@aviaratech/ai-delivery 0.3.12 → 0.3.14

package/dist/lifecycle.test.js

@@ -4,6 +4,7 @@ import { createHash } from 'node:crypto';
 import { syncBuiltinESMExports } from 'node:module';
 import { cpSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, symlinkSync, unlinkSync, utimesSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
+import { createServer } from 'node:net';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { afterAll, test, vi } from 'vitest';
@@ -21,7 +22,7 @@ import * as githubClient from './github/client.js';
 import * as atomicJson from './utils/atomicJson.js';
 import { createIssue, developIssue, listIssueSubissues, readyCheck, resumeCreatedIssue, updateIssue, } from './issue.js';
 import { checkoutPr, finishIssue, listPrs, mergePr, prChecks, prInfo, publishPr, submitFormalReview } from './pr.js';
-import { addWorktreeEntry, removeWorktreeEntry, updateIssueWorktreeDelivery } from './services/worktreeRegistry.js';
+import { addWorktreeEntry, assertNativeIssueTrackingAdmission, getIssueWorktreeStrict, removeWorktreeEntry, updateIssueWorktreeDelivery, } from './services/worktreeRegistry.js';
 import { assertDeliveryRuntimeAdmitted } from './services/deliveryAdmission.js';
 import { getDeliveryRecords } from './services/deliveryRecordService.js';
 import { createIssuePhaseEvidence, loadVerifiedRun, verifyIssue } from './verification.js';
@@ -540,38 +541,13 @@ test('an old active issue remains pinned while a new row uses the same canonical
         assert.equal(readFileSync(registryPath, 'utf8'), futureBytes);
         assert.equal(existsSync(join(root, '.worktrees', 'scratch-new')), false);
         writeFileSync(registryPath, JSON.stringify({ worktrees: [old] }));
-        let issueWrites = 0;
-        const relationshipContext = {
-            root,
-            repo: { owner: 'example', repo: 'widget' },
-            config: (await loadDeliveryConfig(root)).config,
-            clients: {
-                rest: {
-                    issues: {
-                        get: async () => ({ data: { id: 17, number: 17, node_id: 'PARENT-17', state: 'open' } }),
-                        create: async () => {
-                            issueWrites += 1;
-                            return { data: {} };
-                        },
-                        update: async () => {
-                            issueWrites += 1;
-                            return { data: {} };
-                        },
-                    },
-                },
-                graphql: async () => ({
-                    repository: {
-                        issue: {
-                            parent: { id: 'PARENT-17', number: 17 },
-                            blockedBy: { nodes: [], pageInfo: { endCursor: null, hasNextPage: false } },
-                        },
-                    },
-                }),
-            },
-        };
-        await assert.rejects(createIssue(relationshipContext, { title: 'Synthetic child', parentIssueNumber: 17 }), /ownership witness/u);
-        await assert.rejects(updateIssue(relationshipContext, { issueNumber: 17, parentIssueNumber: null }), /ownership witness/u);
-        assert.equal(issueWrites, 0);
+        assert.doesNotThrow(() => assertNativeIssueTrackingAdmission(17, root));
+        const original = readFileSync(registryPath, 'utf8');
+        writeFileSync(registryPath, JSON.stringify({ worktrees: [old, old] }));
+        assert.throws(() => assertNativeIssueTrackingAdmission(17, root), /duplicate/u);
+        writeFileSync(registryPath, futureBytes);
+        assert.throws(() => assertNativeIssueTrackingAdmission(17, root), /unsupported fields/u);
+        writeFileSync(registryPath, original);
         await assert.rejects(prepareIssueWorktree({ identity: 'synthetic-author', issueNumber: 17, repoRoot: root }), /ownership witness/u);
         const row = await prepareStandaloneWorktree({
             branch: 'scratch/new',
@@ -733,8 +709,7 @@ test.each(['current-blocker', 'new-blocker', 'current-parent', 'new-parent'])('t
         await assert.rejects(updateIssue(context, input), /invalid blocked-by relationship evidence/u);
         assert.equal(writes, 0);
         malformedRelationships = false;
-        await assert.rejects(updateIssue(context, { ...input, issueNumber: 17 }), /ownership witness/u);
-        assert.equal(writes, 0);
+        assert.throws(() => getIssueWorktreeStrict(17, root), /ownership witness/u);
         writeFileSync(registryPath, JSON.stringify({ worktrees: [{ ...legacy, schemaVersion: 'unknown@99' }] }));
         await assert.rejects(updateIssue(context, input), /unsupported fields/u);
         assert.equal(writes, 0);
@@ -3618,7 +3593,10 @@ async function syntheticLifecycle(routing) {
                 },
             }),
         },
-        repos: { getCombinedStatusForRef: async () => ({ data: { statuses: [], state: 'success' } }) },
+        repos: {
+            get: async () => ({ data: { full_name: 'example/widget' } }),
+            getCombinedStatusForRef: async () => ({ data: { statuses: [], state: 'success' } }),
+        },
     };
     let authenticatedAuthor = 'synthetic-author[bot]';
     const context = {
@@ -3638,7 +3616,71 @@ async function syntheticLifecycle(routing) {
         },
     };
     let restoreDispatchClient;
+    const enableDispatch = () => {
+        const dispatchClient = vi.spyOn(githubClient, 'createDeliveryGitHubClients').mockImplementation(async (input) => ({
+            ...context.clients,
+            ...(input.role === 'reviewer'
+                ? {
+                    role: 'reviewer',
+                    appActorLogin: async () => 'synthetic-reviewer[bot]',
+                }
+                : {}),
+            graphql: (async (query, variables) => query.includes('DeliveryDiscovery') ||
+                query.includes('DeliveryRepository') ||
+                query.includes('ProjectDeliveryConfiguration')
+                ? syntheticDiscoveryClients().graphql(query, variables)
+                : graphql(query, variables)),
+        }));
+        restoreDispatchClient = () => dispatchClient.mockRestore();
+        return dispatchClient;
+    };
+    const execution = { repoRoot: root, runtimeEntryPath, identity: 'synthetic-author' };
     try {
+        if (routing.legacyNativeMetadata) {
+            enableDispatch();
+            const legacyPath = join(root, '.worktrees', 'issue-17');
+            git(root, 'worktree', 'add', '-b', 'issue/17', legacyPath, 'main');
+            writeFileSync(join(legacyPath, 'artifact.txt'), 'unadopted legacy source\n');
+            const receiptRoot = join(root, '.git', 'legacy-receipts');
+            mkdirSync(receiptRoot);
+            writeFileSync(join(receiptRoot, 'run.json'), '{"producer":"synthetic-legacy"}\n');
+            const registryPath = join(root, '.issue-cli', 'worktrees.json');
+            mkdirSync(dirname(registryPath), { recursive: true });
+            const legacy = {
+                branch: 'issue/17',
+                createdAt: '2026-01-01T00:00:00.000Z',
+                identity: 'synthetic-legacy',
+                issueNumber,
+                path: legacyPath,
+                status: 'active',
+                type: 'issue',
+                updatedAt: '2026-01-01T00:00:00.000Z',
+            };
+            const registryBytes = JSON.stringify({ worktrees: [legacy] });
+            writeFileSync(registryPath, registryBytes);
+            const source = directoryHash(legacyPath);
+            const receipts = directoryHash(receiptRoot);
+            await assert.rejects(executeTool('issue_update', { issueNumber, points: 2 }, {
+                ...execution,
+                identity: 'synthetic-reviewer',
+            }), /identity|author|permitted|allowed/u);
+            const updated = (await executeTool('issue_update', {
+                issueNumber,
+                parentIssueNumber: 11,
+                points: 2,
+                priority: 'High',
+            }, execution));
+            assert.equal(updated.points, 2);
+            assert.equal(updated.priority, 'High');
+            assert.equal(parentIssueNumber, 11);
+            assert.equal(parentPoints, undefined);
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /ownership witness/u);
+            assert.equal(readFileSync(registryPath, 'utf8'), registryBytes);
+            assert.equal(directoryHash(legacyPath), source);
+            assert.equal(directoryHash(receiptRoot), receipts);
+            assert.equal(existsSync(join(gitCommonDir(root), 'ai-delivery/worktree-owners')), false);
+            return;
+        }
         if (routing.producerOnboarding) {
             assert.equal(existsSync(join(root, 'AGENTS.md')), false);
             const archiveBase = join(root, '.git', 'producer-fixture');
@@ -3942,21 +3984,126 @@ exec "${realGit}" "$@"
         await assert.rejects(finishIssue(context, { issueNumber, prNumber, strategy: 'merge' }), /exact prepared merge intent/u);
         headSha = reviewedHead;
         assert.equal(calls.filter((call) => call === 'git:createCommit').length, 1);
+        if (routing.mergedContinuation) {
+            enableDispatch();
+            const terminal = await executeTool('issue_pr_merge', { issueNumber, prNumber, strategy: 'merge' }, execution);
+            assert.equal(terminal.mergeSha, mergeSha);
+            assert.equal(issue.state, 'open');
+            const previous = getIssueWorktreeStrict(issueNumber, root);
+            assert.equal(previous.status, 'merged');
+            const registryPath = join(root, '.issue-cli', 'worktrees.json');
+            const registryBytes = readFileSync(registryPath);
+            const custody = [
+                'runs@2',
+                'publications',
+                'reviews',
+                'merge-intents',
+                'merge-attempts',
+                'merge-results',
+                'merges',
+            ];
+            const oldReceipts = [];
+            const saveReceipts = (path) => {
+                if (!existsSync(path))
+                    return;
+                for (const entry of readdirSync(path, { withFileTypes: true })) {
+                    const child = join(path, entry.name);
+                    if (entry.isDirectory())
+                        saveReceipts(child);
+                    else
+                        oldReceipts.push({ path: child, bytes: readFileSync(child) });
+                }
+            };
+            for (const name of custody)
+                saveReceipts(join(gitCommonDir(root), 'ai-delivery', name));
+            const ownerPath = join(gitCommonDir(root), 'ai-delivery/worktree-owners');
+            const ownerHash = directoryHash(ownerPath);
+            const publicationPath = join(gitCommonDir(root), 'ai-delivery/publications', String(issueNumber), `${headSha}.json`);
+            const publicationBytes = readFileSync(publicationPath);
+            const { publicationId: _publicationId, ...publicationContent } = JSON.parse(publicationBytes.toString());
+            for (const stale of [
+                { issueNumber: 18 },
+                { headSha: 'c'.repeat(40) },
+                { baseSha: 'c'.repeat(40) },
+                { evidenceId: `sha256:${'c'.repeat(64)}` },
+            ]) {
+                const content = { ...publicationContent, ...stale };
+                const bytes = Buffer.from(JSON.stringify({ ...content, publicationId: digestValue(content) }));
+                writeFileSync(publicationPath, bytes, { mode: 0o600 });
+                await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /publication.*(?:verified coordinates|historical approved review)/u);
+                assert.deepEqual(readFileSync(registryPath), registryBytes);
+                assert.deepEqual(readFileSync(publicationPath), bytes);
+            }
+            writeFileSync(publicationPath, publicationBytes, { mode: 0o600 });
+            const reviewPath = join(gitCommonDir(root), 'ai-delivery/reviews', String(issueNumber), `${headSha}.json`);
+            const reviewBytes = readFileSync(reviewPath);
+            const { receiptId: _receiptId, artifact: savedArtifact, ...reviewContent } = JSON.parse(reviewBytes.toString());
+            const { artifactId: _artifactId, ...artifactContent } = savedArtifact;
+            const staleArtifact = { ...artifactContent, diffScopeHash: `sha256:${'c'.repeat(64)}` };
+            const staleReview = { ...reviewContent, artifact: { ...staleArtifact, artifactId: digestValue(staleArtifact) } };
+            const staleReviewBytes = Buffer.from(JSON.stringify({ ...staleReview, receiptId: digestValue(staleReview) }));
+            writeFileSync(reviewPath, staleReviewBytes, { mode: 0o600 });
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /exact historical approved review/u);
+            assert.deepEqual(readFileSync(registryPath), registryBytes);
+            assert.deepEqual(readFileSync(reviewPath), staleReviewBytes);
+            writeFileSync(reviewPath, reviewBytes, { mode: 0o600 });
+            await assert.rejects(developIssue({
+                ...context,
+                config: {
+                    ...config,
+                    roles: {
+                        ...config.roles,
+                        author: { ...config.roles.author, identity: 'other-owner' },
+                    },
+                },
+            }, issueNumber), /same preparing owner/u);
+            issue.state = 'closed';
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /closed/u);
+            issue.state = 'open';
+            headSha = 'b'.repeat(40);
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /terminal receipt/u);
+            headSha = reviewedHead;
+            const mergePath = join(gitCommonDir(root), 'ai-delivery/merges', String(issueNumber), `${headSha}.json`);
+            const mergeBytes = readFileSync(mergePath);
+            unlinkSync(mergePath);
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /exact terminal merge receipt/u);
+            writeFileSync(mergePath, mergeBytes, { mode: 0o600 });
+            assert.deepEqual(readFileSync(registryPath), registryBytes);
+            projectStatus = null;
+            failNextProjectSync = true;
+            await assert.rejects(executeTool('issue_develop', { issueNumber }, execution), /synthetic Project interruption/u);
+            const reactivated = getIssueWorktreeStrict(issueNumber, root);
+            assert.equal(reactivated.status, 'active');
+            assert.equal(reactivated.prNumber, undefined);
+            assert.equal(reactivated.identity, previous.identity);
+            assert.equal(reactivated.createdAt, previous.createdAt);
+            const resumed = await executeTool('issue_develop', { issueNumber }, execution);
+            assert.deepEqual(resumed, { path: previous.path, branch: previous.branch });
+            assert.equal(projectStatus, 'Active');
+            await assert.rejects(verifyIssue({ issueNumber, repoRoot: row.path }), /already-merged issue head/u);
+            for (const saved of oldReceipts) {
+                assert.deepEqual(readFileSync(saved.path), saved.bytes);
+            }
+            assert.equal(directoryHash(ownerPath), ownerHash);
+            // A fresh commit produces new verification slots while the complete prior head remains immutable.
+            writeFileSync(join(row.path, 'change.txt'), 'continued feature\n');
+            git(row.path, 'add', 'change.txt');
+            git(row.path, 'commit', '-qm', 'continue unfinished synthetic issue');
+            const continued = await verifyIssue({ issueNumber, repoRoot: row.path });
+            assert.notEqual(continued.classification.head.sha, reviewedHead);
+            for (const saved of oldReceipts)
+                assert.deepEqual(readFileSync(saved.path), saved.bytes);
+            assert.equal(directoryHash(ownerPath), ownerHash);
+            assert.equal(calls.filter((call) => call === 'git:createCommit').length, 1);
+            return;
+        }
         const blockedRecordPath = join(gitCommonDir(root), 'ai-delivery', 'deliveries.json');
         mkdirSync(blockedRecordPath);
         await assert.rejects(finishIssue(context, { issueNumber, prNumber, strategy: 'merge' }), /Delivery record store is invalid/u);
         assert.equal(existsSync(row.path), false);
         rmSync(blockedRecordPath, { recursive: true });
-        const dispatchClient = vi.spyOn(githubClient, 'createDeliveryGitHubClients').mockImplementation(async () => ({
-            ...context.clients,
-            graphql: (async (query, variables) => query.includes('DeliveryDiscovery') ||
-                query.includes('DeliveryRepository') ||
-                query.includes('ProjectDeliveryConfiguration')
-                ? syntheticDiscoveryClients().graphql(query, variables)
-                : graphql(query, variables)),
-        }));
-        restoreDispatchClient = () => dispatchClient.mockRestore();
-        const execution = { repoRoot: root, runtimeEntryPath, identity: 'synthetic-author' };
+        const dispatchClient = enableDispatch();
+        execution.runtimeEntryPath = runtimeEntryPath;
         const terminalMerge = (await executeTool('issue_pr_merge', { issueNumber, prNumber, strategy: 'merge' }, execution));
         assert.equal(terminalMerge.mergeSha, git(remote, 'rev-parse', 'refs/heads/main'));
         const finished = (await executeTool('issue_finish', { issueNumber, prNumber, strategy: 'merge' }, execution));
@@ -4020,6 +4167,8 @@ test.each([
     { remote: 'upstream', divergentOrigin: false },
     { remote: 'upstream', divergentOrigin: true },
 ])('synthetic lifecycle finishes with remote $remote and divergent origin $divergentOrigin', syntheticLifecycle, 15_000);
+test('supported develop resumes an open merged issue under the same owner and preserves prior receipts', { timeout: 0 }, async () => syntheticLifecycle({ remote: 'origin', divergentOrigin: false, mergedContinuation: true }));
+test('supported native metadata updates a legacy target without adopting its source or receipts', { timeout: 0 }, async () => syntheticLifecycle({ remote: 'origin', divergentOrigin: false, legacyNativeMetadata: true }));
 test('an unrelated consumer uses public MCP setup through verified configured-author publication, counted review readback, merge and cleanup', { timeout: 0 }, async () => {
     await syntheticLifecycle({ remote: 'origin', divergentOrigin: false, producerOnboarding: true });
 });
@@ -4553,6 +4702,125 @@ const child = require('node:child_process').spawnSync(${JSON.stringify(consumer.
 if (child.error) throw child.error;
 process.exit(child.status ?? 1);`;
 }
+test.each([
+    ['pass', 'node24'],
+    ['limit', 'node24'],
+    ['cancel', 'node24'],
+    ['error', 'node24'],
+    ['pass', 'node26'],
+    ['limit', 'node26'],
+    ['cancel', 'node26'],
+    ['error', 'node26'],
+])('Unix IPC sockets preserve regular-file output and %s verification on %s', async (mode, runtime) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ad-socket-')));
+    const baselineSocket = join(output, 'baseline.sock'), childSocket = join(output, 'child.sock');
+    const artifact = join(output, 'artifact'), unrelated = join(output, 'unrelated');
+    writeFileSync(artifact, 'x'.repeat(512));
+    writeFileSync(unrelated, 'preserved');
+    const server = createServer((socket) => {
+        socket.destroy();
+    });
+    let root;
+    try {
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(baselineSocket, resolve);
+        });
+        const script = `(async () => {
+    const fs = require('node:fs'), net = require('node:net');
+    await new Promise((resolve, reject) => {
+      const socket = net.connect(${JSON.stringify(baselineSocket)});
+      socket.once('error', reject); socket.once('connect', () => { socket.destroy(); resolve(); });
+    });
+    const server = net.createServer();
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(${JSON.stringify(childSocket)}, resolve); });
+    fs.writeFileSync(${JSON.stringify(join(output, 'socket-ready'))}, 'ready');
+    try {
+      for (let unit = 0; unit < 12; unit++) {
+        fs.appendFileSync(${JSON.stringify(artifact)}, 'x'.repeat(256));
+        await new Promise(resolve => setTimeout(resolve, 100));
+      }
+    } finally { await new Promise(resolve => server.close(resolve)); }
+    if (${JSON.stringify(mode)} === 'error') process.exitCode = 9;
+  })().catch(error => { console.error(error); process.exitCode = 1; });`;
+        ({ root } = await fixture({ personalAuthor: true, firstStageScript: script }));
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'host-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const clients = syntheticDiscoveryClients();
+        const replies = [];
+        for (const fragment of [
+            'query DeliveryRepository',
+            'query ProjectDeliveryConfiguration',
+            'issueFields(first:',
+            'issueTypes(first:',
+        ])
+            replies.push({ fragment, data: await clients.graphql(fragment) });
+        const consumer = runtime === 'node26'
+            ? packedNode26Consumer()
+            : { executable: process.execPath, root: fileURLToPath(new URL('../', import.meta.url)) };
+        const result = execFileSync(consumer.executable, [
+            '-e',
+            `(async () => {
+      const assert = require('node:assert/strict'), fs = require('node:fs');
+      assert.equal(process.version, ${JSON.stringify(runtime === 'node26' ? 'v26.2.0' : 'v24.21.0')});
+      const replies = ${JSON.stringify(replies)};
+      globalThis.fetch = async (url, options) => {
+        assert.equal(String(url), 'https://api.github.com/graphql');
+        const reply = replies.find(reply => JSON.parse(options.body).query.includes(reply.fragment));
+        assert.ok(reply); return new Response(JSON.stringify({ data: reply.data }), { status: 200, headers: { 'content-type': 'application/json' } });
+      };
+      process.env.AUTHOR_TOKEN = 'synthetic-author-token';
+      const { verifyIssue } = await import(${JSON.stringify(runtime === 'node26' ? '@aviaratech/ai-delivery/agent' : new URL('./agent.js', import.meta.url).href)});
+      const controller = new AbortController(), observations = [];
+      const cancellation = ${JSON.stringify(mode)} === 'cancel' ? setInterval(() => {
+        if (fs.existsSync(${JSON.stringify(childSocket)})) {
+          assert.equal(fs.lstatSync(${JSON.stringify(childSocket)}).isSocket(), true);
+          controller.abort();
+        }
+      }, 10) : undefined;
+      const originalWrite = process.stderr.write;
+      process.stderr.write = line => {
+        observations.push(String(line));
+        return true;
+      };
+      try {
+        const running = verifyIssue({ issueNumber: 17, repoRoot: ${JSON.stringify(row.path)}, signal: controller.signal,
+          resourceBounds: { maxAggregateRssBytes: 1000000000, minFreeDiskBytes: 1,
+            maxNewOutputBytes: ${mode === 'limit' ? 1024 : 8192}, outputRoots: [${JSON.stringify(output)}] } });
+        if (${JSON.stringify(mode)} === 'pass') {
+          const run = await running;
+          assert.ok(run.resources.sampleCount > 0);
+          assert.ok(run.resources.maxSampledNewOutputBytes >= 3072);
+          assert.equal(fs.statSync(${JSON.stringify(artifact)}).size, 3584);
+          assert.equal(fs.existsSync(${JSON.stringify(childSocket)}), false);
+          assert.equal(fs.lstatSync(${JSON.stringify(baselineSocket)}).isSocket(), true);
+        } else await assert.rejects(running, error => {
+          assert.match(String(error), ${mode === 'limit' ? '/filesystem output.*exceeded/' : mode === 'cancel' ? '/cancelled/' : '/exit 9/'});
+          assert.doesNotMatch(String(error), /cleanup failed/); return true;
+        });
+        assert.equal(fs.readFileSync(${JSON.stringify(unrelated)}, 'utf8'), 'preserved');
+        console.log(JSON.stringify({ scenario: 'unix-ipc-socket', runtime: process.version, mode: ${JSON.stringify(mode)},
+          sampleCount: observations.length, unrelatedPreserved: true }));
+      } finally { clearInterval(cancellation); controller.abort(); process.stderr.write = originalWrite; }
+    })().catch(error => { console.error(error); process.exitCode = 1; });`,
+        ], { cwd: consumer.root, encoding: 'utf8', maxBuffer: 1024 * 1024 });
+        console.log(result.trim());
+        assert.ok(existsSync(join(output, 'socket-ready')));
+    }
+    finally {
+        if (server.listening)
+            await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())));
+        assert.equal(existsSync(baselineSocket), false);
+        if (root !== undefined)
+            rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+        assert.equal(existsSync(output), false);
+    }
+});
 test.each(['pass', 'absent', 'limit', 'cancel'])('Node 26 packed public verification preserves CLI rebuild %s behavior', async (mode) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-packed-rebuild-')));
     const target = join(output, 'cli.js');