",
-  analyst: "gpt56_sol_xhigh",
-  "code-reviewer": "gpt56_terra_high",
-  "security-reviewer": "gpt56_sol_xhigh",
-  "quality-reviewer": "gpt56_terra_high",
-  scientist: "gpt56_terra_high",
-  "scientist-deep": "gpt56_sol_xhigh",
-  "document-specialist": "gpt56_terra_high",
-  verifier: "gpt56_terra_high",
-  designer: "gpt56_sol_xhigh",
-  writer: "gpt56_luna_low",
-  spark: "gpt56_luna_low",
-});
-
 const REVIEW_INSTRUCTION_BY_AGENT = Object.freeze({
   "code-reviewer":
     "코드 리뷰 모드로 동작하라. 버그, 리스크, 회귀, 테스트 누락을 우선 식별하라.",
@@ -137,7 +92,7 @@ function resolveRouteScript(explicitPath, cwd = process.cwd()) {
 }
 
 function resolveCodexProfile(agentType) {
-  return CODEX_PROFILE_BY_AGENT[agentType] || "high";
+  return resolveCodexAgentPolicy(agentType).profile;
 }
 
 function normalizeProvider(provider = "auto") {
@@ -154,8 +109,7 @@ function resolveTimeoutMs(agentType, timeoutMs) {
     return Math.trunc(timeoutMs);
   }
 
-  const timeoutSec = AGENT_TIMEOUT_SEC[agentType] || DEFAULT_ROUTE_TIMEOUT_SEC;
-  return timeoutSec * 1000;
+  return resolveCodexAgentPolicy(agentType).timeoutSec * 1000;
 }
 
 function resolveTimeoutSec(agentType, timeoutMs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflux/remote",
-  "version": "10.43.0",
+  "version": "10.45.0",
   "description": "triflux remote — team mode, psmux, MCP workers, SQLite store.",
   "type": "module",
   "main": "hub/index.mjs",