agent-relay-orchestrator 0.127.11 → 0.129.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.127.11",
+  "version": "0.129.0",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.124",
+    "agent-relay-sdk": "0.2.125",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/control.ts

@@ -4,8 +4,8 @@ import { SCHEDULER_COMMAND_MAX_CONCURRENT, SCHEDULER_COMMAND_MAX_OUTPUT_BYTES, t
 import type { ManagedAgentReport, RelayClient, RelayCommand } from "./relay";
 import { handleSelfUpgrade } from "./self-upgrade";
 import { readLocalProviderConfigs } from "./provider-config-migration";
-import { findSessionRecord, readRunnerInfo, spawnAgent, stopSession, type SpawnOptions } from "./spawn";
-import { cleanupWorkspace, discardRecoveryBranch, idleRefreshWorktree, mergeWorkspace, pruneWorktrees, reconcileWorkspace, refreshWorkspaceDeps, workspacesRoot } from "./workspace-probe";
+import { findSessionRecord, isSessionAlive, readRunnerInfo, spawnAgent, stopSession, type SpawnOptions } from "./spawn";
+import { cleanupWorkspace, discardRecoveryBranch, idleRefreshWorktree, mergeWorkspace, mergeWorkspacePlainGit, pruneWorktrees, reconcileWorkspace, refreshWorkspaceDeps, workspacesRoot } from "./workspace-probe";
 import { withMergePhaseTimeout } from "./workspace-probe/merge-timeouts";
 import { withRepoLock } from "./repo-lock";
 import { armWorkspacePrAutoMerge, mergeWorkspacePr, refreshWorkspacePrBranch } from "./workspace-pr";
@@ -74,6 +74,13 @@ export function resolveMaxConcurrentSpawns(env: NodeJS.ProcessEnv = process.env)
 const DEFAULT_SPAWN_REGISTRATION_TIMEOUT_MS = 30_000;
 const SPAWN_REGISTRATION_POLL_MS = 100;
 
+// #1201 F3 — post-registration liveness settle. waitForManagedRegistration returns on the FIRST
+// `registeredAt` write; a successor that crashes microseconds later would, for a NON-managed agent
+// (no policy → no backoff respawn), be lost the instant we stop the predecessor. Before tearing
+// down the predecessor we wait this beat and confirm the successor is STILL alive. Managed agents
+// have backoff respawn as a net; non-managed must never be strandable.
+const DEFAULT_SPAWN_LIVENESS_SETTLE_MS = 300;
+
 export function resolveSpawnRegistrationTimeoutMs(env: NodeJS.ProcessEnv = process.env): number {
   const raw = env.AGENT_RELAY_SPAWN_REGISTRATION_TIMEOUT_MS;
   if (raw === undefined || raw.trim() === "") return DEFAULT_SPAWN_REGISTRATION_TIMEOUT_MS;
@@ -101,19 +108,17 @@ export function resolveSchedulerCommandMaxOutputBytes(env: NodeJS.ProcessEnv = p
 /** Awaits a spawn slot until the child registers, or resolves false at the fail-safe deadline. */
 export type WaitForRegistration = (agent: ManagedAgentReport, timeoutMs: number) => Promise<boolean>;
 
-// #930/#880 — the orchestrator observes a child registering through its runner
-// info file: the runner writes `controlUrl` immediately after binding its local
-// control/MCP server (runner-core writeRunnerInfoFile, right after startMcpProxy),
-// which is exactly #880's contended ws-bind window. So the file's presence is the
-// host-local signal that the child is past that window; holding the slot until it
-// appears is what bounds how many children materialize→bind at once.
+// Registration is explicit in the runner-info file. `controlUrl` appears before the
+// Relay bus register completes, so using file existence alone creates a false-success
+// window where a restart can kill the predecessor before the successor owns its Relay
+// identity. `registeredAt` is written only after registerWithinDeadline resolves.
 async function waitForManagedRegistration(agent: ManagedAgentReport, timeoutMs: number): Promise<boolean> {
   const session = agent.sessionName ?? agent.tmuxSession;
   if (!session) return false;
   const deadline = Date.now() + timeoutMs;
   for (;;) {
     const record = findSessionRecord({ tmuxSession: session, agentId: agent.agentId });
-    if (record && readRunnerInfo(record)) return true;
+    if (record && readRunnerInfo(record)?.registeredAt) return true;
     if (Date.now() >= deadline) return false;
     await Bun.sleep(SPAWN_REGISTRATION_POLL_MS);
   }
@@ -134,6 +139,12 @@ interface ControlHandlerDeps {
   stopSession?: typeof stopSession;
   maxConcurrentSchedulerCommands?: number;
   schedulerCommandMaxOutputBytes?: number;
+  // #1201 F3 — injectable post-registration liveness settle. Defaults to sleeping settleMs then
+  // checking the successor session is still alive. Tests override it to simulate a register-then-crash.
+  settleRegistration?: (agent: ManagedAgentReport, settleMs: number) => Promise<boolean>;
+  registrationSettleMs?: number;
+  // #1201 F2 — injectable safe-point re-check. Defaults to relay.recheckSelfRestartSafePoint.
+  recheckSafePoint?: (agentId: string) => Promise<{ ok: boolean; reason?: string }>;
 }
 
 export function createControlHandler(
@@ -149,6 +160,13 @@ export function createControlHandler(
   const spawnSlots = new Semaphore(deps.maxConcurrentSpawns ?? resolveMaxConcurrentSpawns());
   const waitForRegistration = deps.waitForRegistration ?? waitForManagedRegistration;
   const registrationTimeoutMs = deps.registrationTimeoutMs ?? resolveSpawnRegistrationTimeoutMs();
+  const registrationSettleMs = deps.registrationSettleMs ?? DEFAULT_SPAWN_LIVENESS_SETTLE_MS;
+  const settleRegistration = deps.settleRegistration ?? (async (agent, settleMs) => {
+    if (settleMs > 0) await Bun.sleep(settleMs);
+    const session = agent.sessionName ?? agent.tmuxSession;
+    return session ? isSessionAlive(session) : false;
+  });
+  const recheckSafePoint = deps.recheckSafePoint ?? ((agentId: string) => relay.recheckSelfRestartSafePoint(agentId));
   const schedulerCommandSlots = new Semaphore(deps.maxConcurrentSchedulerCommands ?? resolveMaxConcurrentSchedulerCommands());
   const schedulerCommandMaxOutputBytes = deps.schedulerCommandMaxOutputBytes ?? resolveSchedulerCommandMaxOutputBytes();
   // Backgrounded spawn tasks: each is claimed synchronously (status → accepted)
@@ -164,18 +182,33 @@ export function createControlHandler(
     return agent;
   }
 
-  async function spawnAndWaitForRegistration(opts: SpawnOptions, action = "Spawned"): Promise<ManagedAgentReport> {
+  async function spawnAndWaitForRegistration(opts: SpawnOptions, action = "Spawned", requireRegistration = false): Promise<ManagedAgentReport> {
     const agent = await spawnManagedAgent(opts, action);
     const registered = await waitForRegistration(agent, registrationTimeoutMs);
     if (!registered) {
-      // Not a spawn failure — the process launched; it just didn't register in
-      // time. Release the slot (fail-safe) so a slow/never-registering child
-      // can't wedge capacity, but still treat the launch as successful.
+      if (requireRegistration) {
+        const candidateSession = agent.sessionName ?? agent.tmuxSession;
+        if (candidateSession) {
+          await dispatchStop(candidateSession, config, "successor failed to register", false, 5_000).catch(() => undefined);
+          managedAgents = managedAgents.filter((item) => (item.sessionName ?? item.tmuxSession) !== candidateSession);
+        }
+        throw new Error(`successor ${candidateSession ?? agent.agentId} did not register within ${registrationTimeoutMs}ms`);
+      }
       console.error(`[orchestrator] spawn ${agent.tmuxSession} did not register within ${registrationTimeoutMs}ms; releasing slot (fail-safe)`);
     }
     return agent;
   }
 
+  // #1201 F2/F3 — reconcile an aborted self-restart teardown by removing the SUCCESSOR (keeping
+  // the predecessor). Best-effort stop; drop it from the managed roster so we don't report a
+  // generation we just killed.
+  async function tearDownSuccessor(successor: ManagedAgentReport, reason: string): Promise<void> {
+    const successorSession = successor.sessionName ?? successor.tmuxSession;
+    if (!successorSession) return;
+    await dispatchStop(successorSession, config, reason, false, 5_000).catch(() => undefined);
+    managedAgents = managedAgents.filter((item) => (item.sessionName ?? item.tmuxSession) !== successorSession);
+  }
+
   async function markSpawnCommandFailed(command: RelayCommand, error: unknown): Promise<void> {
     console.error(`[orchestrator] spawn dispatch failed: ${errMessage(error)}`);
     // #930 — the `failed` status write can itself reject during a relay blip. Wrap it so
@@ -264,7 +297,7 @@ export function createControlHandler(
       if (restart && restartSpawn) {
         await spawnSlots.acquire();
         try {
-          restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSpawn, config), "Restarted");
+          restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSpawn, config), "Restarted", true);
         } finally {
           spawnSlots.release();
         }
@@ -279,14 +312,46 @@ export function createControlHandler(
         spawnRequestId: ctrl.spawnRequestId,
       };
     }
-    const result = await dispatchStop(session, config, typeof ctrl.reason === "string" ? ctrl.reason : restart ? "restart" : "shutdown", ctrl.graceful !== false, shutdownTimeoutMs(ctrl));
-    managedAgents = managedAgents.filter((agent) => (agent.sessionName ?? agent.tmuxSession) !== session);
     // A managed restart carries a fresh spawnRequestId in restartSpawn — keep it.
     // Falling back to the live agent's params would reuse the stale id and break
     // relay correlation, so drop it and let spawnAgent assign a new identity.
     const restartSource = (restartSpawn ?? (current ? { ...current, spawnRequestId: undefined } : undefined)) as Record<string, any> | undefined;
     let restarted: ManagedAgentReport | undefined;
-    if (restart && restartSource) {
+    if (restart && restartSpawn && restartSource) {
+      await spawnSlots.acquire();
+      try {
+        // Transactional swap: the successor must complete Relay registration before the
+        // predecessor session is touched. A spawn/registration failure throws with the old
+        // process still alive and the durable continuation artifact still fetchable.
+        restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSource, config), "Restarted", true);
+      } finally {
+        spawnSlots.release();
+      }
+      // #1201 F3 — liveness settle: confirm the successor is STILL alive a beat after its first
+      // `registeredAt` write, BEFORE the predecessor teardown becomes irreversible. A successor that
+      // crashes microseconds after registering would otherwise strand a non-managed agent (no
+      // policy → no backoff respawn). On failure: tear down the (dead) successor, keep predecessor.
+      if (!(await settleRegistration(restarted, registrationSettleMs))) {
+        await tearDownSuccessor(restarted, "successor died during post-registration liveness settle");
+        throw new Error(`successor ${restarted.sessionName ?? restarted.tmuxSession} did not stay alive after registration settle; predecessor kept`);
+      }
+      // #1201 F2 — TOCTOU safe-point re-check for a SELF-restart, as late as possible before the
+      // kill. register-before-kill left the predecessor running after it got {ok:true}, so it could
+      // have created WIP / spawned a child / taken a merge lease in the window. Reconciliation on a
+      // now-violated safe-point: tear down the SUCCESSOR and KEEP the predecessor — never two live
+      // generations, never a lost agent. The caller's own live process simply keeps running; the
+      // failed command records why. Fail-closed: an unavailable re-check is treated as a violation.
+      if (isRecord(ctrl.selfRestart) && typeof ctrl.agentId === "string") {
+        const recheck = await recheckSafePoint(ctrl.agentId);
+        if (!recheck.ok) {
+          await tearDownSuccessor(restarted, `self-restart safe-point re-check failed: ${recheck.reason ?? "unknown"}`);
+          throw new Error(`self-restart aborted at teardown: ${recheck.reason ?? "safe-point re-check failed"}; predecessor kept, successor torn down`);
+        }
+      }
+    }
+    const result = await dispatchStop(session, config, typeof ctrl.reason === "string" ? ctrl.reason : restart ? "restart" : "shutdown", ctrl.graceful !== false, shutdownTimeoutMs(ctrl));
+    managedAgents = managedAgents.filter((agent) => (agent.sessionName ?? agent.tmuxSession) !== session);
+    if (restart && !restartSpawn && restartSource) {
       await spawnSlots.acquire();
       try {
         restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSource, config), "Restarted");
@@ -387,6 +452,17 @@ export function createControlHandler(
   }
 
   async function runNonSpawnCommand(command: RelayCommand): Promise<boolean> {
+    // #1201 F4 — at-most-once guard for restart/shutdown, mirroring runSpawnToRegistration's
+    // terminal-status re-fetch. A redelivered agent.restart (e.g. relay reconcile after an
+    // orchestrator bounce) must not spawn a SECOND successor sharing the predecessor's fresh
+    // spawnRequestId. If the command already reached a terminal state, this is a replay — skip it.
+    if (command.type === "agent.restart" || command.type === "agent.shutdown") {
+      const current = await relay.getCommand(command.id);
+      if (current && TERMINAL_COMMAND_STATUSES.has(current.status)) {
+        console.error(`[orchestrator] skipping ${command.type} ${command.id}: already ${current.status} (replay guard)`);
+        return true;
+      }
+    }
     await relay.updateCommand(command.id, "accepted");
     await relay.updateCommand(command.id, "running");
     try {
@@ -420,7 +496,7 @@ export function createControlHandler(
       } else if (command.type === "workspace.merge") {
         let result: WorkspaceMergeResult;
         try {
-          result = await withMergePhaseTimeout("total", (signal) => mergeWorkspace({
+          const mergeInput = {
             id: typeof command.params.workspaceId === "string" ? command.params.workspaceId : undefined,
             repoRoot: typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined,
             worktreePath: typeof command.params.worktreePath === "string" ? command.params.worktreePath : undefined,
@@ -428,6 +504,7 @@ export function createControlHandler(
             baseRef: typeof command.params.baseRef === "string" ? command.params.baseRef : undefined,
             baseSha: typeof command.params.baseSha === "string" ? command.params.baseSha : undefined,
             strategy: command.params.strategy === "pr" || command.params.strategy === "rebase-ff" || command.params.strategy === "auto" ? command.params.strategy : undefined,
+            landMechanism: command.params.landMechanism === "plain-git" ? "plain-git" : "managed",
             deleteBranch: command.params.deleteBranch !== false,
             push: command.params.push !== false,
             prTitle: typeof command.params.prTitle === "string" ? command.params.prTitle : undefined,
@@ -442,8 +519,10 @@ export function createControlHandler(
                   subject: typeof command.params.prLanded.subject === "string" ? command.params.prLanded.subject : undefined,
                 }
               : undefined,
-            signal,
-          }));
+          } as const;
+          result = await withMergePhaseTimeout("total", (signal) => mergeInput.landMechanism === "plain-git"
+            ? mergeWorkspacePlainGit({ ...mergeInput, signal })
+            : mergeWorkspace({ ...mergeInput, signal }));
         } catch (err) {
           const branch = typeof command.params.branch === "string" ? command.params.branch : undefined;
           const baseRef = typeof command.params.baseRef === "string" ? command.params.baseRef : undefined;

package/src/relay.ts

@@ -20,6 +20,10 @@ export interface RelayClient {
   startHeartbeatLoop(): void;
   stopHeartbeatLoop(): void;
   remintRunnerToken(currentToken: string): Promise<RunnerTokenRemint | null>;
+  // #1201 F2 — re-evaluate the self-restart safe-point against CURRENT relay state, called
+  // immediately before killing the predecessor in a self-restart teardown. Fail-closed: any
+  // transport/parse failure resolves to a violation so the caller aborts the kill.
+  recheckSelfRestartSafePoint(agentId: string): Promise<{ ok: boolean; reason?: string }>;
   connected: boolean;
 }
 
@@ -269,6 +273,17 @@ export function createRelayClient(config: OrchestratorConfig, probeCache: Provid
         return null;
       }
     },
+    async recheckSelfRestartSafePoint(agentId: string): Promise<{ ok: boolean; reason?: string }> {
+      try {
+        const res = await apiCall("POST", `/agents/${encodeURIComponent(agentId)}/self-restart-recheck`, {});
+        if (!res.ok) return { ok: false, reason: `self-restart safe-point re-check returned ${res.status}` };
+        const body = await res.json().catch(() => null) as { ok?: boolean; reason?: string } | null;
+        if (!body || typeof body.ok !== "boolean") return { ok: false, reason: "self-restart safe-point re-check returned an invalid response" };
+        return { ok: body.ok, reason: body.reason };
+      } catch (error) {
+        return { ok: false, reason: `self-restart safe-point re-check unavailable: ${isAbortError(error) ? "timed out" : String(error)}` };
+      }
+    },
     acquireProviderQuotaLease(orchestratorId: string, input: ProviderQuotaLeaseAcquireInput): Promise<ProviderQuotaLeaseAcquireResult> {
       return http.acquireProviderQuotaLease(orchestratorId, input);
     },

package/src/spawn/runtime.ts

@@ -147,6 +147,7 @@ export function readRunnerInfo(record: Pick<SessionRecord, "runnerInfoFile" | "a
       tmuxSocket: typeof info.tmuxSocket === "string" ? info.tmuxSocket : undefined,
       pid: typeof info.pid === "number" ? info.pid : undefined,
       startedAt: typeof info.startedAt === "number" ? info.startedAt : undefined,
+      registeredAt: typeof info.registeredAt === "number" ? info.registeredAt : undefined,
     };
   } catch {
     return null;

package/src/spawn/types.ts

@@ -136,6 +136,7 @@ export interface RunnerInfo {
   tmuxSocket?: string;
   pid?: number;
   startedAt?: number;
+  registeredAt?: number;
 }
 
 export interface TerminalAttachSpec {

package/src/workspace-probe/git-state.ts

@@ -64,7 +64,11 @@ export async function populateMergeState(cwd: string, targetRef: string, state:
     } else {
       const cherry = await git(["cherry", cherryBase, targetRef], cwd);
       if (cherry.ok) {
-        state.unmergedAhead = cherry.stdout ? cherry.stdout.split("\n").filter((line) => line.startsWith("+")).length : 0;
+        const unmergedLines = cherry.stdout ? cherry.stdout.split("\n").filter((line) => line.startsWith("+")) : [];
+        state.unmergedAhead = unmergedLines.length;
+        if (unmergedLines.length) {
+          state.unmergedShas = unmergedLines.slice(0, 20).map((line) => line.slice(2).trim().slice(0, 8));
+        }
       }
     }
     if (state.unmergedAhead === 0) state.landed = true;

package/src/workspace-probe/index.ts

@@ -3,6 +3,7 @@ export * from "./deps";
 export * from "./idle-refresh";
 export * from "./git-state";
 export * from "./merge";
+export * from "./plain-git";
 export * from "./names";
 export * from "./parse";
 export * from "./probe";

package/src/workspace-probe/plain-git.ts

@@ -0,0 +1,96 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import type { WorkspaceMergeResult } from "agent-relay-sdk";
+import { git } from "../git";
+import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
+import { refreshWorkspaceDeps } from "./deps";
+import { throwIfMergeAborted } from "./merge-timeouts";
+import { nextBranchName } from "./names";
+import { shortBranch } from "./parse";
+import type { WorkspaceMergeInput } from "./types";
+
+const MAX_PUSH_ATTEMPTS = 3;
+
+function result(input: WorkspaceMergeInput, branch: string | undefined, fields: Partial<WorkspaceMergeResult>): WorkspaceMergeResult {
+  return {
+    workspaceId: input.id,
+    strategy: "rebase-ff",
+    landMechanism: "plain-git",
+    merged: false,
+    status: "review_requested",
+    ...(branch ? { branch } : {}),
+    ...fields,
+  };
+}
+
+function baseBranch(baseRef: string | undefined): string | undefined {
+  if (!baseRef) return undefined;
+  return baseRef.startsWith("refs/heads/") ? baseRef.slice("refs/heads/".length) : baseRef;
+}
+
+/**
+ * The deliberately small, gateless direct executor. It does not touch Relay's
+ * merge lease or integrated-tree gate: each attempt fetches current origin/base,
+ * rebases the worker tip, then atomically pushes HEAD to base. A rejected push
+ * simply repeats that sequence against the new origin tip.
+ */
+export async function mergeWorkspacePlainGit(input: WorkspaceMergeInput): Promise<WorkspaceMergeResult> {
+  if (!input.worktreePath) return result(input, input.branch, { error: "worktreePath required" });
+  const worktreePath = resolve(input.worktreePath);
+  if (!existsSync(worktreePath)) return result(input, input.branch, { status: "cleaned", error: `worktree does not exist: ${worktreePath}` });
+  const signal = input.signal;
+  throwIfMergeAborted(signal);
+  const branch = shortBranch((await git(["symbolic-ref", "--quiet", "--short", "HEAD"], worktreePath, { signal })).stdout || undefined) ?? input.branch;
+  const base = baseBranch(input.baseRef);
+  if (!base) return result(input, branch, { error: "no base branch to push" });
+  const dirty = await git(["status", "--porcelain"], worktreePath, { signal });
+  if (!dirty.ok) return result(input, branch, { error: dirty.stderr || "failed to inspect workspace status" });
+  if (dirty.stdout.trim()) return result(input, branch, { error: "worktree has uncommitted changes" });
+
+  let lastError = "plain-git land failed";
+  for (let attempt = 1; attempt <= MAX_PUSH_ATTEMPTS; attempt += 1) {
+    throwIfMergeAborted(signal);
+    const fetch = await git(["fetch", "origin", base], worktreePath, { signal });
+    if (!fetch.ok) return result(input, branch, { error: fetch.stderr || `git fetch origin ${base} failed` });
+    const rebase = await git(["rebase", `origin/${base}`], worktreePath, { signal });
+    if (!rebase.ok) {
+      await git(["rebase", "--abort"], worktreePath, { signal });
+      return result(input, branch, { conflict: true, status: "conflict", error: rebase.stderr || `git rebase origin/${base} failed` });
+    }
+    const head = await git(["rev-parse", "HEAD"], worktreePath, { signal });
+    if (!head.ok || !head.stdout.trim()) return result(input, branch, { error: head.stderr || "failed to resolve rebased HEAD" });
+    const push = await git(["push", "origin", `HEAD:${base}`], worktreePath, { signal });
+    if (!push.ok) {
+      lastError = push.stderr || push.stdout || `push to origin/${base} rejected`;
+      console.warn(`[orchestrator] plain-git land push rejected workspace=${input.id ?? "(unknown)"} attempt=${attempt}/${MAX_PUSH_ATTEMPTS}; refetching and rebasing`);
+      continue;
+    }
+    const mergedSha = head.stdout.trim();
+    const verifyFetch = await git(["fetch", "origin", base], worktreePath, { signal });
+    const verified = verifyFetch.ok && (await git(["merge-base", "--is-ancestor", mergedSha, `origin/${base}`], worktreePath, { signal })).ok;
+    if (!verified) return result(input, branch, { error: `push reported success but ${mergedSha} is not on origin/${base}` });
+    const subject = (await git(["log", "-1", "--format=%s", mergedSha], worktreePath, { signal })).stdout.trim() || undefined;
+    const repoRoot = input.repoRoot ? resolve(input.repoRoot) : worktreePath;
+    if (input.deleteBranch === false) {
+      if (branch) {
+        const ownerRepo = await owningRepoRoot(worktreePath, repoRoot);
+        const fresh = await nextBranchName(ownerRepo, branch);
+        const checkout = await git(["checkout", "-B", fresh, `origin/${base}`], worktreePath, { signal });
+        if (checkout.ok) {
+          const deleteResult = await deleteBranchIfSafe(ownerRepo, branch, undefined, mergedSha, signal, input.id);
+          const depsRefresh = await refreshWorkspaceDeps(ownerRepo, worktreePath);
+          return result(input, fresh, { merged: true, status: "active", mergedSha, baseSha: mergedSha, subject, pushed: true, worktreeRemoved: false, newBranch: fresh, ...deleteResult, ...(depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error ? { depsRefresh } : {}), error: undefined });
+        }
+      }
+      return result(input, branch, { merged: true, status: "active", mergedSha, baseSha: mergedSha, subject, pushed: true, worktreeRemoved: false, branchDeleted: false, error: undefined });
+    }
+    const ownerRepo = branch ? await owningRepoRoot(worktreePath, repoRoot) : repoRoot;
+    const removed = await git(["worktree", "remove", "--force", worktreePath], ownerRepo, { signal });
+    const worktreeRemoved = removed.ok;
+    const deleteResult = worktreeRemoved && branch
+      ? await deleteBranchIfSafe(ownerRepo, branch, undefined, mergedSha, signal, input.id)
+      : { branchDeleted: false };
+    return result(input, branch, { merged: true, status: "merged", mergedSha, baseSha: mergedSha, subject, pushed: true, worktreeRemoved, ...deleteResult, error: undefined });
+  }
+  return result(input, branch, { error: `plain-git push rejected after ${MAX_PUSH_ATTEMPTS} attempts: ${lastError}` });
+}

package/src/workspace-probe/types.ts

@@ -1,5 +1,5 @@
 import type { WorkspaceMetadata, WorkspaceMode } from "agent-relay-sdk";
-import type { WorkspaceLandGateLevel, WorkspaceMergeResult } from "agent-relay-sdk";
+import type { WorkspaceLandGateLevel, WorkspaceLandMechanism, WorkspaceMergeResult } from "agent-relay-sdk";
 
 /** Attach to or branch off an existing managed worktree instead of creating a fresh one (#635). */
 export interface ResumeWorkspaceTarget {
@@ -47,6 +47,8 @@ export interface WorkspaceMergeInput {
   baseRef?: string;
   baseSha?: string;
   strategy?: "pr" | "rebase-ff" | "auto";
+  /** Direct-land executor selected by Relay. PR/auto remain managed. */
+  landMechanism?: WorkspaceLandMechanism;
   deleteBranch?: boolean;
   /** Push the advanced base to its upstream (origin) after a rebase-ff land.
    * Defaults to true; auto-skipped when base has no upstream. Disable with