triflux 10.46.0 → 10.48.0

package/hub/lib/codex-session-registry.mjs

@@ -0,0 +1,306 @@
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import {
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+
+export function registryDir(env = process.env) {
+  if (env.TFX_CODEX_SESSION_REGISTRY_DIR) {
+    return env.TFX_CODEX_SESSION_REGISTRY_DIR;
+  }
+  return join(
+    env.XDG_STATE_HOME || join(env.HOME || homedir(), ".local", "state"),
+    "triflux",
+    "codex-sessions",
+  );
+}
+
+function defaultPsFn(pid) {
+  try {
+    const output = execFileSync(
+      "ps",
+      ["-o", "ppid=,comm=", "-p", String(pid)],
+      {
+        encoding: "utf8",
+        timeout: 1000,
+      },
+    );
+    const match = output.match(/^\s*(\d+)\s+(.+?)\s*$/);
+    return match ? { ppid: Number(match[1]), comm: match[2] } : null;
+  } catch {
+    return null;
+  }
+}
+
+export function findCodexAncestorPid({
+  startPid = process.ppid,
+  psFn = defaultPsFn,
+  maxDepth = 8,
+} = {}) {
+  const seen = new Set();
+  let pid = startPid;
+  for (let depth = 0; depth < maxDepth; depth += 1) {
+    if (!Number.isInteger(pid) || pid <= 0 || seen.has(pid)) return null;
+    seen.add(pid);
+    let processInfo;
+    try {
+      processInfo = psFn(pid);
+    } catch {
+      return null;
+    }
+    if (!processInfo) return null;
+    if (basename(String(processInfo.comm || "")) === "codex") return pid;
+    pid = Number(processInfo.ppid);
+  }
+  return null;
+}
+
+function defaultTmuxFn(paneId) {
+  return execFileSync(
+    "tmux",
+    [
+      "display-message",
+      "-p",
+      "-t",
+      paneId,
+      "#{session_name}:#{window_id}.#{pane_id}",
+    ],
+    { encoding: "utf8", timeout: 1000 },
+  );
+}
+
+function defaultPanePidFn(paneId) {
+  return execFileSync(
+    "tmux",
+    ["display-message", "-p", "-t", paneId, "#{pane_pid}"],
+    { encoding: "utf8", timeout: 1000 },
+  );
+}
+
+function defaultCommandFn(pid) {
+  return execFileSync("ps", ["-o", "command=", "-p", String(pid)], {
+    encoding: "utf8",
+    timeout: 1000,
+  });
+}
+
+export function resolveTmuxCoordinate({ paneId, tmuxFn = defaultTmuxFn } = {}) {
+  if (typeof paneId !== "string" || !paneId.trim()) return null;
+  try {
+    const coordinate = tmuxFn(paneId).trim();
+    return /^.+:@\d+\.%\d+$/.test(coordinate) ? coordinate : null;
+  } catch {
+    return null;
+  }
+}
+
+function aliveFromPid(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+function pruneDeadRecords(dir) {
+  try {
+    for (const fileName of readdirSync(dir)) {
+      if (!/^\d+\.json$/.test(fileName)) continue;
+      const pid = Number(fileName.slice(0, -5));
+      if (Number.isSafeInteger(pid) && pid > 0 && !aliveFromPid(pid)) {
+        try {
+          unlinkSync(join(dir, fileName));
+        } catch {
+          // Registry upkeep must never affect the hook response.
+        }
+      }
+    }
+  } catch {
+    // A concurrent removal or permission change must not affect the write.
+  }
+}
+
+export function writeCodexSessionRecord(
+  payload,
+  {
+    env = process.env,
+    now = Date.now,
+    psFn = defaultPsFn,
+    tmuxFn,
+    panePidFn = defaultPanePidFn,
+    commandFn = defaultCommandFn,
+    dir = registryDir(env),
+  } = {},
+) {
+  if (typeof payload?.session_id !== "string" || !payload.session_id.trim()) {
+    return false;
+  }
+  const paneId = typeof env.TMUX_PANE === "string" ? env.TMUX_PANE.trim() : "";
+  if (!paneId) return false;
+  const pid = findCodexAncestorPid({ psFn });
+  if (pid === null) return false;
+
+  try {
+    const command = commandFn(pid);
+    if (
+      typeof command !== "string" ||
+      !command.trim() ||
+      command.includes("app-server")
+    ) {
+      return false;
+    }
+    // Split ps argv on whitespace; the first non-option after the binary is the subcommand.
+    const subcommand = command
+      .trim()
+      .split(/\s+/)
+      .slice(1)
+      .find((arg) => !arg.startsWith("-"));
+    if (subcommand === "exec") return false;
+    const panePidOutput = String(panePidFn(paneId)).trim();
+    const panePid = Number(panePidOutput);
+    if (
+      !/^\d+$/.test(panePidOutput) ||
+      !Number.isSafeInteger(panePid) ||
+      panePid <= 0
+    ) {
+      return false;
+    }
+    const seen = new Set();
+    let ancestor = pid;
+    for (let depth = 0; depth < 8 && ancestor !== panePid; depth += 1) {
+      if (
+        !Number.isSafeInteger(ancestor) ||
+        ancestor <= 0 ||
+        seen.has(ancestor)
+      ) {
+        return false;
+      }
+      seen.add(ancestor);
+      ancestor = Number(psFn(ancestor)?.ppid);
+    }
+    if (ancestor !== panePid) return false;
+  } catch {
+    // Daemons and stale panes cannot prove which TUI owns this thread.
+    return false;
+  }
+
+  const timestamp = typeof now === "function" ? now() : now;
+  const targetDir = dir;
+  const target = join(targetDir, `${pid}.json`);
+  let startedAt = timestamp;
+  let source = payload.source || null;
+  try {
+    const existing = JSON.parse(readFileSync(target, "utf8"));
+    if (existing.pid === pid && existing.sessionId === payload.session_id) {
+      if (Number.isFinite(existing.startedAt)) startedAt = existing.startedAt;
+      if (payload.source === undefined) source = existing.source || null;
+    }
+  } catch {
+    // New record, or an invalid previous record.
+  }
+
+  const record = {
+    version: 1,
+    writer: "triflux",
+    pid,
+    sessionId: payload.session_id,
+    cwd: payload.cwd || process.cwd(),
+    tmux: resolveTmuxCoordinate({ paneId, tmuxFn }),
+    tmuxPane: paneId,
+    source,
+    startedAt,
+    updatedAt: timestamp,
+  };
+
+  mkdirSync(targetDir, { recursive: true, mode: 0o700 });
+  const temporary = join(
+    targetDir,
+    `.${pid}.${process.pid}.${randomUUID()}.tmp`,
+  );
+  try {
+    writeFileSync(temporary, `${JSON.stringify(record)}\n`, {
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameSync(temporary, target);
+  } catch (error) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+      // Keep the original write error.
+    }
+    throw error;
+  }
+  pruneDeadRecords(targetDir);
+  return true;
+}
+
+export function readCodexSessionRecords({
+  dir = registryDir(),
+  isAlive = aliveFromPid,
+} = {}) {
+  let fileNames;
+  try {
+    fileNames = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const fileName of fileNames) {
+    if (!fileName.endsWith(".json")) continue;
+    try {
+      const record = JSON.parse(readFileSync(join(dir, fileName), "utf8"));
+      if (
+        record &&
+        Number.isSafeInteger(record.pid) &&
+        record.pid > 0 &&
+        typeof record.sessionId === "string" &&
+        record.sessionId &&
+        isAlive(record.pid)
+      ) {
+        records.push(record);
+      }
+    } catch {
+      // Ignore a malformed or concurrently removed record.
+    }
+  }
+  return records;
+}
+
+export function codexThreadNames({ indexPath } = {}) {
+  const path =
+    indexPath ||
+    join(
+      process.env.CODEX_HOME || join(process.env.HOME || homedir(), ".codex"),
+      "session_index.jsonl",
+    );
+  let data;
+  try {
+    data = readFileSync(path, "utf8");
+  } catch {
+    return new Map();
+  }
+  const names = new Map();
+  for (const line of data.split("\n")) {
+    try {
+      const entry = JSON.parse(line);
+      if (
+        typeof entry.id === "string" &&
+        typeof entry.thread_name === "string"
+      ) {
+        names.set(entry.id, entry.thread_name);
+      }
+    } catch {
+      // Ignore malformed or incomplete lines.
+    }
+  }
+  return names;
+}

package/hub/lib/cto-env.mjs

@@ -38,10 +38,9 @@ export function resolveRoleControlSnapshot(env = process.env, options = {}) {
   const ctoManagerEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_MANAGER");
   const leadManagerEnabled =
     ctoManagerEnabled && isEnvOn(env, "TFX_LEAD_MANAGER");
-  const northStarEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_NORTH_STAR");
+  const northStarEnabled = masterEnabled && isEnvOn(env, "TFX_CTO_NORTH_STAR");
   const autoCollectEnabled =
-    masterEnabled && !isEnvOff(env, "TFX_CTO_AUTO_COLLECT");
+    masterEnabled && isEnvOn(env, "TFX_CTO_AUTO_COLLECT");
   const values = {
     master_enabled: masterEnabled,
     cto_manager_enabled: ctoManagerEnabled,

package/hub/server.mjs

@@ -72,9 +72,7 @@ import {
 } from "./state.mjs";
 import { createStoreAdapter } from "./store-adapter.mjs";
 import { createCtoAutoCollector } from "./team/cto-auto-collect.mjs";
-import { createGitPreflight } from "./team/git-preflight.mjs";
 import { nativeProxy } from "./team/nativeProxy.mjs";
-import { createSwarmLocks } from "./team/swarm-locks.mjs";
 import {
   createSynapseRegistry,
   projectPeer,
@@ -119,14 +117,6 @@ const AIMD_WINDOW_MS = 30 * 60 * 1000;
 const AIMD_INITIAL_BATCH_SIZE = 3;
 const AIMD_MIN_BATCH_SIZE = 1;
 const AIMD_MAX_BATCH_SIZE = 10;
-const SYNAPSE_VALID_OPS = new Set([
-  "checkout",
-  "rebase",
-  "cherry-pick",
-  "reset",
-  "stash-pop",
-  "worktree-remove",
-]);
 const HUB_IDLE_TIMEOUT_DEFAULT_MS = 30 * 60 * 1000;
 const HUB_IDLE_SWEEP_DEFAULT_MS = 60 * 1000;
 const STATIC_CONTENT_TYPES = Object.freeze({
@@ -1124,21 +1114,13 @@ export async function startHub({
   }
   const delegatorService = new DelegatorService({ worker: delegatorWorker });
 
-  // Synapse Layer 4: session registry + git preflight + swarm locks
+  // Synapse Layer 4: session registry
   const synapseEmitter = new EventEmitter();
   synapseEmitter.setMaxListeners(50);
   const synapseRegistry = createSynapseRegistry({
     persistPath: join(CACHE_DIR, "tfx-hub", "synapse-sessions.json"),
     emitter: synapseEmitter,
   });
-  const swarmLocks = createSwarmLocks({
-    repoRoot: PROJECT_ROOT,
-    persistPath: join(CACHE_DIR, "tfx-hub", "swarm-locks.json"),
-  });
-  const gitPreflight = createGitPreflight({
-    registry: synapseRegistry,
-    locks: swarmLocks,
-  });
   const ctoAutoCollector = createCtoAutoCollector({
     registry: synapseRegistry,
     runCollect,
@@ -1437,7 +1419,7 @@ export async function startHub({
         });
       }
 
-      // ── Synapse Layer 5: session registry + locks + preflight routes ──
+      // ── Synapse Layer 5: session registry routes ──
       // Admin/raw snapshot (loopback-only). Returns raw cwd/pid for local
       // admin/HUD use; the redacted peer surface is GET /synapse/peers.
       if (path === "/synapse/sessions" && req.method === "GET") {
@@ -1642,37 +1624,6 @@ export async function startHub({
         }
       }
 
-      if (path === "/synapse/locks" && req.method === "GET") {
-        return writeJson(res, 200, {
-          ok: true,
-          locks: swarmLocks.snapshot(),
-          ts: Date.now(),
-        });
-      }
-
-      if (path === "/synapse/preflight" && req.method === "POST") {
-        try {
-          const body = await parseBody(req);
-          const { op, args = {}, sessionContext = {} } = body;
-          if (!op || typeof op !== "string") {
-            return writeJson(res, 400, { ok: false, error: "op 필수" });
-          }
-          if (!SYNAPSE_VALID_OPS.has(op)) {
-            return writeJson(res, 400, {
-              ok: false,
-              error: `invalid op: ${op}`,
-            });
-          }
-          const result = gitPreflight.check(op, args, sessionContext);
-          return writeJson(res, 200, { ok: true, ...result });
-        } catch (err) {
-          return writeJson(res, 400, {
-            ok: false,
-            error: String(err?.message || err),
-          });
-        }
-      }
-
       if (path.startsWith("/bridge")) {
         const isBridgeStatusGet =
           path === "/bridge/status" && req.method === "GET";

package/hub/team/recovery-store.mjs

@@ -1,6 +1,6 @@
 // hub/team/recovery-store.mjs — Best-effort preservation of worker changes
 // before a dirty worktree is removed. Uses file-based `.patch` + JSON manifest
-// instead of git stash (git-preflight flags stash-pop/worktree-remove as risky).
+// instead of git stash, which is risky to pop under concurrent worktree use.
 
 import { execFile } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";

package/hub/team/synapse-registry.mjs

@@ -48,9 +48,9 @@ function hasDirtyFiles(session) {
 // A session is "live" while active OR idle. Idle is an interactive session that
 // missed its heartbeat interval but is still under the TTL — alive but inactive,
 // not presumed dead. getActive() and querySessions() share this single predicate
-// so the liveness contract can't drift: getActive() feeds git-preflight's
-// dirty-file conflict guard, so dropping idle there would hide a still-live
-// interactive session's claimed paths from that safety check.
+// so the liveness contract can't drift: getActive() feeds peer discovery,
+// CTO status/hygiene and log retention, so dropping idle there would hide a
+// still-live interactive session from every one of those consumers.
 function isLiveStatus(status) {
   return status === "active" || status === "idle";
 }
@@ -337,7 +337,7 @@ export function createSynapseRegistry(opts = {}) {
     // session resuming: Claude Code re-fires SessionStart with the same
     // session_id on resume/clear/compact, so fall through and re-register
     // (revive) it. Otherwise the resumed-but-live session stays stale forever
-    // and vanishes from peer-discovery AND git-preflight's dirty-file guard.
+    // and vanishes from peer-discovery.
     const existing = sessions.get(sessionId);
     if (existing && isLiveStatus(existing.status)) {
       console.warn(
@@ -381,10 +381,13 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   // stale/expired 세션이 cutoff 넘게 누적되면 Map에서 제거.
-  // live(active/idle)는 lastHeartbeat가 오래돼도 보존 — git-preflight dirty-file 가드가 의존.
-  // Dirty stale rows keep the historical 24h window because same-id resume
-  // revives their dirty-file guard; clean stale rows expire quickly to avoid
-  // daily dummy rows after overnight operator gaps.
+  // live(active/idle) rows survive a long-stale lastHeartbeat because peer
+  // discovery and CTO status/hygiene still read them.
+  // Dirty stale rows keep the historical 24h window. Its original consumer,
+  // the git-preflight dirty-file guard, is gone and nothing populates
+  // dirtyFiles today, so this split is a candidate for collapsing into one
+  // window. Clean stale rows expire quickly to avoid daily dummy rows after
+  // overnight operator gaps.
   function pruneExpired(opts2 = {}) {
     if (destroyed) return { removed: [], count: 0 };
 
@@ -510,9 +513,9 @@ export function createSynapseRegistry(opts = {}) {
   }
 
   function getActive() {
-    // Live = active or idle. git-preflight uses this to detect other live
-    // sessions whose dirty files would conflict; an idle interactive session is
-    // still live (process alive, dirty files on disk) and must stay visible.
+    // Live = active or idle. Peer discovery, CTO status/hygiene and log
+    // retention read this list; an idle interactive session is still live
+    // (process alive) and must stay visible to them.
     return [...sessions.values()]
       .filter((session) => isLiveStatus(session.status))
       .map((session) => cloneSession(session));

package/hub/team/worktree-lifecycle.mjs

@@ -273,6 +273,8 @@ export async function ensureWorktree({
  * @param {string} opts.baseBranch
  * @param {string} [opts.rootDir=process.cwd()]
  * @returns {Promise<{ integrationBranch: string, baseCommit: string }>}
+ * @throws {Error} when the integration branch is checked out by another
+ * worktree; this is an intentional NO-GO and leaves that worktree untouched.
  */
 export async function prepareIntegrationBranch({
   runId,
@@ -299,42 +301,17 @@ export async function prepareIntegrationBranch({
  * Rebase a shard branch onto the integration branch.
  * Uses rebase + fast-forward only (no merge commits).
  *
- * Synapse v1: when a `preflight` checker + `sessionContext` are provided,
- * the rebase is pre-flighted against active sessions' dirty files/leases.
- * Blocked rebases return `{ ok: false, preflight: decision }` without touching
- * any branch. If preflight is omitted, behavior is unchanged.
- *
  * @param {object} opts
  * @param {string} opts.shardBranch — the shard's branch name
  * @param {string} opts.integrationBranch — target integration branch
  * @param {string} [opts.rootDir=process.cwd()]
- * @param {{ checkRebase: Function } | null} [opts.preflight=null] — git-preflight instance
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
- * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string, preflight?: object }>}
+ * @returns {Promise<{ ok: boolean, headCommit?: string, strategy?: string, commits?: number, notes?: string, fallbackReason?: string, error?: string }>}
  */
 export async function rebaseShardOntoIntegration({
   shardBranch,
   integrationBranch,
   rootDir = process.cwd(),
-  preflight = null,
-  sessionContext = null,
 }) {
-  // Synapse v1 pre-flight: bail out before mutating branches when another
-  // session claims overlapping files.
-  if (preflight && sessionContext) {
-    const decision = preflight.checkRebase(
-      { branch: integrationBranch },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked rebase: ${decision.reason || "overlap"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   // #127 BUG-E accident history: this function used to checkout the
   // integration branch in rootDir, leak rootDir HEAD, and redirect later user
   // edits/commits into swarm/.../merge. Integration now happens exclusively in
@@ -458,6 +435,11 @@ export async function rebaseShardOntoIntegration({
       }
     } else {
       await rm(integrationWorktree, { recursive: true, force: true });
+      try {
+        await git(["worktree", "prune"], rootDir);
+      } catch {
+        /* best-effort metadata cleanup after a partial worktree add */
+      }
     }
   }
 }
@@ -524,40 +506,18 @@ export async function cleanupWorktree({
  * Remove a worktree and its branch.
  * Follows WT race-guard: sleep between operations.
  *
- * Synapse v1: when `preflight` + `sessionContext` are provided, the removal
- * is pre-flighted against active sessions — blocked if another session is
- * still registered to this worktree path.
- *
  * @param {object} opts
  * @param {string} opts.worktreePath
  * @param {string} [opts.branchName] — optional branch to delete
  * @param {string} [opts.rootDir=process.cwd()]
  * @param {boolean} [opts.force=false]
- * @param {{ checkWorktreeRemove: Function } | null} [opts.preflight=null]
- * @param {{ sessionId: string, workerId?: string } | null} [opts.sessionContext=null]
  */
 export async function pruneWorktree({
   worktreePath,
   branchName,
   rootDir = process.cwd(),
   force = false,
-  preflight = null,
-  sessionContext = null,
 }) {
-  if (preflight && sessionContext) {
-    const decision = preflight.checkWorktreeRemove(
-      { worktreePath },
-      sessionContext,
-    );
-    if (!decision.allowed) {
-      return {
-        ok: false,
-        error: `git-preflight blocked worktree-remove: ${decision.reason || "active_worktree"}`,
-        preflight: decision,
-      };
-    }
-  }
-
   const cleanupResult = await cleanupWorktree({
     worktreePath,
     branchName,

package/hub/tray-lifecycle.mjs

@@ -120,7 +120,7 @@ export function spawnTrayForHub({
   cwd = process.cwd(),
   spawnFn = spawn,
 } = {}) {
-  if (env?.TFX_HUB_AUTO_TRAY === "0") return { status: "disabled" };
+  if (env?.TFX_HUB_AUTO_TRAY !== "1") return { status: "disabled" };
   if (isWorktreeOrEphemeralHubContext({ cwd, env })) {
     return { status: "disabled", reason: "ephemeral-or-worktree-context" };
   }

package/hub/workers/codex-mcp.mjs

@@ -120,7 +120,7 @@ function readTomlScalar(raw, key) {
 }
 
 /**
- * Resolve a Codex effort profile name (e.g. "gpt6_sol_high") to its concrete
+ * Resolve a Codex effort profile name (e.g. "gpt61_sol_high") to its concrete
  * `model` + reasoning effort. SSOT = the per-profile file written by
  * `tfx setup` at `~/.codex/<profile>.config.toml`. Falls back to deriving the
  * effort from the `<...>_<effort>` naming convention when the file is absent.

package/hud/context-monitor.mjs

@@ -15,7 +15,7 @@ const MAX_CAPTURE_BYTES = 256 * 1024;
 const MAX_TOP_KEYS = 20;
 
 // stdin 이 context_window_size 를 제공하지 않을 때 모델 ID 로 한도를 추정한다.
-// Anthropic 공식 문서(2026-09-22 기준): Opus 4.6 이상, Sonnet 4.6/5,
+// Anthropic 공식 문서(2026-09-30 기준): Opus 4.6 이상, Sonnet 4.6/5/5.5,
 // Fable 5/5.1 = 1M. Sonnet 4.5 / Haiku 4.5 = 200K이며 [1m]도 유지한다.
 const MODEL_HINT_1M_PREFIXES = [
   "claude-sonnet-4-6",