oh-my-codex 0.11.11 → 0.11.13

package/dist/team/runtime.js

@@ -12,12 +12,12 @@ import { composeRoleInstructionsForRole } from '../agents/native-config.js';
 import { codexPromptsDir } from '../utils/paths.js';
 import { resolveTeamWorkerLaunchArgs, TEAM_LOW_COMPLEXITY_DEFAULT_MODEL, parseTeamWorkerLaunchArgs, splitWorkerLaunchArgs, resolveAgentDefaultModel, resolveAgentReasoningEffort, } from './model-contract.js';
 import { resolveCanonicalTeamStateRoot } from './state-root.js';
-import { isBridgeEnabled, getDefaultBridge } from '../runtime/bridge.js';
 import { inferPhaseTargetFromTaskCounts, reconcilePhaseStateForMonitor } from './phase-controller.js';
 import { getTeamTmuxSessions } from '../notifications/tmux.js';
 import { hasStructuredVerificationEvidence } from '../verification/verifier.js';
 import { buildRebalanceDecisions } from './rebalance-policy.js';
 import { readModeState, updateModeState } from '../modes/base.js';
+import { appendTeamCommitHygieneEntries, buildTeamCommitHygieneContext, writeTeamCommitHygieneContext, } from './commit-hygiene.js';
 import { assertCleanLeaderWorkspaceForWorkerWorktrees, ensureWorktree, isGitRepository, planWorktreeTarget, rollbackProvisionedWorktrees, } from './worktree.js';
 async function syncRootTeamModeStateOnTerminalPhase(teamName, phase, cwd) {
     if (phase !== 'complete' && phase !== 'failed' && phase !== 'cancelled')
@@ -82,6 +82,7 @@ function runCommand(command, args, cwd) {
     const result = spawnSync(command, args, {
         cwd,
         encoding: 'utf-8',
+        windowsHide: true,
     });
     return {
         ok: result.status === 0,
@@ -173,11 +174,22 @@ function appendIntegrationReport(teamName, entry, cwd) {
     const line = `- [${timestamp}] ${entry.workerName}: ${entry.operation} conflict auto-resolved (${entry.strategy}) on files: ${entry.files.join(', ') || 'unknown'}. ${entry.detail}\n`;
     appendFileSync(reportPath, existsSync(reportPath) ? line : `# Integration Report\n\n${line}`);
 }
+function resolveWorkerMergeRef(branchResult, workerHead) {
+    const branchRef = branchResult.ok ? branchResult.stdout.trim() : '';
+    if (!branchRef || branchRef === 'HEAD')
+        return workerHead;
+    return branchRef;
+}
+function leaderContainsCommit(repoRoot, cwd, commit) {
+    return runGitCommand(repoRoot, ['merge-base', '--is-ancestor', commit, 'HEAD'], cwd).ok;
+}
 async function integrateWorkerCommitsIntoLeader(params) {
     const { teamName, config, previous, cwd } = params;
     const next = { ...(previous?.integrationByWorker ?? {}) };
     const leaderHeadAtCycleStart = resolveLeaderHead(resolve(config.workers[0]?.worktree_repo_root ?? cwd), cwd);
     const integratedWorkerNames = new Set();
+    const commitHygieneEntries = [];
+    const artifactCwd = config.leader_cwd ?? cwd;
     // ── Phase A: Auto-commit dirty worktrees ──
     for (const worker of config.workers) {
         if (!worker.worktree_repo_root || !worker.worktree_path || !existsSync(worker.worktree_path))
@@ -190,6 +202,16 @@ async function integrateWorkerCommitsIntoLeader(params) {
                 worktree_path: resolve(worker.worktree_path),
                 summary: `auto-committed dirty worktree for ${worker.name}`,
             }, cwd);
+            commitHygieneEntries.push({
+                recorded_at: new Date().toISOString(),
+                operation: 'auto_checkpoint',
+                worker_name: worker.name,
+                task_id: worker.assigned_tasks[0],
+                status: 'applied',
+                operational_commit: commitHash,
+                worktree_path: resolve(worker.worktree_path),
+                detail: 'Dirty worker worktree checkpointed before runtime integration.',
+            });
         }
     }
     // ── Phase B: Integrate worker commits to leader (hybrid strategy) ──
@@ -220,26 +242,69 @@ async function integrateWorkerCommitsIntoLeader(params) {
         if (workerIsAheadOfLeader) {
             // Worker is cleanly ahead → merge --no-ff -X theirs
             const workerBranch = runGitCommand(repoRoot, ['rev-parse', '--abbrev-ref', 'HEAD'], worktreePath);
-            const branchRef = workerBranch.ok && workerBranch.stdout ? workerBranch.stdout : workerHead;
+            const branchRef = resolveWorkerMergeRef(workerBranch, workerHead);
             const merge = runGitCommand(repoRoot, ['merge', '--no-ff', '-X', 'theirs', '-m', `omx(team): merge ${worker.name}`, branchRef], cwd);
             if (merge.ok) {
                 const newLeaderHead = resolveLeaderHead(repoRoot, cwd) ?? leaderHead;
-                state.last_integrated_head = workerHead;
-                state.last_leader_head = newLeaderHead;
-                state.status = 'integrated';
-                state.conflict_commit = undefined;
-                state.conflict_files = undefined;
-                state.updated_at = new Date().toISOString();
-                integratedWorkerNames.add(worker.name);
-                await appendIntegrationEvent(teamName, 'worker_merge_applied', worker, {
-                    worker_name: worker.name,
-                    worker_head: workerHead,
-                    leader_head_before: leaderHead,
-                    leader_head_after: newLeaderHead,
-                    worktree_path: worktreePath,
-                    summary: `merged ${worker.name} into leader via --no-ff -X theirs`,
-                }, cwd);
-                await sendIntegrationMessageToLeader(teamName, worker, `INTEGRATED: merged ${worker.name} (${workerHead.slice(0, 12)}) into leader HEAD ${newLeaderHead.slice(0, 12)} via merge --no-ff.`, cwd);
+                const workerIntegrated = leaderContainsCommit(repoRoot, cwd, workerHead);
+                const leaderAdvanced = newLeaderHead !== leaderHead;
+                if (workerIntegrated && leaderAdvanced) {
+                    state.last_integrated_head = workerHead;
+                    state.last_leader_head = newLeaderHead;
+                    state.status = 'integrated';
+                    state.conflict_commit = undefined;
+                    state.conflict_files = undefined;
+                    state.updated_at = new Date().toISOString();
+                    integratedWorkerNames.add(worker.name);
+                    await appendIntegrationEvent(teamName, 'worker_merge_applied', worker, {
+                        worker_name: worker.name,
+                        worker_head: workerHead,
+                        leader_head_before: leaderHead,
+                        leader_head_after: newLeaderHead,
+                        worktree_path: worktreePath,
+                        summary: `merged ${worker.name} into leader via --no-ff -X theirs`,
+                    }, cwd);
+                    await sendIntegrationMessageToLeader(teamName, worker, `INTEGRATED: merged ${worker.name} (${workerHead.slice(0, 12)}) into leader HEAD ${newLeaderHead.slice(0, 12)} via merge --no-ff.`, cwd);
+                    commitHygieneEntries.push({
+                        recorded_at: new Date().toISOString(),
+                        operation: 'integration_merge',
+                        worker_name: worker.name,
+                        task_id: worker.assigned_tasks[0],
+                        status: 'applied',
+                        operational_commit: newLeaderHead,
+                        source_commit: workerHead,
+                        leader_head_before: leaderHead,
+                        leader_head_after: newLeaderHead,
+                        worktree_path: worktreePath,
+                        detail: 'Leader created a runtime merge commit to integrate worker history.',
+                    });
+                }
+                else {
+                    state.last_leader_head = newLeaderHead;
+                    state.status = 'idle';
+                    state.updated_at = new Date().toISOString();
+                    appendIntegrationReport(teamName, {
+                        workerName: worker.name,
+                        operation: 'merge',
+                        strategy: '-X theirs',
+                        files: [],
+                        detail: `merge reported success but leader HEAD did not advance cleanly (leader_before=${leaderHead.slice(0, 12)}, leader_after=${newLeaderHead.slice(0, 12)}, worker_integrated=${workerIntegrated}, merge_ref=${branchRef}).`,
+                    }, cwd);
+                    await sendIntegrationMessageToLeader(teamName, worker, `INTEGRATION NO-OP: merge for ${worker.name} using ${branchRef.slice(0, 12)} reported success but leader HEAD stayed ${newLeaderHead.slice(0, 12)}. Inspect ${worktreePath}.`, cwd);
+                    commitHygieneEntries.push({
+                        recorded_at: new Date().toISOString(),
+                        operation: 'integration_merge',
+                        worker_name: worker.name,
+                        task_id: worker.assigned_tasks[0],
+                        status: 'skipped',
+                        operational_commit: newLeaderHead,
+                        source_commit: workerHead,
+                        leader_head_before: leaderHead,
+                        leader_head_after: newLeaderHead,
+                        worktree_path: worktreePath,
+                        detail: 'Merge command reported success but leader HEAD did not advance or contain the worker commit; runtime refused to report false integration.',
+                    });
+                }
             }
             else {
                 // Merge failed even with -X theirs (e.g. binary conflict) — abort and log
@@ -333,6 +398,19 @@ async function integrateWorkerCommitsIntoLeader(params) {
                     summary: `cherry-picked ${commit.slice(0, 12)} from ${worker.name} with -X theirs`,
                 }, cwd);
                 await sendIntegrationMessageToLeader(teamName, worker, `INTEGRATED: cherry-picked ${commit.slice(0, 12)} from ${worker.name} into leader HEAD ${newLeaderHead.slice(0, 12)} (-X theirs).`, cwd);
+                commitHygieneEntries.push({
+                    recorded_at: new Date().toISOString(),
+                    operation: 'integration_cherry_pick',
+                    worker_name: worker.name,
+                    task_id: worker.assigned_tasks[0],
+                    status: 'applied',
+                    operational_commit: newLeaderHead,
+                    source_commit: commit,
+                    leader_head_before: leaderHead,
+                    leader_head_after: newLeaderHead,
+                    worktree_path: worktreePath,
+                    detail: 'Leader created a runtime cherry-pick commit while integrating diverged worker history.',
+                });
             }
             if (allPicked) {
                 integratedWorkerNames.add(worker.name);
@@ -376,8 +454,10 @@ async function integrateWorkerCommitsIntoLeader(params) {
                 continue;
             }
             // Rebase with -X ours (in rebase context, "ours" = upstream = leader wins)
+            const workerHeadBeforeRebase = resolveWorkerHead(worktreePath);
             const rebase = runGitCommand(repoRoot, ['rebase', '-X', 'ours', newLeaderHead], worktreePath);
             if (rebase.ok) {
+                const workerHeadAfterRebase = resolveWorkerHead(worktreePath);
                 const state = next[worker.name] ?? {};
                 state.last_rebased_leader_head = newLeaderHead;
                 state.status = 'idle';
@@ -391,6 +471,19 @@ async function integrateWorkerCommitsIntoLeader(params) {
                     worktree_path: worktreePath,
                     summary: `cross-rebased ${worker.name} onto ${newLeaderHead.slice(0, 12)} (-X ours)`,
                 }, cwd);
+                commitHygieneEntries.push({
+                    recorded_at: new Date().toISOString(),
+                    operation: 'cross_rebase',
+                    worker_name: worker.name,
+                    task_id: worker.assigned_tasks[0],
+                    status: 'applied',
+                    operational_commit: workerHeadAfterRebase,
+                    leader_head_after: newLeaderHead,
+                    worker_head_before: workerHeadBeforeRebase,
+                    worker_head_after: workerHeadAfterRebase,
+                    worktree_path: worktreePath,
+                    detail: 'Runtime rebase rewrote worker history onto the updated leader head.',
+                });
             }
             else {
                 // Rebase failed — abort to restore worktree, log for retry next cycle
@@ -415,6 +508,9 @@ async function integrateWorkerCommitsIntoLeader(params) {
             }
         }
     }
+    if (commitHygieneEntries.length > 0) {
+        await appendTeamCommitHygieneEntries(teamName, commitHygieneEntries, artifactCwd);
+    }
     return next;
 }
 function renderWorktreeMergeReport(report) {
@@ -427,6 +523,8 @@ function renderWorktreeMergeReport(report) {
         `- synthetic_commit: ${report.syntheticCommit ?? 'none'}`,
         `- merge_outcome: ${report.mergeOutcome}`,
         `- merge_detail: ${report.mergeDetail}`,
+        `- leader_head_before: ${report.leaderHeadBefore ?? 'none'}`,
+        `- leader_head_after: ${report.leaderHeadAfter ?? 'none'}`,
         '',
         '## Summary',
         report.summaryText ?? 'sparkshell summary unavailable; using raw diff fallback.',
@@ -459,6 +557,8 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
                 summaryText: null,
                 mergeOutcome: 'skipped',
                 mergeDetail: addResult.stderr || 'git add -A failed',
+                leaderHeadBefore: resolveLeaderHead(repoRoot, leaderCwd),
+                leaderHeadAfter: resolveLeaderHead(repoRoot, leaderCwd),
             };
         }
         const commitResult = runGitCommand(repoRoot, ['commit', '--no-verify', '-m', `omx(team): checkpoint ${worker.name} shutdown changes`], worktreePath);
@@ -477,6 +577,8 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
                 summaryText: null,
                 mergeOutcome: 'skipped',
                 mergeDetail: commitResult.stderr || 'git commit failed',
+                leaderHeadBefore: resolveLeaderHead(repoRoot, leaderCwd),
+                leaderHeadAfter: resolveLeaderHead(repoRoot, leaderCwd),
             };
         }
     }
@@ -485,8 +587,10 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
     const diffText = getWorktreeDiffText(worktreePath);
     const summaryText = summarizeWorktreeDiffWithSparkShell(worktreePath);
     const reportPath = join(worktreePath, '.omx', 'diff.md');
+    const leaderHeadBefore = resolveLeaderHead(repoRoot, leaderCwd);
     let mergeOutcome = 'skipped';
     let mergeDetail = 'worktree merge skipped';
+    let leaderHeadAfter = leaderHeadBefore;
     if (sourceRef) {
         const alreadyMerged = runGitCommand(repoRoot, ['merge-base', '--is-ancestor', sourceRef, 'HEAD'], leaderCwd);
         if (alreadyMerged.ok) {
@@ -498,11 +602,13 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
             if (mergeResult.ok) {
                 mergeOutcome = 'merged';
                 mergeDetail = mergeResult.stdout || 'merged successfully';
+                leaderHeadAfter = resolveLeaderHead(repoRoot, leaderCwd) ?? leaderHeadBefore;
             }
             else {
                 mergeOutcome = 'conflict';
                 mergeDetail = mergeResult.stderr || mergeResult.stdout || 'merge failed';
                 runGitCommand(repoRoot, ['merge', '--abort'], leaderCwd);
+                leaderHeadAfter = resolveLeaderHead(repoRoot, leaderCwd) ?? leaderHeadBefore;
             }
         }
     }
@@ -516,6 +622,8 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
         summaryText,
         mergeOutcome,
         mergeDetail,
+        leaderHeadBefore,
+        leaderHeadAfter,
     };
     await mkdir(join(worktreePath, '.omx'), { recursive: true });
     await writeFile(reportPath, renderWorktreeMergeReport(report), 'utf-8');
@@ -523,11 +631,14 @@ async function prepareShutdownMergeReport(worker, leaderCwd) {
     return report;
 }
 async function prepareWorkerWorktreeShutdownReports(config, leaderCwd) {
+    const reports = [];
     for (const worker of config.workers) {
         if (!worker.worktree_path || !worker.worktree_repo_root)
             continue;
         try {
-            await prepareShutdownMergeReport(worker, leaderCwd);
+            const report = await prepareShutdownMergeReport(worker, leaderCwd);
+            if (report)
+                reports.push(report);
         }
         catch (error) {
             const worktreePath = resolve(worker.worktree_path);
@@ -546,6 +657,7 @@ async function prepareWorkerWorktreeShutdownReports(config, leaderCwd) {
             process.stdout.write(`${fallback}\n`);
         }
     }
+    return reports;
 }
 function resolveEffectiveTeamWorktreeMode(leaderCwd, requestedMode) {
     if (!isGitRepository(leaderCwd)) {
@@ -692,12 +804,20 @@ function registerPromptWorkerHandle(teamName, workerName, child) {
     }
     const processPid = pid;
     const existingTeamHandles = promptWorkerRegistry.get(teamName) ?? new Map();
-    existingTeamHandles.set(workerName, { child, pid: processPid });
+    existingTeamHandles.set(workerName, {
+        child,
+        pid: processPid,
+        processGroupId: process.platform !== 'win32' ? processPid : null,
+    });
     promptWorkerRegistry.set(teamName, existingTeamHandles);
     child.on('exit', () => {
         const teamHandles = promptWorkerRegistry.get(teamName);
         if (!teamHandles)
             return;
+        const handle = teamHandles.get(workerName);
+        if (handle?.processGroupId && isProcessGroupAlive(handle.processGroupId)) {
+            return;
+        }
         teamHandles.delete(workerName);
         if (teamHandles.size === 0)
             promptWorkerRegistry.delete(teamName);
@@ -728,67 +848,215 @@ function isPidAlive(pid) {
         return false;
     }
 }
-async function waitForPidExit(pid, timeoutMs) {
-    if (!isPidAlive(pid))
+function isProcessGroupAlive(processGroupId) {
+    if (process.platform === 'win32')
+        return false;
+    if (!Number.isFinite(processGroupId) || processGroupId <= 0)
+        return false;
+    try {
+        process.kill(-processGroupId, 0);
+        return true;
+    }
+    catch (err) {
+        if (err.code === 'ESRCH')
+            return false;
+        process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+        return false;
+    }
+}
+function listProcessTreeEntries() {
+    if (process.platform === 'win32')
+        return [];
+    const result = spawnSync('ps', ['axww', '-o', 'pid=,ppid='], {
+        encoding: 'utf-8',
+        windowsHide: true,
+    });
+    if (result.status !== 0 || typeof result.stdout !== 'string')
+        return [];
+    return result.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => {
+        const match = line.match(/^(\d+)\s+(\d+)$/);
+        if (!match)
+            return null;
+        const pid = Number.parseInt(match[1], 10);
+        const ppid = Number.parseInt(match[2], 10);
+        if (!Number.isFinite(pid) || pid <= 0)
+            return null;
+        if (!Number.isFinite(ppid) || ppid < 0)
+            return null;
+        return { pid, ppid };
+    })
+        .filter((entry) => entry !== null);
+}
+function collectProcessTreePids(rootPid) {
+    if (!Number.isFinite(rootPid) || rootPid <= 0)
+        return [];
+    const childrenByPid = new Map();
+    for (const entry of listProcessTreeEntries()) {
+        const siblings = childrenByPid.get(entry.ppid) ?? [];
+        siblings.push(entry.pid);
+        childrenByPid.set(entry.ppid, siblings);
+    }
+    const ordered = [];
+    const stack = [rootPid];
+    const seen = new Set();
+    while (stack.length > 0) {
+        const pid = stack.pop();
+        if (seen.has(pid))
+            continue;
+        seen.add(pid);
+        ordered.push(pid);
+        for (const childPid of childrenByPid.get(pid) ?? []) {
+            if (!seen.has(childPid))
+                stack.push(childPid);
+        }
+    }
+    return ordered.reverse();
+}
+async function waitForTrackedPidsExit(pids, timeoutMs) {
+    const tracked = [...new Set(pids.filter((pid) => Number.isFinite(pid) && pid > 0))];
+    if (tracked.length === 0)
         return true;
     const deadline = Date.now() + Math.max(0, timeoutMs);
     while (Date.now() < deadline) {
+        if (tracked.every((pid) => !isPidAlive(pid)))
+            return true;
         await new Promise((resolve) => setTimeout(resolve, PROMPT_WORKER_EXIT_POLL_MS));
+    }
+    return tracked.every((pid) => !isPidAlive(pid));
+}
+async function terminateTrackedProcessTree(rootPid, processGroupId = null, graceMs = PROMPT_WORKER_SIGTERM_WAIT_MS, killWaitMs = PROMPT_WORKER_SIGKILL_WAIT_MS) {
+    if (processGroupId && process.platform !== 'win32') {
+        const trackedPids = collectProcessTreePids(rootPid);
+        try {
+            process.kill(-processGroupId, 'SIGTERM');
+        }
+        catch (err) {
+            if (err.code !== 'ESRCH') {
+                process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+            }
+        }
+        for (const pid of trackedPids) {
+            if (pid === rootPid)
+                continue;
+            try {
+                process.kill(pid, 'SIGTERM');
+            }
+            catch (err) {
+                if (err.code !== 'ESRCH') {
+                    process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+                }
+            }
+        }
+        const groupDeadline = Date.now() + Math.max(0, graceMs);
+        while (Date.now() < groupDeadline) {
+            const groupAlive = isProcessGroupAlive(processGroupId);
+            const descendantsAlive = trackedPids.some((pid) => isPidAlive(pid));
+            if (!groupAlive && !descendantsAlive) {
+                return { terminated: true, forcedKill: false, trackedPids };
+            }
+            await new Promise((resolve) => setTimeout(resolve, PROMPT_WORKER_EXIT_POLL_MS));
+        }
+        try {
+            process.kill(-processGroupId, 'SIGKILL');
+        }
+        catch (err) {
+            if (err.code !== 'ESRCH') {
+                process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+            }
+        }
+        for (const pid of trackedPids) {
+            if (!isPidAlive(pid))
+                continue;
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch (err) {
+                if (err.code !== 'ESRCH') {
+                    process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+                }
+            }
+        }
+        const killDeadline = Date.now() + Math.max(0, killWaitMs);
+        while (Date.now() < killDeadline) {
+            const groupAlive = isProcessGroupAlive(processGroupId);
+            const descendantsAlive = trackedPids.some((pid) => isPidAlive(pid));
+            if (!groupAlive && !descendantsAlive) {
+                return { terminated: true, forcedKill: true, trackedPids };
+            }
+            await new Promise((resolve) => setTimeout(resolve, PROMPT_WORKER_EXIT_POLL_MS));
+        }
+        return {
+            terminated: !isProcessGroupAlive(processGroupId) && trackedPids.every((pid) => !isPidAlive(pid)),
+            forcedKill: true,
+            trackedPids,
+        };
+    }
+    const trackedPids = collectProcessTreePids(rootPid);
+    if (trackedPids.length === 0) {
+        return {
+            terminated: !isPidAlive(rootPid),
+            forcedKill: false,
+            trackedPids: [],
+        };
+    }
+    for (const pid of trackedPids) {
+        try {
+            process.kill(pid, 'SIGTERM');
+        }
+        catch (err) {
+            if (err.code !== 'ESRCH') {
+                process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+            }
+        }
+    }
+    if (await waitForTrackedPidsExit(trackedPids, graceMs)) {
+        return { terminated: true, forcedKill: false, trackedPids };
+    }
+    for (const pid of trackedPids) {
         if (!isPidAlive(pid))
-            return true;
+            continue;
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch (err) {
+            if (err.code !== 'ESRCH') {
+                process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
+            }
+        }
     }
-    return !isPidAlive(pid);
+    return {
+        terminated: await waitForTrackedPidsExit(trackedPids, killWaitMs),
+        forcedKill: true,
+        trackedPids,
+    };
 }
 async function teardownPromptWorker(teamName, workerName, fallbackPid, cwd, context) {
     const handle = getPromptWorkerHandle(teamName, workerName);
     const handlePid = handle?.pid;
+    const processGroupId = handle?.processGroupId ?? null;
     const pid = (typeof handlePid === 'number' && Number.isFinite(handlePid))
         ? handlePid
         : (Number.isFinite(fallbackPid) && (fallbackPid ?? 0) > 0 ? fallbackPid : null);
-    if (pid === null) {
+    if (pid === null && processGroupId === null) {
         removePromptWorkerHandle(teamName, workerName);
         return { terminated: true, forcedKill: false, pid: null };
     }
-    try {
-        if (handle && handle.child.exitCode === null && !handle.child.killed) {
-            handle.child.kill('SIGTERM');
-        }
-        else {
-            process.kill(pid, 'SIGTERM');
-        }
-    }
-    catch (err) {
-        if (err.code !== 'ESRCH') {
-            process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
-        }
-        // Best effort.
-    }
-    const exitedOnTerm = await waitForPidExit(pid, PROMPT_WORKER_SIGTERM_WAIT_MS);
-    if (exitedOnTerm) {
+    const teardown = await terminateTrackedProcessTree(pid ?? 0, processGroupId);
+    const processGone = processGroupId ? !isProcessGroupAlive(processGroupId) : !isPidAlive(pid);
+    if (teardown.terminated && processGone) {
         removePromptWorkerHandle(teamName, workerName);
-        return { terminated: true, forcedKill: false, pid };
+        return { terminated: true, forcedKill: teardown.forcedKill, pid };
     }
     await appendTeamEvent(teamName, {
         type: 'worker_stopped',
         worker: workerName,
         reason: `prompt_force_kill:${context}:pid=${pid}`,
     }, cwd).catch(() => { });
-    try {
-        if (handle && handle.child.exitCode === null) {
-            handle.child.kill('SIGKILL');
-        }
-        else {
-            process.kill(pid, 'SIGKILL');
-        }
-    }
-    catch (err) {
-        if (err.code !== 'ESRCH') {
-            process.stderr.write(`[team/runtime] operation failed: ${err}\n`);
-        }
-        // Best effort.
-    }
-    const exitedOnKill = await waitForPidExit(pid, PROMPT_WORKER_SIGKILL_WAIT_MS);
-    if (!exitedOnKill) {
+    if (!teardown.terminated) {
         await appendTeamEvent(teamName, {
             type: 'worker_stopped',
             worker: workerName,
@@ -796,18 +1064,22 @@ async function teardownPromptWorker(teamName, workerName, fallbackPid, cwd, cont
         }, cwd).catch(() => { });
         return {
             terminated: false,
-            forcedKill: true,
+            forcedKill: teardown.forcedKill,
             pid,
             error: 'still_alive_after_sigkill',
         };
     }
     removePromptWorkerHandle(teamName, workerName);
-    return { terminated: true, forcedKill: true, pid };
+    return { terminated: true, forcedKill: teardown.forcedKill, pid };
 }
 function isPromptWorkerAlive(config, worker) {
     const handle = getPromptWorkerHandle(config.name, worker.name);
     if (handle?.child.exitCode === null && !handle.child.killed)
         return true;
+    if (handle?.processGroupId && isProcessGroupAlive(handle.processGroupId))
+        return true;
+    if (process.platform !== 'win32' && isProcessGroupAlive(worker.pid))
+        return true;
     return isPidAlive(worker.pid);
 }
 export { TEAM_LOW_COMPLEXITY_DEFAULT_MODEL };
@@ -816,6 +1088,7 @@ function spawnPromptWorker(teamName, workerName, workerIndex, workerCwd, launchA
     const processSpec = buildWorkerProcessLaunchSpec(teamName, workerIndex, launchArgs, workerCwd, workerEnv, workerCli, initialPrompt);
     const child = spawn(processSpec.command, processSpec.args, {
         cwd: workerCwd,
+        detached: process.platform !== 'win32',
         env: { ...process.env, ...processSpec.env },
         stdio: ['pipe', 'ignore', 'ignore'],
     });
@@ -1255,7 +1528,11 @@ export async function startTeam(teamName, task, agentType, workerCount, tasks, c
             }
             // In split-pane topology, we must not kill the entire tmux session; kill only created panes.
             if (sessionName.includes(':')) {
-                for (const paneId of createdWorkerPaneIds) {
+                for (const [index, paneId] of createdWorkerPaneIds.entries()) {
+                    const panePid = getWorkerPanePid(sessionName, index + 1, paneId);
+                    if (panePid) {
+                        await terminateTrackedProcessTree(panePid);
+                    }
                     try {
                         await killWorkerByPaneIdAsync(paneId, createdLeaderPaneId);
                     }
@@ -1669,7 +1946,7 @@ export async function shutdownTeam(teamName, cwd, options = {}) {
         }
         await cleanupTeamState(sanitized, cwd);
         restoreTeamModelInstructionsFile(sanitized);
-        return;
+        return { commitHygieneArtifacts: null };
     }
     const manifest = await readTeamManifestV2(sanitized, cwd);
     const governance = resolveGovernancePolicy(manifest?.governance, manifest?.policy);
@@ -1772,6 +2049,12 @@ export async function shutdownTeam(teamName, cwd, options = {}) {
     const leaderPaneId = config.leader_pane_id;
     const hudPaneId = config.hud_pane_id;
     if (config.worker_launch_mode === 'interactive') {
+        const workerPanePids = config.workers
+            .map((w) => getWorkerPanePid(sessionName, w.index, w.pane_id))
+            .filter((pid) => typeof pid === 'number' && Number.isFinite(pid) && pid > 0);
+        for (const panePid of workerPanePids) {
+            await terminateTrackedProcessTree(panePid);
+        }
         let resizeHookWarning = null;
         if (config.resize_hook_name && config.resize_hook_target) {
             const resizeHookName = config.resize_hook_name;
@@ -1828,7 +2111,50 @@ export async function shutdownTeam(teamName, cwd, options = {}) {
             throw new Error(`shutdown_prompt_teardown_failed:${promptTeardownFailures.join(',')}`);
         }
     }
-    await prepareWorkerWorktreeShutdownReports(config, cwd);
+    const shutdownReports = await prepareWorkerWorktreeShutdownReports(config, cwd);
+    const commitHygieneEntries = [];
+    for (const report of shutdownReports) {
+        const worker = config.workers.find((entry) => entry.name === report.workerName);
+        if (report.syntheticCommit) {
+            commitHygieneEntries.push({
+                recorded_at: new Date().toISOString(),
+                operation: 'shutdown_checkpoint',
+                worker_name: report.workerName,
+                task_id: worker?.assigned_tasks[0],
+                status: 'applied',
+                operational_commit: report.syntheticCommit,
+                source_commit: report.sourceRef,
+                worktree_path: report.worktreePath,
+                report_path: report.reportPath,
+                detail: 'Runtime created a shutdown checkpoint commit to preserve worker worktree changes.',
+            });
+        }
+        if (report.sourceRef && report.mergeOutcome !== 'skipped') {
+            commitHygieneEntries.push({
+                recorded_at: new Date().toISOString(),
+                operation: 'shutdown_merge',
+                worker_name: report.workerName,
+                task_id: worker?.assigned_tasks[0],
+                status: report.mergeOutcome === 'merged' ? 'applied' : report.mergeOutcome,
+                operational_commit: report.mergeOutcome === 'merged' ? report.leaderHeadAfter : null,
+                source_commit: report.sourceRef,
+                leader_head_before: report.leaderHeadBefore,
+                leader_head_after: report.leaderHeadAfter,
+                worktree_path: report.worktreePath,
+                report_path: report.reportPath,
+                detail: report.mergeDetail,
+            });
+        }
+    }
+    const artifactCwd = config.leader_cwd ?? cwd;
+    const ledger = await appendTeamCommitHygieneEntries(sanitized, commitHygieneEntries, artifactCwd);
+    const taskView = await listTasks(sanitized, cwd).catch(() => []);
+    const commitHygieneContext = buildTeamCommitHygieneContext({
+        teamName: sanitized,
+        tasks: taskView,
+        ledger,
+    });
+    const commitHygieneArtifacts = await writeTeamCommitHygieneContext(sanitized, commitHygieneContext, artifactCwd);
     // 5. Remove worker worktree-root instructions and team-scoped fallback instructions.
     for (const worker of config.workers) {
         if (!worker.worktree_path || !worker.team_state_root)
@@ -1869,6 +2195,7 @@ export async function shutdownTeam(teamName, cwd, options = {}) {
     if (cleanupErrors.length > 0) {
         throw new Error(cleanupErrors.join(' | '));
     }
+    return { commitHygieneArtifacts };
 }
 /**
  * Resume monitoring an existing team.
@@ -2090,22 +2417,6 @@ async function markDispatchRequestLeaderPaneMissingDeferred(params) {
 }
 async function dispatchCriticalInboxInstruction(params) {
     const { teamName, config, workerName, workerIndex, paneId, workerCli, inbox, triggerMessage, cwd, dispatchPolicy, inboxCorrelationKey, requireWorkerStartupEvidence, } = params;
-    // --- Rust runtime bridge: dual-write dispatch mutations ---
-    if (isBridgeEnabled()) {
-        try {
-            const bridge = getDefaultBridge(cwd);
-            const bridgeRequestId = `dispatch-${workerName}-${Date.now()}`;
-            bridge.execCommand({
-                command: 'QueueDispatch',
-                request_id: bridgeRequestId,
-                target: workerName,
-                metadata: { kind: 'inbox', inbox_correlation_key: inboxCorrelationKey },
-            });
-        }
-        catch (_bridgeErr) {
-            // Bridge failure is non-fatal — fall through to existing JS logic
-        }
-    }
     if (config.worker_launch_mode === 'prompt') {
         return await queueInboxInstruction({
             teamName,
@@ -2183,12 +2494,6 @@ async function dispatchCriticalInboxInstruction(params) {
     if (receipt?.status === 'failed') {
         const fallback = await notifyWorkerOutcome(config, workerIndex, triggerMessage, paneId);
         if (fallback.ok) {
-            if (isBridgeEnabled()) {
-                try {
-                    getDefaultBridge(cwd).execCommand({ command: 'MarkNotified', request_id: queued.request_id, channel: `fallback_confirmed_after_failed_receipt:${fallback.reason}` });
-                }
-                catch (_) { /* non-fatal */ }
-            }
             await markDispatchRequestNotified(teamName, queued.request_id, { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}`, failed_at: undefined }, cwd).catch(() => null);
             return {
                 ok: true,
@@ -2197,12 +2502,6 @@ async function dispatchCriticalInboxInstruction(params) {
                 request_id: queued.request_id,
             };
         }
-        if (isBridgeEnabled()) {
-            try {
-                getDefaultBridge(cwd).execCommand({ command: 'MarkFailed', request_id: queued.request_id, reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` });
-            }
-            catch (_) { /* non-fatal */ }
-        }
         await transitionDispatchRequest(teamName, queued.request_id, receipt.status, 'failed', { last_reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` }, cwd).catch(() => { });
         return {
             ok: false,
@@ -2219,20 +2518,8 @@ async function dispatchCriticalInboxInstruction(params) {
         ? `${startupFallbackLabel}_fallback_failed:${fallback.reason}`
         : `fallback_attempted_but_unconfirmed:${fallback.reason}`;
     if (fallback.ok) {
-        if (isBridgeEnabled()) {
-            try {
-                getDefaultBridge(cwd).execCommand({ command: 'MarkNotified', request_id: queued.request_id, channel: `fallback_confirmed:${fallback.reason}` });
-            }
-            catch (_) { /* non-fatal */ }
-        }
         const marked = await markDispatchRequestNotified(teamName, queued.request_id, { last_reason: `fallback_confirmed:${fallback.reason}` }, cwd);
         if (!marked) {
-            if (isBridgeEnabled()) {
-                try {
-                    getDefaultBridge(cwd).execCommand({ command: 'MarkFailed', request_id: queued.request_id, reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` });
-                }
-                catch (_) { /* non-fatal */ }
-            }
             await transitionDispatchRequest(teamName, queued.request_id, 'failed', 'failed', { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` }, cwd).catch(() => { });
         }
         return {
@@ -2246,12 +2533,6 @@ async function dispatchCriticalInboxInstruction(params) {
     }
     const current = await readDispatchRequest(teamName, queued.request_id, cwd);
     if (current && current.status !== 'failed') {
-        if (isBridgeEnabled()) {
-            try {
-                getDefaultBridge(cwd).execCommand({ command: 'MarkFailed', request_id: queued.request_id, reason: fallbackFailureReason });
-            }
-            catch (_) { /* non-fatal */ }
-        }
         await transitionDispatchRequest(teamName, queued.request_id, current.status, 'failed', { last_reason: fallbackFailureReason }, cwd).catch(() => { });
     }
     return {
@@ -2383,21 +2664,6 @@ async function deliverPendingMailboxMessages(teamName, config, workers, previous
             continue;
         for (const msg of unnotified) {
             const triggerMessage = generateMailboxTriggerMessage(worker.name, teamName, 1, resolveInstructionStateRoot(workerInfo.worktree_path));
-            // --- Rust runtime bridge: dual-write mailbox dispatch ---
-            if (isBridgeEnabled()) {
-                try {
-                    const bridge = getDefaultBridge(cwd);
-                    bridge.execCommand({
-                        command: 'QueueDispatch',
-                        request_id: `mailbox-${msg.message_id}-${Date.now()}`,
-                        target: worker.name,
-                        metadata: { kind: 'mailbox', message_id: msg.message_id },
-                    });
-                }
-                catch (_bridgeErr) {
-                    // Bridge failure is non-fatal — fall through to existing JS logic
-                }
-            }
             const transportPreference = config.worker_launch_mode === 'prompt'
                 ? 'prompt_stdin'
                 : (dispatchPolicy.dispatch_mode === 'transport_direct' ? 'transport_direct' : 'hook_preferred_with_fallback');
@@ -2431,16 +2697,6 @@ async function deliverPendingMailboxMessages(teamName, config, workers, previous
                 const direct = await notifyWorkerOutcome(config, workerInfo.index, triggerMessage, workerInfo.pane_id);
                 outcome = { ...direct, request_id: queued.request.request_id, message_id: msg.message_id };
                 if (outcome.ok) {
-                    if (isBridgeEnabled()) {
-                        try {
-                            getDefaultBridge(cwd).execCommand({ command: 'MarkNotified', request_id: queued.request.request_id, channel: `direct:${outcome.reason}` });
-                        }
-                        catch (_) { /* non-fatal */ }
-                        try {
-                            getDefaultBridge(cwd).execCommand({ command: 'MarkMailboxNotified', message_id: msg.message_id });
-                        }
-                        catch (_) { /* non-fatal */ }
-                    }
                     await markMessageNotified(teamName, worker.name, msg.message_id, cwd).catch(() => false);
                     await markDispatchRequestNotified(teamName, queued.request.request_id, { message_id: msg.message_id, last_reason: outcome.reason }, cwd).catch(() => null);
                 }
@@ -2464,23 +2720,6 @@ export async function sendWorkerMessage(teamName, fromWorker, toWorker, body, cw
         throw new Error(`Team ${sanitized} not found`);
     const manifest = await readTeamManifestV2(sanitized, cwd);
     const dispatchPolicy = resolveDispatchPolicy(manifest?.policy, config.worker_launch_mode);
-    // --- Rust runtime bridge: dual-write mailbox message creation ---
-    if (isBridgeEnabled()) {
-        try {
-            const bridge = getDefaultBridge(cwd);
-            const bridgeMessageId = `msg-${fromWorker}-${toWorker}-${Date.now()}`;
-            bridge.execCommand({
-                command: 'CreateMailboxMessage',
-                message_id: bridgeMessageId,
-                from_worker: fromWorker,
-                to_worker: toWorker,
-                body,
-            });
-        }
-        catch (_bridgeErr) {
-            // Bridge failure is non-fatal — fall through to existing JS logic
-        }
-    }
     if (toWorker === 'leader-fixed') {
         const leaderTriggerMessage = generateLeaderMailboxTriggerMessage(sanitized, fromWorker);
         const leaderTransportPreference = dispatchPolicy.dispatch_mode === 'transport_direct'
@@ -2538,7 +2777,7 @@ export async function sendWorkerMessage(teamName, fromWorker, toWorker, body, cw
         }
         if (!finalOutcome.ok)
             throw new Error(`mailbox_notify_failed:${finalOutcome.reason}`);
-        return;
+        return finalOutcome;
     }
     const recipient = config.workers.find((w) => w.name === toWorker);
     if (!recipient)
@@ -2583,6 +2822,7 @@ export async function sendWorkerMessage(teamName, fromWorker, toWorker, body, cw
     }
     if (!finalOutcome.ok)
         throw new Error(`mailbox_notify_failed:${finalOutcome.reason}`);
+    return finalOutcome;
 }
 export async function broadcastWorkerMessage(teamName, fromWorker, body, cwd) {
     const sanitized = sanitizeTeamName(teamName);
@@ -2594,25 +2834,6 @@ export async function broadcastWorkerMessage(teamName, fromWorker, body, cwd) {
     const transportPreference = config.worker_launch_mode === 'prompt'
         ? 'prompt_stdin'
         : (dispatchPolicy.dispatch_mode === 'transport_direct' ? 'transport_direct' : 'hook_preferred_with_fallback');
-    // --- Rust runtime bridge: dual-write broadcast mailbox messages ---
-    if (isBridgeEnabled()) {
-        try {
-            const bridge = getDefaultBridge(cwd);
-            for (const w of config.workers) {
-                const bridgeMessageId = `bcast-${fromWorker}-${w.name}-${Date.now()}`;
-                bridge.execCommand({
-                    command: 'CreateMailboxMessage',
-                    message_id: bridgeMessageId,
-                    from_worker: fromWorker,
-                    to_worker: w.name,
-                    body,
-                });
-            }
-        }
-        catch (_bridgeErr) {
-            // Bridge failure is non-fatal — fall through to existing JS logic
-        }
-    }
     const outcomes = await queueBroadcastMailboxMessage({
         teamName: sanitized,
         fromWorker,