kenaz 0.3.3 → 0.3.6

package/core/.formation/tools/runner.js

@@ -1,1332 +0,0 @@
-/**
- * Formation Runner — with Thalamus-aware activity timeout
- * 統一的 Claude subagent 進程啟動器
- *
- * 4 種啟動方式：
- *   runSingle     — 一般模式（dispatch 用，格式化輸出）
- *   runHeadless   — 無頭模式（prompt 壓縮，原始輸出）
- *   runLegionLead — Agent Teams 模式（teammate-mode + Task 工具）
- *   runParallel   — Squad 並行啟動
- */
-
-const fs = require('fs');
-const path = require('path');
-const { spawn, execSync } = require('child_process');
-const { ROOT, getClaudeEnv, detectClaudeCmd } = require('./utils');
-const { createLogWriter, formatEntry } = require('./logger');
-// TASK_1530: shared salvage helper (also used by post-complete/git-merge.js) so the
-// worktree-leak detector can recover leaked main-repo changes without duplicating it.
-// TASK_1785: readDispatchDirtySnapshot — pre-dispatch dirty snapshot so the leak
-// detector only counts paths that became dirty DURING the dispatch window.
-const { salvageWorkingTreePaths, readDispatchDirtySnapshot } = require('./git-salvage');
-// TASK_1879: canonical shared CARGO_TARGET_DIR for Rust verification — single
-// source of truth (was: 12+ templates each inventing a unique C:/t/* dir).
-const { verifyTargetDir } = require(path.join(ROOT, 'dev', 'scripts', 'verify-target-dir.js'));
-
-/**
- * Look up which Bifröst adapter declares a given model id.
- * Scans .formation/bifrost/<adapter>/models.json files in priority order.
- * Returns the adapter name (e.g. 'openai') or null if no match.
- *
- * Used by spawnClaude to translate dashboard dispatchModel="gpt-5" into
- * adapter="openai" without the dashboard backend needing to round-trip.
- *
- * Empty-string `modelId` is the "adapter default model" sentinel — it
- * matches an adapter that explicitly declares an entry with id="" in
- * its manifest, so the user can pick "Codex default" without committing
- * to a specific gpt-5/o3/etc id.
- */
-function lookupBifrostAdapterForModel(modelId) {
-  if (modelId == null) return null;
-  const bifrostDir = path.join(ROOT, '.formation', 'bifrost');
-  if (!fs.existsSync(bifrostDir)) return null;
-  try {
-    const entries = fs.readdirSync(bifrostDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name === 'shared') continue;
-      const manifestPath = path.join(bifrostDir, entry.name, 'models.json');
-      if (!fs.existsSync(manifestPath)) continue;
-      try {
-        const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
-        if (Array.isArray(manifest.models) && manifest.models.some((m) => m.id === modelId)) {
-          return manifest.adapter || entry.name;
-        }
-      } catch {
-        // skip malformed manifests
-      }
-    }
-  } catch {
-    // bifrost dir read failed
-  }
-  return null;
-}
-
-/**
- * True when a model id belongs to the Claude family — full ids (claude-*) or
- * the Claude CLI's bare aliases (opus/sonnet/haiku/opusplan). Anything else is
- * a non-claude model that must resolve to a Bifröst adapter. (TASK_1774)
- */
-function isClaudeFamilyModel(modelId) {
-  if (!modelId) return false;
-  return /^claude-/.test(modelId) || /^(opus|sonnet|haiku|opusplan)$/i.test(modelId);
-}
-
-/**
- * Read dispatchAdapter from dashboard-models.json — project copy first, then
- * core. Returns the adapter name or null. (TASK_1774, defect 1)
- */
-function readDashboardDispatchAdapter(projectPath) {
-  const candidates = [];
-  if (projectPath && path.resolve(projectPath) !== path.resolve(ROOT)) {
-    candidates.push(path.join(projectPath, '.kenaz', 'dashboard-models.json'));
-  }
-  candidates.push(path.join(ROOT, '.kenaz', 'dashboard-models.json'));
-  for (const p of candidates) {
-    try {
-      if (!fs.existsSync(p)) continue;
-      const dm = JSON.parse(fs.readFileSync(p, 'utf8'));
-      if (dm.dispatchAdapter) return dm.dispatchAdapter;
-    } catch { /* malformed or unreadable — try next candidate */ }
-  }
-  return null;
-}
-
-/**
- * Kill a child process and its entire process tree.
- * On Windows with shell: true, child.kill() only kills the shell (cmd.exe),
- * leaving the actual claude.exe running as an orphan.
- * taskkill /T /F kills the entire tree.
- */
-function killProcessTree(child) {
-  if (!child || !child.pid) return;
-  try {
-    if (process.platform === 'win32') {
-      execSync(`taskkill /T /F /PID ${child.pid}`, { stdio: 'ignore', timeout: 10000, windowsHide: true });
-    } else {
-      child.kill('SIGTERM');
-    }
-  } catch (e) {
-    // Process may have already exited
-    try { child.kill(); } catch {}
-  }
-}
-
-/**
- * Post-dispatch worktree leak detector.
- *
- * After a dispatch completes successfully, verifies that at least one commit
- * landed on the task branch. If the task branch has zero new commits AND the
- * main repo has uncommitted TRACKED changes, agent writes almost certainly
- * leaked to main (the TASK_1402 / TASK_1530 class).
- *
- * TASK_1530: this used to be WARN-ONLY (marker + console.error). That left the
- * leaked content sitting in the main working tree where a later branch-recovery
- * force-checkout could permanently discard it, AND the dispatch was still
- * reported as a clean success. It now ACTS:
- *   1. SALVAGES the leaked main-repo tracked modifications onto a recoverable
- *      branch via the shared salvageWorkingTreePaths helper (same plumbing the
- *      post-complete merge path uses — TASK_1529).
- *   2. BLOCKS: sets child._formationExitCode = 1 so downstream consumers
- *      (formations.js onDone, headless.js, post-complete) do NOT treat the
- *      dispatch as a clean success.
- *
- * Never throws — detection/salvage errors are caught so they never crash the
- * cleanup chain, but a confirmed leak ALWAYS flips the exit code.
- *
- * @param {string} worktreeDir         agent's isolated worktree
- * @param {string} originalWorktreeHead HEAD snapshot taken pre-spawn
- * @param {object} [child]             child process — exit code is flipped on leak
- * @param {string} [mainRoot]          main-repo root to audit (defaults to ROOT;
- *                                     parameterized for the TASK_1530 regression test)
- * @returns {object|null} { leaked, salvageBranch, leakedPaths } on leak, null otherwise
- */
-function detectWorktreeLeak(worktreeDir, originalWorktreeHead, child = null, mainRoot = ROOT) {
-  if (!worktreeDir || !originalWorktreeHead) return null;
-  try {
-    // Use `--not <head>` rather than `^<head>`: on Windows cmd.exe `^` is the
-    // escape char and gets stripped when execSync spawns through a shell, which
-    // would list ALL commits and mask the leak (TASK_1530).
-    const taskCommits = execSync(
-      `git -C "${worktreeDir}" log --oneline HEAD --not ${originalWorktreeHead}`,
-      { encoding: 'utf8', timeout: 10000, windowsHide: true }
-    ).trim();
-    if (taskCommits) return null; // at least one commit on task branch — no leak
-
-    // Zero commits on task branch: check if main repo has uncommitted changes.
-    // Use --untracked-files=no: only TRACKED modifications are the salvageable
-    // data-loss class (untracked peer-task files are correct scope isolation).
-    // IMPORTANT: do NOT .trim() the whole output — porcelain encodes index/worktree
-    // status in cols 0-1, and a worktree-only modification is ' M path' (leading
-    // space). A global trim eats the first line's leading space and shifts the
-    // slice, corrupting the path (e.g. 'kb.js' → 'b.js'). Strip only the trailing
-    // newline. (Same class as the raw-vs-trim note in git-merge.js.)
-    let mainTrackedStatus = '';
-    try {
-      mainTrackedStatus = execSync(
-        `git -C "${mainRoot}" status --porcelain --untracked-files=no`,
-        { encoding: 'utf8', timeout: 10000, windowsHide: true }
-      ).replace(/\r?\n$/, '');
-    } catch { /* main status failed — assume clean */ }
-
-    if (!mainTrackedStatus) return null; // no tracked dirt — no actionable leak
-
-    // Parse the dirty tracked paths (porcelain: 'XY path' or rename 'a -> b').
-    const _allDirtyPaths = mainTrackedStatus.split('\n')
-      .map(l => l.replace(/\r$/, ''))
-      .filter(l => l.length > 0)
-      .map(l => {
-        let p = l.slice(3).trim();
-        const arrow = p.indexOf(' -> ');
-        if (arrow >= 0) p = p.slice(arrow + 4).trim();
-        return p.replace(/^"|"$/g, '');
-      })
-      .filter(Boolean);
-
-    // TASK_1622 (Req 4): Filter known-churn session-state files from the leak set.
-    // These files are ALWAYS dirty during a live Ansuz/Muninn session (counters,
-    // transcripts). They look like leaks but are ambient session churn,
-    // not agent writes that crossed the worktree boundary. Only count dirt that
-    // is NOT in this allowlist as a genuine agent leak.
-    const LEAK_CHURN_ALLOWLIST_PREFIXES = [
-      '.kenaz/specialist/',         // all specialist daemon state files
-      '.kenaz/transcripts/',        // transcript index + session transcripts
-      '.kenaz/dashboard-models.',   // model config updated by dashboard
-      '.kenaz/efe_snapshots/',      // EFE snapshots written by post-complete
-      '.synapse/heat_cache.',       // heat cache flushed every 5 min
-      '.formation/.synapse/',       // guardian counter etc.
-      '.formation/tmp_',            // one-off probe scripts (Muninn, episode writers)
-    ];
-    const _isKnownChurn = (p) => {
-      const norm = p.replace(/[\\]/g, '/');
-      return LEAK_CHURN_ALLOWLIST_PREFIXES.some(prefix => norm.startsWith(prefix));
-    };
-    let leakedPaths = _allDirtyPaths.filter(p => !_isKnownChurn(p));
-    if (leakedPaths.length === 0) {
-      // All dirty files are known-churn session state — not a real leak
-      const _churnPaths = _allDirtyPaths.filter(p => _isKnownChurn(p));
-      if (_churnPaths.length > 0) {
-        console.log(`[runner] [TASK_1622] detectWorktreeLeak: ${_churnPaths.length} dirty file(s) are known session-churn (not a leak). First 3: ${_churnPaths.slice(0, 3).join(', ')}`);
-      }
-      return null; // only churn — no actionable leak
-    }
-
-    // TASK_1785 (DEFECT-D): exclude paths that were ALREADY dirty before the
-    // dispatch started. Zero commits + only pre-existing user WIP is the DEFAULT
-    // bifrost state (DEFECT-A), NOT an agent leak — without this exclusion the
-    // user's own dirty files get reported as a leak AND salvaged to a branch
-    // (TASK_1779 run 1 false positive: 5 user dirty files flagged).
-    const _dispatchSessionId = (child && child._formation && child._formation.sessionId) || null;
-    let _preDirtySnapshot = null;
-    try {
-      _preDirtySnapshot = readDispatchDirtySnapshot(mainRoot, { sessionId: _dispatchSessionId });
-    } catch { /* snapshot read must never break leak detection */ }
-    if (_preDirtySnapshot && Array.isArray(_preDirtySnapshot.dirtyPaths)) {
-      const _preSet = new Set(_preDirtySnapshot.dirtyPaths.map(p => p.replace(/\\/g, '/')));
-      const _newlyDirty = leakedPaths.filter(p => !_preSet.has(p.replace(/\\/g, '/')));
-      const _preExistingCount = leakedPaths.length - _newlyDirty.length;
-      if (_preExistingCount > 0) {
-        console.log(`[runner] [TASK_1785] detectWorktreeLeak: ${_preExistingCount} dirty file(s) were already dirty BEFORE dispatch (pre-dispatch snapshot) — excluded from leak set`);
-      }
-      if (_newlyDirty.length === 0) {
-        // Zero commits + only pre-existing dirt: NOT a leak. No salvage branch,
-        // no LEAK_DETECTED marker, no exit-code flip.
-        return null;
-      }
-      leakedPaths = _newlyDirty;
-    } else {
-      // Missing snapshot (older dispatch / capture failure) — degrade to legacy
-      // semantics with a loud warning. NEVER crash.
-      console.error(`[runner] [TASK_1785] WARNING: no pre-dispatch dirty snapshot for session ${_dispatchSessionId || '<unknown>'} — legacy leak semantics (pre-existing user WIP may be misattributed as leak)`);
-    }
-
-    // Leak confirmed: task branch empty + main has non-churn tracked dirt.
-    const markerFile = path.join(worktreeDir, 'LEAK_DETECTED');
-    const salvageId = (child && child._formation && (child._formation.sessionId || child._formation.skill)) || 'leak';
-
-    // SALVAGE: preserve the leaked main-repo modifications on a recoverable branch
-    // BEFORE anything (branch recovery, next dispatch) can force-discard them.
-    let salvageBranch = null;
-    try {
-      salvageBranch = salvageWorkingTreePaths(mainRoot, salvageId, leakedPaths);
-    } catch { /* salvage failed — fall through, files still in working tree */ }
-
-    const msg = [
-      `🚨 [runner] WORKTREE LEAK DETECTED — BLOCKING dispatch`,
-      `   Worktree:  ${worktreeDir}`,
-      `   Task branch has ZERO commits since ${originalWorktreeHead} but main repo has ${leakedPaths.length} dirty tracked file(s).`,
-      `   Agent writes leaked to MAIN repo. Audit: git -C "${mainRoot}" status`,
-      salvageBranch
-        ? `   💾 Leaked changes salvaged → branch ${salvageBranch} (recover: git checkout ${salvageBranch} -- <file>)`
-        : `   ⚠️  Could not salvage leaked changes to a branch — they remain in the working tree, review before any force-checkout`,
-      `   Marker: ${markerFile}`,
-    ].join('\n');
-    console.error(msg);
-
-    try {
-      fs.writeFileSync(markerFile, JSON.stringify({
-        detected_at: new Date().toISOString(),
-        worktreeDir,
-        originalHead: originalWorktreeHead,
-        leakedPaths,
-        salvageBranch,
-        blocked: true,
-        message: 'Agent dispatch completed with zero commits on task branch while main repo has uncommitted TRACKED changes. Writes leaked to main repo; salvaged to branch and dispatch marked failed.',
-      }, null, 2), 'utf8');
-    } catch { /* marker write failed — warning already emitted */ }
-
-    // BLOCK: flip the exit code so the dispatch is not reported as clean success.
-    if (child) {
-      child._formationExitCode = 1;
-      child._formationLeak = { worktreeDir, leakedPaths, salvageBranch };
-    }
-
-    return { leaked: true, salvageBranch, leakedPaths };
-  } catch {
-    return null; /* git error — skip detection silently */
-  }
-}
-
-// ─────────────────────────────────────────
-// 內部：輸出收集
-// ─────────────────────────────────────────
-
-/**
- * 收集 claude 進程的 stdout/stderr，寫入 log
- * @param {ChildProcess} child
- * @param {object} log - createLogWriter 回傳的 log writer
- * @param {object} opts
- * @param {boolean} opts.silent      - 不輸出到 console
- * @param {string}  opts.memberId    - 成員 ID（顯示用）
- * @param {boolean} opts.pipeRaw     - true=原始 stdout 直通，false=格式化輸出
- * @param {boolean} opts.summaryOnly - true=收集摘要資料，結束時輸出結構化摘要到 stdout
- * @param {string}  opts.coherenceToken - Canary coherence token（用於漂移偵測）
- */
-function collectOutput(child, log, opts = {}) {
-  const { silent, memberId, pipeRaw = false, summaryOnly = false, onLog, coherenceToken, rigor, worktreeDir = null, originalWorktreeHead = null } = opts;
-  let buffer = '';
-  let resultData = null;
-  let semanticFailureReason = null;
-
-  const detectSemanticFailure = (text) => {
-    if (!text) return null;
-    const normalized = String(text);
-    if (/hit your limit/i.test(normalized)) return 'usage limit reached';
-    if (/rate limit/i.test(normalized)) return 'rate limit reached';
-    if (/too many requests/i.test(normalized)) return 'too many requests';
-    if (/\b429\b/.test(normalized)) return 'http 429';
-    // TASK_1774 (defect 2): Claude CLI model-init failure — an unknown/rejected
-    // model id surfaces as "issue with the selected model" in the result text
-    // while the CLI still exits 0 after ~1 turn. Must never report SUCCESS.
-    if (/issue with the selected model/i.test(normalized)) return 'model init failure (selected model rejected)';
-    return null;
-  };
-
-  const registerSemanticFailure = (text) => {
-    const failure = detectSemanticFailure(text);
-    if (!failure) return null;
-    semanticFailureReason = semanticFailureReason || failure;
-    child._formationExitCode = 1;
-    return semanticFailureReason;
-  };
-
-  // ── Refusal detector (TASK_1712) ──────────────────────────────────────
-  // Scans final result text for prompt-injection refusal signatures from safety-hardened
-  // models (e.g. claude-sonnet-5). A refusal must never log [RESULT] SUCCESS — it is a
-  // distinct failure mode that burns cost with zero work (confirmed in esp32 heimdall logs).
-  // Signatures are matched case-insensitively against the full result text.
-  let refusalReason = null;
-  const detectRefusal = (text) => {
-    if (!text || refusalReason) return refusalReason;
-    const t = String(text);
-    if (/prompt.{0,10}injection/i.test(t)) return 'prompt injection refusal';
-    if (/I(?:'m| am) not (?:going to|able to) follow/i.test(t)) return 'explicit refusal (not going to follow)';
-    if (/(?:won'?t|will not|cannot|not able to) (?:adopt|follow|comply with|act as|pretend|roleplay)/i.test(t)) return 'behavioral refusal';
-    if (/hallmarks of (?:a )?(?:prompt.{0,5}injection|jailbreak)/i.test(t)) return 'injection-hallmark refusal';
-    if (/appears to be (?:a )?(?:prompt.{0,5}injection|jailbreak|attempt)/i.test(t)) return 'injection-appearance refusal';
-    if (/attempting to (?:jailbreak|manipulate|bypass|circumvent)/i.test(t)) return 'jailbreak-attempt refusal';
-    if (/(?:bypass|override|circumvent).{0,30}(?:guidelines|safety|values|policy|principles)/i.test(t)) return 'bypass-attempt refusal';
-    if (/I(?:'m| am) unable to (?:assist|help|comply|process) with/i.test(t)) return 'unable-to-assist refusal';
-    if (/(?:skip|ignore) (?:CLAUDE.md|my guidelines|my values|my training)/i.test(t)) return 'bypass-guidelines refusal';
-    return null;
-  };
-  const registerRefusal = (text) => {
-    const reason = detectRefusal(text);
-    if (!reason) return null;
-    refusalReason = reason;
-    child._formationExitCode = 1;
-    child._formationRefusal = reason;
-    return reason;
-  };
-
-  // summaryOnly mode: 收集統計資料
-  const stats = {
-    toolCounts: {},
-    errors: [],
-    startTime: Date.now()
-  };
-
-  // Activity timeout with process-alive detection (TASK_888 fix)
-  // Root cause: agents can silently stall (e.g., git state corruption from
-  // parallel dispatch, context exhaustion) leaving zombie processes.
-  // However, Opus model thinking can legitimately exceed old timeouts (7min).
-  //
-  // New strategy:
-  //   1. Raised base timeouts: high=15min, medium=12min, low=8min
-  //   2. When timeout fires, check if child PID is still alive
-  //   3. If alive → extend (model is thinking), log and reset timer
-  //   4. Absolute ceiling: 30min no output → kill even if alive (zombie guard)
-  const _rigor = opts.rigor || 'low';
-  const ACTIVITY_TIMEOUT_MS = _rigor === 'high' ? 900000 : _rigor === 'medium' ? 720000 : 480000;
-  const ABSOLUTE_SILENCE_CEILING_MS = 30 * 60 * 1000; // 30 min hard cap
-  let activityTimer = null;
-  let lastOutputTime = Date.now();
-  let extensionCount = 0;
-  const MAX_EXTENSIONS = 3; // max 3 extensions before hard kill
-
-  const isChildAlive = () => {
-    if (!child || !child.pid) return false;
-    try {
-      // Sending signal 0 checks if process exists without killing it
-      process.kill(child.pid, 0);
-      return true;
-    } catch {
-      return false;
-    }
-  };
-
-  const resetActivityTimer = () => {
-    if (activityTimer) clearTimeout(activityTimer);
-    lastOutputTime = Date.now();
-    extensionCount = 0; // reset extensions on real output
-    activityTimer = setTimeout(onActivityTimeout, ACTIVITY_TIMEOUT_MS);
-  };
-
-  const onActivityTimeout = () => {
-    const tag = memberId ? ` [${memberId}]` : '';
-    const silenceDuration = Date.now() - lastOutputTime;
-
-    // Hard ceiling: no output for 30 min → kill regardless
-    if (silenceDuration >= ABSOLUTE_SILENCE_CEILING_MS) {
-      const msg = `⚠️  Activity hard ceiling${tag}: no output for ${Math.round(silenceDuration / 60000)}min — killing zombie agent`;
-      console.log(msg);
-      log.stream.write(`[SYSTEM] ${msg}\n`);
-      child.emit('formation:done', 1);
-      setTimeout(() => killProcessTree(child), 3000);
-      return;
-    }
-
-    // Check if process is still alive
-    if (isChildAlive() && extensionCount < MAX_EXTENSIONS) {
-      extensionCount++;
-      const msg = `ℹ️  Activity quiet${tag}: no output for ${Math.round(silenceDuration / 60000)}min but process alive — extending (${extensionCount}/${MAX_EXTENSIONS})`;
-      log.stream.write(`[SYSTEM] ${msg}\n`);
-      // Re-arm timer for another period
-      activityTimer = setTimeout(onActivityTimeout, ACTIVITY_TIMEOUT_MS);
-      return;
-    }
-
-    // Process dead or max extensions reached → kill
-    const reason = !isChildAlive() ? 'process dead' : `max extensions (${MAX_EXTENSIONS}) reached`;
-    const msg = `⚠️  Activity timeout${tag}: no output for ${Math.round(silenceDuration / 60000)}min (${reason}) — killing stalled agent`;
-    console.log(msg);
-    log.stream.write(`[SYSTEM] ${msg}\n`);
-    child.emit('formation:done', 1);
-    setTimeout(() => killProcessTree(child), 3000);
-  };
-
-  resetActivityTimer();
-
-  child.stdout.on('data', (data) => {
-    const str = data.toString();
-    resetActivityTimer();
-    if (!silent && pipeRaw && !summaryOnly) process.stdout.write(data);
-    buffer += str;
-
-    const lines = buffer.split('\n');
-    buffer = lines.pop();
-
-    for (const line of lines) {
-      if (!line.trim()) continue;
-      try {
-        const entry = JSON.parse(line);
-        if (entry.type === 'result') resultData = entry;
-
-        // summaryOnly: 收集工具統計
-        if (summaryOnly && entry.type === 'assistant' && entry.message?.content) {
-          for (const block of entry.message.content) {
-            if (block.type === 'tool_use' && block.name) {
-              stats.toolCounts[block.name] = (stats.toolCounts[block.name] || 0) + 1;
-            }
-          }
-        }
-
-        // ── Canary coherence drift detection ──
-        // NOTE: Do NOT call registerSemanticFailure on assistant text blocks.
-        // Agent narration legitimately contains substrings like "rate limit",
-        // "too many requests", "429" when the task is to *implement* throttling
-        // (e.g. TASK_1114 dispatch died here while implementing pulse.rs rate_limit).
-        // Real API termination signals arrive via entry.type === 'result'
-        // (line ~260) and stderr (line ~280) — those paths still detect legitimately.
-        if (entry.type === 'assistant' && entry.message?.content) {
-          for (const block of entry.message.content) {
-            if (block.type !== 'text' || !block.text) continue;
-            const text = block.text;
-            if (!coherenceToken) continue;
-
-            // Agent explicitly reports drift
-            if (text.includes('##CANARY_DRIFT')) {
-              child.emit('formation:drift', 'agent_reported');
-              break;
-            }
-
-            // Check ##CANARY_CHECK lines
-            if (text.includes('##CANARY_CHECK:')) {
-              const checkMatch = text.match(/##CANARY_CHECK:([^:\n]+):([^:\n]+):([^\n]+)/);
-              if (checkMatch) {
-                const [, token, taskId, scope] = checkMatch;
-                if (token.trim() !== coherenceToken) {
-                  child.emit('formation:drift', `token_mismatch:expected=${coherenceToken},got=${token.trim()}`);
-                }
-              } else {
-                // ##CANARY_CHECK present but malformed → drift
-                child.emit('formation:drift', 'malformed_check');
-              }
-            }
-          }
-        }
-
-        const formatted = formatEntry(entry);
-        if (formatted) {
-          if (log.stream.writable) log.stream.write(formatted + '\n');
-          if (!silent && !pipeRaw && !summaryOnly) console.log(formatted);
-          if (onLog) onLog(formatted);
-        }
-
-        // TASK_1816: surface the effective Bifrost reasoning effort in the
-        // dispatch log. relay.js puts reasoning_effort on its system/init
-        // event; logger.js formatSystem only prints model=/cwd=, so without
-        // this line the effort would be invisible in the log — which is the
-        // exact silent-default defect this task fixes.
-        if (entry.type === 'system' && entry.subtype === 'init' && entry.reasoning_effort) {
-          const effLine = `[SYSTEM][BIFROST] model=${entry.model || 'default'} reasoning_effort=${entry.reasoning_effort}`;
-          if (log.stream.writable) log.stream.write(effLine + '\n');
-          if (!silent && !pipeRaw && !summaryOnly) console.log(effLine);
-          if (onLog) onLog(effLine);
-        }
-
-        // Windows fix: claude process 有時不自行 exit
-        // 偵測到 result 就 emit 完成信號 + 延遲 kill 整個進程樹
-        if (entry.type === 'result') {
-          registerSemanticFailure(entry.result);
-          registerRefusal(entry.result); // TASK_1712: detect injection-refusal before emitting done
-          child.emit('formation:done', (semanticFailureReason || refusalReason) ? 1 : 0);
-          setTimeout(() => {
-            killProcessTree(child);
-          }, 5000);
-        }
-      } catch (e) {
-        if (summaryOnly && line.includes('ERROR')) {
-          stats.errors.push(line.slice(0, 100));
-        }
-      }
-    }
-  });
-
-  child.stderr.on('data', (data) => {
-    if (!silent && !summaryOnly) process.stderr.write(data);
-    if (summaryOnly) {
-      const errLine = data.toString().trim();
-      if (errLine) {
-        stats.errors.push(errLine.slice(0, 100));
-        semanticFailureReason = semanticFailureReason || detectSemanticFailure(errLine);
-      }
-    }
-  });
-
-  let closed = false;
-  const cleanup = (code) => {
-    if (closed) return;
-    closed = true;
-    if (activityTimer) clearTimeout(activityTimer);
-
-    if (buffer.trim()) {
-      try {
-        const entry = JSON.parse(buffer);
-        if (entry.type === 'result') resultData = entry;
-        const formatted = formatEntry(entry);
-        if (formatted) {
-          log.stream.write(formatted + '\n');
-          if (onLog) onLog(formatted);
-        }
-      } catch (e) {}
-    }
-
-    semanticFailureReason = semanticFailureReason || detectSemanticFailure(resultData?.result);
-    // TASK_1712: also check for refusal in the final result (in case it wasn't caught mid-stream)
-    registerRefusal(resultData?.result);
-
-    // TASK_1774 (defect 2): a run that ended with zero turns AND zero cost did no
-    // work at all (model failed to initialize, adapter mis-route). The CLI exits 0
-    // in this state — force FAILED instead of a silent no-op SUCCESS.
-    if (!semanticFailureReason && !refusalReason && resultData
-        && (resultData.num_turns || 0) === 0 && (resultData.total_cost_usd || 0) === 0) {
-      semanticFailureReason = 'zero-turn zero-cost run (model init failure)';
-      child._formationExitCode = 1;
-    }
-
-    // Post-dispatch worktree integrity check: verify at least one commit landed on
-    // the task branch. Run BEFORE computing effectiveCode/footer so a confirmed leak
-    // (TASK_1530) salvages the leaked main-repo changes AND flips _formationExitCode,
-    // making the footer + summary report FAILED instead of clean success.
-    // Only checks when the dispatch otherwise looked clean (no semantic failure and
-    // the agent exited 0) — a leak on an already-failed dispatch is moot.
-    if (!semanticFailureReason && (code ?? 0) === 0 && worktreeDir && originalWorktreeHead) {
-      detectWorktreeLeak(worktreeDir, originalWorktreeHead, child);
-    }
-
-    // _formationLeak is set by detectWorktreeLeak when it flips the exit code.
-    const leaked = !!child._formationLeak;
-    const effectiveCode = (semanticFailureReason || refusalReason || leaked) ? 1 : (code ?? 0);
-    child._formationExitCode = effectiveCode;
-
-    try { log.writeFooter(effectiveCode); } catch (e) {}
-
-    // summaryOnly: 輸出結構化摘要
-    // Wrapped in try-catch: console.log can throw EPIPE if parent (Dashboard)
-    // closed stdout pipe. An uncaught throw here kills the EventEmitter chain,
-    // preventing downstream listeners (scheduler's done()) from firing → hang.
-    try {
-    if (summaryOnly) {
-      const duration = ((Date.now() - stats.startTime) / 1000).toFixed(1);
-      // TASK_1712: REFUSED is a distinct status from FAILED — refusal burns cost with zero work
-      const status = effectiveCode === 0 ? 'SUCCESS' : (refusalReason ? 'REFUSED' : 'FAILED');
-      const formation = child._formation?.formation || 'unknown';
-      const skill = child._formation?.skill || 'unknown';
-      const sessionId = child._formation?.sessionId || 'unknown';
-      const cost = resultData?.total_cost_usd?.toFixed(4) || '0.0000';
-      const turns = resultData?.num_turns || 0;
-
-      console.log('═══ Formation Result ═══');
-      console.log(`Formation: ${formation} | Skill: ${skill} | Session: ${sessionId}`);
-      console.log(`Status: ${status} (exit ${effectiveCode})`);
-      console.log(`Duration: ${duration}s | Cost: $${cost} | Turns: ${turns}`);
-      if (semanticFailureReason) {
-        console.log(`Failure: ${semanticFailureReason}`);
-        // TASK_1774: greppable failure marker — parity with [RESULT] REFUSED below
-        console.log(`[RESULT] FAILED: ${semanticFailureReason}`);
-      }
-      if (refusalReason) {
-        console.log(`[RESULT] REFUSED: ${refusalReason}`);
-      }
-      if (child._formationLeak) {
-        const lk = child._formationLeak;
-        console.log(`Failure: worktree leak — ${lk.leakedPaths.length} file(s) leaked to main repo${lk.salvageBranch ? `, salvaged → ${lk.salvageBranch}` : ' (salvage failed)'}`);
-      }
-
-      const toolEntries = Object.entries(stats.toolCounts);
-      if (toolEntries.length > 0) {
-        const toolStr = toolEntries.map(([name, count]) => `${name}×${count}`).join(', ');
-        console.log(`Tools: ${toolStr}`);
-      }
-
-      console.log(`Log: ${log.path}`);
-
-      if (stats.errors.length > 0) {
-        console.log('Errors:');
-        stats.errors.slice(0, 10).forEach(err => {
-          console.log(`  - ${err}`);
-        });
-      }
-
-      console.log('═══════════════════════');
-    } else if (!silent) {
-      const tag = memberId ? ` [${memberId}]` : '';
-      console.log(`\n⚔️  Done${tag} (exit ${code})`);
-      console.log(`   Log: ${log.path}`);
-    }
-    } catch (e) {
-      // EPIPE or other console error — non-fatal, don't block EventEmitter chain
-    }
-    // NOTE: the worktree-leak check now runs ABOVE (before effectiveCode is
-    // computed) so a confirmed leak salvages + blocks the dispatch (TASK_1530).
-  };
-
-  child.on('close', cleanup);
-  child.on('exit', cleanup);
-  child.on('formation:done', cleanup);
-
-  child._resultData = () => resultData;
-}
-
-// ─────────────────────────────────────────
-// 內部：建立 claude 進程
-// ─────────────────────────────────────────
-
-/**
- * TASK_1841: Probe `claude --help` exactly ONCE per process and reuse the result.
- * Previously spawnClaude ran up to two independent execSync probes per dispatch
- * (--project-dir worktree branch + sub-project branch); every extra probe is a
- * fixed per-dispatch cost, and duplicated probes drift (TASK_1839 pattern:
- * "same protocol, three independent implementations").
- *
- * Returns { helpText, cliVersion }. On probe failure helpText is '' — callers
- * must treat unknown capability as UNSUPPORTED and fail/warn loudly, never
- * silently skip a flag the dispatch depends on (that silent-skip is exactly
- * how the dead --project-dir compensation branch masked the MCP gap).
- */
-let _claudeHelpCache = null;
-function probeClaudeHelp(claudeCmd) {
-  if (_claudeHelpCache && _claudeHelpCache.cmd === claudeCmd) return _claudeHelpCache;
-  let helpText = '';
-  let cliVersion = 'unknown version';
-  try {
-    helpText = execSync(`${claudeCmd} --help 2>&1`, { encoding: 'utf8', timeout: 5000, windowsHide: true });
-    // `--help` prints no version; `--version` prints e.g. "2.1.288 (Claude Code)".
-    try {
-      const verText = execSync(`${claudeCmd} --version 2>&1`, { encoding: 'utf8', timeout: 5000, windowsHide: true });
-      const verMatch = verText.match(/(\d+\.\d+\.\d+)/);
-      if (verMatch) cliVersion = verMatch[1];
-    } catch {
-      // version is informational only; capability checks use helpText
-    }
-  } catch {
-    // claude --help failed — helpText stays ''; capability checks below report unsupported.
-    // Do NOT cache the failure: a timeout/spawn error is a transient condition,
-    // not a CLI capability fact — caching it would poison every later dispatch
-    // in this process. Return uncached so the next call re-probes.
-    return { cmd: claudeCmd, helpText, cliVersion };
-  }
-  _claudeHelpCache = { cmd: claudeCmd, helpText, cliVersion };
-  return _claudeHelpCache;
-}
-
-/**
- * 統一的進程啟動器
- * 所有 run* 函數都透過此函數建立進程
- * Bifröst: 當 BIFROST_ADAPTER 環境變數存在時，路由到對應的 relay
- */
-function spawnClaude(opts) {
-  // ── Adapter routing precedence (highest first) ─────────────────────────
-  // 1. Explicit `bifrostAdapter` opt (passed by callers that already
-  //    decided which adapter to use, e.g. dispatch.js with task metadata)
-  // 2. Dashboard dispatch model: when opts.model is set AND it does NOT
-  //    look like a Claude id (claude-*), assume it is a Bifröst model and
-  //    look up which adapter exposes it via .formation/bifrost/<name>/models.json.
-  //    Empty-string ids (the "use adapter default model" sentinel) are
-  //    matched directly via lookupBifrostAdapterForModel which scans
-  //    every manifest for an entry with id="".
-  // 3. BIFROST_ADAPTER env var (legacy session inheritance — kept as
-  //    fallback for callers that have not been migrated to opts.model)
-  // 4. CODEX_THREAD_ID env var (legacy auto-detect — same fallback)
-  // 5. null → native Claude CLI
-  const explicitAdapter = opts.bifrostAdapter?.trim();
-  let adapter = explicitAdapter || null;
-
-  // opts.model can be undefined, null, '', 'bifrost', or a real id.
-  // Treat undefined/null as "no override" (let the adapter decide),
-  // empty string as the "default model for the resolved adapter" sentinel,
-  // and 'bifrost' as the dispatch-family sentinel (NOT a real model name).
-  const rawModel = opts.model == null ? null : String(opts.model);
-  const isBifrostSentinel = rawModel === 'bifrost';
-  const modelStr = isBifrostSentinel ? null : rawModel;
-  const isEmptySentinel = modelStr === '';
-
-  if (!adapter && modelStr != null && !isClaudeFamilyModel(modelStr)) {
-    adapter = lookupBifrostAdapterForModel(modelStr);
-    // TASK_1774 (defect 1): a real non-claude model id whose manifest lookup
-    // missed (e.g. a new Codex id not yet declared in any
-    // .formation/bifrost/*/models.json) must still route through Bifröst —
-    // consult dashboard-models.json dispatchAdapter (project first, then core)
-    // before giving up. Empty-string sentinel is excluded: it is matched only
-    // against explicit id="" manifest entries above.
-    if (!adapter && modelStr !== '') {
-      adapter = readDashboardDispatchAdapter(opts.projectPath);
-    }
-  }
-
-  // 'bifrost' sentinel: resolve adapter from dashboard-models.json dispatchAdapter
-  // (project copy first, then core — TASK_1774)
-  if (!adapter && isBifrostSentinel) {
-    adapter = readDashboardDispatchAdapter(opts.projectPath);
-  }
-
-  if (!adapter) {
-    adapter = process.env.BIFROST_ADAPTER || null;
-  }
-  if (!adapter && process.env.CODEX_THREAD_ID) {
-    adapter = 'openai';
-  }
-
-  // Guard: claude-family models MUST use native Claude CLI, never bifrost.
-  // A stale .bifrost-active signal or BIFROST_ADAPTER env var can set
-  // adapter='claude', but .formation/bifrost/claude/ has no relay.js →
-  // falls back to openai relay → openai can't handle claude models → 0 turns.
-  if (adapter && modelStr && isClaudeFamilyModel(modelStr)) {
-    adapter = null;
-  }
-
-  // TASK_1774 (defect 1): NEVER silently degrade a non-claude model to the
-  // native Claude CLI. The CLI rejects the model after burning a turn yet exits
-  // 0, masking the mis-route as SUCCESS. Fail fast and loud instead.
-  if (!adapter && modelStr && !isClaudeFamilyModel(modelStr)) {
-    const msg = '[runner] ❌ [RESULT] FAILURE — no Bifröst adapter resolves model "' + modelStr + '". '
-      + 'Declare it in .formation/bifrost/<adapter>/models.json or set dispatchAdapter in '
-      + '.kenaz/dashboard-models.json. Refusing silent fallback to native Claude CLI.';
-    console.error(msg);
-    throw new Error('No Bifröst adapter for non-claude model "' + modelStr + '" — refusing silent Claude CLI fallback');
-  }
-
-  // Empty-string sentinel means "use the adapter's default model" — strip
-  // it from opts.model so spawnBifrost / spawnClaude do not pass --model.
-  // 'bifrost' sentinel is a dispatch-family marker, not a real model — also strip.
-  if (isEmptySentinel || isBifrostSentinel) {
-    opts = { ...opts, model: null };
-  }
-
-  if (adapter) {
-    return spawnBifrost(opts, adapter);
-  }
-  const {
-    prompt,
-    formation,
-    skill,
-    sessionId,
-    memberId,
-    silent,
-    outputPath,
-    cleanPrompt: shouldClean = false,
-    allowedTools = [
-      'Bash,Read,Edit,Write,Glob,Grep,ToolSearch',
-      // Code navigation (LSP) + Synapse memory
-      'mcp__kenaz-dashboard__kenaz_lsp_callers',
-      'mcp__kenaz-dashboard__kenaz_lsp_references',
-      'mcp__kenaz-dashboard__kenaz_lsp_definition',
-      'mcp__kenaz-dashboard__kenaz_lsp_symbols',
-      'mcp__kenaz-dashboard__synapse_recall',
-      'mcp__kenaz-dashboard__synapse_status',
-      'mcp__kenaz-dashboard__synapse_sigils',
-      'mcp__kenaz-dashboard__synapse_health',
-      'mcp__kenaz-dashboard__synapse_rune_conflicts',
-      'mcp__kenaz-dashboard__synapse_scan_stale_runes',
-      'mcp__kenaz-dashboard__synapse_inscribe',
-      'mcp__kenaz-dashboard__synapse_forge',
-      'mcp__kenaz-dashboard__synapse_clustering_log',
-      // Hippocampus — episodic memory
-      'mcp__kenaz-dashboard__hippocampus_episode_start',
-      'mcp__kenaz-dashboard__hippocampus_episode_append',
-      'mcp__kenaz-dashboard__hippocampus_episode_close',
-      'mcp__kenaz-dashboard__hippocampus_episode_link',
-      'mcp__kenaz-dashboard__hippocampus_episode_recall',
-    ].join(','),
-    extraArgs = [],
-    pipeRaw = false,
-    summaryOnly = false,
-    onLog,
-    projectPath = null,
-    coherenceToken = null,
-    worktreeDir = null,
-    model = null,
-    rigor = null,
-    // TASK_1929 (Agent Hub M2): extra --mcp-config file(s), appended AFTER
-    // the core .mcp.json push below (claude's --mcp-config is variadic —
-    // `claude --help`: "Load MCP servers from JSON files or strings
-    // (space-separated)", verified on 2.1.259). Empty array (the default)
-    // = zero behavior change for every pre-existing call site.
-    extraMcpConfigs = [],
-  } = opts;
-
-  const log = createLogWriter({ formation, skill, sessionId, outputPath, memberId, projectPath });
-  log.writeHeader();
-
-  if (!silent) {
-    console.log(`   Log: ${log.path}`);
-    if (projectPath) console.log(`   Project: ${projectPath}`);
-    if (worktreeDir) console.log(`   Worktree: ${worktreeDir}`);
-    console.log(`   Launching${memberId ? ` [${memberId}]` : ''}...`);
-  }
-
-  const claudeCmd = detectClaudeCmd();
-  const args = [
-    '-p', '-',
-    '--dangerously-skip-permissions',
-    '--output-format', 'stream-json',
-    '--verbose',
-    '--allowedTools', allowedTools,
-    ...extraArgs
-  ];
-
-  // Model override: when provided, use the specified model instead of the CLI default.
-  if (model) {
-    args.push('--model', model);
-  }
-
-  // worktreeDir takes priority: Squad parallel members each work in their own isolated worktree.
-  // Falls back to projectPath, then ROOT.
-  const cwd = worktreeDir || projectPath || ROOT;
-
-  // Single per-process capability probe — reused by every check below (TASK_1841).
-  const claudeHelp = probeClaudeHelp(claudeCmd);
-
-  // TASK_1841: the kenaz-dashboard MCP server is declared ONLY in the
-  // project-scoped .mcp.json at the core repo root (type=http, port 18080).
-  // Claude Code resolves project-scoped MCP config from cwd, so any dispatch
-  // whose cwd is NOT the core root — cross-project (projectPath = sub-project,
-  // which only carries .kenaz/) — spawns a child with ZERO kenaz-dashboard
-  // tools, while the --allowedTools list above pretends they exist. There is
-  // nothing to "inherit" either: ~/.claude.json has no kenaz-dashboard entry.
-  // Passing --mcp-config with an absolute path makes MCP registration
-  // cwd-independent for both the worktree and cross-project modes.
-  const mcpConfigPath = path.join(ROOT, '.mcp.json');
-  if (!fs.existsSync(mcpConfigPath)) {
-    // Core install incomplete — fail loudly, never silently dispatch an agent
-    // that cannot reach synapse_*/kenaz_* tools (Requirement: no silent skip).
-    const msg = `[runner] ❌ [RESULT] FAILURE — MCP config missing: ${mcpConfigPath}. `
-      + 'The dispatched agent would have no kenaz-dashboard MCP tools. '
-      + 'Restore .mcp.json at the core repo root before dispatching.';
-    console.error(msg);
-    throw new Error(`MCP config missing: ${mcpConfigPath} — refusing to dispatch a tool-less agent`);
-  }
-  if (!claudeHelp.helpText.includes('--mcp-config')) {
-    // Capability probe says the CLI cannot take an explicit MCP config. Fail
-    // loudly instead of degrading: the previous --project-dir compensation was
-    // wrapped in exactly this kind of probe, the probe never matched, and the
-    // branch shipped as permanent dead code (this bug's root cause; see also
-    // TASK_945 / TASK_1402 for prior "assumed the flag exists" incidents).
-    const msg = `[runner] ❌ [RESULT] FAILURE — claude CLI ${claudeHelp.cliVersion} does not advertise --mcp-config; `
-      + 'cannot register kenaz-dashboard MCP for a headless agent whose cwd is outside the core repo. '
-      + 'Upgrade the claude CLI. Refusing silent degraded dispatch.';
-    console.error(msg);
-    throw new Error(`claude CLI lacks --mcp-config — refusing silent degraded dispatch (${claudeHelp.cliVersion})`);
-  }
-  // NOTE: deliberately NOT passing --strict-mcp-config — it would disable every
-  // other MCP server the user configured (behavior change, out of scope).
-  args.push('--mcp-config', mcpConfigPath);
-  // TASK_1929: additional MCP config file(s) — appended to the SAME
-  // --mcp-config flag (claude's --mcp-config is variadic: `<configs...>`),
-  // never a second --mcp-config flag. No-op when extraMcpConfigs is empty
-  // (the default for every dispatch path except agent_hub/launch.rs).
-  if (extraMcpConfigs.length > 0) {
-    args.push(...extraMcpConfigs);
-  }
-
-  // --project-dir controls where Claude Code resolves tool paths (Edit/Write/Read).
-  // CRITICAL: When running in a worktree, --project-dir MUST point to the worktree,
-  // NOT ROOT. Otherwise Claude Code's Edit/Write will write to the main repo,
-  // causing "worktree path leakage" (TASK_945).
-  //
-  // TASK_1841: the former sub-project branch (`else if (cwd !== ROOT ...)` pushing
-  // `--project-dir ROOT`) was removed — `claude --help` has NEVER advertised
-  // --project-dir, so its helpText gate never passed and the push never executed
-  // once. Cross-project config access is now handled by --mcp-config above.
-  // The worktree branch below is kept (belt-and-braces for future CLI versions)
-  // because its failure mode is a loud warn, not a silent skip.
-  let projectDirFlagSupported = false;
-  if (worktreeDir) {
-    // Worktree mode: point --project-dir to the worktree so all file operations
-    // (Edit, Write, Read, Glob, Grep) resolve paths within the worktree.
-    projectDirFlagSupported = claudeHelp.helpText.includes('--project-dir');
-    if (projectDirFlagSupported) {
-      args.push('--project-dir', worktreeDir);
-    } else {
-      // When --project-dir is absent the flag is silently dropped (see TASK_1402).
-      // CLAUDE_PROJECT_DIR env var (set below) is the fallback. Warn so the operator
-      // knows isolation relies solely on the env var and can upgrade if needed.
-      // No released CLI has advertised --project-dir (TASK_1841), so this is the normal path,
-      // not a degraded one: an always-firing WARNING with "upgrade" advice only trained readers to ignore it.
-      console.log(`[runner] worktree isolation via CLAUDE_PROJECT_DIR + cwd (claude CLI ${claudeHelp.cliVersion} has no --project-dir flag)`);
-    }
-  }
-
-  const env = getClaudeEnv();
-
-  // Headless 模式：告知 task-api.js 跳過 inline post-complete
-  // （由 headless.js onDone 統一處理，避免並行 agent 的 git 衝突）
-  env.FORMATION_HEADLESS = '1';
-
-  // TASK_945: Set FORMATION_WORKTREE_PATH so downstream tools (task-api.js, prompt.js,
-  // post-complete.js) can detect worktree mode and resolve paths correctly.
-  if (worktreeDir) {
-    env.FORMATION_WORKTREE_PATH = worktreeDir;
-    // CLAUDE_PROJECT_DIR is the environment-variable counterpart to --project-dir.
-    // It forces Claude Code's Edit/Write/Read path resolver to anchor inside the
-    // worktree instead of walking .git upward to discover the main repo.
-    //
-    // WHY this is required even when --project-dir is also pushed to args:
-    //   claude CLI 2.1.x (current as of 2026-05-02) does NOT support --project-dir.
-    //   runner.js:spawnClaude checks via `claude --help` and silently omits the flag
-    //   when it is absent. Without CLAUDE_PROJECT_DIR, the fall-through behaviour is
-    //   for Claude Code to discover the main repo via .git walk-up from cwd — causing
-    //   all Edit/Write operations to mutate the main repo instead of the worktree.
-    //   This is invisible until a post-dispatch `git worktree list` audit (TASK_1402
-    //   incident: TASK_1400 dispatch wrote ALL files to main, ZERO to task branch).
-    //
-    // Set unconditionally when worktreeDir is set, regardless of --project-dir flag
-    // support. Both mechanisms coexist safely — future CLI versions that support the
-    // flag will still honour the env var as belt-and-braces isolation.
-    env.CLAUDE_PROJECT_DIR = worktreeDir;
-    // Windows MAX_PATH fix: worktree paths add ~40 chars, pushing KuzuDB CMake
-    // object paths past 260 chars. TASK_1879: use the canonical shared verify
-    // target dir (dev/scripts/verify-target-dir.js) — NOT the project root's
-    // target/, which the live tauri dev process locks (onnxruntime.dll,
-    // os error 32). Cargo serializes concurrent access via file locks:
-    // "Blocking waiting for file lock" at ~0% CPU is waiting, not a hang.
-    if (process.platform === 'win32') {
-      env.CARGO_TARGET_DIR = verifyTargetDir();
-    }
-  }
-
-  // 子專案 git 隔離：GIT_CEILING_DIRECTORIES 阻止 git 向上遍歷到 Core 專案
-  // 這是硬性防禦 — 即使 subagent 直接跑 git 命令，也不會影響 KenazAI 的 repo
-  if (projectPath && projectPath !== ROOT) {
-    const parentDir = require('path').dirname(projectPath);
-    env.GIT_CEILING_DIRECTORIES = parentDir;
-  }
-
-  // Windows shell rules:
-  //   .exe → shell:false (avoids cmd.exe popup windows for background agents)
-  //   .cmd → shell:true  (.cmd is a batch script — requires cmd.exe to interpret)
-  // windowsHide:true sets CREATE_NO_WINDOW flag for BOTH shell and non-shell spawn.
-  // Non-Windows: always shell:true for PATH resolution.
-  const useShell = process.platform !== 'win32'
-    || claudeCmd.endsWith('.cmd');
-  const spawnOpts = {
-    cwd,
-    env,
-    stdio: ['pipe', 'pipe', 'pipe'],
-    windowsHide: true,
-    shell: useShell,
-  };
-  // Snapshot the worktree HEAD before launching so the post-dispatch leak detector
-  // can confirm that new commits appeared on the task branch. Captured here (pre-spawn)
-  // to get a clean baseline before the agent makes any changes.
-  let originalWorktreeHead = null;
-  if (worktreeDir) {
-    try {
-      originalWorktreeHead = execSync(
-        `git -C "${worktreeDir}" rev-parse HEAD`,
-        { encoding: 'utf8', timeout: 5000, windowsHide: true }
-      ).trim();
-    } catch { /* git rev-parse failed — leak detection disabled for this dispatch */ }
-  }
-
-  // TASK_1929: opt-in, zero-cost args dump for proving no regression in the
-  // assembled command line — never set by any real dispatch path. Exits
-  // BEFORE spawning claude (no billed API call), so it's safe to run
-  // before/after a change and diff the JSON.
-  if (process.env.KENAZ_DEBUG_SPAWN_ARGS === '1') {
-    console.log(JSON.stringify({ cmd: claudeCmd, args }));
-    process.exit(0);
-  }
-
-  const child = spawn(claudeCmd, args, spawnOpts);
-
-  let finalPrompt = shouldClean
-    ? prompt.replace(/\r?\n/g, ' ').replace(/\s+/g, ' ').trim()
-    : prompt;
-
-  // TASK_945: Inject explicit worktree path instruction into the prompt so the agent
-  // uses the worktree path for ALL file operations (Edit/Write/Read/Glob/Grep).
-  // This is a defense-in-depth complement to --project-dir pointing to the worktree.
-  if (worktreeDir) {
-    const worktreeInstruction = `\n\n[WORKTREE] All file operations (Edit, Write, Read, Glob, Grep) MUST use paths under: ${worktreeDir}\nDo NOT use paths under the main repo. Your working directory is the worktree.\n\n`;
-    finalPrompt = worktreeInstruction + finalPrompt;
-  }
-
-  child.stdin.write(finalPrompt);
-  child.stdin.end();
-
-  collectOutput(child, log, { silent, memberId, pipeRaw, summaryOnly, onLog, coherenceToken, rigor, worktreeDir, originalWorktreeHead });
-
-  child._formation = { logPath: log.path, memberId, log, formation, skill, sessionId, adapter };
-  return child;
-}
-
-// ─────────────────────────────────────────
-// Bifröst: relay to non-Claude adapters
-// ─────────────────────────────────────────
-
-/**
- * Spawn agent via Bifröst relay (e.g. Codex).
- * Same interface as spawnClaude — stdin prompt, stdout stream-json.
- */
-function spawnBifrost(opts, adapter) {
-  const {
-    prompt, formation, skill, sessionId, memberId, silent,
-    outputPath, cleanPrompt: shouldClean = false,
-    summaryOnly = false, onLog, projectPath = null,
-    coherenceToken = null, worktreeDir = null, model = null, rigor = null,
-    // TASK_1929 (Agent Hub M2): relay.js has no equivalent of claude's
-    // variadic --mcp-config — each path is passed as its own
-    // --mcp-config-extra <path> CLI arg and relay.js reads+translates the
-    // file itself (see relay.js buildCodexMcpOverrides). Empty array (the
-    // default) = zero behavior change for every pre-existing bifrost call.
-    extraMcpConfigs = [],
-  } = opts;
-
-  const log = createLogWriter({ formation, skill, sessionId, outputPath, memberId, projectPath });
-  log.writeHeader();
-
-  if (!silent) {
-    console.log(`   [bifrost] Adapter: ${adapter}`);
-    console.log(`   Log: ${log.path}`);
-    if (projectPath) console.log(`   Project: ${projectPath}`);
-    console.log(`   Launching${memberId ? ` [${memberId}]` : ''}...`);
-  }
-
-  let relayScript = path.join(ROOT, '.formation', 'bifrost', adapter, 'relay.js');
-
-  // Guard: if resolved adapter has no relay.js, try dashboard-models.json
-  // dispatchAdapter, then fall back to 'openai' which is the only adapter
-  // with an actual relay implementation.
-  if (!fs.existsSync(relayScript)) {
-    const origAdapter = adapter;
-    let fallback = null;
-    try {
-      const dmPath = path.join(ROOT, '.kenaz', 'dashboard-models.json');
-      if (fs.existsSync(dmPath)) {
-        const dm = JSON.parse(fs.readFileSync(dmPath, 'utf8'));
-        if (dm.dispatchAdapter && dm.dispatchAdapter !== adapter) {
-          fallback = dm.dispatchAdapter;
-        }
-      }
-    } catch { /* ignore */ }
-    adapter = fallback || 'openai';
-    relayScript = path.join(ROOT, '.formation', 'bifrost', adapter, 'relay.js');
-    console.warn(`   [bifrost] ⚠️  No relay at ${origAdapter}/relay.js — falling back to ${adapter}`);
-  }
-
-  const relayArgs = ['--cwd', worktreeDir || projectPath || ROOT];
-  if (model) relayArgs.push('--model', model);
-  // TASK_1929: see the destructured extraMcpConfigs comment above.
-  for (const p of extraMcpConfigs) relayArgs.push('--mcp-config-extra', p);
-
-  const cwd = worktreeDir || projectPath || ROOT;
-  const env = { ...getClaudeEnv(), BIFROST_ADAPTER: adapter };
-  env.FORMATION_HEADLESS = '1';
-  if (worktreeDir) {
-    env.FORMATION_WORKTREE_PATH = worktreeDir;
-    // TASK_1530: anchor the Codex/OpenAI adapter's file writes to the worktree.
-    // Parity with spawnClaude (~659): without CLAUDE_PROJECT_DIR, relay.js
-    // resolveProjectPath() (bifrost/openai/relay.js:91-93) falls back to
-    // `cwd || process.env.CLAUDE_PROJECT_DIR || process.cwd()`. relay.js already
-    // passes --cwd=worktreeDir as the codex spawn cwd, but setting the env var
-    // here is belt-and-braces isolation: any tooling that consults the env var
-    // (and any future relay that drops --cwd) still resolves inside the worktree
-    // instead of walking .git upward to the MAIN repo. The unset env var was the
-    // confirmed leak vector behind the TASK_1530 external-user data-loss incident.
-    env.CLAUDE_PROJECT_DIR = worktreeDir;
-    // Windows MAX_PATH fix: same as Claude native path above (TASK_1879:
-    // canonical shared verify target dir, see dev/scripts/verify-target-dir.js).
-    if (process.platform === 'win32') {
-      env.CARGO_TARGET_DIR = verifyTargetDir();
-    }
-  }
-
-  // TASK_1530: snapshot the worktree HEAD before launching so the post-dispatch
-  // leak detector can confirm new commits landed on the task branch. Mirrors
-  // spawnClaude (~690-701) — without this, detectWorktreeLeak never fired for
-  // Bifrost dispatches (originalWorktreeHead was never captured here).
-  let originalWorktreeHead = null;
-  if (worktreeDir) {
-    try {
-      originalWorktreeHead = execSync(
-        `git -C "${worktreeDir}" rev-parse HEAD`,
-        { encoding: 'utf8', timeout: 5000, windowsHide: true }
-      ).trim();
-    } catch { /* git rev-parse failed — leak detection disabled for this dispatch */ }
-  }
-
-  // TASK_1929: same opt-in args dump as spawnClaude above — exits before
-  // spawning the relay (no codex/API call), safe for a before/after diff.
-  if (process.env.KENAZ_DEBUG_SPAWN_ARGS === '1') {
-    console.log(JSON.stringify({ cmd: 'node', args: [relayScript, ...relayArgs] }));
-    process.exit(0);
-  }
-
-  const child = spawn('node', [relayScript, ...relayArgs], {
-    cwd,
-    env,
-    stdio: ['pipe', 'pipe', 'pipe'],
-    windowsHide: true,
-  });
-
-  let finalPrompt = shouldClean
-    ? prompt.replace(/\r?\n/g, ' ').replace(/\s+/g, ' ').trim()
-    : prompt;
-
-  if (worktreeDir) {
-    finalPrompt = `\n\n[WORKTREE] All file operations MUST use paths under: ${worktreeDir}\n\n` + finalPrompt;
-  }
-
-  child.stdin.write(finalPrompt);
-  child.stdin.end();
-
-  collectOutput(child, log, { silent, memberId, pipeRaw: false, summaryOnly, onLog, coherenceToken, rigor, worktreeDir, originalWorktreeHead });
-
-  child._formation = { logPath: log.path, memberId, log, formation, skill, sessionId, adapter };
-  return child;
-}
-
-// ─────────────────────────────────────────
-// 一般模式 (dispatch 用)
-// ─────────────────────────────────────────
-
-/**
- * 啟動單一 claude subagent（格式化輸出）
- */
-function runSingle(opts) {
-  return spawnClaude(opts);
-}
-
-// ─────────────────────────────────────────
-// Headless 模式 (Unit / Solo / Squad 成員)
-// ─────────────────────────────────────────
-
-/**
- * 無頭模式：壓縮 prompt + 結構化摘要輸出
- */
-function runHeadless(opts) {
-  return spawnClaude({ ...opts, cleanPrompt: true, summaryOnly: true });
-}
-
-// ─────────────────────────────────────────
-// Legion Lead (Agent Teams)
-// ─────────────────────────────────────────
-
-/**
- * Agent Teams 模式：啟用 teammate-mode + Task 工具
- */
-function runLegionLead(opts) {
-  return spawnClaude({
-    ...opts,
-    cleanPrompt: true,
-    pipeRaw: true,
-    allowedTools: [
-      'Bash,Read,Edit,Write,Glob,Grep,Task,ToolSearch',
-      'mcp__kenaz-dashboard__kenaz_lsp_callers',
-      'mcp__kenaz-dashboard__kenaz_lsp_references',
-      'mcp__kenaz-dashboard__kenaz_lsp_definition',
-      'mcp__kenaz-dashboard__kenaz_lsp_symbols',
-      'mcp__kenaz-dashboard__synapse_recall',
-      'mcp__kenaz-dashboard__synapse_status',
-      'mcp__kenaz-dashboard__synapse_sigils',
-      'mcp__kenaz-dashboard__synapse_health',
-      'mcp__kenaz-dashboard__synapse_rune_conflicts',
-      'mcp__kenaz-dashboard__synapse_scan_stale_runes',
-      'mcp__kenaz-dashboard__synapse_inscribe',
-      'mcp__kenaz-dashboard__synapse_forge',
-      'mcp__kenaz-dashboard__synapse_clustering_log',
-      'mcp__kenaz-dashboard__hippocampus_episode_start',
-      'mcp__kenaz-dashboard__hippocampus_episode_append',
-      'mcp__kenaz-dashboard__hippocampus_episode_close',
-      'mcp__kenaz-dashboard__hippocampus_episode_link',
-      'mcp__kenaz-dashboard__hippocampus_episode_recall',
-    ].join(','),
-    extraArgs: ['--teammate-mode', 'in-process']
-  });
-}
-
-// ─────────────────────────────────────────
-// 並行模式 (Squad — dispatch 用)
-// ─────────────────────────────────────────
-
-/**
- * 並行啟動多個 claude subagent
- */
-function runParallel(opts) {
-  const { members, formation, sessionId, projectPath = null } = opts;
-
-  console.log(`\n⚔️  Squad Parallel Launch: ${members.length} members`);
-
-  const children = members.map(m =>
-    runSingle({
-      prompt: m.prompt,
-      formation,
-      skill: m.skill || 'do',
-      sessionId,
-      memberId: m.memberId,
-      silent: true,
-      projectPath
-    })
-  );
-
-  return Promise.all(
-    children.map(child =>
-      new Promise((resolve) => {
-        child.on('close', (code) => {
-          resolve({
-            memberId: child._formation.memberId,
-            exitCode: code,
-            logPath: child._formation.logPath
-          });
-        });
-      })
-    )
-  ).then(results => {
-    console.log(`\n⚔️  Squad Complete: ${results.length}/${members.length} finished`);
-    for (const r of results) {
-      const status = r.exitCode === 0 ? '✅' : '❌';
-      console.log(`   ${status} [${r.memberId}] exit ${r.exitCode} → ${r.logPath}`);
-    }
-    return results;
-  });
-}
-
-// ─────────────────────────────────────────
-// FormationRunner — single-entry facade
-// ─────────────────────────────────────────
-
-/**
- * FormationRunner: unified facade over the Formation dispatch pipeline.
- *
- * Reduces the caller-visible step count for the Legion pain path from ~9
- * boundary crossings to 4-5:
- *   1. Build prompt (caller)
- *   2. FormationRunner.run(mode, opts)   ← single entry
- *   3. Collect/format output             ← handled internally by collectOutput+formatEntry
- *   4. Await child result                (caller)
- *
- * BEHAVIOR-PRESERVING: all internal logic delegates to the same
- * runSingle / runHeadless / runLegionLead / runParallel functions.
- * No parameter semantics, timeout values, worktree handling, or adapter
- * routing are changed.
- *
- * Supported modes:
- *   'single'      → runSingle(opts)
- *   'headless'    → runHeadless(opts)
- *   'legion-lead' → runLegionLead(opts)
- *   'parallel'    → runParallel(opts)   (returns Promise)
- *
- * Callers that previously imported runLegionLead directly continue to work
- * because the original exports remain in module.exports unchanged.
- */
-class FormationRunner {
-  /**
-   * Execute a Formation dispatch in the specified mode.
-   * @param {'single'|'headless'|'legion-lead'|'parallel'} mode
-   * @param {object} opts - same opts accepted by the underlying run* function
-   * @returns {ChildProcess|Promise}
-   */
-  run(mode, opts) {
-    switch (mode) {
-      case 'single':
-        return runSingle(opts);
-      case 'headless':
-        return runHeadless(opts);
-      case 'legion-lead':
-        return runLegionLead(opts);
-      case 'parallel':
-        return runParallel(opts);
-      default:
-        throw new Error(`FormationRunner: unknown mode "${mode}"`);
-    }
-  }
-}
-
-/**
- * Shared singleton — callers can import and use directly without instantiation.
- * @type {FormationRunner}
- */
-const runner = new FormationRunner();
-
-module.exports = { runSingle, runHeadless, runLegionLead, runParallel, killProcessTree, detectWorktreeLeak, FormationRunner, runner };