dw-sdlc 0.13.0 → 0.15.0

package/dist/agentic-config.js

@@ -1,9 +1,9 @@
 // Reads what a repository declares for an agent: the committed config, the machine's local layer over it,
 // and what the repository implies; an invalid layer is dropped whole. The sdlc plugin's
 // `hooks/config.jq` is the same merge for the guards; this file is the reference, and the tests run both.
-import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { exec } from "./exec.js";
 import { validate } from "./json-schema.js";
 export const COMMITTED_FILE = ".ai/agentic.config.json";
 export const LOCAL_FILE = ".ai/agentic.config.local.json";
@@ -143,7 +143,7 @@ function readLayer(checkouts, file) {
 }
 /** The top level of the repository holding `dir`, or undefined outside one. */
 export function findRepository(dir) {
-    const toplevel = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    const toplevel = exec("git", ["-C", dir, "rev-parse", "--show-toplevel"]);
     return toplevel.status === 0 ? toplevel.stdout.trim() : undefined;
 }
 /** The top level of the repository holding `dir`, or `dir` itself outside one. */
@@ -156,7 +156,7 @@ export function repositoryRoot(dir) {
  */
 export function mainCheckout(root) {
     const args = ["-C", root, "rev-parse", "--path-format=absolute", "--git-dir", "--git-common-dir"];
-    const result = spawnSync("git", args, { encoding: "utf8" });
+    const result = exec("git", args);
     if (result.status !== 0) {
         return undefined;
     }

package/dist/checks/file-size-ratchet.js

@@ -1,8 +1,8 @@
 // `file-size-ratchet`: each file of code within the line limit of its group or, listed in the baseline,
 // within the count recorded there. A refresh only tightens the baseline: it lowers and drops, and adds no file.
-import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, matchesGlob } from "node:path";
+import { exec } from "../exec.js";
 import { CannotRun } from "./check.js";
 import { matching, treeFiles } from "./tree.js";
 const BASELINE = ".ai/file-size-ratchet.baseline.json";
@@ -58,7 +58,7 @@ function keyLines(text, path) {
 function readBaseline(root) {
     const path = join(root, BASELINE);
     if (!existsSync(path)) {
-        const committed = spawnSync("git", ["-C", root, "cat-file", "-e", `HEAD:${BASELINE}`]).status === 0;
+        const committed = exec("git", ["-C", root, "cat-file", "-e", `HEAD:${BASELINE}`]).status === 0;
         return { state: "missing", committed };
     }
     const text = readFileSync(path, "utf8");

package/dist/checks/tree.js

@@ -1,13 +1,13 @@
 // The files of a repository as git sees them, the directories above them, and the ones a Check's globs
 // pick out of them: what the Checks that judge many files read, so a file git ignores is never judged.
-import { spawnSync } from "node:child_process";
 import { existsSync, lstatSync, realpathSync } from "node:fs";
 import { join, matchesGlob, posix, relative } from "node:path";
+import { exec } from "../exec.js";
 import { CannotRun } from "./check.js";
 /** Every file under `pathspecs`, the whole tree when there are none, that git tracks or would track and that is on disk; sorted. */
 export function treeFiles(root, pathspecs = []) {
     const args = ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard", "--", ...pathspecs];
-    const listed = spawnSync("git", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    const listed = exec("git", args);
     if (listed.status !== 0) {
         const under = pathspecs.length === 0 ? "" : ` under ${pathspecs.join(", ")}`;
         const message = `cannot list the files${under}: not a git repository`;

package/dist/cli.js

@@ -55,5 +55,12 @@ async function main(argv) {
     return command.run(argv.slice(words));
 }
 if (import.meta.main) {
-    process.exitCode = await main(process.argv.slice(2));
+    try {
+        process.exitCode = await main(process.argv.slice(2));
+    }
+    catch (error) {
+        // What no command answered for stopped it before a verdict: exit 1 would read as one.
+        process.stderr.write(`dw-sdlc: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 2;
+    }
 }

package/dist/commands/doctor.js

@@ -1,13 +1,13 @@
 // `dw-sdlc doctor`: one PASS / WARN / FAIL line per machine check the sdlc plugin relies on, for the
 // repository holding --root and the user's home; it installs nothing. FAIL is a guard that does not guard
 // (no jq, plugin absent or disabled, an invalid config), WARN a layer missing, loose or out of step, INFO one that does not apply.
-import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { findRepository, resolveConfig } from "../agentic-config.js";
-import { checkPackage, checkPlugin, checkSessions, parseJson, runningPluginRoot, versionBefore } from "../doctor-plugins.js";
+import { checkPackage, checkPlugin, checkSessions, parseJson, runningPluginRoot, sessionsEnabled, versionBefore } from "../doctor-plugins.js";
+import { exec, TimedOut } from "../exec.js";
 import { isObject } from "../json-text.js";
 /** Claude Code's config dir: `$CLAUDE_CONFIG_DIR` when set, the way Claude Code reads it, else `~/.claude`. */
 export function claudeConfigDir(env, home) {
@@ -16,18 +16,30 @@ export function claudeConfigDir(env, home) {
 /** rtk find passes -exec through verbatim from this release; before it, `rtk find … -exec` exits 1. */
 export const RTK_FIND_EXEC_FIXED = "0.46.0";
 export const PNPM_MINIMUM_RELEASE_AGE = 10080;
+/** A probe past its limit answers as a tool that could not run, so its check reports it and the rest still run. */
+function probed(tool, args, cwd) {
+    try {
+        return exec(tool, args, cwd === undefined ? {} : { cwd });
+    }
+    catch (error) {
+        if (error instanceof TimedOut) {
+            return undefined;
+        }
+        throw error;
+    }
+}
 export const realProbe = {
     run(command, args, cwd) {
-        const result = spawnSync(command, args, { cwd, encoding: "utf8" });
-        return { status: result.status ?? 127, stdout: result.stdout ?? "" };
+        const result = probed(command, args, cwd);
+        return { status: result?.status ?? 127, stdout: result?.stdout ?? "" };
     },
     read(path) {
         return existsSync(path) ? readFileSync(path, "utf8") : undefined;
     },
     shell(script) {
         const shell = process.env.SHELL ?? "/bin/sh";
-        const result = spawnSync(shell, ["-l", "-c", script], { encoding: "utf8" });
-        return (result.stdout ?? "").trim().split("\n")[0] ?? "";
+        const result = probed(shell, ["-l", "-c", script]);
+        return (result?.stdout ?? "").trim().split("\n")[0] ?? "";
     }
 };
 function checkJq(probe) {
@@ -121,11 +133,18 @@ function checkRtk(probe, home, claude) {
         detail: `rtk ${version} behind the plugin's rewrite hook; exclude_commands: ${excludes.join(", ") || "none"}`
     };
 }
-/** herdr's `hc` in the agent's shell, which a Lead starts its Workers through; a machine may go without it. */
+/**
+ * herdr's `hc` in the agent's shell, which a Lead starts its Workers through. Its absence warns only where
+ * `sdlc-sessions` is enabled: a machine with only the guards has no reason to install herdr.
+ */
 function checkHc(probe) {
     const hc = probe.shell("command -v hc");
     if (hc === "") {
-        return { name: "hc", level: "INFO", detail: "no hc on PATH, so no /sdlc-delegate: install herdr to run Workers" };
+        return {
+            name: "hc",
+            level: sessionsEnabled(probe) ? "WARN" : "INFO",
+            detail: "no hc on PATH, so no /sdlc-delegate: install herdr to run Workers"
+        };
     }
     return { name: "hc", level: "PASS", detail: `${hc}, so a Lead can start Workers` };
 }

package/dist/commands/references-setup.js

@@ -1,10 +1,10 @@
 // `dw-sdlc references setup` sets a repository up to declare References: the files its USAGE names,
 // each written only when it would change. A list gains the entries it lacks at its end; the one removal
 // is a `references` key moving out of the agentic config. A file it cannot read as expected is refused.
-import { spawnSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { parseArgs } from "node:util";
+import { exec } from "../exec.js";
 import { parseObject, removeKey, render } from "../json-text.js";
 import { CONFIG, REFERENCES_FILE, leftoverKey, leftoverProblem, parseReferences, readFile } from "../references-key.js";
 import { renderBlock, withBlock } from "../router-block.js";
@@ -159,7 +159,7 @@ function source(root) {
 }
 /** The repository `dir` sits in, or `dir` itself outside one. */
 function toplevel(dir) {
-    const result = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], { encoding: "utf8" });
+    const result = exec("git", ["-C", dir, "rev-parse", "--show-toplevel"]);
     return result.status === 0 ? result.stdout.trim() : dir;
 }
 function setup(root, dryRun) {

package/dist/commands/references-sync.js

@@ -1,11 +1,11 @@
 // `dw-sdlc references sync`, the Sync: every Reference `.ai/references.json` declares brought to its ref
 // under references/<dir>, each clone shallow, blobless, detached and sparse where its entry says. An
 // entry that fails fails alone, and a repository that declares no References gets no output at all.
-import { spawnSync } from "node:child_process";
 import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { extname, join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { parseArgs } from "node:util";
+import { exec, SLOW_LIMIT_MS } from "../exec.js";
 import { repositoryFreeEnv } from "../git-env.js";
 import { readPins, resolveRef } from "../pins.js";
 import { REFERENCES_FILE, readReferences } from "../references-key.js";
@@ -135,10 +135,9 @@ async function lock(root, seconds) {
     }
 }
 function git(args, cwd) {
-    // Each call finds its repository from `cwd`. A missing credential fails the fetch instead of waiting
-    // on a prompt nobody sees.
-    const env = { ...repositoryFreeEnv(), GIT_TERMINAL_PROMPT: "0" };
-    const result = spawnSync("git", args, { cwd, encoding: "utf8", env });
+    // Each call finds its repository from `cwd`.
+    const env = repositoryFreeEnv();
+    const result = exec("git", args, { ...(cwd === undefined ? {} : { cwd }), env, limitMs: SLOW_LIMIT_MS });
     // git's error on one line, so each Reference stays one line of the report.
     const err = (result.stderr ?? "")
         .split("\n")

package/dist/commands/setup.js

@@ -1,13 +1,13 @@
 // `dw-sdlc setup` sets a repository and this machine up for the sdlc plugin: the files its USAGE names,
 // each written only when its content would change, so a run is safe to repeat. Existing content is
 // merged, never replaced: other keys stay, and a file that is not a JSON object is refused.
-import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 import { COMMIT_CONVENTIONS, COMMITTED_FILE, DEFAULT_GUARDRAILS, LOCAL_FILE, SCHEMA_FILE, STRICTNESS, inferConfig, repositoryRoot, resolveConfig, schemaId, validateDocument } from "../agentic-config.js";
+import { exec } from "../exec.js";
 import { isObject, parseObject, render } from "../json-text.js";
 import { withGate, withPackage } from "../setup-gate.js";
 import { GLOBAL_DENY, LEASE_RULE, RETIRED_DENY, repositoryDeny } from "../setup-rules.js";
@@ -54,7 +54,7 @@ const PACKAGE_LINK = "dw-sdlc";
 const RETIRED_PLUGINS = ["guardrails", "references"].map((name) => `${name}@${MARKETPLACE}`);
 /** A read-only git command, the one thing the setup runs in the repository. */
 function git(root, args) {
-    const result = spawnSync("git", ["-C", root, ...args], { encoding: "utf8" });
+    const result = exec("git", ["-C", root, ...args]);
     return result.status === 0 ? result.stdout.trim() : undefined;
 }
 /** The committed layer when it is valid; an absent or invalid one sets nothing, as the resolver drops it. */

package/dist/commands/sweep.js

@@ -1,14 +1,15 @@
 // `dw-sdlc sweep`: removes each linked worktree whose whole set passes and each Landed local branch.
 // docs/adr/0015 sets its bounds: it runs from the main checkout, never forces and never writes to a remote.
-import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { join } from "node:path";
 import { parseArgs } from "node:util";
 import { findRepository, mainCheckout, resolveConfig } from "../agentic-config.js";
+import { exec, SLOW_LIMIT_MS } from "../exec.js";
 import { repositoryFreeEnv } from "../git-env.js";
 import { isCommitLanded, isLanded } from "../landed.js";
 import { shellLine } from "../pr/decide.js";
 import { CannotRun } from "../pr/read.js";
+import { byHand, holdersOf, keptIn, lockAfterStop, lockHolder, outsideWorktrees, readTerminals, removeTerminal, stopsOf, sweepingTerminal, whyHeld } from "../sweep-terminals.js";
+import { dirtyFiles, must, pausedOperation, worktreesOf } from "../sweep-trees.js";
 import { asked, git } from "../working-tree.js";
 import { lockVerdict } from "../worktree-lock.js";
 export const summary = "removes Landed branches and clean worktrees whose work has landed, names what it keeps";
@@ -30,20 +31,24 @@ It keeps, and names with the reason and the command to run yourself:
 It never changes anything on a remote: the fetch only writes remote-tracking refs. A removal git refuses is
 kept with git's words, and the sweep goes on.
 
---dry-run removes nothing and answers the same items. One line an item, or one document with --json:
-  { dryRun, base, removed: [item], kept: [item] }, an item { kind, name, reason, command? }, kind branch, worktree
-  or lock (a lifted one), name its path, command the one the dev would run for a kept item.
+In herdr ($HC_TERMINAL_ID set) it reads, with hc, the Workers of this session, the terminals whose parent is
+this one, and every other live terminal. A Worker whose status is none of working, blocked or yet to report
+is stopped (hc kill) then removed (hc rm) when its worktree goes in the same Sweep or its folder is already
+gone; a worktree is judged whole first, so no Worker is stopped beside work it could still commit. A live
+Claude Code lock on that worktree that names the Worker's own program, the pid hc get reports, does not keep
+it: once the Worker is stopped the lock is read again and lifted only when it is stale then, else the
+worktree stays. A finished Worker of this session is removed. This session's own terminal and another
+session's are never stopped: a worktree one is in stays, named with the terminal's address and place and
+hc kill as the dev's command. Outside herdr no terminal is read, and the output says so. An hc that fails
+ends the Sweep with exit 2 before anything is removed.
+
+--dry-run removes and stops nothing and answers the same items. One line an item, or one document with --json:
+  { dryRun, terminalsRead, base, removed: [item], kept: [item] }, an item { kind, name, reason, command? },
+  kind branch, worktree, lock (a lifted one) or terminal, name its path or its address, command the one the
+  dev would run for a kept item.
 
 Exit 0 nothing is kept but the default, the base or a protected branch, 1 something else is, 2 when it
-cannot run: in a linked worktree, with no base to read, or when the fetch fails.`;
-/** `git <args>` at `root`, or a stop naming its problem. */
-function must(root, args) {
-    const result = git(root, args);
-    if ("error" in result) {
-        throw new CannotRun(result.error, "check the repository with git status");
-    }
-    return result.out;
-}
+cannot run: in a linked worktree, with no base to read, when the fetch fails or when hc fails in herdr.`;
 function forcedDelete(branch) {
     return shellLine(["git", "branch", "-D", branch]);
 }
@@ -55,8 +60,10 @@ function fetchOrigin(root) {
     if (asked(root, ["remote", "get-url", "origin"]) === undefined) {
         return;
     }
-    const env = { ...repositoryFreeEnv(), GIT_TERMINAL_PROMPT: "0" };
-    const result = spawnSync("git", ["-C", root, "fetch", "--quiet", "origin"], { encoding: "utf8", env, stdio: "pipe" });
+    const result = exec("git", ["-C", root, "fetch", "--quiet", "origin"], {
+        env: repositoryFreeEnv(),
+        limitMs: SLOW_LIMIT_MS
+    });
     if (result.status !== 0) {
         const said = result.stderr.split("\n").find((line) => line.trim() !== "");
         throw new CannotRun(`git fetch origin failed: ${said?.trim() ?? `exited ${result.status}`}`, "check the network, then call again");
@@ -89,68 +96,16 @@ function branchesOf(root) {
         .split("\n")
         .filter((name) => name !== "");
 }
-/** Every worktree of the repository, the main checkout first. */
-function worktreesOf(root) {
-    const trees = [];
-    let tree;
-    for (const line of must(root, ["worktree", "list", "--porcelain"]).split("\n")) {
-        if (line.startsWith("worktree ")) {
-            tree = { path: line.slice("worktree ".length), head: "", branch: undefined, lock: undefined, prunable: false };
-            trees.push(tree);
-        }
-        else if (tree !== undefined && line.startsWith("HEAD ")) {
-            tree.head = line.slice("HEAD ".length);
-        }
-        else if (tree !== undefined && line.startsWith("branch refs/heads/")) {
-            tree.branch = line.slice("branch refs/heads/".length);
-        }
-        else if (tree !== undefined && (line === "locked" || line.startsWith("locked "))) {
-            tree.lock = line.slice("locked".length).trim();
-        }
-        else if (tree !== undefined && (line === "prunable" || line.startsWith("prunable "))) {
-            tree.prunable = true;
-        }
-    }
-    return trees;
-}
-/** The files `git status` lists in the worktree at `path`, ignored ones aside, or why it cannot be read. */
-function dirtyFiles(path) {
-    const args = ["-C", path, "status", "--porcelain=v1", "-z", "--untracked-files=all"];
-    const result = spawnSync("git", args, { encoding: "utf8", env: repositoryFreeEnv(), maxBuffer: 64 * 1024 * 1024 });
-    if (result.status !== 0) {
-        const said = result.stderr.split("\n").find((line) => line.trim() !== "");
-        return { error: `git status: ${said?.trim() ?? `exited ${result.status ?? "on a signal"}`}` };
-    }
-    const files = [];
-    const entries = result.stdout.split("\0").filter((entry) => entry !== "");
-    for (let index = 0; index < entries.length; index++) {
-        const entry = entries[index] ?? "";
-        files.push(entry.slice(3));
-        if (entry.startsWith("R") || entry.startsWith("C")) {
-            index++;
-        }
-    }
-    return files;
-}
-const OPERATIONS = [
-    ["rebase-merge", "rebase"],
-    ["rebase-apply", "rebase or am"],
-    ["MERGE_HEAD", "merge"],
-    ["CHERRY_PICK_HEAD", "cherry-pick"],
-    ["REVERT_HEAD", "revert"],
-    ["BISECT_LOG", "bisect"]
-];
-/** The operation paused in the worktree at `path`: its git dir holds the state git resumes it from. */
-function pausedOperation(path) {
-    const dir = asked(path, ["rev-parse", "--absolute-git-dir"]);
-    return dir === undefined ? undefined : OPERATIONS.find(([file]) => existsSync(join(dir, file)))?.[1];
-}
 /** Why the worktree stays, with the dev's command when there is one, or null when its whole set passes. */
-function whyTreeStays(root, baseRef, tree, lock) {
+function whyTreeStays(root, baseRef, tree, lock, holders) {
     const { path } = tree;
     if (lock.state === "stays") {
         return lock;
     }
+    const held = whyHeld(holders);
+    if (held !== null) {
+        return held;
+    }
     if (tree.prunable || !existsSync(path)) {
         const prune = shellLine(["git", "worktree", "prune"]);
         return {
@@ -196,8 +151,8 @@ function stays(branch, { head, baseBranch, protectedBranches, held }) {
     const path = held.get(branch);
     return path === undefined ? null : { reason: `checked out in the worktree at ${path}`, command: null, dev: true };
 }
-/** Fetches origin, then sorts each linked worktree and local branch into what goes and what stays. */
-function judge(root) {
+/** Fetches origin, then sorts each linked worktree, local branch and Worker's terminal into what goes and what stays. */
+function judge(root, terminals) {
     fetchOrigin(root);
     const head = originHead(root);
     const base = baseOf(root, head);
@@ -206,9 +161,16 @@ function judge(root) {
     if (checkout === undefined) {
         throw new CannotRun("git lists no worktree", "check the repository with git worktree list");
     }
+    const holders = terminals === undefined
+        ? new Map()
+        : holdersOf(terminals, checkout.path, linked.map(({ path }) => path));
     const verdicts = linked.map((tree) => {
         const lock = lockVerdict(tree.path, tree.lock);
-        return { tree, lock, why: whyTreeStays(root, base.ref, tree, lock) };
+        const here = holders.get(tree.path) ?? [];
+        const pid = lock.state === "stays" ? lock.pid : undefined;
+        const workerLock = pid !== undefined && lockHolder(pid, here) !== undefined ? { pid } : undefined;
+        const why = whyTreeStays(root, base.ref, tree, workerLock === undefined ? lock : { state: "none" }, here);
+        return { tree, lock, here, why, workerLock };
     });
     const staying = verdicts.filter(({ why }) => why !== null).map(({ tree }) => tree);
     const held = new Map();
@@ -243,18 +205,28 @@ function judge(root) {
             kept.push({ kind: "branch", name, reason, command: forcedDelete(name), dev: true });
         }
     };
-    for (const { tree, lock, why } of verdicts) {
+    const outside = terminals === undefined
+        ? { remove: [], keep: [] }
+        : outsideWorktrees(terminals, [checkout.path, ...linked.map(({ path }) => path)]);
+    removed.push(...outside.remove);
+    for (const { name, reason } of outside.keep) {
+        kept.push({ kind: "terminal", name, reason, command: null, dev: true });
+    }
+    for (const { tree, lock, here, why, workerLock } of verdicts) {
         if (why !== null) {
             kept.push({ kind: "worktree", name: tree.path, ...why, dev: true });
+            kept.push(...keptIn(here, tree.path).map((item) => ({ kind: "terminal", ...item, dev: true })));
             continue;
         }
+        removed.push(...stopsOf(here, tree.path));
         const reason = `clean, its HEAD is Landed on ${baseName}`;
         removed.push({
             kind: "worktree",
             name: tree.path,
             reason,
             ...(tree.branch === undefined ? {} : { holds: tree.branch }),
-            ...(lock.state === "stale" ? { stale: lock } : {})
+            ...(lock.state === "stale" ? { stale: lock } : {}),
+            ...(workerLock === undefined ? {} : { workerLock })
         });
         if (tree.branch !== undefined) {
             judgeBranch(tree.branch);
@@ -264,7 +236,7 @@ function judge(root) {
     return { base: baseName, removed, kept };
 }
 /** Removes `item`; the item kept when git refuses it, with git's words, or undefined once it is gone. */
-function removal(root, item, heldBy) {
+function removal(root, item, heldBy, unstopped) {
     const refused = (reason, command) => ({
         kind: item.kind,
         name: item.name,
@@ -272,6 +244,16 @@ function removal(root, item, heldBy) {
         command,
         dev: true
     });
+    if (item.kind === "terminal") {
+        const failed = removeTerminal(item);
+        if (failed === undefined) {
+            return undefined;
+        }
+        if (item.tree !== undefined) {
+            unstopped.set(item.tree, `its Worker's terminal ${item.name} stays: ${failed}`);
+        }
+        return refused(failed, byHand(item));
+    }
     if (item.kind === "worktree") {
         const refusedWith = (reason, command) => {
             if (item.holds !== undefined) {
@@ -279,6 +261,20 @@ function removal(root, item, heldBy) {
             }
             return refused(reason, command);
         };
+        const unstoppable = unstopped.get(item.name);
+        if (unstoppable !== undefined) {
+            return refusedWith(unstoppable, null);
+        }
+        if (item.workerLock !== undefined) {
+            const now = lockAfterStop(root, item.name);
+            if (now.state === "stays") {
+                return refusedWith(`its Worker's terminal was stopped, but ${now.reason}`, now.command);
+            }
+            if (now.state === "stale") {
+                item.stale = now;
+            }
+            delete item.workerLock;
+        }
         if (item.stale !== undefined) {
             const lifted = git(root, ["worktree", "unlock", "--", item.name]);
             if ("error" in lifted) {
@@ -307,8 +303,9 @@ function apply({ base, removed, kept }, root) {
     const gone = [];
     const refused = [];
     const heldBy = new Map();
+    const unstopped = new Map();
     for (const item of removed) {
-        const stayed = removal(root, item, heldBy);
+        const stayed = removal(root, item, heldBy, unstopped);
         if (stayed === undefined) {
             gone.push(item);
         }
@@ -320,8 +317,12 @@ function apply({ base, removed, kept }, root) {
 }
 /** The removed items as the Sweep tells them: a stale lock lifted comes just before its worktree. */
 function shownOf(removed) {
-    return removed.flatMap(({ kind, name, reason, stale }) => {
+    return removed.flatMap(({ kind, name, reason, stale, workerLock }) => {
         const item = { kind, name, reason };
+        if (workerLock !== undefined) {
+            const why = `held by its Worker's program, pid ${workerLock.pid}: lifted once the stop leaves it stale`;
+            return [{ kind: "lock", name, reason: why }, item];
+        }
         return stale === undefined ? [item] : [{ kind: "lock", name, reason: stale.why }, item];
     });
 }
@@ -331,14 +332,15 @@ function verbOf(kind, dryRun) {
     }
     return dryRun ? "would remove" : "removed";
 }
-function linesOf({ dryRun, removed, kept }) {
+function linesOf({ dryRun, terminalsRead, removed, kept }) {
     const out = [
         ...removed.map(({ kind, name, reason }) => `${verbOf(kind, dryRun)} ${kind} ${name} — ${reason}`),
         ...kept.map(({ kind, name, reason, command }) => {
             return `kept ${kind} ${name} — ${reason}${command === null || command === undefined ? "" : `; to remove it yourself: ${command}`}`;
         })
     ];
-    return out.length === 0 ? "nothing to sweep" : out.join("\n");
+    const note = terminalsRead ? [] : ["terminals not read — outside herdr, $HC_TERMINAL_ID is not set"];
+    return [...(out.length === 0 ? ["nothing to sweep"] : out), ...note].join("\n");
 }
 function parseCli(argv) {
     try {
@@ -369,10 +371,13 @@ function sweep(json, dryRun) {
     if (main !== undefined) {
         throw new CannotRun(`${root} is a linked worktree`, `run it from the main checkout: ${shellLine(["cd", main])} && dw-sdlc sweep`);
     }
-    const judged = judge(root);
+    const own = sweepingTerminal();
+    const terminals = own === undefined ? undefined : readTerminals(own);
+    const judged = judge(root, terminals);
     const { base, removed, kept } = dryRun ? judged : apply(judged, root);
     const done = {
         dryRun,
+        terminalsRead: terminals !== undefined,
         base,
         removed: shownOf(removed),
         kept: kept.map(({ kind, name, reason, command }) => ({ kind, name, reason, command }))

package/dist/doctor-plugins.d.ts

@@ -6,6 +6,8 @@ export declare function runningPluginRoot(probe: Probe, claude: string, plugin?:
 export declare function checkPlugin(probe: Probe, claude: string): Check;
 /** Whether the plugin's hooks and skills run the dw-sdlc the repository pins, the one its Gate runs. */
 export declare function checkPackage(probe: Probe, claude: string, root: string | undefined): Check;
+/** Whether `sdlc-sessions` is installed and enabled here, so `/sdlc-delegate` is one the dev can start. */
+export declare function sessionsEnabled(probe: Probe): boolean;
 /**
  * `sdlc-sessions`, which a machine may go without, so it never fails. Its copy of the package against
  * the sdlc plugin's copy: the `package` line holds that one to the repository's pin.

package/dist/doctor-plugins.js

@@ -131,6 +131,10 @@ export function checkPackage(probe, claude, root) {
     }
     return { name, level: "PASS", detail: `${PACKAGE} ${linked} in the plugin and in the repository` };
 }
+/** Whether `sdlc-sessions` is installed and enabled here, so `/sdlc-delegate` is one the dev can start. */
+export function sessionsEnabled(probe) {
+    return listedPlugins(probe)?.find((item) => item.id === SESSIONS_ID)?.enabled === true;
+}
 /**
  * `sdlc-sessions`, which a machine may go without, so it never fails. Its copy of the package against
  * the sdlc plugin's copy: the `package` line holds that one to the repository's pin.
@@ -140,7 +144,9 @@ export function checkSessions(probe, claude) {
     const list = listedPlugins(probe);
     const entry = list?.find((item) => item.id === SESSIONS_ID);
     if (entry === undefined) {
-        const detail = list === undefined ? "claude plugin list did not answer" : `no ${SESSIONS_ID}, so no /sdlc-recap`;
+        const detail = list === undefined
+            ? "claude plugin list did not answer"
+            : `no ${SESSIONS_ID}, so no /sdlc-recap, /sdlc-brief or /sdlc-delegate. claude plugin install ${SESSIONS_ID} --scope user`;
         return { name, level: "INFO", detail };
     }
     const version = typeof entry.version === "string" ? entry.version : "?";

package/dist/exec.d.ts

@@ -0,0 +1,14 @@
+import { type SpawnSyncReturns } from "node:child_process";
+/** For what the network or a repository's size can stretch: a clone, a fetch, a scan of its history. */
+export declare const SLOW_LIMIT_MS = 600000;
+export type ExecOptions = {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+    limitMs?: number;
+};
+/** A tool that outlived its limit and was stopped; the message names it. */
+export declare class TimedOut extends Error {
+}
+/** `tool args` as a child process; a tool's own exit, or its absence, is the caller's. Throws `TimedOut` at the limit. */
+export declare function exec(tool: string, args: string[], options?: ExecOptions): SpawnSyncReturns<string>;

package/dist/exec.js

@@ -0,0 +1,39 @@
+// Every short-lived child process the package runs: stopped at a time limit, so a tool that hangs cannot
+// hang the command, and with git's prompts off, since nobody would see one. A Step of the Gate runs
+// through `run-command.ts` instead, and takes as long as it takes.
+import { spawnSync } from "node:child_process";
+const LIMIT_MS = 120_000;
+/** For what the network or a repository's size can stretch: a clone, a fetch, a scan of its history. */
+export const SLOW_LIMIT_MS = 600_000;
+/** A Step that writes thousands of files makes a diff-tree past the default of 1 MiB. */
+const MAX_BUFFER = 64 * 1024 * 1024;
+const SHOWN = 80;
+/** A tool that outlived its limit and was stopped; the message names it. */
+export class TimedOut extends Error {
+}
+/** DW_SDLC_LIMIT_MS, which a test sets to reach a limit quickly, else the limit the call asks for. */
+function limitOf(asked) {
+    const given = Number(process.env.DW_SDLC_LIMIT_MS);
+    return given > 0 ? given : asked;
+}
+function shown(tool, args) {
+    return [tool, ...args].join(" ").replaceAll(/\s+/g, " ").trim().slice(0, SHOWN);
+}
+/** `tool args` as a child process; a tool's own exit, or its absence, is the caller's. Throws `TimedOut` at the limit. */
+export function exec(tool, args, options = {}) {
+    const { cwd, env = process.env, input } = options;
+    const limitMs = limitOf(options.limitMs ?? LIMIT_MS);
+    const result = spawnSync(tool, args, {
+        ...(cwd === undefined ? {} : { cwd }),
+        ...(input === undefined ? {} : { input }),
+        encoding: "utf8",
+        env: { ...env, GIT_TERMINAL_PROMPT: "0" },
+        killSignal: "SIGKILL",
+        maxBuffer: MAX_BUFFER,
+        timeout: limitMs
+    });
+    if (result.error !== undefined && "code" in result.error && result.error.code === "ETIMEDOUT") {
+        throw new TimedOut(`${shown(tool, args)} did not answer within ${limitMs / 1000} s`);
+    }
+    return result;
+}

package/dist/git-env.js

@@ -1,10 +1,10 @@
 // The environment a git command runs under to find its repository from its own directory, as a git
 // hook's GIT_DIR or GIT_INDEX_FILE would otherwise aim it at the hook's repository.
-import { spawnSync } from "node:child_process";
+import { exec } from "./exec.js";
 let repositoryVars;
 /** This process's environment without the variables that tie git to one repository, as git lists them. */
 export function repositoryFreeEnv() {
-    repositoryVars ??= new Set((spawnSync("git", ["rev-parse", "--local-env-vars"], { encoding: "utf8" }).stdout ?? "").split("\n").filter(Boolean));
+    repositoryVars ??= new Set((exec("git", ["rev-parse", "--local-env-vars"]).stdout ?? "").split("\n").filter(Boolean));
     const vars = repositoryVars;
     return Object.fromEntries(Object.entries(process.env).filter(([name]) => !vars.has(name)));
 }