triflux 10.46.0 → 10.47.0

package/hooks/session-start-fast.mjs

@@ -13,6 +13,7 @@
 import { execFile, execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { resolveRoleControlSnapshot } from "../hub/lib/cto-env.mjs";
 import {
   buildSynapseTaskSummary,
   drainPendingSynapse,
@@ -95,6 +96,11 @@ async function defaultResolveParticipantLakeRoot(cwd) {
  */
 export async function emitParticipantSessionStarted(stdinData, seams = {}) {
   try {
+    if (
+      !resolveRoleControlSnapshot(seams.env || process.env).auto_collect_enabled
+    ) {
+      return null;
+    }
     const payload = parseStartPayload(stdinData);
     const sessionId = String(payload?.session_id || "").trim();
     if (!sessionId) return null;

package/hub/lib/cto-env.mjs

@@ -38,10 +38,9 @@ export function resolveRoleControlSnapshot(env = process.env, options = {}) {
   const ctoManagerEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_MANAGER");
   const leadManagerEnabled =
     ctoManagerEnabled && isEnvOn(env, "TFX_LEAD_MANAGER");
-  const northStarEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_NORTH_STAR");
+  const northStarEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_NORTH_STAR");
   const autoCollectEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_AUTO_COLLECT");
+    masterEnabled && isEnvOn(env, "TFX_CTO_AUTO_COLLECT");
   const values = {
     master_enabled: masterEnabled,
     cto_manager_enabled: ctoManagerEnabled,

package/hub/server.mjs

@@ -72,9 +72,7 @@ import {
 } from "./state.mjs";
 import { createStoreAdapter } from "./store-adapter.mjs";
 import { createCtoAutoCollector } from "./team/cto-auto-collect.mjs";
-import { createGitPreflight } from "./team/git-preflight.mjs";
 import { nativeProxy } from "./team/nativeProxy.mjs";
-import { createSwarmLocks } from "./team/swarm-locks.mjs";
 import {
   createSynapseRegistry,
   projectPeer,
@@ -119,14 +117,6 @@ const AIMD_WINDOW_MS = 30 * 60 * 1000;
 const AIMD_INITIAL_BATCH_SIZE = 3;
 const AIMD_MIN_BATCH_SIZE = 1;
 const AIMD_MAX_BATCH_SIZE = 10;
-const SYNAPSE_VALID_OPS = new Set([
-  "checkout",
-  "rebase",
-  "cherry-pick",
-  "reset",
-  "stash-pop",
-  "worktree-remove",
-]);
 const HUB_IDLE_TIMEOUT_DEFAULT_MS = 30 * 60 * 1000;
 const HUB_IDLE_SWEEP_DEFAULT_MS = 60 * 1000;
 const STATIC_CONTENT_TYPES = Object.freeze({
@@ -1124,21 +1114,13 @@ export async function startHub({
   }
   const delegatorService = new DelegatorService({ worker: delegatorWorker });
 
-  // Synapse Layer 4: session registry + git preflight + swarm locks
+  // Synapse Layer 4: session registry
   const synapseEmitter = new EventEmitter();
   synapseEmitter.setMaxListeners(50);
   const synapseRegistry = createSynapseRegistry({
     persistPath: join(CACHE_DIR, "tfx-hub", "synapse-sessions.json"),
     emitter: synapseEmitter,
   });
-  const swarmLocks = createSwarmLocks({
-    repoRoot: PROJECT_ROOT,
-    persistPath: join(CACHE_DIR, "tfx-hub", "swarm-locks.json"),
-  });
-  const gitPreflight = createGitPreflight({
-    registry: synapseRegistry,
-    locks: swarmLocks,
-  });
   const ctoAutoCollector = createCtoAutoCollector({
     registry: synapseRegistry,
     runCollect,
@@ -1437,7 +1419,7 @@ export async function startHub({
         });
       }
 
-      // ── Synapse Layer 5: session registry + locks + preflight routes ──
+      // ── Synapse Layer 5: session registry routes ──
       // Admin/raw snapshot (loopback-only). Returns raw cwd/pid for local
       // admin/HUD use; the redacted peer surface is GET /synapse/peers.
       if (path === "/synapse/sessions" && req.method === "GET") {
@@ -1642,37 +1624,6 @@ export async function startHub({
         }
       }
 
-      if (path === "/synapse/locks" && req.method === "GET") {
-        return writeJson(res, 200, {
-          ok: true,
-          locks: swarmLocks.snapshot(),
-          ts: Date.now(),
-        });
-      }
-
-      if (path === "/synapse/preflight" && req.method === "POST") {
-        try {
-          const body = await parseBody(req);
-          const { op, args = {}, sessionContext = {} } = body;
-          if (!op || typeof op !== "string") {
-            return writeJson(res, 400, { ok: false, error: "op 필수" });
-          }
-          if (!SYNAPSE_VALID_OPS.has(op)) {
-            return writeJson(res, 400, {
-              ok: false,
-              error: `invalid op: ${op}`,
-            });
-          }
-          const result = gitPreflight.check(op, args, sessionContext);
-          return writeJson(res, 200, { ok: true, ...result });
-        } catch (err) {
-          return writeJson(res, 400, {
-            ok: false,
-            error: String(err?.message || err),
-          });
-        }
-      }
-
       if (path.startsWith("/bridge")) {
         const isBridgeStatusGet =
           path === "/bridge/status" && req.method === "GET";

package/hub/team/recovery-store.mjs

@@ -1,6 +1,6 @@
 // hub/team/recovery-store.mjs — Best-effort preservation of worker changes
 // before a dirty worktree is removed. Uses file-based `.patch` + JSON manifest
-// instead of git stash (git-preflight flags stash-pop/worktree-remove as risky).
+// instead of git stash, which is risky to pop under concurrent worktree use.
 
 import { execFile } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

package/hub/team/synapse-registry.mjs

@@ -48,9 +48,9 @@ function hasDirtyFiles(session) {
 // A session is "live" while active OR idle. Idle is an interactive session that
 // missed its heartbeat interval but is still under the TTL — alive but inactive,
 // not presumed dead. getActive() and querySessions() share this single predicate
-// so the liveness contract can't drift: getActive() feeds git-preflight's
-// dirty-file conflict guard, so dropping idle there would hide a still-live
-// interactive session's claimed paths from that safety check.
+// so the liveness contract can't drift: getActive() feeds peer discovery,
+// CTO status/hygiene and log retention, so dropping idle there would hide a
+// still-live interactive session from every one of those consumers.
 function isLiveStatus(status) {
   return status === "active" || status === "idle";
 }
@@ -337,7 +337,7 @@ export function createSynapseRegistry(opts = {}) {
     // session resuming: Claude Code re-fires SessionStart with the same
     // session_id on resume/clear/compact, so fall through and re-register
     // (revive) it. Otherwise the resumed-but-live session stays stale forever
-    // and vanishes from peer-discovery AND git-preflight's dirty-file guard.
+    // and vanishes from peer-discovery.
     const existing = sessions.get(sessionId);
     if (existing && isLiveStatus(existing.status)) {
       console.warn(
@@ -381,10 +381,13 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   // stale/expired 세션이 cutoff 넘게 누적되면 Map에서 제거.
-  // live(active/idle)는 lastHeartbeat가 오래돼도 보존 — git-preflight dirty-file 가드가 의존.
-  // Dirty stale rows keep the historical 24h window because same-id resume
-  // revives their dirty-file guard; clean stale rows expire quickly to avoid
-  // daily dummy rows after overnight operator gaps.
+  // live(active/idle) rows survive a long-stale lastHeartbeat because peer
+  // discovery and CTO status/hygiene still read them.
+  // Dirty stale rows keep the historical 24h window. Its original consumer,
+  // the git-preflight dirty-file guard, is gone and nothing populates
+  // dirtyFiles today, so this split is a candidate for collapsing into one
+  // window. Clean stale rows expire quickly to avoid daily dummy rows after
+  // overnight operator gaps.
   function pruneExpired(opts2 = {}) {
     if (destroyed) return { removed: [], count: 0 };
 
@@ -510,9 +513,9 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   function getActive() {
-    // Live = active or idle. git-preflight uses this to detect other live
-    // sessions whose dirty files would conflict; an idle interactive session is
-    // still live (process alive, dirty files on disk) and must stay visible.
+    // Live = active or idle. Peer discovery, CTO status/hygiene and log
+    // retention read this list; an idle interactive session is still live
+    // (process alive) and must stay visible to them.
     return [...sessions.values()]
       .filter((session) => isLiveStatus(session.status))
       .map((session) => cloneSession(session));

package/hub/team/worktree-lifecycle.mjs

@@ -273,6 +273,8 @@ export async function ensureWorktree({
  * @param {string} opts.baseBranch
  * @param {string} [opts.rootDir=process.cwd()]
  * @returns {Promise<{ integrationBranch: string, baseCommit: string }>}
+ * @throws {Error} when the integration branch is checked out by another
+ * worktree; this is an intentional NO-GO and leaves that worktree untouched.
  */
 export async function prepareIntegrationBranch({
   runId,
@@ -299,42 +301,17 @@ export async function prepareIntegrationBranch({
  * Rebase a shard branch onto the integration branch.
  * Uses rebase + fast-forward only (no merge commits).
  *
- * Synapse v1: when a `preflight` checker + `sessionContext` are provided,
- * the rebase is pre-flighted against active sessions' dirty files/leases.
- * Blocked rebases return `{ ok: false, preflight: decision }` without touching
- * any branch. If preflight is omitted, behavior is unchanged.
- *
  * @param {object} opts
  * @param {string} opts.shardBranch — the shard's branch name
  * @param {string} opts.integrationBranch — target integration branch
  * @param {string} [opts.rootDir=process.cwd()]
- * @param {{ checkRebase: Function } | null} [opts.preflight=null] — git-preflight instance
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
- * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string, preflight?: object }>}
+ * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string }>}
  */
 export async function rebaseShardOntoIntegration({
   shardBranch,
   integrationBranch,
   rootDir = process.cwd(),
-  preflight = null,
-  sessionContext = null,
 }) {
-  // Synapse v1 pre-flight: bail out before mutating branches when another
-  // session claims overlapping files.
-  if (preflight && sessionContext) {
-    const decision = preflight.checkRebase(
-      { branch: integrationBranch },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked rebase: ${decision.reason || "overlap"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   // #127 BUG-E accident history: this function used to checkout the
   // integration branch in rootDir, leak rootDir HEAD, and redirect later user
   // edits/commits into swarm/.../merge. Integration now happens exclusively in
@@ -458,6 +435,11 @@ export async function rebaseShardOntoIntegration({
       }
     } else {
       await rm(integrationWorktree, { recursive: true, force: true });
+      try {
+        await git(["worktree", "prune"], rootDir);
+      } catch {
+        /* best-effort metadata cleanup after a partial worktree add */
+      }
     }
   }
 }
@@ -524,40 +506,18 @@ export async function cleanupWorktree({
  * Remove a worktree and its branch.
  * Follows WT race-guard: sleep between operations.
  *
- * Synapse v1: when `preflight` + `sessionContext` are provided, the removal
- * is pre-flighted against active sessions — blocked if another session is
- * still registered to this worktree path.
- *
  * @param {object} opts
  * @param {string} opts.worktreePath
  * @param {string} [opts.branchName] — optional branch to delete
  * @param {string} [opts.rootDir=process.cwd()]
  * @param {boolean} [opts.force=false]
- * @param {{ checkWorktreeRemove: Function } | null} [opts.preflight=null]
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
  */
 export async function pruneWorktree({
   worktreePath,
   branchName,
   rootDir = process.cwd(),
   force = false,
-  preflight = null,
-  sessionContext = null,
 }) {
-  if (preflight && sessionContext) {
-    const decision = preflight.checkWorktreeRemove(
-      { worktreePath },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked worktree-remove: ${decision.reason || "active_worktree"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   const cleanupResult = await cleanupWorktree({
     worktreePath,
     branchName,

package/hub/tray-lifecycle.mjs

@@ -120,7 +120,7 @@ export function spawnTrayForHub({
   cwd = process.cwd(),
   spawnFn = spawn,
 } = {}) {
-  if (env?.TFX_HUB_AUTO_TRAY === "0") return { status: "disabled" };
+  if (env?.TFX_HUB_AUTO_TRAY !== "1") return { status: "disabled" };
   if (isWorktreeOrEphemeralHubContext({ cwd, env })) {
     return { status: "disabled", reason: "ephemeral-or-worktree-context" };
   }

package/hud/providers/codex.mjs

@@ -38,6 +38,8 @@ export function classifyBucket(bucket) {
 
 // primary/secondary를 window_minutes 기준으로 정규화
 // HUD 규약: primary=5h, secondary=1w
+// window_minutes 가 비어 있으면 길이를 모르므로 보고된 칸에 둔다(app-server 스키마에서
+// windowDurationMins 는 선택 필드). 길이를 알지만 5h/1w 가 아닌 버킷은 버린다.
 export function normalizeBuckets(rl) {
   let primary = null;
   let secondary = null;
@@ -46,6 +48,12 @@ export function normalizeBuckets(rl) {
     if (kind === "five_hour") primary = bucket;
     else if (kind === "weekly") secondary = bucket;
   }
+  if (!primary && rl.primary && rl.primary.window_minutes == null) {
+    primary = rl.primary;
+  }
+  if (!secondary && rl.secondary && rl.secondary.window_minutes == null) {
+    secondary = rl.secondary;
+  }
   return { primary, secondary };
 }
 
@@ -104,7 +112,35 @@ function isNewerSnapshot(candidate, current) {
   );
 }
 
-function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
+function positiveWindowMinutes(bucket) {
+  const minutes = Number(bucket?.window_minutes);
+  return minutes > 0 ? minutes : null;
+}
+
+// 계정 하나에는 같은 종류의 창이 한 번에 하나만 열린다. 브로커 계정이 없으면
+// ~/.codex/sessions 와 HUD 라벨이 모두 ~/.codex/auth.json 계정 하나의 것이다. 그래서
+// 세션 로그에 더 늦게 리셋되는 창이 나타났고 옛 창이 그 창이 열리기 전에만 관측됐다면,
+// 옛 창은 조기 리셋(2026-09-23 실측)이나 계정 전환으로 끝난 창이다. 프로브로만 본 창은
+// 다른 계정일 수 있어 근거로 쓰지 않는다. 새 창이 열린 뒤에도 관측된 창은 함께 도는
+// 계정이므로 max-used 후보로 남긴다.
+function isReplacedWindowGroup(group, other) {
+  if (other === group || !other.seenInSessions) return false;
+  if (other.minResetAt <= group.maxResetAt || !other.windowMinutes) {
+    return false;
+  }
+  const lastSeenMs = Date.parse(group.latest.timestamp);
+  if (!Number.isFinite(lastSeenMs)) return false;
+  // resets_at 은 실측으로 아래로 약 30초, 위로 1초 흔들리므로 가장 늦은 값으로 개시 시각을 잡는다.
+  const otherOpenedAtMs = (other.maxResetAt - other.windowMinutes * 60) * 1000;
+  return lastSeenMs <= otherOpenedAtMs;
+}
+
+function selectCodexWindowSnapshot(
+  snapshots,
+  nowSec,
+  windowKey,
+  replaceEndedWindows,
+) {
   const groups = [];
   const ungrouped = [];
 
@@ -126,19 +162,29 @@ function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
         minResetAt: resetAt,
         maxResetAt: resetAt,
         latest: snapshot,
+        seenInSessions: !snapshot.probe,
+        windowMinutes: positiveWindowMinutes(snapshot[windowKey]),
       };
       groups.push(group);
       continue;
     }
 
+    if (!snapshot.probe) group.seenInSessions = true;
+    group.windowMinutes ??= positiveWindowMinutes(snapshot[windowKey]);
     group.minResetAt = Math.min(group.minResetAt, resetAt);
     group.maxResetAt = Math.max(group.maxResetAt, resetAt);
     if (isNewerSnapshot(snapshot, group.latest)) group.latest = snapshot;
   }
 
-  const activeGroups = groups.filter(
+  const openGroups = groups.filter(
     (group) => Number(group.latest[windowKey]?.resets_at) > nowSec,
   );
+  const activeGroups = replaceEndedWindows
+    ? openGroups.filter(
+        (group) =>
+          !openGroups.some((other) => isReplacedWindowGroup(group, other)),
+      )
+    : openGroups;
   let selected = null;
   if (activeGroups.length > 0) {
     selected = activeGroups
@@ -168,16 +214,18 @@ function selectCodexWindowSnapshot(snapshots, nowSec, windowKey) {
   return { snapshot: selected, activeGroupCount: activeGroups.length };
 }
 
-function selectCodexSnapshot(snapshots, nowSec) {
+function selectCodexSnapshot(snapshots, nowSec, replaceEndedWindows) {
   const primarySelection = selectCodexWindowSnapshot(
     snapshots,
     nowSec,
     "primary",
+    replaceEndedWindows,
   );
   const secondarySelection = selectCodexWindowSnapshot(
     snapshots,
     nowSec,
     "secondary",
+    replaceEndedWindows,
   );
   const primarySnapshot = primarySelection.snapshot;
   if (!primarySnapshot) return null;
@@ -198,7 +246,7 @@ function selectCodexSnapshot(snapshots, nowSec) {
   return selected;
 }
 
-function mergeRateLimitSnapshots(snapshots, nowSec) {
+function mergeRateLimitSnapshots(snapshots, nowSec, replaceEndedWindows) {
   const merged = {};
   const codexSnapshots = [];
   for (const snapshot of snapshots) {
@@ -211,7 +259,11 @@ function mergeRateLimitSnapshots(snapshots, nowSec) {
     }
   }
 
-  const codex = selectCodexSnapshot(codexSnapshots, nowSec);
+  const codex = selectCodexSnapshot(
+    codexSnapshots,
+    nowSec,
+    replaceEndedWindows,
+  );
   if (codex) merged.codex = codex;
   return merged;
 }
@@ -227,9 +279,16 @@ export function getCodexRateLimits({
   now = new Date(),
   maxLinesPerFile = 800,
   extraSnapshots = [],
+  // 교체된 창 판정(isReplacedWindowGroup). 브로커 Codex 계정이 있으면 끈다.
+  replaceEndedWindows = true,
 } = {}) {
   let syntheticBucket = null; // 최근 token_count에서 합성 (행 활성화 + 토큰 데이터용)
-  const recentSnapshots = [...extraSnapshots];
+  // 프로브도 세션 로그와 같은 window_minutes 기준으로 5h/1w 슬롯을 정한다.
+  // app-server 는 5h 창이 없으면 주간 창을 primary 로 보낸다(2026-09-23 실측).
+  const recentSnapshots = extraSnapshots.map((snapshot) => ({
+    ...snapshot,
+    ...normalizeBuckets(snapshot),
+  }));
   const nowSec = Math.floor(now.getTime() / 1000);
 
   // 7일간 스캔: 실제 rate_limits 우선, 합성 버킷은 폴백
@@ -313,7 +372,11 @@ export function getCodexRateLimits({
     }
 
     const snapshots = dayOffset <= 1 ? recentSnapshots : daySnapshots;
-    const mergedBuckets = mergeRateLimitSnapshots(snapshots, nowSec);
+    const mergedBuckets = mergeRateLimitSnapshots(
+      snapshots,
+      nowSec,
+      replaceEndedWindows,
+    );
     if (Object.keys(mergedBuckets).length > 0) {
       if (syntheticBucket) {
         const main =
@@ -369,10 +432,30 @@ export async function collectProbeSnapshots(now = new Date()) {
   );
 }
 
+// 브로커 계정은 자기 CODEX_HOME 에서 돌기 때문에, 옛 창이 전환 전 계정의 창이어도 그
+// 계정이 아직 쓰이고 있을 수 있다. accounts.json 의 codex 항목과 프로브용 인증 캐시로 판정한다.
+export function hasBrokerCodexAccounts({
+  brokerDir = CODEX_BROKER_AUTH_CACHE_DIR,
+} = {}) {
+  const accounts = readJson(join(brokerDir, "accounts.json"), null);
+  if (Array.isArray(accounts?.codex) && accounts.codex.length > 0) return true;
+  try {
+    return readdirSync(brokerDir).some((file) =>
+      /^codex-auth-.+\.json$/.test(file),
+    );
+  } catch {
+    return false;
+  }
+}
+
 export async function refreshCodexRateLimitsCache() {
   const now = new Date();
   const extraSnapshots = await collectProbeSnapshots(now);
-  const buckets = getCodexRateLimits({ now, extraSnapshots });
+  const buckets = getCodexRateLimits({
+    now,
+    extraSnapshots,
+    replaceEndedWindows: !hasBrokerCodexAccounts(),
+  });
   // buckets가 null이어도 캐시 갱신 (stale 데이터 제거)
   writeJsonSafe(CODEX_QUOTA_CACHE_PATH, { timestamp: Date.now(), buckets });
   return buckets;

package/hud/providers/cto.mjs

@@ -1,5 +1,6 @@
 import { readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
+import { resolveRoleControlSnapshot } from "../../hub/lib/cto-env.mjs";
 import {
   CTO_LAKE_CURRENT_RELATIVE_PATH,
   CTO_STATUS_LINE_MAX_CHARS,
@@ -53,6 +54,8 @@ function extractStatusLine(lines) {
 }
 
 export function readCtoStatus(options = {}) {
+  if (!resolveRoleControlSnapshot(options.env).auto_collect_enabled)
+    return null;
   try {
     const currentPath = resolveCurrentPath(options);
     const stat = statSync(currentPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "triflux",
-  "version": "10.46.0",
+  "version": "10.47.0",
   "description": "CLI-first multi-model orchestrator for Claude Code — route tasks to Codex, Antigravity, and Claude",
   "type": "module",
   "bin": {

package/scripts/setup.mjs

@@ -636,6 +636,13 @@ const SYNC_MAP = [
   // 설치본이 남지 않게 한다. hooks/ 는 플러그인 루트에서 직접 import 되는 경로라
   // 이 복사 목록의 대상이 아니다.
   ...scanLibFiles(PLUGIN_ROOT, CLAUDE_DIR),
+  // hud/providers/cto.mjs 가 ../../hub/lib/cto-env.mjs 를 정적 import 한다(ADR-0018).
+  // 의존성 없는 env 판독 모듈이라 이 파일 하나만 hud 보다 먼저 복사한다.
+  {
+    src: join(PLUGIN_ROOT, "hub", "lib", "cto-env.mjs"),
+    dst: join(CLAUDE_DIR, "hub", "lib", "cto-env.mjs"),
+    label: "hub/lib/cto-env.mjs",
+  },
   ...scanHudFiles(PLUGIN_ROOT, CLAUDE_DIR),
   {
     src: join(PLUGIN_ROOT, "scripts", "notion-read.mjs"),

package/scripts/tfx-route.sh

@@ -3539,7 +3539,7 @@ EOF
       FULL_PROMPT="$PROMPT"
     fi
     # CTO north-star: codex lane(line ~2670)과 동일하게 brief 를 prompt 앞에 주입.
-    # prepend_codex_north_star 는 CLI-agnostic (TFX_CTO_NORTH_STAR opt-out +
+    # prepend_codex_north_star 는 CLI-agnostic (TFX_CTO_NORTH_STAR opt-in +
     # .triflux/lake/current.md 만 참조) 하므로 agy 워커에서도 그대로 재사용한다.
     # sentinel 은 command-substitution 이 trailing newline 을 삼키는 것을 막는다.
     local _agy_north_star_file="${WORKDIR:-$PWD}/.triflux/lake/current.md"

package/hub/team/git-preflight.mjs

@@ -1,286 +0,0 @@
-// hub/team/git-preflight.mjs — Pre-flight safety check for dangerous git ops.
-// Blocks checkout/rebase/cherry-pick/reset/stash-pop/worktree-remove when they
-// would conflict with other active Synapse sessions' dirty files or claimed
-// leases. Fail-open by default: if registry/locks are unavailable, allow the op
-// with a warning (worktree isolation is the baseline safety net).
-
-/**
- * Factory for git pre-flight check.
- *
- * @param {object} opts
- * @param {{ getActive: () => Array<object> }} opts.registry — synapse-registry duck type
- * @param {{ snapshot: () => Array<object> }} opts.locks — swarm-locks duck type
- * @param {boolean} [opts.failOpen=true] — allow op when registry/locks throw or are missing
- * @param {(level: string, msg: string, data?: object) => void} [opts.logger] — optional logger
- * @returns {{
- *   check: Function,
- *   checkRebase: Function,
- *   checkCheckout: Function,
- *   checkCherryPick: Function,
- *   checkReset: Function,
- *   checkStashPop: Function,
- *   checkWorktreeRemove: Function,
- * }}
- */
-export function createGitPreflight(opts = {}) {
-  const { registry, locks, failOpen = true, logger = null } = opts;
-
-  function log(level, msg, data) {
-    if (logger) {
-      try {
-        logger(level, msg, data);
-      } catch {
-        /* logger failure is non-fatal */
-      }
-      return;
-    }
-    if (level === "warn") {
-      console.warn(`[git-preflight] ${msg}`, data ?? "");
-    } else if (level === "error") {
-      console.error(`[git-preflight] ${msg}`, data ?? "");
-    }
-  }
-
-  // ── helpers ──────────────────────────────────────────────
-
-  function safeGetActive() {
-    try {
-      const value = registry?.getActive?.();
-      if (!Array.isArray(value)) return null;
-      return value;
-    } catch (err) {
-      log("warn", "registry.getActive threw", { error: err?.message });
-      return null;
-    }
-  }
-
-  function safeSnapshot() {
-    try {
-      const value = locks?.snapshot?.();
-      if (!Array.isArray(value)) return null;
-      return value;
-    } catch (err) {
-      log("warn", "locks.snapshot threw", { error: err?.message });
-      return null;
-    }
-  }
-
-  function failOpenDecision(reason) {
-    log("warn", "hub unavailable, failing open", { reason });
-    return { allowed: true, reason: "hub_unavailable_fail_open" };
-  }
-
-  function normalizeFiles(list) {
-    if (!Array.isArray(list)) return new Set();
-    return new Set(
-      list
-        .filter((f) => typeof f === "string" && f.length > 0)
-        .map((f) => f.replace(/\\/g, "/")),
-    );
-  }
-
-  function otherActiveSessions(active, sessionId) {
-    return active.filter((s) => s?.sessionId && s.sessionId !== sessionId);
-  }
-
-  function otherLeases(snapshot, workerId) {
-    return snapshot.filter(
-      (entry) => entry?.workerId && entry.workerId !== workerId,
-    );
-  }
-
-  function buildConflict(file, session, holder) {
-    return {
-      file,
-      activeSession: session?.sessionId ?? holder ?? "unknown",
-      activeTask: session?.taskSummary ?? "",
-      ...(holder ? { leaseHolder: holder } : {}),
-    };
-  }
-
-  function recommend(conflicts) {
-    if (!conflicts.length) return "";
-    const first = conflicts[0];
-    const owner = first.leaseHolder || first.activeSession;
-    const task = first.activeTask ? ` Active task: '${first.activeTask}'` : "";
-    return `Wait for '${owner}' to finish, or coordinate via HITL.${task}`;
-  }
-
-  function blockedDecision(op, conflicts, extraReason) {
-    return {
-      allowed: false,
-      reason: extraReason || "overlap_with_active_session",
-      conflicts,
-      recommendation: recommend(conflicts),
-      op,
-    };
-  }
-
-  function allowedDecision() {
-    return { allowed: true };
-  }
-
-  // ── shared scanners ─────────────────────────────────────
-
-  function findDirtyFileConflicts(sessionId, workerId) {
-    const active = safeGetActive();
-    const snapshot = safeSnapshot();
-
-    if (active == null || snapshot == null) {
-      return failOpen ? { fallOpen: true } : { fallOpen: false, conflicts: [] };
-    }
-
-    const conflicts = [];
-    const seen = new Set();
-
-    for (const session of otherActiveSessions(active, sessionId)) {
-      const dirty = normalizeFiles(session.dirtyFiles);
-      for (const file of dirty) {
-        if (seen.has(file)) continue;
-        seen.add(file);
-        conflicts.push(buildConflict(file, session));
-      }
-    }
-
-    for (const lease of otherLeases(snapshot, workerId)) {
-      if (lease.leaseType && lease.leaseType !== "exclusive") continue;
-      const file = typeof lease.file === "string" ? lease.file : null;
-      if (!file || seen.has(file)) continue;
-      seen.add(file);
-      const sessionMeta = lease.sessionMeta || null;
-      conflicts.push(
-        buildConflict(
-          file,
-          sessionMeta
-            ? {
-                sessionId: sessionMeta.sessionId || lease.workerId,
-                taskSummary: sessionMeta.taskSummary || "",
-              }
-            : null,
-          lease.workerId,
-        ),
-      );
-    }
-
-    return { conflicts };
-  }
-
-  function findTargetFileConflicts(targetFiles, sessionId, workerId) {
-    const active = safeGetActive();
-    const snapshot = safeSnapshot();
-
-    if (active == null || snapshot == null) {
-      return failOpen ? { fallOpen: true } : { fallOpen: false, conflicts: [] };
-    }
-
-    const targets = normalizeFiles(targetFiles);
-    if (targets.size === 0) return { conflicts: [] };
-
-    const conflicts = [];
-    const seen = new Set();
-
-    for (const session of otherActiveSessions(active, sessionId)) {
-      const dirty = normalizeFiles(session.dirtyFiles);
-      for (const file of dirty) {
-        if (!targets.has(file) || seen.has(file)) continue;
-        seen.add(file);
-        conflicts.push(buildConflict(file, session));
-      }
-    }
-
-    for (const lease of otherLeases(snapshot, workerId)) {
-      if (lease.leaseType && lease.leaseType !== "exclusive") continue;
-      const file = typeof lease.file === "string" ? lease.file : null;
-      if (!file || !targets.has(file) || seen.has(file)) continue;
-      seen.add(file);
-      const sessionMeta = lease.sessionMeta || null;
-      conflicts.push(
-        buildConflict(
-          file,
-          sessionMeta
-            ? {
-                sessionId: sessionMeta.sessionId || lease.workerId,
-                taskSummary: sessionMeta.taskSummary || "",
-              }
-            : null,
-          lease.workerId,
-        ),
-      );
-    }
-
-    return { conflicts };
-  }
-
-  // ── public API ──────────────────────────────────────────
-
-  /**
-   * Core pre-flight check.
-   *
-   * @param {"checkout"|"rebase"|"cherry-pick"|"reset"|"stash-pop"|"worktree-remove"} op
-   * @param {{ targetFiles?: string[], branch?: string, ref?: string, worktreePath?: string }} args
-   * @param {{ sessionId: string, workerId?: string }} sessionContext
-   * @returns {{ allowed: boolean, reason?: string, conflicts?: object[], recommendation?: string, op?: string }}
-   */
-  function check(op, args = {}, sessionContext = {}) {
-    const sessionId = sessionContext.sessionId || "";
-    const workerId = sessionContext.workerId || sessionId;
-
-    switch (op) {
-      case "checkout":
-      case "rebase":
-      case "reset":
-      case "stash-pop": {
-        const res = findDirtyFileConflicts(sessionId, workerId);
-        if (res.fallOpen) return failOpenDecision(op);
-        if (res.conflicts.length > 0) return blockedDecision(op, res.conflicts);
-        return allowedDecision();
-      }
-      case "cherry-pick": {
-        const targets = Array.isArray(args.targetFiles) ? args.targetFiles : [];
-        const res = findTargetFileConflicts(targets, sessionId, workerId);
-        if (res.fallOpen) return failOpenDecision(op);
-        if (res.conflicts.length > 0) return blockedDecision(op, res.conflicts);
-        return allowedDecision();
-      }
-      case "worktree-remove": {
-        const active = safeGetActive();
-        if (active == null) return failOpenDecision(op);
-        const target =
-          typeof args.worktreePath === "string"
-            ? args.worktreePath.replace(/\\/g, "/")
-            : "";
-        if (!target) return allowedDecision();
-        const conflicts = [];
-        for (const session of otherActiveSessions(active, sessionId)) {
-          const sessionPath =
-            typeof session.worktreePath === "string"
-              ? session.worktreePath.replace(/\\/g, "/")
-              : "";
-          if (sessionPath && sessionPath === target) {
-            conflicts.push({
-              file: target,
-              activeSession: session.sessionId,
-              activeTask: session.taskSummary || "",
-            });
-          }
-        }
-        if (conflicts.length > 0) {
-          return blockedDecision(op, conflicts, "active_worktree");
-        }
-        return allowedDecision();
-      }
-      default:
-        return allowedDecision();
-    }
-  }
-
-  return Object.freeze({
-    check,
-    checkRebase: (args, ctx) => check("rebase", args, ctx),
-    checkCheckout: (args, ctx) => check("checkout", args, ctx),
-    checkCherryPick: (args, ctx) => check("cherry-pick", args, ctx),
-    checkReset: (args, ctx) => check("reset", args, ctx),
-    checkStashPop: (args, ctx) => check("stash-pop", args, ctx),
-    checkWorktreeRemove: (args, ctx) => check("worktree-remove", args, ctx),
-  });
-}