pi-durable-subagents 1.0.13 → 1.0.15

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 1.0.15
+
+- The changes listed under 1.0.14, which was tagged but never published:
+  its macOS CI failed because two test files compared worktree roots (real
+  paths) with temporary paths under the `/var` symlink. Only those tests
+  changed.
+
+## 1.0.14
+
+- The running orchestrator's version is visible. `status` shows it
+  (`orchestrator: 1.0.14 (pid …)`), and when it is not the version a pi
+  session loaded (after an update, running work stays on the old one), that
+  pi says so once and `status` adds a note: the orchestrator switches by
+  itself about 10 s after all work ends. To switch sooner without stopping
+  running calls: `drain`, wait until `status` no longer shows the old
+  version, then `resume` from a pi session started after the update.
+- Two subagents editing the same worktree are pointed out. When two calls
+  that have not finished both used `edit` or `write` under the same git
+  worktree, the main session that started them gets one reminder per pair,
+  and `status` names the other call in `sharedWorktree`. A paused call that
+  wrote still counts until it ends. Nothing is blocked; the reminder closes
+  when either call ends. Writes made only through `bash`
+  are not seen; calls with `isolation: "worktree"` have their own worktree.
+
 ## 1.0.13
 
 - A subagent resumed after its execution was interrupted (the orchestrator

package/README.md

@@ -56,6 +56,7 @@ the npx cache, so `install-service` refuses to run from there.
 | Two steers arrive out of order and the second replaces the first | Only the second one applies. |
 | A step is refused, or a dependency fails | The workflow stops that branch cleanly. Nothing is retried in vain. |
 | A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | A call in a pool continues **in the same session** on the pool's next model; new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
+| Two subagents edit the same worktree | A reminder names both calls; neither is blocked or locked. Only observed `edit`/`write` calls count (bash-only writes are not seen). Calls with `isolation: "worktree"` have their own worktrees. |
 | A subagent waits for an answer for a long time | It releases its model slot and memory, then resumes exactly once when you answer. |
 
 ## Use it
@@ -176,6 +177,7 @@ The main agent is interrupted only when there is something to decide:
 - a finished workflow;
 - a stalled subagent (the alert names the command it is running and for how long, so a long silent command reads differently from a stuck call);
 - an unknown outcome;
+- two unfinished calls observed editing the same worktree (a reminder, never a block);
 - a reached budget.
 
 Each one arrives once. A reminder that was already resolved is shown as
@@ -320,6 +322,26 @@ On load, it checks the pi exports and API methods it uses.
 
 `smoke` runs the same checks inside your pi.
 
+## Updating Durable Subagents
+
+Running work stays on the version it started with: the orchestrator is not
+restarted under it. When the orchestrator runs another version than the one a
+pi session loaded, that pi says so once, and `status` shows the running
+version with a note. The orchestrator exits about 10 s after all work ends,
+and the next start runs the new version. To switch sooner without stopping
+running calls:
+
+1. `drain`: running calls finish and nothing new starts in existing
+   workflows. A call waiting for your answer still counts as running, and a
+   workflow started after the drain is not held.
+2. Wait until `status` no longer shows the old version (about 10 s after the
+   last call ends).
+3. `resume` from a pi session started after the update.
+
+A `resume` before the old orchestrator exits keeps it running the old
+version, and a pi session started before the update still starts the old
+version; start a new one.
+
 ## What we do not promise
 
 - Call specs are checked strictly when a call is first proposed: an unknown or

package/dist/agent/main.js

@@ -12,7 +12,7 @@ import { OsLock } from "../platform/lock.js";
 import { dsaHome, orchInbox, orchLedger, orchLock, outboxRoot } from "../paths.js";
 import { CT, JT } from "../types.js";
 import { attention, presentText, presented, resolved, unfinishedWorkflow } from "./main/snapshots.js";
-import { isLive, pausedElsewhere, statusBrief, statusCallDetail, statusCompactDetail, statusDetail, statusView, widOfRid } from "../orchestrator/snapshot.js";
+import { isLive, pausedElsewhere, runningOrchestrator, statusBrief, statusCallDetail, statusCompactDetail, statusDetail, statusView, widOfRid } from "../orchestrator/snapshot.js";
 import { parameters, request, sendReceipt } from "./main/tool.js";
 import { discoverAgents } from "../compat/agents.js";
 let noteSink;
@@ -89,6 +89,16 @@ export function registerMain(pi, ui) {
         await new Promise((resolve, reject) => { child.once("spawn", resolve); child.once("error", reject); });
         child.unref();
     }
+    // Version visibility: say once per orchestrator process when it runs another version than this pi loaded (after an
+    // update its running work stays on the old one); status shows the same note.
+    let versionTold;
+    function tellVersion() {
+        const { orchestrator, versionNote } = runningOrchestrator(home);
+        if (!versionNote || orchestrator === versionTold || !ctx?.hasUI)
+            return;
+        versionTold = orchestrator;
+        ctx.ui.notify(`Durable Subagents: ${versionNote}.`, "warning");
+    }
     function collect() { return ctx ? attention(home, sender, [...presented(ctx), ...reserved]) : []; }
     function message(items) {
         return { type: "custom_message", customType: CT.attention, content: items.map(presentText).join("\n"), display: true, details: { items } };
@@ -146,6 +156,12 @@ export function registerMain(pi, ui) {
         await outbox.republishPending();
         await starter();
         lastStarter = Date.now();
+        try {
+            tellVersion();
+        }
+        catch (error) {
+            console.error("durable-subagents:", error);
+        }
         timer = setInterval(() => {
             if (polling || stopped)
                 return;
@@ -156,6 +172,7 @@ export function registerMain(pi, ui) {
                 if (Date.now() - lastStarter >= 30_000) {
                     lastStarter = Date.now();
                     await starter();
+                    tellVersion();
                 }
                 await idle();
             }).catch(error => console.error("durable-subagents:", error)).finally(() => { polling = false; });
@@ -326,7 +343,7 @@ export function registerMain(pi, ui) {
             "run (action optional for exactly one launch form): agent+task; tasks:[call specs] parallel; chain:[call specs] sequential ({previous}); workflow:'./script.js' or source (runs.run(key,spec), runs.all([...]), emit(value), args, runs.input(name)). Optional name, cwd, usageBudget, maxCalls, inputs. With tasks/chain, top-level model, timeoutMs, budget, isolation, context, tools, skills, once are defaults for every step (a step's own value wins); a workflow/source script sets them per runs.run call. timeoutMs is milliseconds of active time (a number); omit it unless a hard limit is needed. Explicit unknown agents are rejected BEFORE creation, with available names; unknown script agents fail only their call.",
             "agents: list names, descriptions, default models and source for this cwd; use these names for run.",
             "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model: a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
-            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
+            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, sharedWorktree names calls sharing observed edit/write roots (reminder only), finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again), and the orchestrator version (versionNote when it differs from the loaded one); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
             "Control replies are {applied:true,rid} or {applied:false,reason,rid} when decided; otherwise {submitted:{rid}} after 10s.",
             ...(agents ? [`Available agents: ${agents}.`] : []),
             "User sees a summary line above the editor; ↓ on an empty editor (or /subagents) opens the list, Enter watches live OR finished calls (finished transcripts remain on disk) and expands finished workflows. List keys: s steer (paste-capable input), x stop (confirm y), m model, a answer when asked, f follow-up on finished calls; action feedback appears in footer.",

package/dist/cli/main.js

@@ -57,7 +57,7 @@ export function renderStatus(wf) {
     return [`${wf.wid}@${wf.rev}${wf.name ? ` ${wf.name}` : ""}: ${wf.status}${wf.error ? ` (${clip(wf.error, 300)})` : ""} · ${sealed}/${total} sealed${used ? ` · ${formatUsage(wf.usage)}` : ""}`,
         ...wf.calls.map(c => {
             const last = c.result?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1), err = c.result?.error;
-            return `  ${c.key}@${c.gen} ${c.result?.status ?? c.phase}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage && (c.usage.input || c.usage.output) ? ` ${formatUsage(c.usage)}` : ""}${last ? ` ${JSON.stringify(clip(last, 160))}` : err ? ` (${clip(err, 160)})` : ""}`;
+            return `  ${c.key}@${c.gen} ${c.result?.status ?? c.phase}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage && (c.usage.input || c.usage.output) ? ` ${formatUsage(c.usage)}` : ""}${last ? ` ${JSON.stringify(clip(last, 160))}` : err ? ` (${clip(err, 160)})` : ""}${c.sharedWorktree ? ` (shares worktree with ${c.sharedWorktree.join(", ")})` : ""}`;
         }),
         ...wf.attention.map(a => `  ${a.kind}: ${JSON.stringify(clip(a.text, 300))}`),
         ...(wf.scriptLog ? [`  script log: ${wf.scriptLog}`] : [])].join("\n");
@@ -65,13 +65,13 @@ export function renderStatus(wf) {
 /** P25, T10: Render the compact status projection shared with the `subagents` tool. */
 export function renderView(view) {
     const lines = view.workflows.map(w => [`${w.wid}@${w.rev}${w.name ? ` ${w.name}` : ""}: ${w.status}${w.followUps ? " (follow-up running)" : ""}${w.error ? ` (${clip(w.error, 200)})` : ""} · ${w.done}/${w.planned ?? w.calls.length}${w.planned === undefined && w.status === "running" ? "+" : ""} done${w.usage.input || w.usage.output || w.usage.costUsd ? ` · ${formatUsage(w.usage)}` : ""}`,
-        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.switching ? ` → ${c.switching} (requested)` : ""}${c.switchFailed ? ` (switch refused: ${c.switchFailed})` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
+        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.switching ? ` → ${c.switching} (requested)` : ""}${c.switchFailed ? ` (switch refused: ${c.switchFailed})` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}${c.sharedWorktree ? ` (shares worktree with ${c.sharedWorktree.join(", ")})` : ""}`),
         ...w.attention.map(a => `  ${a.kind}: ${JSON.stringify(a.text.split("\n")[0])}`)].join("\n"));
     if (view.paused)
         lines.unshift(`${view.paused} (pi-durable-subagents resume)`);
     if (view.olderFinished)
         lines.push(`(+${view.olderFinished} older finished workflows; status <wid> shows one in detail)`);
-    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : "", ...(view.exhausted ?? [])].filter(Boolean);
+    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : "", view.orchestrator ? `orchestrator: ${view.orchestrator}` : "", ...(view.exhausted ?? []), view.versionNote ? `note: ${view.versionNote}` : ""].filter(Boolean);
     if (!lines.length)
         lines.push("No workflows");
     return [...lines, ...footer].join("\n");

package/dist/orchestrator/executor/index.js

@@ -30,6 +30,7 @@ import { availableMemory } from "./memory.js";
 import { reached, sessionUsage, totalUsage } from "./usage.js";
 import { recordFenceFailure, resolveFenceAttention, serialContainment, skipLostCandidate, sweepExecutions } from "./sweep.js";
 import { gateRetired } from "./effects/gate.js";
+import { WorktreeIndex, worktreeCalls, worktreeLabel, worktreePair, worktreeRoots } from "./worktree.js";
 const MEM_RECORD_MS = 30000;
 /** A4, P29: A child admitted within this window may not show in MemAvailable yet; its share is reserved explicitly. */
 const MEM_WARMUP_MS = 30000;
@@ -350,7 +351,54 @@ export default function createExecutor(ledgers, options = {}) {
             await t.journal.append(JT.attention, { item: { id, rev: 1, kind: "budget", text: "Workflow budget reached", wid: t.wid } });
         return hit;
     }
+    const roots = worktreeRoots(), writes = new WorktreeIndex();
+    const indexed = () => writes.scan(journals.values());
+    const origin = (w) => writes.origin(w.journal) ?? orch.entries().find(e => e.type === JT.created && e.wid === address(w.call).wid)?.origin;
+    // Serial sections only: wrote and attention are durable before another writer or seal can interleave.
+    /** Remind of every pair of calls that wrote in `root` and have not ended, once per pair and journal. The index must be
+     *  current; each append here is indexed at once (only that journal is read). */
+    async function remind(root) {
+        const live = writes.live(root);
+        for (let i = 0; i < live.length; i++)
+            for (let k = i + 1; k < live.length; k++) {
+                const [first, second] = WorktreeIndex.order(live[i], live[k]), id = worktreePair(first.call, second.call);
+                // A retry after a partial cross-workflow append keeps the reminder (and its writer) as first written.
+                const prior = writes.reminder(id), secondWid = address(second.call).wid;
+                const targets = origin(first) === origin(second) ? [prior && prior.wid !== secondWid ? first : second] : [second, first];
+                const item = prior ?? { id, rev: 1, kind: "conflict", call: second.call, wid: secondWid,
+                    text: `${worktreeLabel(first.call)} and ${worktreeLabel(second.call)} both write in ${root} (edit/write seen); assign one owner or move one to its own worktree` };
+                for (const target of targets)
+                    if (!writes.remindedIn(id, target.journal)) {
+                        await target.journal.append(JT.attention, { item: { ...item, wid: address(target.call).wid } });
+                        writes.scan([target.journal]);
+                    }
+            }
+    }
+    async function wrote(t, exec, cwd, path) {
+        const root = await roots(cwd, path);
+        if (!root)
+            return;
+        await serial(async () => {
+            if (sealed(t.journal, t.callId) || has(t.journal, JT.fenced, exec) || current(t.journal, t.callId) !== exec)
+                return;
+            if (indexed().has(exec, root))
+                return;
+            const after = writes.live(root).map(w => w.call).filter(c => c !== t.callId);
+            await t.journal.append("wrote", { exec, root, ...(after.length ? { after } : {}) });
+            writes.scan([t.journal]);
+            await remind(root);
+        });
+    }
+    /** Close the reminders of pairs where `call` (or, without one, any participant) ended. */
+    async function resolveWorktrees(call) {
+        for (const { id, journal, item } of indexed().open()) {
+            const pair = worktreeCalls(id);
+            if (call ? pair.includes(call) : pair.some(c => writes.ended(c)))
+                await journal.append(JT.attentionResolved, { id, rev: item.rev, resolution: "ended" });
+        }
+    }
     async function retireAttention(journal, call) {
+        await resolveWorktrees(call);
         for (const { item } of attentionEntries(journal.entries())) {
             if (item.kind === "finished" || item.id === `unknown:${call}` || item.id.startsWith("fence:"))
                 continue;
@@ -787,6 +835,7 @@ export default function createExecutor(ledgers, options = {}) {
                             }
                         });
                     }, recordUsage: values => recordUsage(t, values),
+                    wrote: path => wrote(t, exec, cwd, path),
                     switched: event => switched(exec, journal, event), answered: event => answered(exec, event), pendingSwitch: () => pendingSwitch(exec),
                 });
             }
@@ -810,7 +859,12 @@ export default function createExecutor(ledgers, options = {}) {
             journals.set(ticket.wid, ticket.journal);
             const a = { ticket, controller: new AbortController(), stopped: false, wake: () => { }, promise: undefined, onPark: new Set() };
             active.set(ticket.callId, a);
-            a.promise = execute(a).catch(error => {
+            a.promise = serial(async () => {
+                // Repair a crash between wrote and attention (or between the two origin journals).
+                for (const root of indexed().contested())
+                    await remind(root);
+                await resolveWorktrees();
+            }).then(() => execute(a)).catch(error => {
                 completed.delete(ticket.callId);
                 if (a.retired || ticket.journal.entries().some(e => e.type === "retired" && e.call === ticket.callId))
                     return buildCallResult({ key: ticket.key, gen: ticket.gen, status: "stopped", output: "", error: "retired" });
@@ -1005,6 +1059,7 @@ export default function createExecutor(ledgers, options = {}) {
         },
         async recover(wid, journal) {
             journals.set(wid, journal);
+            await serial(() => resolveWorktrees());
             await effects.recover(journal);
             for (const e of journal.entries().filter(e => e.type === JT.exec)) {
                 // F1: an exec whose fence fails stays unfenced and holding; its call parks until a sweep retires it.

package/dist/orchestrator/executor/observe.js

@@ -123,6 +123,9 @@ export async function observeExecution(d) {
             event.type === "message_end" && message?.stopReason !== "error" && (message?.usage?.output ?? 0) > 0)
             progress = performance.now();
         enqueue(async () => {
+            const args = event.args;
+            if (event.type === "tool_execution_start" && (event.toolName === "edit" || event.toolName === "write") && typeof args?.path === "string")
+                await d.wrote?.(args.path);
             const slim = observation(event);
             if (slim) {
                 await serial(() => t.journal.append("observation", { exec, event: slim }));

package/dist/orchestrator/executor/worktree.js

@@ -0,0 +1,152 @@
+import { lstat, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { JT, isEntry } from "../../types.js";
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+/** The file an edit/write tool call names, resolved as pi's tools resolve it (`resolveToCwd`): unicode spaces, an `@`
+ *  prefix, `~` and file URLs. */
+export function toolPath(cwd, input) {
+    let path = input.replace(UNICODE_SPACES, " ");
+    if (path.startsWith("@"))
+        path = path.slice(1);
+    if (path === "~")
+        path = homedir();
+    else if (path.startsWith("~/"))
+        path = join(homedir(), path.slice(2));
+    else if (/^file:\/\//.test(path))
+        path = fileURLToPath(path);
+    return resolve(cwd, path);
+}
+/** The worktree an observed edit/write path is in: the nearest real ancestor directory holding `.git` (a directory, or
+ *  a file in a linked worktree), for files and parent directories not created yet too. No git process and no cache: a
+ *  repository made inside another while calls run is seen at once; each lookup is a few `lstat`s. */
+export function worktreeRoots() {
+    return async (cwd, path) => {
+        // A path pi's tool cannot use either (e.g. a file URL with a host) is no evidence; the tool reports it to the agent.
+        let dir;
+        try {
+            dir = dirname(toolPath(cwd, path));
+        }
+        catch {
+            return;
+        }
+        for (;;) {
+            try {
+                dir = await realpath(dir);
+                break;
+            }
+            catch (error) {
+                if (!["ENOENT", "ENOTDIR"].includes(error.code ?? ""))
+                    return;
+                const parent = dirname(dir);
+                if (parent === dir)
+                    return;
+                dir = parent;
+            }
+        }
+        for (;;) {
+            try {
+                await lstat(join(dir, ".git"));
+                return dir;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return;
+            }
+            const parent = dirname(dir);
+            if (parent === dir)
+                return;
+            dir = parent;
+        }
+    };
+}
+/** Pair identity is durable; it also lets readers and seal recovery identify both participants. */
+export const worktreePair = (a, b) => `worktree:${[a, b].sort().join("|")}`;
+export const worktreeCalls = (id) => id.startsWith("worktree:") ? id.slice(9).split("|") : [];
+export const worktreeLabel = (call) => call.replace(/@\d+\//, "/").replace(/@\d+$/, "");
+const callOf = (exec) => exec.slice(0, exec.lastIndexOf("#"));
+/** What the journals say about observed writes, kept up to date incrementally (each journal entry is read once):
+ *  the first `wrote` of each call per worktree, calls that ended (sealed or retired), the conflict reminders written and
+ *  whether each is still open, and each workflow's origin. Participants come from the journals, not from the calls
+ *  running now: a paused call that wrote still counts until it ends. */
+export class WorktreeIndex {
+    scanned = new Map();
+    /** Writers per root that have not ended; a root is dropped when its last writer ends. */
+    byRoot = new Map();
+    callRoots = new Map();
+    execRoots = new Set();
+    endedCalls = new Set();
+    reminders = new Map();
+    origins = new Map();
+    scan(journals) {
+        for (const journal of journals) {
+            const entries = journal.entries();
+            for (let i = this.scanned.get(journal) ?? 0; i < entries.length; i++)
+                this.apply(journal, entries[i]);
+            this.scanned.set(journal, entries.length);
+        }
+        return this;
+    }
+    apply(journal, e) {
+        if (e.type === "wrote" && typeof e.exec === "string" && typeof e.root === "string") {
+            const call = callOf(e.exec);
+            this.execRoots.add(`${e.exec}\0${e.root}`);
+            if (this.endedCalls.has(call))
+                return;
+            const calls = this.byRoot.get(e.root) ?? new Map();
+            this.byRoot.set(e.root, calls);
+            if (!calls.has(call))
+                calls.set(call, { call, journal, ...(Array.isArray(e.after) ? { after: e.after.map(String) } : {}) });
+            const roots = this.callRoots.get(call) ?? new Set();
+            roots.add(e.root);
+            this.callRoots.set(call, roots);
+        }
+        else if (e.type === JT.sealed || e.type === "retired") {
+            const call = String(e.call);
+            this.endedCalls.add(call);
+            for (const root of this.callRoots.get(call) ?? []) {
+                const calls = this.byRoot.get(root);
+                calls?.delete(call);
+                if (calls && !calls.size)
+                    this.byRoot.delete(root);
+            }
+            this.callRoots.delete(call);
+        }
+        else if (e.type === "wf-created")
+            this.origins.set(journal, e.origin);
+        else if (isEntry(e, JT.attention) && e.item?.kind === "conflict") {
+            const held = this.reminders.get(e.item.id) ?? new Map();
+            this.reminders.set(e.item.id, held);
+            if (!held.has(journal))
+                held.set(journal, { item: e.item, open: true });
+        }
+        else if (e.type === JT.attentionResolved && typeof e.id === "string" && e.id.startsWith("worktree:")) {
+            const held = this.reminders.get(e.id)?.get(journal);
+            if (held)
+                held.open = false;
+        }
+    }
+    has(exec, root) { return this.execRoots.has(`${exec}\0${root}`); }
+    ended(call) { return this.endedCalls.has(call); }
+    /** Roots where two or more calls that have not ended wrote: the only ones a reminder can be due for. */
+    contested() { return [...this.byRoot].filter(([, calls]) => calls.size > 1).map(([root]) => root); }
+    /** Calls that wrote in `root` and have not ended. */
+    live(root) { return [...this.byRoot.get(root)?.values() ?? []]; }
+    origin(journal) { return this.origins.get(journal); }
+    /** The reminder of a pair as first written (another journal may still lack its copy after a crash). */
+    reminder(id) { return this.reminders.get(id)?.values().next().value?.item; }
+    remindedIn(id, journal) { return this.reminders.get(id)?.has(journal) ?? false; }
+    open() {
+        return [...this.reminders].flatMap(([id, held]) => [...held].filter(([, r]) => r.open).map(([journal, r]) => ({ id, journal, item: r.item })));
+    }
+    /** First and second writer of a pair, from the journals: a write records the calls that had written there before it
+     *  (`after`), so the order survives a crash before the reminder; writes without it are ordered by call id. */
+    static order(x, y) {
+        if (y.after?.includes(x.call))
+            return [x, y];
+        if (x.after?.includes(y.call))
+            return [y, x];
+        return x.call < y.call ? [x, y] : [y, x];
+    }
+}

package/dist/orchestrator/ledger.js

@@ -5,6 +5,7 @@
 //   provider-*: used-up usage windows (providers.ts).
 //   config{hash,config}: the orchestrator settings in effect from here; config-rejected{error,hash?}: a change of
 //     config.json refused, while the earlier settings stay (cleared by the next config record).
+//   orchestrator{version,pid} / orchestrator-exit{pid}: the orchestrator running (its package version) and its exit.
 import { foldExhaustion } from "./providers.js";
 import { isEntry } from "../types.js";
 export function emptyLedger() {
@@ -29,6 +30,12 @@ export function applyLedger(state, e) {
     }
     else if (isEntry(e, "config-rejected"))
         state.rejected = { error: String(e.error), ts: e.ts };
+    else if (isEntry(e, "orchestrator"))
+        state.orchestrator = { version: String(e.version), pid: Number(e.pid), ...(e.start ? { start: String(e.start) } : {}), ts: e.ts };
+    else if (isEntry(e, "orchestrator-exit")) {
+        if (state.orchestrator?.pid === e.pid)
+            state.orchestrator.exited = true;
+    }
     foldExhaustion(state.exhausted, e);
 }
 /** Fold the entries appended since `state` was last folded (the ledger only grows); a ledger that is not the one
@@ -36,7 +43,7 @@ export function applyLedger(state, e) {
 export function foldLedger(state, entries) {
     // Journal readers keep the entry objects of a ledger as it grows (kernel/journal.ts), so identity tells them apart.
     if (state.seen && entries[state.seen - 1] !== state.last)
-        Object.assign(state, emptyLedger(), { config: undefined, rejected: undefined, last: undefined });
+        Object.assign(state, emptyLedger(), { config: undefined, rejected: undefined, orchestrator: undefined, last: undefined });
     for (; state.seen < entries.length; state.seen++)
         applyLedger(state, entries[state.seen]);
     state.last = entries[state.seen - 1];

package/dist/orchestrator/main.js

@@ -13,8 +13,10 @@ import { join, resolve } from 'node:path';
 import { dsaHome, orchLedger, orchLock } from "../paths.js";
 import { openJournal } from "../kernel/journal.js";
 import { OsLock } from "../platform/lock.js";
+import { captureStart } from "../platform/proctable.js";
 import { Engine } from "./engine.js";
 import { configPath, configProblem, configStamp, recordConfig, stampedConfig, watchConfig } from "./config.js";
+import { packageVersion } from "../version.js";
 /** P2, C4, K6: Acquire the single authority before opening ledgers, recover, and idle-exit. */
 export async function main(options = {}) {
     const home = options.home ?? dsaHome();
@@ -36,6 +38,10 @@ export async function main(options = {}) {
             config = raw;
         }
         ledgers = { home, config, orch: await openJournal(orchLedger(home)) };
+        // Which version runs is visible to every pi session (status; a notice when it differs from the one pi loaded).
+        // `start` (Linux) tells this process from a later one given the same pid after a crash.
+        const start = await captureStart(process.pid).catch(() => '');
+        await ledgers.orch.append('orchestrator', { version: packageVersion(), pid: process.pid, ...(start ? { start } : {}) });
         const factory = options.executor ?? (await import(__rewriteRelativeImportExtension(new URL(import.meta.url.endsWith('.ts') ? './executor/index.ts' : './executor/index.js', import.meta.url).href))).default;
         const executor = factory(ledgers);
         engine = new Engine(ledgers, executor, options);
@@ -56,6 +62,7 @@ export async function main(options = {}) {
         }
         finally {
             try {
+                await ledgers?.orch.append('orchestrator-exit', { pid: process.pid }).catch(() => { });
                 await ledgers?.orch.close();
             }
             finally {

package/dist/orchestrator/snapshot.js

@@ -7,6 +7,8 @@ import { readJournalSnapshot } from "../kernel/journal.js";
 import { journalPath, orchLedger, pinnedDir, workflowDir } from "../paths.js";
 import { JT, isEntry } from "../types.js";
 import { emptyLedger, foldLedger } from "./ledger.js";
+import { packageVersion } from "../version.js";
+import { worktreeCalls, worktreeLabel } from "./executor/worktree.js";
 /** A workflow has live work: it runs, or follow-ups opened on it after it finished have not ended yet. */
 export function isLive(wf) {
     return wf.status === "running" || (wf.followUps ?? 0) > 0;
@@ -230,6 +232,12 @@ function snapshotReducer(wid, entries) {
         const list = structuredClone([...calls.values()]);
         const openAttention = structuredClone(attention.filter(item => !resolved.has(`${item.id}@${item.rev}`)));
         for (const item of openAttention) {
+            if (item.kind === "conflict") {
+                const pair = worktreeCalls(item.id);
+                for (const c of list)
+                    if (pair.includes(c.callId))
+                        c.sharedWorktree = [...new Set([...(c.sharedWorktree ?? []), ...pair.filter(id => id !== c.callId).map(worktreeLabel)])].sort();
+            }
             const call = item.kind === "question" ? list.find(c => item.id.startsWith(`q:${c.callId}:`)) : undefined;
             if (call && (call.phase === "running" || call.phase === "queued"))
                 call.phase = "asking"; // a hibernated asker is fenced
@@ -420,6 +428,7 @@ export function compactWorkflow(wf) {
         calls: wf.calls.map(c => {
             const r = c.result, last = r?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1);
             return { key: c.key, gen: c.gen, callId: c.callId, phase: c.phase, ...(r ? { status: r.status, ok: r.ok } : {}),
+                ...(c.sharedWorktree ? { sharedWorktree: c.sharedWorktree } : {}),
                 ...(c.model ? { model: c.model } : {}), ...(c.tools ? { tools: c.tools } : {}), ...(c.pending ? { pending: c.pending } : {}), ...(c.switching ? { switching: c.switching } : {}), ...(c.switchFailed ? { switchFailed: c.switchFailed } : {}), ...(nonzero(c.usage) ? { usage: c.usage } : {}),
                 ...(last ? { lastLine: clip(last, 200) } : {}), ...(r?.error ? { error: clip(r.error, 300) } : {}), ...(c.hibernated ? { hibernated: true } : {}) };
         }),
@@ -471,6 +480,57 @@ const latestCalls = (wf) => [...new Map(wf.calls.map(c => [c.key, c])).values()]
  *  the settings in effect (the latest config{hash,config}); config-rejected after it is reported too. */
 // One fold per orchestrator ledger, extended as it grows (ledger.ts; the executor folds the same entries the same way).
 const ledgerStates = new Map();
+/** The orchestrator running now (its last `orchestrator` record, without an exit, whose process lives), and a note when
+ *  its version is not the one this process loaded: running work stays on the version it started with. */
+export function orchestratorView(state, loaded = packageVersion()) {
+    const o = state.orchestrator;
+    if (!o || o.exited || !alive(o.pid, o.start))
+        return {};
+    return { orchestrator: `${o.version} (pid ${o.pid})`, ...(o.version === loaded ? {} : { versionNote: versionNote(o.version, loaded) }) };
+}
+/** Whether the recorded orchestrator still runs. On Linux its start time also tells it from a later process given the
+ *  same pid after a crash (elsewhere the pid alone is checked). */
+function alive(pid, start) {
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        if (error.code !== "EPERM")
+            return false;
+    }
+    if (!start || process.platform !== "linux")
+        return true;
+    try {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19] === start;
+    }
+    catch {
+        return false;
+    }
+}
+const parts = (v) => v.split(/[.-]/).map(n => Number.parseInt(n, 10) || 0);
+function newer(a, b) {
+    const x = parts(a), y = parts(b);
+    for (let i = 0; i < Math.max(x.length, y.length); i++)
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) > (y[i] ?? 0);
+    return false;
+}
+export function versionNote(running, loaded) {
+    return newer(running, loaded)
+        ? `this pi session loaded durable-subagents ${loaded}, older than the running orchestrator ${running}; start a new pi session to use ${running}`
+        : `the orchestrator runs durable-subagents ${running}, this pi loaded ${loaded}: running work stays on ${running}. ` +
+            `It exits about 10 s after all work ends and starts again on ${loaded}. To switch sooner without stopping running calls: ` +
+            `drain (running calls finish, nothing new starts in existing workflows; calls waiting for an answer keep it running), ` +
+            `wait until status no longer shows ${running}, then resume from a pi session started after the update. ` +
+            `A resume before it exits keeps ${running}, and pi sessions started before the update start ${running} again`;
+}
+/** orchestratorView of the home's orchestrator ledger. */
+export function runningOrchestrator(home) {
+    const path = orchLedger(home), state = foldLedger(ledgerStates.get(path) ?? emptyLedger(), readJournalSnapshot(path));
+    ledgerStates.set(path, state);
+    return orchestratorView(state);
+}
 export function slotsView(home, now = Date.now()) {
     const path = orchLedger(home), state = foldLedger(ledgerStates.get(path) ?? emptyLedger(), readJournalSnapshot(path));
     ledgerStates.set(path, state);
@@ -484,7 +544,7 @@ export function slotsView(home, now = Date.now()) {
             holders.set(e.pool, (holders.get(e.pool) ?? 0) + 1);
     const names = [...new Set([...Object.keys(limits), ...holders.keys()])].sort();
     const slots = names.map(p => { const n = holders.get(p) ?? 0, limit = limits[p]?.slots; return typeof limit === "number" ? `${p} ${n}/${limit}` : `${p} ${n} (no limit)`; });
-    return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${config.hash} since ${age(now - config.ts)} ago` } : {}),
+    return { ...orchestratorView(state), ...(slots.length ? { slots } : {}), ...(config ? { config: `${config.hash} since ${age(now - config.ts)} ago` } : {}),
         ...(exhausted.length ? { exhausted } : {}),
         ...(rejected ? { configRejected: `${clip(rejected.error, 200)} (${age(now - rejected.ts)} ago); ${config ? config.hash : "the start settings"} stay in effect` } : {}) };
 }
@@ -504,6 +564,7 @@ export function statusBrief(home, options = {}) {
         const calls = latestCalls(w).filter(c => c.phase !== "sealed" || (c.result && !c.result.ok)).map((c) => {
             const live = c.phase !== "sealed", quiet = c.lastActivity !== undefined ? now - c.lastActivity : undefined;
             return { key: c.key, agent: c.agent, phase: c.phase, ...(c.model ? { model: c.model } : {}),
+                ...(c.sharedWorktree ? { sharedWorktree: c.sharedWorktree } : {}),
                 ...(live && c.startedAt !== undefined ? { for: age(now - c.startedAt) } : {}),
                 ...(live && c.phase !== "asking" && quiet !== undefined && quiet >= 60_000 ? { quiet: age(quiet) } : {}),
                 ...(live && c.startedAt !== undefined ? { tokens: tokens(c.usage) } : {}),

package/dist/ui/cards.js

@@ -6,6 +6,7 @@ const HEAD = {
     finished: { icon: "✓", title: "finished", tone: "success" },
     stall: { icon: "…", title: "no activity", tone: "warning" },
     unknown: { icon: "!", title: "outcome unknown", tone: "warning" },
+    conflict: { icon: "!", title: "shares a worktree", tone: "warning" },
     budget: { icon: "$", title: "budget reached", tone: "warning" },
 };
 const keyOf = (item) => item.call ? item.call.split("/").at(-1).replace(/@1$/, "") : item.wid;

package/dist/version.js

@@ -0,0 +1,14 @@
+// The version of this package, read from its package.json (src/ and dist/ both sit one level below it).
+import { readFileSync } from "node:fs";
+let cached;
+export function packageVersion() {
+    if (cached === undefined) {
+        try {
+            cached = String(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown");
+        }
+        catch {
+            cached = "unknown";
+        }
+    }
+    return cached;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",