baxian 1.2.49 → 1.2.51

package/dist/agent/manager.js

@@ -3,11 +3,13 @@ import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { createSignalToken } from './phase-signal.js';
 import { tmuxInstallHint } from './preflight.js';
-import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, isGitHubRepo, repoSlug, } from '../shared/index.js';
+import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES_AGENT_BOUND_TO_TASK, TASK_TERMINAL_STATUSES as TERMINAL_STATUSES, TASK_ACTIVE_STATUS_SET as ACTIVE_TASK_STATUSES, isGitHubRepo, parseGitRemote, repoSlug, } from '../shared/index.js';
 import { AGENT_STORE_NOOP } from '../state/agent-store.js';
 import { PostApproveStore } from '../state/post-approve-store.js';
 import { SkillRegistry } from '../skill/registry.js';
 import { createRunner, LocalRunner, shellQuote, resolveAgentHost, hostGroupKey } from './runner.js';
+import { GH_EXEC_TIMEOUT_MS, GIT_NET_ENV, execNetwork } from './net-exec.js';
+import { findForeignTaskTip } from './lineage.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
 import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, hasOscTitleWorking, hasOscTitleIdle, screenAllowsTitleIdle, } from './tmux.js';
 import { WorktreeManager } from './worktree.js';
@@ -74,6 +76,8 @@ function agentRuntimeKindFor(agent) {
 }
 const DEFAULT_DISPATCH_ACK_TIMEOUT_MS = 30_000;
 const DEFAULT_DISPATCH_SETTLE_TIMEOUT_MS = 3_000;
+const GH_NET = { timeout: GH_EXEC_TIMEOUT_MS, retries: 1 };
+const MANUAL_SERVER_REVIEW_STATUSES = ['in_progress', 'review', 'fixing'];
 const IMAGE_DISPATCH_PHASES = new Set(['develop', 'code', 'fix', 'server-feedback']);
 const RUNTIME_LIVENESS_SAMPLES = 3;
 export function canDispatchWithBinding(binding) {
@@ -120,6 +124,7 @@ export class AgentManager {
     errorRecordStore;
     reviewStore;
     reviewTransportInstance;
+    serverReviewDriver;
     dispatchAckTimeoutMs;
     dispatchSettleTimeoutMs;
     dispatchAckResendIntervalMs = 3_000;
@@ -189,6 +194,9 @@ export class AgentManager {
     getReviewStore() {
         return this.reviewStore;
     }
+    setServerReviewDriver(driver) {
+        this.serverReviewDriver = driver;
+    }
     effectiveReviewMode(projectId) {
         const project = this.getProjectConfig(projectId);
         return project?.review?.mode ?? this.config.review.mode ?? 'github';
@@ -2130,7 +2138,7 @@ export class AgentManager {
         });
     }
     async ghCreatedAt(endpoint, jq) {
-        const result = await this.platformRunner.exec(`gh api --paginate ${shellQuote(endpoint)} --jq ${shellQuote(jq)}`);
+        const result = await execNetwork(this.platformRunner, `gh api --paginate ${shellQuote(endpoint)} --jq ${shellQuote(jq)}`, GH_NET);
         if (result.exitCode !== 0) {
             throw new Error(`gh api ${endpoint} failed: ${result.stderr || result.stdout}`);
         }
@@ -2145,7 +2153,7 @@ export class AgentManager {
         if (!project) {
             throw new Error(`fetchPrHeadSha: unknown project ${task.projectId}`);
         }
-        const result = await this.platformRunner.exec(`gh pr view ${task.prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefOid --jq .headRefOid`);
+        const result = await execNetwork(this.platformRunner, `gh pr view ${task.prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefOid --jq .headRefOid`, GH_NET);
         if (result.exitCode !== 0) {
             throw new Error(`gh pr view failed for PR #${task.prNumber}: ${result.stderr || result.stdout}`);
         }
@@ -2162,8 +2170,8 @@ export class AgentManager {
         const project = this.getProjectConfig(task.projectId);
         if (!project)
             return undefined;
-        const result = await this.platformRunner.exec(`gh pr view ${prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefName,headRefOid --jq '.headRefName + "\\t" + .headRefOid'`);
-        if (result.exitCode !== 0)
+        const result = await execNetwork(this.platformRunner, `gh pr view ${prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefName,headRefOid --jq '.headRefName + "\\t" + .headRefOid'`, GH_NET).catch(() => undefined);
+        if (!result || result.exitCode !== 0)
             return undefined;
         const [headRefName, headSha] = result.stdout.trim().split('\t');
         if (!headRefName || !/^[0-9a-f]{40}$/i.test(headSha))
@@ -2176,7 +2184,7 @@ export class AgentManager {
         const project = this.getProjectConfig(projectId);
         if (!project)
             return undefined;
-        const result = await this.platformRunner.exec(`gh pr view ${prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefName,headRefOid,body,state,isCrossRepository --jq '.headRefName + "\\t" + .headRefOid + "\\t" + .state + "\\t" + (.isCrossRepository | tostring) + "\\t" + .body'`);
+        const result = await execNetwork(this.platformRunner, `gh pr view ${prNumber} --repo ${shellQuote(repoSlug(project.repo))} --json headRefName,headRefOid,body,state,isCrossRepository --jq '.headRefName + "\\t" + .headRefOid + "\\t" + .state + "\\t" + (.isCrossRepository | tostring) + "\\t" + .body'`, GH_NET);
         if (result.exitCode !== 0) {
             const stderr = result.stderr ?? '';
             if (stderr.includes('Could not resolve to a PullRequest'))
@@ -2284,12 +2292,19 @@ export class AgentManager {
     }
     async resolveAutoBaseRef(runner, workdir) {
         const result = await runner.exec(`git -C ${shellQuote(workdir)} rev-parse --verify --quiet origin/HEAD`);
-        return result.exitCode === 0 ? 'origin/HEAD' : undefined;
+        if (result.exitCode !== 0) {
+            // Falling back to the shared clone's HEAD would seed the worktree with whatever
+            // another agent left checked out — refuse instead of silently cross-contaminating.
+            throw new Error(`origin/HEAD is unresolvable in ${workdir}; ` +
+                `run "git -C ${workdir} remote set-head origin --auto" and redispatch`);
+        }
+        return 'origin/HEAD';
     }
     getRepoCache() {
         return this.repoCache;
     }
-    async rollbackFailedDispatch(taskId, agentId) {
+    async rollbackFailedDispatch(taskId, agentId, reason) {
+        let rolledBack = null;
         await this.withTaskLock(async () => {
             const task = await this.taskStore.get(taskId);
             if (!task)
@@ -2300,7 +2315,23 @@ export class AgentManager {
             task.status = 'pending';
             task.updatedAt = new Date().toISOString();
             await this.taskStore.set(task);
+            rolledBack = { projectId: task.projectId };
         });
+        if (rolledBack && reason) {
+            await this.safeEmit({
+                id: '',
+                type: 'human.intervention',
+                timestamp: new Date().toISOString(),
+                projectId: rolledBack.projectId,
+                agentId,
+                taskId,
+                data: {
+                    phase: reason.phase,
+                    message: reason.message,
+                    note: 'Dispatch failed; the task is back in pending — re-dispatch it once the cause is resolved.',
+                },
+            });
+        }
         const existing = await this.agentStore.get(agentId);
         if (existing && existing.taskId !== taskId) {
             console.warn(`[AgentManager] rollback: agent ${agentId} taskId mismatch (expected ${taskId}, got ${existing.taskId}); ` +
@@ -2578,7 +2609,10 @@ export class AgentManager {
                 await this.releaseAgentForTask(agentId, taskId, 'idle', { allowAwaitingHuman: true });
             }
             else {
-                await this.rollbackFailedDispatch(taskId, agentId);
+                await this.rollbackFailedDispatch(taskId, agentId, dispatchErr ? {
+                    phase: 'dispatch-rollback',
+                    message: dispatchErr instanceof Error ? dispatchErr.message : String(dispatchErr),
+                } : undefined);
             }
         }
         return (await this.taskStore.get(taskId)) ?? null;
@@ -2834,7 +2868,10 @@ export class AgentManager {
         else if (dispatchErr instanceof EnsureSessionError && dispatchErr.partial.handled) {
         }
         else {
-            await this.rollbackFailedDispatch(claimed.id, claimed.agentId);
+            await this.rollbackFailedDispatch(claimed.id, claimed.agentId, dispatchErr ? {
+                phase: 'dispatch-rollback',
+                message: dispatchErr instanceof Error ? dispatchErr.message : String(dispatchErr),
+            } : undefined);
         }
         const refreshed = await this.taskStore.get(claimed.id);
         if (dispatchErr === null) {
@@ -2906,16 +2943,15 @@ export class AgentManager {
         const runner = this.createRunnerFor(agent);
         const worktree = new WorktreeManager(runner);
         const tmux = new TmuxManager(runner);
-        const baseRef = agent.workdir
-            ? undefined
-            : await this.resolveAutoBaseRef(runner, workdir);
         const isServerQaPhase = phase === 'server-review' || phase === 'server-recheck' || phase === 'server-spec-review';
         const customBranch = task.branch && !task.branch.startsWith(BRANCH_PREFIX) ? task.branch : undefined;
+        // review/recheck check out the PR branch detached and never touch origin/HEAD,
+        // so the fail-fast base resolution only runs where the default base is used.
         const worktreePath = isServerQaPhase
             ? await worktree.createDetachedAtBase(workdir, taskId)
             : phase === 'review' || phase === 'recheck'
                 ? await worktree.createDetached(workdir, taskId, task.branch)
-                : await worktree.create(workdir, taskId, baseRef, customBranch);
+                : await worktree.create(workdir, taskId, agent.workdir ? undefined : await this.resolveAutoBaseRef(runner, workdir), customBranch);
         await this.agentStore.update(agentId, (stateNow) => {
             if (!stateNow || stateNow.taskId !== taskId)
                 return AGENT_STORE_NOOP;
@@ -3713,11 +3749,14 @@ export class AgentManager {
             const task = await this.taskStore.get(taskId);
             if (!task)
                 throw new ApiError(404, 'Task not found');
-            if (TERMINAL_STATUSES.includes(task.status))
-                return task;
             if (this.markCompleteInFlight.has(taskId)) {
                 throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`);
             }
+            // 终态不早退：状态不再改写，但残留的 pane/绑定（上次清理中途失败）仍走同一条强制清理路径。
+            // 唯一例外：清理已在进行中的重复取消——重跑只会重复中断同一批 pane，等它收尾即可。
+            const alreadyTerminal = TERMINAL_STATUSES.includes(task.status);
+            if (alreadyTerminal && this.cancelCleanupInFlight.has(taskId))
+                return task;
             if (task.agentId)
                 devToRelease = task.agentId;
             if (task.qaAgentId)
@@ -3736,12 +3775,14 @@ export class AgentManager {
                     };
                 }
             }
-            else if (task.status === 'merge-ready' && task.prNumber !== undefined && task.branch && task.agentId) {
+            else if (!alreadyTerminal && task.reviewMode !== 'server' && task.prNumber !== undefined && task.branch) {
+                // github 模式持有开放 PR 的任务（review/fixing/approved/merge-ready/max_rounds 等）取消时关 PR 删分支；
+                // server 模式仍只信 gate+marker——非 gate 状态上的孤立 prNumber 不足以证明远端有待回收的工件
                 publishedCleanup = {
                     afterDone: 'pr',
                     branch: task.branch,
                     prNumber: task.prNumber,
-                    devAgentId: task.agentId,
+                    ...(task.agentId ? { devAgentId: task.agentId } : {}),
                     mayBeInFlight: false,
                 };
             }
@@ -3749,18 +3790,20 @@ export class AgentManager {
                 if (id)
                     await this.markPaneCancelClearing(id, taskId);
             }
-            const now = new Date().toISOString();
-            task.status = 'cancelled';
-            task.updatedAt = now;
-            await this.taskStore.set(task);
-            await this.safeEmit({
-                id: '',
-                type: 'task.updated',
-                timestamp: now,
-                projectId: task.projectId,
-                taskId,
-                data: { status: 'cancelled' },
-            });
+            if (!alreadyTerminal) {
+                const now = new Date().toISOString();
+                task.status = 'cancelled';
+                task.updatedAt = now;
+                await this.taskStore.set(task);
+                await this.safeEmit({
+                    id: '',
+                    type: 'task.updated',
+                    timestamp: now,
+                    projectId: task.projectId,
+                    taskId,
+                    data: { status: 'cancelled' },
+                });
+            }
             this.claimCancelCleanup(taskId);
             cleanupClaimed = true;
             return task;
@@ -3823,18 +3866,31 @@ export class AgentManager {
             const project = this.getProjectConfig(result.projectId);
             try {
                 if (publishedCleanup.afterDone === 'pr' && publishedCleanup.prNumber !== undefined && project) {
-                    const close = await this.platformRunner.exec(`gh pr close ${publishedCleanup.prNumber} --repo ${shellQuote(repoSlug(project.repo))} ` +
-                        `--comment ${shellQuote('Task cancelled in baxian; closing the published PR.')} --delete-branch`);
+                    const close = await execNetwork(this.platformRunner, `gh pr close ${publishedCleanup.prNumber} --repo ${shellQuote(repoSlug(project.repo))} ` +
+                        `--comment ${shellQuote('Task cancelled in baxian; closing the published PR.')}`, GH_NET);
                     if (close.exitCode !== 0)
                         throw new Error(close.stderr.trim() || close.stdout.trim());
+                    // Branch deletion is a separate idempotent step, not `--delete-branch`:
+                    // a retried close that finds the PR already closed exits 0 before gh's
+                    // branch-deletion block, which would report success while leaking the
+                    // published branch.
+                    const refPath = `repos/${repoSlug(project.repo)}/git/refs/heads/` +
+                        encodeURIComponent(publishedCleanup.branch).replace(/%2F/gi, '/');
+                    const del = await execNetwork(this.platformRunner, `gh api -X DELETE ${shellQuote(refPath)}`, GH_NET);
+                    if (del.exitCode !== 0 && !del.stderr.includes('Reference does not exist')) {
+                        throw new Error(del.stderr.trim() || del.stdout.trim());
+                    }
                 }
-                else {
+                else if (publishedCleanup.devAgentId) {
                     const dev = this.getAgentConfig(publishedCleanup.devAgentId);
                     const state = await this.agentStore.get(publishedCleanup.devAgentId);
                     if (dev && state?.repoPath) {
-                        const del = await this.createRunnerFor(dev).exec(`cd ${shellQuote(state.repoPath)} && git push origin --delete ${shellQuote(publishedCleanup.branch)}`);
-                        if (del.exitCode !== 0)
+                        const del = await execNetwork(this.createRunnerFor(dev), `cd ${shellQuote(state.repoPath)} && ${GIT_NET_ENV} git push origin --delete ${shellQuote(publishedCleanup.branch)}`);
+                        // The goal is "branch absent": a retried delete whose first round
+                        // landed reports a missing remote ref, which is success, not failure.
+                        if (del.exitCode !== 0 && !del.stderr.includes('remote ref does not exist')) {
                             throw new Error(del.stderr.trim() || del.stdout.trim());
+                        }
                     }
                 }
             }
@@ -3903,11 +3959,31 @@ export class AgentManager {
             if (opts.expectSignalToken !== undefined && task.signalToken !== opts.expectSignalToken) {
                 throw new ApiError(409, `Task ${taskId} review pass changed during redispatch (signalToken rotated); aborting`);
             }
-            if (task.reviewMode === 'server') {
-                throw new ApiError(409, `Task ${taskId} uses server review mode; Call review applies only to github-mode tasks`);
-            }
-            if (task.phase === 'spec' && task.status === 'max_rounds') {
-                throw new ApiError(409, `Call review is not supported for spec-phase max_rounds tasks (use Retry or Cancel)`);
+            if (task.reviewMode === 'server' || task.phase === 'spec') {
+                if (!MANUAL_SERVER_REVIEW_STATUSES.includes(task.status)) {
+                    throw new ApiError(409, `Task ${taskId} status is ${task.status}; manual server-side review requires ${MANUAL_SERVER_REVIEW_STATUSES.join('/')}`);
+                }
+                if (!this.serverReviewDriver) {
+                    throw new ApiError(409, `Server review pipeline is not configured; cannot dispatch review for ${taskId}`);
+                }
+                // in_progress 且 phase 未定：dev 既可能交 spec-done 也可能交 code-done，评审对象无从判定
+                if (task.status === 'in_progress' && task.phase === undefined) {
+                    throw new ApiError(409, `Task ${taskId} has no phase yet (the dev has not delivered spec-done/code-done); wait for the dev signal or use Cancel/Retry`);
+                }
+                // 手工发起=明确要求跑一次 QA 评审；无 QA 时必须拒绝，不得落入自动通过/停驻兜底
+                const qaAvailable = (task.qaAgentId !== undefined && !!this.getAgentConfig(task.qaAgentId))
+                    || !!this.findQaPartner(task.agentId);
+                if (!qaAvailable) {
+                    throw new ApiError(400, `Task ${taskId} has no QA partner configured; manual review requires a QA agent`);
+                }
+                const isSpec = task.phase === 'spec';
+                const cap = this.config.review.rounds + (task.maxRoundsContinues ?? 0);
+                const round = isSpec ? (task.specReviewRound ?? 0) : task.reviewRound;
+                if (round + 1 > cap) {
+                    throw new ApiError(409, `Task ${taskId} reached the review round cap (${cap}); continue or cancel it instead`);
+                }
+                this.manualReviewInFlight.add(taskId);
+                return { mode: 'server', isSpec, claimToken: task.signalToken };
             }
             if (!task.prNumber) {
                 throw new ApiError(400, `Task ${taskId} has no PR yet; cannot dispatch review`);
@@ -3929,8 +4005,11 @@ export class AgentManager {
                 qaId = qa.id;
             }
             this.manualReviewInFlight.add(taskId);
-            return { qaId, devAgentId: task.agentId, taskStatusAtClaim: task.status };
+            return { mode: 'github', qaId, devAgentId: task.agentId, taskStatusAtClaim: task.status };
         });
+        if (claim.mode === 'server') {
+            return this.runManualServerReview(taskId, claim);
+        }
         try {
             const { qaId, devAgentId, taskStatusAtClaim } = claim;
             const isTerminal = TERMINAL_STATUSES.includes(taskStatusAtClaim);
@@ -4061,6 +4140,27 @@ export class AgentManager {
             this.manualReviewInFlight.delete(taskId);
         }
     }
+    async runManualServerReview(taskId, claim) {
+        try {
+            // 不在此处预释放旧 QA：可失败的准备工作（读 diff/spec、存轮次）失败时旧 pass 必须原样保留；
+            // 同任务的 QA 重新绑定由 dispatchServerReviewToQa 在派发前完成
+            const fresh = await this.taskStore.get(taskId);
+            if (!fresh || fresh.signalToken !== claim.claimToken
+                || !MANUAL_SERVER_REVIEW_STATUSES.includes(fresh.status)) {
+                throw new ApiError(409, `Task ${taskId} changed during manual review dispatch; aborting`);
+            }
+            const dispatched = claim.isSpec
+                ? await this.serverReviewDriver.dispatchSpecReview(fresh)
+                : await this.serverReviewDriver.dispatchCodeReview(fresh);
+            if (!dispatched) {
+                throw new ApiError(500, `Manual review dispatch for ${taskId} did not start; check the event feed for the cause`);
+            }
+            return (await this.taskStore.get(taskId));
+        }
+        finally {
+            this.manualReviewInFlight.delete(taskId);
+        }
+    }
     async continueDevRound(taskId) {
         if (this.markCompleteInFlight.has(taskId)) {
             throw new ApiError(409, `Task ${taskId} is being completed (merge in progress); try again shortly`);
@@ -4413,7 +4513,9 @@ export class AgentManager {
         const matchHead = opts.matchHeadSha
             ? ` --match-head-commit ${shellQuote(opts.matchHeadSha)}`
             : '';
-        const result = await this.platformRunner.exec(`gh pr merge ${task.prNumber} --repo ${shellQuote(repoSlug(project.repo))}${matchHead} --squash --delete-branch`);
+        // A merge is not idempotent from the caller's view (user-triggered, retryable
+        // in the UI), so it gets a timeout but no automatic retry.
+        const result = await execNetwork(this.platformRunner, `gh pr merge ${task.prNumber} --repo ${shellQuote(repoSlug(project.repo))}${matchHead} --squash --delete-branch`, { retries: 0 });
         if (result.exitCode !== 0) {
             throw new Error(`gh pr merge failed for PR #${task.prNumber}: ${result.stderr || result.stdout}`);
         }
@@ -4848,13 +4950,17 @@ export class AgentManager {
         const armed = await this.setupPhaseSignalWatcher(taskId, agentId, expectedKinds, newToken);
         return { token: newToken, armed };
     }
-    async rollbackVerdictArmFailure(taskId, restore) {
-        await this.withTaskLock(async () => {
+    async rollbackVerdictArmFailure(taskId, restore, opts = {}) {
+        const expected = opts.expect;
+        const rolledBack = await this.withTaskLock(async () => {
             const fresh = await this.taskStore.get(taskId);
             if (!fresh)
-                return;
+                return false;
             if (TERMINAL_STATUSES.includes(fresh.status))
-                return;
+                return false;
+            // pass 已被并发接管（token 轮换或状态推进）时禁止回滚，否则会覆盖接管方刚写入的新 pass
+            if (expected && (fresh.status !== expected.status || fresh.signalToken !== expected.signalToken))
+                return false;
             await this.taskStore.set({
                 ...fresh,
                 status: restore.status,
@@ -4864,19 +4970,26 @@ export class AgentManager {
                 qaAgentId: undefined,
                 updatedAt: new Date().toISOString(),
             });
+            return true;
         });
+        if (!rolledBack)
+            return false;
+        await this.rearmPhaseSignalForCurrentPass(taskId, { skipSnapshot: opts.rearmSkipSnapshot });
+        return true;
+    }
+    async rearmPhaseSignalForCurrentPass(taskId, opts = {}) {
         if (!this.phaseSignalWatcher)
             return;
-        const restored = await this.taskStore.get(taskId);
-        if (!restored?.signalToken)
+        const task = await this.taskStore.get(taskId);
+        if (!task?.signalToken)
             return;
-        if (TERMINAL_STATUSES.includes(restored.status))
+        if (TERMINAL_STATUSES.includes(task.status))
             return;
-        const mapped = this.mapTaskStateToExpectedWatcher(restored);
-        if (mapped) {
-            await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds);
-            await this.tearDownWatcherIfTaskTerminal(taskId);
-        }
+        const mapped = this.mapTaskStateToExpectedWatcher(task);
+        if (!mapped)
+            return;
+        await this.setupPhaseSignal(taskId, mapped.agentId, mapped.expectedKinds, opts.skipSnapshot ? { skipSnapshot: true } : undefined);
+        await this.tearDownWatcherIfTaskTerminal(taskId);
     }
     async parkTaskAtSpecReady(taskId, opts = {}) {
         const task = await this.taskStore.get(taskId);
@@ -5078,7 +5191,13 @@ export class AgentManager {
             if (task.reviewMode !== 'server' && opts.phase !== 'spec') {
                 throw new Error(`dispatchServerReviewToQa: task ${taskId} is not in server review mode`);
             }
-            const qaId = task.qaAgentId ?? this.findQaPartner(task.agentId)?.id;
+            let recordedQaId = task.qaAgentId;
+            if (recordedQaId && !this.getAgentConfig(recordedQaId)) {
+                console.warn(`[dispatchServerReviewToQa] task ${taskId}.qaAgentId="${recordedQaId}" no longer in config; ` +
+                    `falling back to findQaPartner(${task.agentId})`);
+                recordedQaId = undefined;
+            }
+            const qaId = recordedQaId ?? this.findQaPartner(task.agentId)?.id;
             if (!qaId) {
                 const entryKind = task.status === 'fixing'
                     ? (opts.phase === 'spec' ? 'spec-fixed' : 'code-fixed')
@@ -5125,12 +5244,20 @@ export class AgentManager {
             }).catch(() => undefined);
         };
         const rearmEntrySignal = async () => {
+            // 从 review 重派（手工发起）：入口信号早已被消费，dev 停驻等待中，无可重挂
+            if (claim.originalStatus === 'review')
+                return;
             const entryKind = claim.originalStatus === 'fixing'
                 ? (opts.phase === 'spec' ? 'spec-fixed' : 'code-fixed')
                 : (opts.phase === 'spec' ? 'spec-done' : 'code-done');
             await this.setupPhaseSignal(taskId, devAgentId, entryKind, { skipSnapshot: true });
         };
         if (!opts.continuation) {
+            const prevQa = await this.agentStore.get(qaId);
+            if (prevQa?.taskId === taskId) {
+                // 手工重派：上一 pass 的 QA 仍绑定本任务，先释放再重新 acquire（与 github 手工路径一致）
+                await this.releaseAgentForTask(qaId, taskId, 'idle');
+            }
             const acquired = await this.acquireAgentForTask(qaId, taskId, dispatchPhase);
             if (!acquired) {
                 await rearmEntrySignal();
@@ -5372,6 +5499,62 @@ export class AgentManager {
         await this.armPostDispatchSignalOrHold(taskId, devAgentId, expectedKind, newToken);
         return await this.taskStore.get(taskId);
     }
+    projectRepoKey(projectId) {
+        const repo = this.getProjectConfig(projectId)?.repo;
+        if (!repo)
+            return null;
+        if (isGitHubRepo(repo))
+            return `gh:${repoSlug(repo).toLowerCase()}`;
+        const parsed = parseGitRemote(repo);
+        if (parsed)
+            return `git:${parsed.host.toLowerCase()}/${parsed.path}`;
+        return `raw:${repo.trim()}`;
+    }
+    async findLineageViolation(taskId, baseSha) {
+        const task = await this.taskStore.get(taskId);
+        if (!task?.agentId)
+            return null;
+        const agent = this.getAgentConfig(task.agentId);
+        const agentState = await this.agentStore.get(task.agentId);
+        // A rebound agent's worktree belongs to its new task — checking it would
+        // produce verdicts about the wrong branch. Skip; the dispatch path's own
+        // binding guards (acquire) surface the real failure.
+        if (agentState?.taskId !== taskId)
+            return null;
+        const worktree = agentState.worktreePath;
+        if (!agent || !worktree)
+            return null;
+        const runner = this.createRunnerFor(agent);
+        let base = baseSha;
+        if (!base) {
+            // Callers without a baseSha (publish) run long after the review diff was
+            // read; refresh origin/HEAD first or upstream commits merged since then
+            // would linger in base..HEAD and flag tasks that leak nothing.
+            const fetch = await execNetwork(runner, `${GIT_NET_ENV} git -C ${shellQuote(worktree)} fetch origin --quiet`);
+            if (fetch.exitCode !== 0) {
+                throw new Error(`lineage fetch failed in ${worktree}: ${fetch.stderr.trim()}`);
+            }
+            const mb = await runner.exec(`git -C ${shellQuote(worktree)} merge-base origin/HEAD HEAD`);
+            if (mb.exitCode !== 0) {
+                throw new Error(`lineage merge-base failed in ${worktree}: ${mb.stderr.trim()}`);
+            }
+            base = mb.stdout.trim();
+        }
+        // Projects pointing at the same repo share one store and branch namespace,
+        // so candidates are scoped by repo identity, not by projectId.
+        const selfRepoKey = this.projectRepoKey(task.projectId);
+        if (!selfRepoKey)
+            return null;
+        const tasks = await this.taskStore.list();
+        const candidates = tasks
+            .filter(t => t.id !== taskId
+            && !TERMINAL_STATUSES.includes(t.status)
+            && this.projectRepoKey(t.projectId) === selfRepoKey)
+            .map(t => ({ taskId: t.id, branch: t.branch ?? BRANCH_PREFIX + t.id }));
+        if (candidates.length === 0)
+            return null;
+        return findForeignTaskTip((cmd) => runner.exec(cmd), worktree, base, candidates);
+    }
     async dispatchServerAfterDone(taskId, kind) {
         const task = await this.taskStore.get(taskId);
         if (!task)
@@ -5379,6 +5562,44 @@ export class AgentManager {
         const devAgentId = task.agentId;
         if (!devAgentId)
             throw new Error(`dispatchServerAfterDone: task ${taskId} has no dev agent`);
+        let violation;
+        try {
+            violation = await this.findLineageViolation(taskId);
+        }
+        catch (err) {
+            await this.safeEmit({
+                id: '',
+                type: 'human.intervention',
+                timestamp: new Date().toISOString(),
+                projectId: task.projectId,
+                agentId: devAgentId,
+                taskId,
+                data: {
+                    phase: 'server-after-done-lineage-check-failed',
+                    error: err instanceof Error ? err.message : String(err),
+                    note: 'Publish was not dispatched; mark-complete retries it once the repo state is fixed.',
+                },
+            });
+            return null;
+        }
+        if (violation) {
+            await this.safeEmit({
+                id: '',
+                type: 'human.intervention',
+                timestamp: new Date().toISOString(),
+                projectId: task.projectId,
+                agentId: devAgentId,
+                taskId,
+                data: {
+                    phase: 'server-after-done-lineage-violation',
+                    offendingTaskId: violation.taskId,
+                    offendingBranch: violation.branch,
+                    offendingSha: violation.sha,
+                    note: 'The task branch embeds another active task\'s commits; publishing would leak them into this PR. Rebase the branch onto origin/HEAD, then mark-complete to retry the publish.',
+                },
+            });
+            return null;
+        }
         const branch = task.branch ?? BRANCH_PREFIX + taskId;
         const originalToken = task.signalToken;
         const newToken = createSignalToken();
@@ -5640,7 +5861,7 @@ export class AgentManager {
             if (db.exitCode !== 0 || defaultBranch === '') {
                 throw new Error(`ffMergeBranch: cannot resolve default branch: ${db.stderr.trim() || 'empty origin/HEAD'}`);
             }
-            const fetch = await runner.exec(`${cd}git fetch origin`);
+            const fetch = await execNetwork(runner, `${cd}${GIT_NET_ENV} git fetch origin`);
             if (fetch.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [git fetch] failed: ${fetch.stderr.trim()}`);
             }
@@ -5654,12 +5875,12 @@ export class AgentManager {
             else {
                 throw new Error(`ffMergeBranch: no reviewed head recorded for task ${task.id}; cannot safely merge`);
             }
-            const push = await runner.exec(`${cd}git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
+            const push = await execNetwork(runner, `${cd}${GIT_NET_ENV} git push origin ${shellQuote(`origin/${branch}`)}:${shellQuote(defaultBranch)}`);
             if (push.exitCode !== 0) {
                 throw new Error(`ffMergeBranch [push] failed: ${push.stderr.trim() || push.stdout.trim()}`);
             }
-            const del = await runner.exec(`${cd}git push origin --delete ${shellQuote(branch)}`);
-            if (del.exitCode !== 0) {
+            const del = await execNetwork(runner, `${cd}${GIT_NET_ENV} git push origin --delete ${shellQuote(branch)}`);
+            if (del.exitCode !== 0 && !del.stderr.includes('remote ref does not exist')) {
                 console.warn(`[AgentManager] ffMergeBranch: post-merge branch delete failed for ${branch}: ${del.stderr.trim() || del.stdout.trim()}`);
             }
         });