flowviant 0.116.0 → 0.117.0

package/bin/lib/workReportQueue.mjs

@@ -6,16 +6,19 @@
  * Split out of work.mjs (2026-09-26, SOLID F037). The queue is the skip-guard
  * that stops a side-effecting turn being re-run over a dropped 200, so its
  * delivery rules (ok / terminal / reject / retry) have exactly one home; the
- * session lane settles through `settleWorkTurn`, the ship lane through
- * `settleShip`, and the plan and check lanes through `postBestEffort`. The
- * attempts counter is the session lane's, handed in by name, because a
- * terminal delivery is what may forget it.
+ * session lane settles through `settleWorkTurn` and the ship lane through
+ * `settleShip`; the plan, check and intake lanes, which have no queue, settle
+ * through fleetPost.mjs's `postBestEffort` (it closed over nothing of this
+ * queue's and moved there, audit 2026-10-10 F136). The attempts counter is
+ * the session lane's, handed in by name, because a terminal delivery is what
+ * may forget it.
  */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+import { FLEET_URL } from './config.mjs';
 import { git } from './git.mjs';
 import { sweepMergedBranch } from './shipSweep.mjs';
 import { note } from './ui.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
+import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
+import { fleetRequest } from './fleetPost.mjs';
 
 export function createWorkReportQueue({
   repoRoot,
@@ -58,137 +61,102 @@ export function createWorkReportQueue({
    *     hammered a refused body forever.
    *   - 'retry' — network errors, 408, 429 and 5xx: nothing was decided. */
   const postSettle = async (url, body, terminalStatuses) => {
-    try {
-      const res = await fetch(url, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify(body),
-      });
-      if (res.ok) return 'ok';
-      if (terminalStatuses.includes(res.status)) return 'terminal';
-      if (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
-        return 'reject';
-      return 'retry';
-    } catch {
-      return 'retry';
-    }
+    const r = await fleetRequest(url, { body, timeoutMs: 30_000 });
+    if (r.error) return 'retry';
+    if (r.ok) return 'ok';
+    if (terminalStatuses.includes(r.status)) return 'terminal';
+    if (isConsideredRefusal(r.status)) return 'reject';
+    return 'retry';
   };
 
-  /** Retry-After, in ms — seconds or an HTTP-date — capped so one bad or
-   *  hostile header cannot stall a caller for an hour. Falls back to the
-   *  caller's own backoff when the header is absent or unparseable. */
-  const retryAfterMs = (res, fallbackMs) => {
-    const h = res?.headers?.get?.('retry-after');
-    if (h == null) return fallbackMs;
-    const secs = Number(h);
-    if (Number.isFinite(secs)) return Math.max(0, Math.min(secs * 1000, 60_000));
-    const at = Date.parse(h);
-    return Number.isFinite(at) ? Math.max(0, Math.min(at - Date.now(), 60_000)) : fallbackMs;
-  };
+  /** How long a REJECTED report sits out before re-offering its body — long
+   *  enough that a deploy-skew 400 costs a handful of POSTs a day, short
+   *  enough that a server fix picks the report up the same morning. */
+  const REJECT_RETRY_MS = 10 * 60 * 1000;
+  // Keyed `${queue}:${id}` — a turn id and a session id are different
+  // namespaces, and one queue's backoff must never hold the other's report.
+  const reportBackoff = new Map(); // `work:<turnId>` | `ship:<sessionId>` -> earliest next attempt
 
   /**
-   * A best-effort settle POST, AWAITED INLINE by a caller with no per-poll
-   * queue of its own to retry from — unlike `postSettle` above, whose callers
-   * requeue a 'retry'/'reject' outcome themselves. Bounded attempts: 408/429
-   * retry honouring Retry-After, 5xx retries on a short fixed backoff, and
-   * any OTHER 4xx is the server's considered answer — retrying it would just
-   * spend the same refusal again, so it counts as delivered, the existing
-   * trace convention. A network error retries the same way and is then
-   * swallowed: unsettled, and the server expires the job so the asker is
-   * told, never spun.
+   * WHAT A DELIVERED SHIP REPORT SETS OFF — on BOTH paths, the immediate settle
+   * and the per-poll flush (audit 2026-10-10, F158). The flush used to run only
+   * the sweep, so a ship whose first ship-done POST hit a 502 left the rail
+   * rendering the whole pre-ship diff, the Repository block counting a deleted
+   * branch and card closes waiting on the 3-minute fetch. These follow the
+   * MERGE, not the report's punctuality: an action that changes what the
+   * machine would measure must cause a new measurement.
    */
-  const postBestEffort = async (url, body, { attempts = 4, timeoutMs = 30_000 } = {}) => {
-    for (let i = 0; i < attempts; i += 1) {
-      let res;
-      try {
-        res = await fetch(url, {
-          method: 'POST',
-          headers: {
-            Authorization: `Bearer ${FLEET_TOKEN}`,
-            'User-Agent': USER_AGENT,
-            'Content-Type': 'application/json',
-          },
-          signal: AbortSignal.timeout(timeoutMs),
-          body: JSON.stringify(body),
-        });
-      } catch {
-        if (i === attempts - 1) return false;
-        await new Promise((r) => setTimeout(r, 2_000 * (i + 1)));
-        continue;
-      }
-      if (res.ok) return true;
-      if (res.status === 408 || res.status === 429) {
-        if (i === attempts - 1) return false;
-        await new Promise((r) => setTimeout(r, retryAfterMs(res, 2_000 * (i + 1))));
-        continue;
-      }
-      if (res.status >= 500) {
-        if (i === attempts - 1) return false;
-        await new Promise((r) => setTimeout(r, 2_000 * (i + 1)));
-        continue;
-      }
-      return true; // any other 4xx — the server's considered answer
-    }
-    return false;
+  const shipDelivered = (sessionId) => {
+    // The report has landed, so the idempotency path no longer needs the
+    // branch to exist. See `sweepMergedSessionBranch`.
+    sweepMergedSessionBranch(sessionId);
+    // AND THE DIFFSTAT IS NOW WRONG BY DEFINITION. A ship folds base in,
+    // merges the tip out and deletes the branch, so a fresh measurement reads
+    // `ahead: 0` with an empty diffstat — and without this the rail keeps
+    // rendering the ENTIRE pre-ship diff while the transcript two hundred
+    // pixels away says "Shipped to main". The ship button re-arms over a
+    // branch that is already merged. Same rule the kill path just learned:
+    // an action that changes what the machine would measure must cause a new
+    // measurement, and the 60s sweep is not that.
+    void reportPlaceWorktrees(sessionId).catch(() => {});
+    burstListeners(sessionId);
+    // …and the REPO picture changed too: the session branch is gone and base
+    // moved. Without this the Repository block keeps counting a branch the
+    // ship just deleted.
+    onRepoChanged();
+    // The ship's push moved the local origin/<base> ref — observe now, so
+    // the landed report (and anything trailered a ship carried) lands on
+    // this beat rather than the next 3-minute fetch.
+    void landed.observe().catch(() => {});
   };
 
-  /** How long a REJECTED report sits out before re-offering its body — long
-   *  enough that a deploy-skew 400 costs a handful of POSTs a day, short
-   *  enough that a server fix picks the report up the same morning. */
-  const REJECT_RETRY_MS = 10 * 60 * 1000;
-  const reportBackoff = new Map(); // turnId|sessionId -> earliest next attempt
-  const settleWorkTurn = async (turnId, payload) => {
-    const body = { turnId, ...payload };
-    const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
-    if (r === 'retry' || r === 'reject') {
-      pendingWorkReports.set(turnId, body);
-      if (r === 'reject') reportBackoff.set(turnId, Date.now() + REJECT_RETRY_MS);
-    } else {
-      pendingWorkReports.delete(turnId);
-      workAttempts.delete(turnId);
-      reportBackoff.delete(turnId);
-    }
-    return r;
+  /** EACH QUEUE, DESCRIBED ONCE — its endpoint, the explicit statuses under
+   *  which the server will never re-offer the job, the id the body carries,
+   *  and what a delivery (on time or late) forgets or sets off. The settle
+   *  and the flush both deliver through `deliver`, so the two paths cannot
+   *  drift apart again. */
+  const QUEUES = {
+    work: {
+      name: 'work',
+      url: WORK_DONE_URL,
+      terminal: [403, 404],
+      pending: pendingWorkReports,
+      idKey: 'turnId',
+      delivered: (id) => workAttempts.delete(id),
+    },
+    ship: {
+      name: 'ship',
+      url: SHIP_DONE_URL,
+      terminal: [403, 409],
+      pending: pendingShipReports,
+      idKey: 'sessionId',
+      delivered: shipDelivered,
+    },
   };
-  const settleShip = async (sessionId, payload) => {
-    const body = { sessionId, ...payload };
-    const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
+  const backoffKey = (q, id) => `${q.name}:${id}`;
+
+  /** POST one queue's body and apply the outcome: 'retry' and 'reject' keep
+   *  it queued (the skip-guard) and only 'reject' backs off; 'ok' and
+   *  'terminal' forget it — and its backoff — and run the queue's delivered
+   *  effects. */
+  const deliver = async (q, id, body) => {
+    const r = await postSettle(q.url, body, q.terminal);
     if (r === 'retry' || r === 'reject') {
-      pendingShipReports.set(sessionId, body);
-      if (r === 'reject') reportBackoff.set(sessionId, Date.now() + REJECT_RETRY_MS);
+      q.pending.set(id, body);
+      if (r === 'reject') reportBackoff.set(backoffKey(q, id), Date.now() + REJECT_RETRY_MS);
     } else {
-      pendingShipReports.delete(sessionId);
-      reportBackoff.delete(sessionId);
-      // The report has landed, so the idempotency path no longer needs the
-      // branch to exist. See `sweepMergedSessionBranch`.
-      sweepMergedSessionBranch(sessionId);
-      // AND THE DIFFSTAT IS NOW WRONG BY DEFINITION. A ship folds base in,
-      // merges the tip out and deletes the branch, so a fresh measurement reads
-      // `ahead: 0` with an empty diffstat — and without this the rail keeps
-      // rendering the ENTIRE pre-ship diff while the transcript two hundred
-      // pixels away says "Shipped to main". The ship button re-arms over a
-      // branch that is already merged. Same rule the kill path just learned:
-      // an action that changes what the machine would measure must cause a new
-      // measurement, and the 60s sweep is not that.
-      void reportPlaceWorktrees(sessionId).catch(() => {});
-      burstListeners(sessionId);
-      // …and the REPO picture changed too: the session branch is gone and base
-      // moved. Without this the Repository block keeps counting a branch the
-      // ship just deleted.
-      onRepoChanged();
-      // The ship's push moved the local origin/<base> ref — observe now, so
-      // the landed report (and anything trailered a ship carried) lands on
-      // this beat rather than the next 3-minute fetch.
-      void landed.observe().catch(() => {});
+      q.pending.delete(id);
+      reportBackoff.delete(backoffKey(q, id));
+      q.delivered(id);
     }
     return r;
   };
 
+  const settleWorkTurn = (turnId, payload) =>
+    deliver(QUEUES.work, turnId, { [QUEUES.work.idKey]: turnId, ...payload });
+  const settleShip = (sessionId, payload) =>
+    deliver(QUEUES.ship, sessionId, { [QUEUES.ship.idKey]: sessionId, ...payload });
+
   /** See `shipSweep.mjs`. Bound to this manager's repo, base and report queue. */
   const sweepMergedSessionBranch = (sessionId) =>
     sweepMergedBranch(sessionId, {
@@ -210,30 +178,15 @@ export function createWorkReportQueue({
     if (pendingWorkReports.size === 0 && pendingShipReports.size === 0) return;
     flushingReports = true;
     try {
-      for (const [id, body] of [...pendingWorkReports]) {
-        // A rejected body sits out its backoff; the queued entry itself stays
-        // — it is the skip-guard against re-running a turn whose side effects
-        // already happened.
-        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
-        const r = await postSettle(WORK_DONE_URL, body, [403, 404]);
-        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
-        else if (r !== 'retry') {
-          pendingWorkReports.delete(id);
-          workAttempts.delete(id);
-          reportBackoff.delete(id);
-        }
-      }
-      for (const [id, body] of [...pendingShipReports]) {
-        if ((reportBackoff.get(id) ?? 0) > Date.now()) continue;
-        const r = await postSettle(SHIP_DONE_URL, body, [403, 409]);
-        if (r === 'reject') reportBackoff.set(id, Date.now() + REJECT_RETRY_MS);
-        else if (r !== 'retry') {
-          pendingShipReports.delete(id);
-          reportBackoff.delete(id);
-          // Delivered late is still delivered — same sweep as the immediate
-          // path, and it must be here too or a report that needed a retry
-          // would leave its branch behind forever.
-          sweepMergedSessionBranch(id);
+      for (const q of [QUEUES.work, QUEUES.ship]) {
+        for (const [id, body] of [...q.pending]) {
+          // A rejected body sits out its backoff; the queued entry itself
+          // stays — it is the skip-guard against re-running a turn whose side
+          // effects already happened. Delivered late is still delivered: the
+          // same effects as the immediate path (a ship's sweep, re-measure,
+          // repo refresh and landed observation).
+          if ((reportBackoff.get(backoffKey(q, id)) ?? 0) > Date.now()) continue;
+          await deliver(q, id, body);
         }
       }
     } finally {
@@ -244,7 +197,6 @@ export function createWorkReportQueue({
   return {
     pendingWorkReports,
     pendingShipReports,
-    postBestEffort,
     REJECT_RETRY_MS,
     settleWorkTurn,
     settleShip,

package/bin/lib/workRetire.mjs

@@ -11,6 +11,7 @@
 import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { git, isSafePathSegment } from './git.mjs';
+import { PERSON_PLACE_PREFIX } from './workPlaces.mjs';
 
 export function createWorkRetire({
   repoRoot,
@@ -169,7 +170,7 @@ export function createWorkRetire({
       // Only a PERSON's manual place. An agent's own worktree (`a-<id>`) is
       // deliberately not touched: its branch is the reviewable unit, and
       // moving it under a review would change what somebody is deciding about.
-      if (!place.startsWith('u-') || !isSafePathSegment(place)) continue;
+      if (!place.startsWith(PERSON_PLACE_PREFIX) || !isSafePathSegment(place)) continue;
       if (placeLocks.has(place)) continue;
       const wt = join(baseDir, 'sessions', place);
       try {

package/bin/lib/workSessionRuntime.mjs

@@ -1,32 +1,24 @@
 /**
- * WHICH CLI A TAB SPEAKS, AND WHICH CONVERSATION IT RESUMES — the runtime pin
- * and the shapes a resume id must have before it rides argv.
+ * WHICH CLI A TAB SPEAKS — the runtime pin, and agy's cwd registry the first
+ * turn learns its conversation from.
  *
- * Split out of work.mjs (2026-09-26, SOLID F037). The pin and the id guards
- * change together (a new CLI brings both), and none of it is about running a
- * turn: the session lane asks `sessionRuntime` before it spawns. The two id
- * guards are pure and module-level: both turn lanes import them, so the
- * manager never carries a constant between lanes.
+ * Split out of work.mjs (2026-09-26, SOLID F037). None of it is about running
+ * a turn: the session lane asks `sessionRuntime` before it spawns.
+ *
+ * THE ID SHAPES MOVED to a leaf (audit 2026-10-10, F157): conversationIds.mjs
+ * owns every CLI's conversation-id guard and marker name, because the
+ * machine readers below the lanes (runtimeLimits, the session scanners) need
+ * them too and a lane module is not theirs to import. The two guards the
+ * agent lane imports from here are re-exported unchanged.
  */
 import { existsSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { canRun, RUNTIMES } from './runtimes.mjs';
+import { canRun, RUNTIMES, runtimeById, runtimeLabel } from './runtimes.mjs';
 import { detectRuntimes } from './runtimeDetection.mjs';
+import { AGY_CONV_RE, CODEX_THREAD_RE } from './conversationIds.mjs';
 
-/**
- * The shape a codex thread id must have before it is written to disk or —
- * decisive — pushed into argv as `resume <id>`. Conservative on purpose:
- * alphanumeric plus dash/underscore, never a leading dash (an argv that
- * parses as a flag), never whitespace. Anything else is dropped and the
- * session simply runs fresh in its own worktree.
- */
-export const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
-
-/** agy conversation ids are plain UUIDs (the db filename IS the identity —
- *  measured: a renamed copy fails "trajectory not found"). Guarded the same
- *  way as the codex id: it rides in argv as `--conversation <id>`. */
-export const AGY_CONV_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export { AGY_CONV_RE, CODEX_THREAD_RE };
 
 export function createWorkSessionRuntime({ sessionMetaPath }) {
   /**
@@ -52,15 +44,19 @@ export function createWorkSessionRuntime({ sessionMetaPath }) {
    * { mismatch: { pin, runtime } } (labels, for the caller's sentence).
    *
    * SESSION-CAPABLE means rt.mcp is truthy — the session tools ride a real
-   * per-invocation MCP config — OR the runtime runs tabs PLAIN (Antigravity):
-   * no MCP at all, no cards, no streaming; the final answer is delivered by
-   * the daemon's own report and ship-time reconciliation keeps the ledger
-   * whole. `pickRuntimeFor('build')` is still the WRONG question here — it
-   * says yes to the mediated DISPATCH path without saying how a tab would
-   * speak, and a session pinned by it once threw in mcpFor on every turn.
+   * per-invocation MCP config — OR the runtime's row runs tabs PLAIN
+   * (`tab: 'plain'`, Antigravity's): no MCP at all, no cards, no streaming;
+   * the final answer is delivered by the daemon's own report and ship-time
+   * reconciliation keeps the ledger whole. The row says so, and the turn's
+   * shape reads the same fact (workTurnShape.mjs). `pickRuntimeFor('build')`
+   * is still the WRONG question here — it says yes to the mediated DISPATCH
+   * path without saying how a tab would speak, and a session pinned by it
+   * once threw in mcpFor on every turn.
    */
-  const sessionCapable = (rid) =>
-    (Boolean(RUNTIMES[rid]?.mcp) || rid === 'antigravity') && canRun(RUNTIMES[rid], 'build');
+  const sessionCapable = (rid) => {
+    const rt = runtimeById(rid);
+    return (Boolean(rt?.mcp) || rt?.tab === 'plain') && canRun(rt, 'build');
+  };
   const sessionRuntime = (wt, jobRuntime, sessionId) => {
     // SCOPED: two tabs standing in one directory may run different CLIs, and an
     // unscoped pin would hand the second one the first one's runtime.
@@ -73,12 +69,17 @@ export function createWorkSessionRuntime({ sessionMetaPath }) {
         /* unreadable marker — re-pin below */
       }
     }
-    if (pinned && RUNTIMES[pinned]) {
+    // A marker naming no runtime this daemon declares — torn, hand-edited, or
+    // a prototype key like `constructor` — is no pin at all: it is re-picked
+    // exactly like a missing one (audit 2026-10-10, F125). It used to enter
+    // this branch on truthiness and settle every turn as "unsupported
+    // constructor".
+    if (pinned && runtimeById(pinned)) {
       if (jobRuntime && jobRuntime !== pinned) {
         return {
           mismatch: {
-            pin: RUNTIMES[pinned].label || pinned,
-            runtime: RUNTIMES[jobRuntime]?.label || jobRuntime,
+            pin: runtimeLabel(pinned),
+            runtime: runtimeLabel(jobRuntime),
           },
         };
       }
@@ -86,18 +87,18 @@ export function createWorkSessionRuntime({ sessionMetaPath }) {
       // the caller, not silently re-picked: re-picking would hand the held
       // context to a different brain, which is the exact substitution the pin
       // exists to prevent.
-      if (!sessionCapable(pinned)) return { unsupported: RUNTIMES[pinned].label || pinned };
+      if (!sessionCapable(pinned)) return { unsupported: runtimeLabel(pinned) };
       const installed = detectRuntimes().find((r) => r.id === pinned)?.installed;
-      return installed ? { id: pinned } : { missing: RUNTIMES[pinned].label || pinned };
+      return installed ? { id: pinned } : { missing: runtimeLabel(pinned) };
     }
     // First turn, and the server named the brain: that IS the pick, gated the
     // same two ways as a pin — not session-capable and not installed both
     // settle honestly via the caller's existing paths, never substituted.
     if (jobRuntime) {
       if (!sessionCapable(jobRuntime))
-        return { unsupported: RUNTIMES[jobRuntime]?.label || jobRuntime };
+        return { unsupported: runtimeLabel(jobRuntime) };
       const installed = detectRuntimes().find((r) => r.id === jobRuntime)?.installed;
-      if (!installed) return { missing: RUNTIMES[jobRuntime]?.label || jobRuntime };
+      if (!installed) return { missing: runtimeLabel(jobRuntime) };
       if (marker) {
         try {
           writeFileSync(marker, jobRuntime);
@@ -114,7 +115,7 @@ export function createWorkSessionRuntime({ sessionMetaPath }) {
     // when the server names it, never handed out as a default.
     const rows = detectRuntimes();
     const okFor = (rid) =>
-      Boolean(RUNTIMES[rid]?.mcp) &&
+      Boolean(runtimeById(rid)?.mcp) &&
       sessionCapable(rid) &&
       Boolean(rows.find((r) => r.id === rid)?.installed);
     const id = okFor('claude') ? 'claude' : (Object.keys(RUNTIMES).find(okFor) ?? null);