audit-tools 0.28.7 → 0.28.9

package/dist/remediate/steps/nextStep.js

@@ -2,15 +2,15 @@ import { existsSync } from "node:fs";
 import { mkdir, readFile, rename } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { StateStore } from "../state/store.js";
-import { readOptionalJsonFile, writeJsonFile, formatValidationIssues, isRecord, withFsRetry, RunLogger, DO_NOT_TOKEN_WRAP_NOTE, DISPATCH_PROMPT_HANDOFF_NOTE, coerceJsonObjectArg, createRollingDispatcher, setQuotaStateDir, interpretFreeFormIntent, advance } from "audit-tools/shared";
+import { readOptionalJsonFile, writeJsonFile, formatValidationIssues, isRecord, withFsRetry, RunLogger, DO_NOT_TOKEN_WRAP_NOTE, DISPATCH_PROMPT_HANDOFF_NOTE, coerceJsonObjectArg, createRollingDispatcher, setQuotaStateDir, interpretFreeFormIntent, advance, planHybridDispatch, readSettledPools, addSettledPool, sourceByPoolId } from "audit-tools/shared";
 import { applyPlanPipeline, buildCoverageLedger } from "../phases/plan.js";
 import { groundExtractedFindings } from "../phases/grounding.js";
 import { runTriagePhase } from "../phases/triage.js";
 import { runClosePhase } from "../phases/close.js";
 import { validateRemediationPlan } from "../validation/remediationState.js";
-import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, createWorktree, removeWorktree, resetNodeWorktreeAndBranch, acceptNodeWorktree, recordNodeAcceptOutcome, ensureWorktreeNodeModules, seedUntrackedDeclaredPaths, worktreePath, worktreeBranchForBlock, blockScopesFromPlan, } from "./dispatch.js";
+import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, declaredPathsFromPlan, } from "./dispatch.js";
 import { makeProviderNodeDispatcher } from "./providerNodeDispatch.js";
-import { prepareHostRollingDispatch } from "./rollingSession.js";
+import { prepareHostRollingDispatch, nodeClaimRegistry, nodeSettledPoolsPath } from "./rollingSession.js";
 import { writeCurrentStep } from "./stepWriter.js";
 import { dependencyVerifiedComplete } from "./stepUtils.js";
 import { isTerminalStatus, isVerifiedCompleteStatus, isSkipStatus, } from "../state/itemStatus.js";
@@ -365,6 +365,28 @@ function resolvesToInProcessDispatchProvider(sessionConfig) {
     const provider = sessionConfig?.provider;
     return provider !== undefined && IN_PROCESS_DISPATCH_PROVIDERS.has(provider);
 }
+/**
+ * Whether a confirmed pool is one the orchestrator launches IN-PROCESS this cycle
+ * (vs. the conversation host's subagent pool). The remediate classification for the
+ * shared `planHybridDispatch` split — single-sourced off the same provider set
+ * `resolvesToInProcessDispatchProvider` uses.
+ */
+function isInProcessPool(pool) {
+    return IN_PROCESS_DISPATCH_PROVIDERS.has(pool.providerName);
+}
+/**
+ * Release a node's shared claim on a terminal accept (token-checked through the
+ * registry), then drop the held token. Idempotent: a node with no held token (a
+ * peer-owned skip, or a double-release) is a no-op. Single-sourced so both the
+ * success and the error paths of the in-process driver free the claim identically.
+ */
+async function releaseNodeClaim(registry, claimTokens, blockId) {
+    const token = claimTokens.get(blockId);
+    if (!token)
+        return;
+    await registry.release(blockId, token);
+    claimTokens.delete(blockId);
+}
 /**
  * Drive the implement phase through the in-process rolling engine. Engages the
  * shared `createRollingDispatcher` (via `driveRollingDispatch`) over
@@ -410,9 +432,19 @@ export async function driveRollingImplementDispatch(options) {
     const promptPathByBlock = new Map(plan.items
         .filter((i) => typeof i.block_id === "string")
         .map((i) => [i.block_id, i.prompt_path]));
+    // Confirmed pools: quota-derived concurrency, never the raw host flag (INV-QD-11).
+    const confirmedPools = await buildConfirmedPools({
+        sessionConfig: options.sessionConfig,
+        hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
+        hostContextTokens: options.waveOptions?.hostContextTokens,
+        hostOutputTokens: options.waveOptions?.hostOutputTokens,
+        hostModels: options.waveOptions?.hostModels,
+        hostModelId: options.waveOptions?.hostModelId,
+    });
     // The live per-node worker: the configured provider, launched with the node's
     // worktree-rooted prompt and cwd = its worktree. Tests inject `options.dispatchNode`
-    // to exercise the engine without spawning a real worker.
+    // to exercise the engine without spawning a real worker. A node on a source-backed
+    // pool launches FROM its source's config (A-8 generic dispatchable sources).
     const dispatchNode = options.dispatchNode ??
         makeProviderNodeDispatcher({
             root,
@@ -420,16 +452,8 @@ export async function driveRollingImplementDispatch(options) {
             runId,
             sessionConfig: options.sessionConfig,
             promptPathByBlock,
+            sourceByPoolId: sourceByPoolId(confirmedPools),
         });
-    // Confirmed pools: quota-derived concurrency, never the raw host flag (INV-QD-11).
-    const confirmedPools = await buildConfirmedPools({
-        sessionConfig: options.sessionConfig,
-        hostMaxConcurrent: options.waveOptions?.hostMaxConcurrent,
-        hostContextTokens: options.waveOptions?.hostContextTokens,
-        hostOutputTokens: options.waveOptions?.hostOutputTokens,
-        hostModels: options.waveOptions?.hostModels,
-        hostModelId: options.waveOptions?.hostModelId,
-    });
     // Load state to partition the eligible frontier into rolling dependency levels.
     const state = await new StateStore(artifactsDir).loadState();
     if (!state)
@@ -441,78 +465,64 @@ export async function driveRollingImplementDispatch(options) {
         .map((level) => level.filter((b) => plannedBlockIds.has(b.block_id)))
         .filter((level) => level.length > 0);
     const nodeOutcomes = [];
+    // The SAME file-backed claim registry the host-subagent driver claims through
+    // (`nodeClaimRegistry`, keyed only to run + artifacts dir). Claiming a node here
+    // BEFORE creating its worktree makes the in-process and host-subagent drivers
+    // mutually exclusive on a node — exactly-one-claimant across both (A-10), the
+    // cross-driver double-dispatch guard. Owner tokens are held in-memory for the
+    // life of this run: a `rate_limited` re-queue re-enters for the same block, so a
+    // node already claimed by THIS driver reuses its token rather than self-colliding.
+    const registry = nodeClaimRegistry(artifactsDir, runId);
+    const claimTokens = new Map();
     // Per-node worktree dispatch + verify-before-accept, wrapped so the rolling
     // engine's dispatchNode callback always RESOLVES (never rejects).
     const dispatchNodeWithWorktree = async (block, slot) => {
-        const branch = worktreeBranchForBlock(block.block_id, runId);
-        const wt = worktreePath(root, block.block_id, runId);
         const resultPath = resultPathByBlock.get(block.block_id);
-        try {
-            // Idempotent reset of any worktree dir AND leftover branch from a prior
-            // attempt before creating this node's isolated worktree. A `rate_limited`
-            // re-queue re-enters this dispatcher for the same block with the branch
-            // still present; a bare `createWorktree -b` would then fail with "branch
-            // already exists". `resetNodeWorktreeAndBranch` clears both (+ prunes stale
-            // admin entries) so every (re-)dispatch starts clean from HEAD.
-            resetNodeWorktreeAndBranch(root, wt, branch);
-            createWorktree(root, wt, branch);
-            // A fresh worktree has no node_modules (gitignored); link the main checkout's
-            // so this node's verify commands can run.
-            ensureWorktreeNodeModules(root, wt);
-            // Bring in declared targets that are untracked/ignored in the main tree so a
-            // committed-files-only worktree can still see this node's own targets.
-            // `touched_files` is the block's authoritative declared write set (the same
-            // source the dispatch plan's write scope is derived from).
-            seedUntrackedDeclaredPaths(root, wt, block.touched_files ?? []);
-            const result = await dispatchNode({
-                block,
-                slot,
-                worktreeRoot: wt,
-                resultPath,
-            });
-            // Shared post-worker lifecycle (commit → verify → merge), identical to the
-            // host-subagent driver's `accept-node` callback. Records the LIFECYCLE
-            // outcome but returns the worker's TRANSPORT result to the engine (so a
-            // rate_limited worker re-queues; a verify-failure routes to triage via merge).
-            // Verify commands are DERIVED from the node's actually-touched tests inside
-            // acceptNodeWorktree (post-commit) — omit them here so a host-authored path
-            // can't mis-verify. The accept-time write-scope gate likewise adjudicates the
-            // node's ACTUAL git edits (ground truth) against all blocks' declared scopes.
-            const accept = acceptNodeWorktree({
-                root,
-                runId,
-                blockId: block.block_id,
-                worktreeRoot: wt,
-                branch,
-                workerOutcome: result.outcome,
-                scope: { allBlockScopes },
-            });
-            // Persist the tool-owned verify/merge outcome so finalization blocks a node
-            // that self-reported resolved but never actually landed (OBL-DS-06). Parity
-            // with the host-subagent driver's `accept-node` callback.
-            await recordNodeAcceptOutcome(artifactsDir, runId, block.block_id, accept);
-            nodeOutcomes.push({
-                block_id: block.block_id,
-                outcome: accept.outcome,
-                verify_passed: accept.verifyPassed,
-                merged: accept.merged,
-            });
-            return result;
+        // Claim BEFORE any worktree work (CE-001). A node THIS driver already holds (a
+        // rate_limited re-queue) reuses its token. A node a PEER driver holds is its to
+        // run — skip the worker + accept lifecycle entirely so we never double-dispatch
+        // or double-merge it; the run-level `mergeImplementResults` reconciles from the
+        // peer's accept outcome.
+        if (!claimTokens.has(block.block_id)) {
+            const claim = await registry.claim(block.block_id, "in-process");
+            if (!claim.acquired) {
+                nodeOutcomes.push({ block_id: block.block_id, outcome: "success", verify_passed: false, merged: false });
+                return {
+                    packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
+                    outcome: "success",
+                };
+            }
+            claimTokens.set(block.block_id, claim.ownerToken);
         }
-        catch (err) {
-            removeWorktree(root, wt);
-            await recordNodeAcceptOutcome(artifactsDir, runId, block.block_id, {
-                outcome: "error",
-                verifyPassed: false,
-                merged: false,
-            });
-            nodeOutcomes.push({ block_id: block.block_id, outcome: "error", verify_passed: false, merged: false });
-            return {
-                packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
-                outcome: "error",
-                error: err,
-            };
+        // The shared per-node worktree lifecycle (reset → create → link node_modules →
+        // seed → dispatch → commit/verify/write-scope/merge → record), identical to the
+        // A-8 hybrid executor and behaviourally to the host-subagent driver's
+        // `accept-node` callback. `touched_files` is the block's authoritative declared
+        // write set (the source the dispatch plan's write scope is derived from).
+        const { result, accept } = await executeNodeInWorktree({
+            block,
+            slot,
+            root,
+            artifactsDir,
+            runId,
+            resultPath,
+            seedPaths: block.touched_files ?? [],
+            allBlockScopes,
+            dispatchNode,
+        });
+        nodeOutcomes.push({
+            block_id: block.block_id,
+            outcome: accept.outcome,
+            verify_passed: accept.verifyPassed,
+            merged: accept.merged,
+        });
+        // Release the claim ONLY on a terminal accept. A `rate_limited` worker re-queues
+        // (still owned work — keep the claim so a peer can't grab it mid-retry); success /
+        // error / timeout is terminal → free it through the shared registry (token-checked).
+        if (result.outcome !== "rate_limited") {
+            await releaseNodeClaim(registry, claimTokens, block.block_id);
         }
+        return result;
     };
     await driveRollingDispatch(levels, {
         confirmedPools,
@@ -531,6 +541,86 @@ export async function driveRollingImplementDispatch(options) {
         state_status: merged.status,
     };
 }
+/**
+ * Flat per-node input-token estimate for the A-8 hybrid frontier split. The
+ * coordinator splits by per-pool SLOTS (concurrency) — host vs. backend — so a
+ * uniform estimate is sufficient here; it matches the default the in-process engine
+ * uses (`driveRollingDispatch`'s `() => 2000`), keeping the two paths consistent.
+ */
+const HYBRID_NODE_TOKEN_ESTIMATE = 2000;
+/**
+ * Run the A-8 coordinator's IN-PROCESS partition this cycle. Each node was already
+ * claimed by the coordinator and assigned to a backend pool (NIM / codex / …), so it
+ * is launched on THAT pool's provider — binding the slot's providerName to the
+ * per-node assignment is what routes a node to its assigned backend — cwd-confined to
+ * its worktree, through the shared `executeNodeInWorktree` lifecycle (commit → verify
+ * → write-scope → merge); then the coordinator's claim is released.
+ *
+ * Nodes run concurrently: the coordinator's proactive split already bounded the
+ * partition to the backend pools' capacity, so the partition size IS the safe
+ * concurrency. The host partition runs in parallel via the host-subagent driver;
+ * both write accept-outcome sidecars the run-level `mergeImplementResults` reconciles.
+ *
+ * Run-once (no in-pass re-queue): a node whose worker rate-limits or errors is not
+ * merged (its worktree drops) and is routed to triage by the deterministic merge —
+ * bounded, never a livelock. (Cross-cycle settled-pool re-balancing is a follow-up.)
+ */
+export async function executeInProcessPartition(params) {
+    const { root, artifactsDir, runId, sessionConfig, partition, plan, coordinator } = params;
+    if (partition.length === 0)
+        return { nodes: [] };
+    const allBlockScopes = blockScopesFromPlan(plan);
+    const withBlockId = plan.items.filter((i) => typeof i.block_id === "string");
+    const promptPathByBlock = new Map(withBlockId.map((i) => [i.block_id, i.prompt_path]));
+    const resultPathByBlock = new Map(withBlockId.map((i) => [i.block_id, i.result_path]));
+    const state = await new StateStore(artifactsDir).loadState();
+    const blockById = new Map((state?.plan?.blocks ?? []).map((b) => [b.block_id, b]));
+    const dispatchNode = params.dispatchNode ??
+        makeProviderNodeDispatcher({
+            root,
+            artifactsDir,
+            runId,
+            sessionConfig,
+            promptPathByBlock,
+            sourceByPoolId: params.sourceByPoolId,
+        });
+    const nodes = await Promise.all(partition.map(async (a) => {
+        // `a` IS the coordinator's NodeAssignment — release it directly on terminal.
+        const resultPath = resultPathByBlock.get(a.nodeId);
+        if (!resultPath) {
+            // No prepared prompt/result for this node — release + mark error (the merge
+            // routes it to triage); never silently drop a claimed node.
+            await coordinator.release(a);
+            return { block_id: a.nodeId, outcome: "error", verify_passed: false, merged: false };
+        }
+        const block = blockById.get(a.nodeId) ?? { block_id: a.nodeId };
+        const slot = {
+            providerName: a.providerName,
+            hostModel: a.hostModel,
+            poolId: a.poolId,
+        };
+        const { accept } = await executeNodeInWorktree({
+            block,
+            slot,
+            root,
+            artifactsDir,
+            runId,
+            resultPath,
+            seedPaths: declaredPathsFromPlan(plan, a.nodeId),
+            allBlockScopes,
+            dispatchNode,
+        });
+        // Run-once → terminal; free the coordinator claim (token-checked).
+        await coordinator.release(a);
+        return {
+            block_id: a.nodeId,
+            outcome: accept.outcome,
+            verify_passed: accept.verifyPassed,
+            merged: accept.merged,
+        };
+    }));
+    return { nodes };
+}
 /**
  * Whether `root` is the audit-tools monorepo — the repo the tool-owned final
  * gate's suite (INV-RS-10, literally the audit-tools build/check/per-package
@@ -969,7 +1059,89 @@ async function buildImplementDispatchStep(ctx) {
         return { kind: "transition", state: await store.loadState() };
     }
     if (rollingEngineEnabled && canDispatchImpl) {
-        const rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl);
+        // A-8 hybrid spill: when an in-process backend pool is ALSO confirmed (a
+        // configured NIM/openai-compatible endpoint alongside the conversation host),
+        // split the eligible frontier across BOTH pool classes via the shared
+        // HybridSpillCoordinator (single claimant, proactive capacity split) — the
+        // orchestrator runs the in-process partition THIS cycle while the host spawns
+        // subagents for its partition. Pure host-subagent dispatch falls out when no
+        // backend pool is confirmed (the coordinator has nothing to split against).
+        const confirmedPools = await buildConfirmedPools({
+            sessionConfig: sessionConfigImpl ?? null,
+            hostMaxConcurrent: options.hostMaxConcurrent,
+            hostContextTokens: options.hostContextTokens,
+            hostOutputTokens: options.hostOutputTokens,
+            hostModels: options.hostModels,
+            hostModelId: options.hostModelId,
+        });
+        const backendPools = confirmedPools.filter(isInProcessPool);
+        let rolling;
+        if (backendPools.length > 0) {
+            // Prepare the frontier ONCE (worktree-rooted prompts) so the coordinator
+            // split, the in-process executor, and the host driver all read the same plan.
+            const plan = await prepareImplementDispatch({ root, artifactsDir }, runId, undefined, {
+                ...waveOptsImpl,
+                worktreeRootedPrompts: true,
+            });
+            const frontier = plan.items
+                .filter((i) => typeof i.block_id === "string")
+                .map((i) => ({ id: i.block_id, estimatedTokens: HYBRID_NODE_TOKEN_ESTIMATE }));
+            if (frontier.length === 0) {
+                await mergeImplementResults({ root, artifactsDir }, runId);
+                return { kind: "transition", state: await store.loadState() };
+            }
+            // One coordinator over the shared claim registry splits + claims each node to
+            // exactly one pool. DC-4: the settled set is cross-cycle (persisted) — a backend
+            // pool that exhausted on a prior cycle is excluded here, so its work falls to the
+            // host-subagent pool instead of re-looping on a dead backend.
+            const settledPath = nodeSettledPoolsPath(artifactsDir, runId);
+            const settled = await readSettledPools(settledPath);
+            const partition = await planHybridDispatch({
+                frontier,
+                pools: confirmedPools,
+                sessionConfig: sessionConfigImpl ?? {},
+                claimRegistry: nodeClaimRegistry(artifactsDir, runId),
+                readSettled: () => settled,
+                onSettle: async (id) => {
+                    settled.add(id);
+                    await addSettledPool(settledPath, id);
+                },
+                isInProcess: isInProcessPool,
+            });
+            // Run the in-process partition now (each node on its assigned backend pool,
+            // launched FROM that pool's source config — A-8 generic dispatchable sources).
+            const inProcessOutcome = await executeInProcessPartition({
+                root,
+                artifactsDir,
+                runId,
+                sessionConfig: sessionConfigImpl ?? null,
+                partition: partition.inProcess,
+                plan,
+                coordinator: partition.coordinator,
+                sourceByPoolId: sourceByPoolId(confirmedPools),
+            });
+            // DC-4: a backend pool whose node rate-limited is exhausted → settle it
+            // (cross-cycle) so the next cycle routes its share to the host pool.
+            const rateLimited = new Set(inProcessOutcome.nodes.filter((n) => n.outcome === "rate_limited").map((n) => n.block_id));
+            const exhaustedPools = new Set(partition.inProcess.filter((a) => rateLimited.has(a.nodeId)).map((a) => a.poolId));
+            for (const poolId of exhaustedPools) {
+                await partition.coordinator.settlePool(poolId);
+            }
+            // The backend carried the whole batch (or every host node was contested by a
+            // peer driver) → nothing for the host this cycle; merge what landed + transition.
+            if (partition.host.length === 0) {
+                await mergeImplementResults({ root, artifactsDir }, runId);
+                return { kind: "transition", state: await store.loadState() };
+            }
+            // Hand the host partition (pre-claimed) to the host-subagent driver.
+            rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl, {
+                plan,
+                partition: partition.host.map((a) => ({ block_id: a.nodeId, ownerToken: a.ownerToken })),
+            });
+        }
+        else {
+            rolling = await prepareHostRollingDispatch({ root, artifactsDir }, runId, waveOptsImpl);
+        }
         // Everything eligible may already be done/skipped — fold straight to merge
         // rather than emitting a dispatch step with zero nodes.
         if (rolling.session.frontier.length === 0) {
@@ -2321,7 +2493,7 @@ Only \`scope_summary\` and \`intent_summary\` are required; add the optional fie
   "confirmed_by": "host",
   "scope_summary": "<the files/areas in scope>",
   "intent_summary": "<the goal, e.g. full-remediation / security-only>",
-  "free_form_intent": "<optional: guidance threaded into remediation worker prompts>",
+  "free_form_intent": "<optional: interpreted into lens/priority ordering at planning; never threaded verbatim into worker prompts>",
   "filters": {
     "severity": ["critical", "high"],
     "lenses": ["security", "reliability"],