audit-tools 0.36.0 → 0.36.2

package/dist/remediate/steps/nextStep.js

@@ -21,7 +21,7 @@ import { groundExtractedFindings } from "../phases/grounding.js";
 import { runTriagePhase } from "../phases/triage.js";
 import { runClosePhase } from "../phases/close.js";
 import { validateRemediationPlan } from "../validation/remediationState.js";
-import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, targetedCommandsForBlock, } from "./dispatch.js";
+import { mergeImplementResults, prepareImplementDispatch, readExtractedPlanIfPresent, buildConfirmedPools, executeNodeInWorktree, blockScopesFromPlan, targetedCommandsForBlock, readDispatchPlan, } from "./dispatch.js";
 import { makeProviderNodeDispatcher } from "./providerNodeDispatch.js";
 import { prepareHostRollingDispatch, nodeClaimRegistry, nodeSettledPoolsPath } from "./rollingSession.js";
 import { ClaimRegistry } from "../../shared/quota/claimRegistry.js";
@@ -156,6 +156,18 @@ export function detectStructuralRefusalPause(quota) {
         refusedIds,
     };
 }
+/**
+ * Read the admission record backing the zero-frontier structural-refusal
+ * discriminator. `quotaPath` is null for an ATTENDED host (hostOwnedDispatch —
+ * the host owns provider selection/pacing, so NO admission record exists); a
+ * null path is the no-signal case, never a crash: no record ⇒ no structural
+ * refusal ⇒ the caller folds the empty frontier straight to merge. (v0.36.1
+ * zero-frontier crash, accept/reverify cluster defect 5: the call site asserted
+ * `quotaPath!` and the read threw on the attended-host null.)
+ */
+export async function structuralRefusalForZeroFrontier(quotaPath) {
+    return detectStructuralRefusalPause(quotaPath ? await readOptionalJsonFile(quotaPath) : undefined);
+}
 function randomRunId(prefix = "RUN") {
     return `${prefix}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -782,36 +794,70 @@ export async function driveRollingImplementDispatch(options) {
         // or double-merge it; the run-level `mergeImplementResults` reconciles from the
         // peer's accept outcome.
         if (!claimTokens.has(block.block_id)) {
-            const claim = await registry.claim(block.block_id, "in-process");
-            if (!claim.acquired) {
-                nodeOutcomes.push({ block_id: block.block_id, outcome: "success", verify_passed: false, merged: false, pool_id: slot.poolId });
+            try {
+                const claim = await registry.claim(block.block_id, "in-process");
+                if (!claim.acquired) {
+                    nodeOutcomes.push({ block_id: block.block_id, outcome: "success", verify_passed: false, merged: false, pool_id: slot.poolId });
+                    return {
+                        packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
+                        outcome: "success",
+                    };
+                }
+                claimTokens.set(block.block_id, claim.ownerToken);
+            }
+            catch (err) {
+                // Claim acquisition failed — return error outcome without rejecting, per
+                // contract. Release is skipped since we never acquired the claim.
+                nodeOutcomes.push({ block_id: block.block_id, outcome: "error", verify_passed: false, merged: false, pool_id: slot.poolId });
                 return {
                     packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
-                    outcome: "success",
+                    outcome: "error",
+                    error: err,
                 };
             }
-            claimTokens.set(block.block_id, claim.ownerToken);
         }
         // The shared per-node worktree lifecycle (reset → create → link node_modules →
         // seed → dispatch → commit/verify/write-scope/merge → record), identical to the
         // A-8 hybrid executor and behaviourally to the host-subagent driver's
         // `accept-node` callback. `touched_files` is the block's authoritative declared
         // write set (the source the dispatch plan's write scope is derived from).
-        const { result, accept } = await executeNodeInWorktree({
-            block,
-            slot,
-            root,
-            artifactsDir,
-            runId,
-            resultPath,
-            seedPaths: block.touched_files,
-            allBlockScopes,
-            additionalVerifyCommands: targetedCommandsForBlock(state, block.block_id),
-            dispatchNode,
-            // Merge-time ownership gate (OD3 layer 2, D-66/67 slice-1): the SAME lease
-            // this driver just claimed (or re-claimed on a rate_limited re-queue) above.
-            ownership: { registry, nodeId: block.block_id, ownerToken: claimTokens.get(block.block_id) },
-        });
+        let result;
+        let accept;
+        try {
+            ({ result, accept } = await executeNodeInWorktree({
+                block,
+                slot,
+                root,
+                artifactsDir,
+                runId,
+                resultPath,
+                seedPaths: block.touched_files,
+                allBlockScopes,
+                additionalVerifyCommands: targetedCommandsForBlock(state, block.block_id),
+                dispatchNode,
+                // Merge-time ownership gate (OD3 layer 2, D-66/67 slice-1): the SAME lease
+                // this driver just claimed (or re-claimed on a rate_limited re-queue) above.
+                ownership: { registry, nodeId: block.block_id, ownerToken: claimTokens.get(block.block_id) },
+            }));
+        }
+        catch (err) {
+            // Worker execution failed — return error outcome without rejecting, per
+            // contract. Release the claim since we must free it on exception to prevent
+            // blocking peer drivers.
+            try {
+                await releaseNodeClaim(registry, claimTokens, block.block_id);
+            }
+            catch (releaseErr) {
+                // Log release failure but don't escalate — node outcome already records the
+                // execution error as the primary failure mode.
+            }
+            nodeOutcomes.push({ block_id: block.block_id, outcome: "error", verify_passed: false, merged: false, pool_id: slot.poolId });
+            return {
+                packet: { id: block.block_id, payload: { block_id: block.block_id }, estimatedTokens: 0, complexity: 0.5 },
+                outcome: "error",
+                error: err,
+            };
+        }
         nodeOutcomes.push({
             block_id: block.block_id,
             outcome: accept.outcome,
@@ -1553,7 +1599,7 @@ async function buildImplementDispatchStep(ctx) {
             // stay PENDING, and the quota_paused step renders the fit-mismatch cause
             // ("free a larger pool or split the node"), never "wait for a reset".
             if (rolling.session.frontier.length === 0) {
-                const structuralRefusal = detectStructuralRefusalPause(await readOptionalJsonFile(rolling.quotaPath));
+                const structuralRefusal = await structuralRefusalForZeroFrontier(rolling.quotaPath);
                 if (structuralRefusal.pause) {
                     if (rolling.quotaPath) {
                         await reconcileAdmissionLeasesFromQuotaFile(rolling.quotaPath);
@@ -2813,6 +2859,31 @@ async function applyPlanClarificationResolution(root, artifactsDir, state, store
     if (existsSync(resolutionPath)) {
         await withFsRetry(() => rename(resolutionPath, `${resolutionPath}.consumed-${Date.now()}`));
     }
+    // Accept/reverify cluster defect 6: the worker's needs_clarification result
+    // survives at the block's CONSTANT result_path, so the very next merge
+    // (often within this same drain) re-reads it, flips the just-answered item
+    // back to needs_clarification, and re-asks the operator. Archive each
+    // clarified finding's block result at consume time — an ABSENT result file
+    // is the benign "worker hasn't run yet → re-dispatch from scratch" branch,
+    // exactly the state the answer re-opens the item into. (reject_finding /
+    // defer close their items terminally, so the stale file cannot re-open them
+    // — only `clarified` needs the retire.)
+    const clarifiedIds = new Set(resolutions
+        .filter((r) => r.action !== "reject_finding" && r.action !== "defer")
+        .map((r) => r.finding_id));
+    if (clarifiedIds.size > 0) {
+        const owningBlockIds = new Set((state.plan.blocks ?? [])
+            .filter((b) => b.items.some((id) => clarifiedIds.has(id)))
+            .map((b) => b.block_id));
+        const dispatchPlan = await readDispatchPlan(artifactsDir, stateRunId(state), "implement").catch(() => null);
+        for (const planItem of dispatchPlan?.items ?? []) {
+            if (typeof planItem.block_id === "string" &&
+                owningBlockIds.has(planItem.block_id) &&
+                existsSync(planItem.result_path)) {
+                await withFsRetry(() => rename(planItem.result_path, `${planItem.result_path}.consumed-${Date.now()}`));
+            }
+        }
+    }
     const remainingPending = state.plan.findings.some((f) => state.items?.[f.id]?.status === "pending");
     // Undecided-remainder guard, mirroring triage's still-blocked guard: a
     // resolution covering only SOME of the paused items must not fall through to