jules-orchestrator-kit 0.5.2 → 0.6.0

package/scripts/jules-dispatch.mjs

@@ -5,7 +5,7 @@ import crypto from "node:crypto";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { resolveProjectCommands } from "./command-resolver.mjs";
-import { log, logToHistory } from "./utils.mjs";
+import { log, logToHistory, redactSecrets, appendLedger, checkDailyBudget, reserveDailyBudget } from "./utils.mjs";
 
 const isMainModule = process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
 
@@ -45,40 +45,14 @@ if (isMainModule) {
   loadEnv();
 }
 
-// 0.2 Pre-Flight Secret Redaction Gate (RegEx + Env Denylist)
-export function redactSecrets(text) {
-  if (!text) return "";
-  let sanitized = text;
-
-  // Redact active env secrets from denylist keys (*_KEY, *_SECRET, *_TOKEN, etc.)
-  for (const [envKey, envVal] of Object.entries(process.env)) {
-    if (
-      envVal &&
-      envVal.length >= 20 &&
-      /KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH/i.test(envKey)
-    ) {
-      if (sanitized.includes(envVal)) {
-        sanitized = sanitized.split(envVal).join("[REDACTED_ENV_SECRET]");
-      }
-    }
+function parseRetryAfter(res) {
+  const raw = res.headers.get("Retry-After");
+  let waitSec = Number.parseInt(raw ?? "", 10);
+  if (!Number.isFinite(waitSec)) {
+    const asDate = raw ? Date.parse(raw) : NaN;
+    waitSec = Number.isFinite(asDate) ? Math.ceil((asDate - Date.now()) / 1000) : 5;
   }
-
-  const patterns = [
-    /gh[pusr]_[a-zA-Z0-9]{36}/g,
-    /github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}/g,
-    /AKIA[0-9A-Z]{16}/g,
-    /AIzaSy[a-zA-Z0-9_\-]{33}/g,
-    /ya29\.[a-zA-Z0-9_\-]{20,}/g,
-    /Bearer\s+[a-zA-Z0-9\-\._~+\/]+=*/g,
-    /sk-(?:ant-api03-|proj-|svcacct-)[a-zA-Z0-9\-\_]{32,}/g,
-    /xox[baprs]-[a-zA-Z0-9\-]{10,}/g,
-    /eyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}/g,
-    /-----BEGIN (?:RSA|OPENSSH|EC|PRIVATE) KEY-----[\s\S]*?-----END (?:RSA|OPENSSH|EC|PRIVATE) KEY-----/g,
-  ];
-  for (const pat of patterns) {
-    sanitized = sanitized.replace(pat, "[REDACTED_BY_SECURITY_GATE]");
-  }
-  return sanitized;
+  return Math.min(Math.max(waitSec, 0), 60);
 }
 
 const ASTRO_TRIGGER_RE = /\b(?:astro|components|pages|src\/.*\.astro)\b/i;
@@ -129,6 +103,7 @@ let fullPrompt = "";
 let historyFile = "";
 let tmpPayloadFile = "";
 let tmpDir = "";
+let taskKey = "";
 
 const ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 export function getAlphaRange(index, total) {
@@ -214,10 +189,13 @@ if (isMainModule) {
   log.info(`Dispatching task to Google Jules: "${taskTitle}"...`);
   log.success(`Logged dispatch history to: ${path.relative(process.cwd(), historyFile)}`);
 
-  const payloadHash = crypto.createHash("sha256").update(taskTitle + Date.now()).digest("hex").slice(0, 12);
+  const hashInput = [repo || "repoless", taskTitle, rawPrompt, process.env.BASE_BRANCH || "main", dateStr].join("\u0000");
+  taskKey = crypto.createHash("sha256").update(hashInput).digest("hex").slice(0, 12);
+  
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "jules-payload-"));
-  tmpPayloadFile = path.join(tmpDir, `payload_${payloadHash}.json`);
+  tmpPayloadFile = path.join(tmpDir, `payload_${taskKey}.json`);
   fs.writeFileSync(tmpPayloadFile, JSON.stringify({ repo, title: taskTitle, prompt: fullPrompt }), { mode: 0o600 });
+
 }
 
 function cleanupTmp() {
@@ -239,6 +217,14 @@ async function executeDispatch() {
       return;
     }
 
+    const budgetLimit = process.env.JULES_DAILY_BUDGET ? parseInt(process.env.JULES_DAILY_BUDGET, 10) : 300;
+    const budgetCheck = reserveDailyBudget(budgetLimit, taskKey);
+    
+    if (!budgetCheck.ok) {
+      log.warn(`Daily budget exhausted or locked (${budgetCheck.used}/${budgetCheck.budget} sessions). Aborting dispatch.`);
+      process.exit(7); // Budget exhausted exit code
+    }
+
     if (apiKey && (repo || isRepoless)) {
       const payload = {
         title: taskTitle,
@@ -275,6 +261,15 @@ async function executeDispatch() {
             signal: AbortSignal.timeout(30000)
           });
 
+          if (res.status === 429) {
+            const waitSec = parseRetryAfter(res);
+            if (attempts < maxAttempts) {
+              log.warn(`⚠️ REST API Rate Limit Exceeded (HTTP 429). Retrying after ${waitSec}s...`);
+              await new Promise((r) => setTimeout(r, waitSec * 1000));
+              continue;
+            }
+          }
+
           if (res.ok || res.status === 429 || res.status === 400 || res.status === 401) {
             break;
           }
@@ -303,8 +298,8 @@ async function executeDispatch() {
       }
 
       if (res.status === 429) {
-        const retryAfter = res.headers.get("Retry-After");
-        const err = new Error(`❌ Jules REST API Rate Limit Exceeded (HTTP 429). Retry after: ${retryAfter || 'unknown'}`);
+        const waitSec = parseRetryAfter(res);
+        const err = new Error(`❌ Jules REST API Rate Limit Exceeded (HTTP 429). Retry after: ${waitSec}s`);
         err.code = 1;
         throw err;
       }
@@ -330,6 +325,7 @@ async function executeDispatch() {
         sessionId = sId || data.name || data.id || sessionId;
         log.success(`REST API Dispatch response: Session ${sessionId} created successfully.`);
         fs.appendFileSync(historyFile, `\n## Session\n- ID: \`${sessionId}\`\n`);
+        appendLedger("sessions", { event: "session_dispatched", task_key: taskKey, session_id: sessionId, status: "dispatched", task_title: taskTitle, mode: "api" });
       } catch (jsonErr) {
         log.warn("⚠️ Failed to parse REST API JSON response:", jsonErr.message);
       }
@@ -361,6 +357,7 @@ function dispatchViaCli(targetRepo, payloadFile, title) {
     log.step("💻", `Executing: jules ${args.join(" ")} (prompt passed via stdin)...`);
     execFileSync("jules", args, { input: promptToSend, stdio: ["pipe", "inherit", "inherit"] });
     log.success(`Successfully dispatched task "${title}" to Jules CLI.`);
+    appendLedger("sessions", { event: "session_dispatched", task_key: taskKey, session_id: "CLI", status: "dispatched", task_title: title, mode: "cli" });
   } catch (error) {
     const err = new Error(`Failed to dispatch task to Jules CLI: ${error.message}`);
     err.code = 1;
@@ -371,6 +368,6 @@ function dispatchViaCli(targetRepo, payloadFile, title) {
 if (isMainModule) {
   executeDispatch().catch((err) => {
     log.error(`❌ Fatal unhandled rejection in dispatch: ${err.message}`);
-    process.exit(1);
+    process.exit(err.code || 1);
   });
 }

package/scripts/jules-queue-runner.mjs

@@ -13,6 +13,7 @@ const dispatchScript = path.resolve(__dirname, "jules-dispatch.mjs");
 
 const queueDir = path.resolve(process.cwd(), ".agent/jules-queue");
 const completedDir = path.resolve(process.cwd(), ".agent/jules-queue/completed");
+const failedDir = path.resolve(process.cwd(), ".agent/jules-queue/failed");
 const queueLogFile = path.join(queueDir, "queue.jsonl");
 
 const processingDir = path.resolve(process.cwd(), ".agent/jules-queue/.processing");
@@ -23,8 +24,22 @@ if (!fs.existsSync(queueDir)) {
 }
 
 ensureDir(completedDir);
+ensureDir(failedDir);
 ensureDir(processingDir);
 
+// Recover any tasks left in .processing from a previous run or crash
+const STALE_MS = 15 * 60 * 1000;
+const processingFiles = fs.readdirSync(processingDir).filter(f => f.endsWith(".md"));
+for (const f of processingFiles) {
+  const procPath = path.join(processingDir, f);
+  try {
+    if (Date.now() - fs.statSync(procPath).mtimeMs < STALE_MS) continue;
+    const backToQueue = path.join(queueDir, f);
+    fs.renameSync(procPath, backToQueue);
+    log.info(`Recovered stale task ${f} from .processing/`);
+  } catch (_) {}
+}
+
 function logQueueState(file, status, error = null) {
   const entry = JSON.stringify({
     timestamp: new Date().toISOString(),
@@ -97,14 +112,21 @@ async function runQueue() {
         // Atomic claim: move from queueDir to processingDir before dispatching
         try {
           safeMoveSync(filePath, processingPath);
+          const now = new Date();
+          fs.utimesSync(processingPath, now, now);
         } catch (claimErr) {
           // Another runner already claimed this task file or file missing
           return;
         }
 
-        const title = file.replace(/\.md$/, "").replace(/-/g, " ");
+        let title = file.replace(/\.md$/, "").replace(/-/g, " ");
         
         const content = fs.readFileSync(processingPath, "utf-8").trim();
+        const h1Match = content.match(/^#\s+(.+)$/m);
+        if (h1Match && h1Match[1].trim()) {
+          title = h1Match[1].trim();
+        }
+        
         if (!content || content.length < 10) {
           log.warn(`Task file ${file} is empty or invalid. Skipping dispatch.`);
           const destPath = path.join(completedDir, file);
@@ -117,7 +139,7 @@ async function runQueue() {
         logQueueState(file, "RUNNING");
         
         try {
-          await execFileAsync("node", [dispatchScript, title, processingPath]);
+          await execFileAsync("node", [dispatchScript, title, processingPath], { timeout: 10 * 60 * 1000 });
           
           const destPath = path.join(completedDir, file);
           await safeMoveAsync(processingPath, destPath);
@@ -125,7 +147,30 @@ async function runQueue() {
           log.success(`Task dispatched successfully (Moved ${file} to completed/)`);
         } catch (error) {
           logQueueState(file, "FAILED", error);
-          log.error(`Failed to dispatch task [${title}]: ${error.message}`);
+          
+          let attempts = 0;
+          const attemptMatch = content.match(/^attempts:\s*(\d+)/m);
+          if (attemptMatch) attempts = parseInt(attemptMatch[1], 10);
+
+          if (attempts >= 2) {
+             const destPath = path.join(failedDir, file);
+             try { await safeMoveAsync(processingPath, destPath); } catch (_) {}
+             log.error(`Task [${title}] failed 3 times. Moved to failed/. Error: ${error.message}`);
+          } else {
+             let newContent = content;
+             if (attemptMatch) {
+                newContent = content.replace(/^attempts:\s*\d+/m, `attempts: ${attempts + 1}`);
+             } else if (content.startsWith("---\n")) {
+                newContent = content.replace(/^---\n/, `---\nattempts: 1\n`);
+             } else {
+                newContent = `---\nattempts: 1\n---\n\n` + content;
+             }
+             try {
+               fs.writeFileSync(processingPath, newContent);
+               await safeMoveAsync(processingPath, filePath);
+             } catch (_) {}
+             log.warn(`Task [${title}] failed. Re-queued (Attempt ${attempts + 1}). Error: ${error.message}`);
+          }
         }
       })
     );

package/scripts/jules-scan-todos.mjs

@@ -8,6 +8,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { log, ensureDir } from "./utils.mjs";
 
 const IGNORE_DIRS = new Set([
@@ -22,9 +23,8 @@ const IGNORE_DIRS = new Set([
   "coverage",
   ".next",
   ".turbo",
-  "tmp_repos",
-  "tmp_repos2",
-  "tmp_repos3"
+  "test",
+  "scripts/jules-scan-todos.mjs"
 ]);
 
 const IGNORE_EXTS = new Set([
@@ -61,15 +61,15 @@ export function scanCodebaseForTodos(rootDir = process.cwd(), options = {}) {
         walk(fullPath);
       } else if (entry.isFile()) {
         const ext = path.extname(entry.name).toLowerCase();
-        if (IGNORE_EXTS.has(ext)) continue;
+        if (IGNORE_EXTS.has(ext) || IGNORE_DIRS.has(relPath)) continue;
 
         try {
           const content = fs.readFileSync(fullPath, "utf-8");
           const lines = content.split("\n");
           for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
             const line = lines[lineIdx];
-            // Ignore false positives from regex definitions, test assertions, or scanner string literals
-            if (/TAG_REGEX|assert\.|tasks\.some|log\.info\("Zero TODO|\/FIXME comments/i.test(line)) {
+            // Ignore false positives from regex definitions or scanner string literals
+            if (/TAG_REGEX|tasks\.some|log\.info\("Zero TODO|\/FIXME comments/i.test(line)) {
               continue;
             }
             const match = line.match(TAG_REGEX);
@@ -137,6 +137,6 @@ export function runScanner() {
   log.info(`Run \`npx jules-swarm ${path.relative(process.cwd(), outputPath)}\` to execute all tasks in parallel.`);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(import.meta.url.slice(7))) {
+if (process.argv[1] && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url))) {
   runScanner();
 }

package/scripts/jules-self-audit.mjs

@@ -5,12 +5,13 @@ import crypto from "node:crypto";
 import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { resolveWorkspaceExecutionBoundary } from "./command-resolver.mjs";
-import { log, logToHistory } from "./utils.mjs";
+import { log, logToHistory, redactSecrets } from "./utils.mjs";
 
 function runGitCommand(args, ignoreError = false) {
   try {
     return execFileSync("git", args, { encoding: "utf-8" }).trim();
   } catch (error) {
+    if (ignoreError) return "";
     const err = new Error(`Git command failed: git ${args.join(" ")}\n${error.message}`);
     err.code = 1;
     throw err;
@@ -32,7 +33,7 @@ export function matchGlob(filepath, globPattern) {
         seg
           .replace(/[.+^${}()|[\]\\]/g, "\\$&")
           .replace(/\*/g, "[^/]*")
-          .replace(/\?/g, ".")
+          .replace(/\?/g, "[^/]")
       );
     }
   }
@@ -49,6 +50,32 @@ export function matchGlob(filepath, globPattern) {
 }
 
 
+export const COMMAND_DEFINING_FILES = [
+  "package.json",
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "yarn.lock",
+  "bun.lockb",
+  "turbo.json",
+  "nx.json",
+  "lerna.json",
+  "rush.json",
+  "Cargo.toml",
+  "Cargo.lock",
+  "go.mod",
+  "go.sum",
+  "pyproject.toml",
+  "setup.py",
+  "requirements.txt",
+  "Makefile",
+  "build.gradle",
+  "build.gradle.kts",
+  "pom.xml",
+  ".agent/jules.yml",
+  "jules.config.json"
+];
+
 /**
  * Lightweight Zero-Dependency YAML Pattern Extractor
  * Extracts forbidden_paths and allow_paths arrays from jules.yml.
@@ -193,6 +220,18 @@ export function runSelfAudit() {
     .map((f) => f.trim().replace(/^["']|["']$/g, ""))
     .filter(Boolean);
 
+  const commandFileChanges = rawDiffFiles.filter((file) =>
+    COMMAND_DEFINING_FILES.some((cmdFile) => file === cmdFile || file.endsWith(`/${cmdFile}`))
+  );
+
+  if (commandFileChanges.length > 0 && process.env.JULES_ALLOW_COMMAND_FILE_CHANGES !== "true" && process.env.JULES_ALLOW_COMMAND_FILE_CHANGES !== "1") {
+    const err = new Error(
+      "COMMAND FILE CHANGE DETECTED: " + commandFileChanges.join(", ") + ". Refusing to execute verification scripts from untrusted branch."
+    );
+    err.code = 3;
+    throw err;
+  }
+
   const isBloatFile = (file) => /(\.lock|package-lock\.json|yarn\.lock|pnpm-lock\.yaml|\.png|\.jpg|\.jpeg|\.pdf|\.min\.js|\.map)$/i.test(file);
   const changedCodeFiles = rawDiffFiles.filter((f) => !isBloatFile(f));
 
@@ -207,20 +246,72 @@ export function runSelfAudit() {
 
   const violations = rawDiffFiles.filter((file) => {
     const isForbidden = forbiddenPatterns.some((pattern) => matchGlob(file, pattern));
-    if (!isForbidden) return false;
-    const isAllowed = allowedPatterns.some((pattern) => matchGlob(file, pattern));
-    return !isAllowed;
+    if (isForbidden) return true; // Immutable forbidden path — CANNOT be overridden by allow_paths
+    if (allowedPatterns.length > 0) {
+      const isAllowed = allowedPatterns.some((pattern) => matchGlob(file, pattern));
+      return !isAllowed;
+    }
+    return false;
   });
 
   if (violations.length > 0) {
-    const err = new Error("RESTRICTED FILE VIOLATION DETECTED!");
+    const err = new Error("RESTRICTED FILE VIOLATION DETECTED: " + violations.join(", "));
     err.code = 3;
     throw err;
   }
   log.success("Restricted File Boundary Check: PASSED");
 
-  log.info("Resolving Dynamic Verification Suite...");
-  const resolvedCmds = resolveWorkspaceExecutionBoundary(changedCodeFiles, process.cwd());
+  log.info("Analyzing Diff Payload Size & Content...");
+  const diffPayload = runGitCommand(["diff", `${mergeBase}...HEAD`], true);
+  const diffBytes = Buffer.byteLength(diffPayload, "utf8");
+  const maxDiffBytes = 75 * 1024; // 75 KB
+
+  if (diffBytes > maxDiffBytes) {
+    const err = new Error(`DIFF PAYLOAD TOO LARGE: ${diffBytes} bytes exceeds ${maxDiffBytes} bytes. Split the task.`);
+    err.code = 5;
+    throw err;
+  }
+  
+  const redactedDiff = redactSecrets(diffPayload);
+  if (redactedDiff !== diffPayload) {
+    const err = new Error("SECRET LEAK PREVENTED: Secret-like content detected in diff. Aborting.");
+    err.code = 6;
+    throw err;
+  }
+  log.success(`Diff Inspection Check: PASSED (${diffBytes} bytes, No Secrets Detected)`);
+
+  log.info("Resolving Dynamic Verification Suite from Trusted Base Branch...");
+  
+  const runId = crypto.randomBytes(4).toString("hex");
+  const trustedDir = path.join(os.tmpdir(), `jules-trusted-tree-${runId}`);
+  const tempArchive = path.join(os.tmpdir(), `jules-trusted-archive-${runId}.tar`);
+  
+  let resolutionRoot;
+  try {
+    fs.mkdirSync(trustedDir, { recursive: true });
+    execFileSync("git", ["archive", mainRef, "-o", tempArchive]);
+    execFileSync("tar", ["-xf", tempArchive, "-C", trustedDir]);
+    resolutionRoot = trustedDir;
+  } catch (err) {
+    const error = new Error("FATAL: Failed to extract trusted base branch for command resolution. Refusing to fall back to working tree.\n" + err.message);
+    error.code = 2;
+    throw error;
+  }
+
+  let resolvedCmds;
+  try {
+    resolvedCmds = resolveWorkspaceExecutionBoundary(changedCodeFiles, resolutionRoot);
+  } finally {
+    try {
+      if (trustedDir && fs.existsSync(trustedDir)) {
+        fs.rmSync(trustedDir, { recursive: true, force: true });
+      }
+      if (tempArchive && fs.existsSync(tempArchive)) {
+        fs.rmSync(tempArchive, { force: true });
+      }
+    } catch (e) {}
+  }
+
   log.info(`Discovered Execution Scope: ${resolvedCmds.source}`);
 
   const startTime = Date.now();
@@ -278,18 +369,29 @@ export function runSelfAudit() {
     }
 
     let oodaRetries = 0;
+    const oodaStateFile = path.resolve(process.cwd(), ".agent/state/ooda.json");
     try {
-      const history = execSync("git log -n 5 --format=%B", { encoding: "utf-8" });
-      const matches = history.match(/OODA Auto-Repair/gi);
-      if (matches) {
-        oodaRetries = matches.length;
+      if (fs.existsSync(oodaStateFile)) {
+        const oodaData = JSON.parse(fs.readFileSync(oodaStateFile, "utf-8"));
+        oodaRetries = oodaData.attempts || 0;
+      } else {
+        const history = execSync("git log -n 5 --format=%B", { encoding: "utf-8" });
+        const matches = history.match(/OODA Auto-Repair/gi);
+        if (matches) {
+          oodaRetries = matches.length;
+        }
       }
     } catch (e) {
-      // Ignorera git-fel här
+      // Ignorera fel här
     }
 
     if (oodaRetries < 3) {
       log.info(`🛠️ Initiating OODA Auto-Repair (Attempt ${oodaRetries + 1}/3)...`);
+      try {
+        const stateDir = path.resolve(process.cwd(), ".agent/state");
+        if (!fs.existsSync(stateDir)) fs.mkdirSync(stateDir, { recursive: true });
+        fs.writeFileSync(oodaStateFile, JSON.stringify({ attempts: oodaRetries + 1, lastAttempt: new Date().toISOString() }), "utf-8");
+      } catch (e) {}
       const prompt = `OODA Auto-Repair Attempt ${oodaRetries + 1}\n\nThe verification suite failed with the following errors after the previous patch:\n\n\`\`\`\n${failureLog.slice(-1500)}\n\`\`\`\n\nPlease fix the errors so the verification passes.`;
       
       const dispatchScript = path.resolve(process.cwd(), "scripts/jules-dispatch.mjs");
@@ -339,14 +441,21 @@ export function runPreflightSandbox() {
       }
     }
     
-    log.step("[3/5]", "Installing dependencies in sandbox (npm ci)...");
-    const packageJsonPath = path.join(sandboxDir, "package.json");
-    if (fs.existsSync(packageJsonPath)) {
+    log.step("[3/5]", "Resolving package manager and installing dependencies...");
+    let installCmd = "";
+    if (fs.existsSync(path.join(sandboxDir, "pnpm-lock.yaml"))) installCmd = "pnpm install --ignore-scripts";
+    else if (fs.existsSync(path.join(sandboxDir, "bun.lockb"))) installCmd = "bun install --ignore-scripts";
+    else if (fs.existsSync(path.join(sandboxDir, "yarn.lock"))) installCmd = "yarn install --ignore-scripts";
+    else if (fs.existsSync(path.join(sandboxDir, "package-lock.json"))) installCmd = "npm ci --ignore-scripts";
+
+    if (installCmd) {
       try {
-        execSync("npm ci --ignore-scripts", { cwd: sandboxDir, stdio: "ignore" });
+        execSync(installCmd, { cwd: sandboxDir, stdio: "pipe", encoding: "utf-8" });
       } catch (e) {
-        log.warn("npm ci failed or wasn't needed. Proceeding...");
+        log.warn(`${installCmd} failed or wasn't needed. Output: ${e.stdout}\nError: ${e.stderr}\nProceeding...`);
       }
+    } else {
+      log.info("Skipping dependency installation (no lockfile detected).");
     }
 
     log.step("[4/5]", "Resolving execution boundary in sandbox...");

package/scripts/jules-swarm.mjs

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 import fs from "node:fs";
 import path from "node:path";
@@ -74,6 +74,9 @@ function reapOrphanedWorktrees() {
           fs.rmSync(wtPath, { recursive: true, force: true });
         } catch (_) {}
       }
+      try {
+        execFileSync("git", ["branch", "-D", `jules/${entry}`], { stdio: "ignore" });
+      } catch (_) {}
     }
   } catch (_) {}
   try {

package/scripts/lock-manager.mjs

@@ -31,7 +31,37 @@ async function readManifest() {
 
 async function writeManifest(manifest) {
   await fs.mkdir(path.dirname(MANIFEST_PATH), { recursive: true });
-  await fs.writeFile(MANIFEST_PATH, JSON.stringify(manifest, null, 2), 'utf-8');
+  const tmp = MANIFEST_PATH + `.tmp-${process.pid}`;
+  await fs.writeFile(tmp, JSON.stringify(manifest, null, 2), 'utf-8');
+  await fs.rename(tmp, MANIFEST_PATH);
+}
+
+async function withManifestLock(fn) {
+  const lockPath = MANIFEST_PATH + ".lock";
+  await fs.mkdir(path.dirname(lockPath), { recursive: true });
+  for (let i = 0; i < 50; i++) {
+    try {
+      const stats = await fs.stat(lockPath);
+      if (Date.now() - stats.mtimeMs > 5 * 60 * 1000) {
+        await fs.rm(lockPath, { force: true });
+      }
+    } catch (_) {}
+
+    let handle;
+    try {
+      handle = await fs.open(lockPath, "wx");
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      await new Promise(r => setTimeout(r, 50 + Math.random() * 50));
+      continue;
+    }
+    try { return await fn(); }
+    finally {
+      try { await handle.close(); } catch (_) {}
+      await fs.rm(lockPath, { force: true });
+    }
+  }
+  throw new Error("Could not acquire manifest lock");
 }
 
 function cleanExpiredLocks(manifest) {
@@ -47,7 +77,8 @@ function cleanExpiredLocks(manifest) {
 }
 
 async function acquireLocks(agentName, taskId, files) {
-  const manifest = await readManifest();
+  await withManifestLock(async () => {
+    const manifest = await readManifest();
   cleanExpiredLocks(manifest);
   
   const now = Date.now();
@@ -65,13 +96,13 @@ async function acquireLocks(agentName, taskId, files) {
     }
   }
 
-  if (conflicts.length > 0) {
-    console.error(`ERROR: Cannot acquire locks for task ${taskId}. Conflicts detected:`);
-    for (const conflict of conflicts) {
-      console.error(`  - ${conflict.file} is locked by ${conflict.lockedBy} (Task: ${conflict.task})`);
+    if (conflicts.length > 0) {
+      let msg = `Cannot acquire locks for task ${taskId}. Conflicts detected:\n`;
+      for (const conflict of conflicts) {
+        msg += `  - ${conflict.file} is locked by ${conflict.lockedBy} (Task: ${conflict.task})\n`;
+      }
+      throw new Error(msg.trim());
     }
-    process.exit(1);
-  }
 
   for (const file of files) {
     const normalizedFile = path.normalize(file);
@@ -83,12 +114,14 @@ async function acquireLocks(agentName, taskId, files) {
     };
   }
 
-  await writeManifest(manifest);
-  console.log(`SUCCESS: Acquired locks for task ${taskId} on ${files.length} files.`);
+    await writeManifest(manifest);
+    console.log(`SUCCESS: Acquired locks for task ${taskId} on ${files.length} files.`);
+  });
 }
 
 async function releaseLocks(taskId) {
-  const manifest = await readManifest();
+  await withManifestLock(async () => {
+    const manifest = await readManifest();
   let releasedCount = 0;
   
   for (const [file, lock] of Object.entries(manifest)) {
@@ -98,12 +131,13 @@ async function releaseLocks(taskId) {
     }
   }
 
-  if (releasedCount > 0) {
-    await writeManifest(manifest);
-    console.log(`SUCCESS: Released ${releasedCount} locks for task ${taskId}.`);
-  } else {
-    console.log(`INFO: No locks found for task ${taskId}.`);
-  }
+    if (releasedCount > 0) {
+      await writeManifest(manifest);
+      console.log(`SUCCESS: Released ${releasedCount} locks for task ${taskId}.`);
+    } else {
+      console.log(`INFO: No locks found for task ${taskId}.`);
+    }
+  });
 }
 
 async function main() {