triflux 10.20.0 → 10.20.2

package/hub/team/cli/services/native-control.mjs

@@ -79,6 +79,7 @@ export async function startNativeSupervisor({
       {
         sessionName: sessionId,
         hubUrl,
+        workdir: process.cwd(),
         startupDelayMs: 3000,
         logsDir,
         runtimeFile: runtimePath,

package/hub/team/conductor.mjs

@@ -45,6 +45,7 @@ import {
   registerSynapseSession,
   unregisterSynapseSession,
 } from "./synapse-http.mjs";
+import { buildWorkerSandboxEnv } from "./worker-sandbox.mjs";
 
 /** 세션 상태 */
 export const STATES = Object.freeze({
@@ -87,16 +88,24 @@ const DEFAULT_GRACE_MS = 10_000;
  * @param {'codex'|'gemini'} agent
  * @param {string} sessionId — 로깅용
  * @param {object} eventLog — createEventLog 인스턴스
+ * @param {object} brokerInstance — AccountBroker 인스턴스
  */
-function swapAuthFile(lease, agent, sessionId, eventLog) {
+function swapAuthFile(
+  lease,
+  agent,
+  sessionId,
+  eventLog,
+  brokerInstance,
+  targetEnv = {},
+) {
   if (lease?.mode !== "auth" || !lease.authFile) return true;
   if (
     agent === "codex" &&
     lease.id &&
-    broker &&
-    typeof broker.syncAuthToSource === "function"
+    brokerInstance &&
+    typeof brokerInstance.syncAuthToSource === "function"
   ) {
-    const result = broker.syncAuthToSource(lease.id);
+    const result = brokerInstance.syncAuthToSource(lease.id);
     if (result?.copied || result?.reason === "up_to_date") {
       eventLog.append("auth_copy", {
         session: sessionId,
@@ -113,12 +122,14 @@ function swapAuthFile(lease, agent, sessionId, eventLog) {
     });
     return false;
   }
+  const targetHome = targetEnv.HOME || homedir();
+  const codexHome = targetEnv.CODEX_HOME || join(targetHome, ".codex");
   const dests =
     agent === "codex"
-      ? [join(homedir(), ".codex", "auth.json")]
+      ? [join(codexHome, "auth.json")]
       : [
-          join(homedir(), ".gemini", "oauth_creds.json"),
-          join(homedir(), ".gemini", "gemini-credentials.json"),
+          join(targetHome, ".gemini", "oauth_creds.json"),
+          join(targetHome, ".gemini", "gemini-credentials.json"),
         ];
   let allOk = true;
   for (const dest of dests) {
@@ -182,6 +193,7 @@ export function createConductor(opts = {}) {
     baseUrl: opts.synapseBaseUrl,
     fetchImpl: opts.synapseFetch,
   };
+  const getActiveBroker = () => optsBroker ?? broker;
 
   function buildSynapseMeta(session, state = session.state, reason = "") {
     return {
@@ -486,13 +498,14 @@ export function createConductor(opts = {}) {
       emitter.emit("dead", { sessionId: session.id, reason });
 
       // broker release on final death
-      if (broker && session.config.accountId) {
-        broker.release(session.config.accountId, {
+      const activeBroker = getActiveBroker();
+      if (activeBroker && session.config.accountId) {
+        activeBroker.release(session.config.accountId, {
           ok: false,
           failureMode: session.lastFailureMode,
         });
         if (session.lastFailureMode === "rate_limited") {
-          broker.markRateLimited(session.config.accountId, 5 * 60 * 1000);
+          activeBroker.markRateLimited(session.config.accountId, 5 * 60 * 1000);
         }
       }
     }
@@ -568,19 +581,26 @@ export function createConductor(opts = {}) {
       }
     }
 
+    const spawnEnv = {
+      ...process.env,
+      ...launcher.env,
+      ...(session.config.env || {}),
+      ...(session.config.branchGuard ? { TRIFLUX_GIT_BRANCH_GUARD: "1" } : {}),
+    };
+    if (session.config.workerSandbox?.root) {
+      eventLog.append("worker_sandbox_env", {
+        session: session.id,
+        root: session.config.workerSandbox.root,
+        codeHomePreserved: Boolean(spawnEnv.CODEX_HOME),
+      });
+    }
+
     let child;
     try {
       child = spawnFn(spawnSpec.command, spawnSpec.args, {
         shell: false,
         cwd: spawnCwd,
-        env: {
-          ...process.env,
-          ...launcher.env,
-          ...(session.config.env || {}),
-          ...(session.config.branchGuard
-            ? { TRIFLUX_GIT_BRANCH_GUARD: "1" }
-            : {}),
-        },
+        env: spawnEnv,
         reason: `conductor:respawnSession:${session.id}`,
         stdio: ["pipe", "pipe", "pipe"],
         windowsHide: true,
@@ -699,8 +719,9 @@ export function createConductor(opts = {}) {
             completionPayload,
           });
         }
-        if (broker && session.config.accountId) {
-          broker.release(session.config.accountId, { ok: true });
+        const activeBroker = getActiveBroker();
+        if (activeBroker && session.config.accountId) {
+          activeBroker.release(session.config.accountId, { ok: true });
         }
       } else {
         // detect rate_limited from recent output before handleFailure
@@ -1001,10 +1022,11 @@ export function createConductor(opts = {}) {
 
     // broker lease (graceful — broker null if accounts.json absent)
     let lease = null;
-    if (broker && config.agent && !config.remote) {
-      lease = broker.lease({ provider: config.agent });
+    const activeBroker = getActiveBroker();
+    if (activeBroker && config.agent && !config.remote) {
+      lease = activeBroker.lease({ provider: config.agent });
       if (lease === null) {
-        const eta = broker.nextAvailableEta(config.agent);
+        const eta = activeBroker.nextAvailableEta(config.agent);
         eventLog.append("broker_no_lease", {
           session: config.id,
           agent: config.agent,
@@ -1016,17 +1038,47 @@ export function createConductor(opts = {}) {
     }
 
     // apply lease profile/env/auth to config (immutable — new object)
-    const resolvedConfig = lease
+    const leaseEnv =
+      lease?.authFile && config.agent === "codex"
+        ? { ...(lease.env || {}), CODEX_HOME: dirname(lease.authFile) }
+        : lease?.env || {};
+
+    let resolvedConfig = lease
       ? {
           ...config,
           profile: lease.profile ?? config.profile,
-          env: { ...(config.env || {}), ...(lease.env || {}) },
+          env: { ...(config.env || {}), ...leaseEnv },
           accountId: lease.id,
         }
-      : config;
+      : {
+          ...config,
+          env: { ...(config.env || {}) },
+        };
+
+    if (!resolvedConfig.remote) {
+      const sandbox = buildWorkerSandboxEnv({
+        cwd: resolvedConfig.workdir || process.cwd(),
+        sessionId: resolvedConfig.id,
+        env: { ...process.env, ...(resolvedConfig.env || {}) },
+      });
+      resolvedConfig = {
+        ...resolvedConfig,
+        env: { ...(resolvedConfig.env || {}), ...sandbox.env },
+        workerSandbox: sandbox.disabled
+          ? { disabled: true }
+          : { root: sandbox.root, home: sandbox.home },
+      };
+    }
 
     // auth file copy — broker resolved absolute path, conductor does the actual copy
-    swapAuthFile(lease, config.agent, config.id, eventLog);
+    swapAuthFile(
+      lease,
+      config.agent,
+      config.id,
+      eventLog,
+      activeBroker,
+      resolvedConfig.env,
+    );
 
     // 원격 세션은 launcher 불필요 (이미 원격에서 실행 중)
     const launcher = resolvedConfig.remote
@@ -1188,8 +1240,21 @@ export function createConductor(opts = {}) {
 
           const newLease = brokerInstance.lease({ provider });
           if (!newLease) continue;
-
-          swapAuthFile(newLease, provider, session.id, eventLog);
+          if (newLease.authFile && provider === "codex") {
+            session.config.env = {
+              ...(session.config.env || {}),
+              CODEX_HOME: dirname(newLease.authFile),
+            };
+          }
+
+          swapAuthFile(
+            newLease,
+            provider,
+            session.id,
+            eventLog,
+            brokerInstance,
+            session.config.env,
+          );
           eventLog.append("tier_fallback_swap", {
             session: session.id,
             agent: provider,

package/hub/team/native-supervisor.mjs

@@ -15,6 +15,7 @@ import {
 } from "../lib/bash-path.mjs";
 import { verifySlimWrapperRouteExecution } from "./native.mjs";
 import { forceCleanupTeam } from "./nativeProxy.mjs";
+import { buildWorkerSandboxEnv } from "./worker-sandbox.mjs";
 
 const ROUTE_LOG_TAIL_BYTES = 65536;
 
@@ -116,6 +117,7 @@ function memberStateSnapshot() {
       routeVerification: state?.routeVerification || null,
       logFile: state?.logFile || null,
       errFile: state?.errFile || null,
+      workerSandboxRoot: state?.workerSandboxRoot || null,
     });
   }
   return states;
@@ -164,15 +166,25 @@ function spawnMember(member) {
   const outWs = createWriteStream(outPath, { flags: "a" });
   const errWs = createWriteStream(errPath, { flags: "a" });
 
+  const baseEnv = {
+    ...process.env,
+    TERM:
+      process.env.TERM && process.env.TERM !== "dumb"
+        ? process.env.TERM
+        : "xterm-256color",
+  };
+  const sandbox =
+    member.role === "worker"
+      ? buildWorkerSandboxEnv({
+          cwd: config.workdir || process.cwd(),
+          sessionId: `${sessionName}-${member.name}`,
+          env: baseEnv,
+        })
+      : { env: {}, root: null };
+
   const child = spawn(command, {
     shell: true,
-    env: {
-      ...process.env,
-      TERM:
-        process.env.TERM && process.env.TERM !== "dumb"
-          ? process.env.TERM
-          : "xterm-256color",
-    },
+    env: { ...baseEnv, ...sandbox.env },
     stdio: ["pipe", "pipe", "pipe"],
     windowsHide: true,
   });
@@ -187,6 +199,7 @@ function spawnMember(member) {
     status: "running",
     exitCode: null,
     lastPreview: "",
+    workerSandboxRoot: sandbox.root || null,
   };
 
   child.stdout.on("data", (buf) => {

package/hub/team/swarm-cli.mjs

@@ -5,6 +5,10 @@ import { existsSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { createSwarmHypervisor } from "./swarm-hypervisor.mjs";
 import { planSwarm } from "./swarm-planner.mjs";
+import {
+  formatPreflightReport,
+  runSwarmPreflight,
+} from "./swarm-preflight.mjs";
 
 const RESET = "\u001b[0m";
 const BOLD = "\u001b[1m";
@@ -150,10 +154,44 @@ function printPlan(plan) {
   }
 }
 
+function formatCell(value, width) {
+  const text = value == null || value === "" ? "-" : String(value);
+  return text.padEnd(width).slice(0, width);
+}
+
+export function formatIntegrationReport(report = []) {
+  const rows = Array.isArray(report) ? report : [];
+  const lines = [
+    "=== INTEGRATION REPORT ===",
+    "SHARD     STRATEGY       COMMITS  FINAL_SHA  NOTES",
+  ];
+
+  let integrated = 0;
+  let recoveryPatches = 0;
+  for (const row of rows) {
+    if (row.strategy !== "failed") integrated += 1;
+    if (row.recoveryPatch) recoveryPatches += 1;
+    const finalSha = row.finalSha ? String(row.finalSha).slice(0, 7) : "-";
+    const notes = row.recoveryPatch
+      ? `${row.notes || "failed"}; recovery: ${row.recoveryPatch}`
+      : row.notes || "-";
+    lines.push(
+      `${formatCell(row.shard, 9)} ${formatCell(row.strategy, 14)} ${formatCell(row.commits, 8)} ${formatCell(finalSha, 10)} ${notes}`,
+    );
+  }
+
+  const total = rows.length;
+  lines.push("");
+  lines.push(
+    `TOTAL: ${integrated}/${total} integrated, ${recoveryPatches} recovery patch${recoveryPatches === 1 ? "" : "es"} saved.`,
+  );
+  return lines.join("\n");
+}
+
 /**
  * tfx swarm <prd-path> — PRD 실행
  */
-export async function cmdSwarmRun(args, { json = false } = {}) {
+export async function cmdSwarmRun(args, { json = false, deps = {} } = {}) {
   const { flags, positional } = parseFlags(args);
   flags.json = flags.json || json;
 
@@ -168,9 +206,10 @@ export async function cmdSwarmRun(args, { json = false } = {}) {
     throw new Error(`PRD file not found: ${absPrd}`);
   }
 
-  const plan = planSwarm(absPrd, { repoRoot: process.cwd() });
-
   if (flags.dryRun) {
+    const plan = (deps.planSwarm || planSwarm)(absPrd, {
+      repoRoot: process.cwd(),
+    });
     if (flags.json) {
       process.stdout.write(JSON.stringify(planToJson(plan), null, 2) + "\n");
     } else {
@@ -179,6 +218,24 @@ export async function cmdSwarmRun(args, { json = false } = {}) {
     return;
   }
 
+  const preflight = (deps.runSwarmPreflight || runSwarmPreflight)(absPrd, {
+    repoRoot: process.cwd(),
+    deps,
+  });
+  if (!preflight.ok) {
+    if (flags.json) {
+      process.stdout.write(JSON.stringify(preflight, null, 2) + "\n");
+    } else {
+      process.stderr.write(formatPreflightReport(preflight));
+    }
+    process.exitCode = 1;
+    return;
+  }
+
+  const plan = (deps.planSwarm || planSwarm)(absPrd, {
+    repoRoot: process.cwd(),
+  });
+
   const ttyGate = assertTtyForSwarm();
   for (const w of ttyGate.warnings) {
     console.error(`  ${YELLOW}⚠${RESET} ${w}`);
@@ -190,7 +247,7 @@ export async function cmdSwarmRun(args, { json = false } = {}) {
   const logsDir =
     flags.logsDir ||
     join(process.cwd(), ".triflux", "swarm-logs", `run-${Date.now()}`);
-  const hyper = createSwarmHypervisor({
+  const hyper = (deps.createSwarmHypervisor || createSwarmHypervisor)({
     workdir: process.cwd(),
     logsDir,
     maxRestarts: flags.maxRestarts,
@@ -257,6 +314,10 @@ export async function cmdSwarmRun(args, { json = false } = {}) {
     );
   }
 
+  if (Array.isArray(ip.report) && ip.report.length > 0) {
+    console.log(`\n${formatIntegrationReport(ip.report)}`);
+  }
+
   if (flags.json) {
     process.stdout.write(JSON.stringify(status, null, 2) + "\n");
   }
@@ -272,6 +333,39 @@ export async function cmdSwarmPlan(args, { json = false } = {}) {
   return cmdSwarmRun(["--dry-run", ...args], { json });
 }
 
+/**
+ * tfx swarm preflight <prd-path> — PRD 실행 전 no-go 리포트 출력
+ */
+export async function cmdSwarmPreflight(
+  args,
+  { json = false, deps = {} } = {},
+) {
+  const { flags, positional } = parseFlags(args);
+  flags.json = flags.json || json;
+
+  const prdPath = positional[0];
+  if (!prdPath) {
+    throw new Error(
+      "PRD path required. Usage: tfx swarm preflight <prd-path> [--json]",
+    );
+  }
+  const absPrd = resolve(prdPath);
+  if (!existsSync(absPrd)) {
+    throw new Error(`PRD file not found: ${absPrd}`);
+  }
+
+  const report = (deps.runSwarmPreflight || runSwarmPreflight)(absPrd, {
+    repoRoot: process.cwd(),
+    deps,
+  });
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(report, null, 2) + "\n");
+  } else {
+    process.stdout.write(formatPreflightReport(report));
+  }
+  if (!report.ok) process.exitCode = 1;
+}
+
 /**
  * tfx swarm list — synapse status로 위임 (swarm 세션은 synapse registry에 등록)
  */