woods 2.0.0.beta1 → 2.0.0.beta3

data/lib/woods/obsidian/vault_exporter.rb

@@ -10,6 +10,7 @@ require_relative 'errors'
 require_relative 'name_mapper'
 require_relative 'note_builder'
 require_relative 'vault_assets'
+require_relative 'destination_plan'
 
 module Woods
   module Obsidian
@@ -72,7 +73,7 @@ module Woods
       def export_all
         with_pinned_index do
           graph = @reader.raw_graph_data || {}
-          @nodes = graph['nodes'] || {}
+          prepare_graph(graph)
           @pagerank = graph['pagerank'] || {}
           analysis = safe_graph_analysis
           owned = vault_owned_at_start?
@@ -82,16 +83,24 @@ module Woods
           edge_map = build_edge_map(emitted.to_set, graph)
           builder = build_note_builder(mapper, analysis)
 
+          @planned_writes = {}
           written = Set.new
           errors = []
           exported = write_notes(emitted, mapper, edge_map, builder, written, errors)
           indexes = write_indexes(emitted, mapper, written)
           write_sidecar(emitted, mapper, graph, analysis, written)
           write_owned_assets(emitted) if owned
+          DestinationPlan.new(@vault, @planned_writes, managed_note: method(:managed_marker?)).commit
 
-          swept = owned && errors.empty? ? sweep(written) : 0
+          swept = owned && errors.empty? && skipped.zero? ? sweep(written) : 0
           warn_foreign unless owned
           { exported: exported, indexes: indexes, swept: swept, skipped: skipped, errors: cap_errors(errors) }
+        rescue StandardError => e
+          log "  Export stopped: #{e.class}: #{e.message}"
+          { exported: 0, indexes: 0, swept: 0, skipped: skipped || 0,
+            errors: cap_errors(Array(errors) + ["#{e.class}: #{e.message}"]) }
+        ensure
+          @planned_writes = nil
         end
       end
 
@@ -119,19 +128,35 @@ module Woods
 
       # ── Selection / mapping ──────────────────────────────────────────
 
+      # Keep typed identity local to the exporter. Public identifiers and graph
+      # artifacts retain their original shape; variants have their own outgoing
+      # relationships, while persisted edge targets remain bare identifiers.
+      def prepare_graph(graph)
+        @primary = graph['nodes'] || {}
+        @nodes = @primary.to_h { |id, node| [[id, node['type']], node] }
+        @forward = @nodes.keys.to_h { |key| [key, Array(graph.dig('edges', key.first))] }
+        Array(graph['variants']).grep(Hash).each do |record|
+          key = [record['identifier'], record['type']]
+          next if key.any?(&:nil?) || @nodes.key?(key)
+
+          @nodes[key] = record
+          @forward[key] = Array(record['edges'])
+        end
+        @identifiers = @nodes.keys.to_h { |key| [key, key.first] }
+        @keys_by_identifier = @nodes.keys.group_by(&:first)
+        @ambiguous = @keys_by_identifier.select { |_, keys| keys.size > 1 }.keys.to_set
+      end
+
       # The emitted set = graph nodes of an exportable type that have a loadable
       # unit file. Confirming the file loads (not just that the index lists it)
       # guarantees every wikilink target is backed by a real note — a node listed
       # in the index but with no readable unit is dropped (counted as skipped).
       #
-      # @return [Array(Array<String>, Integer)] [sorted emitted ids, skipped count]
+      # @return [Array(Array<Array<String>>, Integer)] [sorted typed keys, skipped count]
       def partition_emitted
-        known = known_ids
         candidates = @nodes.keys.select do |id|
           type = @nodes[id]['type']
-          next false if !@include_framework && FRAMEWORK_TYPES.include?(type)
-
-          known.include?(id)
+          @include_framework || !FRAMEWORK_TYPES.include?(type)
         end.sort
 
         # Load each candidate once and keep it: confirms the unit is readable
@@ -151,18 +176,20 @@ module Woods
       # Load a unit, treating an unreadable/corrupt file as absent rather than
       # letting one bad JSON parse abort the whole export.
       def load_unit(id)
-        @reader.find_unit(id)
+        unit = if @ambiguous.include?(id.first)
+                 @reader.find_unit(id.first, type: id.last)
+               else
+                 @reader.find_unit(id.first)
+               end
+        unit if unit && unit['identifier'] == id.first && unit['type'] == id.last
       rescue StandardError => e
         log "  skipped #{id}: #{e.class}: #{e.message}"
         nil
       end
 
-      def known_ids
-        @known_ids ||= @reader.list_units.to_set { |entry| entry['identifier'] }
-      end
-
       def build_mapper(emitted)
-        NameMapper.new(emitted.to_h { |id| [id, dir_for(@nodes[id]['type'])] })
+        NameMapper.new(emitted.to_h { |id| [id, dir_for(@nodes[id]['type'])] },
+                       identifiers: @identifiers, ambiguous_identifiers: @ambiguous)
       end
 
       def dir_for(type)
@@ -182,25 +209,37 @@ module Woods
 
       def build_note_builder(mapper, analysis)
         NoteBuilder.new(name_mapper: mapper, nodes: @nodes, pagerank: @pagerank,
-                        analysis: analysis, include_source: @include_source, scanner: scanner)
-      end
-
-      # The single edge source: per-id forward (depends_on) and reverse (used_by)
-      # edges from the graph, filtered to the emitted set, self-edges dropped.
-      def build_edge_map(emitted, graph)
-        edges = graph['edges'] || {}
-        reverse = graph['reverse'] || {}
-        emitted.each_with_object({}) do |id, map|
-          deps = Array(edges[id]).filter_map { |edge| forward_edge(edge, id, emitted) }
-                                 .uniq { |edge| [edge[:target], edge[:via]] }
-          used = Array(reverse[id]).select { |sid| sid != id && emitted.include?(sid) }.uniq
-          map[id] = { depends_on: deps, used_by: used }
+                        analysis: analysis, include_source: @include_source, scanner: scanner,
+                        identifiers: @identifiers, ambiguous_identifiers: @ambiguous)
+      end
+
+      # Reverse links must come from resolved forward edges: the legacy reverse
+      # index merges source types, and cannot assign them to a particular note.
+      # A bare target naming several graph types remains ambiguous even if only
+      # one sibling is exportable. Do not invent a typed relationship.
+      def build_edge_map(emitted, _graph)
+        @ambiguous_edges = Set.new
+        map = emitted.to_h { |id| [id, { depends_on: [], used_by: [] }] }
+        emitted.each do |id|
+          deps = @forward[id].filter_map { |edge| forward_edge(edge, id, emitted) }
+                             .uniq { |edge| [edge[:target], edge[:via]] }
+          map[id][:depends_on] = deps
+          deps.each { |edge| map[edge[:target]][:used_by] << id }
         end
+        map.each_value { |edges| edges[:used_by].uniq! }
+        log "  omitted #{@ambiguous_edges.size} ambiguous dependency relationships" unless @ambiguous_edges.empty?
+        map
       end
 
       def forward_edge(edge, source_id, emitted)
         edge = { 'target' => edge } unless edge.is_a?(Hash)
-        target = edge['target']
+        identifier = edge['target']
+        if @ambiguous.include?(identifier)
+          @ambiguous_edges << [source_id, identifier, edge['via']]
+          return nil
+        end
+
+        target = @keys_by_identifier[identifier]&.first
         return nil if target == source_id || !emitted.include?(target)
 
         { target: target, via: edge['via'] }
@@ -263,11 +302,22 @@ module Woods
       # ── Pass 3b: machine sidecar ─────────────────────────────────────
 
       def write_sidecar(emitted, mapper, graph, analysis, written)
-        notes = emitted.to_h do |id|
-          [id, { 'path' => mapper.path_for(id), 'type' => @nodes[id]['type'],
-                 'pagerank' => @pagerank[id]&.round(6) }.compact]
+        notes = {}
+        variants = []
+        emitted.each do |key|
+          id, type = key
+          info = { 'path' => mapper.path_for(key), 'type' => type }
+          info['pagerank'] = @pagerank[id].round(6) if @pagerank[id] && !@ambiguous.include?(id)
+          if @primary.dig(id, 'type') == type
+            notes[id] = info
+          else
+            variants << { 'identifier' => id }.merge(info)
+          end
         end
-        manifest = { 'schema_version' => 1, 'notes' => sort_hash(notes), 'paths' => sort_hash(mapper.paths_to_ids) }
+        paths = mapper.paths_to_ids.transform_values(&:first)
+        manifest = { 'schema_version' => @ambiguous.empty? ? 1 : 2,
+                     'notes' => sort_hash(notes), 'paths' => sort_hash(paths) }
+        manifest['variants'] = variants if manifest['schema_version'] == 2
         write_json(written, "#{SIDECAR_DIR}/manifest.json", manifest)
         write_json(written, "#{SIDECAR_DIR}/dependency_graph.json", graph)
         write_json(written, "#{SIDECAR_DIR}/graph_analysis.json", analysis) if analysis
@@ -282,6 +332,8 @@ module Woods
           safe_write(@vault.join('.obsidian', 'graph.json'), VaultAssets.graph_json(present_types(emitted)))
           safe_write(@vault.join('Units.base'), VaultAssets.units_base)
         end
+        return if @vault.join(SENTINEL).exist?
+
         safe_write(@vault.join(SENTINEL),
                    "woods-managed vault — regenerated by `rake woods:obsidian`. Safe to delete.\n")
       end
@@ -410,7 +462,11 @@ module Woods
       def safe_write(path, content)
         raise PathTraversalError, "refusing to write outside the vault: #{path}" unless safe_inside_vault?(path)
 
-        AtomicFile.write(path, content)
+        if @planned_writes
+          @planned_writes[path] = content
+        else
+          AtomicFile.write(path, content)
+        end
       end
 
       # ── Ownership ────────────────────────────────────────────────────

data/lib/woods/operator/pipeline_guard.rb

@@ -85,14 +85,18 @@ module Woods
 
       # Reset one supported operation or all supported operations atomically.
       #
+      # An explicit :all reset also repairs corrupt state; scoped resets leave it
+      # untouched so unknown cooldowns are not silently discarded.
+      #
       # @param operation [Symbol, String] `:extraction`, `:embedding`, or `:all`
-      # @return [Boolean] true when at least one cooldown was removed
+      # @return [Boolean] true when a cooldown was removed or corrupt state repaired
       # @raise [ArgumentError] when the operation is unsupported
       def reset!(operation)
         operations = reset_operations(operation)
-        return false unless requested_state_present?(operations)
+        repair_corrupt = operation.to_s == 'all'
+        return false unless requested_state_present?(operations, repair_corrupt: repair_corrupt)
 
-        with_existing_locked_state do |state|
+        with_existing_locked_state(repair_corrupt: repair_corrupt) do |state|
           changed = false
           operations.each do |key|
             next unless state.key?(key)
@@ -135,28 +139,29 @@ module Woods
         end
       end
 
-      def parse_state(content)
-        state = content.empty? ? {} : JSON.parse(content)
-        state.is_a?(Hash) ? state : {}
+      def parse_state(content, fallback: {})
+        state = JSON.parse(content)
+        state.is_a?(Hash) ? state : fallback
       rescue JSON::ParserError
-        {}
+        fallback
       end
 
-      def requested_state_present?(operations)
+      def requested_state_present?(operations, repair_corrupt:)
         File.open(@state_path, File::RDONLY) do |file|
           file.flock(File::LOCK_SH)
-          state = parse_state(file.read)
-          operations.any? { |key| state.key?(key) }
+          state = parse_state(file.read, fallback: nil)
+          state ? operations.any? { |key| state.key?(key) } : repair_corrupt
         end
       rescue Errno::ENOENT
         false
       end
 
-      def with_existing_locked_state
+      def with_existing_locked_state(repair_corrupt:)
         File.open(@state_path, File::RDWR) do |file|
           file.flock(File::LOCK_EX)
-          state = parse_state(file.read)
-          changed = yield(state)
+          parsed = parse_state(file.read, fallback: nil)
+          state = parsed || {}
+          changed = yield(state) || (repair_corrupt && parsed.nil?)
           if changed
             file.rewind
             file.write(JSON.generate(state))

data/lib/woods/path_dispatcher.rb

@@ -94,6 +94,11 @@ module Woods
     end
 
     class << self
+      # Runtime-discovered classes have no per-file extractor method.
+      def runtime_rules
+        @runtime_rules ||= [Rule.new(dirs: %w[app], extensions: %w[.rb])].freeze
+      end
+
       # Rules for extractors with a per-file entry point.
       #
       # @return [Array<Rule>]
@@ -147,6 +152,7 @@ module Woods
           # ConcernExtractor globs app/**/concerns, not just the two canonical
           # directories — match any .rb under app/ inside a concerns/ segment.
           file_rule(:concerns, :extract_concern_file, %w[app], require_segment: '/concerns/'),
+          file_rule(:concerns, :extract_model_mixin_file, %w[app lib], exclude: %w[/concerns/]),
           # GraphQL types sit outside FILE_BASED (they share one extractor
           # method across four unit types via GRAPHQL_TYPES), which is exactly
           # why the FILE_BASED-driven coverage guard never noticed they had no
@@ -258,7 +264,7 @@ module Woods
     # @param relative_path [String] Rails.root-relative path
     # @return [Boolean]
     def relevant?(relative_path)
-      return true if relative_path.start_with?('app/') && relative_path.end_with?('.rb')
+      return true if self.class.runtime_rules.any? { |rule| rule.matches?(relative_path) }
 
       file_rules_for(relative_path).any? || whole_app_keys_for(relative_path).any?
     end

data/lib/woods/payload_store.rb

@@ -2,7 +2,6 @@
 
 require 'pathname'
 require 'fileutils'
-require 'find'
 
 module Woods
   # Writer-side owner of the per-generation payload directories.
@@ -95,15 +94,19 @@ module Woods
     # @param target [Pathname, String] a directory returned by {#create}
     # @return [void]
     def clone(source, target)
-      from = Pathname.new(source.to_s)
-      return unless from.directory?
-
-      to = Pathname.new(target.to_s)
-      from.find do |entry|
-        relative = entry.relative_path_from(from)
-        next if relative.to_s == '.'
-
-        replicate(entry, to.join(relative))
+      from = File.expand_path(source.to_s)
+      return unless File.directory?(from)
+
+      to = target.to_s
+      FileUtils.mkdir_p(to)
+      pending = [[from, to]]
+      until pending.empty?
+        source_dir, target_dir = pending.pop
+        Dir.each_child(source_dir) do |name|
+          entry = File.join(source_dir, name)
+          destination = File.join(target_dir, name)
+          replicate(entry, destination, pending)
+        end
       end
     end
 
@@ -168,7 +171,7 @@ module Woods
     # @param destination [Pathname, String] where it should land
     # @return [void]
     def link_or_copy(source, destination)
-      FileUtils.ln(source.to_s, destination.to_s)
+      File.link(source.to_s, destination.to_s)
     rescue Errno::EXDEV, Errno::EPERM, Errno::EMLINK, NotImplementedError
       FileUtils.cp(source.to_s, destination.to_s)
     end
@@ -211,11 +214,22 @@ module Woods
       end
     end
 
-    def replicate(entry, destination)
-      if entry.directory?
-        FileUtils.mkdir_p(destination.to_s)
+    # Classify once: Find.find followed by File.directory? queried metadata
+    # twice per file, costly on FUSE/virtiofs mounts. Parents are created before
+    # their children, so regular files need no extra parent-directory checks.
+    # Preserve the old walk's symlink behavior: a directory symlink becomes an
+    # empty directory, never a traversal into another tree or generation.
+    #
+    # @param entry [String] source entry
+    # @param destination [String] where it belongs in the target
+    # @param pending [Array] directories still to visit
+    # @return [void]
+    def replicate(entry, destination, pending)
+      stat = File.lstat(entry)
+      if stat.directory? || (stat.symlink? && File.directory?(entry))
+        FileUtils.mkdir_p(destination)
+        pending << [entry, destination] if stat.directory?
       else
-        FileUtils.mkdir_p(destination.dirname.to_s)
         link_or_copy(entry, destination)
       end
     end

data/lib/woods/railtie.rb

@@ -14,8 +14,8 @@ module Woods
   # flags and tokens set in `config/initializers/woods.rb` (the
   # generator-created location) do not exist yet when middleware arguments
   # are captured. Both guards are scoped to `console_mcp_path` — requests
-  # outside it pass through untouched — and while `console_mcp_enabled` is
-  # false the whole stack passes through, so an unconfigured host app is
+  # outside it pass through untouched — and while `console_mcp_enabled` or
+  # `console_mcp_http_enabled` is false the whole stack passes through, so an unconfigured host app is
   # completely unaffected. Boot-time validation of the settled configuration
   # happens in `after_initialize` via {Woods::RailtieSupport}.
   #
@@ -84,7 +84,7 @@ module Woods
       # BearerAuth next — requires `Authorization: Bearer <token>` at the
       # console path, failing closed (401) while no usable token is
       # configured. Both are scoped to the console path and inert while
-      # console_mcp_enabled is false.
+      # either console_mcp_enabled or console_mcp_http_enabled is false.
       app.middleware.use(
         Woods::MCP::OriginGuard,
         allowed_origins: Woods::RailtieSupport.console_allowed_origins_proc,

data/lib/woods/railtie_support.rb

@@ -15,11 +15,9 @@ module Woods
   # exercise the request-time procs and boot-time verification without
   # loading Rails::Railtie.
   module RailtieSupport
-    # Boot-time message for a console enabled without a token. Raised in
-    # production; warned everywhere else. Only the HTTP transport enforces
-    # the token ({Woods::MCP::BearerAuth} fails closed with 401 at the console
-    # path); the stdio server never sees a bearer header, so for it a missing
-    # token is a production-boot failure, not a request failure.
+    # Boot-time message when HTTP Console is enabled without a token.
+    # Production refuses to boot; other environments warn. Explicitly
+    # disabling HTTP leaves stdio available without HTTP token validation.
     MISSING_TOKEN_MESSAGE =
       '[Woods Console] console_mcp_token is not set — Console MCP is a high-privilege ' \
       'endpoint that runs SQL and model introspection against the live database. ' \
@@ -37,7 +35,8 @@ module Woods
       'HTTP Console MCP requests will be refused (401) until one is set. The stdio ' \
       'transport (rake woods:console) does not transmit or use a bearer token, so a ' \
       'stdio-only setup still works — set the token before exposing the HTTP endpoint. ' \
-      'Production boot will raise while Console MCP is enabled without a token.'
+      'Set console_mcp_http_enabled = false for stdio-only use. ' \
+      'Production boot will raise while HTTP Console MCP is enabled without a token.'
 
     class << self
       # @return [String, nil] path the console stack was mounted at (captured
@@ -53,12 +52,13 @@ module Woods
 
       # Request-time predicate handed to the console guards and consulted by
       # {Woods::Console::RackMiddleware}. Reads the live configuration on
-      # every call, so a flag set after the middleware was inserted (e.g. in
+      # every call. Both the Console master switch and HTTP switch must be on,
+      # so a flag set after the middleware was inserted (e.g. in
       # config/initializers) still takes effect.
       #
       # @return [Proc] arity-0 proc returning the current enabled flag
       def console_enabled_proc
-        -> { config.console_mcp_enabled }
+        -> { config.console_mcp_enabled && config.console_mcp_http_enabled }
       end
 
       # Deferred bearer token for {Woods::MCP::BearerAuth}, resolved on each
@@ -95,12 +95,12 @@ module Woods
       end
 
       # Boot-time console validation, run from `after_initialize` once the
-      # final configuration is known. With the console enabled and no usable
+      # final configuration is known. With HTTP Console enabled and no usable
       # token, every HTTP request at the console path will be refused with
       # 401 — production refuses to boot instead (matching the pre-#183
       # fail-closed posture), other environments warn loudly. The stdio
-      # server carries no bearer check, so the warning says which transport
-      # it is about rather than claiming every request fails. A token shorter than
+      # server carries no bearer check; explicit stdio-only configuration
+      # skips token validation entirely. A token shorter than
       # {Woods::MCP::BearerAuth::MIN_TOKEN_LENGTH} is a misconfiguration and
       # raises in every environment (as the eager BearerAuth constructor
       # used to). Also warns when `console_mcp_path` changed after the stack
@@ -112,7 +112,7 @@ module Woods
       #   or a too-short token anywhere
       def verify_console_configuration!(production:)
         warn_late_console_path(config)
-        return unless config.console_mcp_enabled
+        return unless config.console_mcp_enabled && config.console_mcp_http_enabled
 
         require 'woods/mcp/bearer_auth'
         token = config.console_mcp_token.to_s