flowviant 0.77.0 → 0.77.3

package/bin/lib/work.mjs

@@ -567,6 +567,21 @@ export function createWorkManager({
   const worktreeSeen = new Set();
   let lastWorktreeFetch = 0;
   let sweepingWorktrees = false;
+  /**
+   * WHERE THE NEXT SWEEP STARTS.
+   *
+   * A safety valve with a rotation, and the rotation is the load-bearing half.
+   * The sweep used to take `activeIds.slice(0, 20)` — a silent truncation of a
+   * list the server builds tabs-first and agent places LAST, so on a project
+   * with twenty live tabs no agent was EVER measured: no branch diff, no head
+   * sha, and none of their trailered commits ever reached a card. Permanently,
+   * because the same twenty won every pass.
+   *
+   * Chunking removes the cut for any realistic project (see below). The cursor
+   * is what makes the residual cap fair rather than arbitrary: past it, the
+   * places that missed one sweep are the ones that lead the next.
+   */
+  let worktreeCursor = 0;
   const postWorktrees = async (reports) => {
     if (!reports.length) return;
     try {
@@ -800,12 +815,46 @@ export function createWorkManager({
           // landed. Best-effort like everything in this sweep.
           void landed.observe().catch(() => {});
         }
+        /**
+         * MEASURED IN CHUNKS, not truncated to one.
+         *
+         * The server's endpoint takes twenty entries per request, and this read
+         * that bound as "measure twenty places" — so everything past the
+         * twentieth was silently never measured, and the server builds that
+         * list with agent places at the END. A project with twenty live tabs
+         * therefore measured no agent at all: their review pane showed no
+         * branch diff, `checkIsStale` had no head to compare against, and their
+         * commits never reached the cards they name.
+         *
+         * The cap on a REQUEST is not a cap on the WORK. Several requests of
+         * twenty cost several round trips and each is validated per entry
+         * exactly as before, so no contract changes and no floor is needed.
+         *
+         * `SWEEP_MAX_PLACES` is a bound on the MACHINE — each place costs a
+         * `git diff`, a listener scan and a process scan — and the cursor
+         * rotates so a project past it still measures everything, just across
+         * successive sweeps instead of one.
+         */
+        const SWEEP_MAX_PLACES = 60;
+        const CHUNK = 20;
+        const total = activeIds.length;
+        const start = total > SWEEP_MAX_PLACES ? worktreeCursor % total : 0;
+        const take = Math.min(total, SWEEP_MAX_PLACES);
+        // Rotated slice, so the tail of a long list leads the next sweep rather
+        // than never being reached.
+        const order = Array.from({ length: take }, (_, i) => activeIds[(start + i) % total]);
+        worktreeCursor = total > SWEEP_MAX_PLACES ? (start + take) % total : 0;
         const reports = [];
-        for (const id of activeIds.slice(0, 20)) {
+        for (const id of order) {
           const r = sessionWorktreeReport(id);
           if (r) reports.push(r);
         }
-        await postWorktrees(reports);
+        // One POST per chunk. Awaited in sequence rather than fired together:
+        // this runs on the machine's own poll beat and a burst of parallel
+        // writes to the same rows buys nothing.
+        for (let i = 0; i < reports.length; i += CHUNK) {
+          await postWorktrees(reports.slice(i, i + CHUNK));
+        }
       } finally {
         sweepingWorktrees = false;
       }
@@ -2275,6 +2324,36 @@ export function createWorkManager({
     for (const id of ids) {
       if (live.has(id)) continue;
       if (peers.has(id)) continue; // another daemon's tab — not ours to retire
+      /**
+       * A HARD STOP REACHES THE CLI HERE, and this is the whole of it.
+       *
+       * `stopAgent` marked the agent abandoned in D1 and nothing on the wire
+       * told the machine, so the CLI went on working, editing the worktree and
+       * spending the operator's quota — while the confirm dialog said the agent
+       * was stopped. It also never got cleaned up, because the check below
+       * skips any place whose lock is held and a running turn holds it: a
+       * stopped agent mid-turn kept its directory forever.
+       *
+       * No new wire field and no version floor: an abandoned agent simply drops
+       * out of `activeWorkSessions` (that list is built from LIVE statuses), so
+       * the server ALREADY says everything needed. Absence means "nothing here
+       * is live any more", and the honest response to that is to stop what we
+       * are running in it and then take the directory.
+       *
+       * SIGTERM the CHILD, never its group — the rule teardown keeps, so an
+       * unattended sweep cannot take the driver's dev server with it. The lock
+       * is released when the child exits, so the removal happens on the next
+       * pass rather than this one.
+       */
+      const running = agentChildren.get(id);
+      if (running) {
+        try {
+          running.kill('SIGTERM');
+        } catch {
+          /* already gone */
+        }
+        agentChildren.delete(id);
+      }
       // Asked of the PLACE, not the session: the lock is keyed by directory,
       // and a session sharing one with a busy peer is not ours to retire
       // either — its worktree is the peer's working directory.
@@ -3604,6 +3683,15 @@ export function createWorkManager({
   // do is run a CLI twice in one worktree, which is what this in-flight set and
   // the place lock prevent — the same discipline `processWorkTurns` keeps.
   const agentTurns = new Set(); // turn ids in flight on this tick
+  /**
+   * The CLI a live agent turn is running in, by PLACE.
+   *
+   * `workChildren` is keyed by the child itself, which answers "kill everything
+   * at teardown" and cannot answer "kill THIS agent's". Keyed by place rather
+   * than by agent id because the one consumer — the retire sweep — walks
+   * directory names, and those are places.
+   */
+  const agentChildren = new Map(); // placeId -> child process
 
   /** Returns the server's reply, because it carries ONE instruction the machine
    *  can act on immediately: `review: true` means the agent's queue just
@@ -3747,10 +3835,31 @@ export function createWorkManager({
         return;
       }
       const wt = dir.wt;
+      /**
+       * NEITHER OF THESE MAY THROW. `git()` throws on a non-zero exit, and both
+       * of these exit non-zero in states a real worktree reaches: `symbolic-ref`
+       * on a DETACHED HEAD (an agent that ran `git checkout <sha>`, a rebase
+       * left half-done), and `rev-parse HEAD` on a branch with no commits yet.
+       * An escape here happens BEFORE any settle, so the turn stays pending
+       * until the six-hour expiry while the agent sits in Working with nothing
+       * behind it — the wedge this whole lane exists to avoid.
+       *
+       * `runAgentMerge` learned this two commits ago and says so in its own
+       * comment; this is the same call, in the same file, left unguarded. Both
+       * facts are OPTIONAL to a turn — they describe the branch, they do not
+       * gate the work — so failing to read them costs a null, not the turn.
+       */
+      const readGit = (args) => {
+        try {
+          return (git(args, wt) || '').trim() || null;
+        } catch {
+          return null;
+        }
+      };
       // WHERE THE BRANCH WAS BEFORE THIS TURN, so the commits reported are the
       // ones this turn actually made.
-      const before = (git(['rev-parse', 'HEAD'], wt) || '').trim() || null;
-      const branch = (git(['symbolic-ref', '--quiet', '--short', 'HEAD'], wt) || '').trim() || null;
+      const before = readGit(['rev-parse', 'HEAD']);
+      const branch = readGit(['symbolic-ref', '--quiet', '--short', 'HEAD']);
 
       const rt = job.runtime || 'claude';
       if (!canRun(RUNTIMES[rt], 'build')) {
@@ -3822,10 +3931,15 @@ export function createWorkManager({
             child = ch;
             workChildren.set(ch, null);
             noteSessionGroup(agentId, ch.pid);
+            // Keyed by PLACE, because the retire sweep iterates directory names
+            // and a place id IS one. It is what lets a hard stop actually reach
+            // the CLI — see `retireWorkSessions`.
+            agentChildren.set(place, ch);
           },
         });
       } finally {
         if (child) workChildren.delete(child);
+        if (agentChildren.get(place) === child) agentChildren.delete(place);
         if (ranMarker) {
           try {
             writeFileSync(ranMarker, '1');
@@ -4209,7 +4323,15 @@ export function createWorkManager({
        */
       if (job.prMode) {
         try {
-          execFileSync('gh', ['auth', 'status'], { stdio: ['ignore', 'pipe', 'pipe'] });
+          // EVERY `gh` CALL IS TIMED OUT. `execFileSync` blocks the daemon's
+          // whole event loop, and this one runs INSIDE the place writer lock —
+          // so a `gh` that hangs (an expired token prompting, a network black
+          // hole, a hung credential helper) stops every turn on the machine,
+          // not merely this merge, and holds the lock while it does.
+          execFileSync('gh', ['auth', 'status'], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 20_000,
+          });
         } catch (e) {
           await postAgentMerge({
             agentId,
@@ -4233,7 +4355,12 @@ export function createWorkManager({
         try {
           git(['push', '-u', 'origin', branch], wt);
         } catch (e) {
-          await postAgentMerge({ agentId, ok: false, detail: ghFirstLine(e) });
+          // SCRUBBED. Every other failure on this path relays `gh`'s own words,
+          // but a push writes the REMOTE URL to stderr and a remote can carry a
+          // token in its userinfo — so this one line is the only place on the
+          // agent merge path that can leak a credential into a stored,
+          // team-visible `mergeError`.
+          await postAgentMerge({ agentId, ok: false, detail: envScrub(ghFirstLine(e)) });
           return;
         }
         let prUrl = null;
@@ -4242,6 +4369,7 @@ export function createWorkManager({
             execFileSync('gh', ['pr', 'view', branch, '--json', 'url,state'], {
               cwd: repoRoot,
               stdio: ['ignore', 'pipe', 'pipe'],
+              timeout: 30_000,
             }).toString()
           );
           if (j?.state === 'OPEN' && typeof j?.url === 'string') prUrl = j.url.trim();
@@ -4254,7 +4382,7 @@ export function createWorkManager({
               'gh',
               // baseBranchName, not baseRef: gh 422s on a remote-tracking name.
               ['pr', 'create', '--head', branch, '--base', prBase, '--fill'],
-              { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'] }
+              { cwd: repoRoot, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 }
             )
               .toString()
               .trim();
@@ -4268,6 +4396,7 @@ export function createWorkManager({
           execFileSync('gh', ['pr', 'merge', branch, '--merge'], {
             cwd: repoRoot,
             stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 120_000,
           });
         } catch (e) {
           const line = ghFirstLine(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.77.0",
+  "version": "0.77.3",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {