flowviant 0.116.0 → 0.124.0

package/bin/lib/workAgentPrecheck.mjs

@@ -7,8 +7,8 @@
  * is parsed, scrubbed and re-sent), the project check for SECURITY ones. The
  * review entry beat sequences the two and owns neither.
  */
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { git } from './git.mjs';
+import { FLEET_URL } from './config.mjs';
+import { gitOrNull } from './git.mjs';
 import { parsePrecheck } from './agentPlan.mjs';
 import { readStash } from './agentCards.mjs';
 import { c, note } from './ui.mjs';
@@ -16,10 +16,11 @@ import { runTurn } from './runTurn.mjs';
 import { SYSTEM_PRECHECK, AGENT_PRECHECK_KICKOFF } from './prompts.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 import { pickRuntimeFor } from './runtimeDetection.mjs';
-import { removeProbeTranscript } from './runtimeCapabilities.mjs';
+import { runCappedTurn } from './workCappedTurn.mjs';
 import { taskIdsFromMessage } from './worktreeDiff.mjs';
 import { limitLine } from './cliLimit.mjs';
-import { fleetEndpoint } from './fleetWire.mjs';
+import { fleetEndpoint, isConsideredRefusal } from './fleetWire.mjs';
+import { postFleetJson } from './fleetPost.mjs';
 import { agentBrowserHome } from './noWindowEnv.mjs';
 
 export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workChildren }) {
@@ -38,7 +39,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
   // meets the card it answers from the very context that produced the work. The
   // reviewer stands IN the agent's worktree because it needs the code and the
   // diff, under the `consult` profile (`consultPermFor` — the fenced Read/Glob rules plus
-  // a few path-validated git reads) with NO MCP passed at all, so there is no
+  // a few shell readers; the `git` ones are fenced by the read guard's refusal,
+  // hooks/readGuard.mjs, not by the CLI) with NO MCP passed at all, so there is no
   // control plane on this turn even if the repository it reads tries to steer
   // it.
   //
@@ -94,20 +96,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
    */
   const postPre = async (body) => {
     try {
-      const res = await fetch(AGENT_PRECHECK_URL, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${FLEET_TOKEN}`,
-          'User-Agent': USER_AGENT,
-          'Content-Type': 'application/json',
-        },
-        signal: AbortSignal.timeout(30_000),
-        body: JSON.stringify(body),
-      });
-      return (
-        res.ok ||
-        (res.status >= 400 && res.status < 500 && res.status !== 408 && res.status !== 429)
-      );
+      const res = await postFleetJson(AGENT_PRECHECK_URL, body, { timeoutMs: 30_000 });
+      return res.ok || isConsideredRefusal(res.status);
     } catch {
       return false; // a blip — worth one more attempt at a model call's answer
     }
@@ -127,13 +117,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
    * review-entry beat it is standing in.
    */
   const branchLog = (wt) => {
-    let out;
-    try {
-      out = git(['log', '--format=%s%n%b%n--', `${baseRef()}..HEAD`, '--not', baseRef()], wt);
-    } catch {
-      return { text: '', taskIds: [] };
-    }
-    if (typeof out !== 'string') return { text: '', taskIds: [] };
+    const out = gitOrNull(['log', '--format=%s%n%b%n--', `${baseRef()}..HEAD`, '--not', baseRef()], wt);
+    if (out == null) return { text: '', taskIds: [] };
     // LINEAR, never backtracking (audit 2026-09-24) — this was
     // `out.matchAll(/^\s*Flowviant-Task:\s*(\S+)\s*$/gm)`, whose `\s*$` is
     // quadratic against a long trailing run of whitespace on one line
@@ -178,12 +163,7 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
     // `checkFingerprint` shape, so a commit landing after this voids it rather
     // than letting an old reading label a branch it never saw. Optional: an
     // unreadable head costs the staleness comparison, not the precheck.
-    let headSha = null;
-    try {
-      headSha = (git(['rev-parse', 'HEAD'], wt) || '').trim() || null;
-    } catch {
-      headSha = null;
-    }
+    const headSha = gitOrNull(['rev-parse', 'HEAD'], wt);
 
     const stash = readStash(sessionMetaPath(wt, 'flowviant-agent-cards', agentId));
     const log = branchLog(wt);
@@ -193,8 +173,6 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
     const missingSpecs = log.taskIds.filter((id) => !held.has(id)).length;
 
     let out = '';
-    let child = null;
-    let timer = null;
     /** The cap fired: the CLI was still running when this machine stopped it. */
     let wedged = false;
     /**
@@ -202,8 +180,8 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
      * other lane that charges an AGENT (2026-09-19).
      *
      * It rides the agent and never a card link: a pre-review belongs to no card
-     * (the same reason `workChildren` gets a null task id below), so the four
-     * counters it adds to are the container's alone. That is also why an
+     * (the same reason its `workChildren` entry carries a null task id), so the
+     * four counters it adds to are the container's alone. That is also why an
      * agent's links can never sum to its total, and the schema says so.
      *
      * A WEDGED OR UNPARSEABLE READING POSTS NOTHING AT ALL, so it charges
@@ -212,116 +190,71 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
      * settle to carry a number would be a post whose only content is a bill.
      */
     let usage = null;
-    /**
-     * THE CONVERSATION THIS READING SPEAKS UNDER — held for exactly one reason:
-     * to DELETE the transcript it leaves behind (review, 2026-09-17).
-     *
-     * This is the first thing in the daemon to run a second `claude -p` inside
-     * an AGENT's worktree, and the agent's own resume is `--continue`, which is
-     * CWD-KEYED — the invariant `runAgentTurn` states in words ("ONE AGENT IS
-     * ONE DIRECTORY, so the CLI's own cwd-keyed resume is exactly right here").
-     * Leaving this turn's `~/.claude/projects/<munged-cwd>/<id>.jsonl` in place
-     * makes the read-only stranger the newest conversation in that directory,
-     * so the agent's NEXT turn — a send-back's re-queued card, a merge-resolve,
-     * a human's typed answer — resumes "you are a SECOND reviewer… YOU ARE
-     * READ-ONLY" instead of its own four-turn context, under build permissions.
-     * That is the 0.69.0 Workbench cross-resume and codex's `resume --last`,
-     * arriving a third time by a third route.
-     *
-     * `removeProbeTranscript` is exported for precisely this and already serves
-     * the skills probe and the dev-command resolver.
-     */
-    let preSession = null;
     try {
       /**
-       * THE CAP RESOLVES THE WAIT ITSELF rather than waiting for `close` after
-       * the kill — the shape the project check and the planner both keep. A
-       * SIGKILLed process whose stdio a grandchild still holds can be slow to
-       * emit `close`, or never emit it, and this promise is inside the place's
-       * writer lock.
+       * ONE CAPPED CONSULT TURN (workCappedTurn.mjs), the planner's and
+       * intake's shape: the child registered and removed on every exit, the
+       * reservation released at the spawn, the cap armed at the spawn and
+       * resolving the wait itself — this promise is inside the place's writer
+       * lock — and THIS READING'S TRANSCRIPT REMOVED FROM THE WORKTREE
+       * (review, 2026-09-17).
+       *
+       * This is the first thing in the daemon to run a second `claude -p`
+       * inside an AGENT's worktree, and the agent's own resume is
+       * `--continue`, which is CWD-KEYED — the invariant `runAgentTurn` states
+       * in words ("ONE AGENT IS ONE DIRECTORY, so the CLI's own cwd-keyed
+       * resume is exactly right here"). Leaving this turn's
+       * `~/.claude/projects/<munged-cwd>/<id>.jsonl` in place makes the
+       * read-only stranger the newest conversation in that directory, so the
+       * agent's NEXT turn — a send-back's re-queued card, a merge-resolve, a
+       * human's typed answer — resumes "you are a SECOND reviewer… YOU ARE
+       * READ-ONLY" instead of its own four-turn context, under build
+       * permissions. That is the 0.69.0 Workbench cross-resume and codex's
+       * `resume --last`, arriving a third time by a third route.
        */
-      let stopWaiting = () => {};
-      const capped = new Promise((r) => {
-        stopWaiting = r;
-      });
-      const turn = runTurn({
-        prompt: AGENT_PRECHECK_KICKOFF({
-          agentName,
-          cards: stash.map((s) => s.prompt).join('\n---\n'),
-          missingSpecs,
-          commits: log.text,
-          diffCommand: `git diff ${baseRef()}...HEAD`,
-        }),
-        system: SYSTEM_PRECHECK,
-        // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
-        // passed empty, so there is no control plane on this turn at all.
-        profile: 'consult',
-        cwd: wt,
-        runtime: rt,
-        // The agent's own browser profile, in the worktree this reader stands
-        // in; no display either way (noWindowEnv.mjs, 2026-09-29).
-        browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
-        // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
-        // agent grading its own homework out of its own context; this is a
-        // stranger reading a diff.
-        streamJson: true,
-        answerFromResult: true,
-        label: c.cyan('[pre-review]'),
-        // The id the CLI reports at `system.init` — harvested off the stream
-        // this turn already parses, no probe and no extra spawn. Held only so
-        // the `finally` below can delete this turn's transcript; see
-        // `preSession`.
-        onInit: (i) => {
-          if (typeof i.sessionId === 'string' && i.sessionId.trim())
-            preSession = i.sessionId.trim();
-        },
-        // The CLI's own count for this reading. Set, never accumulated: one
-        // turn is one `result` event, and the adding-up is the server's.
-        // Tagged with the CLI, so a Claude pre-review of a Codex agent is
-        // charged as Claude's and not folded into the agent's own figure.
-        onUsage: (u) => {
-          usage = { ...u, runtime: rt };
+      ({ out, wedged } = await runCappedTurn({
+        runTurn,
+        capMs: PRECHECK_TIMEOUT_MS,
+        workChildren,
+        releaseSlot,
+        transcriptCwd: wt,
+        turnArgs: {
+          prompt: AGENT_PRECHECK_KICKOFF({
+            agentName,
+            cards: stash.map((s) => s.prompt).join('\n---\n'),
+            missingSpecs,
+            commits: log.text,
+            diffCommand: `git diff ${baseRef()}...HEAD`,
+          }),
+          system: SYSTEM_PRECHECK,
+          // READ-ONLY, and no MCP: `mcpArgs` is omitted entirely rather than
+          // passed empty, so there is no control plane on this turn at all.
+          profile: 'consult',
+          cwd: wt,
+          runtime: rt,
+          // The agent's own browser profile, in the worktree this reader stands
+          // in; no display either way (noWindowEnv.mjs, 2026-09-29).
+          browserHome: agentBrowserHome(sessionMetaPath, wt, agentId),
+          // NO `resume`, AND THAT IS THE FEATURE. A resumed turn would be the
+          // agent grading its own homework out of its own context; this is a
+          // stranger reading a diff.
+          answerFromResult: true,
+          label: c.cyan('[pre-review]'),
+          // The CLI's own count for this reading. Set, never accumulated: one
+          // turn is one `result` event, and the adding-up is the server's.
+          // Tagged with the CLI, so a Claude pre-review of a Codex agent is
+          // charged as Claude's and not folded into the agent's own figure.
+          onUsage: (u) => {
+            usage = { ...u, runtime: rt };
+          },
         },
-        onSpawn: (ch) => {
-          child = ch;
-          // No task id: a pre-review belongs to no card, and the machine
-          // snapshot's per-task rows must not invent one. It still COUNTS
-          // against the machine's ceiling — see liveTurnCount.
-          workChildren.set(ch, null);
-          releaseSlot();
-          // ARMED AT THE SPAWN, not at entry: time spent getting here is not a
-          // wedged CLI. The CHILD and never its group — a read-only turn starts
-          // no server, so there is nothing behind it worth signalling and
-          // everything to lose by signalling somebody else's.
-          timer = setTimeout(() => {
-            wedged = true;
-            try {
-              ch.kill('SIGKILL');
-            } catch {
-              /* already gone */
-            }
-            stopWaiting('');
-          }, PRECHECK_TIMEOUT_MS);
-          timer.unref?.();
-        },
-      });
-      out = await Promise.race([turn, capped]);
+      }));
     } catch {
       return; // a label may never fail the beat it rides
     } finally {
-      if (timer) clearTimeout(timer);
-      if (child) workChildren.delete(child);
+      // The reservation this lane took itself, released on every exit — the
+      // turn's own release covers a spawn; this covers everything else.
       releaseSlot();
-      /**
-       * DELETE THIS READING'S TRANSCRIPT, on EVERY exit — settled, wedged and
-       * killed, or thrown — because every one of them leaves the file behind
-       * and the agent's `--continue` reads the newest one in the directory.
-       *
-       * AFTER the kill and ON A DELAY, the skills probe's own shape: the
-       * transcript is the CHILD's file, so removing it while the child is still
-       * dying races a recreate. Unref'd — it must not hold the process open.
-       */
-      if (preSession) setTimeout(() => removeProbeTranscript(wt, preSession), 750).unref?.();
     }
 
     // A WEDGED READING POSTS NOTHING. There is no row to settle and nobody
@@ -381,10 +314,15 @@ export function createWorkAgentPrecheck({ baseRef, admit, sessionMetaPath, workC
       agentId,
       ...(headSha ? { headSha } : {}),
       ...(usage ? { usage } : {}),
+      // Named fields, never a spread of what the parser returned: a field it
+      // keeps must be passed on here as well. `criteria` rides beside the verdict
+      // and note (2026-10-10), and an older server strips it and draws the one
+      // row it always drew.
       cards: result.cards.map((cd) => ({
         taskId: cd.taskId,
         verdict: cd.verdict,
         ...(cd.note ? { note: cd.note } : {}),
+        ...(cd.criteria ? { criteria: cd.criteria } : {}),
       })),
       ...(result.overall ? { overall: result.overall } : {}),
     };

package/bin/lib/workAgentPublish.mjs

@@ -10,7 +10,7 @@
  * begun-guard, the sweep keeps a published branch current, the merge lane
  * retires the ref — all through the maps and two functions returned here.
  */
-import { git } from './git.mjs';
+import { gitOrNull, sessionBranchRef } from './git.mjs';
 import { publishPushArgs, publishFetchArgs, publishErrorText } from './agentPublish.mjs';
 import { scrub as envScrub } from './uplinkScrub.mjs';
 
@@ -67,13 +67,11 @@ export function createWorkAgentPublish({ repoRoot, gitNet }) {
    *  — which is a perfectly ordinary state (the begun-guard's whole subject) and
    *  means there is nothing to publish, never that a push failed. */
   const agentBranchSha = (place) => {
-    try {
-      return (
-        git(['rev-parse', '--verify', '--quiet', `refs/heads/session/${place}`], repoRoot) || null
-      );
-    } catch {
-      return null;
-    }
+    // The one branch-name definition (git.mjs): an unsafe place names no
+    // branch, which is the same "nothing to publish" as an absent one.
+    const ref = sessionBranchRef(place);
+    if (!ref) return null;
+    return gitOrNull(['rev-parse', '--verify', '--quiet', ref], repoRoot);
   };
   /**
    * PUSH ONE AGENT'S BRANCH TO THE NAME THE SERVER GAVE IT.

package/bin/lib/workAgentTurnBegun.mjs

@@ -13,8 +13,8 @@
  * through the one turn-done wire (workAgentTurnReports.mjs). Null means go on.
  */
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { git } from './git.mjs';
+import { git, sessionBranchRef } from './git.mjs';
+import { worktreePath } from './workPlaces.mjs';
 
 /**
  * WORK THAT HAS BEGUN LIVES ON EXACTLY ONE BOX, AND THIS MAY NOT BE IT.
@@ -45,7 +45,11 @@ import { git } from './git.mjs';
  * remedy somebody cannot carry out is worse than none.
  */
 export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublishedBranch }) {
-  const wtDir = join(baseDir, 'sessions', place);
+  // The caller validated `place` (workAgentTurns); an unsafe one would give a
+  // null directory AND a null ref below, and the null ref stands the guard
+  // down — the same fail-open direction as an unreadable repo.
+  const wtDir = worktreePath(baseDir, place);
+  const ref = sessionBranchRef(place);
   let hasBranch = false;
   /**
    * THREE STATES, AND THE MIDDLE ONE IS WHY THIS IS NOT A BARE CATCH.
@@ -63,14 +67,14 @@ export function begunTurnRefusal(job, place, { baseDir, repoRoot, fetchPublished
    * `placeWtFor` is about to fail on the same unreadable repo and say so
    * in its own words, which is the honest sentence.
    */
-  let branchMeasured = true;
-  try {
-    hasBranch = Boolean(
-      git(['rev-parse', '--verify', '--quiet', `refs/heads/session/${place}`], repoRoot)
-    );
-  } catch (e) {
-    if (e?.status === 1) hasBranch = false;
-    else branchMeasured = false;
+  let branchMeasured = ref !== null;
+  if (branchMeasured) {
+    try {
+      hasBranch = Boolean(git(['rev-parse', '--verify', '--quiet', ref], repoRoot));
+    } catch (e) {
+      if (e?.status === 1) hasBranch = false;
+      else branchMeasured = false;
+    }
   }
   if (branchMeasured && !existsSync(wtDir) && !hasBranch) {
     /**