agent-relay-orchestrator 0.127.7 → 0.127.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.127.7",
+  "version": "0.127.9",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.121",
+    "agent-relay-sdk": "0.2.122",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/spawn/command.ts

@@ -1,4 +1,5 @@
 import { existsSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { artifactProxyBaseUrl } from "../artifact-proxy";
@@ -14,10 +15,40 @@ export function isWithinBaseDir(path: string, baseDir: string): boolean {
   return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
 }
 
+// Linux sockaddr_un.sun_path is 108 bytes including the trailing NUL. With the
+// default tmux socket dir `/tmp/tmux-<uid>/` and `agent-relay-` socket prefix,
+// an 80-byte session name keeps the full path under 108 bytes on normal hosts.
+export const TMUX_SESSION_NAME_MAX_BYTES = 80;
+
+function shortHash(value: string): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, 8);
+}
+
+function boundedSlug(value: string, maxBytes: number): string {
+  const clean = sanitizeFsName(value, { replacement: "-", collapseReplacement: true, trimEdge: true, lowercase: true, fallback: "agent" });
+  if (Buffer.byteLength(clean) <= maxBytes) return clean;
+  const suffix = `-${shortHash(clean)}`;
+  const headBytes = maxBytes - suffix.length;
+  if (headBytes <= 0) return shortHash(clean).slice(0, Math.max(1, maxBytes));
+  return `${clean.slice(0, headBytes).replace(/-+$/g, "")}${suffix}`;
+}
+
+export function sessionLabelForSpawn(opts: Pick<SpawnOptions, "label" | "taskId"> & { label: string }): string {
+  if (opts.taskId === undefined) return opts.label;
+  const base = `task-${opts.taskId}`;
+  const label = opts.label.trim();
+  if (!label || label.toLowerCase() === base || label.toLowerCase().startsWith(`${base}:`)) return base;
+  return `${base}-${label}`;
+}
+
 export function sessionName(config: OrchestratorConfig, provider: string, label: string, uniqueId?: string): string {
-  const clean = sanitizeFsName(label, { replacement: "-", lowercase: true });
   const suffix = uniqueId ? `-${sanitizeFsName(uniqueId, { replacement: "-", lowercase: true }).slice(-8)}` : "";
-  return `${config.tmuxPrefix}-${provider}-${clean}${suffix}`;
+  const prefix = `${config.tmuxPrefix}-${provider}-`;
+  const labelBudget = TMUX_SESSION_NAME_MAX_BYTES - Buffer.byteLength(prefix) - Buffer.byteLength(suffix);
+  if (labelBudget < 8) {
+    throw new Error("derived name too long for tmux socket; pass a short `label`");
+  }
+  return `${prefix}${boundedSlug(label, labelBudget)}${suffix}`;
 }
 
 export function defaultSpawnLabel(now = Date.now()): string {

package/src/spawn/spawn-agent.ts

@@ -3,7 +3,7 @@ import type { OrchestratorConfig } from "../config";
 import { resolveSpawnWorkspace, workspacesRoot } from "../workspace-probe";
 import type { ManagedAgentReport } from "../relay";
 import { applyProjectAcquisitionManifest } from "./acquisition";
-import { buildEnv, buildRunnerCommand, defaultSpawnLabel, isWithinBaseDir, sessionName } from "./command";
+import { buildEnv, buildRunnerCommand, defaultSpawnLabel, isWithinBaseDir, sessionLabelForSpawn, sessionName } from "./command";
 import { addSessionRecord, currentSessionPid, findSessionRecord, ensureLogDir, ensureRunnerInfoDir, logFilePath, runnerInfoPath, sessionRecordLiveness, sessionReportFields } from "./runtime";
 import { managedAgentId } from "./sessions";
 import { spawnRunner } from "./supervisor";
@@ -47,7 +47,7 @@ export async function spawnAgent(
   const d = { ...defaultSpawnAgentDeps, ...deps };
   const label = opts.label || defaultSpawnLabel();
   const agentId = opts.agentId || managedAgentId(config, opts.provider, label);
-  const name = sessionName(config, opts.provider, label, opts.spawnRequestId ?? agentId);
+  const name = sessionName(config, opts.provider, sessionLabelForSpawn({ ...opts, label }), opts.spawnRequestId ?? agentId);
 
   if (!isWithinBaseDir(opts.cwd, config.baseDir)) {
     throw new Error(`cwd must be within base directory: ${config.baseDir}`);

package/src/workspace-probe/integrated-land-gates.ts

@@ -0,0 +1,155 @@
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, realpathSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { errMessage } from "agent-relay-sdk";
+import type { LandGate } from "agent-relay-sdk";
+import { git } from "../git";
+import { runLandGates, type LandGatesResult } from "./land-gates-runner";
+import { mergePhaseTimeoutMs, withMergePhaseTimeout } from "./merge-timeouts";
+
+const LAND_COMMITTER = { name: "Agent Relay", email: "agent-relay@noreply" } as const;
+const FULL_CI_LAND_GATE: LandGate = {
+  name: "ci-land-full",
+  command: "AGENT_RELAY_CI_LAND_FULL=1 bun run ci:land",
+  timeoutMs: 30 * 60 * 1000,
+};
+const DEPENDENCY_LINK_PATHS = [
+  "node_modules",
+  "dashboard/node_modules",
+  "sdk/node_modules",
+  "runner/node_modules",
+  "orchestrator/node_modules",
+  "codex/node_modules",
+  "claude/node_modules",
+  "client/node_modules",
+] as const;
+
+// Synthesize, but do not advance any ref to, the no-ff merge commit of branchSha
+// into baseSha. The resulting commit/tree is the exact integrated tree that will
+// land, so callers can gate it before mutating base.
+export async function synthesizeNoFfMerge(
+  repoRoot: string,
+  baseSha: string,
+  branchSha: string,
+  message: string,
+  timeoutMs?: number,
+  signal?: AbortSignal,
+): Promise<{ ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string }> {
+  const tree = await git(["merge-tree", "--write-tree", baseSha, branchSha], repoRoot, { timeoutMs, timeoutLabel: "workspace merge synthesize merge-tree", signal });
+  if (!tree.ok) return { ok: false, conflict: true, error: tree.stdout || tree.stderr || "merge conflict computing tree" };
+  const treeOid = tree.stdout.split("\n")[0]?.trim();
+  if (!treeOid) return { ok: false, error: "merge-tree produced no tree oid" };
+  const commit = await git(
+    ["-c", "user.name=" + LAND_COMMITTER.name, "-c", "user.email=" + LAND_COMMITTER.email, "commit-tree", treeOid, "-p", baseSha, "-p", branchSha, "-m", message],
+    repoRoot,
+    { timeoutMs, timeoutLabel: "workspace merge synthesize commit-tree", signal },
+  );
+  if (!commit.ok || !commit.stdout) return { ok: false, error: commit.stderr || "commit-tree failed" };
+  return { ok: true, mergeSha: commit.stdout };
+}
+
+async function baseDeclaresCiLand(repoRoot: string, baseSha: string, signal?: AbortSignal): Promise<boolean> {
+  const pkg = await git(["show", `${baseSha}:package.json`], repoRoot, { timeoutMs: mergePhaseTimeoutMs("gates"), timeoutLabel: "workspace merge inspect base package scripts", signal });
+  if (!pkg.ok || !pkg.stdout) return false;
+  try {
+    const parsed = JSON.parse(pkg.stdout) as { scripts?: Record<string, unknown> };
+    return typeof parsed.scripts?.["ci:land"] === "string";
+  } catch {
+    return false;
+  }
+}
+
+function linkDependencyDirs(sourceWorktree: string, gateWorktree: string): void {
+  for (const rel of DEPENDENCY_LINK_PATHS) {
+    const from = join(sourceWorktree, rel);
+    const to = join(gateWorktree, rel);
+    if (!existsSync(from) || existsSync(to)) continue;
+    try {
+      const stat = lstatSync(from);
+      if (!stat.isDirectory() && !stat.isSymbolicLink()) continue;
+      mkdirSync(join(to, ".."), { recursive: true });
+      symlinkSync(realpathSync(from), to, "dir");
+    } catch (err) {
+      console.error(`[orchestrator] land-gate dependency link skipped ${rel}: ${errMessage(err)}`);
+    }
+  }
+}
+
+/**
+ * Run land gates against the exact tree that would land.
+ *
+ * Always materializes that tree in a detached checkout. Even a fast-forwardable
+ * branch is gated outside the worker worktree so worker-only topology, untracked
+ * files, and symlink layout cannot make the boundary check pass differently than
+ * the tree that will advance the base ref.
+ */
+export async function runLandGatesOnIntegratedTree(
+  repoRoot: string,
+  worktreePath: string,
+  behind: number,
+  integrationBaseSha: string,
+  headSha: string,
+  mergeMessage: string,
+  signal?: AbortSignal,
+): Promise<{ gates: LandGatesResult } | { abort: { conflict?: boolean; error: string } }> {
+  console.error("[orchestrator] workspace.merge gate-start worktree=" + worktreePath + " behind=" + behind);
+
+  const requiredGates: LandGate[] = await baseDeclaresCiLand(repoRoot, integrationBaseSha, signal) ? [FULL_CI_LAND_GATE] : [];
+  let gateRef = headSha;
+  if (behind > 0) {
+    let synth: Awaited<ReturnType<typeof synthesizeNoFfMerge>>;
+    try {
+      synth = await withMergePhaseTimeout(
+        "synthesize",
+        (phaseSignal) => synthesizeNoFfMerge(repoRoot, integrationBaseSha, headSha, mergeMessage, mergePhaseTimeoutMs("synthesize"), phaseSignal),
+        { signal },
+      );
+    } catch (err) {
+      return { abort: { error: errMessage(err) } };
+    }
+    if (!synth.ok) return { abort: { conflict: synth.conflict, error: synth.error } };
+    gateRef = synth.mergeSha;
+  }
+
+  const tmpParent = mkdtempSync(join(tmpdir(), "agent-relay-landgate-"));
+  const tmpWorktree = join(tmpParent, "checkout");
+  let add: Awaited<ReturnType<typeof git>>;
+  try {
+    add = await withMergePhaseTimeout(
+      "worktree-add",
+      (phaseSignal) => git(
+        ["worktree", "add", "--detach", tmpWorktree, gateRef],
+        repoRoot,
+        { timeoutMs: mergePhaseTimeoutMs("worktree-add"), timeoutLabel: "workspace merge land-gate worktree add", signal: phaseSignal },
+      ),
+      { signal },
+    );
+  } catch (err) {
+    rmSync(tmpParent, { recursive: true, force: true });
+    return { abort: { error: errMessage(err) } };
+  }
+  if (!add.ok) {
+    rmSync(tmpParent, { recursive: true, force: true });
+    return { abort: { error: add.stderr || "failed to materialize integrated tree for land gates" } };
+  }
+
+  try {
+    linkDependencyDirs(worktreePath, tmpWorktree);
+    return { gates: await withMergePhaseTimeout("gates", () => runLandGates(tmpWorktree, requiredGates), { signal }) };
+  } finally {
+    try {
+      await withMergePhaseTimeout(
+        "cleanup",
+        (phaseSignal) => git(
+          ["worktree", "remove", "--force", tmpWorktree],
+          repoRoot,
+          { timeoutMs: mergePhaseTimeoutMs("cleanup"), timeoutLabel: "workspace merge land-gate worktree cleanup", signal: phaseSignal },
+        ),
+        { signal },
+      );
+    } catch (err) {
+      console.error("[orchestrator] land-gate integrated worktree cleanup timed out/failed: " + errMessage(err));
+    }
+    rmSync(tmpParent, { recursive: true, force: true });
+  }
+}

package/src/workspace-probe/land-gates-runner.ts

@@ -3,15 +3,13 @@ import { errMessage } from "agent-relay-sdk";
 import type { LandGate, LandGateRunResult } from "agent-relay-sdk";
 import { loadRepoLandGates } from "agent-relay-sdk/land-gates";
 
-// #902 — execute a repo's configured land gates against the candidate merged tree
-// inside the landing worktree, BEFORE the ref advance in `mergeRebaseFf`. A repo
-// with no `.agent-relay/land-gates.json` loads zero gates, so the caller takes the
-// exact unchanged land path (ironclad opt-in / zero regression). A required gate
-// failing blocks the land (ref NOT advanced); optional gates only warn.
-
-/** Per-gate default timeout when the gate didn't declare `timeoutMs`. Land gates
- *  are meant to be a FAST high-signal subset, not the full suite — keep the ceiling
- *  generous but bounded so a hung gate can't wedge the per-repo merge lease forever. */
+// #902/#1199 — execute mandatory boundary gates and any repo-configured land gates
+// against the candidate merged tree BEFORE the ref advance in `mergeRebaseFf`.
+// A required gate failing blocks the land (ref NOT advanced); optional gates only warn.
+
+/** Per-gate default timeout when the gate didn't declare `timeoutMs`. Keep the
+ *  ceiling generous but bounded so a hung gate can't wedge the per-repo merge
+ *  lease forever. Full-suite boundary gates should declare their own timeout. */
 const DEFAULT_GATE_TIMEOUT_MS = 5 * 60 * 1000;
 const TIMEOUT_KILL_GRACE_MS = 1_000;
 const OUTPUT_CANCEL_GRACE_MS = 50;
@@ -189,21 +187,20 @@ export interface LandGatesResult {
 }
 
 /**
- * Load + run the repo's configured land gates against `worktreePath`. Returns
- * `ran: 0` with no failure/warnings when the repo declares no gates — the load is the
- * ONLY thing that runs in that case (a missing file → empty list, no subprocess), so
- * the opt-in is byte-clean. Stops at the first failing REQUIRED gate (it blocks the
- * land); optional failures accumulate as warnings and never block.
+ * Load + run required boundary gates plus the repo's configured land gates against `worktreePath`.
+ * Returns `ran: 0` with no failure/warnings only when neither the boundary nor the repo
+ * declares gates. Stops at the first failing REQUIRED gate (it blocks the land);
+ * optional failures accumulate as warnings and never block.
  *
  * A PRESENT-but-malformed `.agent-relay/land-gates.json` is itself a blocking failure
  * (surfaced as a synthetic required gate) rather than an unhandled throw that would
  * crash the merge command — the worker fixes the config and re-lands.
  */
-export async function runLandGates(worktreePath: string): Promise<LandGatesResult> {
+export async function runLandGates(worktreePath: string, requiredGates: LandGate[] = []): Promise<LandGatesResult> {
   const warnings: LandGateRunResult[] = [];
   let gates: LandGate[];
   try {
-    gates = loadRepoLandGates(worktreePath);
+    gates = [...requiredGates, ...loadRepoLandGates(worktreePath)];
   } catch (err) {
     const output = `invalid .agent-relay/land-gates.json: ${errMessage(err)}`;
     return {

package/src/workspace-probe/merge-timeouts.ts

@@ -1,12 +1,12 @@
 export type MergePhase = "total" | "prep" | "preview" | "fetch" | "rebase" | "gates" | "synthesize" | "worktree-add" | "cleanup";
 
 const MERGE_PHASE_TIMEOUTS_MS: Record<MergePhase, number> = {
-  total: 10 * 60_000,
+  total: 40 * 60_000,
   prep: 60_000,
   preview: 30_000,
   fetch: 60_000,
   rebase: 60_000,
-  gates: 5 * 60_000,
+  gates: 35 * 60_000,
   synthesize: 60_000,
   "worktree-add": 60_000,
   cleanup: 30_000,

package/src/workspace-probe/merge.ts

@@ -5,8 +5,8 @@ import { git, gitRaw } from "../git";
 import { execProcess } from "../process";
 import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
 import { refreshWorkspaceDeps } from "./deps";
-import { type LandGatesResult } from "./land-gates-runner";
 import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, upstreamRef, workspaceGitState } from "./git-state";
+import { runLandGatesOnIntegratedTree, synthesizeNoFfMerge } from "./integrated-land-gates";
 import { type MergePhase, mergePhaseTimeoutMs, throwIfMergeAborted, withMergePhaseTimeout } from "./merge-timeouts";
 import { nextBranchName } from "./names";
 import { parseWorktrees, shortBranch } from "./parse";
@@ -628,29 +628,6 @@ function landMergeMessage(branch: string | undefined, subject: string | undefine
 // with plumbing: compute the merged tree, commit it with both parents (base first, so
 // `--first-parent` still reads as base's mainline), then advance the ref with a CAS on
 // the old value. Preserves the branch's commit SHAs without a working tree.
-// Synthesize (but do NOT advance any ref to) the no-ff merge commit of `branchSha` into
-// `baseSha`: compute the merged tree with `merge-tree`, then commit it with both parents
-// (base first, so `--first-parent` reads as base's mainline). This is the exact commit/tree
-// that will become base's new tip — used both to gate the TRUE integrated tree before any ref
-// moves (#902/#903) and, via {@link recordNoFfMerge}, to advance base when no working tree is
-// available. Pure object creation: no ref is touched, so a caller can throw it away freely.
-async function synthesizeNoFfMerge(
-  repoRoot: string, baseSha: string, branchSha: string, message: string,
-  timeoutMs?: number, signal?: AbortSignal,
-): Promise<{ ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string }> {
-  const tree = await git(["merge-tree", "--write-tree", baseSha, branchSha], repoRoot, { timeoutMs, timeoutLabel: "workspace merge synthesize merge-tree", signal });
-  if (!tree.ok) return { ok: false, conflict: true, error: tree.stdout || tree.stderr || "merge conflict computing tree" };
-  const treeOid = tree.stdout.split("\n")[0]?.trim();
-  if (!treeOid) return { ok: false, error: "merge-tree produced no tree oid" };
-  const commit = await git(
-    ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "commit-tree", treeOid, "-p", baseSha, "-p", branchSha, "-m", message],
-    repoRoot,
-    { timeoutMs, timeoutLabel: "workspace merge synthesize commit-tree", signal },
-  );
-  if (!commit.ok || !commit.stdout) return { ok: false, error: commit.stderr || "commit-tree failed" };
-  return { ok: true, mergeSha: commit.stdout };
-}
-
 async function recordNoFfMerge(
   repoRoot: string, base: string, baseSha: string, branchSha: string, message: string, signal?: AbortSignal,
 ): Promise<{ ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string }> {
@@ -661,33 +638,6 @@ async function recordNoFfMerge(
   return { ok: true, mergeSha: synth.mergeSha };
 }
 
-function decommissionedLandGatesResult(): LandGatesResult {
-  return { ran: 0, warnings: [] };
-}
-
-/**
- * Land gates are decommissioned (#923). Release-time gates in `release.ts` are the
- * quality boundary; workspace landing must never launch repo-configured gate subprocesses.
- * Keep this function as the single merge-path kill switch so populated
- * `.agent-relay/land-gates.json` files are treated as always-empty without changing the
- * rest of the rebase/fetch/no-ff landing flow.
- */
-async function runLandGatesOnIntegratedTree(
-  repoRoot: string,
-  worktreePath: string,
-  behind: number,
-  integrationBaseSha: string,
-  headSha: string,
-  mergeMessage: string,
-): Promise<{ gates: LandGatesResult } | { abort: { conflict?: boolean; error: string } }> {
-  void repoRoot;
-  void integrationBaseSha;
-  void headSha;
-  void mergeMessage;
-  console.error(`[orchestrator] workspace.merge gate-skip worktree=${worktreePath} behind=${behind} reason=land-gates-decommissioned`);
-  return { gates: decommissionedLandGatesResult() };
-}
-
 /**
  * Fast-forward the local `base` ref to its fetched `upstream` tip (#638 concurrent-lane
  * recovery). The caller has verified base is a strict ancestor of upstream — a clean ff,
@@ -951,11 +901,7 @@ async function mergeRebaseFf(
   if ("error" in behindResult) return head({ status: "review_requested", error: behindResult.error });
   const behind = behindResult.behind;
 
-  // #923 — land gates are decommissioned. This call is now a hard kill switch that always
-  // returns an empty gate set, even when `.agent-relay/land-gates.json` is populated. Keep it
-  // before base-ref mutation so the rest of the historical land ordering stays intact, but no
-  // gate subprocess or detached gate worktree can be launched at land time.
-  const gateRun = await runLandGatesOnIntegratedTree(repoRoot, worktreePath, behind, integrationBaseSha, headSha, landMergeMessage(branch, landedSubject));
+  const gateRun = await runLandGatesOnIntegratedTree(repoRoot, worktreePath, behind, integrationBaseSha, headSha, landMergeMessage(branch, landedSubject), signal);
   throwIfMergeAborted(signal);
   if ("abort" in gateRun) {
     return gateRun.abort.conflict