@triflux/remote 10.46.0 → 10.48.0

package/hub/server.mjs

@@ -72,9 +72,7 @@ import {
 } from "@triflux/core/hub/state.mjs";
 import { createStoreAdapter } from "./store-adapter.mjs";
 import { createCtoAutoCollector } from "./team/cto-auto-collect.mjs";
-import { createGitPreflight } from "./team/git-preflight.mjs";
 import { nativeProxy } from "./team/nativeProxy.mjs";
-import { createSwarmLocks } from "./team/swarm-locks.mjs";
 import {
   createSynapseRegistry,
   projectPeer,
@@ -119,14 +117,6 @@ const AIMD_WINDOW_MS = 30 * 60 * 1000;
 const AIMD_INITIAL_BATCH_SIZE = 3;
 const AIMD_MIN_BATCH_SIZE = 1;
 const AIMD_MAX_BATCH_SIZE = 10;
-const SYNAPSE_VALID_OPS = new Set([
-  "checkout",
-  "rebase",
-  "cherry-pick",
-  "reset",
-  "stash-pop",
-  "worktree-remove",
-]);
 const HUB_IDLE_TIMEOUT_DEFAULT_MS = 30 * 60 * 1000;
 const HUB_IDLE_SWEEP_DEFAULT_MS = 60 * 1000;
 const STATIC_CONTENT_TYPES = Object.freeze({
@@ -1124,21 +1114,13 @@ export async function startHub({
   }
   const delegatorService = new DelegatorService({ worker: delegatorWorker });
 
-  // Synapse Layer 4: session registry + git preflight + swarm locks
+  // Synapse Layer 4: session registry
   const synapseEmitter = new EventEmitter();
   synapseEmitter.setMaxListeners(50);
   const synapseRegistry = createSynapseRegistry({
     persistPath: join(CACHE_DIR, "tfx-hub", "synapse-sessions.json"),
     emitter: synapseEmitter,
   });
-  const swarmLocks = createSwarmLocks({
-    repoRoot: PROJECT_ROOT,
-    persistPath: join(CACHE_DIR, "tfx-hub", "swarm-locks.json"),
-  });
-  const gitPreflight = createGitPreflight({
-    registry: synapseRegistry,
-    locks: swarmLocks,
-  });
   const ctoAutoCollector = createCtoAutoCollector({
     registry: synapseRegistry,
     runCollect,
@@ -1437,7 +1419,7 @@ export async function startHub({
         });
       }
 
-      // ── Synapse Layer 5: session registry + locks + preflight routes ──
+      // ── Synapse Layer 5: session registry routes ──
       // Admin/raw snapshot (loopback-only). Returns raw cwd/pid for local
       // admin/HUD use; the redacted peer surface is GET /synapse/peers.
       if (path === "/synapse/sessions" && req.method === "GET") {
@@ -1642,37 +1624,6 @@ export async function startHub({
         }
       }
 
-      if (path === "/synapse/locks" && req.method === "GET") {
-        return writeJson(res, 200, {
-          ok: true,
-          locks: swarmLocks.snapshot(),
-          ts: Date.now(),
-        });
-      }
-
-      if (path === "/synapse/preflight" && req.method === "POST") {
-        try {
-          const body = await parseBody(req);
-          const { op, args = {}, sessionContext = {} } = body;
-          if (!op || typeof op !== "string") {
-            return writeJson(res, 400, { ok: false, error: "op 필수" });
-          }
-          if (!SYNAPSE_VALID_OPS.has(op)) {
-            return writeJson(res, 400, {
-              ok: false,
-              error: `invalid op: ${op}`,
-            });
-          }
-          const result = gitPreflight.check(op, args, sessionContext);
-          return writeJson(res, 200, { ok: true, ...result });
-        } catch (err) {
-          return writeJson(res, 400, {
-            ok: false,
-            error: String(err?.message || err),
-          });
-        }
-      }
-
       if (path.startsWith("/bridge")) {
         const isBridgeStatusGet =
           path === "/bridge/status" && req.method === "GET";

package/hub/team/codex-review.mjs

@@ -1,7 +1,6 @@
 // Codex headless review helper. Runs a cross-model review of a git diff
-// without going through Bash-level headless-guard (the guard only inspects
-// `codex exec` invoked from the Bash tool — node `spawn` bypasses it
-// intentionally because `tfx` is the sanctioned entry point).
+// through node `spawn` rather than the Bash tool, because `tfx` is the
+// sanctioned entry point for Codex.
 //
 // Contract:
 //   runCodexReview({ ref = "HEAD", base?: string, timeoutMs = 180_000 })

package/hub/team/cto-auto-collect.mjs

@@ -2,7 +2,7 @@ import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import { resolveLakeRootDir } from "../../cto/lake-root.mjs";
-import { resolveRoleControlSnapshot } from "@triflux/core/hub/lib/cto-env.mjs";
+import { resolveRoleControlSnapshot } from "../lib/cto-env.mjs";
 
 const DEFAULT_DEBOUNCE_MS = 120_000;
 

package/hub/team/cto-pull.mjs

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-import { resolveRoleControlSnapshot } from "@triflux/core/hub/lib/cto-env.mjs";
+import { resolveRoleControlSnapshot } from "../lib/cto-env.mjs";
 
 function defaultLakeRoot() {
   return join(process.cwd(), ".triflux", "lake");

package/hub/team/launcher-template.mjs

@@ -1,5 +1,5 @@
 // hub/team/launcher-template.mjs — 결정론적 런처 생성
-// 기존 codex-adapter와 Antigravity stdin 계약을 소비하여
+// 기존 codex-adapter와 Antigravity print-value 계약을 소비하여
 // 동일 입력 → 동일 args 배열을 보장한다.
 // F1 해결: codex adapter가 --dangerously-bypass-approvals-and-sandbox 자동 추가
 // F4 해결: codex exec "prompt" 인라인 (파이프/리다이렉트 아님)
@@ -18,6 +18,7 @@ function shellSingleQuote(value) {
 
 function buildAntigravityArgs(opts = {}) {
   const prompt = typeof opts.prompt === "string" ? opts.prompt : "";
+  // agy 1.1.27: --print 는 값(프롬프트) 필수, stdin 프롬프트 불가.
   const command = `agy --dangerously-skip-permissions --print ${shellSingleQuote(prompt)}`;
   if (opts.resultFile) {
     return `${command} > ${shellSingleQuote(opts.resultFile)} 2>${shellSingleQuote(`${opts.resultFile}.err`)}`;

package/hub/team/recovery-store.mjs

@@ -1,6 +1,6 @@
 // hub/team/recovery-store.mjs — Best-effort preservation of worker changes
 // before a dirty worktree is removed. Uses file-based `.patch` + JSON manifest
-// instead of git stash (git-preflight flags stash-pop/worktree-remove as risky).
+// instead of git stash, which is risky to pop under concurrent worktree use.
 
 import { execFile } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

package/hub/team/synapse-registry.mjs

@@ -48,9 +48,9 @@ function hasDirtyFiles(session) {
 // A session is "live" while active OR idle. Idle is an interactive session that
 // missed its heartbeat interval but is still under the TTL — alive but inactive,
 // not presumed dead. getActive() and querySessions() share this single predicate
-// so the liveness contract can't drift: getActive() feeds git-preflight's
-// dirty-file conflict guard, so dropping idle there would hide a still-live
-// interactive session's claimed paths from that safety check.
+// so the liveness contract can't drift: getActive() feeds peer discovery,
+// CTO status/hygiene and log retention, so dropping idle there would hide a
+// still-live interactive session from every one of those consumers.
 function isLiveStatus(status) {
   return status === "active" || status === "idle";
 }
@@ -337,7 +337,7 @@ export function createSynapseRegistry(opts = {}) {
     // session resuming: Claude Code re-fires SessionStart with the same
     // session_id on resume/clear/compact, so fall through and re-register
     // (revive) it. Otherwise the resumed-but-live session stays stale forever
-    // and vanishes from peer-discovery AND git-preflight's dirty-file guard.
+    // and vanishes from peer-discovery.
     const existing = sessions.get(sessionId);
     if (existing && isLiveStatus(existing.status)) {
       console.warn(
@@ -381,10 +381,13 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   // stale/expired 세션이 cutoff 넘게 누적되면 Map에서 제거.
-  // live(active/idle)는 lastHeartbeat가 오래돼도 보존 — git-preflight dirty-file 가드가 의존.
-  // Dirty stale rows keep the historical 24h window because same-id resume
-  // revives their dirty-file guard; clean stale rows expire quickly to avoid
-  // daily dummy rows after overnight operator gaps.
+  // live(active/idle) rows survive a long-stale lastHeartbeat because peer
+  // discovery and CTO status/hygiene still read them.
+  // Dirty stale rows keep the historical 24h window. Its original consumer,
+  // the git-preflight dirty-file guard, is gone and nothing populates
+  // dirtyFiles today, so this split is a candidate for collapsing into one
+  // window. Clean stale rows expire quickly to avoid daily dummy rows after
+  // overnight operator gaps.
   function pruneExpired(opts2 = {}) {
     if (destroyed) return { removed: [], count: 0 };
 
@@ -510,9 +513,9 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   function getActive() {
-    // Live = active or idle. git-preflight uses this to detect other live
-    // sessions whose dirty files would conflict; an idle interactive session is
-    // still live (process alive, dirty files on disk) and must stay visible.
+    // Live = active or idle. Peer discovery, CTO status/hygiene and log
+    // retention read this list; an idle interactive session is still live
+    // (process alive) and must stay visible to them.
     return [...sessions.values()]
       .filter((session) => isLiveStatus(session.status))
       .map((session) => cloneSession(session));

package/hub/team/worktree-lifecycle.mjs

@@ -273,6 +273,8 @@ export async function ensureWorktree({
  * @param {string} opts.baseBranch
  * @param {string} [opts.rootDir=process.cwd()]
  * @returns {Promise<{ integrationBranch: string, baseCommit: string }>}
+ * @throws {Error} when the integration branch is checked out by another
+ * worktree; this is an intentional NO-GO and leaves that worktree untouched.
  */
 export async function prepareIntegrationBranch({
   runId,
@@ -299,42 +301,17 @@ export async function prepareIntegrationBranch({
  * Rebase a shard branch onto the integration branch.
  * Uses rebase + fast-forward only (no merge commits).
  *
- * Synapse v1: when a `preflight` checker + `sessionContext` are provided,
- * the rebase is pre-flighted against active sessions' dirty files/leases.
- * Blocked rebases return `{ ok: false, preflight: decision }` without touching
- * any branch. If preflight is omitted, behavior is unchanged.
- *
  * @param {object} opts
  * @param {string} opts.shardBranch — the shard's branch name
  * @param {string} opts.integrationBranch — target integration branch
  * @param {string} [opts.rootDir=process.cwd()]
- * @param {{ checkRebase: Function } | null} [opts.preflight=null] — git-preflight instance
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
- * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string, preflight?: object }>}
+ * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string }>}
  */
 export async function rebaseShardOntoIntegration({
   shardBranch,
   integrationBranch,
   rootDir = process.cwd(),
-  preflight = null,
-  sessionContext = null,
 }) {
-  // Synapse v1 pre-flight: bail out before mutating branches when another
-  // session claims overlapping files.
-  if (preflight && sessionContext) {
-    const decision = preflight.checkRebase(
-      { branch: integrationBranch },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked rebase: ${decision.reason || "overlap"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   // #127 BUG-E accident history: this function used to checkout the
   // integration branch in rootDir, leak rootDir HEAD, and redirect later user
   // edits/commits into swarm/.../merge. Integration now happens exclusively in
@@ -458,6 +435,11 @@ export async function rebaseShardOntoIntegration({
       }
     } else {
       await rm(integrationWorktree, { recursive: true, force: true });
+      try {
+        await git(["worktree", "prune"], rootDir);
+      } catch {
+        /* best-effort metadata cleanup after a partial worktree add */
+      }
     }
   }
 }
@@ -524,40 +506,18 @@ export async function cleanupWorktree({
  * Remove a worktree and its branch.
  * Follows WT race-guard: sleep between operations.
  *
- * Synapse v1: when `preflight` + `sessionContext` are provided, the removal
- * is pre-flighted against active sessions — blocked if another session is
- * still registered to this worktree path.
- *
  * @param {object} opts
  * @param {string} opts.worktreePath
  * @param {string} [opts.branchName] — optional branch to delete
  * @param {string} [opts.rootDir=process.cwd()]
  * @param {boolean} [opts.force=false]
- * @param {{ checkWorktreeRemove: Function } | null} [opts.preflight=null]
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
  */
 export async function pruneWorktree({
   worktreePath,
   branchName,
   rootDir = process.cwd(),
   force = false,
-  preflight = null,
-  sessionContext = null,
 }) {
-  if (preflight && sessionContext) {
-    const decision = preflight.checkWorktreeRemove(
-      { worktreePath },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked worktree-remove: ${decision.reason || "active_worktree"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   const cleanupResult = await cleanupWorktree({
     worktreePath,
     branchName,

package/hub/tray-lifecycle.mjs

@@ -120,7 +120,7 @@ export function spawnTrayForHub({
   cwd = process.cwd(),
   spawnFn = spawn,
 } = {}) {
-  if (env?.TFX_HUB_AUTO_TRAY === "0") return { status: "disabled" };
+  if (env?.TFX_HUB_AUTO_TRAY !== "1") return { status: "disabled" };
   if (isWorktreeOrEphemeralHubContext({ cwd, env })) {
     return { status: "disabled", reason: "ephemeral-or-worktree-context" };
   }

package/hub/workers/codex-mcp.mjs

@@ -1,5 +1,5 @@
 // hub/workers/codex-mcp.mjs — Codex MCP 서버 래퍼
-import { readFileSync } from "node:fs";
+import { appendFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import process from "node:process";
@@ -120,7 +120,7 @@ function readTomlScalar(raw, key) {
 }
 
 /**
- * Resolve a Codex effort profile name (e.g. "gpt6_sol_high") to its concrete
+ * Resolve a Codex effort profile name (e.g. "gpt61_sol_high") to its concrete
  * `model` + reasoning effort. SSOT = the per-profile file written by
  * `tfx setup` at `~/.codex/<profile>.config.toml`. Falls back to deriving the
  * effort from the `<...>_<effort>` naming convention when the file is absent.
@@ -263,6 +263,21 @@ function isNoiseOnlyOutput(text) {
   return NOISE_ONLY_OUTPUT_PATTERNS.some((pattern) => pattern.test(trimmed));
 }
 
+// MCP tool responses are completion-buffered, so stdout cannot distinguish an
+// active long-running call from a stuck one. The SDK delivers only genuine
+// `notifications/progress` callbacks here; append one record per event for
+// tfx-route's per-run heartbeat sidecar. This is intentionally best-effort:
+// inability to write observability data must never change tool execution.
+function recordMcpProgress(activityFile) {
+  if (typeof activityFile !== "string" || !activityFile) return;
+  try {
+    appendFileSync(activityFile, "progress\n");
+  } catch {
+    // The route's liveness file is diagnostic only. A missing/readonly file
+    // must leave the normal MCP request path untouched.
+  }
+}
+
 function watchBootstrapClose(transport) {
   let active = true;
   const promise = new Promise((_, reject) => {
@@ -429,6 +444,10 @@ export class CodexMcpWorker {
       ? options.bootstrapTimeoutMs
       : DEFAULT_CODEX_MCP_BOOTSTRAP_TIMEOUT_MS;
     this.retryOptions = normalizeRetryOptions(options.retryOptions);
+    this.activityFile =
+      typeof options.activityFile === "string"
+        ? options.activityFile
+        : this.env.TFX_CODEX_MCP_ACTIVITY_FILE || "";
 
     this.client = null;
     this.transport = null;
@@ -614,7 +633,12 @@ export class CodexMcpWorker {
           const nextRawResult = await this.client.callTool(
             { name: toolName, arguments: toolArguments },
             undefined,
-            { timeout: timeoutMs },
+            {
+              timeout: timeoutMs,
+              ...(this.activityFile
+                ? { onprogress: () => recordMcpProgress(this.activityFile) }
+                : {}),
+            },
           );
 
           const textContent = collectTextContent(nextRawResult.content);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triflux/remote",
-  "version": "10.46.0",
+  "version": "10.48.0",
   "description": "triflux remote — team mode, psmux, MCP workers, SQLite store.",
   "type": "module",
   "main": "hub/index.mjs",

package/scripts/lib/agent-route-policy.mjs

@@ -7,7 +7,7 @@ import {
 
 const policy = {
   executor: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1080,
     runMode: "fg",
     opusOversight: false,
@@ -15,7 +15,7 @@ const policy = {
     subcommand: "exec",
   },
   codex: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1080,
     runMode: "fg",
     opusOversight: false,
@@ -31,7 +31,7 @@ const policy = {
     subcommand: "exec",
   },
   cleanup: {
-    profile: "gpt6_sol_med",
+    profile: "gpt61_sol_med",
     timeoutSec: 540,
     runMode: "fg",
     opusOversight: false,
@@ -39,7 +39,7 @@ const policy = {
     subcommand: "exec",
   },
   deslop: {
-    profile: "gpt6_sol_med",
+    profile: "gpt61_sol_med",
     timeoutSec: 540,
     runMode: "fg",
     opusOversight: false,
@@ -95,7 +95,7 @@ const policy = {
     subcommand: "exec",
   },
   "code-reviewer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1800,
     runMode: "bg",
     opusOversight: false,
@@ -103,7 +103,7 @@ const policy = {
     subcommand: "review",
   },
   "quality-reviewer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1800,
     runMode: "bg",
     opusOversight: false,
@@ -119,7 +119,7 @@ const policy = {
     subcommand: "review",
   },
   scientist: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1440,
     runMode: "bg",
     opusOversight: false,
@@ -127,7 +127,7 @@ const policy = {
     subcommand: "exec",
   },
   "document-specialist": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1440,
     runMode: "bg",
     opusOversight: false,
@@ -143,7 +143,7 @@ const policy = {
     subcommand: "exec",
   },
   verifier: {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "fg",
     opusOversight: false,
@@ -151,7 +151,7 @@ const policy = {
     subcommand: "review",
   },
   "test-engineer": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "bg",
     opusOversight: false,
@@ -159,7 +159,7 @@ const policy = {
     subcommand: "exec",
   },
   "qa-tester": {
-    profile: "gpt6_sol_high",
+    profile: "gpt61_sol_high",
     timeoutSec: 1200,
     runMode: "bg",
     opusOversight: false,
@@ -212,8 +212,8 @@ export const CANONICAL_CODEX_PROFILE_OVERRIDES = Object.freeze(
   new Set([
     "gpt6_luna_low",
     "gpt6_luna_high",
-    "gpt6_sol_med",
-    "gpt6_sol_high",
+    "gpt61_sol_med",
+    "gpt61_sol_high",
     "gpt6_astra_xhigh",
     "gpt6_astra_max",
     "gpt6_astra_ultra",

package/scripts/lib/codex-profile-config.mjs

@@ -21,22 +21,25 @@ const EFFORT_BY_SUFFIX = {
 const CANONICAL_PROFILE_VALUES = Object.freeze({
   gpt6_luna_low: { model: "gpt-6-luna", effort: "low" },
   gpt6_luna_high: { model: "gpt-6-luna", effort: "high" },
-  gpt6_sol_med: { model: "gpt-6-sol", effort: "medium" },
-  gpt6_sol_high: { model: "gpt-6-sol", effort: "high" },
+  gpt61_sol_med: { model: "gpt-6.1-sol", effort: "medium" },
+  gpt61_sol_high: { model: "gpt-6.1-sol", effort: "high" },
   gpt6_astra_xhigh: { model: "gpt-6-astra", effort: "xhigh" },
   gpt6_astra_max: { model: "gpt-6-astra", effort: "max" },
   gpt6_astra_ultra: { model: "gpt-6-astra", effort: "ultra" },
 });
 
 // GPT-5.6 lane names map to the GPT-6 lane with the same effort. GPT-6 has no
-// Terra tier, so Terra lanes move to Sol.
+// Terra tier, so Terra lanes move to Sol. GPT-6 Sol lane names map to GPT-6.1
+// Sol with the same effort.
 const LEGACY_CANONICAL_PROFILE_ALIASES = Object.freeze({
   gpt56_sol_xhigh: "gpt6_astra_xhigh",
   gpt56_sol_max: "gpt6_astra_max",
   gpt56_sol_ultra: "gpt6_astra_ultra",
-  gpt56_terra_high: "gpt6_sol_high",
-  gpt56_terra_med: "gpt6_sol_med",
+  gpt56_terra_high: "gpt61_sol_high",
+  gpt56_terra_med: "gpt61_sol_med",
   gpt56_luna_low: "gpt6_luna_low",
+  gpt6_sol_high: "gpt61_sol_high",
+  gpt6_sol_med: "gpt61_sol_med",
 });
 
 export function normalizeCodexProfileName(profileName) {
@@ -65,7 +68,7 @@ function readProfileScalar(raw, key) {
 }
 
 /**
- * Resolve a Codex effort profile name (e.g. "gpt6_sol_high") to the `-c key=value`
+ * Resolve a Codex effort profile name (e.g. "gpt61_sol_high") to the `-c key=value`
  * config overrides that `codex exec` accepts, so the headless CLI lanes can
  * select a profile WITHOUT `codex exec --profile <name>`. codex 0.134+ rejects
  * `--profile X` whenever config.toml still contains an inline `[profiles.X]`
@@ -83,7 +86,7 @@ function readProfileScalar(raw, key) {
  *
  * @param {string} profileName
  * @param {{ codexHome?: string }} [opts]
- * @returns {string[]} e.g. ['model="gpt-6-sol"', 'model_reasoning_effort="high"']
+ * @returns {string[]} e.g. ['model="gpt-6.1-sol"', 'model_reasoning_effort="high"']
  */
 export function resolveCodexProfileConfigValues(profileName, opts = {}) {
   if (typeof profileName !== "string" || !profileName) {

package/hub/team/git-preflight.mjs

@@ -1,286 +0,0 @@
-// hub/team/git-preflight.mjs — Pre-flight safety check for dangerous git ops.
-// Blocks checkout/rebase/cherry-pick/reset/stash-pop/worktree-remove when they
-// would conflict with other active Synapse sessions' dirty files or claimed
-// leases. Fail-open by default: if registry/locks are unavailable, allow the op
-// with a warning (worktree isolation is the baseline safety net).
-
-/**
- * Factory for git pre-flight check.
- *
- * @param {object} opts
- * @param {{ getActive: () => Array<object> }} opts.registry — synapse-registry duck type
- * @param {{ snapshot: () => Array<object> }} opts.locks — swarm-locks duck type
- * @param {boolean} [opts.failOpen=true] — allow op when registry/locks throw or are missing
- * @param {(level: string, msg: string, data?: object) => void} [opts.logger] — optional logger
- * @returns {{
- *   check: Function,
- *   checkRebase: Function,
- *   checkCheckout: Function,
- *   checkCherryPick: Function,
- *   checkReset: Function,
- *   checkStashPop: Function,
- *   checkWorktreeRemove: Function,
- * }}
- */
-export function createGitPreflight(opts = {}) {
-  const { registry, locks, failOpen = true, logger = null } = opts;
-
-  function log(level, msg, data) {
-    if (logger) {
-      try {
-        logger(level, msg, data);
-      } catch {
-        /* logger failure is non-fatal */
-      }
-      return;
-    }
-    if (level === "warn") {
-      console.warn(`[git-preflight] ${msg}`, data ?? "");
-    } else if (level === "error") {
-      console.error(`[git-preflight] ${msg}`, data ?? "");
-    }
-  }
-
-  // ── helpers ──────────────────────────────────────────────
-
-  function safeGetActive() {
-    try {
-      const value = registry?.getActive?.();
-      if (!Array.isArray(value)) return null;
-      return value;
-    } catch (err) {
-      log("warn", "registry.getActive threw", { error: err?.message });
-      return null;
-    }
-  }
-
-  function safeSnapshot() {
-    try {
-      const value = locks?.snapshot?.();
-      if (!Array.isArray(value)) return null;
-      return value;
-    } catch (err) {
-      log("warn", "locks.snapshot threw", { error: err?.message });
-      return null;
-    }
-  }
-
-  function failOpenDecision(reason) {
-    log("warn", "hub unavailable, failing open", { reason });
-    return { allowed: true, reason: "hub_unavailable_fail_open" };
-  }
-
-  function normalizeFiles(list) {
-    if (!Array.isArray(list)) return new Set();
-    return new Set(
-      list
-        .filter((f) => typeof f === "string" && f.length > 0)
-        .map((f) => f.replace(/\\/g, "/")),
-    );
-  }
-
-  function otherActiveSessions(active, sessionId) {
-    return active.filter((s) => s?.sessionId && s.sessionId !== sessionId);
-  }
-
-  function otherLeases(snapshot, workerId) {
-    return snapshot.filter(
-      (entry) => entry?.workerId && entry.workerId !== workerId,
-    );
-  }
-
-  function buildConflict(file, session, holder) {
-    return {
-      file,
-      activeSession: session?.sessionId ?? holder ?? "unknown",
-      activeTask: session?.taskSummary ?? "",
-      ...(holder ? { leaseHolder: holder } : {}),
-    };
-  }
-
-  function recommend(conflicts) {
-    if (!conflicts.length) return "";
-    const first = conflicts[0];
-    const owner = first.leaseHolder || first.activeSession;
-    const task = first.activeTask ? ` Active task: '${first.activeTask}'` : "";
-    return `Wait for '${owner}' to finish, or coordinate via HITL.${task}`;
-  }
-
-  function blockedDecision(op, conflicts, extraReason) {
-    return {
-      allowed: false,
-      reason: extraReason || "overlap_with_active_session",
-      conflicts,
-      recommendation: recommend(conflicts),
-      op,
-    };
-  }
-
-  function allowedDecision() {
-    return { allowed: true };
-  }
-
-  // ── shared scanners ─────────────────────────────────────
-
-  function findDirtyFileConflicts(sessionId, workerId) {
-    const active = safeGetActive();
-    const snapshot = safeSnapshot();
-
-    if (active == null || snapshot == null) {
-      return failOpen ? { fallOpen: true } : { fallOpen: false, conflicts: [] };
-    }
-
-    const conflicts = [];
-    const seen = new Set();
-
-    for (const session of otherActiveSessions(active, sessionId)) {
-      const dirty = normalizeFiles(session.dirtyFiles);
-      for (const file of dirty) {
-        if (seen.has(file)) continue;
-        seen.add(file);
-        conflicts.push(buildConflict(file, session));
-      }
-    }
-
-    for (const lease of otherLeases(snapshot, workerId)) {
-      if (lease.leaseType && lease.leaseType !== "exclusive") continue;
-      const file = typeof lease.file === "string" ? lease.file : null;
-      if (!file || seen.has(file)) continue;
-      seen.add(file);
-      const sessionMeta = lease.sessionMeta || null;
-      conflicts.push(
-        buildConflict(
-          file,
-          sessionMeta
-            ? {
-                sessionId: sessionMeta.sessionId || lease.workerId,
-                taskSummary: sessionMeta.taskSummary || "",
-              }
-            : null,
-          lease.workerId,
-        ),
-      );
-    }
-
-    return { conflicts };
-  }
-
-  function findTargetFileConflicts(targetFiles, sessionId, workerId) {
-    const active = safeGetActive();
-    const snapshot = safeSnapshot();
-
-    if (active == null || snapshot == null) {
-      return failOpen ? { fallOpen: true } : { fallOpen: false, conflicts: [] };
-    }
-
-    const targets = normalizeFiles(targetFiles);
-    if (targets.size === 0) return { conflicts: [] };
-
-    const conflicts = [];
-    const seen = new Set();
-
-    for (const session of otherActiveSessions(active, sessionId)) {
-      const dirty = normalizeFiles(session.dirtyFiles);
-      for (const file of dirty) {
-        if (!targets.has(file) || seen.has(file)) continue;
-        seen.add(file);
-        conflicts.push(buildConflict(file, session));
-      }
-    }
-
-    for (const lease of otherLeases(snapshot, workerId)) {
-      if (lease.leaseType && lease.leaseType !== "exclusive") continue;
-      const file = typeof lease.file === "string" ? lease.file : null;
-      if (!file || !targets.has(file) || seen.has(file)) continue;
-      seen.add(file);
-      const sessionMeta = lease.sessionMeta || null;
-      conflicts.push(
-        buildConflict(
-          file,
-          sessionMeta
-            ? {
-                sessionId: sessionMeta.sessionId || lease.workerId,
-                taskSummary: sessionMeta.taskSummary || "",
-              }
-            : null,
-          lease.workerId,
-        ),
-      );
-    }
-
-    return { conflicts };
-  }
-
-  // ── public API ──────────────────────────────────────────
-
-  /**
-   * Core pre-flight check.
-   *
-   * @param {"checkout"|"rebase"|"cherry-pick"|"reset"|"stash-pop"|"worktree-remove"} op
-   * @param {{ targetFiles?: string[], branch?: string, ref?: string, worktreePath?: string }} args
-   * @param {{ sessionId: string, workerId?: string }} sessionContext
-   * @returns {{ allowed: boolean, reason?: string, conflicts?: object[], recommendation?: string, op?: string }}
-   */
-  function check(op, args = {}, sessionContext = {}) {
-    const sessionId = sessionContext.sessionId || "";
-    const workerId = sessionContext.workerId || sessionId;
-
-    switch (op) {
-      case "checkout":
-      case "rebase":
-      case "reset":
-      case "stash-pop": {
-        const res = findDirtyFileConflicts(sessionId, workerId);
-        if (res.fallOpen) return failOpenDecision(op);
-        if (res.conflicts.length > 0) return blockedDecision(op, res.conflicts);
-        return allowedDecision();
-      }
-      case "cherry-pick": {
-        const targets = Array.isArray(args.targetFiles) ? args.targetFiles : [];
-        const res = findTargetFileConflicts(targets, sessionId, workerId);
-        if (res.fallOpen) return failOpenDecision(op);
-        if (res.conflicts.length > 0) return blockedDecision(op, res.conflicts);
-        return allowedDecision();
-      }
-      case "worktree-remove": {
-        const active = safeGetActive();
-        if (active == null) return failOpenDecision(op);
-        const target =
-          typeof args.worktreePath === "string"
-            ? args.worktreePath.replace(/\\/g, "/")
-            : "";
-        if (!target) return allowedDecision();
-        const conflicts = [];
-        for (const session of otherActiveSessions(active, sessionId)) {
-          const sessionPath =
-            typeof session.worktreePath === "string"
-              ? session.worktreePath.replace(/\\/g, "/")
-              : "";
-          if (sessionPath && sessionPath === target) {
-            conflicts.push({
-              file: target,
-              activeSession: session.sessionId,
-              activeTask: session.taskSummary || "",
-            });
-          }
-        }
-        if (conflicts.length > 0) {
-          return blockedDecision(op, conflicts, "active_worktree");
-        }
-        return allowedDecision();
-      }
-      default:
-        return allowedDecision();
-    }
-  }
-
-  return Object.freeze({
-    check,
-    checkRebase: (args, ctx) => check("rebase", args, ctx),
-    checkCheckout: (args, ctx) => check("checkout", args, ctx),
-    checkCherryPick: (args, ctx) => check("cherry-pick", args, ctx),
-    checkReset: (args, ctx) => check("reset", args, ctx),
-    checkStashPop: (args, ctx) => check("stash-pop", args, ctx),
-    checkWorktreeRemove: (args, ctx) => check("worktree-remove", args, ctx),
-  });
-}