audit-tools 0.30.49 → 0.30.51

package/dist/remediate/steps/dispatch.js

@@ -69,6 +69,92 @@ function _capacityPoolSummary(poolId, slots, schedule) {
 function sortRosterMostCapableFirst(roster) {
     return [...roster].sort((a, b) => compareTier(b.rank, a.rank));
 }
+async function buildHostPoolPreamble(input) {
+    const sessionConfig = input.sessionConfig ?? {};
+    const providerName = input.providerName ??
+        sessionConfig.provider ??
+        "claude-code";
+    const hostModel = input.hostModel ??
+        sessionConfig.block_quota
+            ?.host_model ??
+        null;
+    // Quota-key identity: resolved model name, else the host's opaque id, else
+    // null → `provider/*`. Per-roster-rank `model_id` overrides per pool below.
+    const quotaModelKeySegment = hostModel ?? input.hostModelId ?? null;
+    const roster = input.hostModels?.length
+        ? sortRosterMostCapableFirst(input.hostModels)
+        : null;
+    const hostLimit = resolveHostConcurrencyLimit({
+        hostMaxConcurrent: input.hostMaxConcurrent,
+        sessionConfig,
+        env: input.env,
+    });
+    // The capability handshake: the host reported its dispatch model's real
+    // context/output window this session (the roster's most capable entry under
+    // the multi-rank handshake). Carried into the pool's discoveredLimits so the
+    // shared discovered_capability rung sizes the budget to the real window
+    // instead of the conservative 32k floor. RPM/TPM stay null and fill from the
+    // learned quota state.
+    const hostContextTokens = input.hostContextTokens ?? roster?.[0]?.context_tokens ?? null;
+    const hostOutputTokens = input.hostOutputTokens ?? roster?.[0]?.output_tokens ?? null;
+    const hostCapabilityLimits = hostContextTokens != null || hostOutputTokens != null
+        ? { context_tokens: hostContextTokens, output_tokens: hostOutputTokens }
+        : null;
+    let quotaEntries = {};
+    try {
+        const state = await readQuotaState();
+        quotaEntries = state.entries;
+    }
+    catch (err) {
+        process.stderr.write(`[waveScheduler] readQuotaState failed; degrading to no learned quota entry. ${err instanceof Error ? err.message : String(err)}\n`);
+    }
+    // The proactive quota snapshot (Claude OAuth source, then learned) so the
+    // scheduler can throttle/cooldown from live remaining quota — mirrors
+    // audit-code's buildDispatchPool. PREPEND the host-session source keyed on
+    // this host pool's own (provider, model) key — first-class PRE-WALL source
+    // (graduated remaining_pct → LOW/CRITICAL throttle before a 429), gating on the
+    // exact key so it never masks the proactive/learned sources.
+    const quotaSource = buildQuotaSource({
+        halfLifeHours: sessionConfig.quota
+            ?.empirical_half_life_hours,
+        hostSession: input.hostSession ??
+            new HostSessionQuotaSource({
+                providerModelKey: buildProviderModelKey(providerName, quotaModelKeySegment),
+            }),
+    });
+    // One capacity pool per reported roster rank (most capable first), each with
+    // its own discovered window and quota key; a single pool for the scalar/absent
+    // handshake. Built via the shared host-pool-from-roster core so the pool shape
+    // + account-keyed pool ids can't drift across the two consumers.
+    const primaryPools = await buildHostModelPools({
+        providerName,
+        hostModel,
+        hostConcurrencyLimit: hostLimit,
+        quotaSource,
+        quotaEntries,
+        roster,
+        resolve: (entry) => ({
+            poolKey: buildProviderModelKey(providerName, entry?.model_id ?? quotaModelKeySegment),
+            discoveredLimits: entry
+                ? { context_tokens: entry.context_tokens, output_tokens: entry.output_tokens }
+                : hostCapabilityLimits,
+        }),
+    });
+    return {
+        sessionConfig,
+        providerName,
+        hostModel,
+        quotaModelKeySegment,
+        roster,
+        hostLimit,
+        hostContextTokens,
+        hostOutputTokens,
+        hostCapabilityLimits,
+        quotaEntries,
+        quotaSource,
+        primaryPools,
+    };
+}
 export async function scheduleWave(input) {
     const sessionConfig = input.sessionConfig ?? {};
     const providerName = input.providerName ?? sessionConfig.provider ?? "claude-code";
@@ -92,12 +178,6 @@ export async function scheduleWave(input) {
     // learned quota state.
     const hostContextTokens = input.hostContextTokens ?? roster?.[0]?.context_tokens ?? null;
     const hostOutputTokens = input.hostOutputTokens ?? roster?.[0]?.output_tokens ?? null;
-    const hostCapabilityLimits = hostContextTokens != null || hostOutputTokens != null
-        ? {
-            context_tokens: hostContextTokens,
-            output_tokens: hostOutputTokens,
-        }
-        : null;
     const quota = sessionConfig.quota;
     if (!quota || quota.enabled === false) {
         const cap = hostLimit?.active_subagents ?? DEFAULT_WAVE_SIZE;
@@ -127,48 +207,19 @@ export async function scheduleWave(input) {
             capacity_pools: [_capacityPoolSummary(buildProviderModelKey(providerName, quotaModelKeySegment), waveSize, schedule)],
         };
     }
-    let quotaEntries = {};
-    try {
-        const state = await readQuotaState();
-        quotaEntries = state.entries;
-    }
-    catch (err) {
-        process.stderr.write(`[waveScheduler] readQuotaState failed; falling back to default wave size. ${err instanceof Error ? err.message : String(err)}\n`);
-    }
-    // The proactive quota snapshot (Claude OAuth source, then learned) so the
-    // scheduler can throttle/cooldown from live remaining quota — mirrors
-    // audit-code's buildDispatchPool. Cached per key, so one probe per burst.
-    // PREPEND the host-session source keyed on this host pool's own (provider,
-    // model) key — first-class PRE-WALL source (graduated remaining_pct →
-    // LOW/CRITICAL throttle before a 429), gating on the exact key so it never masks
-    // the proactive/learned sources. Mirrors audit-code's buildDispatchPool.
-    const quotaSource = buildQuotaSource({
-        halfLifeHours: sessionConfig.quota
-            ?.empirical_half_life_hours,
-        hostSession: new HostSessionQuotaSource({
-            providerModelKey: buildProviderModelKey(providerName, quotaModelKeySegment),
-        }),
-    });
-    // One capacity pool per reported roster rank (most capable first), each with its
-    // own discovered window and quota key; a single pool for the scalar/absent
-    // handshake. Built via the shared host-pool-from-roster core (same as
-    // buildConfirmedPools) so the pool shape + account-keyed pool ids can't drift.
-    const pools = await buildHostModelPools({
-        providerName,
-        hostModel,
-        hostConcurrencyLimit: hostLimit,
-        quotaSource,
-        quotaEntries,
-        roster,
-        resolve: (entry) => ({
-            poolKey: buildProviderModelKey(providerName, entry?.model_id ?? quotaModelKeySegment),
-            discoveredLimits: entry
-                ? { context_tokens: entry.context_tokens, output_tokens: entry.output_tokens }
-                : hostCapabilityLimits,
-        }),
+    const preamble = await buildHostPoolPreamble({
+        sessionConfig: input.sessionConfig,
+        providerName: input.providerName,
+        hostModel: input.hostModel,
+        hostMaxConcurrent: input.hostMaxConcurrent,
+        hostContextTokens: input.hostContextTokens,
+        hostOutputTokens: input.hostOutputTokens,
+        hostModels: input.hostModels,
+        hostModelId: input.hostModelId,
+        env: input.env,
     });
     const capacity = computeDispatchCapacity({
-        pools,
+        pools: preamble.primaryPools,
         sessionConfig,
         pendingItemTokens: normalizeSlotTokens(input.estimatedSlotTokens, input.itemCount),
     });
@@ -187,55 +238,17 @@ export async function scheduleWave(input) {
  * `driveRollingImplementDispatch`.
  */
 export async function buildConfirmedPools(input) {
-    const sessionConfig = input.sessionConfig ?? {};
-    const providerName = sessionConfig.provider ?? "claude-code";
-    const hostModel = sessionConfig.block_quota
-        ?.host_model ?? null;
-    const quotaModelKeySegment = hostModel ?? input.hostModelId ?? null;
-    const roster = input.hostModels?.length
-        ? sortRosterMostCapableFirst(input.hostModels)
-        : null;
-    const hostLimit = resolveHostConcurrencyLimit({
+    // Resolve identity/limits and build the per-rank host-model pools via the
+    // SAME preamble `scheduleWave` uses — the two no longer keep parallel copies.
+    const { sessionConfig, providerName, quotaSource, quotaEntries, primaryPools } = await buildHostPoolPreamble({
+        sessionConfig: input.sessionConfig,
         hostMaxConcurrent: input.hostMaxConcurrent,
-        sessionConfig,
+        hostContextTokens: input.hostContextTokens,
+        hostOutputTokens: input.hostOutputTokens,
+        hostModels: input.hostModels,
+        hostModelId: input.hostModelId,
         env: input.env,
-    });
-    const hostContextTokens = input.hostContextTokens ?? roster?.[0]?.context_tokens ?? null;
-    const hostOutputTokens = input.hostOutputTokens ?? roster?.[0]?.output_tokens ?? null;
-    const hostCapabilityLimits = hostContextTokens != null || hostOutputTokens != null
-        ? { context_tokens: hostContextTokens, output_tokens: hostOutputTokens }
-        : null;
-    let quotaEntries = {};
-    try {
-        const state = await readQuotaState();
-        quotaEntries = state.entries;
-    }
-    catch {
-        // Non-fatal: a missing/locked quota state degrades to no learned entry.
-    }
-    const quotaSource = buildQuotaSource({
-        halfLifeHours: sessionConfig.quota
-            ?.empirical_half_life_hours,
-        hostSession: input.hostSession ??
-            new HostSessionQuotaSource({
-                providerModelKey: buildProviderModelKey(providerName, quotaModelKeySegment),
-            }),
-    });
-    // Host-model pools via the shared host-pool-from-roster core (identical shape across
-    // audit + remediate). The per-tool part is just the key + the roster/capability limits.
-    const primaryPools = await buildHostModelPools({
-        providerName,
-        hostModel,
-        hostConcurrencyLimit: hostLimit,
-        quotaSource,
-        quotaEntries,
-        roster,
-        resolve: (entry) => ({
-            poolKey: buildProviderModelKey(providerName, entry?.model_id ?? quotaModelKeySegment),
-            discoveredLimits: entry
-                ? { context_tokens: entry.context_tokens, output_tokens: entry.output_tokens }
-                : hostCapabilityLimits,
-        }),
+        hostSession: input.hostSession,
     });
     // Every configured dispatchable backend source (any non-IDE source: NIM/vLLM API,
     // a CLI pool, …) becomes a CapacityPool alongside the primary, so the scheduler's
@@ -1329,17 +1342,48 @@ export function normalizeNodeTestCommand(cmd) {
         return cmd;
     return trimmed.replace(/^node\b/, "node --import tsx/esm");
 }
+/**
+ * True when `cmd` is a test-runner invocation whose target is a whole directory
+ * or the entire suite rather than specific test files — e.g. `npx vitest run
+ * tests/remediate`, `vitest run` (no path), `node --test tests/audit/`. Such a
+ * command, run as an *additional* per-node verify alongside the scoped derive,
+ * re-enters the FULL suite inside a per-node worktree. That is the structural
+ * deadlock proven 2026-06-30: a source node's whole-suite verify fails on a
+ * stale test owned by a DIFFERENT node, and concurrent worktrees race shared
+ * test temp dirs. The derived verify already runs this node's OWN touched
+ * tests, so a host/DAG-authored whole-suite command adds only risk — the tool
+ * drops it rather than relying on the author to scope it (enforce-in-tooling,
+ * never host discretion). A command naming at least one concrete `.test.<ext>`
+ * file is scoped and kept.
+ */
+export function isWholeSuiteTestCommand(cmd) {
+    const c = cmd.trim();
+    const isVitest = /\bvitest\b\s+run\b/.test(c) || /\bvitest\b(?!\s+run)/.test(c);
+    const isNodeTest = /^node\b/.test(c) && /\s--test\b/.test(c);
+    if (!isVitest && !isNodeTest)
+        return false;
+    // Tokenise; a concrete test file makes it scoped. Anything that is a runner
+    // with no concrete test-file target (bare runner, or a directory/glob target)
+    // is whole-suite.
+    const namesConcreteTestFile = /(^|\s)[^\s]*\.test\.(ts|tsx|mjs|cjs|js)(\s|$)/.test(c);
+    return !namesConcreteTestFile;
+}
 /**
  * Filter a node's `targeted_commands` to the build-free subset for the per-node
  * verify section. Build-prepending or build commands are dropped (the host runs
- * the build centrally) rather than emitted into the prompt. Surviving
- * `node --test` commands are normalized to carry the tsx loader.
+ * the build centrally) rather than emitted into the prompt. Whole-suite /
+ * whole-directory test runs are dropped too — they re-enter the full suite in a
+ * per-node worktree and re-create the cross-node verify deadlock (the scoped
+ * derive already covers this node's own tests). Surviving `node --test`
+ * commands are normalized to carry the tsx loader.
  */
 function buildFreeVerifyCommands(commands) {
     if (!Array.isArray(commands))
         return [];
     return commands
-        .filter((c) => typeof c === "string" && isBuildFreeVerifyCommand(c))
+        .filter((c) => typeof c === "string" &&
+        isBuildFreeVerifyCommand(c) &&
+        !isWholeSuiteTestCommand(c))
         .map(normalizeNodeTestCommand);
 }
 /** A repo-relative test path → the runner that executes that file directly. */
@@ -1419,6 +1463,18 @@ function markTerminal(item) {
     item.started_at ??= now;
     item.completed_at = now;
 }
+/**
+ * Load a worker's already-written implement result, distinguishing an ABSENT
+ * file (the worker hasn't run yet → re-dispatch from scratch) from a PRESENT but
+ * INVALID one (the worker ran but emitted malformed/unparseable JSON or a result
+ * that fails the contract). A bare `catch → undefined` conflated the two: a
+ * written-but-invalid file looked identical to "never produced", so the merge
+ * loop silently `continue`d past the block (the missing-file branch never fires
+ * because the file DOES exist) and the node could neither converge nor surface
+ * the corruption. We now archive the invalid file (so a clean re-dispatch can
+ * write a fresh one) and report it loudly, returning `undefined` only for the
+ * genuinely-absent case.
+ */
 async function tryLoadExistingImplementResult(resultPath) {
     if (!existsSync(resultPath))
         return undefined;
@@ -1427,7 +1483,13 @@ async function tryLoadExistingImplementResult(resultPath) {
         assertImplementWorkerResult(result, resultPath);
         return result;
     }
-    catch {
+    catch (err) {
+        // Present but invalid: do NOT treat it as absent (which would let the block
+        // be silently dropped from the merge). Archive the corrupt file and surface
+        // the reason so a clean re-dispatch produces a valid result.
+        process.stderr.write(`[remediate-code] dispatch: existing implement result ${resultPath} is present but ` +
+            `invalid (${err instanceof Error ? err.message : String(err)}); archiving and re-dispatching\n`);
+        await archiveIncompleteImplementResult(resultPath);
         return undefined;
     }
 }
@@ -1773,32 +1835,47 @@ allowed in addition to the file access above.
 // Infra-modifying block detection
 // ---------------------------------------------------------------------------
 /**
- * Canonical set of infra files whose modification can break the live dispatcher
- * while the run is in progress. Paths are repo-relative forward-slash strings.
+ * The live dispatch/orchestration modules whose modification can break the
+ * running engine mid-run. Derived from the REAL post-A12 source layout
+ * (`src/remediate/...`) — this module IS one of them (`steps/dispatch.ts`), so
+ * the list is anchored to the actual files on disk, not a hand-typed monorepo
+ * path that drifts when the tree is reorganised (the pre-A12
+ * `packages/remediate-code/...` list silently matched NOTHING after the
+ * collapse, so every infra block rendered as non-infra). Each entry is the
+ * module's path relative to the `src/remediate` area, forward-slash form.
  */
-const INFRA_FILE_PATHS = new Set([
-    "packages/remediate-code/src/steps/nextStep.ts",
-    "packages/remediate-code/src/steps/dispatch.ts",
-    "packages/remediate-code/src/state/store.ts",
-    "packages/remediate-code/src/steps/contractPipeline.ts",
-    "packages/remediate-code/src/steps/waveScheduler.ts",
-    "packages/remediate-code/src/steps/stepWriter.ts",
-]);
+const INFRA_MODULE_SUBPATHS = [
+    "steps/nextStep.ts",
+    "steps/dispatch.ts",
+    "state/store.ts",
+    "steps/contractPipeline.ts",
+    "steps/stepWriter.ts",
+];
 /**
- * Returns true when any path in `writePaths` matches the set of infra files
- * (normalised to repo-relative forward-slash strings). Used to gate the
- * live-surface verification section in the implement prompt.
+ * The infra module sub-paths anchored under `src/remediate/` — the canonical
+ * repo-relative form for the current (post-A12) single-package layout. A write
+ * path matches when its normalised (forward-slash) form ends with one of these
+ * segments, so an absolute worktree path
+ * (`.../worktrees/foo/src/remediate/steps/dispatch.ts`), a repo-relative path
+ * (`src/remediate/steps/dispatch.ts`), or a Windows backslash path all match,
+ * while a same-basename file in another area (`src/audit/steps/dispatch.ts`)
+ * does not.
+ */
+const INFRA_FILE_SEGMENTS = INFRA_MODULE_SUBPATHS.map((sub) => `src/remediate/${sub}`);
+/**
+ * Returns true when any path in `writePaths` is one of the live infra modules.
+ * Paths are normalised to forward-slash form (win32 backslash → `/`) and matched
+ * by trailing repo-relative segment so absolute/worktree/relative spellings all
+ * resolve identically. Used to gate the live-surface verification section in the
+ * implement prompt.
  */
 export function isInfraModifyingBlock(writePaths) {
     for (const p of writePaths) {
         const normalized = p.replace(/\\/g, "/");
-        if (INFRA_FILE_PATHS.has(normalized))
-            return true;
-        // Also match if the path ends with the infra file's relative segment,
-        // e.g. an absolute path like /abs/root/packages/remediate-code/src/steps/dispatch.ts
-        for (const infraPath of INFRA_FILE_PATHS) {
-            if (normalized.endsWith("/" + infraPath))
+        for (const segment of INFRA_FILE_SEGMENTS) {
+            if (normalized === segment || normalized.endsWith("/" + segment)) {
                 return true;
+            }
         }
     }
     return false;