agent-coord-mcp 0.26.16 → 0.26.18

package/src/tools/shared.ts

@@ -182,6 +182,16 @@ export type Message = {
   // (or any other message) carries the parent message id so consumers can
   // mark the packet answered. Absent on every v1/v2 message — those stay valid.
   inReplyTo?: string;
+  // PROVENANCE (q-314e0187): the pid of the process that wrote this entry,
+  // and its tmux pane when known. `from` names an IDENTITY, not a PROCESS —
+  // two live sessions bound to the same agent id write byte-identical `from`
+  // values, and that is exactly the condition that let worker-3 truthfully
+  // deny sending a message that exists under its name on 2026-08-31: both
+  // sessions' accounts were true, and nothing on the message could say which
+  // wrote it. Cross-reference against sessions/*.json (SessionBinding) or
+  // `ps -p <pid>` to attribute a disputed entry. Absent on every message
+  // written before this field existed — that is UNKNOWN, not "same process".
+  provenance?: { pid: number; tmuxPane?: string };
 };
 
 // THE retention predicate — one definition, three call sites (prune,
@@ -219,6 +229,24 @@ export type Cursor = {
 
 export type Source = "inbox" | "room" | "status";
 
+// q-40449919 (regression from 0.26.8): a `cursors/*.json` filename has TWO
+// shapes since the push/read cursor split (hooks/push-cursor.mjs) —
+// `<agent>.json` (read) and `<agent>.push.json` (push) — and every reader of
+// `listCursorFiles()` was stripping only the outer `.json`, so a push
+// cursor for `worker-3` parsed as an agent literally named `worker-3.push`.
+// That id is unregistered by construction (false `orphan-inboxes-cursors`),
+// and looking up ITS inbox resolves to a file that never existed, so its
+// real, correct offset compares as past-EOF against an empty file — the
+// bus's only error-level finding, driving `healthy:false` for a healthy
+// fleet. ONE parser, used everywhere a cursor filename becomes an agent id,
+// so the assumption cannot re-drift into some other reader the way the
+// filename shape itself drifted out from under the callers that predate it.
+export function agentIdFromCursorFilename(fname: string): { id: string; kind: "read" | "push" } {
+  const push = /^(.*)\.push\.json$/.exec(fname);
+  if (push) return { id: push[1], kind: "push" };
+  return { id: fname.replace(/\.json$/, ""), kind: "read" };
+}
+
 // Resolve the physical file for a (source, agent, channel) tuple.
 export function sourceFile(source: Source, agentId: string, room?: string): string {
   if (source === "inbox") return inboxFile(agentId);

package/src/tools/stall.ts

@@ -218,6 +218,34 @@ export async function stallClockStatusTool(args: { maxAgeMinutes?: number }) {
 
 export const stallCheckSchema = { repo: z.string().optional(), stallMinutes: z.number().optional() };
 
+/**
+ * A row somebody is WORKING — the population the stall clock watches.
+ *
+ * It was `/🚧/` alone, and that read a fleet living in review as an EMPTY
+ * fleet (q-507e80c4). Measured on a consumer fleet 2026-09-02: a board of 3× `🔍 In
+ * Review` and 0× `🚧` returned `checked: 0, measurable: 0`, and `coord_away`
+ * armed at 0/0 — correct and vacuous at once. A clock watching nothing and a
+ * clock watching a healthy fleet return identical green.
+ *
+ * `🔍 In Review` is a lane with an owner and a branch that can stop moving
+ * exactly as an authoring lane can; the review that never gets re-gated is
+ * THE stall shape of a QA-gated fleet. It is read here, on the row as written
+ * — relabelling `🔍`→`🚧` to satisfy the old predicate was the item's
+ * forbidden move, because it satisfies a guard by editing what it reads and
+ * reports authoring lanes that do not exist.
+ *
+ * NOT widened further, deliberately: `⏸ Parked`, `⏳ Queued`, `⛔ Blocked`,
+ * `🚫 Unstaffable`, `✅ Done` have no lane to stall. Widening to everything
+ * would be the 0/0 defect inverted.
+ *
+ * One predicate, exported: `coord_away` measures coverage by calling
+ * `stall_check` and reading `checked`/`measurable`, so it inherits this
+ * population without a change of its own. Anything else that asks "which rows
+ * are in flight" should ask here rather than re-derive it from a glyph.
+ */
+export const IN_FLIGHT_STATUS = /🚧|🔍/;
+export const isInFlightStatus = (status: string): boolean => IN_FLIGHT_STATUS.test(status);
+
 export async function stallCheckTool(args: { repo?: string; stallMinutes?: number }) {
   const repo = args.repo ?? process.cwd();
   const limit = (args.stallMinutes ?? 30) * 60 * 1000;
@@ -226,7 +254,7 @@ export async function stallCheckTool(args: { repo?: string; stallMinutes?: numbe
 
   const liveTransports = await loadLiveTransports();
   const rows = workstreamsV1RowsOf(parseWorkDoc(readFileSync(board, "utf8")));
-  const inFlight = rows.filter((r) => /🚧/.test(r.status));
+  const inFlight = rows.filter((r) => isInFlightStatus(r.status));
   const reg = await readJson<Record<string, { lastHeartbeat: number }>>(AGENTS_FILE, {});
   const now = Date.now();
   const hits: StallHit[] = [];

package/src/tools/transport.ts

@@ -79,6 +79,7 @@ import {
   setOffset,
   sysMsg,
   moveFile,
+  agentIdFromCursorFilename,
   STALE_MS,
   EVICT_MS,
   MAX_WAIT_MS,
@@ -927,8 +928,11 @@ export const joinSchema = {
   attach: z.union([z.boolean(), joinAttachOptionsSchema]).optional(),
   readInbox: z.boolean().optional(),
   // First-claim guard overrides (server.ts guardFirstClaim): claiming an id
-  // that is LIVE on the bus refuses unless the call presents that agent's
-  // token (tokens.json / coord-token) or force:true. Ignored once bound.
+  // that is PROVABLY LIVE on the bus refuses unless the call presents that
+  // agent's token (tokens.json / coord-token) — `force` alone no longer
+  // overrides a provably live incumbent (q-314e0187). `force` still bypasses
+  // the guard when liveness cannot be verified, or the id is verified absent.
+  // Both ignored once bound.
   token: z.string().optional(),
   force: z.boolean().optional(),
   // Prose-only exemption from the typed-record rule — see registerSchema.
@@ -1620,7 +1624,7 @@ export async function doctorTool(args: { fix?: boolean; maxFileBytes?: number })
     }
     const orphanCursor: string[] = [];
     for (const fname of await listCursorFiles()) {
-      const id = fname.replace(/\.json$/, "");
+      const { id } = agentIdFromCursorFilename(fname);
       if (!known.has(id)) {
         orphanCursor.push(id);
         if (fix) {
@@ -1649,10 +1653,17 @@ export async function doctorTool(args: { fix?: boolean; maxFileBytes?: number })
   };
 
   // 4. Cursor offsets past end-of-file (would return [] forever).
+  //
+  // q-40449919: `id` must be the AGENT's id, not the cursor filename minus
+  // one extension — a push cursor's filename is `<agent>.push.json`, and
+  // `inboxFile(id)` on the unfixed `<agent>.push` resolves to a file that
+  // never existed, so `inboxMax` reads 0 and the cursor's real, correct
+  // offset compares as past-EOF against an empty file that was never the
+  // agent's inbox in the first place.
   {
     const broken: string[] = [];
     for (const fname of await listCursorFiles()) {
-      const id = fname.replace(/\.json$/, "");
+      const { id, kind } = agentIdFromCursorFilename(fname);
       const cursorPath = path.join(CURSOR_DIR, fname);
       const cursor = await readJson<Cursor>(cursorPath, {});
       const overflow: string[] = [];
@@ -1667,7 +1678,7 @@ export async function doctorTool(args: { fix?: boolean; maxFileBytes?: number })
         if (off > max) overflow.push(`roomOffsets[${chan}] ${off}>${max}`);
       }
       if (overflow.length) {
-        broken.push(`${id}: ${overflow.join(", ")}`);
+        broken.push(`${id}${kind === "push" ? " (push)" : ""}: ${overflow.join(", ")}`);
         if (fix) {
           await updateJson<Cursor>(cursorPath, {}, (c) => {
             if ((c.inboxOffset ?? 0) > inboxMax) c.inboxOffset = inboxMax;
@@ -1681,7 +1692,7 @@ export async function doctorTool(args: { fix?: boolean; maxFileBytes?: number })
             }
             return c;
           });
-          fixed.push(`clamped cursor offsets for ${id}`);
+          fixed.push(`clamped cursor offsets for ${id}${kind === "push" ? " (push)" : ""}`);
         }
       }
     }
@@ -1724,27 +1735,85 @@ export async function doctorTool(args: { fix?: boolean; maxFileBytes?: number })
   }
 
   // 6. Stale agents (registered, no live transport, heartbeat past EVICT_MS). Report only.
+  //
+  // Task 5.3/22.1: "27 stale" collapsed two different populations that look
+  // identical in a flat heartbeat-age list — 14 agents whose PANE was still
+  // genuinely current (their marker's pid had died, e.g. a `/mcp` reconnect
+  // spawned a new process in the SAME pane, but the pane itself never went
+  // anywhere) and 13 agents that were ORPHANS with no pane behind them at
+  // all, aged 19–45h. An orphan is stale by construction and can NEVER
+  // clear — reporting it beside a merely-slow-heartbeat agent manufactures a
+  // permanent false alarm in the same bucket as a real one.
+  //
+  // THE DISCRIMINATOR: a marker file that still exists on disk (even though
+  // its own pid/heartbeat check already failed `isMarkerLive`) and names a
+  // `tmuxTarget` `tmux has-session` still confirms. `has-session` checks the
+  // PANE, not the recorded pid — so it survives exactly the reconnect shape
+  // above, the same probe `wedged-local-pushers` already uses one direction
+  // over (there: a live pid whose pane died; here: a dead/expired marker
+  // whose pane did not). No marker at all, or a marker whose pane is
+  // confirmed gone, is the only shape left — and that is a genuine orphan.
   {
     // Compute liveness WITHOUT deleting dead markers — loadLiveTransports
     // prunes as a side effect, which would make this read-only check mutate
     // state (and pre-empt the orphan-marker fix in check 1).
     const live = new Set<string>();
+    const markerByAgent = new Map<string, TransportMarker>();
     for (const fname of await listTransportFiles()) {
       const marker = await readJson<TransportMarker | null>(path.join(TRANSPORT_DIR, fname), null);
-      if (marker && isMarkerLive(marker, reg, now)) live.add(marker.agentId);
+      if (!marker) continue;
+      markerByAgent.set(marker.agentId, marker);
+      if (isMarkerLive(marker, reg, now)) live.add(marker.agentId);
     }
-    const stale: string[] = [];
+    // Without a tmux binary we cannot probe a pane at all — every stale
+    // agent is reported as an orphan candidate rather than silently split,
+    // same posture `wedged-local-pushers` takes.
+    const tmuxAvailable = spawnSync("tmux", ["-V"]).status === 0;
+    const paneAlive = (target: string): boolean =>
+      tmuxAvailable && spawnSync("tmux", ["has-session", "-t", target]).status === 0;
+
+    const paneConfirmed: string[] = [];
+    const orphans: string[] = [];
     for (const [id, a] of Object.entries(reg)) {
       if (live.has(id)) continue;
-      if (now - a.lastHeartbeat > EVICT_MS) stale.push(`${id} (${Math.floor((now - a.lastHeartbeat) / 3600000)}h)`);
+      if (now - a.lastHeartbeat <= EVICT_MS) continue;
+      const age = `${Math.floor((now - a.lastHeartbeat) / 3600000)}h`;
+      const marker = markerByAgent.get(id);
+      if (marker?.transport === "tmux-push" && marker.tmuxTarget && paneAlive(marker.tmuxTarget)) {
+        paneConfirmed.push(`${id} (${age}, pane '${marker.tmuxTarget}' still current)`);
+      } else {
+        orphans.push(`${id} (${age})`);
+      }
     }
+    const stale = [...paneConfirmed, ...orphans];
     findings.push({
       check: "stale-agents",
       level: stale.length ? "warn" : "ok",
-      detail: stale.length ? `${stale.length} agent(s) past the eviction window — next list_agents will drop them` : "no stale agents",
+      detail: stale.length
+        ? `${stale.length} agent(s) past the eviction window — next list_agents will drop them ` +
+          `(${paneConfirmed.length} pane-confirmed current, ${orphans.length} genuine orphan(s) with no live pane behind them)`
+        : "no stale agents",
       fixable: false,
       items: stale.length ? stale : undefined,
     });
+    // A SEPARATE finding, not a sub-line: "stale-agents" answers "how many
+    // will list_agents drop", which is true of both buckets equally — an
+    // orphan and a pane-confirmed agent are dropped from the SAME list the
+    // same way. "orphan-agents" answers the different question this task is
+    // actually about — which of those, if any, can never clear on their
+    // own — and reports it even when it is empty, so a checker that only
+    // speaks when it fires cannot be told from one that never ran.
+    findings.push({
+      check: "orphan-agents",
+      level: orphans.length ? "warn" : "ok",
+      detail: orphans.length
+        ? `${orphans.length} stale agent(s) have no live tmux pane behind them — permanent, will not clear on their own (unregister or let eviction drop them)`
+        : tmuxAvailable
+          ? `no orphans among ${stale.length} stale agent(s)${stale.length ? " — all pane-confirmed current" : ""}`
+          : "tmux not available — could not distinguish orphans from pane-confirmed stale agents",
+      fixable: false,
+      items: orphans.length ? orphans : undefined,
+    });
   }
 
   // 6b. STALENESS HAS TWO CAUSES AND THEY LOOK IDENTICAL IN A FLAT LIST.

package/src/tools/work.ts

@@ -13,6 +13,8 @@ import {
   projectV1ToLanes,
   queueItemsOf,
   renderWorkDoc,
+  renderWorkDocForWrite,
+  zeroIsUnparsed,
   workDocIssues,
   workDocLegacyWriteIssues,
   LANES_V0_WRITE_ISSUE,
@@ -55,6 +57,13 @@ export type StoredWorkDoc = {
   kind: "queue" | "done" | "board" | "legacy";
   path: string;
   doc: WorkDoc;
+  /**
+   * The bytes as read. Kept because a COUNT OF ZERO cannot be interpreted
+   * without them: `zeroIsUnparsed` needs to know whether the document had
+   * content the parser did not understand, and the parsed doc has already
+   * discarded that distinction (q-3e7c81a5).
+   */
+  source: string;
 };
 
 export type StoredFactsDoc = {
@@ -77,7 +86,7 @@ async function loadDoc(repo: string, f: { kind: WorkFileKind; path: string }): P
     const parsed = parseFactsDoc(source);
     return { kind: "facts", path: f.path, source, entries: parsed.entries, issues: parsed.issues };
   }
-  return { kind: f.kind, path: f.path, doc: parseWorkDoc(source) };
+  return { kind: f.kind, path: f.path, doc: parseWorkDoc(source), source };
 }
 
 function docIssues(d: StoredDoc): string[] {
@@ -97,12 +106,56 @@ function importedSummary(d: StoredDoc) {
     };
   }
   const issues = [...workDocIssues(d.doc), ...workDocLegacyWriteIssues(d.doc)];
-  return {
-    path: d.path,
-    kind: d.kind,
+  const counts = {
     queue: queueItemsOf(d.doc).length,
     done: doneEntriesOf(d.doc).length,
     board: listWorkBoardOf(d.doc).length,
+  };
+  // A ZERO THAT CANNOT BE TRUSTED IS NAMED, NOT RETURNED BARE.
+  //
+  // These three were plain `.length`, so a document the parser did not
+  // understand reported the same zero as an empty one. A consumer's dashboard
+  // read that and showed a fleet as IDLE on a night it merged 27 PRs; they
+  // declined to enable these verbs rather than ship a display they could not
+  // trust (q-3e7c81a5).
+  //
+  // The counts keep their shape and meaning — a reader that only wants numbers
+  // is unaffected — and `unparsed` says which of them are unanswered questions
+  // rather than answers. The predicate is the SEAM's, shared with `doctor`'s
+  // queue-done-loop rather than restated here.
+  // ONLY THE AXES THIS DOCUMENT CLAIMS TO CARRY.
+  //
+  // Caught by the test's own output rather than by review: qualifying all three
+  // for every file reported `docs/QUEUE.md` as having unparsed `done` and `board`
+  // axes, which is nonsense — a queue document is not expected to hold done
+  // entries, so its zero there is not an unanswered question, it is a category
+  // error on my part. Scoping the qualification to the document's KIND is the
+  // same population discipline the count itself needed: a claim about an axis a
+  // file never carried is noise, and noise is what teaches a reader to skip the
+  // real one. `legacy` is the single-file BACKLOG.md, which carries both regions.
+  const AXES_BY_KIND = {
+    queue: ["queue"],
+    done: ["done"],
+    board: ["board"],
+    legacy: ["queue", "done"],
+  } as const;
+  const unparsed = (AXES_BY_KIND[d.kind] as readonly (keyof typeof counts)[]).filter((axis) =>
+    zeroIsUnparsed(counts[axis], d.source),
+  );
+  return {
+    path: d.path,
+    kind: d.kind,
+    ...counts,
+    ...(unparsed.length
+      ? {
+          unparsed,
+          unparsedNote:
+            `${d.path} has content the parser did not understand: ${unparsed.join(", ")} parsed to ZERO. ` +
+            `That is an unanswered question, not an empty document — do not render it as idle, empty or done. ` +
+            `Either the file uses a shape this grammar does not accept, or it is malformed; both need a human, and ` +
+            `neither is "nothing there".`,
+        }
+      : {}),
     ...(issues.length ? { issues } : {}),
   };
 }
@@ -359,6 +412,19 @@ export async function exportWorkTool(args: {
       });
       continue;
     }
+    // DELIBERATELY THE PURE RENDER, NOT THE STAMPING ONE (q-c50e9b83).
+    //
+    // I routed this through `renderWorkDocForWrite` first and it broke three
+    // pre-existing tests that assert `import → export` writes the real documents
+    // back BYTE-IDENTICALLY. They were right and the change was wrong: this is a
+    // TRANSPORT, not an authoring path. Its contract is to reproduce a document,
+    // and a transport that silently edits content the caller never asked it to
+    // touch is a worse defect than the one being fixed — it would also mean
+    // exporting into ANOTHER project's documents mutates them.
+    //
+    // So the primary is scoped to the AUTHORING writer (`land`, via records.ts),
+    // and an unstamped item arriving through this path is the backstop's
+    // population: it cannot reach `main` without passing a push.
     const rendered = renderWorkDoc(d.doc);
     const current = existsSync(target) ? await fsp.readFile(target, "utf8") : null;
     const declared = scopes.documents.find((s) => s.path === d.path);

package/src/tools/worktrees.ts

@@ -264,6 +264,45 @@ export async function refreshWorktreesTool(args: { repo: string; base: string; a
     return { ok: false as const, error: `${ref} does not resolve — nothing to fast-forward onto` };
   }
 
+/**
+ * Are the commits HEAD has beyond `tip` ALREADY LANDED there?
+ *
+ * `rev-list --count <tip>..HEAD` is pure ANCESTRY, and under squash merge a landed
+ * branch's own shas never enter the base's history — so `ahead` stays > 0 FOREVER
+ * for work that shipped (q-5c40db91; 20 of the last 20 merges on this repo's main
+ * are single-parent). Reading `ahead > 0` as "this tree holds unlanded work" makes
+ * the verb whose job is fast-forwarding idle trees classify a FINISHED tree as
+ * mid-slice, permanently.
+ *
+ * MEASURED, and it cost a lane cycle: a `claim` was refused because a worker's tree
+ * "reads as 1 commit not on origin/main" while that branch had been squash-merged an
+ * hour earlier. Same inverted alarm as the item's headline — landed work reported as
+ * unmerged, inviting preservation of work already shipped — inside our own tooling.
+ *
+ * `git cherry` compares PATCH IDS, so every line marked `-` means every commit's patch
+ * is already upstream. It is NOT complete: several commits squashed into one carry a
+ * different combined patch id, so a negative is INCONCLUSIVE and is reported as
+ * mid-slice exactly as before. Only a positive changes the verdict, which keeps the
+ * failure direction the same as today's for everything this cannot prove.
+ */
+function aheadIsLanded(at: string, tip: string): boolean {
+  // `git` here THROWS rather than returning null, so the catch is what keeps an
+  // UNREADABLE answer out of the landed bucket: not measured is not landed, and
+  // the tree stays mid-slice, which is the direction that refuses rather than
+  // the direction that tells someone their work is safe to discard.
+  let cherry: string;
+  try {
+    cherry = git(at, ["cherry", tip, "HEAD"]);
+  } catch {
+    return false;
+  }
+  if (cherry.trim().length === 0) return false;
+  return cherry
+    .trim()
+    .split("\n")
+    .every((l) => l.trim().startsWith("-"));
+}
+
   const results = [];
   for (const w of listWorktrees(repo)) {
     const at = w.path;
@@ -308,7 +347,9 @@ export async function refreshWorktreesTool(args: { repo: string; base: string; a
               (dirty
                 ? " and DIRTY — not fast-forwarded; uncommitted work is what a diff cannot show"
                 : ahead !== "0"
-                  ? ` and ${ahead} ahead — not fast-forwarded; it has commits ${ref} does not`
+                  ? aheadIsLanded(at, tip)
+                    ? ` and ${ahead} ahead whose patches are ALREADY UPSTREAM — squash-merged, so ancestry will never agree; not fast-forwarded, but nothing here needs preserving`
+                    : ` and ${ahead} ahead — not fast-forwarded; it has commits ${ref} does not`
                   : args.apply
                     ? ""
                     : " — pass apply:true to fast-forward it"),
@@ -337,7 +378,28 @@ export async function refreshWorktreesTool(args: { repo: string; base: string; a
       /* treated as diverged below */
     }
     if (ahead !== "0") {
-      results.push({ path: w.path, action: "refused", why: `MID-SLICE: ${ahead} commit(s) not on ${ref}. Refusing rather than --force.` });
+      // LANDED, NOT MID-SLICE — the ancestry count cannot tell these apart.
+      if (aheadIsLanded(at, tip)) {
+        results.push({
+          path: w.path,
+          action: "landed",
+          why:
+            `${ahead} commit(s) are not ancestors of ${ref}, but every one of their PATCHES is already upstream — ` +
+            `this branch was SQUASH-MERGED and its work has shipped. Ancestry can never say so: a squash writes a new ` +
+            `commit, so these shas will read as "not on ${ref}" forever. Nothing here needs preserving; detach to ${ref} ` +
+            `(or delete the branch) and this tree is reusable. NOT fast-forwarded automatically — moving a tree off ` +
+            `committed work is a decision, not a refresh.`,
+        });
+        continue;
+      }
+      results.push({
+        path: w.path,
+        action: "refused",
+        why:
+          `MID-SLICE: ${ahead} commit(s) not on ${ref}, and their patches are NOT upstream. Refusing rather than --force. ` +
+          `(A squash of SEVERAL commits into one changes the combined patch id, so this cannot prove the negative — ` +
+          `it reports mid-slice, which is the same direction it always failed in.)`,
+      });
       continue;
     }
     if (!args.apply) {

package/src/work.ts

@@ -17,6 +17,10 @@ export {
   renderBoardRow,
   parseWorkDoc,
   renderWorkDoc,
+  renderWorkDocForWrite,
+  stampQueueIds,
+  zeroIsUnparsed,
+  substantiveLines,
   queueItemsOf,
   doneEntriesOf,
   boardRowsOf,

package/dist/build.js

@@ -1,113 +0,0 @@
-// Build identity of the RUNNING server process.
-//
-// The principle is the #28 pusher-freshness fix carried one layer up: stamp
-// what you LOADED at init, compare against what's on disk NOW, and resolve the
-// measured artifact from the code that is actually executing
-// (import.meta.url), never from configuration — the thing that measures must
-// be the thing that ran. A server process outlives `npm run build`; without a
-// load-time sample there is nothing truthful to compare the on-disk build to,
-// and a server running pre-rebuild code stamps transport markers with logic
-// the rebuild replaced (observed live 2026-07-29: post-#28 attach spawned a
-// pusher with no `--agent` argv and a single-file freshness stamp, agreeing
-// with the new on-disk check only by coincidence).
-import { readdirSync, statSync, readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-// Newest mtime (epoch ms) across every file under `dir` (recursive) whose
-// name ends with one of `exts`. Returns undefined when the dir is missing or
-// unreadable — callers skip their check rather than guess. Pure over its
-// arguments so tests exercise it on temp trees instead of touching real
-// sources (a utimes on a shared checkout flips every live pusher's freshness
-// while the suite runs files in parallel).
-export function newestMtimeUnder(dir, exts) {
-    try {
-        let newest;
-        for (const rel of readdirSync(dir, { recursive: true })) {
-            const name = String(rel);
-            if (!exts.some((e) => name.endsWith(e)))
-                continue;
-            let m;
-            try {
-                m = statSync(path.join(dir, name)).mtimeMs;
-            }
-            catch {
-                continue; // deleted mid-scan
-            }
-            if (newest === undefined || m > newest)
-                newest = m;
-        }
-        return newest;
-    }
-    catch {
-        return undefined;
-    }
-}
-// The dir this module was loaded FROM: dist/ in production, src/ under tsx.
-// Either way it is the code actually running, which is the point.
-export const BUILD_DIR = path.dirname(fileURLToPath(import.meta.url));
-// .js for the compiled build, .ts for dev-mode (tsx src/server.ts) — both
-// sides of every comparison use the same list, so the two modes are each
-// self-consistent and can never be compared across.
-const BUILD_EXTS = [".js", ".ts"];
-// Sampled ONCE at module load: the newest mtime across the build this server
-// process actually imported. A later `npm run build` rewrites dist/ under a
-// still-running server; this value stays behind, which is exactly what
-// doctor's server-build-drift check compares against.
-export const SERVER_BUILD_MTIME = newestMtimeUnder(BUILD_DIR, BUILD_EXTS);
-// The on-disk side of the comparison, statted fresh per call.
-// AGENT_COORD_DIST_DIR is a test seam only: it redirects what doctor
-// MEASURES so tests can stage a newer/older build in a temp dir — it never
-// changes what the server loads.
-export function onDiskBuildMtime() {
-    const dir = process.env.AGENT_COORD_DIST_DIR ?? BUILD_DIR;
-    return newestMtimeUnder(dir, BUILD_EXTS);
-}
-// The uncompiled side of the dist-behind-source comparison: newest mtime
-// across src/**/*.ts, resolved as BUILD_DIR's sibling. undefined on a
-// packaged install with no src/ (callers report "nothing to compare", never
-// warn). Under tsx dev-mode BUILD_DIR *is* src/, so the comparison degrades
-// to src-vs-src and reads ok — dev-mode has no build to fall behind.
-// AGENT_COORD_SRC_DIR is the same test seam as AGENT_COORD_DIST_DIR:
-// it redirects measurement only.
-export function onDiskSourceMtime() {
-    const dir = process.env.AGENT_COORD_SRC_DIR ?? path.resolve(BUILD_DIR, "..", "src");
-    return newestMtimeUnder(dir, [".ts"]);
-}
-// Best-effort checkout identity, report-only: lets doctor NAME the build
-// (`branch@sha` would be nicer, but HEAD's sha alone already makes
-// mutable-checkout drift visible, which is all this claims). undefined when
-// not a git checkout (npm install) — never an error.
-export const SERVER_BUILD_SHA = (() => {
-    try {
-        let gitDir = path.resolve(BUILD_DIR, "..", ".git");
-        const st = statSync(gitDir);
-        if (st.isFile()) {
-            // A worktree's .git is a pointer file: "gitdir: <real dir>".
-            const ptr = readFileSync(gitDir, "utf8").trim();
-            if (!ptr.startsWith("gitdir:"))
-                return undefined;
-            gitDir = ptr.slice("gitdir:".length).trim();
-        }
-        const head = readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
-        if (!head.startsWith("ref:"))
-            return head.slice(0, 12); // detached
-        const ref = head.slice(4).trim();
-        try {
-            return readFileSync(path.join(gitDir, ref), "utf8").trim().slice(0, 12);
-        }
-        catch {
-            // Ref may be packed. commondir handling is deliberately out of scope —
-            // best-effort means undefined beats wrong.
-            const packed = readFileSync(path.join(gitDir, "packed-refs"), "utf8");
-            for (const line of packed.split("\n")) {
-                if (line.endsWith(` ${ref}`))
-                    return line.slice(0, 12);
-            }
-            return undefined;
-        }
-    }
-    catch {
-        return undefined;
-    }
-})();
-//# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,mDAAmD;AAEnD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wEAAwE;AACxE,6EAA6E;AAC7E,2CAA2C;AAC3C,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAc;IAC1D,IAAI,CAAC;QACH,IAAI,MAA0B,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAa,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClD,IAAI,CAAS,CAAC;YACd,IAAI,CAAC;gBACH,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,mBAAmB;YAC/B,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,MAAM;gBAAE,MAAM,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtE,0EAA0E;AAC1E,yEAAyE;AACzE,oDAAoD;AACpD,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAElC,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAuB,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAE9F,8DAA8D;AAC9D,qEAAqE;AACrE,2EAA2E;AAC3E,iCAAiC;AACjC,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAC;IAC1D,OAAO,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,sEAAsE;AACtE,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,qEAAqE;AACrE,iCAAiC;AACjC,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,yEAAyE;AACzE,mEAAmE;AACnE,4EAA4E;AAC5E,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAuB,CAAC,GAAG,EAAE;IACxD,IAAI,CAAC;QACH,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YAChB,6DAA6D;YAC7D,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACjD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;YACtE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC"}