muse-crew 0.7.3 → 0.7.4

package/API.md

@@ -194,7 +194,7 @@ Record that a poll tick occurred. Takes no arguments. Used by the dispatcher at
 
 Create a dispatch reservation for a task. Called by the dispatcher workflow BEFORE the worker launches the workflow — the reservation is the atomic claim on the task.
 
-**Atomic:** Uses `INSERT ... ON CONFLICT DO NOTHING`. Returns `acquired: true` if this call created the reservation, `acquired: false` if one already exists. The dispatcher only recommends tasks where `acquired` is true — fail closed on contention.
+**Atomic:** Uses `INSERT ... ON CONFLICT DO UPDATE` with a reclaim guard. Returns `acquired: true` if this call created the reservation OR reclaimed an expired one (the existing row is overwritten only when its `expires_at` is past — no separate reaper, no window where a dead row blocks redispatch). Returns `acquired: false` if a live reservation already exists — the competing dispatcher fails closed. Reclaiming is safe: workflows clear their reservation on self-claim, so an expired row always means the launch died before claiming. The dispatcher only recommends tasks where `acquired` is true — fail closed on contention.
 
 | Field | Type | Notes |
 |-------|------|-------|

package/lib/crew-api.js

@@ -582,16 +582,24 @@ commands["reserve-dispatch"] = (db, args) => {
   const ttl = Math.max(60, Math.min(3600, Number(args.ttl_seconds) || 900));
   const dispatchedAt = now();
   const expiresAt = new Date(Date.now() + ttl * 1000).toISOString();
-  // ATOMIC: INSERT with ON CONFLICT DO NOTHING. If a reservation already
-  // exists (even expired — cleanup is separate), we do NOT overwrite it.
-  // The caller must check `acquired` and fail closed if false.
-  // This prevents the last-write-wins race where two dispatchers both
-  // think they own the task.
+  // ATOMIC RECLAIM (2026-09-13): an expired reservation row is reclaimed by
+  // overwriting it inside the same UPSERT — no separate reaper, no window
+  // where a dead row blocks redispatch. A LIVE reservation still wins the
+  // race: the WHERE clause rejects the overwrite and `acquired` stays false,
+  // so the caller fails closed exactly as before.
+  // Safe to reclaim: workflows clear their reservation on self-claim, so an
+  // expired row always means the launch died before claiming — reclaiming it
+  // can never duplicate a running workflow.
   const info = db.prepare(
     `INSERT INTO dispatch_reservations (task_id, run_id, workflow, dispatched_at, expires_at)
      VALUES (?, ?, ?, ?, ?)
-     ON CONFLICT(task_id) DO NOTHING`
-  ).run(args.task_id, args.run_id, args.workflow, dispatchedAt, expiresAt);
+     ON CONFLICT(task_id) DO UPDATE SET
+       run_id = excluded.run_id,
+       workflow = excluded.workflow,
+       dispatched_at = excluded.dispatched_at,
+       expires_at = excluded.expires_at
+     WHERE dispatch_reservations.expires_at <= ?`
+  ).run(args.task_id, args.run_id, args.workflow, dispatchedAt, expiresAt, now());
   const acquired = info.changes > 0;
   return {
     ok: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Opinionated orchestration for Muse — workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -141,6 +141,54 @@ function parseBoardJson(boardReturn) {
   );
 }
 
+// Deterministic JSON extraction (2026-09-13): an agent ferrying CLI stdout
+// sometimes wraps it in framing text ("Here is the output:\n{...}") instead
+// of returning it verbatim. A bare JSON.parse then throws and the dispatcher
+// drops a reservation it actually acquired — a lost tick, and (before the
+// atomic reclaim above) a stale row that blocked redispatch permanently.
+// This extractor is mechanical, not interpretive: verbatim parse first,
+// then scan for the first balanced {...} candidate that parses. Throws only
+// when no parseable object exists — the caller fails closed.
+function extractJsonObject(raw) {
+  if (raw !== null && typeof raw === "object") return raw;
+  if (typeof raw !== "string") {
+    throw new Error("extractJsonObject: expected a string or object, got " +
+      (raw === null ? "null" : typeof raw));
+  }
+  try { return JSON.parse(raw.trim()); } catch (e) { /* fall through to scan */ }
+  var start = raw.indexOf("{");
+  while (start !== -1) {
+    var end = matchJsonBrace(raw, start);
+    if (end !== -1) {
+      try { return JSON.parse(raw.slice(start, end + 1)); } catch (e2) { /* keep scanning */ }
+    }
+    start = raw.indexOf("{", start + 1);
+  }
+  throw new Error("extractJsonObject: no parseable JSON object found in agent output");
+}
+
+// Balanced-brace scan honoring string literals and escapes. Returns the
+// index of the brace matching the open brace at `start`, or -1.
+function matchJsonBrace(s, start) {
+  var depth = 0, inStr = false, esc = false;
+  for (var i = start; i < s.length; i++) {
+    var ch = s[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === "\\") esc = true;
+      else if (ch === "\"") inStr = false;
+    } else if (ch === "\"") {
+      inStr = true;
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) return i;
+    }
+  }
+  return -1;
+}
+
 // Deterministic board projection — the ONLY place task records are shaped.
 // Pure function, no I/O: covered by tests/board-projection.test.js. The
 // retry field is dashboard-owned state (consecutive failures / rejections
@@ -829,7 +877,7 @@ if (recommended.length > 0) {
         "Create a dispatch reservation.\nRun in shell and return the stdout verbatim:\n" + reserveCmd,
         { key: "reserve-" + rec.task_id.slice(0, 8), label: "Reserving dispatch for " + rec.task_id.slice(0, 8) }
       );
-      var reserveParsed = typeof reserveOut === "string" ? JSON.parse(reserveOut) : reserveOut;
+      var reserveParsed = extractJsonObject(reserveOut);
       if (reserveParsed && reserveParsed.acquired) {
         log("Reserved task " + rec.task_id.slice(0, 8));
         acquired.push(rec);
@@ -838,8 +886,10 @@ if (recommended.length > 0) {
         log("SKIPPED task " + rec.task_id.slice(0, 8) + " — reservation not acquired (another dispatcher owns it)");
       }
     } catch (e) {
-      // FAIL CLOSED: If we cannot reserve, we cannot safely recommend.
-      // The task stays eligible for the next poll.
+      // FAIL CLOSED: If we cannot reserve — or cannot deterministically read
+      // the reservation result — we cannot safely recommend. The task stays
+      // eligible; a row created before the parse failure expires via TTL and
+      // is reclaimable by the next tick (atomic reclaim in reserve-dispatch).
       log("SKIPPED task " + rec.task_id.slice(0, 8) + " — reservation failed: " + e.message);
     }
   }