@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.7 → 0.1.8

package/packages/repo-controls/README.md

@@ -190,12 +190,19 @@ adl-repo-controls --version | help
 ```
 
 **install** requires an existing root `adl-config.toml`: that is the central
-management marker. It deletes and rebuilds the complete adl-owned
-`.workflows/` root, then appends its `[controls]` table only when that table is
-missing. It appends the single shared root ignore `/.enact/logs/` and
-`/.coverage-cache/` to `.gitignore`, writes the lock, and sets
-`core.hooksPath=.workflows/hooks` with `git config --local`.
-- Re-running is state-idempotent: the rebuilt root is byte-identical.
+management marker. It reconciles the complete adl-owned `.workflows/` root
+against every managed path's actual bytes (independent review, 2026-09-29:
+a blind wholesale delete-and-rebuild touched every file's mtime — even ones
+that already matched — on every run, which broke idempotency for anything
+reading those mtimes) — a path whose content is already byte- and
+mode-identical is left alone untouched, and anything else (missing,
+altered, or retired) is still deleted or repaired. It then appends its
+`[controls]` table only when that table is missing. It appends the single
+shared root ignore `/.enact/logs/` and `/.coverage-cache/` to `.gitignore`,
+writes the lock, and sets `core.hooksPath=.workflows/hooks` with
+`git config --local`.
+- Re-running is a true no-op: the rebuilt root is byte-identical AND no
+  managed file's mtime changes when nothing needed correcting.
 - `--dry-run` prints every action and changes nothing (files or git config).
 - Extra, altered, missing, and retired managed files below `.workflows/` are
   deleted or repaired on the next install. Pre-hard-cut log evidence is kept in

package/packages/repo-controls/assets/adl-config.default.toml

@@ -0,0 +1 @@
+version = 1

package/packages/repo-controls/src/cli.ts

@@ -81,7 +81,12 @@ async function dispatch(argv: string[], io: Io): Promise<number> {
       const parsed = parse(command, args, ['--dry-run'])
       const result = install(parsed.repo, { dryRun: parsed.flags.has('--dry-run') })
       printActions(io, result.actions, result.dryRun)
-      io.out(`${result.dryRun ? '[dry-run] ' : ''}${TOOL} ${VERSION} installed into ${result.repo}`)
+      // Independent review, 2026-09-29, finding 8: a genuine no-op run (and
+      // any --dry-run preview) never claims to have "installed" anything —
+      // only a real run that actually changed something says so.
+      if (!result.dryRun && result.actions.length > 0) {
+        io.out(`${TOOL} ${VERSION} installed into ${result.repo}`)
+      }
       return 0
     }
     case 'uninstall': {

package/packages/repo-controls/src/install.ts

@@ -212,9 +212,20 @@ export interface InstallResult {
   dryRun: boolean
 }
 
-function readCentralMarker(repo: string): string {
+/**
+ * `dryRun`: a --dry-run preview must be able to describe what a real
+ * install WOULD do even for a repository with no adl-config.toml on disk
+ * yet (independent review, 2026-09-29, finding 6 — `adl install
+ * --dry-run`'s own step 1 would CREATE this exact marker moments before
+ * this step runs for real, and a dry-run writes nothing to the real repo
+ * first). Simulated as the same minimal `version = 1` template that
+ * creation step writes, never persisted. A REAL run (dryRun=false) is
+ * unaffected: a missing marker still throws exactly as before.
+ */
+function readCentralMarker(repo: string, dryRun: boolean): string {
   const configPath = join(repo, CONFIG_REL)
   if (!existsSync(configPath)) {
+    if (dryRun) return 'version = 1\n'
     throw new Error(`${CONFIG_REL} is missing — this repository is not centrally managed`)
   }
   return readFileSync(configPath, 'utf8')
@@ -222,11 +233,11 @@ function readCentralMarker(repo: string): string {
 
 export function install(repoArg: string, options: InstallOptions): InstallResult {
   const repo = resolveRepo(repoArg)
-  const initialConfigText = readCentralMarker(repo)
+  const dryRun = options.dryRun === true
+  const initialConfigText = readCentralMarker(repo, dryRun)
   // Validate only repo-controls' declared tables before deleting its root.
   // Other owners' tables remain deliberately opaque.
   validateOwnedConfig(initialConfigText)
-  const dryRun = options.dryRun === true
   // The lock is outside neither configuration nor runtime boundaries, so read
   // its bookkeeping before replacing its containing root.  It is never used
   // to preserve root content.
@@ -240,8 +251,12 @@ export function install(repoArg: string, options: InstallOptions): InstallResult
   }
   // This root is a single owner, so drift, stale files, old lock formats, and
   // removed managed files are pruned before the authoritative projection is
-  // rebuilt. Pre-hard-cut log evidence is quarantined in place.
-  reconcileWorkflowsRoot(repo, ops, 'authoritative repo-controls root reconciliation')
+  // rebuilt. Pre-hard-cut log evidence is quarantined in place. Selective,
+  // not wholesale (independent review, 2026-09-29): only paths NOT in
+  // managedPaths are removed, so a managed file that has not actually
+  // changed is left on disk for Ops.write()'s own byte comparison below to
+  // correctly report 'unchanged' and leave its mtime alone.
+  reconcileManagedWorkflowsRoot(repo, ops, [...managedPaths, LOCK_REL], 'stale .workflows content')
 
   const files: Lock['files'] = {}
   // Standalone CI assets are copied BYTE-FOR-BYTE, executable, and locked.
@@ -452,6 +467,71 @@ function removeSymlinksBelow(repo: string, relative: string, ops: Ops): void {
   }
 }
 
+interface CollectedFile {
+  readonly rel: string
+  /** A symlink sitting at a path that TEXTUALLY matches a managed path is never "the managed file, unchanged" -- it is the wrong kind of node there and must be removed so `Ops.write()` creates a real file, never writes through the link into whatever it targets. */
+  readonly isSymlink: boolean
+}
+
+/** Every FILE (or symlink, treated as a leaf -- never traversed) under `rel`, repo-relative, depth-first. `[]` when `rel` does not exist. */
+function collectFiles(repo: string, rel: string): CollectedFile[] {
+  const stats = lstatSync(join(repo, rel), { throwIfNoEntry: false })
+  if (stats === undefined) return []
+  if (stats.isSymbolicLink()) return [{ rel, isSymlink: true }]
+  if (!stats.isDirectory()) return [{ rel, isSymlink: false }]
+  return readdirSync(join(repo, rel)).flatMap((entry) => collectFiles(repo, `${rel}/${entry}`))
+}
+
+/** Removes any now-empty directory under `rel` (never `rel` itself, never the preserved subtree), depth-first. An ancestor of the preserved subtree is still walked (so its OTHER children get pruned) but is never itself removed, since the preserved subtree keeps it non-empty. */
+function pruneEmptyDirs(repo: string, rel: string, preserveRel: string | undefined): void {
+  if (preserveRel !== undefined && rel === preserveRel) return
+  const abs = join(repo, rel)
+  const stats = lstatSync(abs, { throwIfNoEntry: false })
+  if (stats === undefined || !stats.isDirectory() || stats.isSymbolicLink()) return
+  for (const entry of readdirSync(abs)) pruneEmptyDirs(repo, `${rel}/${entry}`, preserveRel)
+  if (rel !== WORKFLOWS_ROOT && readdirSync(abs).length === 0) rmSync(abs, { recursive: true })
+}
+
+/**
+ * Selective counterpart to `reconcileWorkflowsRoot`, used only by
+ * `install()` (independent review, 2026-09-29): the wholesale
+ * remove-then-rewrite that function does is correct for `uninstall()`
+ * (nothing should survive), but for `install()` it defeated `Ops.write()`'s
+ * own byte comparison — every managed file always looked freshly absent,
+ * so a no-op run still reported every file as newly 'create'd and touched
+ * every mtime. This instead removes only paths NOT in `managedPaths` (and
+ * never the preserved pre-hard-cut log-quarantine subtree), leaving every
+ * managed path exactly as it is on disk for `Ops.write()` to diff for real.
+ */
+function reconcileManagedWorkflowsRoot(repo: string, ops: Ops, managedPaths: readonly string[], reason: string): void {
+  // lstat, not existsSync: existsSync follows links and reports false for a
+  // dangling one, which would otherwise leave a stale (possibly dangling)
+  // symlink AT the root itself in place -- and a later `mkdirSync(...,
+  // {recursive: true})` for a managed path under it throws EEXIST against
+  // that non-directory entry rather than creating a real .workflows/.
+  const rootStats = lstatSync(join(repo, WORKFLOWS_ROOT), { throwIfNoEntry: false })
+  if (rootStats === undefined) return
+  if (rootStats.isSymbolicLink()) {
+    ops.remove(WORKFLOWS_ROOT, 'the managed root was a symlink, not a real directory')
+    return
+  }
+  const workflowLogs = LEGACY_LOG_QUARANTINES[0]
+  const preserveRel = realDirectoryHasData(repo, workflowLogs.rel) ? workflowLogs.rel : undefined
+  const managed = new Set(managedPaths)
+
+  for (const { rel, isSymlink } of collectFiles(repo, WORKFLOWS_ROOT)) {
+    if (preserveRel !== undefined && (rel === preserveRel || rel.startsWith(`${preserveRel}/`))) continue
+    if (managed.has(rel) && !isSymlink) continue
+    ops.remove(rel, isSymlink && managed.has(rel) ? 'a managed path was a symlink, not a real file' : reason)
+  }
+  // The preserved quarantine subtree is otherwise skipped entirely above,
+  // but a symlink placed inside it is never legitimate quarantined
+  // evidence -- removed without traversing its target, same as
+  // reconcileWorkflowsRoot's own uninstall path.
+  if (preserveRel !== undefined) removeSymlinksBelow(repo, preserveRel, ops)
+  pruneEmptyDirs(repo, WORKFLOWS_ROOT, preserveRel)
+}
+
 export type UninstallOptions = InstallOptions
 
 export interface UninstallResult extends InstallResult {
@@ -460,7 +540,9 @@ export interface UninstallResult extends InstallResult {
 
 export function uninstall(repoArg: string, options: UninstallOptions): UninstallResult {
   const repo = resolveRepo(repoArg)
-  validateOwnedConfig(readCentralMarker(repo))
+  // Never simulated, dry-run or not: uninstalling a repo with no marker at
+  // all is not a "what would happen" question worth answering.
+  validateOwnedConfig(readCentralMarker(repo, false))
   const dryRun = options.dryRun === true
   const lock = priorLockForReconciliation(repo)
   const ops = new Ops(repo, dryRun)