oh-my-copilot 4.13.1 → 4.13.21

package/dist/team/runtime-v2.js

@@ -15,10 +15,10 @@
  * Architecture mirrors runtime.ts: startTeam, monitorTeam, shutdownTeam,
  * assignTask, resumeTeam as discrete operations driven by the caller.
  */
-import { join, resolve } from 'path';
 import { tmuxExecAsync } from '../cli/tmux-utils.js';
+import { join, resolve } from 'path';
 import { existsSync } from 'fs';
-import { mkdir, readdir, readFile, writeFile } from 'fs/promises';
+import { mkdir, readdir, readFile, rm, writeFile } from 'fs/promises';
 import { performance } from 'perf_hooks';
 import { TeamPaths, absPath, teamStateRoot } from './state-paths.js';
 import { allocateTasksToWorkers } from './allocation-policy.js';
@@ -28,12 +28,11 @@ import { DEFAULT_TEAM_GOVERNANCE, DEFAULT_TEAM_TRANSPORT_POLICY, getConfigGovern
 import { inferPhase } from './phase-controller.js';
 import { validateTeamName } from './team-name.js';
 import { buildWorkerArgv, getContract, resolveValidatedBinaryPath, getWorkerEnv as getModelWorkerEnv, isPromptModeAgent, getPromptModeArgs, resolveClaudeWorkerModel, } from './model-contract.js';
-import { createTeamSession, spawnWorkerInPane, sendToWorker, waitForPaneReady, paneHasActiveTask, paneLooksReady, applyMainVerticalLayout, } from './tmux-session.js';
+import { createTeamSession, spawnWorkerInPane, sendToWorker, killTeamSession, waitForPaneReady, paneHasActiveTask, paneLooksReady, applyMainVerticalLayout, getWorkerLiveness, } from './tmux-session.js';
 import { composeInitialInbox, ensureWorkerStateDir, writeWorkerOverlay, generateTriggerMessage, generatePromptModeStartupPrompt, } from './worker-bootstrap.js';
 import { queueInboxInstruction } from './mcp-comm.js';
-import { cleanupTeamWorktrees } from './git-worktree.js';
+import { cleanupTeamWorktrees, inspectTeamWorktreeCleanupSafety, ensureWorkerWorktree, installWorktreeRootAgents, normalizeTeamWorktreeMode, } from './git-worktree.js';
 import { formatOmcCliInvocation } from '../utils/omc-cli-rendering.js';
-import { getHostCliType } from '../utils/host-detection.js';
 import { createSwallowedErrorLogger } from '../lib/swallowed-error.js';
 import { CANONICAL_TEAM_ROLES } from '../shared/types.js';
 import { loadConfig } from '../config/loader.js';
@@ -41,16 +40,70 @@ import { buildResolvedRoutingSnapshot, getRoleRoutingSpec } from './stage-router
 import { routeTaskToRole } from './role-router.js';
 import { normalizeDelegationRole } from '../features/delegation-routing/types.js';
 import { cliWorkerOutputFilePath, parseCliWorkerVerdict, renderCliWorkerOutputContract, shouldInjectContract, } from './cli-worker-contract.js';
+import { startMergeOrchestrator, recoverFromRestart, } from './merge-orchestrator.js';
+import { ensureLeaderInbox, extendLeaderBootstrapPrompt, appendToLeaderInbox } from './leader-inbox.js';
+import { execFileSync } from 'node:child_process';
+import { isRuntimeV2Enabled } from './runtime-flags.js';
+import { installCommitCadence, startFallbackPoller, uninstallCommitCadence, } from './worker-commit-cadence.js';
 // ---------------------------------------------------------------------------
-// Feature flag
+// In-process orchestrator registry (per-team handle for the lifetime of the
+// runtime-cli process). Lives at module scope so shutdownTeamV2 can find it.
 // ---------------------------------------------------------------------------
-export function isRuntimeV2Enabled(env = process.env) {
-    const raw = env.OMC_RUNTIME_V2;
-    if (!raw)
-        return true;
-    const normalized = raw.trim().toLowerCase();
-    return !['0', 'false', 'no', 'off'].includes(normalized);
+const orchestratorByTeam = new Map();
+const cadenceByTeam = new Map();
+function registerTeamOrchestrator(teamName, handle) {
+    orchestratorByTeam.set(teamName, handle);
+}
+function getTeamOrchestrator(teamName) {
+    return orchestratorByTeam.get(teamName);
+}
+function unregisterTeamOrchestrator(teamName) {
+    orchestratorByTeam.delete(teamName);
+}
+function registerTeamCadence(teamName, context, poller) {
+    const entry = cadenceByTeam.get(teamName) ?? { pollers: [], contexts: [] };
+    entry.contexts.push(context);
+    if (poller)
+        entry.pollers.push(poller);
+    cadenceByTeam.set(teamName, entry);
+}
+async function stopTeamCadence(teamName) {
+    const entry = cadenceByTeam.get(teamName);
+    if (!entry)
+        return;
+    cadenceByTeam.delete(teamName);
+    for (const poller of entry.pollers) {
+        try {
+            poller.stop();
+        }
+        catch { /* best-effort cleanup */ }
+    }
+    for (const context of entry.contexts) {
+        try {
+            await uninstallCommitCadence(context);
+        }
+        catch { /* best-effort cleanup */ }
+    }
+}
+/**
+ * Resolve the leader's current branch via `git branch --show-current` from cwd.
+ * Throws if not a git repo or HEAD is detached.
+ */
+function resolveLeaderBranch(cwd) {
+    const out = execFileSync('git', ['branch', '--show-current'], {
+        cwd,
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    }).trim();
+    if (!out) {
+        throw new Error('auto-merge requires a non-detached leader branch (git branch --show-current returned empty)');
+    }
+    return out;
 }
+// ---------------------------------------------------------------------------
+// Feature flag
+// ---------------------------------------------------------------------------
+export { isRuntimeV2Enabled } from './runtime-flags.js';
 const MONITOR_SIGNAL_STALE_MS = 30_000;
 // ---------------------------------------------------------------------------
 // Helper: sanitize team name
@@ -125,23 +178,17 @@ function resolvePreflightBinaryPath(agentType) {
 // ---------------------------------------------------------------------------
 // Helper: check worker liveness via tmux pane
 // ---------------------------------------------------------------------------
-async function isWorkerPaneAlive(paneId) {
+async function getWorkerPaneLiveness(paneId) {
     if (!paneId)
-        return false;
-    try {
-        const { isWorkerAlive } = await import('./tmux-session.js');
-        return await isWorkerAlive(paneId);
-    }
-    catch {
-        return false;
-    }
+        return 'dead';
+    return getWorkerLiveness(paneId);
 }
 async function captureWorkerPane(paneId) {
     if (!paneId)
         return '';
     try {
-        const { stdout } = await tmuxExecAsync(['capture-pane', '-t', paneId, '-p', '-S', '-80']);
-        return stdout;
+        const result = await tmuxExecAsync(['capture-pane', '-t', paneId, '-p', '-S', '-80']);
+        return result.stdout ?? '';
     }
     catch {
         return '';
@@ -167,12 +214,18 @@ function findOutstandingWorkerTask(worker, taskById, inProgressByOwner) {
     const owned = inProgressByOwner.get(worker.name) ?? [];
     return owned[0] ?? null;
 }
+function getTaskDependencyIds(task) {
+    return task.depends_on ?? task.blocked_by ?? [];
+}
+function getMissingDependencyIds(task, taskById) {
+    return getTaskDependencyIds(task).filter((dependencyId) => !taskById.has(dependencyId));
+}
 // ---------------------------------------------------------------------------
 // V2 task instruction builder — CLI API lifecycle, NO done.json
 // ---------------------------------------------------------------------------
 /**
  * Build the initial task instruction for v2 workers.
- * Workers use `omcp team api` CLI commands for all lifecycle transitions.
+ * Workers use `omc team api` CLI commands for all lifecycle transitions.
  */
 function buildV2TaskInstruction(teamName, workerName, task, taskId, cliOutputContract) {
     const claimTaskCommand = formatOmcCliInvocation(`team api claim-task --input '${JSON.stringify({ team_name: teamName, task_id: taskId, worker: workerName })}' --json`, {});
@@ -269,7 +322,7 @@ async function spawnV2Worker(opts) {
     const splitResult = await tmuxExecAsync([
         'split-window', splitType, '-t', splitTarget,
         '-d', '-P', '-F', '#{pane_id}',
-        '-c', opts.cwd,
+        '-c', opts.workerCwd ?? opts.cwd,
     ]);
     const paneId = splitResult.stdout.split('\n')[0]?.trim();
     if (!paneId) {
@@ -288,8 +341,9 @@ async function spawnV2Worker(opts) {
         : undefined;
     // Build v2 task instruction (CLI API, NO done.json)
     const instruction = buildV2TaskInstruction(opts.teamName, opts.workerName, opts.task, opts.taskId, cliOutputContract);
-    const inboxTriggerMessage = generateTriggerMessage(opts.teamName, opts.workerName);
-    const promptModeStartupPrompt = generatePromptModeStartupPrompt(opts.teamName, opts.workerName, undefined, cliOutputContract);
+    const instructionStateRoot = opts.worktreePath ? '$OMC_TEAM_STATE_ROOT' : undefined;
+    const inboxTriggerMessage = generateTriggerMessage(opts.teamName, opts.workerName, instructionStateRoot);
+    const promptModeStartupPrompt = generatePromptModeStartupPrompt(opts.teamName, opts.workerName, instructionStateRoot, cliOutputContract);
     if (usePromptMode) {
         await composeInitialInbox(opts.teamName, opts.workerName, instruction, opts.cwd, cliOutputContract);
     }
@@ -298,10 +352,14 @@ async function spawnV2Worker(opts) {
         ...getModelWorkerEnv(opts.teamName, opts.workerName, opts.agentType),
         OMC_TEAM_STATE_ROOT: teamStateRoot(opts.cwd, opts.teamName),
         OMC_TEAM_LEADER_CWD: opts.cwd,
+        ...(opts.worktreePath ? { OMC_TEAM_WORKTREE_PATH: opts.worktreePath } : {}),
+        ...(opts.workerCwd ? { OMC_TEAM_WORKER_CWD: opts.workerCwd } : {}),
     };
     const resolvedBinaryPath = opts.resolvedBinaryPaths[opts.agentType]
         ?? resolveValidatedBinaryPath(opts.agentType);
     // Resolve model from environment variables.
+    // For Claude agents on Bedrock/Vertex, resolve the provider-specific model
+    // so workers don't fall back to invalid Anthropic API model names. (#1695)
     // Snapshot-provided model (from resolved_routing) takes precedence so
     // per-role routing (codex/gemini/claude-tier) is honored at spawn time.
     const modelForAgent = opts.model ?? (() => {
@@ -315,18 +373,35 @@ async function spawnV2Worker(opts) {
                 || process.env.OMC_GEMINI_DEFAULT_MODEL
                 || undefined;
         }
+        // Claude agents: resolve Bedrock/Vertex model when on those providers
         return resolveClaudeWorkerModel();
     })();
     const [launchBinary, ...launchArgs] = buildWorkerArgv(opts.agentType, {
         teamName: opts.teamName,
         workerName: opts.workerName,
-        cwd: opts.cwd,
+        cwd: opts.workerCwd ?? opts.cwd,
         resolvedBinaryPath,
         model: modelForAgent,
     });
-    // For prompt-mode agents (codex, gemini), pass instruction via CLI flag
+    // For prompt-mode agents (currently gemini), keep the full instruction in
+    // inbox.md and pass only a short file-pointer prompt via CLI args. This
+    // avoids echoing reviewer/seed prompt text into tmux scrollback.
     if (usePromptMode) {
-        launchArgs.push(...getPromptModeArgs(opts.agentType, instruction));
+        launchArgs.push(...getPromptModeArgs(opts.agentType, promptModeStartupPrompt));
+    }
+    if (opts.autoMerge && opts.worktreePath) {
+        const cadenceContext = {
+            teamName: opts.teamName,
+            workerName: opts.workerName,
+            worktreePath: opts.worktreePath,
+            agentType: opts.agentType,
+            enabled: true,
+        };
+        const cadence = await installCommitCadence(cadenceContext);
+        const poller = cadence.method === 'fallback-poll'
+            ? startFallbackPoller(opts.worktreePath, opts.workerName)
+            : undefined;
+        registerTeamCadence(opts.teamName, cadenceContext, poller);
     }
     const paneConfig = {
         teamName: opts.teamName,
@@ -334,7 +409,7 @@ async function spawnV2Worker(opts) {
         envVars,
         launchBinary,
         launchArgs,
-        cwd: opts.cwd,
+        cwd: opts.workerCwd ?? opts.cwd,
     };
     await spawnWorkerInPane(opts.sessionName, paneId, paneConfig);
     // Apply layout
@@ -385,7 +460,7 @@ async function spawnV2Worker(opts) {
             startupFailureReason: dispatchOutcome.reason,
         };
     }
-    if (opts.agentType === 'claude' || opts.agentType === 'copilot') {
+    if (opts.agentType === 'claude') {
         const settled = await waitForWorkerStartupEvidence(opts.teamName, opts.workerName, opts.taskId, opts.cwd, 6);
         if (!settled) {
             return {
@@ -411,6 +486,46 @@ async function spawnV2Worker(opts) {
         ...(outputFile ? { outputFile } : {}),
     };
 }
+async function rollbackUnpersistedNativeWorktreeStartup(teamName, cwd, cause) {
+    const safety = inspectTeamWorktreeCleanupSafety(teamName, cwd);
+    if (!safety.hasEvidence)
+        return;
+    const teamRoot = absPath(cwd, TeamPaths.root(teamName));
+    const errorMessage = cause instanceof Error ? cause.message : String(cause);
+    try {
+        const cleanup = cleanupTeamWorktrees(teamName, cwd);
+        if (cleanup.preserved.length === 0) {
+            await rm(teamRoot, { recursive: true, force: true });
+            return;
+        }
+        await mkdir(teamRoot, { recursive: true });
+        await writeFile(join(teamRoot, 'startup-failure.json'), JSON.stringify({
+            reason: 'startup_failed_before_config_persisted',
+            error: errorMessage,
+            preserved: cleanup.preserved,
+            recorded_at: new Date().toISOString(),
+        }, null, 2), 'utf-8');
+    }
+    catch (rollbackError) {
+        await mkdir(teamRoot, { recursive: true });
+        await writeFile(join(teamRoot, 'startup-failure.json'), JSON.stringify({
+            reason: 'startup_failed_before_config_persisted',
+            error: errorMessage,
+            rollback_error: rollbackError instanceof Error ? rollbackError.message : String(rollbackError),
+            recorded_at: new Date().toISOString(),
+        }, null, 2), 'utf-8');
+    }
+}
+async function rollbackStartedNativeWorktreeStartup(args) {
+    try {
+        await killTeamSession(args.sessionName, args.workerPaneIds, args.leaderPaneId ?? undefined, { sessionMode: args.sessionMode });
+    }
+    catch (killError) {
+        process.stderr.write(`[team/runtime-v2] startup rollback tmux cleanup failed: ${killError instanceof Error ? killError.message : String(killError)}
+`);
+    }
+    await rollbackUnpersistedNativeWorktreeStartup(args.teamName, args.cwd, args.cause);
+}
 // ---------------------------------------------------------------------------
 // startTeamV2 — direct tmux creation, CLI API inbox, NO watchdog
 // ---------------------------------------------------------------------------
@@ -430,6 +545,25 @@ export async function startTeamV2(config) {
     // do NOT change routing — user must recreate the team to pick up changes.
     const pluginCfg = config.pluginConfig ?? loadConfig();
     const resolvedRouting = buildResolvedRoutingSnapshot(pluginCfg);
+    let worktreeMode = normalizeTeamWorktreeMode(process.env.OMC_TEAM_WORKTREE_MODE ?? pluginCfg.team?.ops?.worktreeMode);
+    // Auto-merge gate (M5 + M3 hardening). Forces worktreeMode='named' so each
+    // worker has a real branch the orchestrator can merge from.
+    let autoMergeLeaderBranch;
+    if (config.autoMerge) {
+        if (!isRuntimeV2Enabled()) {
+            throw new Error('auto-merge requires OMC_RUNTIME_V2=1 (this feature is v2-only).');
+        }
+        autoMergeLeaderBranch = resolveLeaderBranch(leaderCwd);
+        const stripped = autoMergeLeaderBranch.replace(/^refs\/heads\//i, '').toLowerCase();
+        if (stripped === 'main' || stripped === 'master') {
+            throw new Error('auto-merge refuses main/master leader branch — use a feature branch');
+        }
+        if (worktreeMode !== 'named') {
+            // Force named-branch worktree mode so workers get a real branch.
+            worktreeMode = 'named';
+        }
+    }
+    const workspaceMode = worktreeMode === 'disabled' ? 'single' : 'worktree';
     // Validate CLIs and pin absolute binary paths for user-declared agentTypes.
     // AC-8: missing/untrusted binaries fall back to the snapshot's Claude tuple at
     // spawn time; emit a loud warning naming the binary so operators can fix it.
@@ -507,6 +641,23 @@ export async function startTeamV2(config) {
     }
     // Build allocation inputs for the new role-aware allocator
     const workerNames = Array.from({ length: config.workerCount }, (_, index) => `worker-${index + 1}`);
+    const workerWorktrees = new Map();
+    try {
+        if (worktreeMode !== 'disabled') {
+            for (const workerName of workerNames) {
+                const worktree = ensureWorkerWorktree(sanitized, workerName, leaderCwd, {
+                    mode: worktreeMode,
+                    requireCleanLeader: true,
+                });
+                if (worktree)
+                    workerWorktrees.set(workerName, worktree);
+            }
+        }
+    }
+    catch (error) {
+        await rollbackUnpersistedNativeWorktreeStartup(sanitized, leaderCwd, error);
+        throw error;
+    }
     const workerNameSet = new Set(workerNames);
     // Respect explicit owner fields first, then allocate remaining tasks
     const startupAllocations = [];
@@ -529,7 +680,7 @@ export async function startTeamV2(config) {
         const allocationWorkers = workerNames.map((name, i) => ({
             name,
             role: config.workerRoles?.[i]
-                ?? (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? getHostCliType()),
+                ?? (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? 'claude'),
             currentLoad: 0,
         }));
         for (const r of allocateTasksToWorkers(allocationTasks, allocationWorkers)) {
@@ -537,41 +688,71 @@ export async function startTeamV2(config) {
         }
     }
     // Set up worker state dirs and overlays (with v2 CLI API instructions)
-    for (let i = 0; i < workerNames.length; i++) {
-        const wName = workerNames[i];
-        const agentType = (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? getHostCliType());
-        await ensureWorkerStateDir(sanitized, wName, leaderCwd);
-        await writeWorkerOverlay({
-            teamName: sanitized, workerName: wName, agentType,
-            tasks: config.tasks.map((t, idx) => ({
-                id: String(idx + 1), subject: t.subject, description: t.description,
-            })),
-            cwd: leaderCwd,
-            ...(config.rolePrompt ? { bootstrapInstructions: config.rolePrompt } : {}),
-        });
+    try {
+        for (let i = 0; i < workerNames.length; i++) {
+            const wName = workerNames[i];
+            const agentType = (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? 'claude');
+            await ensureWorkerStateDir(sanitized, wName, leaderCwd);
+            const overlayPath = await writeWorkerOverlay({
+                teamName: sanitized, workerName: wName, agentType,
+                tasks: config.tasks.map((t, idx) => ({
+                    id: String(idx + 1), subject: t.subject, description: t.description,
+                })),
+                cwd: leaderCwd,
+                ...(config.rolePrompt ? { bootstrapInstructions: config.rolePrompt } : {}),
+                ...(workerWorktrees.has(wName) ? { instructionStateRoot: '$OMC_TEAM_STATE_ROOT' } : {}),
+            });
+            const worktree = workerWorktrees.get(wName);
+            if (worktree) {
+                const overlayContent = await readFile(overlayPath, 'utf-8');
+                installWorktreeRootAgents(sanitized, wName, leaderCwd, worktree.path, overlayContent);
+            }
+        }
+    }
+    catch (error) {
+        await rollbackUnpersistedNativeWorktreeStartup(sanitized, leaderCwd, error);
+        throw error;
     }
     // Create tmux session (leader only — workers spawned below)
-    const session = await createTeamSession(sanitized, 0, leaderCwd, {
-        newWindow: Boolean(config.newWindow),
-    });
+    let session;
+    try {
+        session = await createTeamSession(sanitized, 0, leaderCwd, {
+            newWindow: Boolean(config.newWindow),
+        });
+    }
+    catch (error) {
+        await rollbackUnpersistedNativeWorktreeStartup(sanitized, leaderCwd, error);
+        throw error;
+    }
     const sessionName = session.sessionName;
     const leaderPaneId = session.leaderPaneId;
     const ownsWindow = session.sessionMode !== 'split-pane';
     const workerPaneIds = [];
     // Build workers info for config
-    const workersInfo = workerNames.map((wName, i) => ({
-        name: wName,
-        index: i + 1,
-        role: config.workerRoles?.[i]
-            ?? (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? getHostCliType()),
-        assigned_tasks: [],
-        working_dir: leaderCwd,
-    }));
+    const workersInfo = workerNames.map((wName, i) => {
+        const worktree = workerWorktrees.get(wName);
+        return {
+            name: wName,
+            index: i + 1,
+            role: config.workerRoles?.[i]
+                ?? (agentTypes[i % agentTypes.length] ?? agentTypes[0] ?? 'claude'),
+            assigned_tasks: [],
+            working_dir: worktree?.path ?? leaderCwd,
+            team_state_root: teamStateRoot(leaderCwd, sanitized),
+            ...(worktree ? {
+                worktree_repo_root: leaderCwd,
+                worktree_path: worktree.path,
+                worktree_branch: worktree.branch,
+                worktree_detached: worktree.detached,
+                worktree_created: worktree.created,
+            } : {}),
+        };
+    });
     // Write initial v2 config
     const teamConfig = {
         name: sanitized,
         task: config.tasks.map(t => t.subject).join('; '),
-        agent_type: agentTypes[0] || getHostCliType(),
+        agent_type: agentTypes[0] || 'claude',
         worker_launch_mode: 'interactive',
         policy: DEFAULT_TEAM_TRANSPORT_POLICY,
         governance: DEFAULT_TEAM_GOVERNANCE,
@@ -589,9 +770,24 @@ export async function startTeamV2(config) {
         resize_hook_name: null,
         resize_hook_target: null,
         resolved_routing: resolvedRouting,
-        ...(ownsWindow ? { workspace_mode: 'single' } : {}),
+        workspace_mode: workspaceMode,
+        worktree_mode: worktreeMode,
     };
-    await saveTeamConfig(teamConfig, leaderCwd);
+    try {
+        await saveTeamConfig(teamConfig, leaderCwd);
+    }
+    catch (error) {
+        await rollbackStartedNativeWorktreeStartup({
+            teamName: sanitized,
+            cwd: leaderCwd,
+            cause: error,
+            sessionName,
+            leaderPaneId,
+            workerPaneIds,
+            sessionMode: session.sessionMode,
+        });
+        throw error;
+    }
     const permissionsSnapshot = {
         approval_mode: process.env.OMC_APPROVAL_MODE || 'default',
         sandbox_mode: process.env.OMC_SANDBOX_MODE || 'default',
@@ -606,7 +802,7 @@ export async function startTeamV2(config) {
             worker_id: 'leader-fixed',
             role: 'leader',
         },
-        policy: { ...DEFAULT_TEAM_TRANSPORT_POLICY, ...DEFAULT_TEAM_GOVERNANCE },
+        policy: DEFAULT_TEAM_TRANSPORT_POLICY,
         governance: DEFAULT_TEAM_GOVERNANCE,
         permissions_snapshot: permissionsSnapshot,
         tmux_session: sessionName,
@@ -617,13 +813,28 @@ export async function startTeamV2(config) {
         leader_cwd: leaderCwd,
         team_state_root: teamConfig.team_state_root,
         workspace_mode: teamConfig.workspace_mode,
+        worktree_mode: teamConfig.worktree_mode,
         leader_pane_id: leaderPaneId,
         hud_pane_id: null,
         resize_hook_name: null,
         resize_hook_target: null,
         next_worker_index: teamConfig.next_worker_index,
     };
-    await writeFile(absPath(leaderCwd, TeamPaths.manifest(sanitized)), JSON.stringify(teamManifest, null, 2), 'utf-8');
+    try {
+        await writeFile(absPath(leaderCwd, TeamPaths.manifest(sanitized)), JSON.stringify(teamManifest, null, 2), 'utf-8');
+    }
+    catch (error) {
+        await rollbackStartedNativeWorktreeStartup({
+            teamName: sanitized,
+            cwd: leaderCwd,
+            cause: error,
+            sessionName,
+            leaderPaneId,
+            workerPaneIds,
+            sessionMode: session.sessionMode,
+        });
+        throw error;
+    }
     // Spawn workers for initial tasks (at most one startup task per worker)
     const initialStartupAllocations = [];
     const seenStartupWorkers = new Set();
@@ -635,62 +846,146 @@ export async function startTeamV2(config) {
         if (initialStartupAllocations.length >= config.workerCount)
             break;
     }
-    for (const decision of initialStartupAllocations) {
-        const wName = decision.workerName;
-        const workerIndex = Number.parseInt(wName.replace('worker-', ''), 10) - 1;
-        const taskId = String(decision.taskIndex + 1);
-        const task = config.tasks[decision.taskIndex];
-        if (!task || workerIndex < 0)
-            continue;
-        // Route the task through the team's immutable snapshot (Option E).
-        // Falls back to the round-robin agentType when the inferred role is
-        // outside the canonical vocabulary (preserves pre-patch behavior).
-        const fallbackAgent = (agentTypes[workerIndex % agentTypes.length] ?? agentTypes[0] ?? 'claude');
-        const assignment = resolveTaskAssignment(task, resolvedRouting, pluginCfg.team?.roleRouting, resolvedBinaryPaths, fallbackAgent);
-        const workerLaunch = await spawnV2Worker({
-            sessionName,
-            leaderPaneId,
-            existingWorkerPaneIds: workerPaneIds,
-            teamName: sanitized,
-            workerName: wName,
-            workerIndex,
-            agentType: assignment.agentType,
-            task,
-            taskId,
-            cwd: leaderCwd,
-            resolvedBinaryPaths,
-            ...(assignment.model ? { model: assignment.model } : {}),
-            ...(assignment.role ? { role: assignment.role } : {}),
-        });
-        if (workerLaunch.paneId) {
-            workerPaneIds.push(workerLaunch.paneId);
-            const workerInfo = workersInfo[workerIndex];
-            if (workerInfo) {
-                workerInfo.pane_id = workerLaunch.paneId;
-                workerInfo.assigned_tasks = workerLaunch.startupAssigned ? [taskId] : [];
-                workerInfo.worker_cli = (assignment.agentType === 'copilot' ? 'claude' : assignment.agentType);
-                if (workerLaunch.outputFile) {
-                    workerInfo.output_file = workerLaunch.outputFile;
+    try {
+        for (const decision of initialStartupAllocations) {
+            const wName = decision.workerName;
+            const workerIndex = Number.parseInt(wName.replace('worker-', ''), 10) - 1;
+            const taskId = String(decision.taskIndex + 1);
+            const task = config.tasks[decision.taskIndex];
+            if (!task || workerIndex < 0)
+                continue;
+            // Route the task through the team's immutable snapshot (Option E).
+            // Falls back to the round-robin agentType when the inferred role is
+            // outside the canonical vocabulary (preserves pre-patch behavior).
+            const fallbackAgent = (agentTypes[workerIndex % agentTypes.length] ?? agentTypes[0] ?? 'claude');
+            const assignment = resolveTaskAssignment(task, resolvedRouting, pluginCfg.team?.roleRouting, resolvedBinaryPaths, fallbackAgent);
+            const workerLaunch = await spawnV2Worker({
+                sessionName,
+                leaderPaneId,
+                existingWorkerPaneIds: workerPaneIds,
+                teamName: sanitized,
+                workerName: wName,
+                workerIndex,
+                agentType: assignment.agentType,
+                task,
+                taskId,
+                cwd: leaderCwd,
+                workerCwd: workersInfo[workerIndex]?.working_dir ?? leaderCwd,
+                worktreePath: workersInfo[workerIndex]?.worktree_path,
+                autoMerge: Boolean(config.autoMerge),
+                resolvedBinaryPaths,
+                ...(assignment.model ? { model: assignment.model } : {}),
+                ...(assignment.role ? { role: assignment.role } : {}),
+            });
+            if (workerLaunch.paneId) {
+                workerPaneIds.push(workerLaunch.paneId);
+                const workerInfo = workersInfo[workerIndex];
+                if (workerInfo) {
+                    workerInfo.pane_id = workerLaunch.paneId;
+                    workerInfo.assigned_tasks = workerLaunch.startupAssigned ? [taskId] : [];
+                    workerInfo.worker_cli = assignment.agentType;
+                    if (workerLaunch.outputFile) {
+                        workerInfo.output_file = workerLaunch.outputFile;
+                    }
                 }
             }
-        }
-        if (workerLaunch.startupFailureReason) {
-            await appendTeamEvent(sanitized, {
-                type: 'team_leader_nudge',
-                worker: 'leader-fixed',
-                reason: `startup_manual_intervention_required:${wName}:${workerLaunch.startupFailureReason}`,
-            }, leaderCwd);
+            if (workerLaunch.startupFailureReason) {
+                const logEventFailure = createSwallowedErrorLogger('team.runtime-v2.startTeamV2 appendTeamEvent failed');
+                appendTeamEvent(sanitized, {
+                    type: 'team_leader_nudge',
+                    worker: 'leader-fixed',
+                    reason: `startup_manual_intervention_required:${wName}:${workerLaunch.startupFailureReason}`,
+                }, leaderCwd).catch(logEventFailure);
+            }
         }
     }
+    catch (error) {
+        await rollbackStartedNativeWorktreeStartup({
+            teamName: sanitized,
+            cwd: leaderCwd,
+            cause: error,
+            sessionName,
+            leaderPaneId,
+            workerPaneIds,
+            sessionMode: session.sessionMode,
+        });
+        throw error;
+    }
     // Persist config with pane IDs
     teamConfig.workers = workersInfo;
-    await saveTeamConfig(teamConfig, leaderCwd);
+    try {
+        await saveTeamConfig(teamConfig, leaderCwd);
+    }
+    catch (error) {
+        await rollbackStartedNativeWorktreeStartup({
+            teamName: sanitized,
+            cwd: leaderCwd,
+            cause: error,
+            sessionName,
+            leaderPaneId,
+            workerPaneIds,
+            sessionMode: session.sessionMode,
+        });
+        throw error;
+    }
+    const logEventFailure = createSwallowedErrorLogger('team.runtime-v2.startTeamV2 appendTeamEvent failed');
     // Emit start event — NO watchdog, leader drives via monitorTeamV2()
-    await appendTeamEvent(sanitized, {
+    appendTeamEvent(sanitized, {
         type: 'team_leader_nudge',
         worker: 'leader-fixed',
         reason: `start_team_v2: workers=${config.workerCount} tasks=${config.tasks.length} panes=${workerPaneIds.length}`,
-    }, leaderCwd);
+    }, leaderCwd).catch(logEventFailure);
+    // Auto-merge orchestrator startup. Because --auto-merge is an explicit
+    // safety opt-in, startup/registration failures are fatal: continuing would
+    // leave users believing worker edits are being merged when they are not.
+    if (config.autoMerge && autoMergeLeaderBranch) {
+        try {
+            await ensureLeaderInbox(sanitized, leaderCwd);
+            // Seed an introductory leader-inbox note so the leader knows the inbox
+            // exists and where to read it. This mirrors the worker bootstrap pattern.
+            await appendToLeaderInbox(sanitized, extendLeaderBootstrapPrompt(sanitized), leaderCwd);
+            // M6: try to recover from a previous run before starting fresh.
+            try {
+                await recoverFromRestart({
+                    teamName: sanitized,
+                    repoRoot: leaderCwd,
+                    leaderBranch: autoMergeLeaderBranch,
+                    cwd: leaderCwd,
+                });
+            }
+            catch (recErr) {
+                process.stderr.write(`[team/runtime-v2] auto-merge recover-from-restart failed: ${recErr}\n`);
+            }
+            const orchestrator = await startMergeOrchestrator({
+                teamName: sanitized,
+                repoRoot: leaderCwd,
+                leaderBranch: autoMergeLeaderBranch,
+                cwd: leaderCwd,
+            });
+            registerTeamOrchestrator(sanitized, orchestrator);
+            // Register every spawned worker (named worktree mode is enforced above
+            // when autoMerge is on, so worker branches exist). A single failed
+            // registration makes the auto-merge contract unsafe, so fail loudly.
+            for (const w of workersInfo) {
+                await orchestrator.registerWorker(w.name);
+            }
+        }
+        catch (orchErr) {
+            await stopTeamCadence(sanitized);
+            unregisterTeamOrchestrator(sanitized);
+            await rollbackStartedNativeWorktreeStartup({
+                teamName: sanitized,
+                cwd: leaderCwd,
+                cause: orchErr,
+                sessionName,
+                leaderPaneId,
+                workerPaneIds,
+                sessionMode: session.sessionMode,
+            });
+            const reason = orchErr instanceof Error ? orchErr.message : String(orchErr);
+            throw new Error(`auto-merge startup failed: ${reason}`);
+        }
+    }
     return {
         teamName: sanitized,
         sanitizedName: sanitized,
@@ -837,8 +1132,8 @@ export async function processCliWorkerVerdicts(teamName, cwd) {
         const outputFile = worker.output_file;
         if (!outputFile)
             continue;
-        const alive = await isWorkerPaneAlive(worker.pane_id);
-        if (alive)
+        const liveness = await getWorkerPaneLiveness(worker.pane_id);
+        if (liveness !== 'dead')
             continue;
         if (!fsExistsSync(outputFile)) {
             results.push({ workerName: worker.name, taskId: null, status: 'file_missing' });
@@ -1002,16 +1297,17 @@ export async function monitorTeamV2(teamName, cwd) {
     const recommendations = [];
     const workerScanStartMs = performance.now();
     const workerSignals = await Promise.all(config.workers.map(async (worker) => {
-        const alive = await isWorkerPaneAlive(worker.pane_id);
+        const liveness = await getWorkerPaneLiveness(worker.pane_id);
+        const alive = liveness === 'alive';
         const [status, heartbeat, paneCapture] = await Promise.all([
             readWorkerStatus(sanitized, worker.name, cwd),
             readWorkerHeartbeat(sanitized, worker.name, cwd),
             alive ? captureWorkerPane(worker.pane_id) : Promise.resolve(''),
         ]);
-        return { worker, alive, status, heartbeat, paneCapture };
+        return { worker, alive, liveness, status, heartbeat, paneCapture };
     }));
     const workerScanMs = performance.now() - workerScanStartMs;
-    for (const { worker: w, alive, status, heartbeat, paneCapture } of workerSignals) {
+    for (const { worker: w, alive, liveness, status, heartbeat, paneCapture } of workerSignals) {
         const currentTask = status.current_task_id ? taskById.get(status.current_task_id) ?? null : null;
         const outstandingTask = currentTask ?? findOutstandingWorkerTask(w, taskById, inProgressByOwner);
         const expectedTaskId = status.current_task_id ?? outstandingTask?.id ?? w.assigned_tasks[0] ?? '';
@@ -1030,12 +1326,20 @@ export async function monitorTeamV2(teamName, cwd) {
         workers.push({
             name: w.name,
             alive,
+            liveness,
             status,
             heartbeat,
             assignedTasks: w.assigned_tasks,
+            working_dir: w.working_dir,
+            worktree_repo_root: w.worktree_repo_root,
+            worktree_path: w.worktree_path,
+            worktree_branch: w.worktree_branch,
+            worktree_detached: w.worktree_detached,
+            worktree_created: w.worktree_created,
+            team_state_root: w.team_state_root,
             turnsWithoutProgress,
         });
-        if (!alive) {
+        if (liveness === 'dead') {
             deadWorkers.push(w.name);
             const deadWorkerTasks = inProgressByOwner.get(w.name) || [];
             for (const t of deadWorkerTasks) {
@@ -1046,8 +1350,14 @@ export async function monitorTeamV2(teamName, cwd) {
         const statusFresh = isFreshTimestamp(status.updated_at);
         const heartbeatFresh = isFreshTimestamp(heartbeat?.last_turn_at);
         const hasWorkStartEvidence = expectedTaskId !== '' && hasWorkerStatusProgress(status, expectedTaskId);
+        const missingDependencyIds = outstandingTask
+            ? getMissingDependencyIds(outstandingTask, taskById)
+            : [];
         let stallReason = null;
-        if (paneSuggestsIdle && expectedTaskId !== '' && !hasWorkStartEvidence) {
+        if (paneSuggestsIdle && missingDependencyIds.length > 0) {
+            stallReason = 'missing_dependency';
+        }
+        else if (paneSuggestsIdle && expectedTaskId !== '' && !hasWorkStartEvidence) {
             stallReason = 'no_work_start_evidence';
         }
         else if (paneSuggestsIdle && expectedTaskId !== '' && (!statusFresh || !heartbeatFresh)) {
@@ -1058,7 +1368,10 @@ export async function monitorTeamV2(teamName, cwd) {
         }
         if (stallReason) {
             nonReportingWorkers.push(w.name);
-            if (stallReason === 'no_work_start_evidence') {
+            if (stallReason === 'missing_dependency') {
+                recommendations.push(`Investigate ${w.name}: task-${outstandingTask?.id ?? expectedTaskId} is blocked by missing task ids [${missingDependencyIds.join(', ')}]; pane is idle at prompt`);
+            }
+            else if (stallReason === 'no_work_start_evidence') {
                 recommendations.push(`Investigate ${w.name}: assigned work but no work-start evidence; pane is idle at prompt`);
             }
             else if (stallReason === 'stale_or_missing_worker_reports') {
@@ -1079,19 +1392,27 @@ export async function monitorTeamV2(teamName, cwd) {
         failed: allTasks.filter((t) => t.status === 'failed').length,
     };
     const allTasksTerminal = taskCounts.pending === 0 && taskCounts.blocked === 0 && taskCounts.in_progress === 0;
+    for (const task of allTasks) {
+        const missingDependencyIds = getMissingDependencyIds(task, taskById);
+        if (missingDependencyIds.length === 0) {
+            continue;
+        }
+        recommendations.push(`Investigate task-${task.id}: depends on missing task ids [${missingDependencyIds.join(', ')}]`);
+    }
     // Infer phase from task distribution
     const phase = inferPhase(allTasks.map((t) => ({
         status: t.status,
         metadata: undefined,
     })));
     // Emit monitor-derived events (task completions, worker state changes)
-    await emitMonitorDerivedEvents(sanitized, allTasks, workers.map((w) => ({ name: w.name, alive: w.alive, status: w.status })), previousSnapshot, cwd);
+    await emitMonitorDerivedEvents(sanitized, allTasks, workers.map((w) => ({ name: w.name, alive: w.alive, liveness: w.liveness, status: w.status })), previousSnapshot, cwd);
     // Persist snapshot for next cycle
     const updatedAt = new Date().toISOString();
     const totalMs = performance.now() - monitorStartMs;
     await writeMonitorSnapshot(sanitized, {
         taskStatusById: Object.fromEntries(allTasks.map((t) => [t.id, t.status])),
         workerAliveByName: Object.fromEntries(workers.map((w) => [w.name, w.alive])),
+        workerLivenessByName: Object.fromEntries(workers.map((w) => [w.name, w.liveness])),
         workerStateByName: Object.fromEntries(workers.map((w) => [w.name, w.status.state])),
         workerTurnCountByName: Object.fromEntries(workers.map((w) => [w.name, w.heartbeat?.turn_count ?? 0])),
         workerTaskIdByName: Object.fromEntries(workers.map((w) => [w.name, w.status.current_task_id ?? ''])),
@@ -1143,9 +1464,48 @@ export async function shutdownTeamV2(teamName, cwd, options = {}) {
     const timeoutMs = options.timeoutMs ?? 15_000;
     const sanitized = sanitizeTeamName(teamName);
     const config = await readTeamConfig(sanitized, cwd);
+    const finalizeAutoMerge = async () => {
+        const orchestrator = getTeamOrchestrator(sanitized);
+        if (orchestrator) {
+            try {
+                const drainResult = await orchestrator.drainAndStop();
+                if (drainResult.unmerged.length > 0) {
+                    await appendTeamEvent(sanitized, {
+                        type: 'team_leader_nudge',
+                        worker: 'leader-fixed',
+                        reason: `auto_merge_drain_unmerged:${drainResult.unmerged.map((u) => `${u.workerName}:${u.reason}`).join(',')}`,
+                    }, cwd).catch(logEventFailure);
+                }
+                for (const w of config?.workers ?? []) {
+                    try {
+                        await orchestrator.unregisterWorker(w.name);
+                    }
+                    catch (err) {
+                        process.stderr.write(`[team/runtime-v2] orchestrator.unregisterWorker(${w.name}) failed: ${err}\n`);
+                    }
+                }
+            }
+            catch (err) {
+                process.stderr.write(`[team/runtime-v2] orchestrator drainAndStop: ${err}\n`);
+            }
+            finally {
+                await stopTeamCadence(sanitized);
+                unregisterTeamOrchestrator(sanitized);
+            }
+        }
+        else {
+            await stopTeamCadence(sanitized);
+        }
+    };
     if (!config) {
-        // No config available; only clean state. We intentionally avoid guessing
-        // a tmux session name here to prevent accidental self-session termination.
+        // No config means worker liveness cannot be proven. Worktree metadata and
+        // root AGENTS backups live under the scoped state tree, so use non-mutating
+        // inspection and preserve state whenever any worktree recovery evidence exists.
+        const cleanupSafety = inspectTeamWorktreeCleanupSafety(sanitized, cwd);
+        if (cleanupSafety.hasEvidence) {
+            process.stderr.write('[team/runtime-v2] preserving team state because config is missing and worktree cleanup evidence remains\n');
+            return;
+        }
         await cleanupTeamState(sanitized, cwd);
         return;
     }
@@ -1205,7 +1565,10 @@ export async function shutdownTeamV2(teamName, cwd, options = {}) {
             await writeShutdownRequest(sanitized, w.name, 'leader-fixed', cwd);
             shutdownRequestTimes.set(w.name, requestedAt);
             // Write shutdown inbox
-            const shutdownInbox = `# Shutdown Request\n\nAll tasks are complete. Please wrap up and respond with a shutdown acknowledgement.\n\nWrite your ack to: ${TeamPaths.shutdownAck(sanitized, w.name)}\nFormat: {"status":"accept","reason":"ok","updated_at":"<iso>"}\n\nThen exit your session.\n`;
+            const shutdownAckPath = w.worktree_path
+                ? `$OMC_TEAM_STATE_ROOT/workers/${w.name}/shutdown-ack.json`
+                : TeamPaths.shutdownAck(sanitized, w.name);
+            const shutdownInbox = `# Shutdown Request\n\nAll tasks are complete. Please wrap up and respond with a shutdown acknowledgement.\n\nWrite your ack to: ${shutdownAckPath}\nFormat: {"status":"accept","reason":"ok","updated_at":"<iso>"}\n\nThen exit your session.\n`;
             await writeWorkerInbox(sanitized, w.name, shutdownInbox, cwd);
         }
         catch (err) {
@@ -1244,11 +1607,11 @@ export async function shutdownTeamV2(teamName, cwd, options = {}) {
         await new Promise((r) => setTimeout(r, 2_000));
     }
     // 4. Force kill remaining tmux panes
+    const recordedWorkerPaneIds = config.workers
+        .map((w) => w.pane_id)
+        .filter((p) => typeof p === 'string' && p.trim().length > 0);
     try {
-        const { killWorkerPanes, killTeamSession, resolveSplitPaneWorkerPaneIds } = await import('./tmux-session.js');
-        const recordedWorkerPaneIds = config.workers
-            .map((w) => w.pane_id)
-            .filter((p) => typeof p === 'string' && p.trim().length > 0);
+        const { killWorkerPanes, killTeamSession, resolveSplitPaneWorkerPaneIds, getWorkerLiveness } = await import('./tmux-session.js');
         const ownsWindow = config.tmux_window_owned === true;
         const workerPaneIds = ownsWindow
             ? recordedWorkerPaneIds
@@ -1265,9 +1628,36 @@ export async function shutdownTeamV2(teamName, cwd, options = {}) {
                 : 'detached-session';
             await killTeamSession(config.tmux_session, workerPaneIds, config.leader_pane_id ?? undefined, { sessionMode });
         }
+        const paneById = new Map(config.workers
+            .filter((w) => typeof w.pane_id === 'string' && w.pane_id.trim().length > 0)
+            .map((w) => [w.pane_id, w.name]));
+        const liveness = await Promise.all(workerPaneIds.map(async (paneId) => [paneId, await getWorkerLiveness(paneId)]));
+        const aliveWorkers = liveness
+            .filter(([, state]) => state === 'alive')
+            .map(([paneId]) => paneById.get(paneId) ?? paneId);
+        if (aliveWorkers.length > 0) {
+            process.stderr.write(`[team/runtime-v2] preserving worktrees/state because worker pane(s) are still alive: ${aliveWorkers.join(', ')}
+`);
+            await finalizeAutoMerge();
+            return;
+        }
+        const unknownWorkers = liveness
+            .filter(([, state]) => state === 'unknown')
+            .map(([paneId]) => paneById.get(paneId) ?? paneId);
+        if (unknownWorkers.length > 0) {
+            process.stderr.write(`[team/runtime-v2] preserving worktrees/state because worker pane liveness is unknown: ${unknownWorkers.join(', ')}
+`);
+            await finalizeAutoMerge();
+            return;
+        }
     }
     catch (err) {
         process.stderr.write(`[team/runtime-v2] tmux cleanup: ${err}\n`);
+        if (recordedWorkerPaneIds.length > 0) {
+            process.stderr.write('[team/runtime-v2] preserving worktrees/state because tmux cleanup did not prove worker panes exited\n');
+            await finalizeAutoMerge();
+            return;
+        }
     }
     // 5. Ralph completion logging
     if (ralph) {
@@ -1281,14 +1671,28 @@ export async function shutdownTeamV2(teamName, cwd, options = {}) {
             reason: `ralph_cleanup_summary: total=${finalTasks.length} completed=${completed} failed=${failed} pending=${pending} force=${force}`,
         }, cwd).catch(logEventFailure);
     }
-    // 6. Clean up state
+    // 6a. Drain the merge orchestrator (if attached). Final merge sweep before
+    // cleanupTeamWorktrees touches per-worker worktrees. Also used by preserve-state
+    // exits above so auto-merge shutdown is not skipped when pane liveness is unknown.
+    await finalizeAutoMerge();
+    // 6. Clean up state. If worktree cleanup preserved dirty worktrees, keep the
+    // team state directory too; it contains the metadata and root AGENTS.md backups
+    // needed for a later safe cleanup attempt.
+    let preservedWorktrees = 0;
     try {
-        cleanupTeamWorktrees(sanitized, cwd);
+        const worktreeCleanup = cleanupTeamWorktrees(sanitized, cwd);
+        preservedWorktrees = worktreeCleanup.preserved.length;
     }
     catch (err) {
+        preservedWorktrees = 1;
         process.stderr.write(`[team/runtime-v2] worktree cleanup: ${err}\n`);
     }
-    await cleanupTeamState(sanitized, cwd);
+    if (preservedWorktrees === 0) {
+        await cleanupTeamState(sanitized, cwd);
+    }
+    else {
+        process.stderr.write(`[team/runtime-v2] preserved ${preservedWorktrees} worktree(s); keeping team state for follow-up cleanup\n`);
+    }
 }
 // ---------------------------------------------------------------------------
 // resumeTeam — reconstruct runtime from persisted state
@@ -1300,7 +1704,7 @@ export async function resumeTeamV2(teamName, cwd) {
         return null;
     // Verify tmux session is alive
     try {
-        const sessionName = config.tmux_session || `omcp-team-${sanitized}`;
+        const sessionName = config.tmux_session || `omc-team-${sanitized}`;
         await tmuxExecAsync(['has-session', '-t', sessionName.split(':')[0]]);
         return {
             teamName: sanitized,