flowviant 0.115.0 → 0.117.0

package/bin/lib/workAgentCheck.mjs

@@ -8,16 +8,17 @@
  * the process-group kill), the pre-review for MODEL-REPORTING ones. The review
  * entry beat sequences the two and owns neither.
  */
-import { readFileSync, lstatSync, rmSync, readdirSync } from 'node:fs';
-import { spawn } from 'node:child_process';
-import { join } from 'node:path';
+import { readFileSync, realpathSync, rmSync } from 'node:fs';
+import { spawn as spawnProcess } from 'node:child_process';
+import { dirname, join } from 'node:path';
 import { FLEET_URL } from './config.mjs';
-import { git } from './git.mjs';
+import { gitOrNull } from './git.mjs';
 import { warn } from './ui.mjs';
-import { ARTIFACT_DIR, artifactTypeFor } from './artifacts.mjs';
+import { ARTIFACT_DIR, artifactTypeFor, walkArtifactDir } from './artifacts.mjs';
+import { flowviantParentState, realDirState } from './ownedDirs.mjs';
+import { killGroup } from './processGroup.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
-import { withoutMachineCredentials } from './machineEnv.mjs';
-import { agentBrowserHome, openBrowserHome, withoutWindows } from './noWindowEnv.mjs';
+import { agentBrowserHome, openBrowserHome, unattendedEnv } from './noWindowEnv.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
 import { workLanesStopped } from './standDownGate.mjs';
 
@@ -35,54 +36,75 @@ import { workLanesStopped } from './standDownGate.mjs';
  * before any person looked — and the directory is git-excluded, so the file
  * never appears in the diff a reviewer reads.
  *
- * What an artifact IS is already a closed list (`ARTIFACT_TYPES`), and the
- * scan only ever shows TOP-LEVEL regular files: anything else there is
- * nothing the product will show, so removing it before the check costs
- * nothing a person could see. Symlinks and subdirectories go whole; a
- * `.flowviant` that is not a real directory is left alone (that is the
- * repository's own content, not something a turn wrote). Returns the names
- * removed, for the log line.
+ * What an artifact IS is already a closed list (`ARTIFACT_TYPES`, which holds
+ * no script type), and WHERE one may stand is the scan's own walk
+ * (`walkArtifactDir`, artifacts.mjs — one walk since 2026-10-10, the audit's
+ * F067). This header used to say the scan showed only TOP-LEVEL files, and
+ * the fence removed every subdirectory whole: a 3D-model page
+ * (`<name>/index.html`) or a bundle's sidecars went the moment the queue
+ * emptied, and a send-back turn that did not rewrite the page settled
+ * "nothing". So real directories within the scan's depth stay and are walked;
+ * at ANY depth a dot-name, a symlink, anything that is not a regular file, a
+ * file off the allowlist, and a directory deeper than the scan looks is
+ * removed — nothing the product will show, so removing it costs nothing a
+ * person could see. A `.flowviant` that is not a real directory is left alone
+ * (that is the repository's own content, not something a turn wrote). Returns
+ * the relative paths removed, for the log line.
  */
 export function clearNonArtifacts(wt) {
   const removed = [];
-  try {
-    const parent = lstatSync(join(wt, '.flowviant'));
-    if (parent.isSymbolicLink() || !parent.isDirectory()) return removed;
-    const dir = join(wt, ARTIFACT_DIR);
-    const st = lstatSync(dir);
-    if (st.isSymbolicLink() || !st.isDirectory()) {
+  if (flowviantParentState(wt) !== 'dir') return removed;
+  const dir = join(wt, ARTIFACT_DIR);
+  const state = realDirState(dir);
+  if (state === 'none') return removed; // the ordinary case
+  if (state === 'other') {
+    // A link or a file AT the directory's name: the link goes, never its target.
+    try {
       rmSync(dir, { force: true, recursive: false });
       removed.push(ARTIFACT_DIR);
-      return removed;
-    }
-    for (const name of readdirSync(dir)) {
-      const p = join(dir, name);
-      let e;
-      try {
-        e = lstatSync(p);
-      } catch {
-        continue; // vanished between the list and the stat
-      }
-      const keep = e.isFile() && !name.startsWith('.') && artifactTypeFor(name) !== null;
-      if (keep) continue;
-      try {
-        rmSync(p, { recursive: true, force: true });
-        removed.push(name);
-      } catch {
-        /* best-effort — reported by omission */
-      }
+    } catch {
+      /* best-effort — reported by omission */
     }
+    return removed;
+  }
+  // A REMOVAL STAYS INSIDE THE DIRECTORY. The walk descends only what `lstat`
+  // called a real directory, but this one deletes, so each entry's parent is
+  // resolved again right before it goes: a folder swapped for a link after
+  // its look is never a way to remove what the link points at.
+  let root;
+  try {
+    root = realpathSync(dir);
   } catch {
-    /* no artifacts directory — the ordinary case */
+    return removed;
   }
+  const inside = (name, path) => {
+    try {
+      return realpathSync(dirname(path)) === join(root, dirname(name));
+    } catch {
+      return false;
+    }
+  };
+  walkArtifactDir(wt, ({ name, path, kind }) => {
+    if (kind === 'dir' || (kind === 'file' && artifactTypeFor(name) !== null)) return;
+    if (!inside(name, path)) return;
+    try {
+      // `rm -r` on a link removes the link; on a real directory, its contents
+      // (links inside it unlinked, never followed).
+      rmSync(path, { recursive: true, force: true });
+      removed.push(name);
+    } catch {
+      /* best-effort — reported by omission */
+    }
+  });
   return removed;
 }
 
 /**
  * THE ENVIRONMENT THE PROJECT'S CHECK RUNS UNDER: the daemon's own, minus the
  * machine credential — the same rule `cliEnv` (runTurn.mjs) applies to a turn,
- * imported from its one home (machineEnv.mjs) rather than from the CLI
- * module, so the check never depends on the CLI module's spawn helpers. Nothing a check runs needs the credential the daemon
+ * imported from its one home (`unattendedEnv`, noWindowEnv.mjs) rather than
+ * from the CLI module, so the check never depends on the CLI module's spawn
+ * helpers. Nothing a check runs needs the credential the daemon
  * authenticates with; everything else is what the agent's own turn saw when it
  * ran the same tests.
  */
@@ -90,10 +112,22 @@ export function checkEnv(env = process.env, browserHome = null) {
   // …and, like that turn since 2026-09-29, no way to a window: a test run
   // nobody is watching that opens a headed browser or an HTML report opens it
   // on nobody's behalf (noWindowEnv.mjs). The agent's own browser profile.
-  return withoutWindows(withoutMachineCredentials(env), browserHome);
+  return unattendedEnv(env, { browserHome });
 }
 
-export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, groupKillChildren, sessionMetaPath }) {
+/**
+ * `spawn` is node's unless a test hands one in: the release below is about a
+ * child whose 'close' never comes, which a real process only shows with a
+ * survivor outside its group holding the pipe.
+ */
+export function createWorkAgentCheck({
+  repoRoot,
+  postBestEffort,
+  workChildren,
+  groupKillChildren,
+  sessionMetaPath,
+  spawn = spawnProcess,
+}) {
   const AGENT_CHECK_DONE_URL = fleetEndpoint('agent-check-done', FLEET_URL);
 
   // ── THE PROJECT'S OWN CHECK, and the MERGE ─────────────────────────────────
@@ -136,7 +170,12 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
 
   const runCheck = async (agentId, wt) => {
     const cmd = readCheckCommand();
-    const headSha = (git(['rev-parse', 'HEAD'], wt) || '').trim() || undefined;
+    // OPTIONAL, like the pre-review's twin read: an unreadable head (a
+    // worktree retired mid-beat, an unborn branch) costs the answer its
+    // headSha, never the answer. This read was the one copy left unguarded,
+    // and its throw kept the row on its previous, older check label (audit
+    // 2026-10-10, F144).
+    const headSha = gitOrNull(['rev-parse', 'HEAD'], wt) ?? undefined;
     if (!cmd) {
       await postCheck({ agentId, status: 'none', ...(headSha ? { headSha } : {}) });
       return;
@@ -161,6 +200,21 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
       // After the teardown no check starts; this promise stays pending.
       if (workLanesStopped()) return;
       let child;
+      /**
+       * ONE RELEASE, from every way the check ends (2026-10-10, the audit's
+       * F152). Only 'close' and 'error' used to untrack the child, and
+       * nothing ever pruned `groupKillChildren` — so a timed-out check whose
+       * pipe a survivor outside its group still held (a watcher, a dev server
+       * it daemonised) never closed, and stayed a live turn for good: the
+       * machine's admission count inflated and `workBusy` held off every
+       * self-update until a restart, while the set kept one dead child per
+       * run. Idempotent; the timer, 'error' and 'close' each call it.
+       */
+      const release = () => {
+        if (!child) return;
+        workChildren.delete(child);
+        groupKillChildren.delete(child);
+      };
       try {
         // DETACHED, so the child's pid is its PROCESS GROUP. A check is almost
         // always a shell that spawns the real runner, and signalling the shell
@@ -242,17 +296,10 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
       child.stdout?.on('data', keep);
       child.stderr?.on('data', keep);
       const timer = setTimeout(() => {
-        try {
-          // The GROUP, not the child: killing the shell leaves whatever it
-          // started running, which is the thing actually taking ten minutes.
-          process.kill(-child.pid, 'SIGKILL');
-        } catch {
-          try {
-            child.kill('SIGKILL');
-          } catch {
-            /* already gone */
-          }
-        }
+        // The GROUP, not the child: killing the shell leaves whatever it
+        // started running, which is the thing actually taking ten minutes.
+        killGroup(child, 'SIGKILL');
+        release();
         text += '\n[flowviant] the check ran past ten minutes and was stopped';
         // RESOLVE HERE TOO. Waiting for 'close' after a kill is the shape that
         // hangs: if the group is already gone the event never arrives, and this
@@ -261,13 +308,13 @@ export function createWorkAgentCheck({ repoRoot, postBestEffort, workChildren, g
       }, CHECK_TIMEOUT_MS);
       child.on('error', (e) => {
         clearTimeout(timer);
-        workChildren.delete(child);
+        release();
         text += String(e?.message || e);
         finish('failed');
       });
       child.on('close', (code) => {
         clearTimeout(timer);
-        workChildren.delete(child);
+        release();
         finish(code === 0 ? 'passed' : 'failed');
       });
     });

package/bin/lib/workAgentMerges.mjs

@@ -1,16 +1,33 @@
 /** Agent merge claims, pull-request approval, and branch cleanup. */
-import { ensureOpenPr, ghFirstLine, ghReady, mergeAndVerifyTip, PR_URL_RE } from './prWorkflow.mjs';
+import { ensureOpenPr, ghReady, mergeAndVerifyTip, PR_URL_RE, relayedFailure } from './prWorkflow.mjs';
 import { existsSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
-import { git, gitNet as gitNetIn, baseBranchName, isSafePathSegment } from './git.mjs';
+import { FLEET_URL } from './config.mjs';
+import { git, gitOrNull, gitNet as gitNetIn, baseBranchName, isSafePathSegment, sessionBranch, stripUrlUserinfo } from './git.mjs';
 import { isPublishRef, publishPushArgs, publishDeleteArgs, publishErrorText } from './agentPublish.mjs';
 import { mergeOutward as shipMergeOutward } from './shipMerge.mjs';
 import { gitMergeIn } from './gitMergeIdentity.mjs';
 import { warn } from './ui.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
+import { claimFleetLease, settleLease } from './fleetPost.mjs';
+import { worktreePath } from './workPlaces.mjs';
+
+/** Git puts merge conflicts on stdout, while refusals usually use stderr.
+ * Keep both before the command wrapper, scrub before bounding, and put Git's
+ * reason first so the server's shorter mergeError cap keeps the useful part.
+ * A genuine conflict stays in the worktree for the merge_resolve turn.
+ * Userinfo is stripped too (2026-10-10, F153): the merge's own push to
+ * `origin` can print the remote URL, token and all, into a team-visible
+ * mergeError. */
+export function agentMergeFailureDetail(error) {
+  const output = [error?.stdout, error?.stderr]
+    .map((value) => String(value ?? '').trim())
+    .filter(Boolean)
+    .join('\n');
+  return envScrub(stripUrlUserinfo(output || String(error?.message || error))).slice(0, 2000);
+}
 
 export function createWorkAgentMerges({
   repoRoot,
@@ -39,42 +56,12 @@ export function createWorkAgentMerges({
   // landed observer's own fetch sees it, and the cards close there.
   const agentMerges = new Set(); // agent ids in flight on this tick
 
-  const claimAgentMerge = async (agentId) => {
-    try {
-      const res = await fetch(AGENT_MERGE_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ agentId, instance: DAEMON_INSTANCE }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
-    } catch {
-      return false; // the peer may hold it; doing nothing is the safe answer
-    }
-  };
+  // The peer may hold it; doing nothing is the safe answer.
+  const claimAgentMerge = (agentId) => claimFleetLease(AGENT_MERGE_CLAIM_URL, { agentId });
 
-  const postAgentMerge = async (body) => {
-    try {
-      await fetch(AGENT_MERGE_DONE_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify({ ...body, instance: DAEMON_INSTANCE }),
-      });
-    } catch {
-      /* the lease lapses and the job is re-offered — a merge is idempotent
-         against an already-merged branch, which mergeOutward detects */
-    }
-  };
+  // On a failure the lease lapses and the job is re-offered — a merge is
+  // idempotent against an already-merged branch, which mergeOutward detects.
+  const postAgentMerge = (body) => settleLease(AGENT_MERGE_DONE_URL, body, { timeoutMs: 30_000 });
 
   // A merge COMMIT needs an identity the machine may not have; the probe and
   // the daemon's fallback live in gitMergeIdentity.mjs.
@@ -132,7 +119,7 @@ export function createWorkAgentMerges({
     // does not know exists.
     try {
       await inPlace(place, true, async () => {
-      const wt = join(baseDir, 'sessions', place);
+      const wt = worktreePath(baseDir, place);
       if (!existsSync(wt)) {
         await report({ agentId, ok: false, detail: 'the worktree is gone' });
         return;
@@ -154,7 +141,7 @@ export function createWorkAgentMerges({
           await report({
             agentId,
             ok: false,
-            detail: envScrub(String(e?.message || e)).slice(0, 2000),
+            detail: agentMergeFailureDetail(e),
           });
           return;
         }
@@ -168,21 +155,19 @@ export function createWorkAgentMerges({
       // `git()` THROWS on a non-zero exit, and `symbolic-ref` exits non-zero on
       // a detached HEAD — so the guard below was unreachable and the throw
       // escaped the claimed merge, leaving it unsettled until its lease lapsed.
-      let branch = '';
-      try {
-        branch = (git(['symbolic-ref', '--quiet', '--short', 'HEAD'], wt) || '').trim();
-      } catch {
-        branch = '';
-      }
+      // `gitOrNull` reads that as no branch.
+      const branch = gitOrNull(['symbolic-ref', '--quiet', '--short', 'HEAD'], wt) ?? '';
       if (!branch) {
         // A detached HEAD names no branch, so there is nothing to merge and
         // nothing to record. An ambiguity in git, not a rule of ours.
         await report({ agentId, ok: false, detail: 'this worktree is on a detached HEAD' });
         return;
       }
-      const tip = (git(['rev-parse', 'HEAD'], wt) || '').trim();
-      const countOut = git(['rev-list', '--count', `${baseRef()}..HEAD`], wt);
-      const count = Number((countOut || '0').trim()) || 0;
+      const tip = gitOrNull(['rev-parse', 'HEAD'], wt) ?? '';
+      // The count stays a THROWING read, inside the merge's own catch: a
+      // range git cannot answer must never read as 0, which is "already on
+      // base" and reports success.
+      const count = Number(git(['rev-list', '--count', `${baseRef()}..HEAD`], wt)) || 0;
       if (count === 0) {
         // Already on base — an idempotent re-offer, or an agent that changed
         // nothing. Reported as a SUCCESS: the branch's work is on base, which
@@ -249,7 +234,7 @@ export function createWorkAgentMerges({
          * work on that ref that nobody approved; the plain push of the checked
          * out branch is the honest fallback.
          */
-        const ownBranch = branch === `session/${place}`;
+        const ownBranch = branch === sessionBranch(place);
         const head =
           ownBranch && isPublishRef(job.publishedRef) ? job.publishedRef : branch;
         try {
@@ -268,14 +253,15 @@ export function createWorkAgentMerges({
             agentRemoteAt.set(place, { ref: head, sha: tip });
           }
         } catch (e) {
-          // SCRUBBED. Every other failure on this path relays `gh`'s own words,
-          // but a push writes the REMOTE URL to stderr and a remote can carry a
-          // token in its userinfo — so this one line is the only place on the
-          // agent merge path that can leak a credential into a stored,
-          // team-visible `mergeError`.
+          // SCRUBBED AND USERINFO-STRIPPED (`relayedFailure`). A push writes
+          // the REMOTE URL to stderr and a remote can carry a token in its
+          // userinfo, and this line becomes a stored, team-visible
+          // `mergeError`. The env scrub alone left `//user:token@` standing
+          // (audit 2026-10-10, F153); gh's own refusals below take the same
+          // relay inside prWorkflow.mjs.
           // A refused push is the remote or its login (no `origin`, a
           // credential, a protected ref) — the person's to fix, not the branch.
-          await report({ agentId, ok: false, fix: 'person', detail: envScrub(ghFirstLine(e)) });
+          await report({ agentId, ok: false, fix: 'person', detail: relayedFailure(e) });
           return;
         }
         const pr = ensureOpenPr(head, prBase, { cwd: repoRoot });
@@ -309,6 +295,19 @@ export function createWorkAgentMerges({
           });
           return;
         }
+        // GitHub lists no open pull request FROM this head in this
+        // repository, so nothing was merged — never one picked by a selector
+        // that merely looks like the branch (prWorkflow.mjs).
+        if (merged.noPr) {
+          await report({
+            agentId,
+            ok: false,
+            detail:
+              `there is no open pull request from ${head} in this repository to merge` +
+              (linked ? ` — the one opened is at ${prUrl}` : ' — approve again to open one'),
+          });
+          return;
+        }
         if (merged.notOnBase) {
           // gh said yes and base does not have the tip: a merge queue may
           // still be running it, or an older PR merged. The server closes
@@ -354,7 +353,7 @@ export function createWorkAgentMerges({
           // resolve turn on the server. A conflict says nothing, and the
           // agent resolves it in its worktree as before.
           ...(e?.fix === 'person' ? { fix: 'person' } : {}),
-          detail: envScrub(String(e?.message || e)).slice(0, 2000),
+          detail: agentMergeFailureDetail(e),
         });
         return;
       }
@@ -362,6 +361,12 @@ export function createWorkAgentMerges({
       onRepoChanged();
       landed.observe();
       });
+    } catch (e) {
+      // Unexpected Git failures must retain their diagnostics too. The belt
+      // below remains for paths which exit without an error or a report.
+      if (!reported) {
+        await report({ agentId, ok: false, detail: agentMergeFailureDetail(e) });
+      }
     } finally {
       if (!reported) {
         // Belt over braces. A merge this daemon claimed and cannot account for