tickmarkr 1.61.0 → 1.62.0

package/dist/compile/native.js

@@ -118,24 +118,89 @@ export function compileNative(file) {
         throw new CompileError(`acceptance criteria are required on every task. Missing on: ${missing.join(", ")}.\n` +
             `Add to each section in ${file}:\n- acceptance:\n  - <observable outcome>`);
     }
-    const csv = (value) => (value && value.toLowerCase() !== "none" ? value.split(",").map((item) => item.trim()).filter(Boolean) : []);
+    // v1.62 (OBS-97): commas inside {a,b} alternatives are part of one glob entry, not separators —
+    // split only at brace depth 0 so a brace glob reaches the lint (and the scope gate) intact.
+    const splitTop = (value) => {
+        const parts = [];
+        let depth = 0;
+        let current = "";
+        for (const ch of value) {
+            if (ch === "," && depth === 0) {
+                parts.push(current);
+                current = "";
+                continue;
+            }
+            if (ch === "{")
+                depth++;
+            else if (ch === "}" && depth > 0)
+                depth--;
+            current += ch;
+        }
+        return [...parts, current];
+    };
+    const csv = (value) => (value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => item.trim()).filter(Boolean) : []);
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
     // consult diagnosed exactly this. Empty files[] stays exempt: no file scope means unrestricted
     // (src/gates/scope.ts). An entry hosts a collectable path iff its glob can produce one — probed by
-    // substituting each wildcard run with a test-shaped segment (also covers literal test-file paths).
+    // substituting each wildcard run with a test-shaped segment (also covers literal test-file paths);
+    // v1.62 extends the probe to {a,b} brace alternatives and ? single-character wildcards.
     const collectable = picomatch(COLLECTABLE_TESTS, { dot: true });
     // Single-token substitution is not a true glob-overlap test (tests/**/*.ts needs "probe.test",
     // a bare ** needs the whole collectable path) — probe with several test-shaped tokens and accept
     // if ANY candidate satisfies both globs. Scopes that truly cannot host one still fail every probe.
     const PROBE_TOKENS = ["probe.test.ts", "probe.test", "tests/probe.test.ts"];
+    // v1.62: {a,b} alternatives expand to concrete branches before probing (innermost group first, so
+    // nesting resolves); an unbalanced brace is literal to picomatch and stays unexpanded. Expansion is
+    // BOUNDED: past BRANCH_CAP branches, further alternatives are dropped — dropping candidates can only
+    // reject, never accept (every accept needs a concrete witness), so the cap stays fail-closed while a
+    // pathological {a,b}{a,b}… entry can no longer balloon compile time.
+    const BRANCH_CAP = 64;
+    const expandBraces = (glob) => {
+        let branches = [glob];
+        for (;;) {
+            let changed = false;
+            const next = [];
+            for (const branch of branches) {
+                const inner = branch.match(/\{([^{}]*)\}/);
+                if (!inner) {
+                    next.push(branch);
+                    continue;
+                }
+                changed = true;
+                for (const alt of inner[1].split(","))
+                    next.push(branch.replace(inner[0], alt));
+            }
+            branches = next.slice(0, BRANCH_CAP);
+            if (!changed)
+                return branches;
+        }
+    };
+    // v1.62: a ? never blocks self-match (it matches any one char), so hosting hinges on the probe
+    // clearing the collectable literals — search ? positions over that alphabet PER POSITION (a mixed
+    // scope like test?/unit.tes?.ts needs different chars at each ?). Every accepted probe is a concrete
+    // path satisfying BOTH globs (a witness), so expansion and substitution can only lift false
+    // rejections — a scope with no witness still fails every probe. Bounded: entries with more than
+    // QMARK_CAP ?s stay fail-closed (4^4 = 256 candidates is the ceiling per probe).
+    const QMARK_CHARS = ["t", "e", "s", "."];
+    const QMARK_CAP = 4;
+    const qmarkVariants = (probe) => {
+        const qCount = (probe.match(/\?/g) ?? []).length;
+        if (qCount === 0 || qCount > QMARK_CAP)
+            return [probe];
+        let variants = [probe];
+        for (let i = 0; i < qCount; i++) {
+            variants = variants.flatMap((v) => QMARK_CHARS.map((ch) => v.replace("?", ch)));
+        }
+        return [probe, ...variants];
+    };
     const canHostTest = (entry) => {
         const self = picomatch(entry, { dot: true });
-        return PROBE_TOKENS.some((token) => {
-            const probe = entry.replace(/\*+/g, token);
-            return self(probe) && collectable(probe);
-        });
+        return expandBraces(entry)
+            .flatMap((branch) => PROBE_TOKENS.map((token) => branch.replace(/\*+/g, token)))
+            .flatMap(qmarkVariants)
+            .some((probe) => self(probe) && collectable(probe));
     };
     const homeless = drafts
         .filter((draft) => {

package/dist/drivers/herdr.d.ts

@@ -1,6 +1,7 @@
 import { type ExecutorDriver, type NotifyOpts, type Slot, type SlotOpts } from "./types.js";
 export declare const TRAILER_SAFE_FLOOR_COLS = 108;
 export declare const TRAILER_WIDTH_MARGIN = 2;
+export declare const DELIVERY_ATTEMPTS = 3;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export declare function workerSplitDirection(paneCols: number | null, safeFloor?: number, margin?: number): "right" | "down";
 export declare class HerdrDriver implements ExecutorDriver {

package/dist/drivers/herdr.js

@@ -6,6 +6,10 @@ import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName }
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
 export const TRAILER_SAFE_FLOOR_COLS = 108;
 export const TRAILER_WIDTH_MARGIN = 2; // cols below (floor + margin) refuse a rightward first split
+// OBS-85 verified delivery: bounded type→read-back→enter attempts before failing closed.
+export const DELIVERY_ATTEMPTS = 3;
+const DELIVERY_VERIFY_TIMEOUT_MS = 2000; // per attempt — a paste that hasn't rendered in 2s is retyped
+const DELIVERY_READ_LINES = 80;
 /** First-generation join direction from measured trailer-safe floor (43-MEASUREMENT.md). */
 export function workerSplitDirection(paneCols, safeFloor = TRAILER_SAFE_FLOOR_COLS, margin = TRAILER_WIDTH_MARGIN) {
     if (paneCols == null || paneCols <= 0)
@@ -273,11 +277,41 @@ export class HerdrDriver {
         await this.renameGroupTab(entry);
         return { id: pane, name, cwd, tabId: entry.tabId, group };
     }
+    // OBS-85 verified delivery: a pane paste can interleave a long dispatch line with itself (codex
+    // `$(git rev-parse…)` mashed into its trailing printf — v1.58 T2 attempts 2-4, v1.61 T10). Never
+    // the atomic `pane run` (text+Enter in one request, uninspectable between the two): type WITHOUT
+    // enter, read the pane back — `wait output --match` checks the same unwrapped transcript pane
+    // read exposes, event-driven so wrap and render timing can't race the check — and press Enter
+    // only when that read-back contains the typed command. A corrupted paste is captured (pane read),
+    // cleared (C-u), and retyped, bounded; persistent corruption fails closed WITH the captured
+    // transcript — the dispatch-time pincer the ledger asks for, not post-hoc `git:` archaeology.
     async run(slot, cmd) {
         const pane = await this.paneId(slot);
-        const r = await this.herdr(`pane run ${shq(pane)} ${shq(cmd)}`, slot.cwd);
-        if (r.code !== 0)
-            throw new Error(`herdr pane run failed: ${r.stderr || r.stdout}`);
+        let transcript = "";
+        for (let attempt = 0; attempt < DELIVERY_ATTEMPTS; attempt++) {
+            if (attempt > 0) {
+                // clear the corrupted input line before retyping; a failed clear must NOT be retyped onto —
+                // corrupt-prefix + clean-retype would concatenate and false-verify by containment
+                const cleared = await this.herdr(`pane send-keys ${shq(pane)} C-u`, slot.cwd);
+                if (cleared.code !== 0)
+                    throw new Error(`herdr delivery clear failed — refusing to retype onto a corrupted line (OBS-85); pane transcript:\n${transcript}`);
+            }
+            const typed = await this.herdr(`pane send-text ${shq(pane)} ${shq(cmd)}`, slot.cwd);
+            if (typed.code !== 0)
+                throw new Error(`herdr pane send-text failed: ${typed.stderr || typed.stdout}`);
+            const back = await this.herdr(`wait output ${shq(pane)} --match ${shq(cmd)} --timeout ${DELIVERY_VERIFY_TIMEOUT_MS}`, slot.cwd, DELIVERY_VERIFY_TIMEOUT_MS + 15_000);
+            // ponytail: transcript containment (scrollback included); anchor to the prompt line if a
+            // prior echo of the same command ever false-verifies. Dead pane → error envelope → unverified.
+            if (this.waitOk(back.code, back.stdout)) {
+                const enter = await this.herdr(`pane send-keys ${shq(pane)} Enter`, slot.cwd);
+                if (enter.code !== 0)
+                    throw new Error(`herdr pane send-keys Enter failed: ${enter.stderr || enter.stdout}`);
+                return;
+            }
+            // capture the corrupted delivery BEFORE clearing it — the OBS-85 byte-level evidence
+            transcript = (await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${DELIVERY_READ_LINES}`, slot.cwd)).stdout;
+        }
+        throw new Error(`herdr delivery corrupted after ${DELIVERY_ATTEMPTS} attempts — enter never pressed (OBS-85); pane transcript:\n${transcript}`);
     }
     waitOk(code, stdout) {
         if (code !== 0 || !stdout.trim())

package/dist/run/daemon.js

@@ -7,7 +7,7 @@ import { stringify } from "yaml";
 import { trailerPattern, writePrompt } from "../adapters/prompt.js";
 import { allAdapters, discoverChannels, getAdapter, probeAll, readDoctor } from "../adapters/registry.js";
 import { addUsage, channelKey, matchesTrustDialog, QUOTA_RE } from "../adapters/types.js";
-import { bannerShell } from "../brand.js";
+import { bannerShell, paneDispatchCommand } from "../brand.js";
 import { globalConfigDir, loadConfigWithMode, readOverlayFile, repoOverlayPath, } from "../config/config.js";
 import { herdrSealShellPrefix, SubprocessDriver } from "../drivers/subprocess.js";
 import { formatOwnedName } from "../drivers/types.js";
@@ -575,6 +575,19 @@ export async function runDaemon(repoRoot, opts = {}) {
                     journal.append("worker-mode-fallback", t.id, { reason: driver.interactive ? "adapter" : "driver" });
                 }
                 const interactive = icmd !== null;
+                // OBS-85 (v1.62 T1): both dispatch branches deliver ONE short script invocation — banner,
+                // adapter command, and nonce exit marker live in a per-attempt script beside the prompt
+                // artifact (the same paneDispatchCommand pattern judge/review/consult dispatches use). The
+                // delivered pane line carries no command substitution and no trailing shell text, so paste
+                // timing can never interleave a `$(…)` with what follows it (the codex corruption class).
+                const workerCmd = interactive ? icmd : adapter.invoke(t, wt, assignment, { promptFile }).command;
+                const dispatchScript = promptFile.replace(/\.md$/, ".sh");
+                writeFileSync(dispatchScript, [
+                    "export BASH_SILENCE_DEPRECATION_WARNING=1",
+                    bannerShell(),
+                    workerCmd,
+                    exitMarkerCmd,
+                ].join("\n"));
                 // SPEND-01: this attempt's dispatch wall-clock — the usage collect cursor. Captured once here, the
                 // single site, so a test can reason about it; keep Date.now() out of profile.ts (still pure) and
                 // out of adapter module scope (the cursor is a parameter, threaded from the daemon).
@@ -617,9 +630,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                 if (interactive) {
                     // v1.2 interactive: the TUI doesn't exit on completion — the trailer is the finish line.
                     // The exit wrapper still fires if the TUI dies (crash/quit): fast-fail instead of burning the timeout.
-                    // T5: the pane announces itself first — same brand header (logo + dim identity) as the
-                    // judge/review/consult dispatch scripts; one printf one-liner, dispatch mechanics unchanged.
-                    await driver.run(slot, `${bannerShell()}; ${icmd}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     let paged = false;
                     // v1.22 T5 / OBS-19: auto-answer a fingerprint-matched trust dialog exactly once per slot.
                     // Any other blocked/idle dialog still pages the operator (paged latch below).
@@ -708,9 +719,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 else {
-                    const inv = adapter.invoke(t, wt, assignment, { promptFile });
-                    // T5: same brand header as the interactive path and the gate/consult dispatch scripts.
-                    await driver.run(slot, `${bannerShell()}; ${inv.command}; ${exitMarkerCmd}`);
+                    await driver.run(slot, paneDispatchCommand(dispatchScript));
                     // OBS-54: headless workers have the same output-inactivity budget as visible panes.
                     // OBS-82: same normalized-snapshot compare as the interactive site — spinner-only repaints
                     // exhaust the budget here too; harvest below still reads the raw pane.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "1.61.0",
+  "version": "1.62.0",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",