@bongos/core 1.21.175 → 1.21.176

package/scripts/bongos/ship-memory-sync.js

@@ -0,0 +1,249 @@
+// scripts/bongos/ship-memory-sync.js — memory sync-on-ship + transcript/model resolution (task #274, V3.R55).
+//
+// Carved out of scripts/bongos/ship.js by task 1003205 (goal 1000079, the R03
+// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
+// original ship.js lines 197-365 unchanged. ship.js remains the facade that
+// re-exports every name and owns the CLI entry point, so the ship contract and
+// every flag are untouched, and the other scripts that import from it are too.
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { cliClient } = require('./cli-lib');
+const { REPO_ROOT } = require('./ship-state.js');
+
+// ---------- Memory sync-on-ship (Task #274 / V3.R55) ----------
+//
+// After a successful ship, push the builder's local Claude Code memory dir to
+// the server (POST /api/bongos/memory/sync), so a builder's MEMORY.md +
+// feedback_*.md follow them across machines and survive a dead laptop. This is
+// the push half of ADR 0024's cloneable-memory chain; #275 wires the pull side.
+//
+// Convention for locating the memory dir (NO hardcoded identity — CLAUDE.md §10):
+// Claude Code stores per-project memory under
+//   <homedir>/.claude/projects/<encoded-project-path>/memory/
+// where <encoded-project-path> is the project's ABSOLUTE path with every '/'
+// and '.' replaced by '-' (e.g. /Users/x/Desktop/Claude-OTB →
+// -Users-x-Desktop-Claude-OTB). We derive the project path from the MAIN
+// worktree root (REPO_ROOT), not this ephemeral feature worktree, because the
+// memory dir is keyed to the canonical project checkout. CLAUDE_CONFIG_DIR
+// overrides the ~/.claude base when set (matches Claude Code's own behavior).
+//
+// Conflict policy: storeMemoryFile is an unconditional UPSERT (last-write-wins,
+// server clock — ADR 0024 §3), so we push every file and let the server
+// overwrite. Smarter mtime-diffing (skip files the server already has newer) is
+// a possible follow-up; for #274 a full push is correct and cheap (KB of md).
+//
+// BEST-EFFORT: any failure here is logged as a warning and swallowed — a memory
+// sync hiccup (dir missing, API down, quota) must NEVER fail or undo a ship.
+
+function claudeConfigBase() {
+  // Claude Code honors CLAUDE_CONFIG_DIR as the base for its state dir; default
+  // is ~/.claude. Resolve via os.homedir() so this works for any user.
+  return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
+}
+
+function encodeProjectPath(absProjectPath) {
+  // Claude Code's encoding: every NON-ALPHANUMERIC char becomes '-'. The old
+  // `[/.]` class silently no-op'd on Windows (separator '\', drive ':', spaces),
+  // so the transcript was never found, no session_record was written, and the
+  // cost-plus reward — the only stream a cost-plus-only instance pays (ADR 0146)
+  // — could never book: every Windows ship paid 0 (task 1002471). Same rule as
+  // scripts/bongos/onboarding-config.js, which already had it right. POSIX output is
+  // unchanged for paths whose only specials are '/' and '.'.
+  return String(absProjectPath).replace(/[^a-zA-Z0-9]/g, '-');
+}
+
+// listProjectDirs — the default directory lister for the scan fallback below.
+// Returns the immediate subdirectory NAMES of ~/.claude/projects, sorted so a
+// scan is deterministic. Injectable (opts.readdirFn) so the fallback is unit
+// testable without a real home dir.
+function listProjectDirs(projectsRoot) {
+  return fs
+    .readdirSync(projectsRoot, { withFileTypes: true })
+    .filter((d) => d.isDirectory())
+    .map((d) => d.name)
+    .sort();
+}
+
+// resolveTranscriptPath — find this session's transcript .jsonl. Claude Code
+// keys the transcript to the project dir of the CWD where the session RUNS, so
+// a session in a git worktree stores it under the WORKTREE-encoded dir, not the
+// main checkout. (6D.1 #540 shipped resolving only REPO_ROOT, which silently
+// missed every worktree session — #551.) We try the session-local dir
+// (process.cwd()) first, then REPO_ROOT.
+//
+// task 1002505: those two fast paths NARROW the miss, they do not seal it. The
+// session driving a ship need not be rooted in EITHER dir — a session rooted in
+// another repo can file a task here and ship it (proven on task 1002475, whose
+// orchestrating session lived under a different project's encoded dir, so both
+// probed paths missed, no session_record was written, and the cost-plus reward
+// — the only stream this instance pays, ADR 0146 — never booked). So after the
+// fast paths we SCAN every dir under ~/.claude/projects for <sessionId>.jsonl.
+// A session id is a UUID, so a filename hit is unambiguous and cannot
+// mis-attribute; the scan is one stat per project dir, so it stays cheap.
+//
+// Pure-ish (exists + readdir + base injectable for tests). Pass opts.tried an
+// array and every probed path is appended to it — the caller reports that in a
+// transcript_not_found skip, so a genuine miss still names where it looked. The
+// scan contributes ONE summary line, not one line per dir, so the reason stays
+// readable. Returns the first existing path, or null.
+function resolveTranscriptPath(sessionId, projectDirs, opts = {}) {
+  const exists = opts.existsFn || fs.existsSync;
+  const readdir = opts.readdirFn || listProjectDirs;
+  const base = opts.base || claudeConfigBase();
+  const tried = Array.isArray(opts.tried) ? opts.tried : null;
+  const projectsRoot = path.join(base, 'projects');
+  const seen = new Set();
+
+  const probe = (p, { record = true } = {}) => {
+    if (seen.has(p)) return false;
+    seen.add(p);
+    if (tried && record) tried.push(p);
+    return exists(p);
+  };
+
+  for (const dir of projectDirs || []) {
+    if (!dir) continue;
+    const p = path.join(projectsRoot, encodeProjectPath(path.resolve(dir)), `${sessionId}.jsonl`);
+    if (probe(p)) return p;
+  }
+
+  // Fallback scan. Best-effort: an unreadable/absent projects root is not an
+  // error here — it just means the scan finds nothing, same as the fast paths.
+  let names;
+  try {
+    names = readdir(projectsRoot);
+  } catch (_) {
+    names = null;
+  }
+  if (!Array.isArray(names)) {
+    if (tried) tried.push(`${path.join(projectsRoot, '*')} (could not read the projects dir)`);
+    return null;
+  }
+  for (const name of names) {
+    const p = path.join(projectsRoot, name, `${sessionId}.jsonl`);
+    if (probe(p, { record: false })) return p;
+  }
+  if (tried) tried.push(`${path.join(projectsRoot, '*', `${sessionId}.jsonl`)} (scanned ${names.length} project dirs)`);
+  return null;
+}
+
+// resolveBuilderModel — the REAL model that authored this session's work, read
+// from the session transcript (dominant by output tokens, synthetic turns
+// skipped), so selectGraderModel gets a true cross-model input instead of the
+// ASSUMED_BUILDER_MODEL fallback (task 1002659 — everything graded on the
+// assumed-builder default before this). Best-effort: no session id, no
+// transcript, or any read error → null → the grader assumes, as before.
+function resolveBuilderModel(opts = {}) {
+  try {
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    // Same path-traversal guard as uploadSessionOnShip: the id lands in a path.
+    if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
+    const transcriptPath = resolveTranscriptPath(sessionId, [process.cwd(), REPO_ROOT].filter(Boolean), opts);
+    if (!transcriptPath) return null;
+    const perModel = new Map();
+    for (const line of fs.readFileSync(transcriptPath, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      let o;
+      try { o = JSON.parse(line); } catch (_) { continue; }
+      const msg = o && o.message;
+      if (!msg || !msg.model || msg.model === '<synthetic>' || !msg.usage) continue;
+      perModel.set(msg.model, (perModel.get(msg.model) || 0) + (Number(msg.usage.output_tokens) || 0));
+    }
+    let best = null;
+    let bestTokens = 0;
+    for (const [model, tokens] of perModel) {
+      if (tokens > bestTokens) { best = model; bestTokens = tokens; }
+    }
+    return best;
+  } catch (_) {
+    return null;
+  }
+}
+
+function resolveMemoryDir() {
+  // REPO_ROOT is the main worktree (canonical project checkout). The memory dir
+  // is keyed to that path, not the per-task feature worktree we're shipping from.
+  const encoded = encodeProjectPath(path.resolve(REPO_ROOT));
+  return path.join(claudeConfigBase(), 'projects', encoded, 'memory');
+}
+
+// Enumerate the memory dir into [{ path, content, mtime }]. `path` is RELATIVE
+// to the memory dir (matches the server's (builder_id, relative-path) key).
+// Recurses so nested memory files (if Claude Code ever nests them) are caught.
+// Returns [] if the dir doesn't exist (not all builders have memory).
+function collectMemoryFiles(memDir) {
+  if (!fs.existsSync(memDir)) return [];
+  const out = [];
+  const walk = (absDir, relPrefix) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(absDir, { withFileTypes: true });
+    } catch (_) {
+      return;
+    }
+    for (const ent of entries) {
+      const abs = path.join(absDir, ent.name);
+      const rel = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
+      if (ent.isDirectory()) {
+        walk(abs, rel);
+      } else if (ent.isFile()) {
+        try {
+          const content = fs.readFileSync(abs, 'utf8');
+          const mtime = fs.statSync(abs).mtime.toISOString();
+          // Use POSIX-style relative paths regardless of OS so the server key
+          // is stable across machines.
+          out.push({ path: rel.split(path.sep).join('/'), content, mtime });
+        } catch (_) {
+          /* skip unreadable file — best-effort */
+        }
+      }
+    }
+  };
+  walk(memDir, '');
+  return out;
+}
+
+async function syncMemoryOnShip() {
+  try {
+    const memDir = resolveMemoryDir();
+    const files = collectMemoryFiles(memDir);
+    if (files.length === 0) {
+      // Silent-ish: a builder with no memory dir is normal. One quiet line so
+      // the absence is visible in the ship log without looking like an error.
+      console.log('  memory sync: no local memory dir found — skipping (this is fine).');
+      return;
+    }
+    console.log(`  syncing ${files.length} memory file${files.length === 1 ? '' : 's'} to the server...`);
+    const r = await (await cliClient({ allowUnauthenticated: true })).memory.postMemorySync({ body: { files } });
+    if (r.status === 401) {
+      console.log('  memory sync: skipped (session not valid for sync; non-blocking).');
+      return;
+    }
+    const d = r.data || {};
+    if (r.ok) {
+      const errN = Array.isArray(d.errors) ? d.errors.length : 0;
+      console.log(
+        `  memory sync: ${d.stored ?? 0} stored, ${d.skipped ?? 0} skipped${errN ? `, ${errN} error(s)` : ''}.`
+      );
+    } else if (r.status === 413) {
+      console.log(`  memory sync: quota/size limit hit (${d.error || 'quota'}) — prune memory and re-sync. Non-blocking; ship is complete.`);
+    } else {
+      console.log(`  memory sync: server returned ${r.status} (non-blocking):`, d.error || d);
+    }
+  } catch (e) {
+    // Any error at all — network, fs, anything — must not fail the ship.
+    console.log('  memory sync failed (non-blocking):', e && e.message ? e.message : e);
+  }
+}
+
+module.exports = {
+  claudeConfigBase,
+  encodeProjectPath,
+  resolveBuilderModel,
+  resolveTranscriptPath,
+  syncMemoryOnShip,
+};

package/scripts/bongos/ship-merge-gate.js

@@ -0,0 +1,225 @@
+// scripts/bongos/ship-merge-gate.js — the fitness gate on the MERGE RESULT, run
+// between the local merge and the push that makes it main (task 1004032).
+//
+// WHY THIS EXISTS. Branch protection requires the `unit` check of a PULL
+// REQUEST. The local-merge land path is not a pull request: ship-merge.js
+// merges the task branch into main inside the main checkout and pushes the
+// result straight to origin/main, so no required check is consulted at any
+// point. Until this file, the only things standing between a builder's branch
+// and a red main were the grader (which reads a diff, not the gates) and
+// runSmoke (an HTTP liveness probe against the deployed instance). Neither runs
+// fitness.js, and ship-check.js — which does — is a command the builder may
+// choose to run, not a step of the ship.
+//
+// THE INCIDENT IT CLOSES (2026-09-17). Commit 89ac9620 (task 1000862) added two
+// legacy-acronym literals to .github/workflows/integration.yml. Measured after
+// the fact, on the commits themselves:
+//
+//   89ac9620  the BRANCH TIP  legacy_gds_literals 1137, committed baseline 1135
+//                             -> fitness.js exits non-zero. Already red.
+//   272b664d  the MERGE       the same 1137 against the same 1135, since the
+//                             merge changed nothing about those two literals.
+//   41ce52d4  the main before  fitness.js passes.
+//
+// So the guess in the original bug report — that a merge-ref-evaluated ratchet
+// let a clean branch produce a red main — is WRONG, and the truth is worse: the
+// branch was red on its own, and the ship pushed it to main regardless. This
+// was never the subtle "green branch, red merge" case; nothing measured
+// anything. main went red, and three tasks (1003456, 1004014, 1004021) sat at
+// 'confirmed' with nothing able to land until the baseline was raised by hand
+// to unblock the queue.
+//
+// WHAT IT DOES NOT DO. It does not punish a builder for damage that is already
+// on main. A gate that refused every ship while main is red would have turned
+// that same incident into a total deadlock instead of a bad afternoon — so when
+// the merge result fails, the pre-merge base is measured too, and a failure
+// already present there is reported and waved through. The rule is "do not make
+// main worse", not "main must be perfect before you may ship".
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+// mergeGateVerdict — PURE. The whole decision, over two measurements:
+//
+//   mergeClean  did fitness pass on the merge result (the tree about to be main)
+//   baseClean   did it pass on the pre-merge base — true, false, or null for
+//               "could not be measured"
+//
+// The null case blocks on purpose. A failing merge result IS a red main
+// whatever the base was doing; an unmeasurable base means the gate cannot show
+// the failure was inherited, and the honest report is "this push makes main
+// red and I cannot prove it was already red". The builder's own next step is
+// the same either way — run fitness.js and read the failing lines.
+function mergeGateVerdict({ mergeClean, baseClean }) {
+  if (mergeClean) return { block: false, reason: 'clean' };
+  if (baseClean === false) return { block: false, reason: 'pre-existing' };
+  if (baseClean === null || baseClean === undefined) return { block: true, reason: 'unmeasured-base' };
+  return { block: true, reason: 'regression' };
+}
+
+// gateMessage — PURE. The one line printed for each verdict, in the voice of
+// the sibling bails in ship-merge.js.
+function gateMessage(reason) {
+  switch (reason) {
+    case 'clean':
+      return '  fitness on the merge result: clean';
+    case 'pre-existing':
+      return '  fitness on the merge result: FAILS, but the pre-merge main fails too — inherited, not caused by this branch; proceeding';
+    case 'regression':
+      return '  auto-merge: fitness FAILS on the merge result and PASSES on the pre-merge main — this branch would turn main red; task stays at confirmed';
+    case 'unmeasured-base':
+      return '  auto-merge: fitness FAILS on the merge result and the pre-merge main could not be measured; task stays at confirmed';
+    default:
+      return `  auto-merge: fitness gate returned an unknown verdict (${reason})`;
+  }
+}
+
+// fitnessOutcome — one fitness.js run over the tree at `treeRoot`, as a
+// TRI-STATE: 'clean', 'failing', or 'unmeasurable'.
+//
+// The three are kept apart on purpose. An earlier cut returned a boolean, which
+// made a crashed run and a genuine finding the same answer — and since a
+// FAILING base waves the ship through, a probe that merely broke would have
+// certified any regression as inherited. A control that degrades to permissive
+// under infra flakiness is not a control. 'unmeasurable' blocks instead.
+//
+// IT MUST BE THAT TREE'S OWN fitness.js, not this file's sibling copy.
+// fitness.js resolves the repo it measures from its own __dirname and ignores
+// cwd, so invoking the shipping worktree's copy with `cwd` pointed elsewhere
+// measures the shipping worktree twice and reports "clean" for whatever it was
+// asked about. That is not a hypothetical: the first cut of this gate did
+// exactly that, and replaying the 2026-09-17 incident through it returned a
+// confident pass on a tree that fails fitness. Running each tree's own gate is
+// also the honest semantics — a base commit is measured by the rules that were
+// committed with it, which is what CI would have done on that commit.
+//
+// Output is inherited so the failing lines land in the ship log where the
+// builder reads them. A non-zero exit is a FINDING; anything else that goes
+// wrong (no fitness.js in that tree, a spawn that never ran, a checker that
+// crashed) is 'unmeasurable'.
+function fitnessOutcome(treeRoot) {
+  const script = path.join(treeRoot, 'scripts', 'bongos', 'fitness.js');
+  if (!fs.existsSync(script)) return 'unmeasurable';
+  try {
+    execFileSync(process.execPath, [script], { cwd: treeRoot, stdio: 'inherit', shell: false });
+    return 'clean';
+  } catch (err) {
+    // A real gate verdict is a clean non-zero exit. A spawn that never produced
+    // an exit code (ENOENT on the interpreter, a signal, a permissions refusal)
+    // is the infra case, and must not be read as "this tree fails".
+    return typeof err?.status === 'number' ? 'failing' : 'unmeasurable';
+  }
+}
+
+// runFitnessAt — the boolean face of fitnessOutcome, kept for the merge-result
+// side where "not clean" is all the caller needs: a merge result that cannot be
+// measured is one this gate will not certify either way.
+function runFitnessAt(treeRoot) {
+  return fitnessOutcome(treeRoot) === 'clean';
+}
+
+// probeBaseClean — measure the PRE-MERGE base in a throwaway detached worktree,
+// so the merge already sitting in the main checkout does not have to be unwound
+// to ask the question. Returns true (base clean), false (base genuinely fails
+// its own gate) or null (could not be measured at all).
+//
+// No `npm ci` and no node_modules junction: fitness.js reads the tree and
+// shells out to git, and runs green in a bare worktree — verified on this repo.
+// If that ever stops being true the probe reports 'unmeasurable' rather than
+// inventing a verdict, and mergeGateVerdict blocks.
+function probeBaseClean(repoRoot, baseSha) {
+  if (!baseSha) return null;
+  let dir = null;
+  try {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-merge-gate-'));
+    execFileSync('git', ['worktree', 'add', '--detach', '--quiet', dir, baseSha], {
+      cwd: repoRoot, stdio: 'ignore', shell: false,
+    });
+  } catch (_) {
+    if (dir) removeProbe(repoRoot, dir);
+    return null;
+  }
+  try {
+    const outcome = fitnessOutcome(dir);
+    if (outcome === 'clean') return true;
+    if (outcome === 'failing') return false;
+    return null;
+  } finally {
+    removeProbe(repoRoot, dir);
+  }
+}
+
+// removeProbe — best-effort teardown. A husk left in the OS temp dir is
+// untidy; a ship that dies because its cleanup threw is worse.
+function removeProbe(repoRoot, dir) {
+  try {
+    execFileSync('git', ['worktree', 'remove', '--force', dir], { cwd: repoRoot, stdio: 'ignore', shell: false });
+  } catch (_) { /* fall through to the filesystem */ }
+  try {
+    fs.rmSync(dir, { recursive: true, force: true });
+  } catch (_) { /* nothing left to do */ }
+}
+
+// gateMergeResult — the I/O half: measure, decide, print. `baseSha` is the main
+// tip as it stood BEFORE the branch was merged in (in ship-merge.js that is
+// origin/main, since the ff-only step immediately above it guarantees the two
+// are the same commit).
+// gateApplies — does this repo carry the fitness gate at all? A VENDORED
+// instance (core under node_modules/@bongos/core) has no scripts/bongos/fitness.js
+// of its own — fitness is the core's architecture gate, and the core ran it in
+// its own CI before it was published. Without this the gate read the missing
+// file as 'unmeasurable' on BOTH sides and blocked every vendored land
+// (task 1004584). It only stands down when the pre-merge base lacks the file
+// too, so a branch that DELETES fitness.js from the core is still measured
+// (and blocked as unmeasurable) rather than waved through.
+//
+// It asks GIT, never the disk (task 1004728). A vendored instance keeps an
+// untracked `scripts -> node_modules/@bongos/core/scripts` link in its main
+// checkout (hidden by .git/info/exclude; grading needs it), so the core's own
+// fitness.js IS on disk there. The disk check read that as "this repo carries
+// the gate", ran the core's fitness against a tree with no core in it, and
+// blocked every land on toast. What the repo carries is what it tracks.
+function tracksFitness(repoRoot, rev) {
+  try {
+    execFileSync('git', ['cat-file', '-e', `${rev}:scripts/bongos/fitness.js`], {
+      cwd: repoRoot, stdio: 'ignore', shell: false,
+    });
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+function gateApplies(repoRoot, baseSha) {
+  if (tracksFitness(repoRoot, 'HEAD')) return true;
+  if (!baseSha) return true;
+  // the base had it — this merge removed it; measure (and block)
+  return tracksFitness(repoRoot, baseSha);
+}
+
+function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
+  if (!gateApplies(repoRoot, baseSha)) {
+    log('  fitness: this repo carries no scripts/bongos/fitness.js (a vendored instance) — gate not applicable');
+    return { block: false, reason: 'not-applicable' };
+  }
+  log('  fitness against post-merge state...');
+  const mergeClean = runFitnessAt(repoRoot);
+  const baseClean = mergeClean ? true : probeBaseClean(repoRoot, baseSha);
+  const verdict = mergeGateVerdict({ mergeClean, baseClean });
+  log(gateMessage(verdict.reason));
+  return verdict;
+}
+
+module.exports = {
+  fitnessOutcome,
+  gateApplies,
+  gateMergeResult,
+  gateMessage,
+  mergeGateVerdict,
+  probeBaseClean,
+  runFitnessAt,
+};