@brainervirus/workit-core 0.6.1 → 0.7.0

package/src/core/safe-write.ts

@@ -0,0 +1,22 @@
+import { writeFileSync } from "node:fs";
+
+// Shared credential-safe write (Task 14 Step 7 / CA-13): `wx` exclusive create
+// closes the TOCTOU window between an existence check and the write, and EEXIST
+// means the other writer won — their bytes are preserved instead of clobbered.
+// Every token write in the wizard (ensureToken), the apply path (create-file
+// mutations) and initApplyData routes through this one primitive.
+export type ExclusiveWriteResult = "created" | "preserved";
+
+export function writeFileExclusive(
+  file: string,
+  content: string,
+  mode?: number,
+): ExclusiveWriteResult {
+  try {
+    writeFileSync(file, content, { encoding: "utf8", flag: "wx", mode });
+    return "created";
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === "EEXIST") return "preserved";
+    throw err;
+  }
+}

package/src/core/scripts.ts

@@ -1,47 +1,6 @@
-import { spawnSync } from "node:child_process";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
+import { assetRoot, packageRoot } from "./package-root";
 
-const dirname = path.dirname(fileURLToPath(import.meta.url));
-export const PLUGIN_ROOT = path.resolve(dirname, "../..");
+export const PLUGIN_ROOT = packageRoot();
+export const ASSET_ROOT = assetRoot();
 
 export const resolveWorkspaceRoot = (explicit?: string) => explicit || process.cwd();
-
-export function runScript(
-  scriptName: string,
-  args: string[],
-  workspaceRoot: string,
-  extraEnv?: Record<string, string>,
-) {
-  const cwd = resolveWorkspaceRoot(workspaceRoot);
-  const scriptPath = path.join(PLUGIN_ROOT, "scripts", scriptName);
-  const result = spawnSync("bash", [scriptPath, ...args], {
-    cwd,
-    encoding: "utf8",
-    env: { ...process.env, ...extraEnv },
-  });
-  return {
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-    exitCode: result.status ?? 1,
-    scriptPath,
-    cwd,
-  };
-}
-
-export function runScriptJson(
-  scriptName: string,
-  args: string[],
-  workspaceRoot: string,
-  extraEnv?: Record<string, string>,
-) {
-  const { stdout, stderr, exitCode } = runScript(scriptName, args, workspaceRoot, extraEnv);
-  if (exitCode !== 0) {
-    return { error: (stderr || stdout || "script failed").trim(), exitCode };
-  }
-  try {
-    return { data: JSON.parse(stdout.trim()) };
-  } catch {
-    return { error: "invalid JSON from script", raw: stdout.trim() };
-  }
-}

package/src/core/sdd.ts

@@ -1,17 +1,20 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "node:fs";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { execFileSync } from "node:child_process";
 import path from "node:path";
 import { parseTasksFromPlan } from "./docs-validate";
 import { docsValidate } from "./docs-validate";
 import { readFlowState } from "./flow-state";
+import { resolveCanonicalLayout, resolveDocsPath } from "./docs-layout";
 
 const posix = (p: string) => p.split(path.sep).join("/");
 
-export const slugFromPlan = (planPath: string) => {
-  const dirName = path.basename(path.dirname(planPath));
-  return dirName === "." || dirName === "/" || dirName === "" ? "" : dirName;
-};
-
 /** OpenCode todowrite payload. SDD ledger is persistence, not a UI substitute. */
 export function todosFromTasks(
   tasks: { id: number | string; title: string }[],
@@ -40,13 +43,12 @@ export function sddContext({
   plan_path?: string;
   workspace_root: string;
 }) {
-  const cwd = path.resolve(workspace_root);
-  let resolvedSlug = slug;
-  let resolvedPlanPath = plan_path;
-  if (!resolvedSlug && plan_path) {
-    resolvedPlanPath = path.isAbsolute(plan_path) ? plan_path : path.join(cwd, plan_path);
-    resolvedSlug = slugFromPlan(resolvedPlanPath);
-  }
+  // One shared contained path contract (DC-01, DC-02): slug and/or plan_path
+  // resolve to a canonical layout or the call fails before anything is read.
+  const resolved = resolveCanonicalLayout({ workspace_root, slug, plan_path });
+  if (!resolved.ok) return { error: resolved.error };
+  const cwd = resolved.layout.workspace;
+  const resolvedSlug = resolved.layout.slug;
   if (!resolvedSlug) return { error: "slug or plan_path required" };
 
   const sdd_dir = path.posix.join("docs", resolvedSlug, "sdd");
@@ -55,7 +57,7 @@ export function sddContext({
 
   let progress_lines: string[] = [];
   let completed_task_ids: number[] = [];
-  const absProgress = path.join(cwd, progress_path);
+  const absProgress = path.join(resolved.layout.sdd, "progress.md");
   if (existsSync(absProgress)) {
     progress_lines = readFileSync(absProgress, "utf8")
       .split("\n")
@@ -69,7 +71,7 @@ export function sddContext({
   }
 
   let manifest: Record<string, unknown> = {};
-  const absManifest = path.join(cwd, manifest_path);
+  const absManifest = path.join(resolved.layout.sdd, "manifest.json");
   if (existsSync(absManifest)) {
     try {
       manifest = JSON.parse(readFileSync(absManifest, "utf8"));
@@ -84,12 +86,15 @@ export function sddContext({
   let todos: { id: string; content: string; status: string }[] = [];
   let task_count = 0;
   if (plan_path) {
-    const absPlan = path.isAbsolute(plan_path) ? plan_path : path.join(cwd, plan_path);
-    const planText = readFileSync(absPlan, "utf8");
+    const planText = readFileSync(resolved.layout.plan, "utf8");
     const specMatch = planText.match(/^\*\*Spec:\*\*\s*(?:`([^`]+)`|(\S+))/m);
     const spec_path = specMatch?.[1] ?? specMatch?.[2] ?? "";
     if (spec_path) {
-      const validated = docsValidate({ spec_path, plan_path, workspace_root: cwd });
+      const validated = docsValidate({
+        spec_path,
+        plan_path: path.relative(cwd, resolved.layout.plan),
+        workspace_root: cwd,
+      });
       if (validated.ok === false)
         return { ok: false, errors: validated.errors, error: validated.error };
     }
@@ -136,12 +141,13 @@ export function sddTaskBrief({
   section_text: string;
   workspace_root: string;
 }) {
-  const cwd = path.resolve(workspace_root);
-  const dir = path.isAbsolute(sdd_dir) ? sdd_dir : path.join(cwd, sdd_dir);
+  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
+  if (!contained.ok) return { error: contained.error };
+  const dir = contained.path;
   mkdirSync(dir, { recursive: true });
   const out = path.join(dir, `task-${task_id}-brief.md`);
   writeFileSync(out, `# Task ${task_id} brief\n\n${section_text}\n`, "utf8");
-  const rel = posix(path.relative(cwd, out));
+  const rel = posix(path.relative(contained.base, out));
   return { brief_path: rel, task_id };
 }
 
@@ -156,16 +162,23 @@ export function sddReviewPackage({
   head_sha: string;
   workspace_root: string;
 }) {
-  const cwd = path.resolve(workspace_root);
-  const dir = path.isAbsolute(sdd_dir) ? sdd_dir : path.join(cwd, sdd_dir);
+  const contained = resolveDocsPath({ workspace_root, path: sdd_dir });
+  if (!contained.ok) return { error: contained.error };
+  const dir = contained.path;
   mkdirSync(dir, { recursive: true });
   const base7 = base_sha.slice(0, 7);
   const head7 = head_sha.slice(0, 7);
   const diffPath = path.join(dir, `review-${base7}..${head7}.diff`);
   try {
-    const diff = execFileSync("git", ["diff", base_sha, head_sha], { cwd, encoding: "utf8" });
+    const diff = execFileSync("git", ["diff", base_sha, head_sha], {
+      cwd: contained.base,
+      encoding: "utf8",
+      // AR-14: a failed diff (missing shas, non-repo fixture) must stay in the
+      // captured error, never in the suite output.
+      stdio: ["pipe", "pipe", "pipe"],
+    });
     writeFileSync(diffPath, diff, "utf8");
-    const rel = posix(path.relative(cwd, diffPath));
+    const rel = posix(path.relative(contained.base, diffPath));
     return { diff_path: rel, base_sha, head_sha, base7, head7 };
   } catch (error) {
     return { error: error instanceof Error ? error.message : "git diff failed" };
@@ -183,14 +196,18 @@ export function sddAppendProgress({
   line: string;
   workspace_root: string;
 }) {
-  const cwd = path.resolve(workspace_root);
-  const path_ = path.isAbsolute(progress_path) ? progress_path : path.join(cwd, progress_path);
+  const contained = resolveDocsPath({ workspace_root, path: progress_path });
+  if (!contained.ok) return { error: contained.error };
+  const path_ = contained.path;
   const trimmed = line.trim();
   if (!PROGRESS_RE.test(trimmed)) {
     return { error: "invalid progress line format" };
   }
+  if (existsSync(path_) && statSync(path_).isDirectory()) {
+    return { error: `progress path is a directory: ${progress_path}` };
+  }
   mkdirSync(path.dirname(path_), { recursive: true });
   appendFileSync(path_, trimmed + "\n", "utf8");
-  const rel = posix(path.relative(cwd, path_));
+  const rel = posix(path.relative(contained.base, path_));
   return { ok: true, line: trimmed, progress_path: rel };
 }

package/src/core/setup-state.ts

@@ -0,0 +1,54 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { isConfigObject, resolveConfigDir } from "./config";
+
+// WZ-06: typed setup-state reader distinguishing missing from malformed
+// configuration. Purely read-only — nothing here ever writes; Apply decision
+// (Task 13/14) reads this state and refuses to proceed on malformed files.
+
+export type FileState = {
+  file: string;
+  status: "missing" | "valid" | "malformed";
+  error?: string;
+};
+
+export type SetupState = {
+  configDir: string;
+  config: FileState;
+  youtrack: FileState;
+  vcs: FileState;
+  workspaces: FileState;
+};
+
+export const classifySetupFile = (dir: string, name: string): FileState => {
+  const file = path.join(dir, name);
+  let raw: string;
+  try {
+    raw = readFileSync(file, "utf8");
+  } catch {
+    // An existing-but-unreadable file (EACCES) is NOT "missing": mutations must
+    // never be generated against it. Report it as malformed so risky consumers
+    // (wizard/installer/doctor) block on the exact path.
+    if (existsSync(file)) {
+      return { file, status: "malformed", error: `${file} is not readable` };
+    }
+    return { file, status: "missing" };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isConfigObject(parsed)) {
+      return { file, status: "malformed", error: `${file} is not a JSON object` };
+    }
+  } catch {
+    return { file, status: "malformed", error: `${file} is not valid JSON` };
+  }
+  return { file, status: "valid" };
+};
+
+export const readSetupState = (dir: string = resolveConfigDir()): SetupState => ({
+  configDir: dir,
+  config: classifySetupFile(dir, "config.json"),
+  youtrack: classifySetupFile(dir, "youtrack.json"),
+  vcs: classifySetupFile(dir, "vcs.json"),
+  workspaces: classifySetupFile(dir, "workspaces.json"),
+});