@adia-ai/adia-ui-forge 0.8.31 → 0.8.33

package/skills/adia-release/scripts/dispatch-publish.mjs

@@ -17,7 +17,7 @@
 // Part of the adia-release skill. Mechanizes the dispatch loop
 // + handles the npm-latest ordering rule for batch pushes.
 
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import process from 'node:process';
 import { assertMonorepoRoot } from './assert-monorepo-root.mjs';
 import { PACKAGE_NAMES } from './package-paths.mjs';
@@ -49,10 +49,14 @@ function parseArgs(argv) {
       console.log('--after            Verify npm latest is at the given version before dispatching this one.');
       console.log('                   Used in batch push to ensure publish ordering.');
       console.log('--verify-triggered Instead of dispatching, check whether each per-package publish-<pkg>.yml');
-      console.log('                   ALREADY has a run for the <pkg>-vX.Y.Z tag (i.e. push-on-tag fired), and');
-      console.log('                   re-dispatch ONLY the misses. This is the recovery for the batch-tag-push');
-      console.log('                   skip (recovery-paths.md §Scenario 7) — a single `git push <12 tags>` can');
-      console.log('                   trigger ZERO publish workflows. Idempotent: re-dispatches nothing if all 11 fired.');
+      console.log('                   has a SUCCESSFUL run for the <pkg>-vX.Y.Z tag, and re-dispatch the misses.');
+      console.log('                   Conclusion-aware (gh#763): a cancelled/failed/timed-out run is a miss, not');
+      console.log('                   a pass; in-progress/queued runs get a bounded wait. Every re-dispatch is');
+      console.log('                   gated behind an npm-registry check — if <pkg>@<version> is already on the');
+      console.log('                   registry the publish succeeded regardless of run conclusion (a run can');
+      console.log('                   publish, then be stamped cancelled by the job clock), and re-dispatching');
+      console.log('                   would only 403. Covers the batch-tag-push skip (recovery-paths.md');
+      console.log('                   §Scenario 7) AND dead runs from runner starvation. Idempotent.');
       console.log(`--scope            npm scope the packages publish under (default: ${DEFAULT_SCOPE};`);
       console.log('                   or set $ADIA_NPM_SCOPE). The --after npm-latest check uses this scope.');
       process.exit(0);
@@ -65,18 +69,23 @@ function parseArgs(argv) {
   return args;
 }
 
-function run(cmd, dry) {
+// All gh/npm invocations go through execFileSync with ARGUMENT ARRAYS —
+// never a shell string. --version/--scope are CLI-attacker-controlled;
+// interpolating them into a shell command is command injection (PR #774
+// review). `run` logs a printable form in dry mode and execs the array.
+function run(bin, argv, dry, opts = {}) {
+  const printable = `${bin} ${argv.join(' ')}`;
   if (dry) {
-    console.log(`  [dry] ${cmd}`);
+    console.log(`  [dry] ${printable}`);
     return '';
   }
-  return execSync(cmd, { encoding: 'utf8' });
+  return execFileSync(bin, argv, { encoding: 'utf8', ...opts });
 }
 
 function checkAfter(afterVersion, scope) {
   console.log(`Checking npm latest is at ${afterVersion} before dispatching...`);
   try {
-    const latest = execSync(`npm view ${scope}/web-components dist-tags.latest`, { encoding: 'utf8' }).trim();
+    const latest = run('npm', ['view', `${scope}/web-components`, 'dist-tags.latest'], false).trim();
     if (latest !== afterVersion) {
       console.error(`error: npm ${scope}/web-components latest is '${latest}', expected '${afterVersion}'`);
       console.error('  This means the previous batch hasn\'t completed publishing.');
@@ -92,9 +101,8 @@ function checkAfter(afterVersion, scope) {
 
 function dispatch(pkg, version, dry) {
   const ref = `${pkg}-v${version}`;
-  const cmd = `gh workflow run "publish-${pkg}.yml" --ref "${ref}"`;
   try {
-    const out = run(cmd, dry);
+    const out = run('gh', ['workflow', 'run', `publish-${pkg}.yml`, '--ref', ref], dry);
     if (!dry && out) {
       const url = out.split('\n').find((l) => l.startsWith('http')) || '';
       console.log(`  ✓ dispatched ${pkg} (${url.trim()})`);
@@ -114,53 +122,163 @@ async function sleep(ms) {
   return new Promise((res) => setTimeout(res, ms));
 }
 
-// Has publish-<pkg>.yml already run for the <pkg>-vX.Y.Z tag? Tag-triggered runs
+// Classify a run's {status, conclusion} into what --verify-triggered should do
+// with it. Pure — selftest exercises it with negative controls.
+//   'success' — completed + success: the publish run is satisfied.
+//   'pending' — queued / in_progress / waiting / requested: recheck (bounded wait).
+//   'dead'    — completed but NOT success (cancelled / failure / timed_out /
+//               skipped / anything unknown): re-dispatch candidate. gh#763: the
+//               v0.8.29 starvation wave stamped runs `cancelled` — one of them
+//               had already published to npm, which is why every re-dispatch is
+//               additionally gated behind the registry check below.
+function classifyRun(status, conclusion) {
+  if (status !== 'completed') return 'pending';
+  return conclusion === 'success' ? 'success' : 'dead';
+}
+
+// Latest run of publish-<pkg>.yml for the <pkg>-vX.Y.Z tag. Tag-triggered runs
 // report the tag in the `headBranch` field, so we filter the run list by it.
-// Returns true if at least one run exists for that tag, false otherwise.
+// Returns 'none' | 'success' | 'pending' | 'dead' | 'unknown' — existence
+// alone is NOT satisfaction (gh#763: a cancelled run used to count as
+// "triggered"), and a FAILED QUERY is NOT verified absence (PR #774 review:
+// fail-open here read a gh rate limit as "no run" and re-dispatched over a
+// possibly in-flight publish).
 function triggeredForTag(pkg, version, dry) {
   const tag = `${pkg}-v${version}`;
-  const cmd = `gh run list --workflow="publish-${pkg}.yml" --branch "${tag}" --limit 1 --json databaseId -q '.[0].databaseId // empty'`;
+  const argv = ['run', 'list', `--workflow=publish-${pkg}.yml`, '--branch', tag, '--limit', '1', '--json', 'status,conclusion', '-q', '.[0] // empty'];
   if (dry) {
-    console.log(`  [dry] ${cmd}`);
-    return false; // dry preview assumes not-triggered so the re-dispatch path is shown
+    console.log(`  [dry] gh ${argv.join(' ')}`);
+    return 'none'; // dry preview assumes not-triggered so the re-dispatch path is shown
   }
   try {
-    const out = execSync(cmd, { encoding: 'utf8' }).trim();
-    return out.length > 0;
+    const out = execFileSync('gh', argv, { encoding: 'utf8' }).trim();
+    if (!out) return 'none'; // gh answered: genuinely zero runs for the tag
+    const run = JSON.parse(out);
+    return classifyRun(run.status, run.conclusion);
   } catch {
-    // gh error (auth / rate limit / missing workflow) — treat as "unknown".
-    // Conservative: report not-triggered so the miss is re-dispatched rather than
-    // silently skipped. A redundant re-dispatch is harmless (publish is idempotent
-    // per the workflow's own guard); a skipped publish is the failure we're fixing.
-    return false;
+    // gh error (auth / rate limit / missing workflow) — we could not observe
+    // the runs. Fail CLOSED: 'unknown' stops the loop with a nonzero result
+    // instead of dispatching blind.
+    return 'unknown';
   }
 }
 
-// The batch-tag-push-skip recovery: verify each per-package publish workflow
-// actually triggered off its pushed tag, and re-dispatch ONLY the misses.
-// Idempotent — re-dispatches nothing if all 11 fired.
-function verifyTriggeredAndRedispatch(version, dry) {
-  console.log(`\nVerifying publish-on-tag triggered for all ${PACKAGES.length} packages (v${version}):`);
+// Registry truth: is <scope>/<pkg>@<version> already published? A workflow
+// run's conclusion is NOT publish truth — the v0.8.29 compose run published
+// successfully, then got stamped `cancelled` by the 10m job clock. If the
+// version is on the registry, the publish succeeded, full stop; re-dispatching
+// would only hit npm's publish-over-published 403.
+// Returns true (published) | false (npm answered: version absent, E404) |
+// null (query FAILED — network/auth; absence NOT verified, fail closed:
+// PR #774 review — a transient npm failure must not re-open the 403).
+function onRegistry(pkg, version, scope, dry) {
+  const argv = ['view', `${scope}/${pkg}@${version}`, 'version'];
+  if (dry) {
+    console.log(`  [dry] npm ${argv.join(' ')}`);
+    return false; // dry preview assumes not-published so the re-dispatch path is shown
+  }
+  try {
+    return execFileSync('npm', argv, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim() === version;
+  } catch (e) {
+    const stderr = `${e.stderr || ''}`;
+    if (stderr.includes('E404') || stderr.includes('404 Not Found')) return false; // definitive: not published
+    return null; // npm/network error — absence unverified
+  }
+}
+
+// What to do with a package whose latest run is not a clean success, given
+// registry truth (`published`: true | false | null-unverified). Pure —
+// selftest proves the 403-avoidance and fail-closed invariants here.
+//   published === true → 'satisfied'  — npm has the version; the publish
+//                        succeeded whatever the run conclusion says. NEVER
+//                        re-dispatch over an already-published version (403).
+//   either query failed→ 'unknown'    — run state or registry state was NOT
+//                        observed (rate limit, network). Fail closed: stop
+//                        with a nonzero result, never dispatch blind.
+//   pending, absent    → 'wait'       — a run may still be publishing; do not
+//                        race it with a second dispatch.
+//   dead/none, absent  → 'redispatch' — no run, or a cancelled/failed/
+//                        timed-out one, and the registry lacks the version.
+function decidePackage(state, published) {
+  if (published === true) return 'satisfied';
+  if (state === 'unknown' || published === null) return 'unknown';
+  if (state === 'pending') return 'wait';
+  return 'redispatch';
+}
+
+// Bounded wait for in-progress/queued runs before judging them: a healthy
+// publish run finishes in ~30s; 6 × 20s covers a slow queue without stalling
+// the recovery loop forever.
+const PENDING_RECHECKS = 6;
+const PENDING_RECHECK_SECONDS = 20;
+
+// The publish-run recovery: verify each per-package publish workflow has a
+// SUCCESSFUL run for its tag (batch-tag-push skip AND dead runs — cancelled /
+// failed / timed_out, e.g. runner starvation), wait out in-progress runs, and
+// re-dispatch only true misses — never over a version the registry already has.
+// Idempotent — re-dispatches nothing if all publishes landed.
+async function verifyTriggeredAndRedispatch(version, scope, dry) {
+  console.log(`\nVerifying publish-on-tag succeeded for all ${PACKAGES.length} packages (v${version}):`);
+  let pending = PACKAGES;
+  const unresolved = new Map(); // pkg → state, after the bounded wait
+  for (let attempt = 0; attempt <= PENDING_RECHECKS && pending.length > 0; attempt++) {
+    if (attempt > 0) {
+      console.log(`  … ${pending.length} run(s) still pending — recheck ${attempt}/${PENDING_RECHECKS} in ${PENDING_RECHECK_SECONDS}s`);
+      await sleep(PENDING_RECHECK_SECONDS * 1000);
+    }
+    const stillPending = [];
+    for (const pkg of pending) {
+      const state = triggeredForTag(pkg, version, dry);
+      if (state === 'success') {
+        console.log(`  ✓ ${pkg} — successful publish run for ${pkg}-v${version}`);
+      } else if (state === 'pending' && attempt < PENDING_RECHECKS && !dry) {
+        stillPending.push(pkg);
+      } else {
+        unresolved.set(pkg, state);
+      }
+    }
+    pending = stillPending;
+  }
+
+  // Registry gate: for every non-success, npm is the arbiter — already
+  // published → satisfied regardless of run conclusion; absent → re-dispatch.
   const misses = [];
-  for (const pkg of PACKAGES) {
-    if (triggeredForTag(pkg, version, dry)) {
-      console.log(`  ✓ ${pkg} — publish run found for ${pkg}-v${version}`);
+  for (const [pkg, state] of unresolved) {
+    const decision = decidePackage(state, onRegistry(pkg, version, scope, dry));
+    if (decision === 'satisfied') {
+      console.log(`  ✓ ${pkg} — run state '${state}' but ${scope}/${pkg}@${version} IS on the registry → published, no re-dispatch`);
+    } else if (decision === 'unknown') {
+      console.log(`  ! ${pkg} — run or registry state could NOT be observed (gh/npm query failed) → NOT dispatching blind; fix gh/npm access and re-run --verify-triggered`);
+      misses.push({ pkg, redispatch: false });
+    } else if (decision === 'wait') {
+      console.log(`  ? ${pkg} — run still pending after bounded wait and not on the registry → NOT re-dispatching over an in-flight run; re-run --verify-triggered once it settles`);
+      misses.push({ pkg, redispatch: false });
     } else {
-      console.log(`  ✗ ${pkg} — NO publish run for ${pkg}-v${version} (batch-push skip) → will re-dispatch`);
-      misses.push(pkg);
+      const why = state === 'none' ? 'NO publish run (batch-push skip)' : 'run cancelled/failed/timed-out';
+      console.log(`  ✗ ${pkg} — ${why} for ${pkg}-v${version}, not on the registry → will re-dispatch`);
+      misses.push({ pkg, redispatch: true });
     }
   }
   if (misses.length === 0) {
-    console.log(`\n[verify-triggered] all ${PACKAGES.length} publish workflows triggered — nothing to re-dispatch.`);
+    console.log(`\n[verify-triggered] all ${PACKAGES.length} publishes verified (successful run or on-registry) — nothing to re-dispatch.`);
     return 0;
   }
-  console.log(`\n[verify-triggered] ${misses.length} miss(es) — re-dispatching via workflow_dispatch:`);
+  const toDispatch = misses.filter((m) => m.redispatch);
   let redispatched = 0;
-  for (const pkg of misses) {
-    if (dispatch(pkg, version, dry)) redispatched++;
+  if (toDispatch.length > 0) {
+    console.log(`\n[verify-triggered] ${toDispatch.length} miss(es) — re-dispatching via workflow_dispatch:`);
+    for (const { pkg } of toDispatch) {
+      if (dispatch(pkg, version, dry)) redispatched++;
+    }
+    console.log(`\n[verify-triggered] re-dispatched ${redispatched}/${toDispatch.length} ${dry ? '(dry)' : ''}`);
+    if (!dry) {
+      console.log('  Registry is the final arbiter — confirm each with:');
+      console.log(`    npm view ${scope}/<pkg>@${version} version`);
+    }
   }
-  console.log(`\n[verify-triggered] re-dispatched ${redispatched}/${misses.length} ${dry ? '(dry)' : ''}`);
-  return redispatched === misses.length ? 0 : 1;
+  const unresolvedCount = misses.length - toDispatch.length;
+  if (unresolvedCount > 0) console.log(`\n[verify-triggered] ${unresolvedCount} package(s) unresolved (run still pending, or gh/npm query failed) — re-run --verify-triggered once they settle / access is restored.`);
+  return redispatched === toDispatch.length && unresolvedCount === 0 ? 0 : 1;
 }
 
 async function main() {
@@ -169,10 +287,11 @@ async function main() {
   assertMonorepoRoot(process.cwd());
   if (args.after) checkAfter(args.after, args.scope);
 
-  // Recovery mode — verify each publish workflow triggered off its pushed tag,
-  // re-dispatch only the misses (the batch-tag-push skip). Skips the blind dispatch.
+  // Recovery mode — verify each publish workflow SUCCEEDED for its pushed tag
+  // (or the version is on the registry), re-dispatch only true misses (batch-
+  // tag-push skip + dead runs, gh#763). Skips the blind dispatch.
   if (args.verifyTriggered) {
-    const rc = verifyTriggeredAndRedispatch(args.version, args.dry);
+    const rc = await verifyTriggeredAndRedispatch(args.version, args.scope, args.dry);
     process.exit(rc);
   }
 
@@ -211,31 +330,75 @@ async function main() {
   if (succeeded !== PACKAGES.length) process.exit(1);
 }
 
-// dry mode never shells out (run()/dispatch() short-circuit before
-// execSync), so this exercises the real functions without touching gh/npm.
-function selftest() {
+// dry mode never shells out (run()/dispatch()/triggeredForTag()/onRegistry()
+// short-circuit before execFileSync), so this exercises the real functions
+// without touching gh/npm.
+async function selftest() {
+  const fail = (msg) => { console.error(`selftest FAIL: ${msg}`); process.exit(1); };
+
   let allOk = true;
   for (const pkg of PACKAGES) {
     if (!dispatch(pkg, '9.9.9', true /* dry */)) allOk = false;
   }
-  if (!allOk) { console.error('selftest FAIL: dry dispatch() reported a failure for at least one package'); process.exit(1); }
+  if (!allOk) fail('dry dispatch() reported a failure for at least one package');
+
+  // classifyRun() — the gh#763 core: conclusion decides, existence does not.
+  if (classifyRun('completed', 'success') !== 'success') fail("classifyRun(completed,success) must be 'success'");
+  // Negative controls: the exact states the v0.8.29 starvation wave produced
+  // must NOT satisfy the verify — a cancelled run counting as "triggered" is
+  // the defect this script no longer has.
+  for (const dead of ['cancelled', 'failure', 'timed_out', 'skipped', null]) {
+    if (classifyRun('completed', dead) !== 'dead') fail(`classifyRun(completed,${dead}) must be 'dead', never satisfied`);
+  }
+  for (const status of ['queued', 'in_progress', 'waiting', 'requested']) {
+    if (classifyRun(status, null) !== 'pending') fail(`classifyRun(${status}) must be 'pending' (bounded recheck)`);
+  }
+
+  // decidePackage() — the registry gate. Negative controls: the v0.8.29
+  // a2ui-compose shape (run cancelled, version PUBLISHED) must never
+  // re-dispatch — that's the publish-over-published 403.
+  if (decidePackage('dead', true) !== 'satisfied') fail('decidePackage(dead, published) must be satisfied — never re-dispatch over a published version');
+  if (decidePackage('none', true) !== 'satisfied') fail('decidePackage(none, published) must be satisfied');
+  if (decidePackage('pending', true) !== 'satisfied') fail('decidePackage(pending, published) must be satisfied');
+  if (decidePackage('dead', false) !== 'redispatch') fail('decidePackage(dead, absent) must re-dispatch');
+  if (decidePackage('none', false) !== 'redispatch') fail('decidePackage(none, absent) must re-dispatch');
+  if (decidePackage('pending', false) !== 'wait') fail('decidePackage(pending, absent) must wait, never race an in-flight run');
+  // Fail-closed negative controls (PR #774 review): a FAILED query is not
+  // verified absence — 'unknown' must never dispatch. A gh rate limit could
+  // hide an in-flight run; a transient npm failure could hide an
+  // already-published version (the 403 again).
+  for (const state of ['unknown', 'none', 'dead', 'pending']) {
+    if (decidePackage(state, null) !== 'unknown') fail(`decidePackage(${state}, registry-unverified) must be 'unknown' — never dispatch blind`);
+  }
+  for (const published of [false, null]) {
+    if (decidePackage('unknown', published) !== 'unknown') fail(`decidePackage(run-unknown, ${published}) must be 'unknown' — never dispatch blind`);
+  }
+  // Positive registry truth still wins even when the run query failed:
+  if (decidePackage('unknown', true) !== 'satisfied') fail('decidePackage(unknown, published) must be satisfied — registry is the arbiter');
+
+  // triggeredForTag() in dry mode must conservatively report 'none' — the
+  // whole point is re-dispatching misses; silently assuming "triggered"
+  // would let a real miss through.
+  if (triggeredForTag('web-components', '9.9.9', true) !== 'none') {
+    fail("dry triggeredForTag() must report 'none' (conservative default)");
+  }
 
-  // triggeredForTag() in dry mode must conservatively report "not yet
-  // triggered" — verifyTriggeredAndRedispatch's whole point is to re-dispatch
-  // misses; silently assuming "triggered" would let a real miss through.
-  if (triggeredForTag('web-components', '9.9.9', true) !== false) {
-    console.error('selftest FAIL: dry triggeredForTag() must report false (conservative default)'); process.exit(1);
+  // onRegistry() in dry mode must report not-published — assuming published
+  // would suppress the re-dispatch preview AND, inverted, the real registry
+  // gate is what prevents the publish-over-published 403.
+  if (onRegistry('web-components', '9.9.9', '@adia-ai', true) !== false) {
+    fail('dry onRegistry() must report false (conservative default)');
   }
 
-  const rc = verifyTriggeredAndRedispatch('9.9.9', true);
-  if (rc !== 0) { console.error(`selftest FAIL: dry verifyTriggeredAndRedispatch() should report rc=0, got ${rc}`); process.exit(1); }
+  const rc = await verifyTriggeredAndRedispatch('9.9.9', '@adia-ai', true);
+  if (rc !== 0) fail(`dry verifyTriggeredAndRedispatch() should report rc=0, got ${rc}`);
 
   console.log('selftest OK');
 }
 
 const topArgv = process.argv.slice(2);
 if (topArgv[0] === 'selftest') {
-  selftest();
+  selftest().catch((e) => { console.error(`selftest FAIL: ${e.message}`); process.exit(1); });
 } else {
   main().catch((e) => {
     console.error(`error: ${e.message}`);