ace-lab 0.13.1 → 0.14.0

data/lib/ace/lab/organisms/prepare.rb

@@ -7,6 +7,7 @@ require_relative "../molecules/directory_provisioner"
 require_relative "../molecules/key_provisioner"
 require_relative "../molecules/role_verifier"
 require_relative "../molecules/gemset_provisioner"
+require_relative "../molecules/extension_provisioner"
 
 module Ace
   module Lab
@@ -51,9 +52,11 @@ module Ace
             unresolved, effective_dry_run)
           roles = prepare_roles(manifest["roles"], available, unresolved, effective_dry_run)
           gems = prepare_gems(manifest["gemset"], effective_dry_run)
+          extensions = prepare_extensions(manifest["gemset"], effective_dry_run, gems)
 
           {
-            "ok" => [accounts, directories, keys, roles, gems].flatten.none? { |item| item["status"] == "failed" },
+            "ok" => [accounts, directories, keys, roles, gems, extensions].flatten
+              .none? { |item| item["status"] == "failed" },
             "dry_run" => effective_dry_run,
             "machine" => manifest["machine"],
             "manifest" => manifest_path,
@@ -61,7 +64,8 @@ module Ace
             "directories" => directories,
             "keys" => keys,
             "roles" => roles,
-            "gems" => gems
+            "gems" => gems,
+            "extensions" => extensions
           }
         end
 
@@ -152,6 +156,28 @@ module Ace
           provisioner.call(runtime: runtime)
         end
 
+        # Harness extension projections (task 8xs.t.pu0.0): converged
+        # from the installed gem's exact declared version after the
+        # gemset phase; a gem phase failure fails every extension as a
+        # dependency (the projection source would not exist).
+        def prepare_extensions(runtime, dry_run, gems)
+          entries = runtime["extensions"]
+          return [] if entries.empty?
+
+          if gems.any? { |gem| gem["status"] == "failed" }
+            return entries.map do |entry|
+              {"extension" => entry["gem"], "gem" => entry["gem"], "version" => nil,
+               "path" => entry["path"], "account" => entry["account"], "status" => "failed",
+               "loaded_version" => nil, "restart_required" => false, "files" => [],
+               "message" => "gemset convergence failed; fix the gem phase first"}
+            end
+          end
+
+          Molecules::ExtensionProvisioner.new(
+            gem_home: runtime["gem_home"], dry_run: dry_run, account_lookup: @account_lookup
+          ).call(extensions: entries, gems: runtime["gems"])
+        end
+
         def available_accounts(account_reports)
           account_reports.reject { |report| report["status"] == "failed" }
             .map { |report| report["username"] }

data/lib/ace/lab/organisms/verify.rb

@@ -5,11 +5,14 @@ require_relative "../molecules/install_manifest_loader"
 require_relative "../molecules/key_provisioner"
 require_relative "../molecules/role_verifier"
 require_relative "../molecules/gemset_provisioner"
+require_relative "../molecules/extension_provisioner"
 require_relative "../molecules/hitl_routes"
 require_relative "../molecules/caller_authorizer"
 require_relative "../atoms/topology_schema"
 require "open3"
 require "yaml"
+require "json"
+require "fileutils"
 require "date"
 
 module Ace
@@ -99,7 +102,8 @@ module Ace
             "overseer" => check_overseer(manifest),
             "adapters" => check_adapters(manifest, executors),
             "tools" => check_tools(manifest, executors),
-            "gems" => check_gems(manifest)
+            "gems" => check_gems(manifest),
+            "extensions" => check_extensions(manifest, entries)
           }
           flat = checks.values.flatten(1)
           {
@@ -583,20 +587,146 @@ module Ace
             kind, versions_or_message = provisioner.runtime_versions(
               name: gem["name"], gem_home: gem_home
             )
-            reason = case kind
-            when :unknown, :failed then versions_or_message
-            when :ok then gem_version_reason(gem, versions_or_message, gem_home)
-            end
-            status = case kind
-            when :ok then reason ? FAIL : PASS
-            when :unknown then UNKNOWN
-            else FAIL
+            status, reason = if kind != :ok
+              [kind == :unknown ? UNKNOWN : FAIL, versions_or_message]
+            else
+              verify_present_gem(provisioner, gem, versions_or_message, gem_home)
             end
             {"gem" => gem["name"], "version" => gem["version"], "gem_home" => gem_home,
              "status" => status, "reason" => reason}
           end
         end
 
+        # A gem whose exact declared version is present must ALSO prove
+        # (1) its runtime dependency closure resolves in the target
+        # runtime — a gem listed in `gem list` with a missing
+        # transitive dependency is NOT ready (task 8xs.t.pu0.0) — and
+        # (2) no NEWER version sits beside the declared one: RubyGems
+        # activates the highest installed version, so a newer sibling
+        # would silently take over the runtime's CLI.
+        def verify_present_gem(provisioner, gem, versions, gem_home)
+          reason = gem_version_reason(gem, versions, gem_home)
+          return [FAIL, reason] if reason
+
+          newer_kind, newer_or_message = provisioner.newer_versions(
+            name: gem["name"], declared_version: gem["version"], gem_home: gem_home
+          )
+          if newer_kind != :ok
+            return [newer_kind == :unknown ? UNKNOWN : FAIL, newer_or_message]
+          end
+          unless newer_or_message.empty?
+            return [FAIL,
+              "gem '#{gem["name"]}' has newer version(s) #{newer_or_message.join(", ")} beside " \
+                "the declared #{gem["version"]} in '#{gem_home}'; the newer version would take " \
+                "over CLI activation; rerun ace-lab install"]
+          end
+
+          closure_kind, closure_or_message = provisioner.closure_failures(
+            name: gem["name"], version: gem["version"], gem_home: gem_home
+          )
+          return [closure_kind == :unknown ? UNKNOWN : FAIL, closure_or_message] if closure_kind != :ok
+          return [FAIL, closure_or_message.join("; ")] unless closure_or_message.empty?
+
+          [PASS, nil]
+        end
+
+        # Declared harness extension projections (task 8xs.t.pu0.0):
+        # re-derived from the same receipts and installed gem trees the
+        # provisioner converges (shared ExtensionProjection helpers) —
+        # the receipt must name the declared gem at its exact declared
+        # version, every projected file must match the installed gem's
+        # handbook/extensions content, the destination must not escape
+        # the extensions directory through a symlinked component, and
+        # the projected files must grant the declared account read.
+        def check_extensions(manifest, entries)
+          gemset = manifest["gemset"]
+          gemset["extensions"].map do |entry|
+            declared = gemset["gems"].find { |gem| gem["name"] == entry["gem"] }
+            reason = if declared.nil?
+              "extension source gem '#{entry["gem"]}' is not declared in the gemset"
+            else
+              extension_reason(entry, declared, gemset["gem_home"], entries[entry["account"]])
+            end
+            {"extension" => entry["gem"], "gem" => entry["gem"], "path" => entry["path"],
+             "account" => entry["account"], "status" => reason ? FAIL : PASS, "reason" => reason}
+          end
+        end
+
+        def extension_reason(entry, declared, gem_home, account_entry)
+          source_root = Molecules::ExtensionProjection.gem_source_root(
+            gem_home, entry["gem"], declared["version"]
+          )
+          return "gem '#{entry["gem"]}' #{declared["version"]} is not installed with a " \
+            "handbook/extensions tree in '#{gem_home}'; rerun ace-lab install" unless File.directory?(source_root)
+
+          receipt_path = File.join(entry["path"], Molecules::ExtensionProvisioner::RECEIPT_NAME)
+          unless File.file?(receipt_path)
+            return "extension projection receipt '#{receipt_path}' is missing; rerun ace-lab install"
+          end
+
+          begin
+            receipt = JSON.parse(File.read(receipt_path))
+          rescue JSON::ParserError
+            return "extension projection receipt '#{receipt_path}' is not valid JSON; rerun ace-lab install"
+          rescue Errno::EACCES, Errno::ENOENT
+            return "extension projection receipt '#{receipt_path}' is not readable; " \
+              "rerun ace-lab install"
+          end
+          if receipt["gem"] != entry["gem"] || receipt["version"] != declared["version"]
+            return "extension projection at '#{entry["path"]}' was projected from " \
+              "'#{receipt["gem"]} #{receipt["version"]}' but the manifest declares " \
+              "'#{entry["gem"]} #{declared["version"]}'; rerun ace-lab install"
+          end
+
+          expected = Molecules::ExtensionProjection.source_files(source_root)
+          listed = receipt.fetch("files", [])
+          if listed.sort != expected.keys.sort
+            return "extension projection at '#{entry["path"]}' lists different files than " \
+              "gem '#{entry["gem"]}' #{declared["version"]} carries; rerun ace-lab install"
+          end
+
+          # A destination that escapes the extensions directory through
+          # a symlinked component is refused before any comparison (the
+          # same validate_destination posture convergence applies).
+          begin
+            expected.each_key do |relative|
+              Molecules::ExtensionProjection.validate_destination!(entry["path"], relative)
+            end
+          rescue Ace::Lab::Error => e
+            return "#{e.message}; rerun ace-lab install"
+          end
+
+          mismatch = expected.find do |relative, source|
+            target = File.join(entry["path"], relative)
+            !File.file?(target) || !FileUtils.compare_file(source, target)
+          end
+          return "extension projection file '#{mismatch.first}' differs from gem " \
+            "'#{entry["gem"]}' #{declared["version"]}; rerun ace-lab install" if mismatch
+
+          # Declared-account readability (stat-based — the verifier
+          # does not run as the declared account): a projected file is
+          # readable when it is world-readable, or owner-readable AND
+          # owned by the declared account's uid.
+          unreadable = expected.keys.find do |relative|
+            unreadable_reason(File.join(entry["path"], relative), account_entry)
+          end
+          return "extension projection file '#{unreadable}' is not readable by the declared " \
+            "account '#{entry["account"]}'; rerun ace-lab install" if unreadable
+
+          nil
+        end
+
+        def unreadable_reason(path, account_entry)
+          stat = lstat(path)
+          return true if stat.nil? || !stat.file? || stat.symlink?
+
+          mode = stat.mode & 0o777
+          return false if (mode & 0o004) != 0 # world-readable
+          return false if (mode & 0o400) != 0 && account_entry && stat.uid == account_entry.uid
+
+          true
+        end
+
         def gem_version_reason(gem, versions, gem_home)
           return nil if versions.include?(gem["version"])
           if versions.empty?

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.13.1"
+    VERSION = "0.14.0"
   end
 end

data/lib/ace/lab.rb

@@ -18,6 +18,7 @@ require_relative "lab/models/topology_entry"
 require_relative "lab/models/query_result"
 require_relative "lab/models/status_report"
 require_relative "lab/molecules/topology_loader"
+require_relative "lab/molecules/project_locations"
 require_relative "lab/molecules/config_state_classifier"
 require_relative "lab/molecules/lab_state_scanner"
 require_relative "lab/molecules/caller_authorizer"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.14.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -173,9 +173,19 @@ files:
 - lib/ace/lab/atoms/install_schema.rb
 - lib/ace/lab/atoms/public_projection.rb
 - lib/ace/lab/atoms/topology_schema.rb
+- lib/ace/lab/auth.rb
+- lib/ace/lab/auth/credential_handoff.rb
+- lib/ace/lab/auth/lease_store.rb
+- lib/ace/lab/auth/plugins/env_provider.rb
+- lib/ace/lab/auth/plugins/forgejo_provider.rb
+- lib/ace/lab/auth/plugins/github_provider.rb
+- lib/ace/lab/auth/profile_schema.rb
+- lib/ace/lab/auth/providers.rb
+- lib/ace/lab/auth/service.rb
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
+- lib/ace/lab/cli/commands/auth.rb
 - lib/ace/lab/cli/commands/install.rb
 - lib/ace/lab/cli/commands/prepare.rb
 - lib/ace/lab/cli/commands/project_add.rb
@@ -198,6 +208,8 @@ files:
 - lib/ace/lab/molecules/config_state_classifier.rb
 - lib/ace/lab/molecules/directory_provisioner.rb
 - lib/ace/lab/molecules/exact_resolver.rb
+- lib/ace/lab/molecules/extension_projection.rb
+- lib/ace/lab/molecules/extension_provisioner.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
 - lib/ace/lab/molecules/gemset_provisioner.rb
@@ -209,6 +221,7 @@ files:
 - lib/ace/lab/molecules/key_provisioner.rb
 - lib/ace/lab/molecules/lab_state_scanner.rb
 - lib/ace/lab/molecules/overseer_provisioner.rb
+- lib/ace/lab/molecules/project_locations.rb
 - lib/ace/lab/molecules/project_registry.rb
 - lib/ace/lab/molecules/repository_provisioner.rb
 - lib/ace/lab/molecules/role_verifier.rb