agent-relay-orchestrator 0.127.9 → 0.127.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.127.9",
+  "version": "0.127.10",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "agent-relay-providers": "0.104.4",
-    "agent-relay-sdk": "0.2.122",
+    "agent-relay-sdk": "0.2.123",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/control.ts

@@ -433,6 +433,9 @@ export function createControlHandler(
             prTitle: typeof command.params.prTitle === "string" ? command.params.prTitle : undefined,
             prBody: typeof command.params.prBody === "string" ? command.params.prBody : undefined,
             autoMerge: command.params.autoMerge === "on-green" || command.params.autoMerge === "on-approval" || command.params.autoMerge === "manual" ? command.params.autoMerge : undefined,
+            gateLevel: command.params.gateLevel === "subset" || command.params.gateLevel === "none" ? command.params.gateLevel : undefined,
+            gateReason: typeof command.params.gateReason === "string" ? command.params.gateReason : undefined,
+            gateRequestedBy: typeof command.params.gateRequestedBy === "string" ? command.params.gateRequestedBy : undefined,
             prLanded: isRecord(command.params.prLanded)
               ? {
                   sha: typeof command.params.prLanded.sha === "string" ? command.params.prLanded.sha : undefined,

package/src/workspace-probe/integrated-land-gates.ts

@@ -3,16 +3,14 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { errMessage } from "agent-relay-sdk";
 import type { LandGate } from "agent-relay-sdk";
+import type { WorkspaceLandGateLevel } from "agent-relay-sdk";
+import { cleanLandGatesConfig, landGatesTimeoutBudgetMs, loadRepoLandGates } from "agent-relay-sdk/land-gates";
 import { git } from "../git";
 import { runLandGates, type LandGatesResult } from "./land-gates-runner";
 import { mergePhaseTimeoutMs, withMergePhaseTimeout } from "./merge-timeouts";
 
 const LAND_COMMITTER = { name: "Agent Relay", email: "agent-relay@noreply" } as const;
-const FULL_CI_LAND_GATE: LandGate = {
-  name: "ci-land-full",
-  command: "AGENT_RELAY_CI_LAND_FULL=1 bun run ci:land",
-  timeoutMs: 30 * 60 * 1000,
-};
+const LAND_GATES_FILE = ".agent-relay/land-gates.json";
 const DEPENDENCY_LINK_PATHS = [
   "node_modules",
   "dashboard/node_modules",
@@ -48,17 +46,23 @@ export async function synthesizeNoFfMerge(
   return { ok: true, mergeSha: commit.stdout };
 }
 
-async function baseDeclaresCiLand(repoRoot: string, baseSha: string, signal?: AbortSignal): Promise<boolean> {
-  const pkg = await git(["show", `${baseSha}:package.json`], repoRoot, { timeoutMs: mergePhaseTimeoutMs("gates"), timeoutLabel: "workspace merge inspect base package scripts", signal });
-  if (!pkg.ok || !pkg.stdout) return false;
+async function resolveRequiredLandGates(repoRoot: string, baseSha: string, signal?: AbortSignal): Promise<LandGate[]> {
+  const config = await git(["show", `${baseSha}:${LAND_GATES_FILE}`], repoRoot, { timeoutMs: mergePhaseTimeoutMs("gates"), timeoutLabel: "workspace merge inspect base land-gates config", signal });
+  if (!config.ok || !config.stdout) return [];
   try {
-    const parsed = JSON.parse(pkg.stdout) as { scripts?: Record<string, unknown> };
-    return typeof parsed.scripts?.["ci:land"] === "string";
-  } catch {
-    return false;
+    return cleanLandGatesConfig(JSON.parse(config.stdout), repoRoot);
+  } catch (err) {
+    throw new Error(`invalid ${LAND_GATES_FILE} at ${baseSha}: ${errMessage(err)}`);
   }
 }
 
+function requiredGatesForLevel(requiredGates: LandGate[], gateLevel: WorkspaceLandGateLevel): LandGate[] {
+  if (gateLevel === "full") return requiredGates;
+  // subset = candidate-tree repo gates only. The base-required list is omitted;
+  // runLandGates still reads the candidate checkout config below.
+  return [];
+}
+
 function linkDependencyDirs(sourceWorktree: string, gateWorktree: string): void {
   for (const rel of DEPENDENCY_LINK_PATHS) {
     const from = join(sourceWorktree, rel);
@@ -90,11 +94,24 @@ export async function runLandGatesOnIntegratedTree(
   integrationBaseSha: string,
   headSha: string,
   mergeMessage: string,
+  gateLevel: WorkspaceLandGateLevel = "full",
   signal?: AbortSignal,
 ): Promise<{ gates: LandGatesResult } | { abort: { conflict?: boolean; error: string } }> {
-  console.error("[orchestrator] workspace.merge gate-start worktree=" + worktreePath + " behind=" + behind);
+  console.error("[orchestrator] workspace.merge gate-start worktree=" + worktreePath + " behind=" + behind + " level=" + gateLevel);
 
-  const requiredGates: LandGate[] = await baseDeclaresCiLand(repoRoot, integrationBaseSha, signal) ? [FULL_CI_LAND_GATE] : [];
+  if (gateLevel === "none") {
+    console.error("[orchestrator] workspace.merge gate-skip level=none worktree=" + worktreePath);
+    return { gates: { ran: 0, warnings: [] } };
+  }
+
+  let baseRequiredGates: LandGate[];
+  try {
+    baseRequiredGates = await resolveRequiredLandGates(repoRoot, integrationBaseSha, signal);
+  } catch (err) {
+    return { abort: { error: errMessage(err) } };
+  }
+  const requiredGates = requiredGatesForLevel(baseRequiredGates, gateLevel);
+  const loadCandidateRepoGates = gateLevel === "subset";
   let gateRef = headSha;
   if (behind > 0) {
     let synth: Awaited<ReturnType<typeof synthesizeNoFfMerge>>;
@@ -135,7 +152,22 @@ export async function runLandGatesOnIntegratedTree(
 
   try {
     linkDependencyDirs(worktreePath, tmpWorktree);
-    return { gates: await withMergePhaseTimeout("gates", () => runLandGates(tmpWorktree, requiredGates), { signal }) };
+    let candidateRepoGates: LandGate[] | undefined;
+    if (loadCandidateRepoGates) {
+      try {
+        candidateRepoGates = loadRepoLandGates(tmpWorktree);
+      } catch {
+        candidateRepoGates = undefined;
+      }
+    }
+    const gateTimeoutBudgetMs = landGatesTimeoutBudgetMs([...requiredGates, ...(candidateRepoGates ?? [])]);
+    return {
+      gates: await withMergePhaseTimeout(
+        "gates",
+        () => runLandGates(tmpWorktree, requiredGates, { loadRepoGates: loadCandidateRepoGates, repoGates: candidateRepoGates }),
+        { signal, minimumMs: gateTimeoutBudgetMs },
+      ),
+    };
   } finally {
     try {
       await withMergePhaseTimeout(

package/src/workspace-probe/land-gates-runner.ts

@@ -1,7 +1,7 @@
 import { resolve } from "node:path";
 import { errMessage } from "agent-relay-sdk";
 import type { LandGate, LandGateRunResult } from "agent-relay-sdk";
-import { loadRepoLandGates } from "agent-relay-sdk/land-gates";
+import { DEFAULT_LAND_GATE_TIMEOUT_MS, loadRepoLandGates } from "agent-relay-sdk/land-gates";
 
 // #902/#1199 — execute mandatory boundary gates and any repo-configured land gates
 // against the candidate merged tree BEFORE the ref advance in `mergeRebaseFf`.
@@ -10,7 +10,7 @@ import { loadRepoLandGates } from "agent-relay-sdk/land-gates";
 /** Per-gate default timeout when the gate didn't declare `timeoutMs`. Keep the
  *  ceiling generous but bounded so a hung gate can't wedge the per-repo merge
  *  lease forever. Full-suite boundary gates should declare their own timeout. */
-const DEFAULT_GATE_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_GATE_TIMEOUT_MS = DEFAULT_LAND_GATE_TIMEOUT_MS;
 const TIMEOUT_KILL_GRACE_MS = 1_000;
 const OUTPUT_CANCEL_GRACE_MS = 50;
 /** Cap on the full output streamed to the relay artifact (the notification only ever
@@ -187,8 +187,8 @@ export interface LandGatesResult {
 }
 
 /**
- * Load + run required boundary gates plus the repo's configured land gates against `worktreePath`.
- * Returns `ran: 0` with no failure/warnings only when neither the boundary nor the repo
+ * Run required boundary gates plus, when requested, repo-configured land gates against
+ * `worktreePath`. Returns `ran: 0` with no failure/warnings only when neither set
  * declares gates. Stops at the first failing REQUIRED gate (it blocks the land);
  * optional failures accumulate as warnings and never block.
  *
@@ -196,11 +196,12 @@ export interface LandGatesResult {
  * (surfaced as a synthetic required gate) rather than an unhandled throw that would
  * crash the merge command — the worker fixes the config and re-lands.
  */
-export async function runLandGates(worktreePath: string, requiredGates: LandGate[] = []): Promise<LandGatesResult> {
+export async function runLandGates(worktreePath: string, requiredGates: LandGate[] = [], options: { loadRepoGates?: boolean; repoGates?: LandGate[] } = {}): Promise<LandGatesResult> {
   const warnings: LandGateRunResult[] = [];
   let gates: LandGate[];
   try {
-    gates = [...requiredGates, ...loadRepoLandGates(worktreePath)];
+    const repoGates = options.repoGates ?? (options.loadRepoGates === false ? [] : loadRepoLandGates(worktreePath));
+    gates = [...requiredGates, ...repoGates];
   } catch (err) {
     const output = `invalid .agent-relay/land-gates.json: ${errMessage(err)}`;
     return {

package/src/workspace-probe/merge-timeouts.ts

@@ -19,11 +19,12 @@ function positiveEnvMs(name: string): number | undefined {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
 }
 
-export function mergePhaseTimeoutMs(phase: MergePhase): number {
+export function mergePhaseTimeoutMs(phase: MergePhase, minimumMs = 0): number {
   const key = `AGENT_RELAY_WORKSPACE_MERGE_${phase.toUpperCase().replace(/-/g, "_")}_TIMEOUT_MS`;
-  return positiveEnvMs(key)
+  const configured = positiveEnvMs(key)
     ?? positiveEnvMs("AGENT_RELAY_WORKSPACE_MERGE_PHASE_TIMEOUT_MS")
     ?? MERGE_PHASE_TIMEOUTS_MS[phase];
+  return Math.max(configured, minimumMs);
 }
 
 function abortError(signal: AbortSignal): Error {
@@ -40,9 +41,9 @@ export function throwIfMergeAborted(signal?: AbortSignal): void {
 export async function withMergePhaseTimeout<T>(
   phase: MergePhase,
   run: (signal: AbortSignal) => Promise<T>,
-  options: { signal?: AbortSignal } = {},
+  options: { signal?: AbortSignal; minimumMs?: number } = {},
 ): Promise<T> {
-  const timeoutMs = mergePhaseTimeoutMs(phase);
+  const timeoutMs = mergePhaseTimeoutMs(phase, options.minimumMs);
   const controller = new AbortController();
   let timeout: ReturnType<typeof setTimeout> | undefined;
   const abortFromParent = () => controller.abort(abortError(options.signal!));

package/src/workspace-probe/merge.ts

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { errMessage, type BaseWorktreeSyncResult, type WorkspaceMergePreview, type WorkspaceMergeResult } from "agent-relay-sdk";
+import { errMessage, type BaseWorktreeSyncResult, type WorkspaceLandGateLevel, type WorkspaceMergePreview, type WorkspaceMergeResult } from "agent-relay-sdk";
 import { git, gitRaw } from "../git";
 import { execProcess } from "../process";
 import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
@@ -825,6 +825,7 @@ async function mergeRebaseFf(
   signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
   throwIfMergeAborted(signal);
+  const gateLevel: WorkspaceLandGateLevel = input.gateLevel === "subset" || input.gateLevel === "none" ? input.gateLevel : "full";
   const base = preview.baseRef;
   if (!base) return head({ status: "review_requested", error: "no base branch to merge into" });
   if (!branch) return head({ status: "review_requested", error: "cannot determine agent branch" });
@@ -833,16 +834,11 @@ async function mergeRebaseFf(
   // upstream (e.g. main -> origin/main) and we'll push, fetch it and check whether
   // origin has moved ahead of local base.
   //
-  // Origin-ahead is the COMMON case under concurrency (#638): a sibling lane lands
-  // and advances origin/<base> while this lane still sits on a stale local base.
-  // Refusing here floods the steward on every normal multi-lane batch. Instead:
-  //   - If local base carries nothing origin lacks (it's a strict ancestor of the
-  //     fetched upstream), fast-forward local base to the upstream and land onto the
-  //     FRESH origin (the no-ff merge below ties the branch onto the advanced base).
-  //     This is a clean recovery — no steward escalation.
-  //   - Refuse ONLY on genuine divergence: local base has commits not on origin, so
-  //     a sync would rewrite/discard published-or-local history. A real failure must
-  //     still set `error` so the relay's no-progress backoff (#638) can engage.
+  // Origin-ahead is common under concurrency: a sibling lane lands and advances
+  // origin/<base> while this lane still sits on a stale local base. Direct land
+  // must not silently synthesize a no-ff merge or PR fallback in that upstream-stale
+  // state (#1184). Local-only base advancement still uses the existing no-ff path:
+  // land gates, timeout cancellation, and abort recovery all exercise that machinery.
   // Tracks whether the DIRTY base checkout caught up to the advanced HEAD across BOTH heal
   // points (the upstream sync below and the final land). A mixed state from either is surfaced
   // loudly rather than swallowed as a log warning (#824).
@@ -855,8 +851,8 @@ async function mergeRebaseFf(
 
   // SHA preservation (#287): never rebase the agent branch — rewriting its commits
   // gives them new SHAs and breaks traceability (the branch.landed SHA must exist on
-  // base verbatim). headSha is the preserved landed commit; when base has advanced we
-  // tie the branch in with a no-ff merge so the agent's commits keep their identity.
+  // base verbatim). headSha is the preserved landed commit; local no-ff lands tie the
+  // branch in with a merge commit so the agent's commits keep their identity.
   const headResult = await mergeGit(["rev-parse", "HEAD"], worktreePath, "rebase", "workspace merge resolve workspace HEAD before gates", signal);
   const headSha = headResult.stdout;
   if (!headResult.ok || !headSha) return head({ status: "review_requested", error: gitError(headResult, "failed to resolve workspace HEAD before gates") });
@@ -865,8 +861,7 @@ async function mergeRebaseFf(
   const landedSubject = (await mergeGit(["log", "-1", "--format=%s", headSha], worktreePath, "rebase", "workspace merge read landed commit subject", signal)).stdout || undefined;
 
   // Resolve the SHA the work will integrate onto WITHOUT moving the ref. Origin-ahead is
-  // the common concurrent case (#638): we still fetch fresh origin to compute the real merge,
-  // but defer the local-base sync until the final base-ref mutation block below.
+  // the #1184 fail-fast case; local-base no-ff is left to the existing gate/ref machinery.
   const integrationBaseResult = await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve integration base ${base}`, signal);
   let integrationBaseSha = integrationBaseResult.stdout;
   if (!integrationBaseResult.ok || !integrationBaseSha) return head({ status: "review_requested", error: gitError(integrationBaseResult, `failed to resolve integration base ${base}`) });
@@ -883,25 +878,46 @@ async function mergeRebaseFf(
       return head({ status: "review_requested", error: errMessage(err) });
     }
     if (!(await mergeGit(["merge-base", "--is-ancestor", upstream, base], worktreePath, "rebase", `workspace merge compare ${upstream} to ${base}`, signal)).ok) {
-      // Origin moved ahead. Sync-then-land iff local base is cleanly behind (ancestor
-      // of upstream); otherwise it's genuine divergence — refuse without mutating.
+      // Origin moved ahead. If local base is not cleanly behind, it's genuine divergence
+      // and we refuse without mutating. If it is cleanly behind, compute against upstream;
+      // the behind check below decides whether direct land can still fast-forward.
       if (!(await mergeGit(["merge-base", "--is-ancestor", base, upstream], worktreePath, "rebase", `workspace merge compare ${base} to ${upstream}`, signal)).ok) {
         return head({ status: "review_requested", error: `local ${base} has diverged from ${upstream} (commits not on origin); sync before landing` });
       }
       const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} for integration`, signal)).stdout;
       if (!upstreamSha) return head({ status: "review_requested", error: `cannot resolve ${upstream} to sync ${base}` });
-      // Integrate onto fresh origin (the tree that will land), but DON'T advance local base yet.
+      // Consider fresh origin the integration base, but DON'T advance local base yet.
       integrationBaseSha = upstreamSha;
       needSync = true;
     }
   }
 
-  // Behind relative to the TRUE integration base (origin-ahead ⟹ behind>0 ⟹ a real no-ff merge).
+  // Behind relative to fresh upstream means direct land is not a fast-forward of the
+  // instance's true integration base. Fail before gates/ref mutation so callers see
+  // the reason and can rebase or choose PR explicitly. Local-only behind remains the
+  // pre-existing no-ff path to preserve gate, timeout, and abort-recovery behavior.
   const behindResult = await countBehind(worktreePath, integrationBaseSha, signal);
   if ("error" in behindResult) return head({ status: "review_requested", error: behindResult.error });
   const behind = behindResult.behind;
+  if (behind > 0 && needSync) {
+    const branchName = branch ?? "workspace branch";
+    const baseName = base ?? "base";
+    const advanced = integrationBaseSha ? ` (base advanced to ${integrationBaseSha.slice(0, 12)})` : "";
+    return head({
+      status: "review_requested",
+      error: `cannot direct-land: ${branchName} is not a fast-forward of ${baseName}${advanced}; rebase and retry, or land with --strategy pr`,
+    });
+  }
 
-  const gateRun = await runLandGatesOnIntegratedTree(repoRoot, worktreePath, behind, integrationBaseSha, headSha, landMergeMessage(branch, landedSubject), signal);
+  const gateSkippedField = gateLevel !== "full" ? {
+    gateSkipped: {
+      level: gateLevel,
+      reason: input.gateReason ?? "",
+      by: input.gateRequestedBy ?? "unknown",
+      commit: headSha,
+    },
+  } : {};
+  const gateRun = await runLandGatesOnIntegratedTree(repoRoot, worktreePath, behind, integrationBaseSha, headSha, landMergeMessage(branch, landedSubject), gateLevel, signal);
   throwIfMergeAborted(signal);
   if ("abort" in gateRun) {
     return gateRun.abort.conflict
@@ -1062,14 +1078,14 @@ async function mergeRebaseFf(
       const depsRefresh = await refreshWorkspaceDeps(ownerRepo, worktreePath);
       throwIfMergeAborted(signal);
       const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
-      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, pushed, ...(reportDeps ? { depsRefresh } : {}), ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
+      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, pushed, ...(reportDeps ? { depsRefresh } : {}), ...baseWorktreeSyncField, ...gateWarningsField, ...gateSkippedField, error: undefined });
     }
     // Recycle failed — keep the existing branch. Still landed, still active.
-    return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
+    return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, ...baseWorktreeSyncField, ...gateWarningsField, ...gateSkippedField, error: undefined });
   }
   throwIfMergeAborted(signal);
   const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], ownerRepo, "cleanup", "workspace merge remove landed worktree", signal);
   const worktreeRemoved = removed.ok;
   const deleteResult = worktreeRemoved ? await deleteBranchIfSafe(ownerRepo, branch, undefined, baseTip, signal, input.id) : { branchDeleted: false };
-  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, ...deleteResult, pushed, ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
+  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, ...deleteResult, pushed, ...baseWorktreeSyncField, ...gateWarningsField, ...gateSkippedField, error: undefined });
 }

package/src/workspace-probe/types.ts

@@ -1,5 +1,5 @@
 import type { WorkspaceMetadata, WorkspaceMode } from "agent-relay-sdk";
-import type { WorkspaceMergeResult } from "agent-relay-sdk";
+import type { WorkspaceLandGateLevel, WorkspaceMergeResult } from "agent-relay-sdk";
 
 /** Attach to or branch off an existing managed worktree instead of creating a fresh one (#635). */
 export interface ResumeWorkspaceTarget {
@@ -59,6 +59,11 @@ export interface WorkspaceMergeInput {
    *  - "on-approval": open PR, do NOT arm; reviewer pipeline arms it later.
    *  - "manual": open PR, do NOT arm (today's legacy behavior). */
   autoMerge?: "on-green" | "on-approval" | "manual";
+  /** Land-gate level. Omitted/"full" runs the base-declared required gates. */
+  gateLevel?: WorkspaceLandGateLevel;
+  /** Required by Relay before subset/none reaches the host; carried for audit output. */
+  gateReason?: string;
+  gateRequestedBy?: string;
   /**
    * Set when the relay observed this branch's PR already merged on the remote and is
    * dispatching a land-and-continue RECYCLE (#423). Carries the relay's ground truth (the