smol-symphony 0.2.0 → 0.3.1

package/dist/shell/interp/vm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vm.js","sourceRoot":"","sources":["../../../src/shell/interp/vm.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,wCAAwC;AACxC,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,kFAAkF;AAClF,yEAAyE;AACzE,iFAAiF;AACjF,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,iCAAiC;AACjC,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAE7E,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EACL,EAAE,EACF,cAAc,EACd,gBAAgB,EAChB,YAAY,IAAI,oBAAoB,EACpC,UAAU,GAMX,MAAM,0BAA0B,CAAC;AAyBlC;;;;;GAKG;AACH,SAAS,eAAe,CAAC,QAA0C,EAAE,OAAe;IAClF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS;QACvF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,iBAAiB;IACJ,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;IAC7B,IAAI,CAAoD;IACxD,OAAO,CAAS;IAEjC,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,EAAc;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,8EAA8E;AAE9E,MAAM,gBAAgB;IAOD;IACA;IAPnB;;;;OAIG;IACH,YACmB,EAAM,EACN,UAAsB,GAAG,EAAE,CAAC,SAAS;QADrC,OAAE,GAAF,EAAE,CAAI;QACN,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ,IAAI,EAAE;QACJ,OAAO,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,IAAmB;QACtB,6EAA6E;QAC7E,oDAAoD;QACpD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YACtC,GAAG,EAAE,IAAI,CAAC,OAAO,IAAI,SAAS;YAC9B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE;YACrE,MAAM;YACN,MAAM;YACN,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,SAAS;YACtC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,EACvD,CAAC,GAAY,EAAE,EAAE;gBACf,gFAAgF;gBAChF,iFAAiF;gBACjF,gFAAgF;gBAChF,4EAA4E;gBAC5E,4EAA4E;gBAC5E,4EAA4E;gBAC5E,wEAAwE;gBACxE,IAAI,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAChD,MAAM,GAAG,CAAC;YACZ,CAAC,CACF;YACD,IAAI,EAAE,GAAG,EAAE;gBACT,IAAI,MAAM;oBAAE,OAAO;gBACnB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC;oBACH,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;gBAAC,MAAM,CAAC;oBACP,8CAA8C;gBAChD,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,yEAAyE;QACzE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;CACF;AAED,+EAA+E;AAE/E,MAAM,OAAO,gBAAgB;IACV,YAAY,CAAoB;IAEjD,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,YAAY,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAqB;QAClC,MAAM,MAAM,GAAoC,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5B,kFAAkF;YAClF,6EAA6E;YAC7E,2DAA2D;YAC3D,IAAI,CAAC,CAAC,aAAa;gBAAE,MAAM,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,CAAC;QACD,uEAAuE;QACvE,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,OAAO,GAAc;YACzB,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YACtC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,GAAG;YACzB,kFAAkF;YAClF,+EAA+E;YAC/E,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,EAAE,MAAM,EAAE;YACf,SAAS,EAAE,IAAI,CAAC,SAAkC;YAClD,GAAG,EAAE,IAAI,CAAC,GAA6B;YACvC,GAAG,EAAE,IAAI,CAAC,GAA6B;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,IAAI,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,oFAAoF;IACpF,UAAU;QACR,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,EAAE;QACN,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/shell/interp/workspace.js

@@ -0,0 +1,310 @@
+// FCIS rewrite — WorkspaceEffect adapter (kind: adapter) implementing the
+// `WorkspacePort` over the host filesystem + git/gh CLIs.
+//
+// Responsibility (ported from the read-only reference, NOT modified):
+//   • src/workspace.ts            — ensureFor (per-identifier lock, assertContained
+//                                    guard, mkdir, canonical clone+branch+origin
+//                                    restore + restorePushedBranch on re-dispatch),
+//                                    fetchBaseInWorkspace, remove, workspacePathFor.
+//   • src/reconciler/workspace-defaults.ts — list (dirs under root) + inspect
+//                                    (HEAD / base-sha / dirty / commits-ahead).
+//
+// The central effect-interpreter routes the `workspace` family to this port
+// (effect-interpreter.ts `workspace()`); ZERO decisions live here. Env-driven
+// repo/base resolution (SYMPHONY_REPO / SYMPHONY_BASE_BRANCH / SYMPHONY_SOURCE_REPO)
+// now lives in core — the port receives an ALREADY-RESOLVED `{ baseBranch,
+// githubRepo }`, so this adapter only performs IO.
+//
+// Shell rule: imports from src/types/** ONLY. Git/gh spawn lifecycle is injected
+// as a `ProcessRunner` port by the composition root, so this file stays a thin
+// fs+verb mapper. NodeNext ESM with .js extensions on relative imports.
+import { mkdir, rm, lstat, stat, readdir, writeFile, access } from 'node:fs/promises';
+import path from 'node:path';
+import { sanitizeWorkspaceKey } from '../workspace-key.js';
+// Pinned commit identity for work the in-VM agent makes. Local-only so it never
+// leaks into ~/.gitconfig. Mirrors workspace.ts resolveSetupOptions.
+const GIT_IDENTITY = { name: 'symphony-agent', email: 'agent@symphony.local' };
+// Network git verbs fail fast on a credential prompt rather than blocking
+// (workspace.ts `noPrompt`).
+const NO_PROMPT_ENV = { GIT_TERMINAL_PROMPT: '0' };
+// Marker file (workspace-dir root) the runner drops when a terminal-state phase-8
+// handoff push FAILED; the janitor stats it and RETAINS the dir so the only copy
+// of the completed commit survives for manual push/recovery (issue 234). A dotfile
+// at the clone root so an operator doing manual recovery sees it (and the reason)
+// in a plain `ls -la`.
+const HANDOFF_PENDING_MARKER = '.symphony-handoff-pending';
+class WorkspaceError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'WorkspaceError';
+    }
+}
+function workspacePathFor(root, identifier) {
+    const key = sanitizeWorkspaceKey(identifier);
+    if (key.length === 0) {
+        throw new WorkspaceError('invalid_workspace_key', `cannot sanitize identifier: ${identifier}`);
+    }
+    return path.join(root, key);
+}
+// git/gh runner pair bound to a single deps.process seam. `expect` throws on a
+// non-zero exit; the bare runner returns the result for the caller to branch on.
+function gitRunners(proc) {
+    const run = (argv, cwd, env) => proc.run(['git', ...argv], { cwd, env });
+    const expect = async (argv, cwd, env) => {
+        const r = await run(argv, cwd, env);
+        if (r.exit_code !== 0) {
+            throw new WorkspaceError('workspace_setup_git_failed', `git ${argv.join(' ')} exited ${r.exit_code}: ${(r.stderr.trim() || r.stdout.trim())}`);
+        }
+        return r;
+    };
+    return { run, expect };
+}
+// Restore an already-pushed agent/<id> branch into a fresh clone so a re-dispatch
+// continues from pushed work. Returns false when there is no origin (local-only)
+// or the remote branch genuinely doesn't exist yet (ls-remote exit 2 = first
+// dispatch). Fails CLOSED on any other non-zero exit (128 transport/auth) so a
+// later push can't force-with-lease over already-pushed work once origin recovers.
+async function restorePushedBranch(git, wsPath, branch) {
+    const remoteCheck = await git.run(['remote', 'get-url', 'origin'], wsPath);
+    if (remoteCheck.exit_code !== 0)
+        return false;
+    // Probe the EXACT head ref (`refs/heads/<branch>`) — `ls-remote <branch>` does
+    // suffix matching and a colliding ref would false-positive.
+    const exists = await git.run(['ls-remote', '--exit-code', 'origin', `refs/heads/${branch}`], wsPath, NO_PROMPT_ENV);
+    if (exists.exit_code === 2)
+        return false; // reached remote, no such ref → cut fresh
+    if (exists.exit_code !== 0) {
+        throw new WorkspaceError('workspace_setup_origin_unreachable', `git ls-remote origin ${branch} failed (exit ${exists.exit_code}): ${(exists.stderr || exists.stdout).trim()}`);
+    }
+    // Fetch the EXACT head ref (a bare <branch> refspec could resolve a same-named tag).
+    const fetched = await git.run(['fetch', '--no-tags', 'origin', `refs/heads/${branch}`], wsPath, NO_PROMPT_ENV);
+    if (fetched.exit_code !== 0) {
+        throw new WorkspaceError('workspace_setup_branch_fetch_failed', `git fetch origin ${branch} failed (exit ${fetched.exit_code}): ${(fetched.stderr || fetched.stdout).trim()}`);
+    }
+    await git.expect(['checkout', '-b', branch, 'FETCH_HEAD'], wsPath);
+    return true;
+}
+// Canonical per-issue clone+branch+remote setup (workspace.ts setupWorkspaceDir).
+// `wsPath` exists and is empty; on failure the caller unwinds the dir.
+async function setup(deps, git, wsPath, baseBranch, branch, githubRepo) {
+    // 1. Source repo must look like a git repo. Read the LIVE source repo so a
+    //    reloaded workflow_dir is honoured.
+    const sourceRepo = deps.sourceRepo();
+    try {
+        const st = await stat(path.join(sourceRepo, '.git'));
+        if (!st.isDirectory() && !st.isFile())
+            throw new Error('not a git dir');
+    }
+    catch (err) {
+        throw new WorkspaceError('workspace_setup_no_source_repo', `source repo ${sourceRepo} is not a git repository: ${err.message}`);
+    }
+    // 2. Hardlinked, narrow-refspec clone landing on base (`.` cwd = wsPath).
+    await git.expect(['clone', '--local', '--no-tags', '--branch', baseBranch, sourceRepo, '.'], wsPath);
+    // 3. Strip every remote the clone copied (network targets stay zero) + unset
+    //    any inherited credential.helper (best-effort: empty config → exit 5).
+    const remotes = await git.expect(['remote'], wsPath);
+    for (const remote of remotes.stdout.split(/\r?\n/).map((r) => r.trim()).filter((r) => r.length > 0)) {
+        await git.expect(['remote', 'remove', remote], wsPath);
+    }
+    await git.run(['config', '--local', '--unset', 'credential.helper'], wsPath);
+    // 4. Conditional origin restore (PR mode): canonical HTTPS URL (no token; auth
+    //    is the host's gh, never the VM). Deliberately NO origin fetch+reset — the
+    //    source repo's local <base> is the canonical base ref (avoids drift false
+    //    positives, see workspace.ts comment).
+    if (githubRepo && githubRepo.length > 0) {
+        await git.expect(['remote', 'add', 'origin', `https://github.com/${githubRepo}.git`], wsPath);
+        // gh auth setup-git best-effort: a host without gh still gets a usable origin.
+        await deps.process.run(['gh', 'auth', 'setup-git'], { cwd: wsPath });
+    }
+    // 5. Pin commit identity (local-only).
+    await git.expect(['config', '--local', 'user.name', GIT_IDENTITY.name], wsPath);
+    await git.expect(['config', '--local', 'user.email', GIT_IDENTITY.email], wsPath);
+    // 6. Land HEAD on the per-issue branch. On re-dispatch (origin/<branch> already
+    //    pushed) restore it so the agent's pushed work is carried forward; else cut
+    //    fresh. See restorePushedBranch for the non-converging loop this closes.
+    if (await restorePushedBranch(git, wsPath, branch))
+        return;
+    await git.expect(['checkout', '-b', branch], wsPath);
+}
+// Resolve (creating if missing) the workspace dir. Returns true when THIS call
+// did the mkdir (gates one-time canonical setup). Rejects symlinks (containment
+// risk) and non-directory entries.
+async function ensureDirExists(wsPath) {
+    try {
+        // lstat (not stat): a symlink could redirect setup + the returned cwd
+        // outside the root, violating the §5.5 containment invariant.
+        const st = await lstat(wsPath);
+        if (st.isSymbolicLink()) {
+            throw new WorkspaceError('workspace_path_is_symlink', `workspace path ${wsPath} is a symlink; refusing to use`);
+        }
+        if (!st.isDirectory()) {
+            throw new WorkspaceError('workspace_path_not_directory', `expected directory at ${wsPath}, found a non-directory`);
+        }
+        return false;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            await mkdir(wsPath, { recursive: true });
+            return true;
+        }
+        throw err;
+    }
+}
+async function doEnsureFor(deps, git, identifier, opts) {
+    // Read the LIVE workspace root so a hot-reloaded workspace.root retargets here.
+    const root = deps.root();
+    await mkdir(root, { recursive: true });
+    const wsPath = workspacePathFor(root, identifier);
+    deps.assertContained(root, wsPath);
+    const createdNow = await ensureDirExists(wsPath);
+    if (createdNow) {
+        try {
+            await setup(deps, git, wsPath, opts.baseBranch, `agent/${identifier}`, opts.githubRepo);
+        }
+        catch (err) {
+            // Best-effort unwind so the next dispatch tick retries cleanly.
+            await rm(wsPath, { recursive: true, force: true }).catch(() => undefined);
+            throw err;
+        }
+    }
+    return { path: wsPath, created: createdNow };
+}
+// git inspection of one workspace for drift detection (workspace-defaults.ts
+// defaultInspectWorkspace). HEAD-less / non-repo dirs return a null head so the
+// janitor treats them as "don't touch". All git is workspace-local.
+async function inspect(git, workspacePath, baseBranch) {
+    const head = await git.run(['rev-parse', 'HEAD'], workspacePath);
+    if (head.exit_code !== 0 || head.stdout.trim().length === 0) {
+        return { head: null, workspaceBaseSha: null, hasUncommitted: false, commitsAheadOfBase: 0 };
+    }
+    const headSha = head.stdout.trim();
+    const status = await git.run(['status', '--porcelain'], workspacePath);
+    const hasUncommitted = status.exit_code === 0 && status.stdout.length > 0;
+    const wsBase = await git.run(['rev-parse', baseBranch], workspacePath);
+    const workspaceBaseSha = wsBase.exit_code === 0 && wsBase.stdout.trim().length > 0 ? wsBase.stdout.trim() : null;
+    let aheadCount = 0;
+    if (workspaceBaseSha !== null) {
+        // `<base>..HEAD` walks only objects the workspace owns. Malformed-ref
+        // non-zero → 0 ahead rather than poisoning the snapshot.
+        const ahead = await git.run(['rev-list', '--count', `${workspaceBaseSha}..${headSha}`], workspacePath);
+        aheadCount = ahead.exit_code === 0 ? Number(ahead.stdout.trim()) || 0 : 0;
+    }
+    return { head: headSha, workspaceBaseSha, hasUncommitted, commitsAheadOfBase: aheadCount };
+}
+// Enumerate workspace dirs under root (workspace-defaults.ts
+// defaultListWorkspaceDirs). Non-directories filtered out; ENOENT on root →
+// empty (cold start). Other errors propagate (don't reap on a transient hiccup).
+async function listDirs(root) {
+    let entries;
+    try {
+        entries = await readdir(root);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    const out = [];
+    for (const name of entries) {
+        const p = path.join(root, name);
+        try {
+            const st = await stat(p);
+            if (st.isDirectory())
+                out.push({ name, path: p });
+        }
+        catch {
+            // Entry vanished mid-pass; next reconcile picks it up.
+        }
+    }
+    return out;
+}
+/**
+ * Build the workspace adapter. Returns the {@link WorkspacePort} the central
+ * effect-interpreter drains the `workspace` family through. A per-identifier
+ * in-flight promise map coalesces concurrent `ensureFor` calls (dispatch runner
+ * + reconciler eager-create) into one `git clone --local` so they don't race on
+ * the same dir; the entry is removed in a `finally` so a re-dispatch re-enters.
+ */
+export function createWorkspaceAdapter(deps) {
+    const git = gitRunners(deps.process);
+    const ensureInFlight = new Map();
+    return {
+        workspacePathFor: (identifier) => workspacePathFor(deps.root(), identifier),
+        workspaceKeyFor: sanitizeWorkspaceKey,
+        // Coalesce concurrent ensureFor for the same identifier into one setup pass.
+        // Key by the LIVE root + sanitized identifier: a WORKFLOW.yaml hot-reload that
+        // moves workspace.root mid-clone must NOT let a fresh ensureFor(id) reuse the
+        // stale promise still cloning into the OLD root — that would return a path
+        // under the wrong root. Including the live root in the key starts a fresh
+        // in-flight entry whenever the root changes (and the finally-delete uses the
+        // same captured key so the right entry is cleared).
+        async ensureFor(identifier, opts) {
+            const key = `${deps.root()}\0${sanitizeWorkspaceKey(identifier)}`;
+            const existing = ensureInFlight.get(key);
+            if (existing)
+                return existing;
+            const p = doEnsureFor(deps, git, identifier, opts);
+            ensureInFlight.set(key, p);
+            try {
+                return await p;
+            }
+            finally {
+                ensureInFlight.delete(key);
+            }
+        },
+        // Per-dispatch fetch of the workspace's base ref so the in-VM `git rebase
+        // origin/<base>` sees a current ref (workspace.ts fetchBaseInWorkspace). No-op
+        // when there's no origin (local-only). Throws on a configured-origin fetch
+        // failure so the caller aborts rather than launching against a stale ref.
+        async fetchBaseInWorkspace(workspacePath, baseBranch) {
+            const remoteCheck = await git.run(['remote', 'get-url', 'origin'], workspacePath);
+            if (remoteCheck.exit_code !== 0)
+                return; // local-only: nothing to fetch
+            const fetched = await git.run(['fetch', '--no-tags', 'origin', baseBranch], workspacePath, NO_PROMPT_ENV);
+            if (fetched.exit_code !== 0) {
+                throw new WorkspaceError('workspace_fetch_base_failed', `git fetch origin ${baseBranch} failed (exit ${fetched.exit_code}): ${(fetched.stderr || fetched.stdout).trim()}`);
+            }
+        },
+        // Best-effort fs removal of the per-issue dir. A symlink/non-directory at the
+        // path is a no-op (containment safety). `reason` is carried for the run log.
+        async remove(identifier, _reason) {
+            const root = deps.root();
+            const wsPath = workspacePathFor(root, identifier);
+            deps.assertContained(root, wsPath);
+            try {
+                const st = await lstat(wsPath);
+                if (st.isSymbolicLink() || !st.isDirectory())
+                    return;
+            }
+            catch {
+                return; // ENOENT etc. → already gone
+            }
+            await rm(wsPath, { recursive: true, force: true });
+        },
+        inspect: (workspacePath, baseBranch) => inspect(git, workspacePath, baseBranch),
+        list: () => listDirs(deps.root()),
+        // Drop the handoff-pending marker into the per-issue dir (issue 234). Resolved +
+        // containment-guarded like remove(); the reason is the body so manual recovery
+        // can read why the push failed. No-op if the dir vanished (best-effort).
+        async markHandoffPending(identifier, reason) {
+            const root = deps.root();
+            const wsPath = workspacePathFor(root, identifier);
+            deps.assertContained(root, wsPath);
+            await writeFile(path.join(wsPath, HANDOFF_PENDING_MARKER), `${reason}\n`, 'utf8');
+        },
+        // Stat the marker for the janitor's retention gate. Any access error (ENOENT,
+        // the dir gone) reads as "no marker" → the dir reaps as today.
+        async hasHandoffPendingMarker(workspacePath) {
+            try {
+                await access(path.join(workspacePath, HANDOFF_PENDING_MARKER));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=workspace.js.map

package/dist/shell/interp/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../src/shell/interp/workspace.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,oFAAoF;AACpF,iFAAiF;AACjF,oFAAoF;AACpF,qFAAqF;AACrF,8EAA8E;AAC9E,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,qFAAqF;AACrF,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,iFAAiF;AACjF,+EAA+E;AAC/E,wEAAwE;AAExE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,IAAI,MAAM,WAAW,CAAC;AAI7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,gFAAgF;AAChF,qEAAqE;AACrE,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,sBAAsB,EAAW,CAAC;AAExF,0EAA0E;AAC1E,6BAA6B;AAC7B,MAAM,aAAa,GAA2B,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;AAE3E,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,kFAAkF;AAClF,uBAAuB;AACvB,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAE3D,MAAM,cAAe,SAAQ,KAAK;IACb;IAAnB,YAAmB,IAAY,EAAE,OAAe;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QADE,SAAI,GAAJ,IAAI,CAAQ;QAE7B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AA4BD,SAAS,gBAAgB,CAAC,IAAY,EAAE,UAAkB;IACxD,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,+BAA+B,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAmB;IACrC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,GAAW,EAAE,GAA4B,EAA0B,EAAE,CAChG,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,EAAE,IAAc,EAAE,GAAW,EAAE,GAA4B,EAA0B,EAAE;QACzG,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,4BAA4B,EAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAID,kFAAkF;AAClF,iFAAiF;AACjF,6EAA6E;AAC7E,+EAA+E;AAC/E,mFAAmF;AACnF,KAAK,UAAU,mBAAmB,CAAC,GAAe,EAAE,MAAc,EAAE,MAAc;IAChF,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3E,IAAI,WAAW,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,+EAA+E;IAC/E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACpH,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,0CAA0C;IACpF,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,oCAAoC,EACpC,wBAAwB,MAAM,iBAAiB,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,qFAAqF;IACrF,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,cAAc,CACtB,qCAAqC,EACrC,oBAAoB,MAAM,iBAAiB,OAAO,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,uEAAuE;AACvE,KAAK,UAAU,KAAK,CAClB,IAA0B,EAC1B,GAAe,EACf,MAAc,EACd,UAAkB,EAClB,MAAc,EACd,UAAyB;IAEzB,2EAA2E;IAC3E,wCAAwC;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,cAAc,CACtB,gCAAgC,EAChC,eAAe,UAAU,6BAA8B,GAAa,CAAC,OAAO,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACrG,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACpG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,2CAA2C;IAC3C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,sBAAsB,UAAU,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9F,+EAA+E;QAC/E,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,uCAAuC;IACvC,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAClF,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,IAAI,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO;IAC3D,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,mCAAmC;AACnC,KAAK,UAAU,eAAe,CAAC,MAAc;IAC3C,IAAI,CAAC;QACH,sEAAsE;QACtE,8DAA8D;QAC9D,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,kBAAkB,MAAM,gCAAgC,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,8BAA8B,EAAE,yBAAyB,MAAM,yBAAyB,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAA0B,EAC1B,GAAe,EACf,UAAkB,EAClB,IAAuD;IAEvD,gFAAgF;IAChF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,gFAAgF;AAChF,oEAAoE;AACpE,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,aAAqB,EAAE,UAAkB;IAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,aAAa,CAAC,CAAC;IACvE,MAAM,gBAAgB,GAAG,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjH,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,gBAAgB,KAAK,OAAO,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;QACvG,UAAU,GAAG,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC;AAC7F,CAAC;AAED,6DAA6D;AAC7D,4EAA4E;AAC5E,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,WAAW,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAG/D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuD,CAAC;IAEtF,OAAO;QACL,gBAAgB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC;QAC3E,eAAe,EAAE,oBAAoB;QAErC,6EAA6E;QAC7E,+EAA+E;QAC/E,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,6EAA6E;QAC7E,oDAAoD;QACpD,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI;YAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;YAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YACnD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,CAAC;YACjB,CAAC;oBAAS,CAAC;gBACT,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,+EAA+E;QAC/E,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,CAAC,oBAAoB,CAAC,aAAa,EAAE,UAAU;YAClD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;YAClF,IAAI,WAAW,CAAC,SAAS,KAAK,CAAC;gBAAE,OAAO,CAAC,+BAA+B;YACxE,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YAC1G,IAAI,OAAO,CAAC,SAAS,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,cAAc,CACtB,6BAA6B,EAC7B,oBAAoB,UAAU,iBAAiB,OAAO,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAClH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,6EAA6E;QAC7E,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE;oBAAE,OAAO;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,6BAA6B;YACvC,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,EAAE,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,CAAC;QAC/E,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAEjC,iFAAiF;QACjF,+EAA+E;QAC/E,yEAAyE;QACzE,KAAK,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,EAAE,GAAG,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC;QACpF,CAAC;QAED,8EAA8E;QAC9E,+DAA+D;QAC/D,KAAK,CAAC,uBAAuB,CAAC,aAAa;YACzC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/shell/main-acp.js

@@ -0,0 +1,78 @@
+// FCIS rewrite — ACP-substrate construction for the composition root (kind: shell).
+//
+// Builds the REAL {@link AcpPort} (createAcpInterpreter, shell/interp/acp.ts) over
+// the `/acp` WebSocket, replacing the placeholderAcp() stub. The interpreter binds
+// to the SAME {@link AcpWsRegistry} the unified HTTP server exposes on the `/acp`
+// Upgrade (passed in as `input.registry` = a.acpWs from buildConcreteAdapters), so
+// a guest dial-back resolves the Duplex the host SDK drives.
+//
+// The interpreter resolves `vmId → dispatch context` through a small mutable
+// DISPATCH-CONTEXT registry the runner slice populates at per-dispatch bring-up:
+// constructed empty here (no dispatch active until the runner registers one) and
+// returned alongside the port so the runner slice can wire it.
+//
+// Core-free: imports src/types + sibling shell only — the pure `toolCallLifecycle`
+// decider arrives injected via `input.core` (only the composition root imports core).
+import { createAcpInterpreter } from './interp/acp.js';
+/** The mutable per-dispatch context registry (runner writes; ACP interpreter reads). */
+function createDispatchContextRegistry() {
+    const byVm = new Map();
+    return {
+        register: (vmId, ctx) => {
+            byVm.set(vmId, ctx);
+        },
+        deregister: (vmId) => {
+            byVm.delete(vmId);
+        },
+        contextForVm: (vmId) => byVm.get(vmId),
+    };
+}
+/**
+ * Construct the real ACP substrate. The returned `port` is the live AcpPort wired
+ * into the EffectAdapters bundle; `context` is the registry the runner slice
+ * populates so `sessionNew(vmId)` can resolve the dispatch's issue / workspace /
+ * MCP-server set. The `mcpServersFor` seam reads the SAME registry the runner
+ * populated (per-dispatch MCP servers), defaulting to none when MCP is disabled.
+ */
+export function buildAcpSubstrate(input) {
+    const context = createDispatchContextRegistry();
+    const port = createAcpInterpreter({
+        toolCallLifecycle: input.core.toolCallLifecycle,
+        isTransportError: input.core.isTransportError,
+        selectPermissionOption: input.core.selectPermissionOption,
+        // vmId → the per-dispatch ACP context captured at bring-up (runner-populated):
+        // the issue/workspace identity AND the dial-back `accepted` stream of the WS
+        // registration the runner created BEFORE launch (token → launch env). The
+        // interpreter CONSUMES `accepted` in sessionNew — it never registers again.
+        contextForVm: (vmId) => {
+            const ctx = context.contextForVm(vmId);
+            return ctx
+                ? {
+                    issueId: ctx.issueId,
+                    identifier: ctx.identifier,
+                    workspacePath: ctx.workspacePath,
+                    accepted: ctx.accepted,
+                    cancelAccept: ctx.cancelAccept,
+                }
+                : undefined;
+        },
+        // The per-dispatch MCP server set (registered alongside the context); when the
+        // dispatch ran with mcp disabled OR no context is registered, expose none.
+        mcpServersFor: (vmId, opts) => {
+            if (!opts.mcpEnabled)
+                return [];
+            return context.contextForVm(vmId)?.mcpServers ?? [];
+        },
+        runlog: input.runlog,
+        readTimeoutMs: input.readTimeoutMs(),
+        promptTimeoutMs: input.promptTimeoutMs(),
+        connectTimeoutMs: input.connectTimeoutMs(),
+        iso: () => input.clock.iso(),
+    });
+    // Expose the host `/acp` WS registry so the runner slice can `register(issueId,
+    // identifier)` EARLY — before the agent launches — and thread the returned token
+    // into the launch env. (Was previously consumed only here for the late, racy
+    // in-sessionNew registration.)
+    return { port, context, registry: input.registry };
+}
+//# sourceMappingURL=main-acp.js.map

package/dist/shell/main-acp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main-acp.js","sourceRoot":"","sources":["../../src/shell/main-acp.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,kFAAkF;AAClF,mFAAmF;AACnF,6DAA6D;AAC7D,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+DAA+D;AAC/D,EAAE;AACF,mFAAmF;AACnF,sFAAsF;AAStF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,wFAAwF;AACxF,SAAS,6BAA6B;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,OAAO;QACL,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAwB;IACxD,MAAM,OAAO,GAAG,6BAA6B,EAAE,CAAC;IAEhD,MAAM,IAAI,GAAG,oBAAoB,CAAC;QAChC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB;QAC/C,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB;QAC7C,sBAAsB,EAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB;QACzD,+EAA+E;QAC/E,6EAA6E;QAC7E,0EAA0E;QAC1E,4EAA4E;QAC5E,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,GAAG;gBACR,CAAC,CAAC;oBACE,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B;gBACH,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QACD,+EAA+E;QAC/E,2EAA2E;QAC3E,aAAa,EAAE,CAAC,IAAI,EAAE,IAAI,EAAe,EAAE;YACzC,IAAI,CAAC,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE;QACpC,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;QACxC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE;QAC1C,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;KAC7B,CAAC,CAAC;IAEH,gFAAgF;IAChF,iFAAiF;IACjF,6EAA6E;IAC7E,+BAA+B;IAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACrD,CAAC"}

package/dist/shell/main-adapters.js

@@ -0,0 +1,222 @@
+// FCIS rewrite — adapter construction for the composition root (kind: shell).
+//
+// Sliced out of src/shell/main.ts so the root keeps only the core-wiring under
+// the max-lines budget. This module constructs the resolvable adapters + the
+// deterministic seams and folds them into the EffectAdapters bundle the central
+// interpreter routes through. It imports NO core (only the root may) — every
+// pure decider arrives already injected by the root.
+//
+// The real ACP client (main-acp.ts: createAcpInterpreter over the `/acp`
+// WebSocket) + the host-only credential adapter (main-credential.ts:
+// GondolinCredentialAdapter) are now LIVE: the root builds each substrate and
+// injects the resolved port here. The remaining heavy / stateful sub-vocabularies
+// (the live runner pipeline, PR autopilot, VM-reaper fold) are owned by their own
+// shell slices and wired by the root once those slices stabilize; here they
+// surface a clean `{ ok:false }` / honest fallback so the interpreter stays total
+// and the scheduler reducer drains end-to-end while they land. The MCP runtime's
+// `mcp_tool`-family applier (`applyMcpEffect`) IS wired now (main-mcp.ts); the
+// root injects it so it shares the tracker move/write IO with the live runtime.
+import path from 'node:path';
+import process from 'node:process';
+import { mkdir, readdir, rm, stat, writeFile, readFile, access } from 'node:fs/promises';
+import { systemClock, tokenRandomSource, nodeCryptoEnv, nodeMemProbe } from './adapter/clock-random.js';
+import { setLogFile } from './interp/log.js';
+import { createProcessRunner, createProcessSignalPort } from './interp/process.js';
+import { createTimerPort } from './interp/timer.js';
+import { createGitAdapter } from './interp/git.js';
+import { GhCliPort } from './interp/gh.js';
+import { GondolinVmClient } from './interp/vm.js';
+import { createTrackerAdapter } from './interp/tracker.js';
+import { createWorkspaceAdapter } from './interp/workspace.js';
+import { FsRunLogStore } from './interp/runlog.js';
+import { AcpWsRegistry } from './interp/acp-ws.js';
+/** Resolve the persistent log-file path: env override > <logs.root>/symphony.log. */
+export function resolveLogFile(envLogFile, cfg) {
+    if (envLogFile === undefined)
+        return path.join(cfg.logs.root, 'symphony.log');
+    return envLogFile === '' ? null : envLogFile;
+}
+/**
+ * Point the persistent log sink at the resolved file for `cfg` and return a
+ * `retarget` closure for reloads. The startup banner names the file once; on a
+ * WORKFLOW.yaml edit the sink only moves when the resolved target actually
+ * changed (a `logs.root` edit with no SYMPHONY_LOG_FILE override — the override
+ * pins the path), and we print one short stdout line so the operator sees the new
+ * destination. Steady-state reloads stay silent.
+ */
+export function wireLogSink(envLogFile, cfg) {
+    let current = resolveLogFile(envLogFile, cfg);
+    setLogFile(current);
+    return (next) => {
+        const nextFile = resolveLogFile(envLogFile, next);
+        if (nextFile === current)
+            return;
+        current = nextFile;
+        setLogFile(nextFile);
+        if (nextFile !== null)
+            process.stdout.write(`reloaded; logs → ${nextFile}\n`);
+    };
+}
+/**
+ * Construct the resolvable adapters + the four deterministic seams. `getCfg` is
+ * read lazily so each adapter sees the live (reloaded) config; `log` is the
+ * already-built structured sink.
+ */
+export function buildConcreteAdapters(getCfg, log, resolveIssueMatch, core) {
+    const proc = createProcessRunner();
+    return {
+        clock: systemClock(),
+        random: tokenRandomSource(),
+        crypto: nodeCryptoEnv(),
+        mem: nodeMemProbe(core.parseMemAvailableMib),
+        process: proc,
+        signal: createProcessSignalPort(),
+        timer: createTimerPort(),
+        git: createGitAdapter({ process: proc }),
+        gh: new GhCliPort(proc, { repoSlug: () => getCfg().workspace.github_repo }),
+        vm: new GondolinVmClient(),
+        tracker: createTrackerAdapter({
+            config: () => getCfg().tracker,
+            log,
+            resolveMatch: resolveIssueMatch,
+            composeIssueFile: core.composeIssueFile,
+            pickNextNumericIdentifier: core.pickNextNumericIdentifier,
+        }),
+        workspace: createWorkspaceAdapter({
+            // LIVE closures (not boot snapshots) so a WORKFLOW.yaml hot-reload that moves
+            // workspace.root / workflow_dir retargets create/list/remove (finding #3).
+            // SYMPHONY_SOURCE_REPO still wins when set (a static env override).
+            root: () => getCfg().workspace.root,
+            sourceRepo: () => process.env.SYMPHONY_SOURCE_REPO ?? getCfg().workflow_dir,
+            process: proc,
+            assertContained: core.assertContained,
+        }),
+        runlog: new FsRunLogStore(log),
+        acpWs: new AcpWsRegistry({ log }),
+    };
+}
+/**
+ * Assemble the EffectAdapters bundle the central interpreter routes through. The
+ * resolvable adapters pass straight through; the remaining sub-vocabulary
+ * families are honest fallbacks (see file header) until their owning slice wires
+ * them through the root.
+ */
+export function buildEffectAdapters(deps) {
+    const diskTracker = {
+        listIssues: (root) => deps.tracker.listIssues(root),
+        readIssue: (root, identifier) => deps.tracker.readIssue(root, identifier),
+    };
+    return {
+        tracker: deps.tracker,
+        diskTracker,
+        vm: deps.vm,
+        // The runner slice owns the live vmId→VmHandle table; no live attempts run
+        // through the root yet, so no handle resolves.
+        vmHandleFor: () => undefined,
+        // The REAL ACP port (over the `/acp` WebSocket) + host-only credential port,
+        // built in the main-acp / main-credential substrates and injected by the root.
+        acp: deps.acp,
+        git: deps.git,
+        gh: deps.gh,
+        classifyPushResult: deps.classifyPushResult,
+        parsePrNumberFromUrl: deps.parsePrNumberFromUrl,
+        fs: nodeIssueFs(),
+        workspace: deps.workspace,
+        credential: deps.credential,
+        log: deps.log,
+        runlog: deps.runlog,
+        timer: deps.timer,
+        signal: deps.signal,
+        process: deps.process,
+        // <logsRoot>/<identifier>.jsonl (REF sanitizeWorkspaceKey → file path).
+        runlogPathFor: (_issueId, identifier) => path.join(deps.logsRoot(), `${identifier}.jsonl`),
+        // PR autopilot + VM reaper appliers: the reconciler slice owns them (the PR
+        // pass + the SIGTERM→…→SIGKILL escalation drive the same instances). The root
+        // injects them here so a core-emitted `pr`/`reaper` Effect shares pass state;
+        // an honest fallback covers the (unwired) case so the interpreter stays total.
+        applyPrEffect: deps.applyPrEffect ?? (async () => ({ ok: false, error: 'pr autopilot not wired in composition root' })),
+        applyMcpEffect: deps.applyMcpEffect ?? (async () => ({ kind: 'move_failed', message: 'mcp runtime not wired in composition root' })),
+        // The `steering` family resolves/cancels the per-issue awaiter (the ONE live
+        // Promise); the root injects McpRuntime's so a steering Effect lands it.
+        steering: deps.steering,
+        // The `mcp` family activates/deactivates the per-dispatch active entry; the root
+        // injects the live McpRuntime so the runner's bracket effect mints/tears it down.
+        mcpLifecycle: deps.mcpLifecycle,
+        applyKillStep: deps.applyKillStep ?? (async () => ({ kind: 'gone' })),
+        ttyPromptLine: async (question) => {
+            const { promptLine } = await import('./interp/tty.js');
+            return promptLine(question);
+        },
+        ttyWrite: (text) => process.stdout.write(text),
+    };
+}
+/**
+ * Real node:fs/promises-backed IssueFs (issue files + predicate file_present
+ * probes + action body staging). The thin port the interpreter's fs family
+ * routes through; lives here rather than its own interp slice while that slice
+ * is unsliced.
+ */
+export function nodeIssueFs() {
+    return {
+        mkdir: async (p, opts) => {
+            await mkdir(p, { recursive: opts.recursive });
+        },
+        readdir: (p) => readdir(p),
+        stat: async (p) => {
+            const st = await stat(p);
+            return { isDirectory: () => st.isDirectory() };
+        },
+        writeFile: (p, data, encoding) => writeFile(p, data, encoding),
+        readFile: (p, encoding) => readFile(p, encoding),
+        rm: (p, opts) => rm(p, { recursive: opts.recursive, force: opts.force }),
+        access: (p) => access(p)
+            .then(() => true)
+            .catch(() => false),
+    };
+}
+/**
+ * Minimal real RunningEntry the loop fills in until the runner slice supplies the
+ * pinned one (workspace path, pinned dispatch config, …). Carries the live
+ * `cancel` closure + the `active_tool_calls` Set the loop driver mutates directly.
+ */
+export function buildPlaceholderEntry(plan, cancel) {
+    const issue = plan.issue;
+    return {
+        issue_id: issue.id,
+        identifier: issue.identifier,
+        issue,
+        session_id: null,
+        thread_id: null,
+        turn_id: null,
+        adapter_pid: null,
+        last_event: null,
+        last_event_at: null,
+        last_message: null,
+        input_tokens: 0,
+        output_tokens: 0,
+        total_tokens: 0,
+        last_reported_input_tokens: 0,
+        last_reported_output_tokens: 0,
+        last_reported_total_tokens: 0,
+        turn_count: 0,
+        retry_attempt: plan.attempt,
+        started_at: new Date().toISOString(),
+        workspace_path: '',
+        cancel,
+        recent_events: [],
+        last_error: null,
+        cleanup_workspace_on_exit: false,
+        mcp_token: null,
+        tracker_root_at_dispatch: plan.trackerRoot,
+        github_repo_at_dispatch: null,
+        base_branch_at_dispatch: '',
+        resolved_actor: '',
+        transitioned: false,
+        steering_requested: false,
+        steering_question: null,
+        steering_context: null,
+        active_tool_calls: new Set(),
+        last_transition: null,
+    };
+}
+//# sourceMappingURL=main-adapters.js.map