tickmarkr 1.42.0 → 1.43.0

package/dist/brand.d.ts

@@ -2,3 +2,8 @@ export declare const BANNER: string;
 /** ANSI-stripped, trailing-space-trimmed twin of BANNER — README hero and other plain surfaces. */
 export declare const PLAIN_BANNER: string;
 export declare function bannerShell(): string;
+export declare const TICKMARKR_EXIT_TRAILER = "printf '\\nTICKMARKR_''EXIT:%s\\n' $?";
+/** OBS-50: visible-pane bootstrap script — banner + agent command + byte-identical exit trailer. */
+export declare function paneDispatchScript(body: string[]): string;
+/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+export declare function paneDispatchCommand(scriptPath: string): string;

package/dist/brand.js

@@ -17,3 +17,14 @@ export function bannerShell() {
     const printable = BANNER.replaceAll("\x1b", "\\033").replaceAll("\n", "\\n");
     return `printf '%b\\n' '${printable}'`;
 }
+// OBS-50: quote-split exit marker — herdr echoes the typed command into the transcript that
+// waitOutput matches, so the literal must not appear unsplit in the dispatch line.
+export const TICKMARKR_EXIT_TRAILER = `printf '\\nTICKMARKR_''EXIT:%s\\n' $?`;
+/** OBS-50: visible-pane bootstrap script — banner + agent command + byte-identical exit trailer. */
+export function paneDispatchScript(body) {
+    return ["export BASH_SILENCE_DEPRECATION_WARNING=1", ...body, TICKMARKR_EXIT_TRAILER].join("\n");
+}
+/** OBS-50: one short herdr pane-run line; bootstrap lives in the script file beside the prompt. */
+export function paneDispatchCommand(scriptPath) {
+    return `bash ${JSON.stringify(scriptPath)}`;
+}

package/dist/gates/acceptance.js

@@ -1,7 +1,8 @@
 import { channelKey, shq } from "../adapters/types.js";
 import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
-import { sh, shOk } from "../run/git.js";
+import { sh } from "../run/git.js";
+import { checkDiffCap, fetchTaskDiff } from "./review.js";
 import { extractJson, runLlm } from "./llm.js";
 const isCommand = (a) => typeof a === "object" && a.oracle === "command";
 const isTest = (a) => typeof a === "object" && a.oracle === "test";
@@ -57,12 +58,11 @@ export async function acceptanceGate(task, worktree, baseRef, judge, via, opts =
     const warn = onlyJudge
         ? "WARNING: only judge oracles — no deterministic command/test oracle guards this task (deterministic preferred, spec §2).\n"
         : "";
-    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
     const diffCap = opts.diffCap ?? DEFAULT_DIFF_CAP;
-    if (diff.length > diffCap) {
-        return { gate: "acceptance", pass: false,
-            details: warn + detBlock + `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
-    }
+    const capFail = checkDiffCap("acceptance", forCap.length, diffCap, warn + detBlock);
+    if (capFail)
+        return capFail;
     const prompt = `TICKMARKR-JUDGE
 You are a strict acceptance judge. Decide whether the diff satisfies EVERY acceptance criterion.
 Judge only what the diff proves — plausible-but-wrong must fail. Do not award partial credit.

package/dist/gates/llm.js

@@ -2,7 +2,7 @@ import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { formatOwnedName, parseOwnedName } from "../drivers/types.js";
-import { bannerShell } from "../brand.js";
+import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
 import { sh } from "../run/git.js";
 export const GATE_PANE_SEP = " · ";
 /** T8: role-first pane name for fleet visibility — judge · T4, review · T3, consult · T2. */
@@ -38,13 +38,15 @@ export async function runHeadless(adapter, model, prompt, cwd, timeoutMs = 30000
 // v1.1 default path: the same headless CLI call, but dispatched through the driver
 // as a visible named agent (herdr pane), with the quote-split completion wrapper.
 export async function runViaDriver(adapter, model, prompt, cwd, via, timeoutMs = 300000) {
-    const pf = join(mkdtempSync(join(tmpdir(), "tickmarkr-llm-")), "prompt.md");
+    const dir = mkdtempSync(join(tmpdir(), "tickmarkr-llm-"));
+    const pf = join(dir, "prompt.md");
     writeFileSync(pf, prompt);
+    const scriptPath = join(dir, "dispatch.sh");
+    // OBS-50: bootstrap in a script beside the prompt — pane sees one short bash line + banner, not the raw inline command
+    writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(pf, model)]));
     const slot = await via.driver.slot(cwd, rolePaneNameFromPrompt(prompt, via.name), via.label ? { label: via.label } : undefined);
     via.onSlot?.(slot);
-    // brand banner at pane top — gate panes run headless-print (no alt screen), so it stays visible;
-    // extractJson is anchored to JSON braces and the exit marker to TICKMARKR_EXIT:\d, neither matches banner text
-    await via.driver.run(slot, `${bannerShell()}; ${adapter.headlessCommand(pf, model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+    await via.driver.run(slot, paneDispatchCommand(scriptPath));
     // wait for the digit-suffixed marker (a real $? exit code), never a bare "TICKMARKR_EXIT:" that a
     // self-referential diff under review merely DISPLAYS — same guard the worker path uses (daemon.ts:193).
     // Without it, a judge/review pane echoing tickmarkr's own source false-completes before its verdict lands.

package/dist/gates/review.d.ts

@@ -7,6 +7,13 @@ export interface ReviewVerdict {
     approve: boolean;
     issues: string[];
 }
+export declare function fetchTaskDiff(worktree: string, baseRef: string): Promise<{
+    full: string;
+    forCap: string;
+}>;
+export declare function checkDiffCap(gate: string, measured: number, cap: number, prefix?: string): GateResult | null;
+export declare function isDiffCapPark(result: GateResult): boolean;
+export declare function diffCapParkReason(results: GateResult[]): string | null;
 export declare function modelId(model: string): string;
 export declare function pickReviewer(author: Assignment, channels: BillingChannel[], exclude?: string[]): BillingChannel | null;
 export declare function reviewGate(task: Task, worktree: string, baseRef: string, author: Assignment, channels: BillingChannel[], adapters: WorkerAdapter[], cfg: TickmarkrConfig, via?: GateVia, excludeReviewers?: string[]): Promise<GateResult>;

package/dist/gates/review.js

@@ -5,6 +5,32 @@ import { getAdapter } from "../adapters/registry.js";
 import { shOk } from "../run/git.js";
 import { marginalCostRank } from "../route/router.js";
 import { extractJson, runLlm } from "./llm.js";
+// OBS-48: cap on zero-context diff bytes (git diff -U0), not context-padded full diff — scattered
+// one-line hunks no longer trip at ~370 diff-bytes per changed line. Full diff still goes to the judge.
+const DIFF_CAP_REMEDY = "split the task, or raise gates.diffCap";
+export async function fetchTaskDiff(worktree, baseRef) {
+    const full = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const forCap = await shOk(`git diff -U0 '${baseRef}..HEAD'`, worktree);
+    return { full, forCap };
+}
+export function checkDiffCap(gate, measured, cap, prefix = "") {
+    if (measured <= cap)
+        return null;
+    return {
+        gate,
+        pass: false,
+        details: prefix + `diff exceeds verifiable cap (${measured} > ${cap}) — ${DIFF_CAP_REMEDY}`,
+        // daemon/run-gates: park('human') immediately — the diff cannot shrink by retrying (OBS-48).
+        meta: { park: "human" },
+    };
+}
+export function isDiffCapPark(result) {
+    return result.pass === false && result.meta?.park === "human" && /diff exceeds verifiable cap/i.test(result.details);
+}
+// ponytail: single policy hook for callers after runGates — skips the escalation ladder on diff-cap trips.
+export function diffCapParkReason(results) {
+    return results.find(isDiffCapPark)?.details ?? null;
+}
 // FLEET-05: canonical model identity = the segment after the last "/". Provider-prefixed ids name ONE
 // base model behind two harnesses (zai-coding-plan/glm-5.2, zai/glm-5.2 → "glm-5.2"); vendor alone (mixed vs
 // zhipu) is not a diversity signal. Suffix-stripping over-excludes only if two genuinely different
@@ -37,12 +63,11 @@ export async function reviewGate(task, worktree, baseRef, author, channels, adap
             ? { gate: "review", pass: false, details: "no cross-vendor reviewer available (diversity rule); set review.required:false to waive" }
             : { gate: "review", pass: true, details: "WARNING: no cross-vendor reviewer available — review waived by config" };
     }
-    const diff = await shOk(`git diff '${baseRef}..HEAD'`, worktree);
+    const { full: diff, forCap } = await fetchTaskDiff(worktree, baseRef);
     const diffCap = cfg.gates.diffCap ?? DEFAULT_DIFF_CAP;
-    if (diff.length > diffCap) {
-        return { gate: "review", pass: false,
-            details: `diff exceeds verifiable cap (${diff.length} > ${diffCap}) — split the task, or raise gates.diffCap` };
-    }
+    const capFail = checkDiffCap("review", forCap.length, diffCap);
+    if (capFail)
+        return capFail;
     const prompt = `TICKMARKR-REVIEW
 You are a skeptical cross-vendor code reviewer. Another agent (vendor: ${author.adapter}) authored this diff.
 Look for correctness bugs, security issues, and acceptance-criteria gaps. Approve only if you would merge it.

package/dist/run/consult.js

@@ -1,6 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAdapter } from "../adapters/registry.js";
+import { bannerShell, paneDispatchCommand, paneDispatchScript } from "../brand.js";
 import { extractJson, gatePaneName } from "../gates/llm.js";
 import { sh } from "./git.js";
 const MAX_RETRY_GUIDANCE_LINES = 10;
@@ -73,7 +74,10 @@ opts = {}) {
             ...(opts.runId ? { owned: { role: "consult", taskId: d.taskId, attempt: 0, runId: opts.runId } } : {}),
         });
         opts.onSlot?.(slot);
-        await driver.run(slot, `${adapter.headlessCommand(promptFile, cfg.consult.model)}; printf '\\nTICKMARKR_''EXIT:%s\\n' $?`);
+        const scriptPath = join(dir, `${d.taskId}-${n}.sh`);
+        // OBS-50: visible consult panes get the brand banner; headless path above stays banner-free (machine-parsed stdout)
+        writeFileSync(scriptPath, paneDispatchScript([bannerShell(), adapter.headlessCommand(promptFile, cfg.consult.model)]));
+        await driver.run(slot, paneDispatchCommand(scriptPath));
         // digit-suffixed marker only: a dossier quoting tickmarkr's own "TICKMARKR_EXIT:" literal must not
         // false-complete the consult pane before its verdict (same guard as daemon.ts:193 / llm.ts).
         await driver.waitOutput(slot, "TICKMARKR_EXIT:\\d", cfg.consult.stallMinutes * 60_000, { regex: true });

package/dist/run/daemon.js

@@ -11,7 +11,7 @@ import { captureBaseline, detectGateCommands } from "../gates/baseline.js";
 import { runGates } from "../gates/run-gates.js";
 import { addEvidence, attributeBlocked, blockedTasks, getTask, loadGraph, pendingTasks, readyTasks, saveGraph, setStatus } from "../graph/graph.js";
 import { consult, renderRetryGuidance } from "./consult.js";
-import { cleanupRunWorktrees, gitHead, sh } from "./git.js";
+import { cleanupRunWorktrees, gitHead, linkNodeModules, sh, WORKTREE_LAYOUT_CONTRACT } from "./git.js";
 import { Journal, loadRoutingProfile, newRunId } from "./journal.js";
 import { acquireRunLock, releaseRunLock } from "./lock.js";
 import { ensureIntegration, integrationBranch, integrationHead, mergeTask, verifyIntegrationTip } from "./merge.js";
@@ -343,6 +343,11 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
+                // OBS-47: state the worktree layout contract in the worker prompt (cheap-tier workers were
+                // committing/deleting node_modules and tripping the scope gate). Prepended, not appended, so the
+                // completion trailer stays the structural last line (prompt.ts's design). The harness re-asserts
+                // the link itself before gates regardless of what the worker does with it.
+                writeFileSync(promptFile, `${WORKTREE_LAYOUT_CONTRACT}\n\n${readFileSync(promptFile, "utf8")}`);
                 const adapter = getAdapter(assignment.adapter, adapters);
                 // VIS-04: workers share one role tab. T2: `owned` names the pane canonically (ownership contract);
                 // the legacy name stays the fallback for drivers without owned handling (subprocess spies).
@@ -556,6 +561,16 @@ export async function runDaemon(repoRoot, opts = {}) {
                 }
                 graph = setStatus(graph, t.id, "gated");
                 saveGraph(repoRoot, graph);
+                // OBS-47: re-assert the node_modules link BEFORE gates run on any attempt. A worker may have
+                // deleted/replaced the symlink provisioned at worktree creation (run-20260717-004803 T5 lost two
+                // attempts + a consult to this); restore it harness-side so a prior attempt's environment damage
+                // can never fail a later attempt's gates. Gates never trust worker claims — this runs
+                // unconditionally, never on worker say-so. Restoration can fail (EPERM/busy); fail closed with a
+                // named environmental verdict instead of letting the test gate mask it as a code red.
+                if (!linkNodeModules(repoRoot, wt, { force: true })) {
+                    await park(t, "environmental: node_modules link could not be re-asserted before gates (OBS-47)", "setup", assignment, attempt + 1, startMs, gateFails, consults, tokens, metered, retryMode);
+                    return;
+                }
                 const onGate = async (e) => {
                     if (e.phase === "start")
                         return;

package/dist/run/git.d.ts

@@ -8,6 +8,7 @@ export declare function sh(cmd: string, cwd: string, timeoutMs?: number): Promis
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function gitHead(cwd: string): Promise<string>;
 export declare const sanitizeBranch: (branch: string) => string;
+export declare const WORKTREES_DIR = "worktrees.noindex";
 export declare const worktreePath: (repo: string, branch: string) => string;
 /** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
 export declare function cleanupRunWorktrees(repo: string, branch: string, opts: {
@@ -16,5 +17,8 @@ export declare function cleanupRunWorktrees(repo: string, branch: string, opts:
 }): Promise<void>;
 export declare function resolveIntegrationBranch(_repo: string, branch: string): Promise<string>;
 export declare function createWorktree(repo: string, branch: string, baseRef: string): Promise<string>;
-export declare function linkNodeModules(repo: string, dir: string): void;
+export declare function linkNodeModules(repo: string, dir: string, { force }?: {
+    force?: boolean | undefined;
+}): boolean;
+export declare const WORKTREE_LAYOUT_CONTRACT = "## Worktree layout contract (harness-provisioned \u2014 do not modify)\n- node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it \u2014 the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.";
 export declare function removeWorktree(repo: string, dir: string): Promise<void>;

package/dist/run/git.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { existsSync, symlinkSync } from "node:fs";
+import { existsSync, lstatSync, readlinkSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
@@ -49,7 +49,12 @@ export async function gitHead(cwd) {
 }
 export const sanitizeBranch = (branch) => branch.replace(/[^\w.-]+/g, "-");
 const sanitize = sanitizeBranch;
-export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+// OBS-49: macOS Spotlight skips any *.noindex directory, so worktree churn during gate bursts
+// stops spawning mdworkers (9 mdworkers measured on an 18-core M5 Max at load-77). Accepted cost:
+// CLI trust stores key on exact worktree paths (OBS-16), so each worktree re-prompts for trust
+// once after this rename — the same one-time per-install cost as the v1.38 state-dir rename.
+export const WORKTREES_DIR = "worktrees.noindex";
+export const worktreePath = (repo, branch) => join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
 /** OBS-28: remove this run's recorded worktrees; tolerates already-gone paths. */
 export async function cleanupRunWorktrees(repo, branch, opts) {
     if (opts.removeIntegration)
@@ -69,25 +74,47 @@ const resolveTaskBranch = async (repo, branch) => {
 };
 export async function createWorktree(repo, branch, baseRef) {
     branch = await resolveTaskBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
     await shOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
     linkNodeModules(repo, dir);
     return dir;
 }
-// best-effort: devDep-based gates (tsx, vitest) shell out root-anchored and ENOENT in a bare
-// fresh worktree (OBS-27); failure here must never fail worktree creation
-export function linkNodeModules(repo, dir) {
+// OBS-41/OBS-47: the harness provisions node_modules as a symlink into the main repo so devDep-based
+// gates (tsx, vitest) resolve in a bare worktree. Provisioning (createWorktree) calls this LENIENT —
+// create the link only when dest is absent, never clobber (best-effort, never fails worktree creation).
+// The pre-gate re-assert (OBS-47) calls this with force:true — a worker that deleted/replaced the link
+// (real directory, wrong/broken symlink) is restored to the provisioned link. Idempotent: an
+// already-correct link is a no-op. Returns whether dest is the provisioned link: provisioning ignores
+// the result; the pre-gate caller treats false as a named environmental park, never a masked test red.
+export function linkNodeModules(repo, dir, { force = false } = {}) {
     const src = join(repo, "node_modules");
     const dest = join(dir, "node_modules");
-    if (!existsSync(src) || existsSync(dest))
-        return;
+    if (!existsSync(src))
+        return true; // nothing provisioned to link — correct state is no link (OBS-27 best-effort)
     try {
+        if (lstatSync(dest).isSymbolicLink() && readlinkSync(dest) === src)
+            return true; // already the provisioned link
+    }
+    catch { /* dest absent — fall through to create */ }
+    if (!force && existsSync(dest))
+        return false; // lenient provisioning (OBS-41): never clobber an existing entry
+    try {
+        rmSync(dest, { recursive: true, force: true }); // force tolerates absent; clears a wrong link / real dir / file
         symlinkSync(src, dest, "dir");
+        return true;
+    }
+    catch {
+        return false;
     }
-    catch { /* best-effort */ }
 }
+// OBS-47: the worktree layout the harness provisions, stated in the worker prompt so cheap-tier workers
+// stop tripping the scope gate by committing/deleting/replacing node_modules. The harness re-asserts the
+// link itself before gates regardless (gates never trust worker claims) — this contract just keeps the
+// worker from spending an attempt on environment repair.
+export const WORKTREE_LAYOUT_CONTRACT = `## Worktree layout contract (harness-provisioned — do not modify)
+- node_modules is a symlink into the main repo's node_modules, provisioned by tickmarkr. Never commit, delete, or replace it — the harness re-asserts this link before gates run, so modifying it cannot help and may fail your attempt.`;
 export async function removeWorktree(repo, dir) {
     await sh(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
     await sh(`rm -rf ${shq(dir)}`, repo);

package/dist/run/merge.js

@@ -3,14 +3,14 @@ import { join } from "node:path";
 import { shq } from "../adapters/types.js";
 import { fingerprint } from "../gates/baseline.js";
 import { tickmarkrDir } from "../graph/graph.js";
-import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shOk } from "./git.js";
+import { gitHead, linkNodeModules, resolveIntegrationBranch, sh, shOk, WORKTREES_DIR } from "./git.js";
 export function integrationBranch(cfg, runId) {
     return `${cfg.integrationBranchPrefix}${runId}`;
 }
 const sanitize = (branch) => branch.replace(/[^\w.-]+/g, "-");
 export async function ensureIntegration(repo, branch, baseRef) {
     branch = await resolveIntegrationBranch(repo, branch);
-    const dir = join(tickmarkrDir(repo), "worktrees", sanitize(branch));
+    const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (!existsSync(join(dir, ".git"))) {
         const exists = (await sh(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
         if (exists) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.42.0",
+  "version": "1.43.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",