forgedock 1.42.0 → 1.43.1

package/bin/lean/effects.mjs

@@ -254,7 +254,7 @@ export function runCheckCommand({ command, cwd, timeoutMs = 300000, env = null }
   return new Promise((done) => {
     let out = "", timedOut = false, child;
     const add = (b) => { out += String(b); if (out.length > 2 * CHECK_OUTPUT_CAP) out = out.slice(-CHECK_OUTPUT_CAP); };
-    try { child = spawn("bash", ["-c", String(command)], { cwd, detached: true, stdio: ["ignore", "pipe", "pipe"], ...(env ? { env: { ...process.env, ...env } } : {}) }); }
+    try { child = spawn("bash", ["-c", String(command)], { cwd, detached: true, windowsHide: true, stdio: ["ignore", "pipe", "pipe"], ...(env ? { env: { ...process.env, ...env } } : {}) }); }
     catch (e) { done({ rc: 127, output: String(e?.message ?? e) }); return; }
     const kill = () => { try { process.kill(-child.pid, "SIGKILL"); } catch { try { child.kill("SIGKILL"); } catch { /* gone */ } } };
     const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);

package/bin/lean/execution.test.mjs

@@ -528,15 +528,18 @@ describe("execution budget and sandbox cost (#4255)", () => {
     const prov = fakeProvider({ finish: (n) => ({ terminalReason: "merged", pr: 100 + n, cost_usd: 2 }), usage: async (h) => ({ minutes: 5 * h.issue, cost_usd: 0.1 * h.issue }) });
     const events = [];
     const file = join(work, "day.json");
-    const res = await quiet(() => orchestrateFromCli(["1", "2", "3", "--repo", "o/r", "--no-prefilter"], base(work, { batchId: "bc1",
+    const printed = []; // #4917: #3 stays pending (budget hold), so the batch is not finalised: no report.json, the printed report carries the sandbox lines
+    const log0 = console.log; console.log = (l) => { printed.push(String(l)); };
+    const res = await (async () => { try { return await orchestrateFromCli(["1", "2", "3", "--repo", "o/r", "--no-prefilter"], base(work, { batchId: "bc1",
       execution: parseExecution({ mode: "remote", max_remote: "1", budget_minutes: "15" }), sandboxProvider: prov,
       sandboxLedger: (n) => makeLedger({ root: ledRoot, batch: "bc1", lane: `sandbox-${n}`, owner: "t", issue: n }),
-      executionBudget: openExecutionBudget({ budget: parseExecution({ budget_minutes: "15" }).budget, file }), emitTelemetry: (rec) => { events.push(rec); } })));
+      executionBudget: openExecutionBudget({ budget: parseExecution({ budget_minutes: "15" }).budget, file }), emitTelemetry: (rec) => { events.push(rec); } })); } finally { console.log = log0; } })();
     assert.deepEqual(res.rows.map((r) => [r.issue, r.outcome, r.sandbox?.minutes ?? null]), [[1, "merged", 5], [2, "merged", 10], [3, "held", null]]);
-    const rep = openBatch(join(work, "batches"), "bc1").readReport();
-    assert.deepEqual(rep.rows[1].sandbox, { minutes: 10, cost_usd: 0.2, attempts: 1 });
-    assert.match(rep.report, /sandbox: 2 lanes, 15\.0 min, \$0\.30 \(token cost \$4\.00\); budget: batch 15 min/);
-    assert.match(rep.report, /sbx-min/);
+    assert.equal(openBatch(join(work, "batches"), "bc1").readReport(), null);
+    assert.deepEqual(res.rows[1].sandbox, { minutes: 10, cost_usd: 0.2, attempts: 1 });
+    const text = printed.join("\n");
+    assert.match(text, /sandbox: 2 lanes, 15\.0 min, \$0\.30 \(token cost \$4\.00\); budget: batch 15 min/);
+    assert.match(text, /sbx-min/);
     assert.deepEqual(events.filter((e) => e.event === "SANDBOX_USAGE").map((e) => [e.issue, e.minutes, e.cost_usd, e.batch]), [[1, 5, 0.1, "bc1"], [2, 10, 0.2, "bc1"]]);
     assert.equal(Object.keys(JSON.parse(readFileSync(file, "utf8")).days[new Date().toISOString().slice(0, 10)]).length, 2);
   });

package/bin/lean/fixround.test.mjs

@@ -3,7 +3,7 @@
 import { describe, it } from "node:test";
 import assert from "node:assert/strict";
 import { MECHANICAL_KINDS, FIX_PROMPT_MAX, citesFileLine, freshFix, issueSummary, capText, TRIGGERS, REWORK_TRIGGERS, firstPassOf, formatFirstPassSummary, sessionCostDelta } from "./fixround.mjs";
-import { fixSessionPrompt } from "./prompts.mjs";
+import { fixSessionPrompt, ciFailurePrompt } from "./prompts.mjs";
 
 describe("#4363 fresh fix sessions: which rounds, and the prompt caps", () => {
   it("every mechanical kind is fresh; block/contract/conflict kinds are not", () => {
@@ -115,3 +115,11 @@ describe("#4407 sessionCostDelta: per-attempt cost from a resumed session's runn
     assert.equal(sessionCostDelta(last, { resume: "b", sessionId: "b", cost: 2 }).delta, 0.5);
   });
 });
+
+describe("#4987 CI fix prompt: unrelated failures", () => {
+  it("tells the builder an out-of-diff failing check is a note, not an amendment", () => {
+    const p = ciFailurePrompt([{ job: "core-tests" }], "ci");
+    assert.match(p, /not an amendment/);
+    assert.match(p, /unknown amendment kinds are rejected/);
+  });
+});

package/bin/lean/guardgate.mjs

@@ -4,10 +4,11 @@
  * Guard gate (#4693): execution-based, no pattern matching on diff text. A lane whose diff changes lines a merged fix
  * protected (git blame on the lane's merge base names the guard's merge commit, or a later commit that kept the lines), or
  * edits/deletes a guard's test file, reruns that guard's test files *as they exist on base* against the lane's tree. A
- * failure is `conformance.guard_broken` (builder resumed once). The only override is a `supersedes` amendment (conformance.mjs).
+ * failure is `conformance.guard_broken` (builder resumed once) unless the same base test also fails on the merge-base tree (#4968). The only override is a `supersedes` amendment (conformance.mjs).
  * Deterministic, 0 LLM calls; a lane touching nothing guarded does one local index read and no git work.
  */
 import * as nodeFs from "node:fs";
+import { tmpdir } from "node:os";
 import { dirname, extname, join } from "node:path";
 import { OUTCOME_CODES } from "../engine/outcome-codes.mjs";
 import { collectGuards, guardsIndexPath, readIndex, writeIndex } from "./guards.mjs";
@@ -94,9 +95,15 @@ export async function selectGuards({ guards, files, git, base }) {
   return { selected, mergeBase };
 }
 
-/** The command that runs one test file: the contract's own validate command with that path substituted, else a per-extension default; null when unknown. */
-export function commandFor(path, contract) {
+/**
+ * The command that runs one test file: the repo's `verify.guard_command` template for the extension (`{path}` substituted,
+ * or the path appended), else the contract's own validate command with that path substituted, else a per-extension
+ * default; null when unknown. The command runs from the worktree root with the repo-relative path.
+ */
+export function commandFor(path, contract, guardCommand = {}) {
   const ext = extname(path);
+  const tpl = String(guardCommand?.[ext.toLowerCase()] ?? "").trim();
+  if (tpl) return tpl.includes("{path}") ? tpl.replaceAll("{path}", path) : `${tpl} ${path}`;
   for (const v of contract?.validate ?? []) {
     const cmd = String(v?.command ?? "");
     if (/(?:^|\s)(?:-k|-t|--grep|--test-name-pattern|--testNamePattern)(?:\s|=)|::/.test(cmd)) continue;
@@ -112,22 +119,61 @@ export function commandFor(path, contract) {
 /** Sibling path for the base copy of a test file, so its relative imports resolve against the lane's tree. */
 export const basePathOf = (path) => { const e = extname(path); return `${path.slice(0, path.length - e.length)}__guardbase${e}`; };
 
+/** Names of the failing tests in a runner's output: TAP/node:test `not ok` lines (SKIP/TODO excluded), the spec reporter's `✖ name (Nms)`, pytest `FAILED path::name`. null when the output names none. */
+export function failingNames(output) {
+  const names = new Set();
+  for (const raw of String(output ?? "").split("\n")) {
+    const line = raw.replace(/\r$/, "");
+    let m = /^\s*not ok \d+ - (.+?)\s*$/.exec(line);
+    if (m && !/\s#\s*(?:SKIP|TODO)\b/i.test(m[1])) { names.add(m[1].replace(/\s+#\s.*$/, "").trim()); continue; }
+    m = /^\s*✖ (.+?) \([\d.]+m?s\)\s*$/.exec(line) ?? /^\s*FAILED (\S+?)(?: - .*)?\s*$/.exec(line);
+    if (m) names.add(m[1]);
+  }
+  return names.size ? [...names] : null;
+}
+
 const tailOf = (out) => String(out ?? "").split("\n").filter((l) => l.trim()).slice(-40).join("\n").slice(-1500);
 
 /**
  * Rerun the selected guards' base test files against the lane tree, in a small pool, under one wall-time cap.
  * Returns {failures, runs, skipped[], ms}. A test that cannot be run (no base copy, unknown runner, over the cap) is skipped, never a failure.
  */
-export async function runGuards({ selected, mergeBase, contract, git, runCommand, cwd, env, capMs = GUARD_CAP_MS, parallelism = 2, fs = nodeFs, now = Date.now }) {
+export async function runGuards({ selected, mergeBase, contract, guardCommand, git, runCommand, cwd, env, capMs = GUARD_CAP_MS, parallelism = 2, fs = nodeFs, now = Date.now }) {
   const t0 = now(), skipped = [], runs = [], jobs = [];
   for (const { guard } of selected) {
     for (const t of guard.tests ?? []) {
-      const path = norm(t.path), copy = basePathOf(path), command = commandFor(copy, contract);
+      const path = norm(t.path), copy = basePathOf(path), command = commandFor(copy, contract, guardCommand);
       if (!command) { skipped.push(`#${guard.issue} ${path}: no runner known for ${extname(path) || "this file"}`); continue; }
       jobs.push({ guard, path, copy, command });
     }
   }
   const made = [];
+  let base = null; // #4968: one detached worktree of the merge base, made on the first lane failure and shared by the pool
+  const baseTree = () => (base ??= (async () => {
+    let dir = null;
+    try {
+      dir = fs.mkdtempSync(join(tmpdir(), "guardbase-"));
+      await git(["worktree", "add", "--detach", dir, mergeBase]);
+      try { if (fs.existsSync(join(cwd, "node_modules"))) fs.symlinkSync(join(cwd, "node_modules"), join(dir, "node_modules")); } catch { /* best effort */ }
+      return { dir };
+    } catch (e) { return { dir, error: String(e?.message ?? e).split("\n")[0].slice(0, 80) }; }
+  })());
+  /** Decide a failed lane run against the same test on the base tree: the names the lane newly fails, [] when base fails it too, null when base passes (every failure is the lane's). */
+  const newFailures = async (j, laneOut) => {
+    const left = capMs - (now() - t0);
+    if (left <= 0) return { skip: `over the ${Math.round(capMs / 1000)}s guard cap` };
+    const t = await baseTree();
+    if (t.error) return { skip: `baseline unavailable (${t.error})` };
+    const bcmd = commandFor(j.path, contract, guardCommand); // the same runner as the lane run (verify.guard_command, #4792)
+    let b;
+    try { b = await runCommand({ command: bcmd, cwd: t.dir, timeoutMs: left, env }); } catch (e) { b = { rc: 127, output: String(e?.message ?? e) }; }
+    if (b?.rc === TIMEOUT_RC || b?.rc === 127) return { skip: `baseline unavailable (${b.rc === 127 ? "runner unavailable" : "over the guard cap"})` };
+    if (b?.rc === 0) return { fresh: null };
+    const lane = failingNames(laneOut), prior = failingNames(b?.output);
+    if (!lane || !prior) return { skip: "fails on base" };
+    const fresh = lane.filter((n) => !prior.includes(n));
+    return fresh.length ? { fresh } : { skip: "fails on base" };
+  };
   try {
     const queue = jobs.slice();
     const work = async () => {
@@ -142,12 +188,25 @@ export async function runGuards({ selected, mergeBase, contract, git, runCommand
         try { r = await runCommand({ command: j.command, cwd, timeoutMs: left, env }); } catch (e) { r = { rc: 127, output: String(e?.message ?? e) }; }
         if (r?.rc === TIMEOUT_RC) { skipped.push(`#${j.guard.issue} ${j.path}: over the ${Math.round(capMs / 1000)}s guard cap`); continue; }
         if (r?.rc === 127) { skipped.push(`#${j.guard.issue} ${j.path}: runner unavailable`); continue; }
-        runs.push({ issue: j.guard.issue, why: j.guard.why, test: j.path, command: j.command, rc: Number.isInteger(r?.rc) ? r.rc : 1, output: String(r?.output ?? "") });
+        const rc = Number.isInteger(r?.rc) ? r.rc : 1, output = String(r?.output ?? "");
+        let failed = rc === 0 ? null : failingNames(output);
+        if (rc !== 0) {
+          const v = await newFailures(j, output);
+          if (v.skip) { skipped.push(`guard #${j.guard.issue} ${j.path}: ${v.skip}`); continue; }
+          if (v.fresh) failed = v.fresh;
+        }
+        runs.push({ issue: j.guard.issue, why: j.guard.why, test: j.path, command: j.command, rc, output, failed });
       }
     };
     await Promise.all(Array.from({ length: Math.max(1, Math.min(parallelism, jobs.length)) }, work));
   } finally {
     for (const p of made) { try { fs.rmSync(p, { force: true }); } catch { /* best effort */ } }
+    const t = base ? await base : null;
+    if (t?.dir) {
+      try { await git(["worktree", "remove", "--force", t.dir]); } catch { /* best effort */ }
+      try { fs.rmSync(t.dir, { recursive: true, force: true }); } catch { /* best effort */ }
+      try { await git(["worktree", "prune"]); } catch { /* best effort */ }
+    }
   }
   return { failures: guardFailures(runs), runs, skipped, ms: now() - t0 };
 }
@@ -159,7 +218,7 @@ const supersedesHint = (guard) => `If this change intentionally changes the guar
 export function guardFailures(runs) {
   return (runs ?? []).filter((r) => r.rc !== 0).map((r) => ({
     code: OUTCOME_CODES.CONFORMANCE_GUARD_BROKEN, kind: "guard_broken", guard: `#${r.issue}`, test: r.test,
-    detail: `${supersedesHint(`#${r.issue}`)} guard #${r.issue} broken (${String(r.why ?? "").slice(0, 200)}): base test ${r.test} fails against your tree (\`${r.command}\`, exit ${r.rc}):\n${tailOf(r.output)}`,
+    detail: `${supersedesHint(`#${r.issue}`)} guard #${r.issue} broken (${String(r.why ?? "").slice(0, 200)}): base test ${r.test} fails against your tree (\`${r.command}\`, exit ${r.rc})${r.failed?.length ? `; failing tests: ${r.failed.slice(0, 20).join(" | ")}` : ""}:\n${tailOf(r.output)}`,
   }));
 }
 

package/bin/lean/guardgate.test.mjs

@@ -5,7 +5,7 @@ import assert from "node:assert/strict";
 import { execFileSync, spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { oldRanges, selectGuards, runGuards, commandFor, basePathOf, guardFailures, supersessionComment, supersededIds, loadGuards } from "./guardgate.mjs";
+import { oldRanges, selectGuards, runGuards, commandFor, basePathOf, failingNames, guardFailures, supersessionComment, supersededIds, loadGuards } from "./guardgate.mjs";
 import { applyAmendments, precheck } from "./conformance.mjs";
 import { builderImplementPrompt, conformanceResumePrompt } from "./prompts.mjs";
 import { tmpDir } from "../tests/_tmp.mjs";
@@ -19,13 +19,13 @@ const put = (cwd, p, body) => { mkdirSync(join(cwd, p, ".."), { recursive: true
 const TEST_SRC = (v) => `import test from "node:test";\nimport assert from "node:assert/strict";\nimport { price } from "./a.mjs";\ntest("price is ${v}", () => assert.equal(price(), ${v}));\n`;
 
 /** A repo whose fix commit (merge_sha) made price() return 2, guarded by src/a.test.mjs; the lane starts from it. */
-function fixture() {
+function fixture(testSrc = TEST_SRC(2)) {
   const d = tmpDir("guardgate-");
   sh(d, "init", "-q", "-b", "main");
   put(d, "src/a.mjs", "export function price() {\n  return 1;\n}\n");
   sh(d, "add", "-A"); sh(d, "commit", "-qm", "init");
   put(d, "src/a.mjs", "export function price() {\n  return 2;\n}\n");
-  put(d, "src/a.test.mjs", TEST_SRC(2));
+  put(d, "src/a.test.mjs", testSrc);
   sh(d, "add", "-A"); sh(d, "commit", "-qm", "fix: price");
   const sha = sh(d, "rev-parse", "HEAD").trim();
   put(d, "src/other.mjs", "export const x = 1;\n");
@@ -127,6 +127,24 @@ test("a base test that cannot run in the cap, or has no known runner, is skipped
   assert.equal(existsSync(join(d, basePathOf("src/a.test.mjs"))), false);
 });
 
+test("a verify.guard_command template wins over the contract and the fallbacks (#4792)", async () => {
+  const gc = { ".py": "scripts/pytest {path}" };
+  assert.equal(commandFor("tests/test_a__guardbase.py", {}, gc), "scripts/pytest tests/test_a__guardbase.py");
+  assert.equal(commandFor("tests/test_a__guardbase.py", { validate: [{ command: "pytest -q tests/test_a.py" }] }, gc), "scripts/pytest tests/test_a__guardbase.py");
+  assert.equal(commandFor("tests/test_a__guardbase.py", {}, { ".py": "uv run pytest -q" }), "uv run pytest -q tests/test_a__guardbase.py");
+  assert.equal(commandFor("src/a.test__guardbase.mjs", {}, gc), "node --test src/a.test__guardbase.mjs");
+  const { d, guard } = fixture();
+  put(d, "src/a.mjs", "export function price() {\n  return 1;\n}\n");
+  commit(d, "revert");
+  const git = gitIn(d);
+  const { selected, mergeBase } = await selectGuards({ guards: [guard], files: files(d), git, base: "origin/main" });
+  const seen = [];
+  const r = await runGuards({ selected, mergeBase, contract: {}, guardCommand: { ".mjs": "run-it {path}" }, git, runCommand: async (a) => { seen.push(a); return { rc: 0, output: "" }; }, cwd: d, env: {} });
+  assert.equal(r.runs.length, 1);
+  assert.equal(seen[0].command, "run-it src/a.test__guardbase.mjs");
+  assert.equal(seen[0].cwd, d);
+});
+
 test("pytest-style guards run through the contract's own validate command with the path substituted", () => {
   assert.equal(commandFor("tests/test_a__guardbase.py", { validate: [{ command: "pytest -q tests/test_a.py" }] }), "pytest -q tests/test_a__guardbase.py");
   assert.equal(commandFor("tests/test_a__guardbase.py", {}), "python -m pytest -q tests/test_a__guardbase.py");
@@ -189,3 +207,91 @@ test("an additive enum change that updates its coverage test fails the guard wit
   const withIt = precheck({ contract: a.contract, ...base });
   assert.deepEqual(withIt.failures.filter((f) => f.kind === "guard_broken"), []);
 });
+
+// #4968: a guard test already red on the merge base must not block the lane
+const FLAKY = (v) => `${TEST_SRC(v)}test("env dependent", () => assert.fail("red on base"));\n`;
+const revert = (d) => { put(d, "src/a.mjs", "export function price() {\n  return 1;\n}\n"); commit(d, "revert"); };
+
+test("a guard test that already fails on base is skipped (fails on base), not guard_broken", async () => {
+  const { d, guard } = fixture(FLAKY(2));
+  put(d, "src/a.mjs", "export function price() {\n  return 1 + 1;\n}\n"); // harmless edit of the guarded line
+  commit(d, "refactor");
+  const { selected, r } = await gate(d, guard);
+  assert.equal(selected.length, 1);
+  assert.equal(r.failures.length, 0, JSON.stringify(r));
+  assert.ok(r.skipped.some((x) => /guard #7 .*fails on base/.test(x)), r.skipped.join("|"));
+});
+
+test("a test that passes on base and fails on the lane is blocked, with no skip", async () => {
+  const { d, guard } = fixture();
+  revert(d);
+  const { r } = await gate(d, guard);
+  assert.equal(r.failures.length, 1);
+  assert.deepEqual(r.skipped, []);
+  assert.match(r.failures[0].detail, /failing tests: price is 2:/);
+});
+
+test("a new failure in a file that already had one is blocked and its name leads the detail", async () => {
+  const { d, guard } = fixture(FLAKY(2));
+  revert(d);
+  const { r } = await gate(d, guard);
+  assert.equal(r.failures.length, 1, JSON.stringify({ skipped: r.skipped }));
+  const detail = r.failures[0].detail;
+  assert.match(detail, /failing tests: price is 2:\n/, "only the new failure is named");
+  assert.ok(detail.indexOf("failing tests:") < detail.indexOf("env dependent"), "names precede the output tail (any reporter)");
+});
+
+test("a passing guard adds no baseline worktree, and a failing one removes its worktree", async () => {
+  const pass = fixture();
+  const calls = [];
+  const spy = (cwd) => async (args) => { calls.push(args[0]); return sh(cwd, ...args); };
+  put(pass.d, "src/a.mjs", "export function price() {\n  return 1 + 1;\n}\n"); commit(pass.d, "refactor");
+  let git = spy(pass.d);
+  let { selected, mergeBase } = await selectGuards({ guards: [pass.guard], files: files(pass.d), git, base: "origin/main" });
+  calls.length = 0;
+  const ok = await runGuards({ selected, mergeBase, contract: {}, git, runCommand, cwd: pass.d, env: process.env });
+  assert.equal(ok.failures.length, 0);
+  assert.ok(!calls.includes("worktree"), calls.join(","));
+  const bad = fixture();
+  revert(bad.d);
+  git = spy(bad.d);
+  ({ selected, mergeBase } = await selectGuards({ guards: [bad.guard], files: files(bad.d), git, base: "origin/main" }));
+  calls.length = 0;
+  const r = await runGuards({ selected, mergeBase, contract: {}, git, runCommand, cwd: bad.d, env: process.env });
+  assert.equal(r.failures.length, 1);
+  assert.ok(calls.includes("worktree"));
+  assert.equal(sh(bad.d, "worktree", "list").trim().split("\n").length, 1, "baseline worktree removed");
+});
+
+test("the baseline rerun uses the verify.guard_command runner, so a real break still blocks", async () => {
+  const { d, guard } = fixture();
+  revert(d);
+  const git = gitIn(d);
+  const { selected, mergeBase } = await selectGuards({ guards: [guard], files: files(d), git, base: "origin/main" });
+  const seen = [];
+  // run-it only exists through guard_command: the lane copy fails, the base copy passes
+  const r = await runGuards({ selected, mergeBase, contract: {}, guardCommand: { ".mjs": "run-it {path}" }, git, runCommand: async (a) => {
+    seen.push(a);
+    return a.cwd === d ? { rc: 1, output: "not ok 1 - price is 2\n" } : { rc: 0, output: "ok 1 - price is 2\n" };
+  }, cwd: d, env: {} });
+  assert.deepEqual(seen.map((s) => s.command), ["run-it src/a.test__guardbase.mjs", "run-it src/a.test.mjs"]);
+  assert.notEqual(seen[1].cwd, d, "baseline runs in the merge-base worktree");
+  assert.equal(r.failures.length, 1, JSON.stringify(r.skipped));
+});
+
+test("a baseline that cannot run is skipped, never blocking", async () => {
+  const { d, guard } = fixture();
+  revert(d);
+  const git = async (a) => { if (a[0] === "worktree" && a[1] === "add") throw new Error("no worktree"); return sh(d, ...a); };
+  const { selected, mergeBase } = await selectGuards({ guards: [guard], files: files(d), git, base: "origin/main" });
+  const r = await runGuards({ selected, mergeBase, contract: {}, git, runCommand, cwd: d, env: process.env });
+  assert.equal(r.failures.length, 0);
+  assert.match(r.skipped[0], /baseline unavailable \(no worktree\)/);
+});
+
+test("failingNames reads TAP, spec and pytest output and ignores skips", () => {
+  assert.deepEqual(failingNames("ok 1 - a\nnot ok 2 - b c\n    not ok 1 - nested # SKIP why\nnot ok 3 - d # TODO x"), ["b c"]);
+  assert.deepEqual(failingNames("  ✖ spec one (1.2ms)\n✖ failing tests:\n  ✖ spec one (1.2ms)"), ["spec one"]);
+  assert.deepEqual(failingNames("FAILED tests/t.py::test_x - assert 1 == 2"), ["tests/t.py::test_x"]);
+  assert.equal(failingNames("all fine"), null);
+});

package/bin/lean/heavy.test.mjs

@@ -9,7 +9,7 @@ import { tmpDir } from "../tests/_tmp.mjs";
 import { guardChain, isPassThroughWrapper, SHIM_LOOP_MAX, classifyStep, heavyConfig, openHeavy, acquireHeavy, writeHeavyShims, heavyShimScript, sumWaits, runWrapped, HEAVY_BINS, isHeavyProcess } from "./heavy.mjs";
 import { checkAdmission, ADMISSION_DEFAULTS, localLaneCap } from "./admission.mjs";
 import { formatAlertLines, formatWaitSummary } from "./orchestrate.mjs";
-import { readHeavy, liveLaneCap } from "../engine-cli.mjs";
+import { readHeavy, readAdmission, liveLaneCap } from "../engine-cli.mjs";
 
 // Injected pids, clock and host: `live` is the set of pids the registry sees as alive; `mem` the MemAvailable in MB.
 const world = ({ mem = 12000, cores = 4, swapFree = 0 } = {}) => {
@@ -336,4 +336,14 @@ describe("validation steps and the local lane cap (#4777)", () => {
     assert.equal(liveLaneCap(1, { cfg: {}, host: { cores: () => 8, memAvailableMb: () => 64000 } })(), 1);
     assert.equal(liveLaneCap(3, { cfg: { enabled: false }, host: { cores: () => 8, memAvailableMb: () => 64000 } })(), 3);
   });
+
+  it("batch cap follows the repo forge.yaml lane_cpu_reservation / lane_mem_mb, not the process cwd (#4828)", () => {
+    const d = tmpDir("lane-cap-");
+    writeFileSync(join(d, "forge.yaml"), "engine:\n  lane_cpu_reservation: 4\n  lane_mem_mb: 4096\n");
+    const host = { cores: () => 16, memAvailableMb: () => 2048 + 3 * 4096 + 10 };
+    assert.equal(liveLaneCap(null, { cfg: readAdmission(d), host })(), 3, "memory binds at 4096 MB per lane");
+    assert.equal(liveLaneCap(null, { cfg: {}, host })(), 6, "defaults: 2048 MB per lane");
+    writeFileSync(join(d, "forge.yaml"), "engine:\n  lane_cpu_reservation: 8\n");
+    assert.equal(liveLaneCap(null, { cfg: readAdmission(d), host: { cores: () => 16, memAvailableMb: () => 64000 } })(), 2);
+  });
 });

package/bin/lean/issuewatch.mjs

@@ -366,7 +366,7 @@ function realIo(repo, env = process.env) {
     },
     launch: (n, lane) => {
       let res = null;
-      const p = spawn(process.execPath, [CLI, "run-issue", String(n), "--lane", lane], { detached: true, stdio: "ignore", cwd: process.cwd(), env });
+      const p = spawn(process.execPath, [CLI, "run-issue", String(n), "--lane", lane], { detached: true, windowsHide: true, stdio: "ignore", cwd: process.cwd(), env });
       p.on("close", (code) => { res = { code: code ?? 1 }; }); p.on("error", () => { res = { code: 1 }; });
       return { poll: () => res };
     },
@@ -375,7 +375,7 @@ function realIo(repo, env = process.env) {
       reported: (id) => existsSync(join(root, id, "report.json")),
       start: async (issues, parallel, lane) => {
         const before = new Set(listBatches(root));
-        spawn(process.execPath, [CLI, "orchestrate", ...issues.map(String), "--parallel", String(parallel), "--lane", lane, "--repo", repo], { detached: true, stdio: "ignore", cwd: process.cwd(), env }).unref();
+        spawn(process.execPath, [CLI, "orchestrate", ...issues.map(String), "--parallel", String(parallel), "--lane", lane, "--repo", repo], { detached: true, windowsHide: true, stdio: "ignore", cwd: process.cwd(), env }).unref();
         for (let i = 0; i < 60; i++) { const id = listBatches(root).find((b) => !before.has(b)); if (id) return id; await new Promise((r) => setTimeout(r, 1000)); }
         throw new Error("orchestrate did not create a batch within 60s");
       },