@bongos/core 1.21.175 → 1.21.177

package/scripts/gds/ship-memory-sync.js

@@ -1,249 +1,6 @@
-// scripts/gds/ship-memory-sync.js — memory sync-on-ship + transcript/model resolution (task #274, V3.R55).
-//
-// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
-// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
-// original ship.js lines 197-365 unchanged. ship.js remains the facade that
-// re-exports every name and owns the CLI entry point, so the ship contract and
-// every flag are untouched, and the other scripts that import from it are too.
-
+// scripts/gds/ship-memory-sync.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/ship-memory-sync.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { cliClient } = require('./cli-lib');
-const { REPO_ROOT } = require('./ship-state.js');
-
-// ---------- Memory sync-on-ship (Task #274 / V3.R55) ----------
-//
-// After a successful ship, push the builder's local Claude Code memory dir to
-// the server (POST /api/bongos/memory/sync), so a builder's MEMORY.md +
-// feedback_*.md follow them across machines and survive a dead laptop. This is
-// the push half of ADR 0024's cloneable-memory chain; #275 wires the pull side.
-//
-// Convention for locating the memory dir (NO hardcoded identity — CLAUDE.md §10):
-// Claude Code stores per-project memory under
-//   <homedir>/.claude/projects/<encoded-project-path>/memory/
-// where <encoded-project-path> is the project's ABSOLUTE path with every '/'
-// and '.' replaced by '-' (e.g. /Users/x/Desktop/Claude-OTB →
-// -Users-x-Desktop-Claude-OTB). We derive the project path from the MAIN
-// worktree root (REPO_ROOT), not this ephemeral feature worktree, because the
-// memory dir is keyed to the canonical project checkout. CLAUDE_CONFIG_DIR
-// overrides the ~/.claude base when set (matches Claude Code's own behavior).
-//
-// Conflict policy: storeMemoryFile is an unconditional UPSERT (last-write-wins,
-// server clock — ADR 0024 §3), so we push every file and let the server
-// overwrite. Smarter mtime-diffing (skip files the server already has newer) is
-// a possible follow-up; for #274 a full push is correct and cheap (KB of md).
-//
-// BEST-EFFORT: any failure here is logged as a warning and swallowed — a memory
-// sync hiccup (dir missing, API down, quota) must NEVER fail or undo a ship.
-
-function claudeConfigBase() {
-  // Claude Code honors CLAUDE_CONFIG_DIR as the base for its state dir; default
-  // is ~/.claude. Resolve via os.homedir() so this works for any user.
-  return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
-}
-
-function encodeProjectPath(absProjectPath) {
-  // Claude Code's encoding: every NON-ALPHANUMERIC char becomes '-'. The old
-  // `[/.]` class silently no-op'd on Windows (separator '\', drive ':', spaces),
-  // so the transcript was never found, no session_record was written, and the
-  // cost-plus reward — the only stream a cost-plus-only instance pays (ADR 0146)
-  // — could never book: every Windows ship paid 0 (task 1002471). Same rule as
-  // scripts/gds/onboarding-config.js, which already had it right. POSIX output is
-  // unchanged for paths whose only specials are '/' and '.'.
-  return String(absProjectPath).replace(/[^a-zA-Z0-9]/g, '-');
-}
-
-// listProjectDirs — the default directory lister for the scan fallback below.
-// Returns the immediate subdirectory NAMES of ~/.claude/projects, sorted so a
-// scan is deterministic. Injectable (opts.readdirFn) so the fallback is unit
-// testable without a real home dir.
-function listProjectDirs(projectsRoot) {
-  return fs
-    .readdirSync(projectsRoot, { withFileTypes: true })
-    .filter((d) => d.isDirectory())
-    .map((d) => d.name)
-    .sort();
-}
-
-// resolveTranscriptPath — find this session's transcript .jsonl. Claude Code
-// keys the transcript to the project dir of the CWD where the session RUNS, so
-// a session in a git worktree stores it under the WORKTREE-encoded dir, not the
-// main checkout. (6D.1 #540 shipped resolving only REPO_ROOT, which silently
-// missed every worktree session — #551.) We try the session-local dir
-// (process.cwd()) first, then REPO_ROOT.
-//
-// task 1002505: those two fast paths NARROW the miss, they do not seal it. The
-// session driving a ship need not be rooted in EITHER dir — a session rooted in
-// another repo can file a task here and ship it (proven on task 1002475, whose
-// orchestrating session lived under a different project's encoded dir, so both
-// probed paths missed, no session_record was written, and the cost-plus reward
-// — the only stream this instance pays, ADR 0146 — never booked). So after the
-// fast paths we SCAN every dir under ~/.claude/projects for <sessionId>.jsonl.
-// A session id is a UUID, so a filename hit is unambiguous and cannot
-// mis-attribute; the scan is one stat per project dir, so it stays cheap.
-//
-// Pure-ish (exists + readdir + base injectable for tests). Pass opts.tried an
-// array and every probed path is appended to it — the caller reports that in a
-// transcript_not_found skip, so a genuine miss still names where it looked. The
-// scan contributes ONE summary line, not one line per dir, so the reason stays
-// readable. Returns the first existing path, or null.
-function resolveTranscriptPath(sessionId, projectDirs, opts = {}) {
-  const exists = opts.existsFn || fs.existsSync;
-  const readdir = opts.readdirFn || listProjectDirs;
-  const base = opts.base || claudeConfigBase();
-  const tried = Array.isArray(opts.tried) ? opts.tried : null;
-  const projectsRoot = path.join(base, 'projects');
-  const seen = new Set();
-
-  const probe = (p, { record = true } = {}) => {
-    if (seen.has(p)) return false;
-    seen.add(p);
-    if (tried && record) tried.push(p);
-    return exists(p);
-  };
-
-  for (const dir of projectDirs || []) {
-    if (!dir) continue;
-    const p = path.join(projectsRoot, encodeProjectPath(path.resolve(dir)), `${sessionId}.jsonl`);
-    if (probe(p)) return p;
-  }
-
-  // Fallback scan. Best-effort: an unreadable/absent projects root is not an
-  // error here — it just means the scan finds nothing, same as the fast paths.
-  let names;
-  try {
-    names = readdir(projectsRoot);
-  } catch (_) {
-    names = null;
-  }
-  if (!Array.isArray(names)) {
-    if (tried) tried.push(`${path.join(projectsRoot, '*')} (could not read the projects dir)`);
-    return null;
-  }
-  for (const name of names) {
-    const p = path.join(projectsRoot, name, `${sessionId}.jsonl`);
-    if (probe(p, { record: false })) return p;
-  }
-  if (tried) tried.push(`${path.join(projectsRoot, '*', `${sessionId}.jsonl`)} (scanned ${names.length} project dirs)`);
-  return null;
-}
-
-// resolveBuilderModel — the REAL model that authored this session's work, read
-// from the session transcript (dominant by output tokens, synthetic turns
-// skipped), so selectGraderModel gets a true cross-model input instead of the
-// ASSUMED_BUILDER_MODEL fallback (task 1002659 — everything graded on the
-// assumed-builder default before this). Best-effort: no session id, no
-// transcript, or any read error → null → the grader assumes, as before.
-function resolveBuilderModel(opts = {}) {
-  try {
-    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
-    // Same path-traversal guard as uploadSessionOnShip: the id lands in a path.
-    if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
-    const transcriptPath = resolveTranscriptPath(sessionId, [process.cwd(), REPO_ROOT].filter(Boolean), opts);
-    if (!transcriptPath) return null;
-    const perModel = new Map();
-    for (const line of fs.readFileSync(transcriptPath, 'utf8').split('\n')) {
-      if (!line.trim()) continue;
-      let o;
-      try { o = JSON.parse(line); } catch (_) { continue; }
-      const msg = o && o.message;
-      if (!msg || !msg.model || msg.model === '<synthetic>' || !msg.usage) continue;
-      perModel.set(msg.model, (perModel.get(msg.model) || 0) + (Number(msg.usage.output_tokens) || 0));
-    }
-    let best = null;
-    let bestTokens = 0;
-    for (const [model, tokens] of perModel) {
-      if (tokens > bestTokens) { best = model; bestTokens = tokens; }
-    }
-    return best;
-  } catch (_) {
-    return null;
-  }
-}
-
-function resolveMemoryDir() {
-  // REPO_ROOT is the main worktree (canonical project checkout). The memory dir
-  // is keyed to that path, not the per-task feature worktree we're shipping from.
-  const encoded = encodeProjectPath(path.resolve(REPO_ROOT));
-  return path.join(claudeConfigBase(), 'projects', encoded, 'memory');
-}
-
-// Enumerate the memory dir into [{ path, content, mtime }]. `path` is RELATIVE
-// to the memory dir (matches the server's (builder_id, relative-path) key).
-// Recurses so nested memory files (if Claude Code ever nests them) are caught.
-// Returns [] if the dir doesn't exist (not all builders have memory).
-function collectMemoryFiles(memDir) {
-  if (!fs.existsSync(memDir)) return [];
-  const out = [];
-  const walk = (absDir, relPrefix) => {
-    let entries;
-    try {
-      entries = fs.readdirSync(absDir, { withFileTypes: true });
-    } catch (_) {
-      return;
-    }
-    for (const ent of entries) {
-      const abs = path.join(absDir, ent.name);
-      const rel = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
-      if (ent.isDirectory()) {
-        walk(abs, rel);
-      } else if (ent.isFile()) {
-        try {
-          const content = fs.readFileSync(abs, 'utf8');
-          const mtime = fs.statSync(abs).mtime.toISOString();
-          // Use POSIX-style relative paths regardless of OS so the server key
-          // is stable across machines.
-          out.push({ path: rel.split(path.sep).join('/'), content, mtime });
-        } catch (_) {
-          /* skip unreadable file — best-effort */
-        }
-      }
-    }
-  };
-  walk(memDir, '');
-  return out;
-}
-
-async function syncMemoryOnShip() {
-  try {
-    const memDir = resolveMemoryDir();
-    const files = collectMemoryFiles(memDir);
-    if (files.length === 0) {
-      // Silent-ish: a builder with no memory dir is normal. One quiet line so
-      // the absence is visible in the ship log without looking like an error.
-      console.log('  memory sync: no local memory dir found — skipping (this is fine).');
-      return;
-    }
-    console.log(`  syncing ${files.length} memory file${files.length === 1 ? '' : 's'} to the server...`);
-    const r = await (await cliClient({ allowUnauthenticated: true })).memory.postMemorySync({ body: { files } });
-    if (r.status === 401) {
-      console.log('  memory sync: skipped (session not valid for sync; non-blocking).');
-      return;
-    }
-    const d = r.data || {};
-    if (r.ok) {
-      const errN = Array.isArray(d.errors) ? d.errors.length : 0;
-      console.log(
-        `  memory sync: ${d.stored ?? 0} stored, ${d.skipped ?? 0} skipped${errN ? `, ${errN} error(s)` : ''}.`
-      );
-    } else if (r.status === 413) {
-      console.log(`  memory sync: quota/size limit hit (${d.error || 'quota'}) — prune memory and re-sync. Non-blocking; ship is complete.`);
-    } else {
-      console.log(`  memory sync: server returned ${r.status} (non-blocking):`, d.error || d);
-    }
-  } catch (e) {
-    // Any error at all — network, fs, anything — must not fail the ship.
-    console.log('  memory sync failed (non-blocking):', e && e.message ? e.message : e);
-  }
-}
-
-module.exports = {
-  claudeConfigBase,
-  encodeProjectPath,
-  resolveBuilderModel,
-  resolveTranscriptPath,
-  syncMemoryOnShip,
-};
+require('../bongos/forwarder.js').forward(module, 'ship-memory-sync.js');

package/scripts/gds/ship-merge-gate.js

@@ -1,225 +1,6 @@
-// scripts/gds/ship-merge-gate.js — the fitness gate on the MERGE RESULT, run
-// between the local merge and the push that makes it main (task 1004032).
-//
-// WHY THIS EXISTS. Branch protection requires the `unit` check of a PULL
-// REQUEST. The local-merge land path is not a pull request: ship-merge.js
-// merges the task branch into main inside the main checkout and pushes the
-// result straight to origin/main, so no required check is consulted at any
-// point. Until this file, the only things standing between a builder's branch
-// and a red main were the grader (which reads a diff, not the gates) and
-// runSmoke (an HTTP liveness probe against the deployed instance). Neither runs
-// fitness.js, and ship-check.js — which does — is a command the builder may
-// choose to run, not a step of the ship.
-//
-// THE INCIDENT IT CLOSES (2026-09-17). Commit 89ac9620 (task 1000862) added two
-// legacy-acronym literals to .github/workflows/integration.yml. Measured after
-// the fact, on the commits themselves:
-//
-//   89ac9620  the BRANCH TIP  legacy_gds_literals 1137, committed baseline 1135
-//                             -> fitness.js exits non-zero. Already red.
-//   272b664d  the MERGE       the same 1137 against the same 1135, since the
-//                             merge changed nothing about those two literals.
-//   41ce52d4  the main before  fitness.js passes.
-//
-// So the guess in the original bug report — that a merge-ref-evaluated ratchet
-// let a clean branch produce a red main — is WRONG, and the truth is worse: the
-// branch was red on its own, and the ship pushed it to main regardless. This
-// was never the subtle "green branch, red merge" case; nothing measured
-// anything. main went red, and three tasks (1003456, 1004014, 1004021) sat at
-// 'confirmed' with nothing able to land until the baseline was raised by hand
-// to unblock the queue.
-//
-// WHAT IT DOES NOT DO. It does not punish a builder for damage that is already
-// on main. A gate that refused every ship while main is red would have turned
-// that same incident into a total deadlock instead of a bad afternoon — so when
-// the merge result fails, the pre-merge base is measured too, and a failure
-// already present there is reported and waved through. The rule is "do not make
-// main worse", not "main must be perfect before you may ship".
-
+// scripts/gds/ship-merge-gate.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/ship-merge-gate.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-
-// mergeGateVerdict — PURE. The whole decision, over two measurements:
-//
-//   mergeClean  did fitness pass on the merge result (the tree about to be main)
-//   baseClean   did it pass on the pre-merge base — true, false, or null for
-//               "could not be measured"
-//
-// The null case blocks on purpose. A failing merge result IS a red main
-// whatever the base was doing; an unmeasurable base means the gate cannot show
-// the failure was inherited, and the honest report is "this push makes main
-// red and I cannot prove it was already red". The builder's own next step is
-// the same either way — run fitness.js and read the failing lines.
-function mergeGateVerdict({ mergeClean, baseClean }) {
-  if (mergeClean) return { block: false, reason: 'clean' };
-  if (baseClean === false) return { block: false, reason: 'pre-existing' };
-  if (baseClean === null || baseClean === undefined) return { block: true, reason: 'unmeasured-base' };
-  return { block: true, reason: 'regression' };
-}
-
-// gateMessage — PURE. The one line printed for each verdict, in the voice of
-// the sibling bails in ship-merge.js.
-function gateMessage(reason) {
-  switch (reason) {
-    case 'clean':
-      return '  fitness on the merge result: clean';
-    case 'pre-existing':
-      return '  fitness on the merge result: FAILS, but the pre-merge main fails too — inherited, not caused by this branch; proceeding';
-    case 'regression':
-      return '  auto-merge: fitness FAILS on the merge result and PASSES on the pre-merge main — this branch would turn main red; task stays at confirmed';
-    case 'unmeasured-base':
-      return '  auto-merge: fitness FAILS on the merge result and the pre-merge main could not be measured; task stays at confirmed';
-    default:
-      return `  auto-merge: fitness gate returned an unknown verdict (${reason})`;
-  }
-}
-
-// fitnessOutcome — one fitness.js run over the tree at `treeRoot`, as a
-// TRI-STATE: 'clean', 'failing', or 'unmeasurable'.
-//
-// The three are kept apart on purpose. An earlier cut returned a boolean, which
-// made a crashed run and a genuine finding the same answer — and since a
-// FAILING base waves the ship through, a probe that merely broke would have
-// certified any regression as inherited. A control that degrades to permissive
-// under infra flakiness is not a control. 'unmeasurable' blocks instead.
-//
-// IT MUST BE THAT TREE'S OWN fitness.js, not this file's sibling copy.
-// fitness.js resolves the repo it measures from its own __dirname and ignores
-// cwd, so invoking the shipping worktree's copy with `cwd` pointed elsewhere
-// measures the shipping worktree twice and reports "clean" for whatever it was
-// asked about. That is not a hypothetical: the first cut of this gate did
-// exactly that, and replaying the 2026-09-17 incident through it returned a
-// confident pass on a tree that fails fitness. Running each tree's own gate is
-// also the honest semantics — a base commit is measured by the rules that were
-// committed with it, which is what CI would have done on that commit.
-//
-// Output is inherited so the failing lines land in the ship log where the
-// builder reads them. A non-zero exit is a FINDING; anything else that goes
-// wrong (no fitness.js in that tree, a spawn that never ran, a checker that
-// crashed) is 'unmeasurable'.
-function fitnessOutcome(treeRoot) {
-  const script = path.join(treeRoot, 'scripts', 'gds', 'fitness.js');
-  if (!fs.existsSync(script)) return 'unmeasurable';
-  try {
-    execFileSync(process.execPath, [script], { cwd: treeRoot, stdio: 'inherit', shell: false });
-    return 'clean';
-  } catch (err) {
-    // A real gate verdict is a clean non-zero exit. A spawn that never produced
-    // an exit code (ENOENT on the interpreter, a signal, a permissions refusal)
-    // is the infra case, and must not be read as "this tree fails".
-    return typeof err?.status === 'number' ? 'failing' : 'unmeasurable';
-  }
-}
-
-// runFitnessAt — the boolean face of fitnessOutcome, kept for the merge-result
-// side where "not clean" is all the caller needs: a merge result that cannot be
-// measured is one this gate will not certify either way.
-function runFitnessAt(treeRoot) {
-  return fitnessOutcome(treeRoot) === 'clean';
-}
-
-// probeBaseClean — measure the PRE-MERGE base in a throwaway detached worktree,
-// so the merge already sitting in the main checkout does not have to be unwound
-// to ask the question. Returns true (base clean), false (base genuinely fails
-// its own gate) or null (could not be measured at all).
-//
-// No `npm ci` and no node_modules junction: fitness.js reads the tree and
-// shells out to git, and runs green in a bare worktree — verified on this repo.
-// If that ever stops being true the probe reports 'unmeasurable' rather than
-// inventing a verdict, and mergeGateVerdict blocks.
-function probeBaseClean(repoRoot, baseSha) {
-  if (!baseSha) return null;
-  let dir = null;
-  try {
-    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-merge-gate-'));
-    execFileSync('git', ['worktree', 'add', '--detach', '--quiet', dir, baseSha], {
-      cwd: repoRoot, stdio: 'ignore', shell: false,
-    });
-  } catch (_) {
-    if (dir) removeProbe(repoRoot, dir);
-    return null;
-  }
-  try {
-    const outcome = fitnessOutcome(dir);
-    if (outcome === 'clean') return true;
-    if (outcome === 'failing') return false;
-    return null;
-  } finally {
-    removeProbe(repoRoot, dir);
-  }
-}
-
-// removeProbe — best-effort teardown. A husk left in the OS temp dir is
-// untidy; a ship that dies because its cleanup threw is worse.
-function removeProbe(repoRoot, dir) {
-  try {
-    execFileSync('git', ['worktree', 'remove', '--force', dir], { cwd: repoRoot, stdio: 'ignore', shell: false });
-  } catch (_) { /* fall through to the filesystem */ }
-  try {
-    fs.rmSync(dir, { recursive: true, force: true });
-  } catch (_) { /* nothing left to do */ }
-}
-
-// gateMergeResult — the I/O half: measure, decide, print. `baseSha` is the main
-// tip as it stood BEFORE the branch was merged in (in ship-merge.js that is
-// origin/main, since the ff-only step immediately above it guarantees the two
-// are the same commit).
-// gateApplies — does this repo carry the fitness gate at all? A VENDORED
-// instance (core under node_modules/@bongos/core) has no scripts/gds/fitness.js
-// of its own — fitness is the core's architecture gate, and the core ran it in
-// its own CI before it was published. Without this the gate read the missing
-// file as 'unmeasurable' on BOTH sides and blocked every vendored land
-// (task 1004584). It only stands down when the pre-merge base lacks the file
-// too, so a branch that DELETES fitness.js from the core is still measured
-// (and blocked as unmeasurable) rather than waved through.
-//
-// It asks GIT, never the disk (task 1004728). A vendored instance keeps an
-// untracked `scripts -> node_modules/@bongos/core/scripts` link in its main
-// checkout (hidden by .git/info/exclude; grading needs it), so the core's own
-// fitness.js IS on disk there. The disk check read that as "this repo carries
-// the gate", ran the core's fitness against a tree with no core in it, and
-// blocked every land on toast. What the repo carries is what it tracks.
-function tracksFitness(repoRoot, rev) {
-  try {
-    execFileSync('git', ['cat-file', '-e', `${rev}:scripts/gds/fitness.js`], {
-      cwd: repoRoot, stdio: 'ignore', shell: false,
-    });
-    return true;
-  } catch (_) {
-    return false;
-  }
-}
-
-function gateApplies(repoRoot, baseSha) {
-  if (tracksFitness(repoRoot, 'HEAD')) return true;
-  if (!baseSha) return true;
-  // the base had it — this merge removed it; measure (and block)
-  return tracksFitness(repoRoot, baseSha);
-}
-
-function gateMergeResult({ repoRoot, baseSha, log = console.log }) {
-  if (!gateApplies(repoRoot, baseSha)) {
-    log('  fitness: this repo carries no scripts/gds/fitness.js (a vendored instance) — gate not applicable');
-    return { block: false, reason: 'not-applicable' };
-  }
-  log('  fitness against post-merge state...');
-  const mergeClean = runFitnessAt(repoRoot);
-  const baseClean = mergeClean ? true : probeBaseClean(repoRoot, baseSha);
-  const verdict = mergeGateVerdict({ mergeClean, baseClean });
-  log(gateMessage(verdict.reason));
-  return verdict;
-}
-
-module.exports = {
-  fitnessOutcome,
-  gateApplies,
-  gateMergeResult,
-  gateMessage,
-  mergeGateVerdict,
-  probeBaseClean,
-  runFitnessAt,
-};
+require('../bongos/forwarder.js').forward(module, 'ship-merge-gate.js');