@brainervirus/workit-core 1.2.1 → 1.3.1

package/src/core/route-intent.ts

@@ -1,85 +1,37 @@
-import { TaskStore } from "./task-store";
-
-export type ShellRouteIntent = {
-  route: "git.branch_setup" | "hosting.pull_request" | "hosting.merge";
-  guidance: string;
-};
-
-const GUIDANCE: Record<ShellRouteIntent["route"], string> = {
-  "git.branch_setup":
-    "use the Workit git.branch_setup action (workit_external_action in hosts, or `workit action git.branch_setup --payload '{}' --confirm --json` in the CLI)",
-  "hosting.pull_request":
-    "use the Workit hosting.pull_request action (workit_external_action in hosts, or `workit action hosting.pull_request --payload '{...}' --confirm --json` in the CLI), then drive the created PR through workit-babysit",
-  "hosting.merge":
-    "use the Workit hosting.merge action (workit_external_action in hosts, or `workit action hosting.merge --payload '{...}' --confirm --json` in the CLI)",
-};
-
-const unbalancedQuotes = (segment: string): boolean => {
-  const text = segment.replace(/\\./gu, "");
-  return (text.match(/"/gu)?.length ?? 0) % 2 !== 0 || (text.match(/'/gu)?.length ?? 0) % 2 !== 0;
+import { validateBranchNameFor, type BranchNamePolicyCheck } from "./branch";
+
+// ponytail: recognize direct literal Git forms only; expand coverage if users need shell AST support.
+export const shellBranchTarget = (command: string): string | null => {
+  if (
+    !command.trim() ||
+    /[\r\n;&|<>`'"$()\\*?{}~!#]/u.test(command) ||
+    command.includes("[") ||
+    command.includes("]")
+  )
+    return null;
+
+  const args = command.trim().split(/\s+/u);
+  if (args[0] !== "git") return null;
+  const option = args[2];
+  const target =
+    args[1] === "switch" &&
+    ["-c", "--create", "-C", "--force-create"].includes(option ?? "") &&
+    (args.length === 4 || args.length === 5)
+      ? args[3]
+      : args[1] === "checkout" &&
+          ["-b", "-B"].includes(option ?? "") &&
+          (args.length === 4 || args.length === 5)
+        ? args[3]
+        : args[1] === "branch" && (args.length === 3 || args.length === 4)
+          ? args[2]
+          : null;
+  return target && !target.startsWith("-") ? target : null;
 };
 
-const segmentTokens = (segment: string): string[] | null => {
-  if (segment.includes("`") || segment.includes("$(")) return null;
-  if (unbalancedQuotes(segment)) return null;
-  const parts = segment.trim().split(/\s+/u);
-  while (parts.length > 0 && /^[A-Za-z_][A-Za-z0-9_]*=/u.test(parts[0])) parts.shift();
-  return parts.length > 0 ? parts : null;
+export const shellBranchPolicyViolation = (
+  root: string,
+  command: string,
+): BranchNamePolicyCheck | null => {
+  const target = shellBranchTarget(command);
+  return target === null ? null : validateBranchNameFor(root, target);
 };
-
-const unquote = (token: string): string => token.replace(/^['"]|['"]$/gu, "");
-
-/**
- * Narrow recognizer for direct branch and PR creation commands. It returns null
- * for everything it cannot classify unambiguously, so hosts deny only the exact
- * routes that must go through the shared action reservation.
- */
-export function shellRouteIntent(command: string): ShellRouteIntent | null {
-  if (typeof command !== "string" || command.trim() === "") return null;
-  for (const raw of command.split(/&&|\|\||;|\n/u)) {
-    const parts = segmentTokens(raw);
-    if (!parts) continue;
-    const head = unquote(parts[0]);
-    const second = unquote(parts[1] ?? "");
-    const third = unquote(parts[2] ?? "");
-    if (head === "git" && second === "switch" && (third === "-c" || third === "--create"))
-      return { route: "git.branch_setup", guidance: GUIDANCE["git.branch_setup"] };
-    if (head === "git" && second === "checkout" && (third === "-b" || third === "-B"))
-      return { route: "git.branch_setup", guidance: GUIDANCE["git.branch_setup"] };
-    if (head === "gh" && second === "pr" && third === "create")
-      return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
-    if (head === "glab" && second === "mr" && third === "create")
-      return { route: "hosting.pull_request", guidance: GUIDANCE["hosting.pull_request"] };
-    if (head === "gh" && second === "pr" && third === "merge")
-      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
-    if (head === "glab" && second === "mr" && third === "merge")
-      return { route: "hosting.merge", guidance: GUIDANCE["hosting.merge"] };
-  }
-  return null;
-}
-
-/**
- * Session-scoped enforcement: the denial protects live Workit coordination,
- * so it fires only where an active or paused task exists. Any filesystem or
- * storage failure means "no live task" — never deny on uncertainty.
- */
-export function hasLiveWorkitTask(dir: string): boolean {
-  try {
-    if (typeof dir !== "string" || dir === "") return false;
-    const listed = new TaskStore(dir).listTasks();
-    if (!listed.ok) return false;
-    return listed.data.some((task) => task.status === "active" || task.status === "paused");
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Single core gate for the shell route denial. Adapters pass their
- * session/project directory and delete local deny duplication; outside
- * attributed sessions the command is silently allowed.
- */
-export function shouldDenyShellRoute(dir: string, command: string): ShellRouteIntent | null {
-  if (!hasLiveWorkitTask(dir)) return null;
-  return shellRouteIntent(command);
-}

package/src/core/safe-write.ts

@@ -1,4 +1,16 @@
-import { writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import {
+  closeSync,
+  fchmodSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
 
 // Shared credential-safe write (Task 14 Step 7 / CA-13): `wx` exclusive create
 // closes the TOCTOU window between an existence check and the write, and EEXIST
@@ -20,3 +32,56 @@ export function writeFileExclusive(
     throw err;
   }
 }
+
+export function writeFileAtomic(file: string, content: string, mode?: number): void {
+  const absolute = path.resolve(file);
+  let parent = path.dirname(absolute);
+  const root = path.parse(parent).root;
+  for (;;) {
+    try {
+      if (lstatSync(parent).isSymbolicLink()) throw new Error(`symlinked write path: ${parent}`);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+    const next = path.dirname(parent);
+    if (parent === root || next === parent) break;
+    parent = next;
+  }
+
+  const directory = path.dirname(absolute);
+  mkdirSync(directory, { recursive: true });
+  let existing: ReturnType<typeof lstatSync> | null = null;
+  try {
+    existing = lstatSync(absolute);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  if (existing?.isSymbolicLink() || (existing && !existing.isFile())) {
+    throw new Error(`refusing to replace non-regular file: ${absolute}`);
+  }
+  const temporary = `${absolute}.${randomUUID()}.tmp`;
+  let fd: number | undefined;
+  try {
+    fd = openSync(temporary, "wx", mode ?? 0o666);
+    writeFileSync(fd, content, "utf8");
+    if (existing) fchmodSync(fd, existing.mode & 0o777);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    renameSync(temporary, absolute);
+  } catch (error) {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {
+        // Keep the original write error.
+      }
+    }
+    try {
+      unlinkSync(temporary);
+    } catch {
+      // The temporary may already have been renamed or removed.
+    }
+    throw error;
+  }
+}

package/src/core/setup-state.ts

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { isConfigObject, resolveConfigDir } from "./config";
+import { readWorkspacesResult } from "./workspaces";
 
 // WZ-06: typed setup-state reader distinguishing missing from malformed
 // configuration. Purely read-only — nothing here ever writes; Apply decision
@@ -42,6 +43,12 @@ export const classifySetupFile = (dir: string, name: string): FileState => {
   } catch {
     return { file, status: "malformed", error: `${file} is not valid JSON` };
   }
+  if (name === "workspaces.json") {
+    const workspaces = readWorkspacesResult(dir);
+    if (workspaces.status === "malformed" || workspaces.status === "invalid") {
+      return { file, status: "malformed", error: workspaces.error };
+    }
+  }
   return { file, status: "valid" };
 };
 

package/src/core/setup.ts

@@ -26,10 +26,11 @@ import {
 import { detectBranchPolicy } from "./branch-policy";
 import { readSetupState, type SetupState } from "./setup-state";
 import {
-  loadWorkspacesFrom,
-  matchWorkspace,
   readWorkspacesResult,
+  resolveWorkspaceFrom,
+  validateWorkspacesDocument,
   validateWorkspaceGlob,
+  workspacesRevision,
   type WorkspaceConfig,
 } from "./workspaces";
 import { GITIGNORE_ENTRIES } from "./gitignore";
@@ -86,7 +87,12 @@ export type SetupPreviewInput = {
 export type SetupMutation =
   | { type: "create-file"; path: string; content: string; mode?: number }
   | { type: "merge-json"; path: string; value: unknown }
-  | { type: "update-workspaces"; path: string; entries: WorkspaceConfig[] }
+  | {
+      type: "update-workspaces";
+      path: string;
+      entries: WorkspaceConfig[];
+      expectedRevision: string;
+    }
   | { type: "append-gitignore"; path: string; entries: string[] }
   // AR-09: host registration merges and the adapter package copy are planned
   // during preview so the reviewed mutation set IS the Apply write set.
@@ -170,27 +176,15 @@ function youtrackDraft(values: SetupPreviewInput, tokenPath: string): Record<str
   };
 }
 
-function vcsDraft(
-  provider: VcsProvider,
-  gitlabToken: string,
-  githubToken: string,
-): Record<string, unknown> {
+function vcsDraft(provider: VcsProvider): Record<string, unknown> {
   return {
     provider,
     gitlab: {
       host: "gitlab.com",
       apiUrl: "https://gitlab.com/api/v4",
-      tokenFile: gitlabToken,
     },
-    github: { host: "github.com", tokenFile: githubToken },
+    github: { host: "github.com" },
     pr: { squashOnMerge: true, removeSourceBranch: true, pushBranch: true, confirmSkip: true },
-    tokenDefaults: {
-      name: "workit",
-      description: "OpenCode workit — /wk-pr and glab/gh",
-      gitlabScopes: ["api"],
-      githubPermissions: { pull_requests: "write", contents: "write", metadata: "read" },
-      githubClassicScopes: ["repo"],
-    },
   };
 }
 
@@ -231,17 +225,6 @@ const readConfigRecord = (file: string): Record<string, unknown> | null => {
   }
 };
 
-const deleteAtPath = (obj: Record<string, unknown>, keyPath: string): void => {
-  const keys = keyPath.split(".");
-  let cursor = obj;
-  for (const key of keys.slice(0, -1)) {
-    const next = cursor[key];
-    if (!isRecord(next)) return;
-    cursor = next;
-  }
-  delete cursor[keys[keys.length - 1]];
-};
-
 export function buildSetupPreview(
   values: SetupPreviewInput,
   opts: SetupPreviewOptions = {},
@@ -281,7 +264,8 @@ export function buildSetupPreview(
     // WZ-12 parity: the draft is authoritative but a no-op workspaces section
     // (unchanged vs disk, including the initial seed) must not claim a rewrite.
     // Removing every workspace differs from disk and therefore still writes [].
-    const diskWorkspaces = loadWorkspacesFrom(state.configDir);
+    const diskWorkspaceResult = readWorkspacesResult(state.configDir);
+    const diskWorkspaces = diskWorkspaceResult.entries;
     if (!isDeepStrictEqual(values.workspaces, diskWorkspaces)) {
       // RL-08: unsupported matcher grammar is rejected before any write —
       // same gate the direct writeWorkspaces path and the wizard enforce.
@@ -298,6 +282,7 @@ export function buildSetupPreview(
           type: "update-workspaces",
           path: path.join(state.configDir, "workspaces.json"),
           entries: values.workspaces,
+          expectedRevision: diskWorkspaceResult.revision!,
         });
       }
     }
@@ -340,48 +325,11 @@ export function buildSetupPreview(
 
     if (values.vcsProvider !== "skip") {
       const vcsPath = path.join(state.configDir, "vcs.json");
-      const vcsExisting = readConfigRecord(vcsPath);
-      const glConfigured = configuredTokenPath(vcsExisting, "gitlab", "tokenFile");
-      const ghConfigured = configuredTokenPath(vcsExisting, "github", "tokenFile");
-      const gitlabToken = resolveTokenPath(
-        glConfigured,
-        path.join(state.configDir, "gitlab.token"),
-        values.tokenPaths?.gitlab,
-      );
-      const githubToken = resolveTokenPath(
-        ghConfigured,
-        path.join(state.configDir, "github.token"),
-        values.tokenPaths?.github,
-      );
-      const draft = vcsDraft(values.vcsProvider, gitlabToken, githubToken);
-      for (const [configured, token, key] of [
-        [glConfigured, gitlabToken, "gitlab.tokenFile"],
-        [ghConfigured, githubToken, "github.tokenFile"],
-      ] as const) {
-        if (configured !== null && token !== configured) {
-          deleteAtPath(draft, key);
-          mutations.push({
-            type: "set-token-path",
-            path: vcsPath,
-            key,
-            value: token,
-          });
-        }
-      }
       mutations.push({
         type: "merge-json",
         path: vcsPath,
-        value: draft,
+        value: vcsDraft(values.vcsProvider),
       });
-      const activeToken = values.vcsProvider === "gitlab" ? gitlabToken : githubToken;
-      if (existsSync(activeToken)) preserved.push(activeToken);
-      else
-        mutations.push({
-          type: "create-file",
-          path: activeToken,
-          content: TOKEN_PLACEHOLDER + "\n",
-          mode: 0o600,
-        });
     }
 
     // AR-09: host registrations and the adapter package copy are planned here
@@ -583,6 +531,22 @@ type CoreMutation = Exclude<
   { type: "register-platform" } | { type: "install-adapter" }
 >;
 
+const workspaceEntriesAlreadyMatch = (
+  contents: string | null,
+  file: string,
+  entries: WorkspaceConfig[],
+): boolean => {
+  if (contents === null) return entries.length === 0;
+  try {
+    const current = validateWorkspacesDocument(JSON.parse(contents), file);
+    return (
+      current.status === "valid" && JSON.stringify(current.entries) === JSON.stringify(entries)
+    );
+  } catch {
+    return false;
+  }
+};
+
 function applyMutation(m: CoreMutation): SetupResultEntry {
   const dir = path.dirname(m.path);
   switch (m.type) {
@@ -622,19 +586,65 @@ function applyMutation(m: CoreMutation): SetupResultEntry {
         : { platform: "core", file: m.path, status: "Installed" };
     }
     case "update-workspaces": {
-      // RL-08: a mutation built by a non-wizard caller still cannot write an
-      // unsupported matcher pattern — reported Failed, never silently stored.
-      for (const entry of m.entries) {
-        if (!entry || typeof entry.glob !== "string") continue;
-        const v = validateWorkspaceGlob(entry.glob);
-        if (!v.ok) return { platform: "core", file: m.path, status: "Failed", detail: v.error };
-      }
-      const next = JSON.stringify({ workspaces: m.entries }, null, 2) + "\n";
       const prev = readFileSafe(m.path);
+      if (workspaceEntriesAlreadyMatch(prev, m.path, m.entries))
+        return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
+      if (workspacesRevision(prev) !== m.expectedRevision) {
+        return {
+          platform: "core",
+          file: m.path,
+          status: "Failed",
+          detail:
+            "workspace config changed after preview; rebuild the preview and review the new values",
+        };
+      }
+      let document: Record<string, unknown> = {};
+      if (prev !== null) {
+        try {
+          const current = validateWorkspacesDocument(JSON.parse(prev), m.path);
+          if (current.status === "malformed" || current.status === "invalid") {
+            return { platform: "core", file: m.path, status: "Failed", detail: current.error };
+          }
+          document = current.document ?? {};
+        } catch {
+          return {
+            platform: "core",
+            file: m.path,
+            status: "Failed",
+            detail: `${m.path} is not valid JSON`,
+          };
+        }
+      }
+      const proposed = validateWorkspacesDocument({ ...document, workspaces: m.entries }, m.path);
+      if (proposed.status !== "valid") {
+        return { platform: "core", file: m.path, status: "Failed", detail: proposed.error };
+      }
+      const next = JSON.stringify({ ...document, workspaces: m.entries }, null, 2) + "\n";
       if (prev === next)
         return { platform: "core", file: m.path, status: "Skipped", detail: "already configured" };
       mkdirSync(dir, { recursive: true });
-      writeFileSync(m.path, next, "utf8");
+      const tmp = `${m.path}.${process.pid}.tmp`;
+      try {
+        writeFileSync(tmp, next, "utf8");
+        if (workspacesRevision(readFileSafe(m.path)) !== m.expectedRevision) {
+          rmSync(tmp, { force: true });
+          return {
+            platform: "core",
+            file: m.path,
+            status: "Failed",
+            detail: "workspace config changed while applying the preview; rebuild and review it",
+          };
+        }
+        renameSync(tmp, m.path);
+      } catch (error) {
+        rmSync(tmp, { force: true });
+        return {
+          platform: "core",
+          file: m.path,
+          status: "Failed",
+          detail: `failed to write ${m.path}: ${error instanceof Error ? error.message : String(error)}`,
+        };
+      }
       return prev === null
         ? { platform: "core", file: m.path, status: "Installed" }
         : { platform: "core", file: m.path, status: "Configured" };
@@ -1060,6 +1070,38 @@ export function applySetupPreview(
     };
   }
 
+  const workspaceMutation = preview.mutations.find(
+    (mutation): mutation is Extract<SetupMutation, { type: "update-workspaces" }> =>
+      mutation.type === "update-workspaces",
+  );
+  const currentWorkspaceContents = workspaceMutation ? readFileSafe(workspaceMutation.path) : null;
+  if (
+    workspaceMutation &&
+    workspacesRevision(currentWorkspaceContents) !== workspaceMutation.expectedRevision &&
+    !workspaceEntriesAlreadyMatch(
+      currentWorkspaceContents,
+      workspaceMutation.path,
+      workspaceMutation.entries,
+    )
+  ) {
+    return {
+      ok: false,
+      exitCode: 1,
+      entries: [
+        {
+          platform: "core",
+          file: workspaceMutation.path,
+          status: "Failed",
+          detail:
+            "workspace config changed after preview; rebuild the preview and review the new values",
+        },
+      ],
+      preserved: preview.preserved,
+      blocked: [],
+      doctor: [],
+    };
+  }
+
   const res = resolveApply(preview, options);
   const entries: SetupResultEntry[] = [];
   // AR-09/AR-13: Apply dispatches ONLY the reviewed mutation union. The adapter
@@ -1218,8 +1260,16 @@ export function applyWorkspaceBranchPolicy(opts: {
 }): Record<string, any> {
   const { workspace_root, env = process.env } = opts;
   const dir = path.join(env.WORKFLOW_TOOLKIT_CONFIG ?? configDir());
-  const { status, path: wsPath, entries } = readWorkspacesResult(dir);
-  if (status === "malformed") return { ok: false, error: `malformed workspaces.json: ${wsPath}` };
+  const {
+    status,
+    path: wsPath,
+    entries,
+    document,
+    revision,
+    error: workspacesError,
+  } = readWorkspacesResult(dir);
+  if (status === "malformed" || status === "invalid")
+    return { ok: false, error: workspacesError ?? `invalid workspaces.json: ${wsPath}` };
   const detection = detectBranchPolicy(workspace_root);
   const name = String(env.WORKFLOW_BP_NAME ?? path.basename(workspace_root));
   const integration = (env.WORKFLOW_BP_INTEGRATION ?? detection.integration) as "pr" | "merge";
@@ -1234,8 +1284,22 @@ export function applyWorkspaceBranchPolicy(opts: {
   const glob = `${workspace_root.replace(/[\\/]+$/, "")}/**`;
   if (!validateWorkspaceGlob(glob).ok)
     return { ok: false, error: `invalid workspace glob: ${glob}` };
-  const idx = entries.findIndex((w) => matchWorkspace(w.glob, workspace_root));
-  const existing = idx >= 0 ? entries[idx] : null;
+  let existing: WorkspaceConfig | null;
+  try {
+    existing = resolveWorkspaceFrom(workspace_root, dir);
+  } catch (error) {
+    const selectedName = env.WORKFLOW_BP_NAME?.trim();
+    if (!selectedName)
+      return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    try {
+      existing = resolveWorkspaceFrom(workspace_root, dir, selectedName);
+    } catch (selectionError) {
+      return {
+        ok: false,
+        error: selectionError instanceof Error ? selectionError.message : String(selectionError),
+      };
+    }
+  }
   if (existing?.branchPolicy && isDeepStrictEqual(existing.branchPolicy, policy)) {
     return {
       ok: true,
@@ -1246,10 +1310,38 @@ export function applyWorkspaceBranchPolicy(opts: {
     };
   }
   const next = existing
-    ? entries.map((w, i) => (i === idx ? { ...w, branchPolicy: policy } : w))
+    ? entries.map((w) => (w.name === existing?.name ? { ...w, branchPolicy: policy } : w))
     : [...entries, { name, glob, branchPolicy: policy }];
+  if (!existing && entries.some((entry) => entry.name === name))
+    return { ok: false, error: `workspace name ${JSON.stringify(name)} is already configured` };
+  const proposed = validateWorkspacesDocument({ ...document, workspaces: next }, wsPath);
+  if (proposed.status !== "valid") return { ok: false, error: proposed.error };
+  if (workspacesRevision(readFileSafe(wsPath)) !== revision)
+    return {
+      ok: false,
+      error: `workspaces.json changed while applying the branch policy: ${wsPath}`,
+    };
   mkdirSync(path.dirname(wsPath), { recursive: true });
-  writeFileSync(wsPath, JSON.stringify({ workspaces: next }, null, 2) + "\n", "utf8");
+  const tmp = `${wsPath}.${process.pid}.tmp`;
+  try {
+    writeFileSync(tmp, JSON.stringify({ ...document, workspaces: next }, null, 2) + "\n", "utf8");
+    if (workspacesRevision(readFileSafe(wsPath)) !== revision) {
+      rmSync(tmp, { force: true });
+      return {
+        ok: false,
+        error: `workspaces.json changed while applying the branch policy: ${wsPath}`,
+      };
+    }
+    renameSync(tmp, wsPath);
+  } catch (error) {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {}
+    return {
+      ok: false,
+      error: `failed to write ${wsPath}: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
   return {
     ok: true,
     status: existing ? "updated" : "configured",
@@ -1264,6 +1356,7 @@ export function applyWorkspaceBranchPolicy(opts: {
 export {
   applyCutover,
   applyRollback,
+  resumeCutover,
   classifyHostGeneration,
   readCutoverReceipt,
   detectCursorLatest,