fix(H-1): auto-serialize parallel pkg-manager/file-edit steps via inferred resource locks

[Copilot]

The scheduler's file-write exclusion mechanism was silently bypassed whenever the planner LLM omitted resources hints — allowing npm install and file-edit package.json to run concurrently and produce an inconsistent manifest/lockfile state.

Changes

src/langgraph/graph.ts — Planner hard constraints

• Added two explicit rules to BLOCKS_PLANNER_SYSTEM: package-manager commands (npm install, yarn, pnpm, pip install, cargo build, go get, bundle) must declare resources: ["file:WRITE:<manifest>"] and must not be placed in the same parallel block as steps that edit that manifest; file-edit/file-write steps must declare their write targets.

src/langgraph/compiler.ts — Structural safety net

• inferMissingResources() (exported): detects pkg-manager invocations in description and file-edit/file-write tool use mentioning a known manifest, then produces the missing file:write:<manifest> lock strings.
• compileBlocksPlanToDag(): merges inferred resources into every compiled step node so the scheduler enforces serialisation regardless of what the planner emitted.
• detectPkgManifestConflicts() (exported): post-plan scan that identifies parallel branch pairs with a pkg-manager step vs. a file-edit step sharing a manifest without a declared lock; called from planNode to emit a structured warn.

Inference example (H-1 scenario)

// Planner emits these two branches in parallel with no resources declared:
// branch "install":   { description: "npm install @anthropic-ai/sdk@latest", toolsNeeded: [] }
// branch "edit":      { description: "Edit package.json to add ...", toolsNeeded: ["file-edit"] }

// compileBlocksPlanToDag() now auto-adds to both nodes:
//   resources: ["file:write:package.json"]
// → scheduler serialises them via the existing write-exclusion logic

Tests

19 new unit tests covering inferMissingResources (all supported package managers, file-edit+manifest, no-op cases), the H-1 scheduler serialisation scenario end-to-end, and detectPkgManifestConflicts (conflict, sequential, unrelated branches).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• duckduckgo.com
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/agentloop/agentloop/node_modules/jest-worker/build/processChild.js (dns block)
  • Triggering command: /usr/local/bin/node /usr/local/bin/node /home/REDACTED/work/agentloop/agentloop/node_modules/jest-worker/build/processChild.js tnet/tools/git git bran�� -v -d ','x')}catch(e){} --local user.email /snap/bin/git git s__/�� (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)