agent-relay-orchestrator 0.29.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -16,7 +16,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "agent-relay-sdk": "0.2.18"
+    "agent-relay-sdk": "0.2.19"
   },
   "devDependencies": {
     "@types/bun": "latest",

package/src/terminal-stream.ts

@@ -144,12 +144,28 @@ export function decodeControlOutput(data: string): Uint8Array {
   return Uint8Array.from(out);
 }
 
-// The control stream is read as latin1 so the `%output` octal path above sees faithful
-// bytes. But command-reply blocks (capture-pane grid rows) arrive as raw UTF-8, so their
-// lines reach us as the byte-faithful latin1 representation. Re-decode them to real UTF-8
-// here, or multi-byte glyphs (box-drawing, powerline) double-encode on the next repaint
-// and render as mojibake (#270). Safe to do per line: no UTF-8 continuation byte is
-// 0x0A/0x0D, so the newline split never lands mid-sequence.
+// Byte-faithful single-byte decode (true ISO-8859-1: byte N → U+00NN). We CANNOT use
+// `new TextDecoder("latin1")` — per the WHATWG encoding standard "latin1" is an alias for
+// windows-1252, which remaps 0x80–0x9F to printable code points (e.g. 0x96 → U+2013). Those
+// bytes are exactly the UTF-8 continuation/lead octets of box-drawing & powerline glyphs
+// (▐ = U+2590 = E2 96 90), so a windows-1252 read is NOT reversible via `charCodeAt & 0xff`
+// and corrupts every multi-byte glyph (#270 regression). fromCharCode maps each byte 1:1, so
+// the round-trip below is exact. Chunked to keep fromCharCode.apply off the arg-count limit.
+export function decodeLatin1(bytes: Uint8Array): string {
+  let out = "";
+  const CHUNK = 0x8000;
+  for (let i = 0; i < bytes.length; i += CHUNK) {
+    out += String.fromCharCode.apply(null, bytes.subarray(i, i + CHUNK) as unknown as number[]);
+  }
+  return out;
+}
+
+// The control stream is read byte-faithfully (see decodeLatin1) so the `%output` octal path
+// above sees raw bytes. But command-reply blocks (capture-pane grid rows) arrive as raw
+// UTF-8, so their lines reach us as the byte-faithful latin1 representation. Re-decode them
+// to real UTF-8 here, or multi-byte glyphs (box-drawing, powerline) double-encode on the
+// next repaint and render as mojibake (#270). Safe to do per line: no UTF-8 continuation
+// byte is 0x0A/0x0D, so the newline split never lands mid-sequence.
 const REPLY_UTF8_DECODER = new TextDecoder("utf-8");
 export function latin1LineToUtf8(line: string): string {
   const bytes = new Uint8Array(line.length);
@@ -383,12 +399,12 @@ class SessionStream {
     const proc = this.proc;
     if (!proc?.stdout || typeof proc.stdout === "number") return;
     const reader = (proc.stdout as ReadableStream<Uint8Array>).getReader();
-    const decoder = new TextDecoder("latin1");
     try {
       for (;;) {
         const { done, value } = await reader.read();
         if (done) break;
-        this.lineBuf += decoder.decode(value, { stream: true });
+        // True ISO-8859-1, NOT TextDecoder("latin1") (= windows-1252, lossy in 0x80–0x9F).
+        this.lineBuf += decodeLatin1(value);
         let nl: number;
         while ((nl = this.lineBuf.indexOf("\n")) !== -1) {
           const line = this.lineBuf.slice(0, nl).replace(/\r$/, "");

package/src/workspace-probe.ts

@@ -125,6 +125,7 @@ export async function resolveSpawnWorkspace(input: WorkspaceResolutionInput): Pr
 
   const id = workspaceId(input);
   const repoRoot = probe.repoRoot;
+  const baseRef = terminalBaseRef(repoRoot, probe.branch);
   const baseSha = probe.headSha ?? requireGit(["rev-parse", "HEAD"], repoRoot);
   const branch = await availableBranch(repoRoot, branchName(input, id));
   const workspaceRoot = input.workspaceRoot ? resolve(input.workspaceRoot) : workspacesRoot(homedir());
@@ -151,7 +152,7 @@ export async function resolveSpawnWorkspace(input: WorkspaceResolutionInput): Pr
       sourceCwd,
       worktreePath,
       branch,
-      baseRef: probe.branch,
+      baseRef,
       baseSha,
       status: "active",
       deps,
@@ -977,6 +978,44 @@ function mergePr(
   return head({ status: "merge_planned", prUrl, error: undefined });
 }
 
+// Identity stamped on the merge commit a no-ff land records (#287). The merge is a
+// relay/orchestrator action, not the author's — attribute it clearly so `git log`
+// shows who tied the branch in, without impersonating the agent's commits (whose
+// original author and SHA are preserved underneath as the merge's second parent).
+const LAND_COMMITTER = { name: "Agent Relay", email: "agent-relay@noreply" } as const;
+
+function landMergeMessage(branch: string | undefined, subject: string | undefined): string {
+  const name = shortBranch(branch) ?? branch ?? "branch";
+  return subject ? `Merge ${name}: ${subject}` : `Merge ${name}`;
+}
+
+// Record a no-ff merge of `branchSha` into `base` when base is NOT checked out in any
+// worktree (#287). We can't run a working-tree merge, so synthesize the merge commit
+// with plumbing: compute the merged tree, commit it with both parents (base first, so
+// `--first-parent` still reads as base's mainline), then advance the ref with a CAS on
+// the old value. Preserves the branch's commit SHAs without a working tree.
+function recordNoFfMerge(
+  repoRoot: string,
+  base: string,
+  baseSha: string,
+  branchSha: string,
+  message: string,
+): { ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string } {
+  const tree = git(["merge-tree", "--write-tree", baseSha, branchSha], repoRoot);
+  if (!tree.ok) return { ok: false, conflict: true, error: tree.stdout || tree.stderr || "merge conflict computing tree" };
+  const treeOid = tree.stdout.split("\n")[0]?.trim();
+  if (!treeOid) return { ok: false, error: "merge-tree produced no tree oid" };
+  const commit = git(
+    ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "commit-tree", treeOid, "-p", baseSha, "-p", branchSha, "-m", message],
+    repoRoot,
+  );
+  if (!commit.ok || !commit.stdout) return { ok: false, error: commit.stderr || "commit-tree failed" };
+  const mergeSha = commit.stdout;
+  const update = git(["update-ref", `refs/heads/${base}`, mergeSha, baseSha], repoRoot);
+  if (!update.ok) return { ok: false, error: update.stderr || "failed to advance base ref" };
+  return { ok: true, mergeSha };
+}
+
 function mergeRebaseFf(
   input: WorkspaceMergeInput,
   worktreePath: string,
@@ -1005,30 +1044,46 @@ function mergeRebaseFf(
     }
   }
 
-  // Rebase the agent branch onto base so base can fast-forward to it.
-  if (countBehind(worktreePath, base) > 0) {
-    const rebase = git(["rebase", base], worktreePath);
-    if (!rebase.ok) {
-      git(["rebase", "--abort"], worktreePath);
-      return head({ conflict: true, status: "conflict", error: rebase.stderr || "rebase onto base failed" });
-    }
-  }
+  // SHA preservation (#287): never rebase the agent branch — rewriting its commits
+  // gives them new SHAs and breaks traceability (the branch.landed SHA must exist on
+  // base verbatim). headSha is the preserved landed commit; when base has advanced we
+  // tie the branch in with a no-ff merge so the agent's commits keep their identity.
   const headSha = git(["rev-parse", "HEAD"], worktreePath).stdout;
   // Subject of the landed commit for the relay's branch.landed notice (#239). Best-effort:
   // an empty/failed read just omits it from the message body.
   const landedSubject = git(["log", "-1", "--format=%s", headSha], worktreePath).stdout || undefined;
+  const behind = countBehind(worktreePath, base);
 
-  // Advance base to the rebased branch. If base is checked out somewhere, do a
-  // real ff-only merge there so its working tree stays consistent; otherwise
-  // just move the ref. Refuse if the base worktree has uncommitted changes.
+  // Advance base. `baseTip` is base's new tip after the land: it equals headSha on a
+  // clean fast-forward, or the merge commit on a no-ff merge. If base is checked out
+  // somewhere, operate in that worktree so its working tree stays consistent; otherwise
+  // move/synthesize the ref directly. Refuse if the base worktree has uncommitted changes.
+  let baseTip = headSha;
   const baseWorktree = worktreeForBranch(repoRoot, base);
   if (baseWorktree) {
     if (baseWorktree.dirty) return head({ status: "review_requested", error: `base branch '${base}' has uncommitted changes in ${baseWorktree.path}` });
-    const ff = git(["merge", "--ff-only", branch], baseWorktree.path);
-    if (!ff.ok) return head({ status: "review_requested", error: ff.stderr || "fast-forward into base failed" });
-  } else {
+    if (behind === 0) {
+      const ff = git(["merge", "--ff-only", branch], baseWorktree.path);
+      if (!ff.ok) return head({ status: "review_requested", error: ff.stderr || "fast-forward into base failed" });
+    } else {
+      const merge = git(
+        ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "merge", "--no-ff", "-m", landMergeMessage(branch, landedSubject), branch],
+        baseWorktree.path,
+      );
+      if (!merge.ok) {
+        git(["merge", "--abort"], baseWorktree.path);
+        return head({ conflict: true, status: "conflict", error: merge.stderr || "merge into base failed" });
+      }
+      baseTip = git(["rev-parse", "HEAD"], baseWorktree.path).stdout;
+    }
+  } else if (behind === 0) {
     const update = git(["update-ref", `refs/heads/${base}`, headSha], repoRoot);
     if (!update.ok) return head({ status: "review_requested", error: update.stderr || "failed to advance base ref" });
+  } else {
+    const baseSha = git(["rev-parse", base], repoRoot).stdout;
+    const merged = recordNoFfMerge(repoRoot, base, baseSha, headSha, landMergeMessage(branch, landedSubject));
+    if (!merged.ok) return head(merged.conflict ? { conflict: true, status: "conflict", error: merged.error } : { status: "review_requested", error: merged.error });
+    baseTip = merged.mergeSha;
   }
 
   // Publish the advanced base so local and origin converge (#190). We verified
@@ -1052,22 +1107,23 @@ function mergeRebaseFf(
     const fresh = nextBranchName(repoRoot, branch);
     const switched = git(["checkout", "-B", fresh, base], worktreePath);
     if (switched.ok) {
-      // The old branch now equals base (just fast-forwarded) — drop the litter.
+      // The old branch is now fully contained in base (fast-forwarded, or merged in
+      // as the no-ff merge's second parent) — drop the litter.
       const oldDeleted = git(["branch", "-D", branch], repoRoot).ok;
       // The worktree just moved onto the advanced base, which may declare deps the
       // shared (symlinked) node_modules lacks. Re-provision so the recycled session
       // continues from a buildable state (issue #51). No-op when nothing is stale.
       const depsRefresh = refreshWorkspaceDeps(repoRoot, worktreePath);
       const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
-      return head({ merged: true, status: "active", mergedSha: headSha, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, pushed, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
+      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, pushed, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
     }
     // Recycle failed — keep the existing branch. Still landed, still active.
-    return head({ merged: true, status: "active", mergedSha: headSha, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, error: undefined });
+    return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, error: undefined });
   }
   const removed = git(["worktree", "remove", "--force", worktreePath], repoRoot);
   const worktreeRemoved = removed.ok;
   const branchDeleted = worktreeRemoved ? git(["branch", "-D", branch], repoRoot).ok : false;
-  return head({ merged: true, status: "merged", mergedSha: headSha, subject: landedSubject, worktreeRemoved, branchDeleted, pushed, error: undefined });
+  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, branchDeleted, pushed, error: undefined });
 }
 
 async function availableBranch(repoRoot: string, base: string): Promise<string> {
@@ -1084,6 +1140,33 @@ function workspaceId(input: WorkspaceResolutionInput): string {
   return safeSegment(raw, 80);
 }
 
+// The branch a workspace lands INTO. Normally the source checkout's current branch
+// (`main`, or a deliberate feature branch). But when an agent is (re-)spawned from inside
+// a managed worktree — e.g. one recycled onto `agent/<owner>/<id>-N` after a land — the
+// source HEAD is that transient session branch. Chaining a new workspace onto it strands
+// the work one hop short of the real base: an `agent/...` branch has no remote upstream,
+// so the land advances a local-only branch that never reaches origin/main while still
+// reporting "✅ landed" (#285). Resolve to the repo's terminal base in that case; only fall
+// back to the session branch if no default base can be found (no worse than before).
+function terminalBaseRef(repoRoot: string, currentBranch: string | undefined): string | undefined {
+  if (!currentBranch || !currentBranch.startsWith("agent/")) return currentBranch;
+  return repoDefaultBranch(repoRoot) ?? currentBranch;
+}
+
+// The repo's mainline: origin/HEAD's target when set (and present locally), else local
+// `main`/`master`. Returns undefined when none resolve.
+function repoDefaultBranch(repoRoot: string): string | undefined {
+  const head = git(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"], repoRoot);
+  if (head.ok && head.stdout) {
+    const name = head.stdout.replace(/^[^/]+\//, ""); // strip the `origin/` remote prefix
+    if (name && git(["show-ref", "--verify", "--quiet", `refs/heads/${name}`], repoRoot).ok) return name;
+  }
+  for (const candidate of ["main", "master"]) {
+    if (git(["show-ref", "--verify", "--quiet", `refs/heads/${candidate}`], repoRoot).ok) return candidate;
+  }
+  return undefined;
+}
+
 function branchName(input: WorkspaceResolutionInput, id: string): string {
   const owner = input.policyName || input.label || input.automationId || "manual";
   // 40 fits a full UUID (36) plus the `sp_`-stripped slack. A tighter cap (was 24)