agent-relay-orchestrator 0.106.0 → 0.107.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.106.0",
+  "version": "0.107.0",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.0",
-    "agent-relay-sdk": "0.2.92",
+    "agent-relay-sdk": "0.2.93",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/workspace-probe/merge.ts

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import type { WorkspaceMergePreview, WorkspaceMergeResult } from "agent-relay-sdk";
+import type { BaseWorktreeSyncResult, WorkspaceMergePreview, WorkspaceMergeResult } from "agent-relay-sdk";
 import { git, gitRaw } from "../git";
 import { prMergedState } from "../workspace-pr";
 import { refreshWorkspaceDeps } from "./deps";
@@ -100,16 +100,45 @@ function resetIndexPathsToHead(worktreePath: string, paths: string[]): boolean {
   return git(["reset", "-q", "HEAD", "--", ...paths], worktreePath).ok;
 }
 
-function logBaseWorktreeSyncWarning(base: string, worktreePath: string, message: string): void {
-  console.error(`[orchestrator] Warning: advanced ${base} but could not fully sync dirty base worktree ${worktreePath}: ${message}`);
+/** Landed paths whose working copy still differs from the advanced HEAD (ground truth, not
+ *  exit codes): the checkout is mixed for these — reads/builds/publishes see STALE files. */
+function pathsDifferingFromHead(worktreePath: string, paths: string[]): string[] {
+  if (paths.length === 0) return [];
+  const diff = gitRaw(["diff", "--name-only", "-z", "HEAD", "--", ...paths], worktreePath);
+  // A failed diff can't prove the checkout is clean — treat every landed path as suspect.
+  return diff.ok ? splitNul(diff.stdout) : [...paths];
+}
+
+const RECONCILED: BaseWorktreeSyncResult = { reconciled: true };
+
+/** Combine two heal outcomes from a single land (an upstream sync + the final land can each
+ *  touch the dirty checkout). A mixed state from either wins; paths union. */
+function mergeBaseSyncResults(a: BaseWorktreeSyncResult | undefined, b: BaseWorktreeSyncResult | undefined): BaseWorktreeSyncResult | undefined {
+  if (!a || a.reconciled) return b && !b.reconciled ? b : a ?? b;
+  if (!b || b.reconciled) return a;
+  const unsyncedPaths = [...new Set([...(a.unsyncedPaths ?? []), ...(b.unsyncedPaths ?? [])])];
+  const preservedWipPaths = [...new Set([...(a.preservedWipPaths ?? []), ...(b.preservedWipPaths ?? [])])];
+  return {
+    reconciled: false,
+    unsyncedPaths,
+    ...(preservedWipPaths.length ? { preservedWipPaths } : {}),
+    message: [a.message, b.message].filter(Boolean).join("; "),
+  };
 }
 
 /**
  * After a dirty checked-out base is advanced with ref plumbing, bring the checkout forward
  * without clobbering human WIP. `read-tree -m -u old new` is the primary mechanism: it
- * updates clean paths in the index and worktree and refuses before overwriting local edits.
- * If it refuses, preserve the land by leaving the ref advanced, restore only paths that were
- * clean before the ref move, and normalize conflicting landed paths to unstaged edits.
+ * updates clean paths in the index and worktree and refuses (atomically) before overwriting
+ * local edits. If it refuses, preserve the land by leaving the ref advanced, force only the
+ * paths that were clean before the ref move to HEAD, and normalize conflicting landed paths
+ * (genuine human WIP) to unstaged edits so they surface rather than stage a reverse diff.
+ *
+ * Crucially (#824): the heal is best-effort, so it VERIFIES against ground truth afterwards.
+ * Any landed path whose working copy still differs from the advanced HEAD leaves the checkout
+ * in a MIXED state (HEAD moved, working file didn't). That is no longer swallowed as a log
+ * warning — it is returned so the relay surfaces a loud operator alert. We never blind-clobber
+ * a path with real human WIP to "fix" it; such paths are reported as `preservedWipPaths`.
  */
 function syncDirtyBaseWorktreeAfterRefAdvance(
   base: string,
@@ -117,24 +146,42 @@ function syncDirtyBaseWorktreeAfterRefAdvance(
   oldBaseTip: string,
   newBaseTip: string,
   dirtyBefore: Set<string> | undefined,
-): void {
-  if (!baseWorktree?.dirty || !dirtyBefore) return;
+): BaseWorktreeSyncResult {
+  if (!baseWorktree?.dirty || !dirtyBefore) return RECONCILED;
   const readTree = git(["read-tree", "-m", "-u", oldBaseTip, newBaseTip], baseWorktree.path);
-  if (readTree.ok) return;
+  if (readTree.ok) return RECONCILED;
 
   const changedPaths = changedPathList(baseWorktree.path, oldBaseTip, newBaseTip);
   const cleanChangedPaths = changedPaths.filter((path) => !dirtyBefore.has(path));
   const dirtyChangedPaths = changedPaths.filter((path) => dirtyBefore.has(path));
-  const restoredClean = restorePathsFromHead(baseWorktree.path, cleanChangedPaths);
-  const resetDirtyIndex = resetIndexPathsToHead(baseWorktree.path, dirtyChangedPaths);
-  logBaseWorktreeSyncWarning(
-    base,
-    baseWorktree.path,
-    [
-      readTree.stderr || "read-tree refused local changes",
-      restoredClean ? undefined : "failed to restore clean landed paths",
-      resetDirtyIndex ? undefined : "failed to reset conflicting path index",
-    ].filter(Boolean).join("; "),
+  // Clean landed paths carry no human WIP — force them to HEAD (restores content AND mode).
+  restorePathsFromHead(baseWorktree.path, cleanChangedPaths);
+  // Landed paths the human also edited — preserve the WIP, normalize the index to HEAD so the
+  // difference surfaces as an unstaged modification (not a staged reverse diff). #681.
+  resetIndexPathsToHead(baseWorktree.path, dirtyChangedPaths);
+
+  // Ground-truth check (#824): re-derive which landed paths are STILL out of sync with the
+  // advanced HEAD rather than trusting the restore/reset exit codes. A clean landed path left
+  // stale here is the silent strand that shipped a stale file into the #823 bootstrap publish.
+  const unsyncedPaths = pathsDifferingFromHead(baseWorktree.path, changedPaths);
+  if (unsyncedPaths.length === 0) return RECONCILED;
+  const preservedWipPaths = unsyncedPaths.filter((path) => dirtyBefore.has(path));
+  return {
+    reconciled: false,
+    unsyncedPaths,
+    ...(preservedWipPaths.length ? { preservedWipPaths } : {}),
+    message: `advanced ${base} but ${unsyncedPaths.length} landed path(s) remain out of sync with HEAD in ${baseWorktree.path}: ${unsyncedPaths.join(", ")}`
+      + (preservedWipPaths.length ? ` (preserved human WIP — reconcile by hand: ${preservedWipPaths.join(", ")})` : ""),
+  };
+}
+
+/** Loud, operator-visible signal that a dirty base checkout was left in a mixed state. Replaces
+ *  the old swallow-as-warning behavior (#824): a stale primary checkout must never be silent. */
+function logBaseWorktreeStrand(base: string, worktreePath: string, sync: BaseWorktreeSyncResult): void {
+  console.error(
+    `[orchestrator] ALERT (#824): dirty base ${base} checkout left in a MIXED state after land — `
+      + `${worktreePath} working files are out of sync with the advanced HEAD. ${sync.message ?? ""} `
+      + "Reads/builds/publishes from this checkout will see STALE content until reconciled.",
   );
 }
 
@@ -511,7 +558,7 @@ function syncLocalBaseToUpstream(
   worktreePath: string,
   base: string,
   upstream: string,
-): { ok: true } | { ok: false; error: string } {
+): { ok: true; baseSync?: BaseWorktreeSyncResult } | { ok: false; error: string } {
   const upstreamSha = git(["rev-parse", "--verify", upstream], worktreePath).stdout;
   if (!upstreamSha) return { ok: false, error: `cannot resolve ${upstream} to sync ${base}` };
   const baseWorktree = worktreeForBranch(repoRoot, base);
@@ -530,8 +577,8 @@ function syncLocalBaseToUpstream(
   const updateArgs = oldBaseTip ? ["update-ref", `refs/heads/${base}`, upstreamSha, oldBaseTip] : ["update-ref", `refs/heads/${base}`, upstreamSha];
   const update = git(updateArgs, repoRoot);
   if (!update.ok) return { ok: false, error: update.stderr || `failed to advance ${base} to ${upstream}` };
-  if (oldBaseTip) syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, upstreamSha, dirtyBefore);
-  return { ok: true };
+  const baseSync = oldBaseTip ? syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, upstreamSha, dirtyBefore) : undefined;
+  return { ok: true, baseSync };
 }
 
 function mergeRebaseFf(
@@ -560,6 +607,10 @@ function mergeRebaseFf(
   //   - Refuse ONLY on genuine divergence: local base has commits not on origin, so
   //     a sync would rewrite/discard published-or-local history. A real failure must
   //     still set `error` so the relay's no-progress backoff (#638) can engage.
+  // Tracks whether the DIRTY base checkout caught up to the advanced HEAD across BOTH heal
+  // points (the upstream sync below and the final land). A mixed state from either is surfaced
+  // loudly rather than swallowed as a log warning (#824).
+  let baseSync: BaseWorktreeSyncResult | undefined;
   const upstream = upstreamRef(worktreePath, base);
   const slash = upstream ? upstream.indexOf("/") : -1;
   const remote = slash > 0 ? upstream!.slice(0, slash) : undefined; // remote of a `remote/branch` upstream
@@ -574,6 +625,7 @@ function mergeRebaseFf(
       }
       const synced = syncLocalBaseToUpstream(repoRoot, worktreePath, base, upstream);
       if (!synced.ok) return head({ status: "review_requested", error: synced.error });
+      baseSync = mergeBaseSyncResults(baseSync, synced.baseSync);
     }
   }
 
@@ -618,15 +670,23 @@ function mergeRebaseFf(
       ? git(["update-ref", `refs/heads/${base}`, headSha, oldBaseTip], repoRoot)
       : git(["update-ref", `refs/heads/${base}`, headSha], repoRoot);
     if (!update.ok) return head({ status: "review_requested", error: update.stderr || "failed to advance base ref" });
-    if (oldBaseTip) syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, headSha, dirtyBasePathsBefore);
+    if (oldBaseTip) baseSync = mergeBaseSyncResults(baseSync, syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, headSha, dirtyBasePathsBefore));
   } else {
     const baseSha = git(["rev-parse", base], repoRoot).stdout;
     const merged = recordNoFfMerge(repoRoot, base, baseSha, headSha, landMergeMessage(branch, landedSubject));
     if (!merged.ok) return head(merged.conflict ? { conflict: true, status: "conflict", error: merged.error } : { status: "review_requested", error: merged.error });
     baseTip = merged.mergeSha;
-    syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, baseSha, baseTip, dirtyBasePathsBefore);
+    baseSync = mergeBaseSyncResults(baseSync, syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, baseSha, baseTip, dirtyBasePathsBefore));
   }
 
+  // #824 — a dirty base checkout left out of sync with the advanced HEAD is a MIXED state:
+  // the land succeeded but the shared/primary checkout now serves STALE files for the landed
+  // paths. Surface it loudly (host log + a `baseWorktreeSync` field the relay raises as an
+  // operator alert) instead of swallowing it as a warning. We never blind-clobber human WIP to
+  // hide it — the report names which paths still need a manual reconcile.
+  const baseWorktreeSyncField = baseSync && !baseSync.reconciled ? { baseWorktreeSync: baseSync } : {};
+  if (baseSync && !baseSync.reconciled && baseWorktree) logBaseWorktreeStrand(base, baseWorktree.path, baseSync);
+
   // Publish the advanced base so local and origin converge (#190). We verified
   // origin was an ancestor of base above, so this is a fast-forward; a failure
   // means origin raced us — surface it instead of claiming an unpublished land.
@@ -656,13 +716,13 @@ function mergeRebaseFf(
       // continues from a buildable state (issue #51). No-op when nothing is stale.
       const depsRefresh = refreshWorkspaceDeps(repoRoot, worktreePath);
       const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
-      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, pushed, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
+      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, pushed, ...(reportDeps ? { depsRefresh } : {}), ...baseWorktreeSyncField, error: undefined });
     }
     // Recycle failed — keep the existing branch. Still landed, still active.
-    return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, error: undefined });
+    return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, ...baseWorktreeSyncField, error: undefined });
   }
   const removed = git(["worktree", "remove", "--force", worktreePath], repoRoot);
   const worktreeRemoved = removed.ok;
   const branchDeleted = worktreeRemoved ? git(["branch", "-D", branch], repoRoot).ok : false;
-  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, branchDeleted, pushed, error: undefined });
+  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, branchDeleted, pushed, ...baseWorktreeSyncField, error: undefined });
 }