The witness role doesn't have a /rig worktree like the refinery does.
The handoff command was trying to cd to <rig>/witness/rig which doesn't
exist, causing the respawned pane to fail immediately and the session
to die.
Changed witness workdir from <rig>/witness/rig to <rig>/witness.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
ReconcilePool now detects and kills orphan tmux sessions (sessions without
corresponding polecat directories). This prevents allocation from being
blocked by broken state from crashed polecats.
Changes:
- Add tmux to Manager to check for orphan sessions during reconciliation
- Add ReconcilePoolWith for testable session/directory reconciliation logic
- Always clear hook_bead slot when reopening agent beads (fixes stale hooks)
- Prune stale git worktree entries during reconciliation
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Polecats now fully clean up after themselves on `gt done`:
- Step 1: Nuke worktree (existing behavior)
- Step 2: Kill own tmux session (new)
This completes the "done means gone" model - both worktree and
session are terminated. Previously the session survived as a zombie.
Audit logging added to both systems:
- townlog: EventKill for `gt log` visibility
- events: TypeSessionDeath with structured payload
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix(config): implement role_agents support in BuildStartupCommand
The role_agents field in TownSettings and RigSettings existed but was
not being used by the startup command builders. All services fell back
to the default agent instead of using role-specific agent assignments.
Changes:
- BuildStartupCommand now extracts GT_ROLE from envVars and uses
ResolveRoleAgentConfig() for role-based agent selection
- BuildStartupCommandWithAgentOverride follows the same pattern when
no explicit override is provided
- refinery/manager.go uses ResolveRoleAgentConfig with constants
- cmd/start.go uses ResolveRoleAgentConfig with constants
- Updated comments from hardcoded agent name to generic "agent"
- Added ValidateAgentConfig() to check agent exists and binary is in PATH
- Added lookupAgentConfigIfExists() helper for validation
- ResolveRoleAgentConfig now warns to stderr and falls back to default
if configured agent is invalid or binary is missing
Resolution priority (now working):
1. Explicit --agent override
2. Rig's role_agents[role] (validated)
3. Town's role_agents[role] (validated)
4. Rig's agent setting
5. Town's default_agent
6. Hardcoded default fallback
Adds tests for:
- TestBuildStartupCommand_UsesRoleAgentsFromTownSettings
- TestBuildStartupCommand_RigRoleAgentsOverridesTownRoleAgents
- TestBuildAgentStartupCommand_UsesRoleAgents
- TestValidateAgentConfig
- TestResolveRoleAgentConfig_FallsBackOnInvalidAgent
Fixes: role_agents configuration not being applied to services
* fix(config): add GT_ROOT to BuildStartupCommandWithAgentOverride
- Fixes missing GT_ROOT and GT_SESSION_ID_ENV exports in
BuildStartupCommandWithAgentOverride, matching BuildStartupCommand behavior
- Adds test for override priority over role_agents
- Adds test verifying GT_ROOT is included in command
This addresses the Greptile review comment about agents started with
an override not having access to town-level resources.
Co-authored-by: Steve Yegge <steve.yegge@gmail.com>
CountBdDaemons() was using `bd daemon list --json` which triggers
daemon auto-start as a side effect. During shutdown verification,
this caused a new daemon to spawn after all daemons were killed,
resulting in "bd daemon shutdown incomplete: 1 still running" error.
Replaced all `bd daemon killall` calls with pkill in:
- stopBdDaemons()
- restartBdDaemons()
Changed CountBdDaemons() to use pgrep instead of bd daemon list.
Also removed the now-unused parseBdDaemonCount helper function and its tests.
detectTownRootFromCwd() only checked for mayor/town.json, but
workspace.FindFromCwd() also accepts mayor/ directory as a secondary
marker. This fixes handoff failing in workspaces without town.json.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* feat: Add worktree setup hooks for injecting local configurations
Implements GitHub issue #220 - Worktree setup hook for injecting
local configurations.
When polecats are spawned, their worktrees are created from the rig's
repo. Previously, there was no way to inject custom configurations
during this process.
Now users can place executable hooks in <rig>/.runtime/setup-hooks/
to run custom scripts during worktree creation:
rig/
.runtime/
setup-hooks/
01-git-config.sh <- Inject git config
02-copy-secrets.sh <- Copy secrets
99-finalize.sh <- Final setup
Features:
- Hooks execute in alphabetical order
- Non-executable files are skipped with a warning
- Hooks run with worktree as working directory
- Environment variables: GT_WORKTREE_PATH, GT_RIG_PATH
- Hook failures are non-fatal (warn but continue)
Example hook to inject git config:
#!/bin/sh
git config --local user.signingkey ~/.ssh/key.asc
git config --local commit.gpgsign true
Related to: hq-fq2zg, GitHub issue #220
* fix(lint): remove unused error return from buildCVSummary
buildCVSummary always returned nil for its error value, causing
golangci-lint to fail with "result 1 (error) is always nil".
The function handles errors internally by returning partial data,
so the error return was misleading. Removed it and updated caller.
Instead of changing the convoy ID format, register the hq-cv- prefix
as a valid route pointing to town beads. This preserves the semantic
meaning of convoy IDs (hq-cv-xxxxx) while fixing the prefix mismatch.
Changes:
- Register hq-cv- prefix during gt install
- Add doctor check and fix for missing convoy route
- Update routes_check tests for both hq- and hq-cv- routes
Fixes: gt-4nmfh
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
The beads.go run() function uses --no-daemon for faster read operations,
but this fails when the database is out of sync with JSONL (e.g., after
the daemon is killed during shutdown before it can sync).
Adding --allow-stale prevents these failures and makes witness/refinery
startup more reliable after gt down --all.
When no argument is provided, `gt hook show` now auto-detects the
current agent from context using resolveSelfTarget(), matching the
behavior of other commands like `gt hook` and `gt mail inbox`.
Fixessteveyegge/beads#1078
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
buildCVSummary always returned nil for its error value, causing
golangci-lint to fail with "result 1 (error) is always nil".
The function handles errors internally by returning partial data,
so the error return was misleading. Removed it and updated caller.
* feat(refinery,boot): add --agent flag for model selection (hq-7d5m)
Add --agent flag to gt refinery start/attach/restart and gt boot spawn
commands for consistent model selection across all agent launch points.
Implementation follows the existing pattern from gt deacon start:
- Add StringVar flag for agent alias
- Pass override to Manager/Boot via SetAgentOverride()
- Use BuildAgentStartupCommandWithAgentOverride when override is set
Files affected:
- cmd/gt/refinery.go: add flags to start/attach/restart commands
- internal/refinery/manager.go: add SetAgentOverride and use in Start()
- cmd/gt/boot.go: add flag to spawn command
- internal/boot/boot.go: add SetAgentOverride and use in spawnTmux()
Closes#438
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* refactor(refinery,boot): use parameter-passing pattern for --agent flag
Address PR review feedback:
1. ADD TESTS: Add tests for --agent flag existence following witness_test.go pattern
- internal/cmd/refinery_test.go: tests for start/attach/restart
- internal/cmd/boot_test.go: test for spawn
2. ALIGN PATTERN: Change from setter pattern to parameter-passing pattern
- Manager.Start(foreground, agentOverride) instead of SetAgentOverride + Start
- Boot.Spawn(agentOverride) instead of SetAgentOverride + Spawn
- Matches witness.go style: Start(foreground bool, agentOverride string, ...)
Updated all callers to pass empty string for default agent:
- internal/daemon/daemon.go
- internal/cmd/rig.go
- internal/cmd/start.go
- internal/cmd/up.go
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: furiosa <will@saults.io>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Replace weak "If You're Stuck" section with comprehensive escalation
guidance including:
- When to escalate (specific scenarios)
- How to escalate (gt escalate, mail to Witness, mail to Mayor)
- What to do after escalating (continue or exit cleanly)
- Anti-pattern example showing wrong vs right approach
This prevents polecats from filing beads and passively waiting for
human input, which caused them to appear stuck in sessions.
Fixes: hq-t8zy
The RejectMR function was modifying the in-memory MR object but never
persisting the change to beads storage. This caused rejected MRs to
continue showing in the queue with status "open".
Fix: Call beads.CloseWithReason() to properly close the MR bead before
updating the in-memory state.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
1. TestQuerySessionEvents_FindsEventsFromAllLocations
- Skip test when running inside Gas Town workspace to prevent
daemon interaction causing hangs
- Add filterGTEnv helper to isolate subprocess environment
2. TestAddWithOptions_HasAgentsMD / TestAddWithOptions_AgentsMDFallback
- Create origin/main ref manually after adding local directory as
remote since git fetch doesn't create tracking branches for local
directories
Refs: gt-zbu3x
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add commands to find and terminate orphan Claude processes (those with
PPID=1 that survived session termination):
- gt orphans list: Show orphan Claude processes
- gt orphans kill: Kill with confirmation
- gt orphans kill -f: Force kill without confirmation
Detection excludes:
- tmux processes (may contain "claude" in args)
- Claude.app desktop application processes
- Claude Helper processes
The original `gt orphans` functionality for finding orphan git commits
is preserved.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Merge polecat/nux-mkd083ff: Updates KillSessionWithProcesses to use
cleaner inline exec.Command style and improved documentation.
Prevents orphan processes that survive tmux kill-session due to
SIGHUP being ignored by Claude processes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds `gt orphans kill` subcommand that permanently removes orphaned
commits by running `git gc --prune=now`.
Flags:
- --dry-run: Preview without deleting
- --days N: Kill orphans from last N days (default 7)
- --all: Kill all orphans regardless of age
- --force: Skip confirmation prompt
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Before calling tmux kill-session, explicitly kill the pane's process tree
using pkill. This ensures claude processes don't survive session termination
due to SIGHUP being caught/ignored.
Implementation:
- Add KillSessionWithProcesses() to tmux.go
- Update killSessionsInOrder() in start.go to use new method
- Update stopSession() in down.go to use new method
Fixes: gt-5r7zr
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Migrate witness, boot, and deacon spawns to use NewSessionWithCommand
instead of NewSession+SendKeys to ensure BD_ACTOR is visible in the
process tree for orphan detection via ps.
Refs: gt-emi5b
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
buildCVSummary always returned nil for its error value, causing
golangci-lint to fail with "result 1 (error) is always nil".
The function handles errors internally by returning partial data,
so the error return was misleading. Removed it and updated caller.
Combines three related sling improvements:
1. Auto-attach mol-polecat-work (Issue #288)
- Automatically attach work molecule when slinging to polecats
- Ensures polecats have standard guidance molecule attached
2. Fix polecat hook with molecule (Issue #197)
- Use beads.ResolveHookDir() for correct directory resolution
- Prevents bd cook from failing in polecat worktree
3. Spawn fresh polecat when target has no session
- When slinging to a dead polecat, spawn fresh one instead of failing
- Fixes stale convoys not progressing due to done polecats
When starting Mayor via 'gt may at', the session now:
1. Works from townRoot (~/gt) instead of mayorDir (~/gt/mayor)
2. Includes startup beacon with explicit instructions in initial prompt
3. Removes redundant post-start nudges (beacon has instructions)
This matches the 'gt handoff' behavior where the agent immediately
knows to check hook and mail on startup.
Fixes: hq-h3449 (P0 escalation - horrendous starting UX)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
bd delete --hard --force creates tombstones instead of truly deleting,
which blocks agent bead recreation when polecats are respawned with the
same name. The tombstone is invisible to bd show/reopen but still
triggers UNIQUE constraint on create.
Workaround: Use CloseAndClearAgentBead instead of DeleteAgentBead when
cleaning up agent beads. Closed beads can be reopened by
CreateOrReopenAgentBead.
Changes:
- Add CloseAndClearAgentBead() for soft-delete that allows reopen
- Clears mutable fields (hook_bead, active_mr, cleanup_status, agent_state)
in description before closing to emulate delete --force --hard
- Update RemoveWithOptions to use close instead of delete
- Update RepairWorktreeWithOptions similarly
- Add comprehensive tests documenting the bd bug and verifying the workaround
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Migrate witness, boot, and deacon spawns to use NewSessionWithCommand
instead of NewSession+SendKeys to ensure BD_ACTOR is visible in the
process tree for orphan detection via ps.
Refs: gt-emi5b
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add critical checks to prevent lost work when polecats call gt done
without having made any commits:
1. Block if working directory not available (cannot verify git state)
2. Block if uncommitted changes exist (would be lost on completion)
3. Check commits against origin/main not local main (ensures actual work)
If any check fails, refuse completion and suggest using --status DEFERRED.
This preserves the worktree so work is not lost.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
gt done now completes successfully even if the polecat's worktree is
deleted mid-operation by the Witness or another process.
Changes:
- Add FindFromCwdWithFallback() that returns townRoot from GT_TOWN_ROOT
env var when getcwd fails
- Update runDone() to use fallback paths and env vars (GT_BRANCH,
GT_POLECAT) when cwd is unavailable
- Update updateAgentStateOnDone() to use env vars (GT_ROLE, GT_RIG,
GT_POLECAT) for role detection fallback
- All bead operations are now explicitly non-fatal with warnings
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add --owner flag to gt convoy create to track who requested a convoy.
Owner receives completion notification when convoy closes (in addition
to any --notify subscribers). Notifications are de-duplicated if owner
and notify are the same address.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Remove the mrqueue side-channel from gastown. The merge queue now uses
beads merge-request wisps exclusively, not parallel .beads/mq/*.json files.
Changes:
- Delete internal/mrqueue/ package (~830 lines removed)
- Move scoring logic to internal/refinery/score.go
- Update Refinery engineer to query beads via ReadyWithType("merge-request")
- Add MRInfo struct to replace mrqueue.MR
- Add ClaimMR/ReleaseMR methods using beads assignee field
- Update HandleMergeReady to not create duplicate queue entries
- Update gt refinery commands (claim, release, unclaimed) to use beads
- Stub out MQEventSource (no longer needed)
The Refinery now:
- Lists MRs via beads.ReadyWithType("merge-request")
- Claims via beads.Update(..., {Assignee: worker})
- Closes via beads.CloseWithReason("merged", mrID)
- Blocks on conflicts via beads.AddDependency(mrID, taskID)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
ZFC violation: InUse was being persisted to JSON and loaded from disk,
but Reconcile() immediately overwrites it with filesystem-derived state.
Changes:
- Mark InUse with json:"-" to exclude from serialization
- Load() now initializes InUse as empty (derived via Reconcile)
- Updated test to verify OverflowNext persists but InUse does not
Per ZFC "Discover, Don't Track", InUse should always be derived from
existing polecat directories, not tracked as separate state.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Allow `gt crew status <rig>` to work without requiring --rig flag.
This matches the pattern already used by crew start and crew stop.
Desire path: hq-v33hb
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add `gt polecat identity show <rig> <polecat>` command that displays:
- Identity bead ID and creation date
- Session count
- Completion statistics (completed, failed, abandoned)
- Language breakdown from file extensions in git history
- Work type breakdown (feat, fix, refactor, etc.)
- Recent work list with relative timestamps
- First-pass success rate
Supports --json flag for programmatic output.
Closes: hq-d17es.4
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add ConvoyWatcher that monitors bd activity for issue closes and
triggers convoy completion checks immediately rather than waiting
for patrol.
- Watch bd activity --follow --town --json for status=closed events
- Query SQLite for convoys tracking the closed issue
- Trigger gt convoy check when tracked issue closes
- Convoys close within seconds of last issue closing
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add `gt convoy close` command to manually close convoys regardless of
tracked issue status. This addresses the desire path identified in
convoy-lifecycle.md.
Features:
- Close convoy with optional --reason flag
- Send notification with optional --notify flag
- Idempotent: closing already-closed convoy is a no-op
- Validates convoy type before closing
Closes hq-2i8yw
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds supervision for dispatched dogs that may get stuck.
The new step (between dog-pool-maintenance and orphan-check):
- Lists dogs in "working" state
- Checks work duration vs plugin timeout (default 10m)
- Decision matrix based on how long overdue:
- < 2x timeout: log warning, check next cycle
- 2x-5x timeout: file death warrant
- > 5x timeout: force clear + escalate to Mayor
- Tracks chronic failures for repeat offenders
This closes the supervision gap where dogs could hang forever
after being dispatched via `gt dog dispatch --plugin`.
Closes: gt-s4dp3
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use errors.Is() for all ErrAlreadyRunning comparisons (consistency)
- Remove redundant HasSession check before Start() (was a race anyway)
- Remove unused tmux parameters from startRigAgents and startWitnessForRig
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The Recorder calls bd commands but wasn't setting the BEADS_DIR
environment variable. This could cause plugin run beads to be
created in the wrong database when redirects are in play.
Fixes: gt-z4ct5
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- gt rig park now accepts variadic args (fixes#375)
- gt rig unpark updated for consistency
- Errors collected and reported at end
Also fixes test self-interruption bug where sling tests sent real
tmux nudges containing "Work slung: gt-wisp-xyz", causing agents
running tests to interrupt themselves. Added GT_TEST_NO_NUDGE env
var to skip nudge during tests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Fixes from code review:
- Remove duplicate generateDogNameForDispatch, reuse generateDogName
- Fix race condition: assign work BEFORE sending mail
- Add rollback if mail send fails (clear work assignment)
- Fix misleading help text (was "hooks mail", actually sends mail)
- Add --json flag for scripted output
- Add --dry-run flag to preview without executing
The order change (assign work first, then send mail) ensures that if
AssignWork fails, no mail has been sent. If mail fails after work is
assigned, we rollback by clearing the work assignment.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Remove duplicate *Parallel variants, consolidate into single functions
- Cache discoverAllRigs() result at top level, pass to functions
- Use sync/atomic for startedAny flag instead of extra mutex
- Functions now take rigs slice and mutex as parameters
Net reduction: 83 lines
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Workers now get primed on the desire-paths philosophy:
- crew.md.tmpl: New "Desire Paths" section before Tips
- polecat.md.tmpl: Updated "Agent UX" section with desire-path label
When a command fails but the guess was reasonable, workers are
encouraged to file a bead with the desire-path label. This helps
improve agent ergonomics by surfacing intuitive command patterns.
References ~/gt/docs/AGENT-ERGONOMICS.md for full philosophy.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Implements gt-n08ix.2: formalized plugin dispatch to dogs.
The new `gt dog dispatch --plugin <name>` command:
- Finds plugin definition using the existing plugin scanner
- Creates a mail work unit with plugin instructions
- Assigns work to an idle dog (or creates one with --create)
- Returns immediately (non-blocking)
Usage:
gt dog dispatch --plugin rebuild-gt
gt dog dispatch --plugin rebuild-gt --rig gastown
gt dog dispatch --plugin rebuild-gt --dog alpha
gt dog dispatch --plugin rebuild-gt --create
This enables the Deacon to dispatch plugins to dogs during patrol
cycles without blocking on execution.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
