@anionex/dsh-turn-rewind 0.3.2 → 0.3.4

package/src/engine.ts

@@ -58,7 +58,7 @@ const DEFAULTS = {
   planTtlMs: 15 * 60 * 1_000,
   staleLockMs: 30_000,
   turnCheckpointMode: 'legacy',
-  turnCheckpointTimeoutMs: 5_000,
+  turnCheckpointTimeoutMs: 60_000,
   turnCheckpointMaxNewBytes: 32 * 1024 * 1024,
   turnCheckpointTrust: 'fast',
 } as const
@@ -312,17 +312,36 @@ export class ChangeLedgerEngine {
             })
           } else {
             const id = makeId('rp')
-            const captured = (await captureGitTurnCheckpoint({
-              cwd: source.state.root,
-              id,
-              sessionId: options.sessionId,
-              turn: options.turn,
-              turnStartSeq: options.turnStartSeq,
-              config: this.config,
-              signal,
-            })).manifest
-            await this.publishGitManifest(captured, signal)
-            manifest = captured
+            try {
+              const captured = (await captureGitTurnCheckpoint({
+                cwd: source.state.root,
+                id,
+                sessionId: options.sessionId,
+                turn: options.turn,
+                turnStartSeq: options.turnStartSeq,
+                config: this.config,
+                signal,
+              })).manifest
+              await this.publishGitManifest(captured, signal)
+              manifest = captured
+            } catch (error) {
+              // A Git-native turn tree cannot omit a path without changing the
+              // trust fences it is verified with, so a path that exceeds a limit
+              // falls back to the ledger's own store, which keeps the checkpoint
+              // and simply reports the paths it could not store.
+              if (!(error instanceof ChangeLedgerError)
+                || (error.code !== 'FILE_TOO_LARGE' && error.code !== 'UNSUPPORTED_FILE_TYPE')) throw error
+              manifest = await this.createLocked({
+                cwd: source.state.root,
+                kind: 'turn',
+                sessionId: options.sessionId,
+                label: `Before turn ${String(options.turn)} checkpoint`,
+                turn: options.turn,
+                turnStartSeq: options.turnStartSeq,
+                signal,
+                deferGarbageCollection: true,
+              })
+            }
           }
           await this.store.deleteTurnCheckpointSkip(
             source.state.root,
@@ -493,7 +512,7 @@ export class ChangeLedgerEngine {
         ...(currentState.type === 'git' && currentState.operation !== undefined ? { currentOperation: currentState.operation } : {}),
         headChanged: repositoryHeadChanged(manifest.repository, currentState),
         operationChanged: workspaceOperationChanged(manifest.repository, currentState),
-        changes: diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries),
+        changes: filterUnobservedChanges(manifest, diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries)),
       }
     } finally {
       await release()
@@ -534,7 +553,7 @@ export class ChangeLedgerEngine {
         throw workspaceStaleError(options.expectedRepository, current.source.state, 'inspection')
       }
       assertRepositoryCompatible(manifest, current.source.state, options.allowHeadChange === true)
-      const changes = diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries)
+      const changes = filterUnobservedChanges(manifest, diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries))
       if (changes.length === 0) {
         throw new ChangeLedgerError('NO_CHANGES', `workspace already matches restore point ${manifest.id}`)
       }
@@ -952,6 +971,9 @@ export class ChangeLedgerEngine {
         fileCount: tree.fileCount,
         totalBytes: tree.totalBytes,
         entries: tree.entries,
+        ...(tree.skipped.length === 0 ? {} : { skipped: tree.skipped }),
+        ...(tree.skippedCount === 0 ? {} : { skippedCount: tree.skippedCount }),
+        ...(tree.truncated === undefined ? {} : { truncated: tree.truncated }),
         restoreCount: 0,
       }
       if (options.deferGarbageCollection !== true) {
@@ -1158,6 +1180,9 @@ function summarize(manifest: RestorePointManifest): RestorePointSummary {
     treeHash: manifest.treeHash,
     fileCount: manifest.fileCount,
     totalBytes: manifest.totalBytes,
+    ...(manifest.skipped === undefined ? {} : { skipped: manifest.skipped }),
+    skippedCount: manifest.skippedCount ?? 0,
+    ...(manifest.truncated === undefined ? {} : { truncated: manifest.truncated }),
     restoreCount: manifest.restoreCount,
     ...(manifest.lastRestoredAt === undefined ? {} : { lastRestoredAt: manifest.lastRestoredAt }),
     ...(workspace.type === 'git' && workspace.head !== undefined ? { head: workspace.head } : {}),
@@ -1168,6 +1193,28 @@ function summarize(manifest: RestorePointManifest): RestorePointSummary {
   }
 }
 
+/**
+ * Drop changes a restore point never observed.
+ *
+ * Limits leave a point partial by design, so it must never rewrite a path it
+ * could not store, and while its skip list is incomplete it must not authorize
+ * deleting a path it never saw either: a pre-existing file that merely exceeded
+ * a limit must survive the rewind.
+ * @param manifest - restore point being inspected or planned.
+ * @param changes - raw path differences against the current workspace.
+ * @returns the changes a restore may act on.
+ */
+function filterUnobservedChanges(
+  manifest: RestorePointManifest,
+  changes: readonly WorkspaceChange[],
+): readonly WorkspaceChange[] {
+  const skipped = new Set((manifest.skipped ?? []).map(skip => skip.path))
+  const incomplete = manifest.truncated !== undefined
+    || (manifest.skippedCount ?? 0) > (manifest.skipped?.length ?? 0)
+  if (skipped.size === 0 && !incomplete) return changes
+  return changes.filter(change => !skipped.has(change.path) && !(incomplete && change.kind === 'added'))
+}
+
 /** Reject a fence that now describes a different workspace or workspace mode. */
 function assertWorkspaceIdentityCompatible(before: WorkspaceState, after: WorkspaceState): void {
   if (before.type !== after.type) {

package/src/git.ts

@@ -4,7 +4,7 @@ import { link, lstat, mkdir, open, readFile, realpath, unlink } from 'node:fs/pr
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { ChangeLedgerError, errorMessage } from './errors.js'
 import { canonicalDirectory, isNodeError, syncDirectory, validateRelativePath } from './path-utils.js'
-import type { GitWorkspaceState } from './types.js'
+import type { CaptureSkip, CaptureTruncation, GitWorkspaceState } from './types.js'
 
 const GIT_MAX_BUFFER = 32 * 1024 * 1024
 
@@ -12,6 +12,10 @@ const GIT_MAX_BUFFER = 32 * 1024 * 1024
 export interface RepositorySnapshotSource {
   readonly state: GitWorkspaceState
   readonly paths: readonly string[]
+  /** Git discovery never skips a path; per-file limits are reported by capture. */
+  readonly skipped: readonly CaptureSkip[]
+  readonly skippedCount: number
+  readonly truncated?: CaptureTruncation
 }
 
 /** Durable identity and shared lock location for one concrete Git worktree. */
@@ -72,6 +76,8 @@ export async function discoverRepository(cwd: string, signal?: AbortSignal): Pro
       stagedPaths,
     },
     paths,
+    skipped: [],
+    skippedCount: 0,
   }
 }
 

package/src/index.ts

@@ -2,6 +2,7 @@
  * DSH Turn Rewind, powered by persistent, inspectable, approval-gated Change Ledger restore points.
  * @module @anionex/dsh-turn-rewind
  */
+import { readFileSync } from 'node:fs'
 import type { Context } from '@deepseek-ai/cordis'
 import { ChangeLedgerEngine } from './engine.js'
 import { installManageHttp, installRewindHttp, TurnCheckpointCoordinator } from './rewind-host.js'
@@ -14,6 +15,23 @@ export * from './rewind-host.js'
 export * from './settings.js'
 export * from './types.js'
 
+/**
+ * Version of the running package.
+ *
+ * A Profile keeps the previous plugin in memory until DSH restarts, so the
+ * loaded version is logged at activation and can be compared with what is on
+ * disk in `.../profiles/<name>/node_modules/@anionex/dsh-turn-rewind`.
+ * @returns the package version, or `unknown` when the manifest is unreadable.
+ */
+function pluginVersion(): string {
+  try {
+    const manifest = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version?: unknown }
+    return typeof manifest.version === 'string' ? manifest.version : 'unknown'
+  } catch {
+    return 'unknown'
+  }
+}
+
 declare module '@deepseek-ai/cordis' {
   interface Context {
     changeLedger: ChangeLedgerService
@@ -29,6 +47,7 @@ export class ChangeLedgerService {
     ctx.provide('changeLedger', this)
     this.engine = new ChangeLedgerEngine(config)
     const checkpoints = new TurnCheckpointCoordinator(this.engine)
+    ctx.logger.info(`[turn-rewind] v${pluginVersion()} active; workspace modes: git worktree, ordinary directory`)
     ctx.inject(['agents'], (scope: Context) => { checkpoints.install(scope) })
     // `apiProxy` is deliberately absent: DSH 0.1.2-alpha carriers (DSH Desktop 2.x)
     // provide `sessionController` instead, and the route must exist on both.

package/src/rewind-host.ts

@@ -117,7 +117,7 @@ interface SessionControllerLike {
 }
 
 /** Services a conversation restart can be built on, in either carrier shape. */
-type ConversationRestartContext = Pick<Context, 'sessions' | 'sessionQuery'> & {
+type ConversationRestartContext = Pick<Context, 'sessions' | 'sessionQuery' | 'get'> & {
   readonly apiProxy?: ApiProxyLike
   readonly sessionController?: SessionControllerLike
 }
@@ -432,6 +432,11 @@ export function createRewindHttpHandler(
         const changes = inspection.changes.slice(offset, offset + limit)
         const common = {
           status: 'ready', sessionId, messageSeq, turn: checkpoint.turn, checkpointId: checkpoint.id,
+          // A restore point that could not store every eligible path stays usable;
+          // the browser shows what was left out instead of blocking the rewind.
+          skippedCount: inspection.restorePoint.skippedCount,
+          ...(inspection.restorePoint.skipped === undefined ? {} : { skipped: inspection.restorePoint.skipped }),
+          ...(inspection.restorePoint.truncated === undefined ? {} : { captureTruncated: inspection.restorePoint.truncated }),
           turnStartSeq: checkpoint.turnStartSeq,
           totalChanges: inspection.changes.length,
           changes: changes.map(change => ({ path: change.path, kind: change.kind })),
@@ -667,14 +672,18 @@ async function createConversationRestart(
     || current.previousTurnEndSeq !== checkpoint.previousTurnEndSeq) {
     throw new ChangeLedgerError('PLAN_STALE', 'the session no longer contains the selected message boundary')
   }
-  const controller = ctx.sessionController
+  // Cordis throws when a context reads a service property it did not inject, and
+  // no single inject list covers both carriers: 0.1.1 provides `apiProxy` while
+  // 0.1.2-alpha provides `sessionController`. `ctx.get` is the optional accessor
+  // that returns undefined instead of failing the request.
+  const controller = ctx.get('sessionController') as SessionControllerLike | undefined
   if (controller !== undefined) {
     const created = checkpoint.previousTurnEndSeq === undefined
       ? await controller.create({ cwd: checkpoint.cwd })
       : await controller.fork({ sessionId: sourceId, atSeq: checkpoint.previousTurnEndSeq })
     return { sessionId: requiredText(created.sessionId, 'sessionController sessionId') }
   }
-  const apiProxy = ctx.apiProxy
+  const apiProxy = ctx.get('apiProxy') as ApiProxyLike | undefined
   if (apiProxy === undefined) {
     throw new ChangeLedgerError(
       'CONVERSATION_REWIND_FAILED',

package/src/snapshot.ts

@@ -6,6 +6,9 @@ import { isNodeError, resolveWorkspacePath } from './path-utils.js'
 import type { LedgerStore } from './store.js'
 import { discoverWorkspace, sameWorkspaceFence, type WorkspaceSnapshotSource } from './workspace.js'
 import type {
+  CaptureSkip,
+  CaptureSkipReason,
+  CaptureTruncation,
   ResolvedChangeLedgerConfig,
   SnapshotEntry,
   WorkspaceChange,
@@ -18,11 +21,20 @@ export interface CapturedTree {
   readonly source: WorkspaceSnapshotSource
   readonly entries: Readonly<Record<string, SnapshotEntry>>
   readonly gitEntries?: Readonly<Record<string, SnapshotEntry>>
+  /** Eligible paths this capture could not store; a restore never touches them. */
+  readonly skipped: readonly CaptureSkip[]
+  readonly skippedCount: number
+  /** Set when a limit stopped the capture before every eligible path was read. */
+  readonly truncated?: CaptureTruncation
+  /** True when the recorded skip list is shorter than `skippedCount`. */
+  readonly skippedListTruncated: boolean
   readonly treeHash: string
   readonly fileCount: number
   readonly totalBytes: number
 }
 
+const MAX_RECORDED_SKIPS = 50
+
 /** Capture the current tracked and non-ignored Git working tree. */
 export async function captureTree(options: {
   readonly cwd: string
@@ -33,12 +45,21 @@ export async function captureTree(options: {
 }): Promise<CapturedTree> {
   throwIfAborted(options.signal)
   const source = await discoverWorkspace(options.cwd, options.config, options.signal)
-  if (source.paths.length > options.config.maxFiles) {
-    throw new ChangeLedgerError(
-      'TOO_MANY_FILES',
-      `workspace has ${source.paths.length} eligible paths; configured maximum is ${options.config.maxFiles}`,
-    )
+  // Limits never discard an entire restore point: an over-limit path is left out
+  // and reported, and the remaining eligible paths are still captured. A restore
+  // only ever rewrites captured paths, so a partial point stays safe to apply.
+  const skipped: CaptureSkip[] = [...source.skipped]
+  let skippedCount = source.skippedCount
+  let truncated: CaptureTruncation | undefined = source.truncated
+  const recordSkip = (path: string, reason: CaptureSkipReason): void => {
+    skippedCount += 1
+    if (skipped.length < MAX_RECORDED_SKIPS) skipped.push({ path, reason })
+    else truncated ??= reason === 'snapshot-limit' ? 'snapshot-limit' : 'file-limit'
   }
+  const paths = source.paths.length > options.config.maxFiles
+    ? source.paths.slice(0, options.config.maxFiles)
+    : source.paths
+  if (source.paths.length > options.config.maxFiles) truncated ??= 'file-limit'
 
   const entries: Record<string, SnapshotEntry> = Object.create(null) as Record<string, SnapshotEntry>
   // Git-object capture only applies to a Git worktree; an ordinary directory
@@ -51,18 +72,38 @@ export async function captureTree(options: {
         entries: Object.create(null) as Record<string, SnapshotEntry>,
       }
   let totalBytes = 0
+  let budgetSpent = false
   const capturePath = async (path: string): Promise<void> => {
     throwIfAborted(options.signal)
-    const entry = await captureEntry(source.state.root, path, options.config.maxFileBytes, options.signal)
+    if (budgetSpent) {
+      // The aggregate budget is gone, but the path is still recorded so a
+      // restore can prove this point never observed it.
+      recordSkip(path, 'snapshot-limit')
+      return
+    }
+    let entry: Awaited<ReturnType<typeof captureEntry>>
+    try {
+      entry = await captureEntry(source.state.root, path, options.config.maxFileBytes, options.signal)
+    } catch (error) {
+      if (error instanceof ChangeLedgerError && error.code === 'FILE_TOO_LARGE') {
+        recordSkip(path, 'file-too-large')
+        return
+      }
+      if (error instanceof ChangeLedgerError && error.code === 'UNSUPPORTED_FILE_TYPE') {
+        recordSkip(path, 'unsupported-file-type')
+        return
+      }
+      throw error
+    }
     if (entry === undefined) return
     if (entry.kind === 'file') {
-      totalBytes += entry.content.length
-      if (totalBytes > options.config.maxSnapshotBytes) {
-        throw new ChangeLedgerError(
-          'SNAPSHOT_TOO_LARGE',
-          `eligible files exceed configured aggregate limit of ${options.config.maxSnapshotBytes} bytes`,
-        )
+      if (budgetSpent || totalBytes + entry.content.length > options.config.maxSnapshotBytes) {
+        budgetSpent = true
+        truncated ??= 'snapshot-limit'
+        recordSkip(path, 'snapshot-limit')
+        return
       }
+      totalBytes += entry.content.length
       if (options.store !== undefined) {
         await options.store.putBlob(source.state.root, entry.snapshot.blob, entry.content)
       }
@@ -75,22 +116,23 @@ export async function captureTree(options: {
     entries[path] = entry.snapshot
     if (gitCapture !== undefined) gitCapture.entries[path] = entry.snapshot
   }
-  if (gitCapture === undefined) {
-    for (const path of source.paths) await capturePath(path)
-  } else {
+  {
+    // Reading one file at a time makes a real project directory take minutes, so
+    // every capture runs through a bounded worker pool. Per-file stability stats
+    // and the synchronous budget check keep the result identical to a serial run.
     let next = 0
     let failed = false
     let firstError: unknown = new ChangeLedgerError('WORKSPACE_CHANGED_DURING_CAPTURE', 'parallel comparison capture failed')
     const concurrency = Math.min(
       32,
-      source.paths.length,
+      paths.length,
       Math.max(1, Math.floor(COMPARISON_READ_BUDGET_BYTES / options.config.maxFileBytes)),
     )
     const workers = Array.from({ length: concurrency }, async () => {
-      while (!failed && next < source.paths.length) {
+      while (!failed && next < paths.length) {
         const index = next
         next += 1
-        const path = source.paths[index]
+        const path = paths[index]
         if (path === undefined) continue
         try {
           await capturePath(path)
@@ -110,6 +152,10 @@ export async function captureTree(options: {
     source,
     entries,
     ...(gitCapture === undefined ? {} : { gitEntries: gitCapture.entries }),
+    skipped,
+    skippedCount,
+    skippedListTruncated: skippedCount > skipped.length,
+    ...(truncated === undefined ? {} : { truncated }),
     treeHash: hashTree(entries),
     fileCount: Object.keys(entries).length,
     totalBytes,

package/src/store.ts

@@ -270,6 +270,10 @@ export class LedgerStore {
       throw new ChangeLedgerError('BLOB_HASH_MISMATCH', `refusing to store content whose SHA-256 does not match ${hash}`)
     }
     const path = this.blobPath(workspace, hash)
+    // Content addressing makes an existing blob identical by construction, and
+    // re-writing it costs one fsync per file: a full-tree capture of a large
+    // workspace otherwise spends minutes proving it already stored the content.
+    if (await pathExists(path)) return
     const directory = join(this.workspaceDir(workspace), 'blobs', hash.slice(0, 2))
     await mkdir(directory, { recursive: true, mode: 0o700 })
     const temporary = join(directory, `.${randomUUID()}.tmp`)

package/src/types.ts

@@ -33,6 +33,18 @@ export interface SymlinkSnapshotEntry {
 /** One path captured by a restore point. */
 export type SnapshotEntry = FileSnapshotEntry | SymlinkSnapshotEntry
 
+/** Why one eligible path was left out of a restore point. */
+export type CaptureSkipReason = 'file-too-large' | 'unsupported-file-type' | 'snapshot-limit'
+
+/** One eligible path that a restore point could not store. */
+export interface CaptureSkip {
+  readonly path: string
+  readonly reason: CaptureSkipReason
+}
+
+/** Why a capture stopped before it enumerated every eligible path. */
+export type CaptureTruncation = 'file-limit' | 'snapshot-limit'
+
 /** Git facts that fence a restore point to the repository state it observed. */
 export interface GitWorkspaceState {
   readonly type: 'git'
@@ -80,6 +92,15 @@ export interface RestorePointManifestV1 {
   readonly fileCount: number
   readonly totalBytes: number
   readonly entries: Readonly<Record<string, SnapshotEntry>>
+  /**
+   * Eligible paths this restore point could not store, bounded for storage.
+   * A restore never touches them, so a partial point stays safe to apply.
+   */
+  readonly skipped?: readonly CaptureSkip[]
+  /** Total skipped paths, including any beyond the bounded list. */
+  readonly skippedCount?: number
+  /** Set when limits stopped the capture before every eligible path was read. */
+  readonly truncated?: CaptureTruncation
   readonly restoreCount: number
   readonly lastRestoredAt?: number
 }
@@ -152,6 +173,9 @@ export interface RestorePointSummary {
   readonly treeHash: string
   readonly fileCount: number
   readonly totalBytes: number
+  readonly skipped?: readonly CaptureSkip[]
+  readonly skippedCount: number
+  readonly truncated?: CaptureTruncation
   readonly restoreCount: number
   readonly lastRestoredAt?: number
   readonly head?: string

package/src/validate.ts

@@ -5,6 +5,8 @@ import { hashTree } from './snapshot.js'
 import {
   GIT_CHECKPOINT_FORMAT_VERSION,
   LEDGER_FORMAT_VERSION,
+  type CaptureSkip,
+  type CaptureTruncation,
   type RepositoryState,
   type RestoreOperation,
   type RestorePointKind,
@@ -81,11 +83,24 @@ export function parseManifest(value: unknown): RestorePointManifest {
     corrupt('only turn restore points may carry turn metadata')
   }
   const lastRestoredAt = optionalNonNegativeInteger(record, 'lastRestoredAt')
+  const skipped = parseCaptureSkips(record.skipped)
+  const skippedCount = optionalNonNegativeInteger(record, 'skippedCount')
+  if (skippedCount !== undefined && skippedCount < (skipped?.length ?? 0)) {
+    corrupt('skippedCount cannot be smaller than the recorded skipped paths')
+  }
+  const truncatedValue = record.truncated
+  if (truncatedValue !== undefined && truncatedValue !== 'file-limit' && truncatedValue !== 'snapshot-limit') {
+    corrupt('truncated must be "file-limit" or "snapshot-limit"')
+  }
+  const truncated: CaptureTruncation | undefined = truncatedValue
   const common = {
     id,
     kind: restorePointKind,
     workspace,
     repository,
+    ...(skipped === undefined ? {} : { skipped }),
+    ...(skippedCount === undefined ? {} : { skippedCount }),
+    ...(truncated === undefined ? {} : { truncated }),
     ...(sessionId === undefined ? {} : { sessionId }),
     ...(label === undefined ? {} : { label }),
     ...(parentRestorePoint === undefined ? {} : { parentRestorePoint }),
@@ -168,6 +183,25 @@ export function validateBlobHash(value: string): string {
  * @param value - persisted `repository` field.
  * @returns the validated workspace state.
  */
+/**
+ * Parse the optional bounded list of eligible paths a restore point could not store.
+ * @param value - persisted `skipped` field.
+ * @returns the validated list, or undefined when the manifest carries none.
+ */
+function parseCaptureSkips(value: unknown): readonly CaptureSkip[] | undefined {
+  if (value === undefined) return undefined
+  if (!Array.isArray(value)) corrupt('skipped must be an array')
+  return value.map((entry) => {
+    const record = objectRecord(entry, 'skipped path')
+    const path = validateRelativePath(requireString(record.path, 'skipped path'))
+    const reason = record.reason
+    if (reason !== 'file-too-large' && reason !== 'unsupported-file-type') {
+      corrupt('skipped reason must be "file-too-large" or "unsupported-file-type"')
+    }
+    return { path, reason }
+  })
+}
+
 function parseRepository(value: unknown): RepositoryState {
   const record = objectRecord(value, 'repository state')
   const root = absoluteString(record, 'root')