agent-dealer 1.3.0 → 1.3.2

package/bundle/server/dist/routes/issues-source-attachments.test.js

@@ -1,6 +1,7 @@
 // NOT-364: atomic Linear attachment import and reload reconciliation.
 import { test, before, after, beforeEach } from "node:test";
 import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
@@ -445,3 +446,279 @@ test("failed reload preserves the old task text and attachment snapshot", async
     assert.equal(createHash("sha256").update(fs.readFileSync(afterRows[0].blobPath)).digest("hex"), beforeBlobHash, "old blob bytes intact");
     await app.close();
 });
+// NOT-422: parked scope reload — the same atomic reconciliation as the
+// pre-execution path, preserving the active workflow and the open action.
+const PARKED_CONTRACT_V1 = [
+    "Ship the friend-path run command.",
+    "",
+    "## Builder execution mode",
+    "feature",
+    "",
+    "## Non-goals",
+    "- Rewriting the installer",
+    "",
+    "## Exit predicate",
+    "The friend-path run command works on a clean machine with operator proof.",
+    "",
+    "## One-PR stopping point",
+    "Stop after the run command lands with its regression test.",
+    "",
+    "## Acceptance criteria",
+    "- [ ] Friend-path run works",
+    "  Evidence: run fixtures | run the tests | green",
+    "- [ ] [operator] Clean-machine proof attached",
+    "  Evidence: operator run | paste the output | reviewed",
+    "",
+].join("\n");
+const PARKED_CONTRACT_V2 = [
+    "Ship the friend-path run command.",
+    "",
+    "## Builder execution mode",
+    "feature",
+    "",
+    "## Non-goals",
+    "- Rewriting the installer",
+    "",
+    "## Exit predicate",
+    "The friend-path run command works with simulator proof; clean-machine proof moved out.",
+    "",
+    "## One-PR stopping point",
+    "Stop after the run command lands with its regression test.",
+    "",
+    "## Acceptance criteria",
+    "- [ ] Friend-path run works",
+    "  Evidence: run fixtures | run the tests | green",
+    "- [ ] Simulator proof attached",
+    "  Evidence: simulator run | paste the output | reviewed",
+    "",
+].join("\n");
+function parkedNodeWith(description, attachments) {
+    return { ...linearNodeWith(attachments), description };
+}
+let scopeAttachCounter = 0;
+async function parkScopeWithAttachments(app) {
+    const { startWorkflow, applyCompletion } = await import("../coordinator/commands.js");
+    const { claimWorkItem } = await import("../repository/work-items.js");
+    const { ReviewerResult } = await import("../coordinator/reviewer-result.js");
+    const { getIssue } = await import("../repository/issues.js");
+    scopeAttachCounter += 1;
+    const created = (await (await app.inject({
+        method: "POST",
+        url: "/api/issues",
+        payload: {
+            ...BASE_LINEAR,
+            externalId: `linear-uuid-scope-att-${scopeAttachCounter}`,
+            description: PARKED_CONTRACT_V1,
+            linearAttachments: [FILE_ATT, LINK_ATT],
+        },
+    })).json());
+    assert.equal(startWorkflow(created.id).ok, true);
+    const dev = claimWorkItem("scope-att-test", { leaseMs: 60_000 });
+    await applyCompletion(dev.id, dev.leaseToken, {
+        kind: "clean_handoff",
+        branch: "b",
+        headSha: "abc",
+        baseSha: "base",
+        prNumber: 1,
+        prUrl: "https://gh/pr/1",
+    });
+    const rev = claimWorkItem("scope-att-test", { leaseMs: 60_000 });
+    await applyCompletion(rev.id, rev.leaseToken, {
+        kind: "verdict",
+        result: ReviewerResult.parse({
+            verdict: "escalated",
+            productScopeQuestion: "Is clean-machine proof still required?",
+            baseSha: "b",
+            headSha: "h",
+            acceptanceCriteriaAssessment: "ok",
+            evidenceAssessment: "ok",
+            findings: [],
+            risks: [],
+        }),
+    });
+    assert.equal(getIssue(created.id).status, "needs_human");
+    return created.id;
+}
+test("NOT-422: parked scope reload recompiles the contract, reconciles attachments, and preserves the workflow", async () => {
+    downloadBytes.set(FILE_URL, TARBALL_V1);
+    const app = await buildApp();
+    const id = await parkScopeWithAttachments(app);
+    const { getIssue } = await import("../repository/issues.js");
+    const { getActiveWorkflowInstance, listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
+    const { getHumanAction, listHumanActionsForIssue } = await import("../repository/human-actions.js");
+    const { listWorkerSessionsForIssue } = await import("../repository/worker-sessions.js");
+    const { getTaskSnapshot } = await import("../coordinator/commands.js");
+    const before = getIssue(id);
+    const instanceBefore = getActiveWorkflowInstance(id);
+    const actionBefore = listHumanActionsForIssue(id).find((a) => a.actionType === "product_scope_decision");
+    const sessionsBefore = listWorkerSessionsForIssue(id);
+    const frozenBefore = getTaskSnapshot(before);
+    const oldBlob = listSourceAttachments(id).find((r) => r.kind === "file").blobPath;
+    assert.ok(fs.existsSync(oldBlob));
+    // Linear now: amended contract (the [operator] criterion is gone), the same
+    // file id with new bytes, a brand-new file, and the link removed.
+    const FILE_B_URL = "https://uploads.linear.app/abc/b.bin";
+    const TARBALL_B = Buffer.from("brand-new-bytes");
+    downloadBytes.set(FILE_URL, TARBALL_V2);
+    downloadBytes.set(FILE_B_URL, TARBALL_B);
+    linearNode = parkedNodeWith(PARKED_CONTRACT_V2, [
+        { id: "att-file-1", title: "repro.tar.gz", url: FILE_URL },
+        { id: "att-file-3", title: "b.bin", url: FILE_B_URL },
+    ]);
+    const res = await app.inject({ method: "POST", url: `/api/issues/${id}/reload-source` });
+    assert.equal(res.statusCode, 200, res.body);
+    const reloaded = res.json();
+    assert.equal(reloaded.title, "NOT-1: Reloaded title");
+    assert.equal(reloaded.description, PARKED_CONTRACT_V2);
+    assert.equal(reloaded.executionContract.exitPredicate, "The friend-path run command works with simulator proof; clean-machine proof moved out.");
+    assert.ok(!reloaded.acceptanceCriteria.includes("[operator] Clean-machine proof attached"));
+    assert.ok(reloaded.acceptanceCriteria.includes("Simulator proof attached"));
+    // Attachments reconciled atomically: changed bytes land, the new file
+    // appears, and the removed link disappears. The replaced blob is retained —
+    // the frozen snapshot still references it until Resume re-freezes.
+    const rows = listSourceAttachments(id);
+    assert.deepEqual(rows.map((r) => r.linearAttachmentId).sort(), ["att-file-1", "att-file-3"]);
+    const changed = rows.find((r) => r.linearAttachmentId === "att-file-1");
+    assert.equal(changed.sha256, createHash("sha256").update(TARBALL_V2).digest("hex"));
+    assert.deepEqual(fs.readFileSync(changed.blobPath), TARBALL_V2);
+    assert.ok(fs.existsSync(oldBlob), "blob still referenced by the frozen snapshot is retained");
+    // Everything else is preserved: repository/configuration, workflow
+    // instance, PR/head/branch, rounds, counters, sessions, and the open action.
+    const after = getIssue(id);
+    const preserved = (issue) => ({
+        repo: issue.repo,
+        baseBranch: issue.baseBranch,
+        developerAgentId: issue.developerAgentId,
+        reviewerAgentId: issue.reviewerAgentId,
+        maxReviewRounds: issue.maxReviewRounds,
+        maxInfraAttempts: issue.maxInfraAttempts,
+        maxCiAttempts: issue.maxCiAttempts,
+        autoMerge: issue.autoMerge,
+        status: issue.status,
+        currentRound: issue.currentRound,
+        infraAttempts: issue.infraAttempts,
+        ciAttempts: issue.ciAttempts,
+        branch: issue.branch,
+        baseSha: issue.baseSha,
+        headSha: issue.headSha,
+        prNumber: issue.prNumber,
+        prUrl: issue.prUrl,
+        source: issue.source,
+        externalId: issue.externalId,
+        externalLabel: issue.externalLabel,
+        externalUrl: issue.externalUrl,
+    });
+    assert.deepEqual(preserved(after), preserved(before));
+    assert.equal(getActiveWorkflowInstance(id).id, instanceBefore.id);
+    assert.deepEqual(getHumanAction(actionBefore.id), { ...actionBefore });
+    assert.deepEqual(listWorkerSessionsForIssue(id), sessionsBefore);
+    assert.equal(listWorkflowEventsForIssue(id).filter((e) => e.type === "issue.source_reloaded").length, 1);
+    // The frozen snapshot still carries the old text AND the old manifest until Resume.
+    const frozenAfter = getTaskSnapshot(after);
+    assert.equal(frozenAfter.description, PARKED_CONTRACT_V1);
+    assert.ok(frozenAfter.acceptanceCriteria.includes("[operator] Clean-machine proof attached"));
+    assert.deepEqual(frozenAfter.sourceAttachments, frozenBefore.sourceAttachments);
+    assert.ok(frozenAfter.sourceAttachments.some((a) => a.linearAttachmentId === "att-link-1"));
+    await app.close();
+});
+test("NOT-422: attachment-only parked reload shows sourceAttachments pending and Resume re-freezes the manifest", async () => {
+    downloadBytes.set(FILE_URL, TARBALL_V1);
+    const app = await buildApp();
+    const id = await parkScopeWithAttachments(app);
+    const { getIssue } = await import("../repository/issues.js");
+    const { listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
+    const { listHumanActionsForIssue } = await import("../repository/human-actions.js");
+    const { getTaskSnapshot, resolveHumanActionAndAdvance, TASK_SNAPSHOT_ARTIFACT_KIND } = await import("../coordinator/commands.js");
+    const { listArtifactsForIssue } = await import("../repository/artifacts-for-issue.js");
+    const { materializeSourceAttachments } = await import("../coordinator/source-attachments.js");
+    const oldBlob = listSourceAttachments(id).find((r) => r.kind === "file").blobPath;
+    const snapshotsBefore = listArtifactsForIssue(id).filter((a) => a.kind === TASK_SNAPSHOT_ARTIFACT_KIND).length;
+    assert.equal(snapshotsBefore, 1);
+    // Linear changed only the inputs: identical contract text (and the same
+    // derived title), new bytes for the file, the link removed.
+    downloadBytes.set(FILE_URL, TARBALL_V2);
+    linearNode = {
+        ...parkedNodeWith(PARKED_CONTRACT_V1, [{ id: "att-file-1", title: "repro.tar.gz", url: FILE_URL }]),
+        title: "import me",
+    };
+    const res = await app.inject({ method: "POST", url: `/api/issues/${id}/reload-source` });
+    assert.equal(res.statusCode, 200, res.body);
+    // Text byte-identical, rows swapped, the replaced blob retained for the
+    // frozen snapshot that still references it.
+    const parked = getIssue(id);
+    assert.equal(parked.title, BASE_LINEAR.title);
+    assert.equal(parked.description, PARKED_CONTRACT_V1);
+    assert.ok(parked.acceptanceCriteria.includes("[operator] Clean-machine proof attached"));
+    assert.deepEqual(listSourceAttachments(id).map((r) => r.linearAttachmentId), ["att-file-1"]);
+    assert.ok(fs.existsSync(oldBlob), "replaced blob retained while the frozen snapshot references it");
+    assert.ok(getTaskSnapshot(parked).sourceAttachments.some((a) => a.linearAttachmentId === "att-link-1"));
+    // Issue Detail reads the amended inputs as pending for the next snapshot —
+    // and only the manifest is pending.
+    const detail = (await app.inject({ method: "GET", url: `/api/issues/${id}` })).json();
+    assert.deepEqual(detail.pendingSnapshotChangedFields, ["sourceAttachments"]);
+    // Resume re-freezes exactly one new snapshot carrying the amended manifest.
+    const action = listHumanActionsForIssue(id).find((a) => a.actionType === "product_scope_decision");
+    const resolved = resolveHumanActionAndAdvance(action.id, "operator", "resume");
+    assert.equal(resolved.ok, true);
+    const snapshots = listArtifactsForIssue(id).filter((a) => a.kind === TASK_SNAPSHOT_ARTIFACT_KIND);
+    assert.equal(snapshots.length, snapshotsBefore + 1);
+    const events = listWorkflowEventsForIssue(id);
+    const refreshed = events.filter((e) => e.type === "task_snapshot.refreshed");
+    assert.equal(refreshed.length, 1);
+    assert.deepEqual(JSON.parse(refreshed[0].payloadJson).changedFields, ["sourceAttachments"]);
+    const types = events.map((e) => e.type);
+    assert.ok(types.indexOf("task_snapshot.refreshed") < types.lastIndexOf("repair.started"));
+    const snap = getTaskSnapshot(getIssue(id));
+    assert.equal(snap.sourceAttachments.length, 1);
+    assert.equal(snap.sourceAttachments[0].sha256, createHash("sha256").update(TARBALL_V2).digest("hex"));
+    // The next round materializes the amended bytes — never "stored bytes are missing".
+    const worktree = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-scope-att-only-"));
+    execFileSync("git", ["init", "-q"], { cwd: worktree });
+    const materialized = materializeSourceAttachments(worktree, snap.sourceAttachments);
+    assert.equal(materialized.length, 1);
+    assert.deepEqual(fs.readFileSync(path.join(worktree, materialized[0].relativePath)), TARBALL_V2);
+    await app.close();
+});
+test("NOT-422: failed parked reloads preserve prior text, attachments, workflow, and the open action", async () => {
+    const { getIssue } = await import("../repository/issues.js");
+    const { getActiveWorkflowInstance, listWorkflowEventsForIssue } = await import("../repository/workflow-events.js");
+    const { getHumanAction, listHumanActionsForIssue } = await import("../repository/human-actions.js");
+    async function expectIntact(id, label) {
+        const issue = getIssue(id);
+        assert.equal(issue.title, BASE_LINEAR.title, `${label}: title intact`);
+        assert.equal(issue.description, PARKED_CONTRACT_V1, `${label}: description intact`);
+        assert.ok(issue.acceptanceCriteria.includes("[operator] Clean-machine proof attached"), `${label}: criteria intact`);
+        const rows = listSourceAttachments(id);
+        assert.deepEqual(rows.map((r) => r.linearAttachmentId).sort(), ["att-file-1", "att-link-1"], `${label}: attachment rows intact`);
+        const file = rows.find((r) => r.kind === "file");
+        assert.deepEqual(fs.readFileSync(file.blobPath), TARBALL_V1, `${label}: blob bytes intact`);
+        const action = listHumanActionsForIssue(id).find((a) => a.actionType === "product_scope_decision");
+        assert.equal(getHumanAction(action.id).status, "open", `${label}: scope action still open`);
+        assert.ok(getActiveWorkflowInstance(id), `${label}: workflow still active`);
+        assert.equal(issue.status, "needs_human", `${label}: still parked`);
+        assert.ok(!listWorkflowEventsForIssue(id).some((e) => e.type === "issue.source_reloaded"), `${label}: no reload event`);
+    }
+    // A new file whose download fails: 502, prior snapshot untouched.
+    downloadBytes.set(FILE_URL, TARBALL_V1);
+    const app = await buildApp();
+    const failedId = await parkScopeWithAttachments(app);
+    const BAD_URL = "https://uploads.linear.app/abc/missing.bin";
+    downloadBytes.set(BAD_URL, "http500");
+    linearNode = parkedNodeWith(PARKED_CONTRACT_V2, [
+        { id: "att-file-1", title: "repro.tar.gz", url: FILE_URL },
+        { id: "att-file-9", title: "missing.bin", url: BAD_URL },
+    ]);
+    const failed = await app.inject({ method: "POST", url: `/api/issues/${failedId}/reload-source` });
+    assert.equal(failed.statusCode, 502, failed.body);
+    await expectIntact(failedId, "download failure");
+    // A malformed amended contract: actionable 400, prior snapshot untouched.
+    const badId = await parkScopeWithAttachments(app);
+    const malformed = PARKED_CONTRACT_V2.replace("feature", "teleport");
+    downloadBytes.set(FILE_URL, TARBALL_V1);
+    linearNode = parkedNodeWith(malformed, [{ id: "att-file-1", title: "repro.tar.gz", url: FILE_URL }]);
+    const bad = await app.inject({ method: "POST", url: `/api/issues/${badId}/reload-source` });
+    assert.equal(bad.statusCode, 400, bad.body);
+    assert.match(bad.json().error, /unknown execution mode/);
+    await expectIntact(badId, "contract failure");
+    await app.close();
+});

package/bundle/server/dist/routes/issues.js

@@ -10,7 +10,7 @@ import { listUsageEventsForIssue, summarizeIssueUsage } from "../repository/usag
 import { listWorkflowEventsForIssue, appendWorkflowEvent, listWorkflowInstancesForIssue, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
 import { listHumanActionsForIssue, listOpenHumanActions } from "../repository/human-actions.js";
 import { listFindingsForIssue } from "../repository/findings.js";
-import { abortIssueAsync, applyParkedEdit, canEditParkedIssue, capWaitForIssue, checkIssueReadiness, closeReadyIssue, parkCapWait, PARKED_EDITABLE_FIELDS } from "../coordinator/commands.js";
+import { abortIssueAsync, applyParkedEdit, canEditParkedIssue, capWaitForIssue, checkIssueReadiness, closeReadyIssue, diffTaskSnapshotFromLive, parkCapWait, parkedEditableFields, parkedEditableFieldsLabel } from "../coordinator/commands.js";
 import { deleteDealerIssue } from "../coordinator/delete-issue.js";
 import { getAgent } from "../repository/agents.js";
 import { executeIssueNow, isStartable, queueStatusForIssue, refreshQueueWaitReasonForIssue, startIssueViaQueue, } from "../coordinator/admission.js";
@@ -82,6 +82,10 @@ export async function registerIssueRoutes(app) {
             const statuses = requested.length > 0
                 ? requested
                 : IssueStatus.options.filter((s) => s !== "closed");
+            // NOT-385: the direction is allowlisted — only an explicit `asc` reverses
+            // to oldest-first; an absent or unknown value renders newest-first
+            // instead of failing the list.
+            const direction = query.direction?.trim() === "asc" ? "asc" : "desc";
             const result = queryIssues({
                 search: query.q,
                 status: statuses,
@@ -89,6 +93,7 @@ export async function registerIssueRoutes(app) {
                 needsAttention: query.needsAttention === "1" || query.needsAttention === "true",
                 page: query.page !== undefined ? Number(query.page) : undefined,
                 limit: query.limit !== undefined ? Number(query.limit) : undefined,
+                direction,
             });
             const openActionIssueIds = new Set(listOpenHumanActions().map((a) => a.issueId));
             return {
@@ -154,6 +159,10 @@ export async function registerIssueRoutes(app) {
             // NOT-364: durable Linear source attachments — files with safe name, size
             // and checksum plus Dealer blob path; links as labeled metadata only.
             sourceAttachments: listSourceAttachments(id),
+            // NOT-422: live-vs-frozen task diff — the fields a parked resume would
+            // re-freeze into a new task snapshot (empty = in sync, or pre-freeze).
+            // Issue Detail renders the pending-snapshot notice off this.
+            pendingSnapshotChangedFields: diffTaskSnapshotFromLive(issue),
         };
     });
     /** NOT-173: stable issue-level execution read model. The existing
@@ -348,18 +357,21 @@ export async function registerIssueRoutes(app) {
             if (getActiveWorkerSessionForIssue(id)) {
                 return "Cannot edit an issue with an actively running session";
             }
-            // NOT-185: the one active-workflow exception — parked at an open attempts_exhausted
-            // or policy_escalation action with nothing pending/leased. A resume re-freezes the
-            // snapshot (task fields) and the next round's profile snapshot (agent fields).
+            // NOT-185: the active-workflow exception — parked at an open attempts_exhausted,
+            // policy_escalation, or (NOT-422) product_scope_decision action with nothing
+            // pending/leased. A resume re-freezes the snapshot (task fields) and, at an
+            // attempts/policy park, the next round's profile snapshot (agent fields).
             if (getActiveWorkflowInstance(id)) {
                 if (!canEditParkedIssue(fresh)) {
                     return "Cannot edit an issue with an active workflow";
                 }
                 // Only the re-frozen inputs may change at the park: repo/base branch, the review
-                // budget and autoMerge stay as the running workflow saw them.
-                const blocked = Object.keys(parsed.data).filter((k) => !PARKED_EDITABLE_FIELDS.has(k));
+                // budget and autoMerge stay as the running workflow saw them — and at a pure
+                // product-scope pause the agents stay too (task text only).
+                const allowed = parkedEditableFields(id);
+                const blocked = Object.keys(parsed.data).filter((k) => !allowed.has(k));
                 if (blocked.length > 0) {
-                    return `Only title, description, acceptanceCriteria, developerAgentId and reviewerAgentId can be edited while parked (got: ${blocked.join(", ")})`;
+                    return `Only ${parkedEditableFieldsLabel(id)} can be edited while parked (got: ${blocked.join(", ")})`;
                 }
             }
             return null;
@@ -453,7 +465,10 @@ export async function registerIssueRoutes(app) {
     /**
      * NOT-363: reload a Linear-sourced issue's task text from its linked ticket.
      * Only while `ready` with no active workflow or running worker — a race
-     * with admission fails closed with 409. Replaces title + description
+     * with admission fails closed with 409. NOT-422 adds the parked exception:
+     * a `needs_human` product-scope pause (open `product_scope_decision`, no
+     * running session, nothing pending/leased) reloads the same way and keeps
+     * the action open for an explicit Resume. Replaces title + description
      * atomically, recompiles the execution contract, and swaps the acceptance
      * criteria for the freshly derived ones; repo, agents, policy fields,
      * auto-merge, queue position, and coordinator-owned fields are preserved.

package/bundle/server/dist/routes/issues.test.js

@@ -735,6 +735,86 @@ test("NOT-228: limit clamps to 100 and out-of-range pages keep totals", async ()
     assert.equal(pastEnd.page, 9);
     await app.close();
 });
+// NOT-385: Latest with no direction renders newest-first; the ascending
+// reverse renders the same cohort oldest-first, and an unknown direction
+// falls back to newest-first instead of failing.
+test("NOT-385: direction defaults to newest-first, asc reverses, unknown falls back", async () => {
+    const app = await buildApp();
+    const oldIssue = await r228Seed(app, "R385 order old");
+    const newIssue = await r228Seed(app, "R385 order new");
+    getDb().prepare("UPDATE issues SET updated_at = ? WHERE id = ?").run("2026-08-01T00:00:00.000Z", oldIssue.id);
+    getDb().prepare("UPDATE issues SET updated_at = ? WHERE id = ?").run("2026-09-01T00:00:00.000Z", newIssue.id);
+    const q = encodeURIComponent("R385 order");
+    const newest = await r228Get(app, `?q=${q}&page=1&limit=10`);
+    assert.deepEqual(newest.issues.map((i) => i.id), [newIssue.id, oldIssue.id]);
+    const explicitDesc = await r228Get(app, `?q=${q}&page=1&limit=10&direction=desc`);
+    assert.deepEqual(explicitDesc.issues.map((i) => i.id), [newIssue.id, oldIssue.id]);
+    const oldest = await r228Get(app, `?q=${q}&page=1&limit=10&direction=asc`);
+    assert.deepEqual(oldest.issues.map((i) => i.id), [oldIssue.id, newIssue.id]);
+    assert.equal(oldest.total, newest.total);
+    const fallback = await r228Get(app, `?q=${q}&page=1&limit=10&direction=sideways`);
+    assert.deepEqual(fallback.issues.map((i) => i.id), [newIssue.id, oldIssue.id]);
+    await app.close();
+});
+// NOT-385: equal `updated_at` rows paginate without duplicates or skips in
+// either direction — the rowid tie-breaker follows the timestamp direction
+// before LIMIT/OFFSET applies.
+test("NOT-385: equal timestamps paginate repeatably in both directions", async () => {
+    const app = await buildApp();
+    const ids = [];
+    for (const title of ["R385 tie one", "R385 tie two", "R385 tie three"]) {
+        ids.push((await r228Seed(app, title)).id);
+    }
+    for (const id of ids) {
+        getDb().prepare("UPDATE issues SET updated_at = ? WHERE id = ?").run("2026-09-01T00:00:00.000Z", id);
+    }
+    const q = encodeURIComponent("R385 tie");
+    const descFirst = await r228Get(app, `?q=${q}&limit=2&page=1`);
+    const descSecond = await r228Get(app, `?q=${q}&limit=2&page=2`);
+    assert.deepEqual(descFirst.issues.map((i) => i.id), [ids[2], ids[1]]);
+    assert.deepEqual(descSecond.issues.map((i) => i.id), [ids[0]]);
+    const ascFirst = await r228Get(app, `?q=${q}&limit=2&page=1&direction=asc`);
+    const ascSecond = await r228Get(app, `?q=${q}&limit=2&page=2&direction=asc`);
+    assert.deepEqual(ascFirst.issues.map((i) => i.id), [ids[0], ids[1]]);
+    assert.deepEqual(ascSecond.issues.map((i) => i.id), [ids[2]]);
+    for (const [first, second] of [[descFirst, descSecond], [ascFirst, ascSecond]]) {
+        assert.equal(first.total, 3);
+        assert.equal(first.totalPages, 2);
+        assert.deepEqual(new Set([...first.issues, ...second.issues].map((i) => i.id)).size, 3, "pages neither duplicate nor skip rows");
+    }
+    await app.close();
+});
+// NOT-385: the direction composes with every filter — the reverse renders the
+// same result set, only oldest-first.
+test("NOT-385: direction coexists with the search, status, repo, and attention filters", async () => {
+    const app = await buildApp();
+    const repo = "github.com/r385/filtered";
+    const keep = await r228Seed(app, "R385 filter keep me", { repo });
+    const moved = await r228Seed(app, "R385 filter moved on", { repo });
+    await r228Seed(app, "R385 filter other repo", { repo: "github.com/r385/elsewhere" });
+    transitionIssue(moved.id, "developing");
+    createHumanAction({
+        issueId: moved.id,
+        actionType: "final_review",
+        reason: "Reviewer approved",
+        question: "Accept?",
+        responseOptions: ["complete"],
+    });
+    getDb().prepare("UPDATE issues SET updated_at = ? WHERE id = ?").run("2026-08-01T00:00:00.000Z", keep.id);
+    getDb().prepare("UPDATE issues SET updated_at = ? WHERE id = ?").run("2026-09-01T00:00:00.000Z", moved.id);
+    const q = encodeURIComponent("R385 filter");
+    const repoParam = encodeURIComponent(repo);
+    const newest = await r228Get(app, `?q=${q}&repo=${repoParam}&page=1&limit=10`);
+    assert.deepEqual(newest.issues.map((i) => i.id), [moved.id, keep.id]);
+    const oldest = await r228Get(app, `?q=${q}&repo=${repoParam}&page=1&limit=10&direction=asc`);
+    assert.deepEqual(oldest.issues.map((i) => i.id), [keep.id, moved.id]);
+    assert.equal(oldest.total, newest.total);
+    const byStatus = await r228Get(app, `?q=${q}&status=developing&page=1&limit=10&direction=asc`);
+    assert.deepEqual(byStatus.issues.map((i) => i.id), [moved.id]);
+    const attention = await r228Get(app, `?q=${q}&needsAttention=1&page=1&limit=10&direction=asc`);
+    assert.deepEqual(attention.issues.map((i) => i.id), [moved.id]);
+    await app.close();
+});
 test("NOT-217: PATCH reviewer-only edit records before/after reviewers without touching the developer", async () => {
     const app = await buildApp();
     const created = (await app.inject({

package/bundle/server/dist/routes/queue.js

@@ -17,7 +17,7 @@ export async function registerQueueRoutes(app) {
         return getAdmissionStatus();
     });
     /**
-     * NOT-215: operator-chosen active-issue limit (1–2, never above the effective
+     * NOT-215: operator-chosen active-issue limit (1–5, never above the effective
      * worker/spawn ceiling). Persisted in the DB — survives page reload and server
      * restart. Raising fills free slots on the next tick; lowering only pauses new
      * admissions, never interrupts running work.

package/bundle/server/dist/routes/queue.test.js

@@ -1,5 +1,5 @@
 // packages/server/src/routes/queue.test.ts
-import { test, before, beforeEach } from "node:test";
+import { test, before, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
 import fs from "node:fs";
 import os from "node:os";
@@ -12,6 +12,10 @@ const { createIssue } = await import("../repository/issues.js");
 const { registerQueueRoutes } = await import("./queue.js");
 const { startWorkflow } = await import("../coordinator/commands.js");
 before(() => migrate());
+const savedEnv = {
+    MAX_COORDINATOR_CONCURRENCY: process.env.MAX_COORDINATOR_CONCURRENCY,
+    MAX_CONCURRENT_RUNS: process.env.MAX_CONCURRENT_RUNS,
+};
 beforeEach(() => {
     getDb().exec(`
     DELETE FROM queue_entries;
@@ -24,6 +28,17 @@ beforeEach(() => {
   `);
     // NOT-215: the persisted concurrency setting must not leak between tests.
     getDb().prepare("DELETE FROM intake_settings WHERE key = 'admission.maxActiveIssues'").run();
+    // NOT-378: ceiling assertions assume no environment overrides.
+    delete process.env.MAX_COORDINATOR_CONCURRENCY;
+    delete process.env.MAX_CONCURRENT_RUNS;
+});
+afterEach(() => {
+    for (const [key, value] of Object.entries(savedEnv)) {
+        if (value === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = value;
+    }
 });
 async function app() {
     const f = Fastify();
@@ -87,26 +102,28 @@ test("NOT-215: GET /api/queue/status reports the truthful admission read model",
         waiting: 0,
         limit: 1,
         maxActiveIssues: 1,
-        ceiling: 2,
-        options: [1, 2],
+        // NOT-378: default five-process ceiling, options 1–5.
+        ceiling: 5,
+        options: [1, 2, 3, 4, 5],
         overCap: false,
     });
     await f.close();
 });
-test("NOT-215: PUT /api/queue/settings persists 1..2 and the status reflects it", async () => {
+test("NOT-215: PUT /api/queue/settings persists 1..5 and the status reflects it", async () => {
     const f = await app();
-    const put = await f.inject({
-        method: "PUT",
-        url: "/api/queue/settings",
-        payload: { maxActiveIssues: 2 },
-    });
-    assert.equal(put.statusCode, 200);
-    const body = put.json();
-    assert.equal(body.maxActiveIssues, 2);
-    assert.equal(body.limit, 2);
+    for (const value of [1, 2, 3, 4, 5]) {
+        const put = await f.inject({
+            method: "PUT",
+            url: "/api/queue/settings",
+            payload: { maxActiveIssues: value },
+        });
+        assert.equal(put.statusCode, 200, `accepts ${value}`);
+        assert.equal(put.json().maxActiveIssues, value);
+        assert.equal(put.json().limit, value);
+    }
     const status = await f.inject({ method: "GET", url: "/api/queue/status" });
-    assert.equal(status.json().maxActiveIssues, 2);
-    assert.equal(status.json().limit, 2);
+    assert.equal(status.json().maxActiveIssues, 5);
+    assert.equal(status.json().limit, 5);
     await f.close();
 });
 test("NOT-215: the persisted limit survives a server restart (fresh app, same DB)", async () => {
@@ -114,30 +131,48 @@ test("NOT-215: the persisted limit survives a server restart (fresh app, same DB
     const put = await f.inject({
         method: "PUT",
         url: "/api/queue/settings",
-        payload: { maxActiveIssues: 2 },
+        payload: { maxActiveIssues: 5 },
     });
     assert.equal(put.statusCode, 200);
     await f.close();
     const restarted = await app();
     const status = await restarted.inject({ method: "GET", url: "/api/queue/status" });
-    assert.equal(status.json().maxActiveIssues, 2);
-    assert.equal(status.json().limit, 2);
+    assert.equal(status.json().maxActiveIssues, 5);
+    assert.equal(status.json().limit, 5);
     await restarted.close();
 });
-test("NOT-215: PUT /api/queue/settings rejects values outside 1..2", async () => {
+test("NOT-215: PUT /api/queue/settings rejects values outside 1..5", async () => {
     const f = await app();
     for (const payload of [
         { maxActiveIssues: 0 },
-        { maxActiveIssues: 3 },
+        { maxActiveIssues: 6 },
+        { maxActiveIssues: 99 },
         { maxActiveIssues: 1.5 },
         { maxActiveIssues: "x" },
         {},
     ]) {
         const res = await f.inject({ method: "PUT", url: "/api/queue/settings", payload });
         assert.equal(res.statusCode, 400, `rejects ${JSON.stringify(payload)}`);
+        assert.equal(typeof res.json().error, "string");
     }
     // A rejected write leaves the stored value alone.
     const status = await f.inject({ method: "GET", url: "/api/queue/status" });
     assert.equal(status.json().maxActiveIssues, 1);
     await f.close();
 });
+test("NOT-378: PUT /api/queue/settings rejects a value above the effective ceiling", async () => {
+    process.env.MAX_COORDINATOR_CONCURRENCY = "3";
+    const f = await app();
+    const res = await f.inject({
+        method: "PUT",
+        url: "/api/queue/settings",
+        payload: { maxActiveIssues: 4 },
+    });
+    assert.equal(res.statusCode, 400);
+    assert.equal(res.json().error, "maxActiveIssues 4 exceeds the effective worker/spawn ceiling of 3");
+    const status = await f.inject({ method: "GET", url: "/api/queue/status" });
+    assert.equal(status.json().maxActiveIssues, 1, "a rejected write leaves the stored value alone");
+    assert.equal(status.json().ceiling, 3);
+    assert.deepEqual(status.json().options, [1, 2, 3]);
+    await f.close();
+});

package/bundle/server/dist/runners/process-registry.js

@@ -3,7 +3,7 @@ const activeLogPaths = new Map();
 let activeSpawnCount = 0;
 const spawnWaiters = [];
 export function maxConcurrentSpawns() {
-    return Number(process.env.MAX_CONCURRENT_RUNS ?? 2);
+    return Number(process.env.MAX_CONCURRENT_RUNS ?? 5);
 }
 export async function acquireSpawnSlot() {
     const max = maxConcurrentSpawns();

package/bundle/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-dealer/server",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "type": "module",
   "main": "dist/index.js",
   "files": [
@@ -23,7 +23,7 @@
     "test": "AGENT_DEALER_SKIP_GITHUB_HEALTH=1 AGENT_DEALER_SKIP_AGENT_HEALTH=1 npm run build -w @agent-dealer/shared && AGENT_DEALER_SKIP_GITHUB_HEALTH=1 AGENT_DEALER_SKIP_AGENT_HEALTH=1 node ../../scripts/run-workspace-tests.mjs"
   },
   "dependencies": {
-    "@agent-dealer/shared": "1.3.0",
+    "@agent-dealer/shared": "1.3.2",
     "@fastify/cors": "^11.0.1",
     "@fastify/static": "^8.2.0",
     "@modelcontextprotocol/sdk": "^1.29.0",