flowviant 0.115.0 → 0.117.0

package/bin/lib/workAgentPlans.mjs

@@ -1,18 +1,19 @@
 /** Agent plan claims, read-only planning turns, and proposal reports. */
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
-import { git, isSafePathSegment } from './git.mjs';
+import { FLEET_URL, DAEMON_INSTANCE } from './config.mjs';
+import { gitOrNull, isSafePathSegment } from './git.mjs';
 import { parseProposal } from './agentPlan.mjs';
 import { c, note } from './ui.mjs';
 import { runTurn as defaultRunTurn } from './runTurn.mjs';
 import { SYSTEM_PLAN, AGENT_PLAN_KICKOFF } from './prompts.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
-import { RUNTIMES } from './runtimes.mjs';
-import { pickRuntimeFor as defaultPickRuntimeFor } from './runtimeDetection.mjs';
-import { removeProbeTranscript } from './runtimeCapabilities.mjs';
+import { canRun, runtimeById, runtimeLabel } from './runtimes.mjs';
+import { detectRuntimes as defaultDetectRuntimes, pickRuntimeFor as defaultPickRuntimeFor } from './runtimeDetection.mjs';
+import { brainFor } from './workBrain.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
 import { fleetEndpoint } from './fleetWire.mjs';
-import { REPO_PLACE } from './workPlaces.mjs';
+import { claimFleetLease, fleetHeaders } from './fleetPost.mjs';
+import { REPO_PLACE, worktreePath } from './workPlaces.mjs';
 import { addUsage } from './turnUsage.mjs';
 
 export function createWorkAgentPlans({
@@ -24,10 +25,11 @@ export function createWorkAgentPlans({
   admit,
   placeLocks,
   workChildren,
-  // The real CLI driver and picker; injectable only so the lane can be driven
+  // The real CLI driver, detector and picker; injectable so the lane can be driven
   // in a test without spending a model turn (the wiki runner's shape).
   runTurn = defaultRunTurn,
   pickRuntimeFor = defaultPickRuntimeFor,
+  detectRuntimes = defaultDetectRuntimes,
 }) {
   const AGENT_PLAN_DONE_URL = fleetEndpoint('agent-plan-done', FLEET_URL);
   const AGENT_PLAN_ACTIVITY_URL = fleetEndpoint('agent-plan-activity', FLEET_URL);
@@ -41,8 +43,11 @@ export function createWorkAgentPlans({
   // creates a worktree, a branch or a card.
   //
   // READ-ONLY IN THE CHECKOUT. `profile: 'consult'` selects `consultPermFor` (the
-  // fenced Read/Glob rules plus a few path-validated `git`/`ls`/`cat` reads —
-  // no Write, no Edit, no mkdir, no rm) and NO MCP is passed at all, so this
+  // fenced Read/Glob rules plus a few shell readers: `ls`/`cat`/`head`, which
+  // the CLI path-validates itself, and the `git` readers, which it does not —
+  // their path fence is the read guard's refusal (hooks/readGuard.mjs), of
+  // `--no-index` and of any git argument aimed off the checkout — and no
+  // Write, no Edit, no mkdir, no rm) and NO MCP is passed at all, so this
   // turn has no control plane to reach even if the repository it reads tries
   // to steer it. The proposal comes back as the turn's final message rather
   // than through a tool, which is exactly what lets that permission set be
@@ -66,8 +71,8 @@ export function createWorkAgentPlans({
    * on a PRESS instead of an agent.
    *
    * This turn was already streaming and the daemon was already reading it:
-   * `streamJson` humanizes every read, grep, command and thought and prints
-   * it behind `[plan]` on the operator's terminal. Every one of those lines
+   * runTurn's event reader humanizes every read, grep, command and thought
+   * and prints it behind `[plan]` on the operator's terminal. Every one of those lines
    * was then thrown away, so a Deploy press said "planning" on the board and
    * nothing else for as long as it took — which on an overnight queue is the
    * whole night. Forwarding the CLI's own tail costs nothing that is not
@@ -88,11 +93,7 @@ export function createWorkAgentPlans({
     try {
       await fetch(AGENT_PLAN_ACTIVITY_URL, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
+        headers: fleetHeaders(),
         signal: AbortSignal.timeout(15_000),
         body: JSON.stringify({ planId, line: text }),
       });
@@ -129,24 +130,8 @@ export function createWorkAgentPlans({
    */
   const PLAN_TURN_TIMEOUT_MS = 15 * 60_000;
 
-  const claimAgentPlan = async (id) => {
-    try {
-      const res = await fetch(AGENT_PLAN_CLAIM_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(15_000),
-        body: JSON.stringify({ id, instance: DAEMON_INSTANCE }),
-      });
-      const j = await res.json().catch(() => null);
-      return j?.data?.claimed === true;
-    } catch {
-      return false; // the peer may hold it; doing nothing is the safe answer
-    }
-  };
+  // The peer may hold it; doing nothing is the safe answer.
+  const claimAgentPlan = (id) => claimFleetLease(AGENT_PLAN_CLAIM_URL, { id });
 
   /**
    * What a live agent has already TOUCHED, measured here rather than sent.
@@ -162,7 +147,7 @@ export function createWorkAgentPlans({
    */
   const agentChangedFiles = (placeId) => {
     if (!placeId || !isSafePathSegment(placeId)) return [];
-    const wt = join(baseDir, 'sessions', placeId);
+    const wt = worktreePath(baseDir, placeId);
     if (!existsSync(wt)) return [];
     const out = new Set();
     for (const args of [
@@ -183,16 +168,12 @@ export function createWorkAgentPlans({
        * `planning` until its expiry, having spent nothing and explained
        * nothing, on what would be an ordinary second Deploy.
        *
-       * An agent whose files cannot be read contributes none. That is the
-       * honest answer and it is what the planner should be told.
+       * An agent whose files cannot be read contributes none — `gitOrNull`
+       * (git.mjs) reads a failure as null. That is the honest answer and it
+       * is what the planner should be told.
        */
-      let r;
-      try {
-        r = git(args, wt);
-      } catch {
-        continue;
-      }
-      if (typeof r !== 'string') continue;
+      const r = gitOrNull(args, wt);
+      if (r == null) continue;
       for (const line of r.split('\n')) {
         const f = line.trim();
         if (f) out.add(f);
@@ -224,15 +205,35 @@ export function createWorkAgentPlans({
     }
 
     /**
-     * WHICH CLI PLANS. `pickRuntimeFor('consult')`, the same picker every other
-     * turn nobody @mentioned already uses — Claude when it is here (the prompts
-     * were written against it), otherwise whatever can express the profile.
-     *
-     * Deliberately NOT the project's runtime order: that order is about AGENTS,
-     * which hold a conversation across many turns and whose value is that held
-     * context. A planner runs once and reads; it takes what the machine has.
+     * WHICH CLI PLANS. The person's pick comes first; a named CLI must be
+     * installed and able to run the read-only profile, or the press says why.
+     * A model or effort pin without a named CLI is a Claude pick. With no pick
+     * or pin, `pickRuntimeFor('consult')` is the fallback — Claude when it is
+     * here, otherwise whatever can express the profile.
      */
-    const rt = pickRuntimeFor('consult');
+    let rt;
+    const pickedRuntime = typeof job.runtime === 'string' && job.runtime.length > 0
+      ? job.runtime
+      : job.model != null || job.effort != null ? 'claude' : null;
+    if (pickedRuntime) {
+      rt = pickedRuntime;
+      const runtime = runtimeById(rt);
+      if (!runtime) {
+        await postAgentPlan({ id, error: `${rt} is not a CLI this machine knows` });
+        return;
+      }
+      const label = runtime.label;
+      if (!detectRuntimes().find((r) => r.id === rt)?.installed) {
+        await postAgentPlan({ id, error: `${label} is not installed on this machine` });
+        return;
+      }
+      if (!canRun(runtime, 'consult')) {
+        await postAgentPlan({ id, error: `${label} can't run a read-only turn on this machine` });
+        return;
+      }
+    } else {
+      rt = pickRuntimeFor('consult');
+    }
     if (!rt) {
       await postAgentPlan({ id, error: 'no CLI on this machine can run a read-only turn' });
       return;
@@ -283,23 +284,6 @@ export function createWorkAgentPlans({
     }));
 
     let out = '';
-    /** REMOVED IN A `finally`. `workChildren` is what `workBusy()` counts, and
-     *  a leaked entry keeps the daemon permanently "busy" — which blocks every
-     *  auto-update from that moment on, silently, until a restart. */
-    let planChild = null;
-    let planTimer = null;
-    /**
-     * THE PLANNER'S OWN CONVERSATION, so its transcript can be removed.
-     *
-     * `claude -p` in the CHECKOUT writes `~/.claude/projects/<checkout>/<id>.jsonl`,
-     * and the checkout is exactly where the operator runs their own terminal
-     * Claude. Left behind, every Deploy press became the newest ENDED session
-     * there: it displaced the operator's real conversation from the `+` adopt
-     * menu (one row per directory), offered to fork a read-only planner into a
-     * build tab, and was what their own `claude --continue` resumed. The
-     * pre-review and the skills probe delete theirs for the same reason.
-     */
-    let planSession = null;
     /** The cap fired: the CLI was still running when this machine stopped it. */
     let wedged = false;
     /**
@@ -320,88 +304,58 @@ export function createWorkAgentPlans({
     try {
       await inPlace(REPO_PLACE, false, async () => {
         /**
-         * THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close`
-         * after the kill — the shape the project check's timeout already
-         * keeps. A SIGKILLed process whose stdio a grandchild still holds can
-         * be slow to emit `close`, or never emit it, and this promise is what
-         * holds the claimed press open.
+         * ONE CAPPED CONSULT TURN (workCappedTurn.mjs): the child registered
+         * in `workChildren` and removed on every exit, the reservation
+         * released at the spawn, the cap ARMED AT THE SPAWN — time spent
+         * waiting for the checkout is not a wedged CLI, and a press that never
+         * got to run is what the server's own clock is for — and the
+         * planner's transcript removed from the CHECKOUT, where it would
+         * otherwise become the newest ENDED session: displacing the
+         * operator's real conversation from the `+` adopt menu, offering to
+         * fork a read-only planner into a build tab, and being what their own
+         * `claude --continue` resumed.
          */
-        let stopWaiting = () => {};
-        const capped = new Promise((r) => {
-          stopWaiting = r;
-        });
-        const turn = runTurn({
-          prompt: AGENT_PLAN_KICKOFF({
-            tasks,
-            liveAgents,
-            agentCap: Number.isInteger(job.agentCap) && job.agentCap > 0 ? job.agentCap : 3,
-          }),
-          system: SYSTEM_PLAN,
-          // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
-          // passed empty, so there is no control plane on this turn at all.
-          profile: 'consult',
-          cwd: repoRoot,
-          runtime: rt,
-          streamJson: true,
-          answerFromResult: true,
-          label: c.cyan('[plan]'),
-          // The CLI's own tail, forwarded to the press. Same rule as an agent
-          // turn's: throttled, overwritten rather than appended, and never
-          // awaited by the turn.
-          onActivity: (a) => {
-            if (a?.label) narrate(String(a.label));
-          },
-          onInit: (i) => {
-            if (typeof i.sessionId === 'string' && i.sessionId.trim())
-              planSession = i.sessionId.trim();
-          },
-          // Tagged with the CLI that counted it; one turn, so the sum is the
-          // one report (turnUsage.mjs keeps it null-safe).
-          onUsage: (u) => {
-            usage = addUsage(usage, { ...u, runtime: rt });
+        ({ out, wedged } = await runCappedTurn({
+          runTurn,
+          capMs: PLAN_TURN_TIMEOUT_MS,
+          workChildren,
+          releaseSlot,
+          transcriptCwd: repoRoot,
+          turnArgs: {
+            prompt: AGENT_PLAN_KICKOFF({
+              tasks,
+              liveAgents,
+              agentCap: Number.isInteger(job.agentCap) && job.agentCap > 0 ? job.agentCap : 3,
+            }),
+            system: SYSTEM_PLAN,
+            // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
+            // passed empty, so there is no control plane on this turn at all.
+            profile: 'consult',
+            cwd: repoRoot,
+            runtime: rt,
+            ...brainFor(job, rt),
+            answerFromResult: true,
+            label: c.cyan('[plan]'),
+            // The CLI's own tail, forwarded to the press. Same rule as an agent
+            // turn's: throttled, overwritten rather than appended, and never
+            // awaited by the turn.
+            onActivity: (a) => {
+              if (a?.label) narrate(String(a.label));
+            },
+            // Tagged with the CLI that counted it; one turn, so the sum is the
+            // one report (turnUsage.mjs keeps it null-safe).
+            onUsage: (u) => {
+              usage = addUsage(usage, { ...u, runtime: rt });
+            },
           },
-          onSpawn: (ch) => {
-            planChild = ch;
-            // No id: a Deploy press is not a task, and the snapshot's per-task
-            // rows must not invent one. It still COUNTS against the machine's
-            // ceiling — see liveTurnCount.
-            workChildren.set(ch, null);
-            releaseSlot();
-            say(`${RUNTIMES[rt]?.label ?? rt} started on this machine`);
-            /**
-             * ARMED AT THE SPAWN, not at the claim: time spent waiting for the
-             * checkout is not a wedged CLI, and a press that never got to run
-             * is what the server's own clock is for.
-             *
-             * The CHILD, never its group — the rule teardown keeps. A
-             * read-only planning turn starts no dev server, so there is
-             * nothing behind it worth signalling and everything to lose by
-             * signalling somebody else's.
-             */
-            planTimer = setTimeout(() => {
-              wedged = true;
-              try {
-                ch.kill('SIGKILL');
-              } catch {
-                /* already gone */
-              }
-              stopWaiting('');
-            }, PLAN_TURN_TIMEOUT_MS);
-            planTimer.unref?.();
+          onSpawn: () => {
+            say(`${runtimeLabel(rt)} started on this machine`);
           },
-        });
-        out = await Promise.race([turn, capped]);
+        }));
       });
     } catch (e) {
       await postAgentPlan({ id, error: envScrub(String(e?.message || e)).slice(0, 500), ...spent() });
       return;
-    } finally {
-      if (planTimer) clearTimeout(planTimer);
-      if (planChild) workChildren.delete(planChild);
-      // On EVERY exit, after the kill and on a delay — the transcript is the
-      // child's file, and removing it while the child is still dying races a
-      // recreate. The pre-review's own shape.
-      if (planSession) setTimeout(() => removeProbeTranscript(repoRoot, planSession), 750).unref?.();
     }
 
     if (wedged) {

package/bin/lib/workAgentPrecheck.mjs

@@ -7,8 +7,8 @@
  * is parsed, scrubbed and re-sent), the project check for SECURITY ones. The
  * review entry beat sequences the two and owns neither.
  */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { git } from './git.mjs';
+import { FLEET_URL } from './config.mjs';
+import { gitOrNull } from './git.mjs';
 import { parsePrecheck } from './agentPlan.mjs';
 import { readStash } from './agentCards.mjs';
 import { c, note } from './ui.mjs';
@@ -16,10 +16,11 @@ import { runTurn } from './runTurn.mjs';
 import { SYSTEM_PRECHECK, AGENT_PRECHECK_KICKOFF } from './prompts.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { pickRuntimeFor } from './runtimeDetection.mjs';
-import { removeProbeTranscript } from './runtimeCapabilities.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
 import { taskIdsFromMessage } from './worktreeDiff.mjs';
 import { limitLine } from './cliLimit.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
+import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
+import { postFleetJson } from './fleetPost.mjs';
 import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workChildren }) {
@@ -38,7 +39,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
   // meets the card it answers from the very context that produced the work. The
   // reviewer stands IN the agent's worktree because it needs the code and the
   // diff, under the `consult` profile (`consultPermFor` — the fenced Read/Glob rules plus
-  // a few path-validated git reads) with NO MCP passed at all, so there is no
+  // a few shell readers; the `git` ones are fenced by the read guard's refusal,
+  // hooks/readGuard.mjs, not by the CLI) with NO MCP passed at all, so there is no
   // control plane on this turn even if the repository it reads tries to steer
   // it.
   //
@@ -94,20 +96,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
    */
   const postPre = async (body) => {
     try {
-      const res = await fetch(AGENT_PRECHECK_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify(body),
-      });
-      return (
-        res.ok ||
-        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
-      );
+      const res = await postFleetJson(AGENT_PRECHECK_URL, body, { timeoutMs: 30_000 });
+      return res.ok || isConsideredRefusal(res.status);
     } catch {
       return false; // a blip — worth one more attempt at a model call's answer
     }
@@ -127,13 +117,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
    * review-entry beat it is standing in.
    */
   const branchLog = (wt) => {
-    let out;
-    try {
-      out = git(['log', '--format=%s%n%b%n--', `${baseRef()}..HEAD`, '--not', baseRef()], wt);
-    } catch {
-      return { text: '', taskIds: [] };
-    }
-    if (typeof out !== 'string') return { text: '', taskIds: [] };
+    const out = gitOrNull(['log', '--format=%s%n%b%n--', `${baseRef()}..HEAD`, '--not', baseRef()], wt);
+    if (out == null) return { text: '', taskIds: [] };
     // LINEAR, never backtracking (audit 2026-09-24) — this was
     // `out.matchAll(/^\s*Flowviant-Task:\s*(\S+)\s*$/gm)`, whose `\s*$` is
     // quadratic against a long trailing run of whitespace on one line
@@ -178,12 +163,7 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
     // `checkFingerprint` shape, so a commit landing after this voids it rather
     // than letting an old reading label a branch it never saw. Optional: an
     // unreadable head costs the staleness comparison, not the precheck.
-    let headSha = null;
-    try {
-      headSha = (git(['rev-parse', 'HEAD'], wt) || '').trim() || null;
-    } catch {
-      headSha = null;
-    }
+    const headSha = gitOrNull(['rev-parse', 'HEAD'], wt);
 
     const stash = readStash(sessionMetaPath(wt, 'flowviant-agent-cards', agentId));
     const log = branchLog(wt);
@@ -193,8 +173,6 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
     const missingSpecs = log.taskIds.filter((id) => !held.has(id)).length;
 
     let out = '';
-    let child = null;
-    let timer = null;
     /** The cap fired: the CLI was still running when this machine stopped it. */
     let wedged = false;
     /**
@@ -202,8 +180,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
      * other lane that charges an AGENT (2026-09-19).
      *
      * It rides the agent and never a card link: a pre-review belongs to no card
-     * (the same reason `workChildren` gets a null task id below), so the four
-     * counters it adds to are the container's alone. That is also why an
+     * (the same reason its `workChildren` entry carries a null task id), so the
+     * four counters it adds to are the container's alone. That is also why an
      * agent's links can never sum to its total, and the schema says so.
      *
      * A WEDGED OR UNPARSEABLE READING POSTS NOTHING AT ALL, so it charges
@@ -212,116 +190,71 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
      * settle to carry a number would be a post whose only content is a bill.
      */
     let usage = null;
-    /**
-     * THE CONVERSATION THIS READING SPEAKS UNDER — held for exactly one reason:
-     * to DELETE the transcript it leaves behind (review, 2026-09-17).
-     *
-     * This is the first thing in the daemon to run a second `claude -p` inside
-     * an AGENT's worktree, and the agent's own resume is `--continue`, which is
-     * CWD-KEYED — the invariant `runAgentTurn` states in words ("ONE AGENT IS
-     * ONE DIRECTORY, so the CLI's own cwd-keyed resume is exactly right here").
-     * Leaving this turn's `~/.claude/projects/<munged-cwd>/<id>.jsonl` in place
-     * makes the read-only stranger the newest conversation in that directory,
-     * so the agent's NEXT turn — a send-back's re-queued card, a merge-resolve,
-     * a human's typed answer — resumes "you are a SECOND reviewer… YOU ARE
-     * READ-ONLY" instead of its own four-turn context, under build permissions.
-     * That is the 0.69.0 Workbench cross-resume and codex's `resume --last`,
-     * arriving a third time by a third route.
-     *
-     * `removeProbeTranscript` is exported for precisely this and already serves
-     * the skills probe and the dev-command resolver.
-     */
-    let preSession = null;
     try {
       /**
-       * THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close` after
-       * the kill — the shape the project check and the planner both keep. A
-       * SIGKILLed process whose stdio a grandchild still holds can be slow to
-       * emit `close`, or never emit it, and this promise is inside the place's
-       * writer lock.
+       * ONE CAPPED CONSULT TURN (workCappedTurn.mjs), the planner's and
+       * intake's shape: the child registered and removed on every exit, the
+       * reservation released at the spawn, the cap armed at the spawn and
+       * resolving the wait itself — this promise is inside the place's writer
+       * lock — and THIS READING'S TRANSCRIPT REMOVED FROM THE WORKTREE
+       * (review, 2026-09-17).
+       *
+       * This is the first thing in the daemon to run a second `claude -p`
+       * inside an AGENT's worktree, and the agent's own resume is
+       * `--continue`, which is CWD-KEYED — the invariant `runAgentTurn` states
+       * in words ("ONE AGENT IS ONE DIRECTORY, so the CLI's own cwd-keyed
+       * resume is exactly right here"). Leaving this turn's
+       * `~/.claude/projects/<munged-cwd>/<id>.jsonl` in place makes the
+       * read-only stranger the newest conversation in that directory, so the
+       * agent's NEXT turn — a send-back's re-queued card, a merge-resolve, a
+       * human's typed answer — resumes "you are a SECOND reviewer… YOU ARE
+       * READ-ONLY" instead of its own four-turn context, under build
+       * permissions. That is the 0.69.0 Workbench cross-resume and codex's
+       * `resume --last`, arriving a third time by a third route.
        */
-      let stopWaiting = () => {};
-      const capped = new Promise((r) => {
-        stopWaiting = r;
-      });
-      const turn = runTurn({
-        prompt: AGENT_PRECHECK_KICKOFF({
-          agentName,
-          cards: stash.map((s) => s.prompt).join('\n---\n'),
-          missingSpecs,
-          commits: log.text,
-          diffCommand: `git diff ${baseRef()}...HEAD`,
-        }),
-        system: SYSTEM_PRECHECK,
-        // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
-        // passed empty, so there is no control plane on this turn at all.
-        profile: 'consult',
-        cwd: wt,
-        runtime: rt,
-        // The agent's own browser profile, in the worktree this reader stands
-        // in; no display either way (noWindowEnv.mjs, 2026-09-29).
-        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
-        // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
-        // agent grading its own homework out of its own context; this is a
-        // stranger reading a diff.
-        streamJson: true,
-        answerFromResult: true,
-        label: c.cyan('[pre-review]'),
-        // The id the CLI reports at `system.init` — harvested off the stream
-        // this turn already parses, no probe and no extra spawn. Held only so
-        // the `finally` below can delete this turn's transcript; see
-        // `preSession`.
-        onInit: (i) => {
-          if (typeof i.sessionId === 'string' && i.sessionId.trim())
-            preSession = i.sessionId.trim();
-        },
-        // The CLI's own count for this reading. Set, never accumulated: one
-        // turn is one `result` event, and the adding-up is the server's.
-        // Tagged with the CLI, so a Claude pre-review of a Codex agent is
-        // charged as Claude's and not folded into the agent's own figure.
-        onUsage: (u) => {
-          usage = { ...u, runtime: rt };
+      ({ out, wedged } = await runCappedTurn({
+        runTurn,
+        capMs: PRECHECK_TIMEOUT_MS,
+        workChildren,
+        releaseSlot,
+        transcriptCwd: wt,
+        turnArgs: {
+          prompt: AGENT_PRECHECK_KICKOFF({
+            agentName,
+            cards: stash.map((s) => s.prompt).join('\n---\n'),
+            missingSpecs,
+            commits: log.text,
+            diffCommand: `git diff ${baseRef()}...HEAD`,
+          }),
+          system: SYSTEM_PRECHECK,
+          // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
+          // passed empty, so there is no control plane on this turn at all.
+          profile: 'consult',
+          cwd: wt,
+          runtime: rt,
+          // The agent's own browser profile, in the worktree this reader stands
+          // in; no display either way (noWindowEnv.mjs, 2026-09-29).
+          browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
+          // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
+          // agent grading its own homework out of its own context; this is a
+          // stranger reading a diff.
+          answerFromResult: true,
+          label: c.cyan('[pre-review]'),
+          // The CLI's own count for this reading. Set, never accumulated: one
+          // turn is one `result` event, and the adding-up is the server's.
+          // Tagged with the CLI, so a Claude pre-review of a Codex agent is
+          // charged as Claude's and not folded into the agent's own figure.
+          onUsage: (u) => {
+            usage = { ...u, runtime: rt };
+          },
         },
-        onSpawn: (ch) => {
-          child = ch;
-          // No task id: a pre-review belongs to no card, and the machine
-          // snapshot's per-task rows must not invent one. It still COUNTS
-          // against the machine's ceiling — see liveTurnCount.
-          workChildren.set(ch, null);
-          releaseSlot();
-          // ARMED AT THE SPAWN, not at entry: time spent getting here is not a
-          // wedged CLI. The CHILD and never its group — a read-only turn starts
-          // no server, so there is nothing behind it worth signalling and
-          // everything to lose by signalling somebody else's.
-          timer = setTimeout(() => {
-            wedged = true;
-            try {
-              ch.kill('SIGKILL');
-            } catch {
-              /* already gone */
-            }
-            stopWaiting('');
-          }, PRECHECK_TIMEOUT_MS);
-          timer.unref?.();
-        },
-      });
-      out = await Promise.race([turn, capped]);
+      }));
     } catch {
       return; // a label may never fail the beat it rides
     } finally {
-      if (timer) clearTimeout(timer);
-      if (child) workChildren.delete(child);
+      // The reservation this lane took itself, released on every exit — the
+      // turn's own release covers a spawn; this covers everything else.
       releaseSlot();
-      /**
-       * DELETE THIS READING'S TRANSCRIPT, on EVERY exit — settled, wedged and
-       * killed, or thrown — because every one of them leaves the file behind
-       * and the agent's `--continue` reads the newest one in the directory.
-       *
-       * AFTER the kill and ON A DELAY, the skills probe's own shape: the
-       * transcript is the CHILD's file, so removing it while the child is still
-       * dying races a recreate. Unref'd — it must not hold the process open.
-       */
-      if (preSession) setTimeout(() => removeProbeTranscript(wt, preSession), 750).unref?.();
     }
 
     // A WEDGED READING POSTS NOTHING. There is no row to settle and nobody

package/bin/lib/workAgentPublish.mjs

@@ -10,7 +10,7 @@
  * begun-guard, the sweep keeps a published branch current, the merge lane
  * retires the ref — all through the maps and two functions returned here.
  */
-import { git } from './git.mjs';
+import { gitOrNull, sessionBranchRef } from './git.mjs';
 import { publishPushArgs, publishFetchArgs, publishErrorText } from './agentPublish.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 
@@ -67,13 +67,11 @@ export function createWorkAgentPublish({ repoRoot, gitNet }) {
    *  — which is a perfectly ordinary state (the begun-guard's whole subject) and
    *  means there is nothing to publish, never that a push failed. */
   const agentBranchSha = (place) => {
-    try {
-      return (
-        git(['rev-parse', '--verify', '--quiet', `refs/heads/session/${place}`], repoRoot) || null
-      );
-    } catch {
-      return null;
-    }
+    // The one branch-name definition (git.mjs): an unsafe place names no
+    // branch, which is the same "nothing to publish" as an absent one.
+    const ref = sessionBranchRef(place);
+    if (!ref) return null;
+    return gitOrNull(['rev-parse', '--verify', '--quiet', ref], repoRoot);
   };
   /**
    * PUSH ONE AGENT'S BRANCH TO THE NAME THE SERVER GAVE IT.