@brainervirus/workit-core 8.22.3 → 8.24.0

package/src/ledger.ts

@@ -1622,15 +1622,20 @@ export function checkVerdicts(
                 ? newestCurrent.reasons
                 : (["type_check_only"] as RejectReason[]),
         };
-  const selfEntry = failing
+  // The author's latest pass or failure on the current code wins, across
+  // kinds: a newer failure cancels an older pass (review finding mvkcoxgb).
+  const latestSelf = failing
     ? undefined
     : verdicts.findLast(
         (entry) =>
           entry.current &&
           !entry.independent &&
           !untrusted(entry.reasons) &&
-          STRONG_RESULTS.has(String(entry.verdict.result)),
+          (STRONG_RESULTS.has(String(entry.verdict.result)) ||
+            FAILING.has(String(entry.verdict.result))),
       );
+  const selfEntry =
+    latestSelf && STRONG_RESULTS.has(String(latestSelf.verdict.result)) ? latestSelf : undefined;
   return {
     branch,
     head,

package/src/stack.ts

@@ -73,6 +73,8 @@ import {
   type ReadRow,
   type VerdictBasis,
 } from "./ledger";
+import type { LaneNeed, ReviewLane } from "./core/policy/lane";
+import { prLaneGate } from "./core/policy/pr-lane";
 
 export const STACK_VERSION = 1;
 
@@ -1016,7 +1018,20 @@ export type BranchStatus = {
   next: NextAction | null;
   checks: ChecksState | null;
   blockers: string[];
-  verdict: { accepted: boolean; basis: VerdictBasis; reasons: string[]; verdictId: string | null };
+  /**
+   * `accepted`: an accepted independent verdict; `satisfied`: what the land
+   * gate reads, the verdict the PR's review lane asks for (an accepted
+   * independent one outside `verification: proportional`).
+   */
+  verdict: {
+    accepted: boolean;
+    satisfied: boolean;
+    basis: VerdictBasis;
+    reasons: string[];
+    verdictId: string | null;
+    lane: ReviewLane | null;
+    need: LaneNeed;
+  };
 };
 
 export type Qualification =
@@ -1081,16 +1096,27 @@ export function repoMismatch(ctx: Pick<Ctx, "resolved">, stack: StackFile): Stac
   return null;
 }
 
-const verdictOf = (cwd: string, branch: string, rows: readonly ReadRow[]) => {
+const verdictOf = (
+  cwd: string,
+  branch: string,
+  rows: readonly ReadRow[],
+  doc: PrStatusDoc | null,
+): BranchStatus["verdict"] => {
   const check = checkVerdicts(cwd, branch, rows);
+  // Without a PR there is no base to diff against: the gate stays independent.
+  const gate = doc ? prLaneGate(cwd, check, { branch, base: doc.base, head: doc.head.sha }) : null;
   return {
     accepted: check.accepted.accepted,
+    satisfied: gate ? gate.satisfied : check.accepted.accepted,
     basis: check.current.basis,
-    reasons: check.accepted.reasons as string[],
-    verdictId:
-      typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
+    reasons: check.accepted.reasons,
+    verdictId: gate
+      ? gate.verdictId
+      : typeof check.accepted.verdict?.id === "string" && check.accepted.accepted
         ? check.accepted.verdict.id
         : null,
+    lane: gate?.lane.lane ?? null,
+    need: gate?.need ?? "non-author",
   };
 };
 
@@ -1161,12 +1187,20 @@ export function qualify(
       `${label} has a current independent failed verdict for ${doc.head.sha.slice(0, 12)}; --unverified never lands over a rejection`,
       "a new independent verdict on the head supersedes it",
     );
-  if (!(bypass && allowUnverified) && !verdict.accepted)
+  if (!(bypass && allowUnverified) && !verdict.satisfied) {
+    const bypassHint = allowUnverified
+      ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"`
+      : "";
     return stop(
       verdict.reasons.includes("no_verdict") ? "no_verdict" : "needs_verdict",
-      `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)} (${verdict.reasons.join(", ") || "none"})`,
-      `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${allowUnverified ? `; or, only if the user asks to land unverified: workit stack land --unverified --reason "<why>"` : ""}`,
+      verdict.need === "self"
+        ? `${label} has no verdict for ${doc.head.sha.slice(0, 12)} (lane self: the author's own --self verdict is enough; ${verdict.reasons.join(", ") || "none"})`
+        : `${label} has no accepted independent verdict for ${doc.head.sha.slice(0, 12)}${verdict.lane && verdict.lane !== "none" ? ` (lane ${verdict.lane})` : ""} (${verdict.reasons.join(", ") || "none"})`,
+      verdict.need === "self"
+        ? `after an observed passing \`workit check test\`, the author runs: workit ledger verdict tests-verified --self --how "<what you ran>" --branch ${entry.branch}${bypassHint}`
+        : `an independent session verifies ${entry.branch} and runs: workit ledger verdict verified --how "<what was exercised>" --branch ${entry.branch}${bypassHint}`,
     );
+  }
   if (!grant.allowed)
     return stop(
       "grant_required",
@@ -1215,8 +1249,16 @@ export function stackStatus(ctx: Ctx, stack: StackFile): StackResult<StatusOutco
       checks: doc?.checks.state ?? null,
       blockers: doc?.blockers ?? [],
       verdict: merged
-        ? { accepted: true, basis: "none", reasons: [], verdictId: null }
-        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows),
+        ? {
+            accepted: true,
+            satisfied: true,
+            basis: "none",
+            reasons: [],
+            verdictId: null,
+            lane: null,
+            need: "non-author",
+          }
+        : verdictOf(ctx.cwd, entry.branch, ledger.value.rows, doc),
     };
     branches.push(row);
     if (merged) {
@@ -1866,7 +1908,7 @@ export async function landStack(
       }
     }
     const grant = requireGrant(ctx.cwd, "merge");
-    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows());
+    const verdict = verdictOf(ctx.cwd, entry.branch, ledgerRows(), doc);
     // A dry run predicts the retarget the real run would do first.
     const effective =
       options.dryRun && simulated.size > 0 && doc ? { ...doc, base: stack.trunk } : doc;
@@ -1906,7 +1948,7 @@ export async function landStack(
         deleteBranch: false,
         actor: ctx.actor,
         expect: { base: stack.trunk, branch: entry.branch },
-        ...(bypass && !verdict.accepted ? { unverified: bypass } : {}),
+        ...(bypass && !verdict.satisfied ? { unverified: bypass } : {}),
       },
       ctx.sleep,
     );

package/src/worktree-deps.ts

@@ -0,0 +1,142 @@
+// Dependencies for a fresh worktree (issue #310): a linked worktree has no
+// node_modules, so a resolver walks up to whatever node_modules is above it
+// (the main checkout's, for a worktree nested inside it) and a workspace
+// package resolves to the main checkout's source: tests then run the wrong
+// code. Instead of a package-manager install, the worktree gets its own
+// node_modules that mirrors the main checkout's one level deep:
+//
+// - a symlink is copied as it is: a relative one (bun, npm and yarn link
+//   workspace packages as `../../packages/<name>`, and `.bin` entries as
+//   `../<pkg>/bin/x`) then resolves inside the worktree, which has the same
+//   layout; an absolute one into the main checkout (a Windows junction) is
+//   re-pointed at the worktree's counterpart;
+// - `@scope` directories and `.bin` are mirrored the same way, one level;
+// - anything else (a third-party package) is linked to the main checkout's,
+//   so installed packages are shared, never copied.
+//
+// It runs only where the worktree has no node_modules of its own and git
+// ignores node_modules there (else the links would show as changes and block
+// release). `git worktree remove` unlinks the links and never follows them.
+import fs from "node:fs";
+import path from "node:path";
+import { gitRun } from "./fanout";
+
+const MODULES = "node_modules";
+/** Directories searched for node_modules below the checkout root (packages/<name>). */
+const MAX_DEPTH = 2;
+
+export type LinkedDependencies = {
+  /** The main checkout the links point at. */
+  from: string;
+  /** The node_modules directories made, relative to the worktree. */
+  dirs: string[];
+  /** Links made across them. */
+  entries: number;
+  ms: number;
+};
+
+const within = (child: string, parent: string): boolean => {
+  const relative = path.relative(parent, child);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+};
+
+/** node_modules directories of the main checkout, as paths relative to it. */
+function moduleDirs(main: string): string[] {
+  const out: string[] = [];
+  const walk = (relative: string, depth: number) => {
+    let entries: fs.Dirent[];
+    try {
+      entries = fs.readdirSync(path.join(main, relative), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const child = path.join(relative, entry.name);
+      if (entry.name === MODULES) out.push(child);
+      else if (depth < MAX_DEPTH && !entry.name.startsWith(".")) walk(child, depth + 1);
+    }
+  };
+  walk("", 0);
+  return out;
+}
+
+function linkEntry(main: string, worktree: string, source: string, target: string): void {
+  const stat = fs.lstatSync(source);
+  if (stat.isSymbolicLink()) {
+    const link = fs.readlinkSync(source);
+    // An absolute link into the main checkout (outside its node_modules) is a
+    // workspace package: point it at the worktree's copy.
+    const outside =
+      path.isAbsolute(link) &&
+      within(link, main) &&
+      !path.relative(main, link).split(path.sep).includes(MODULES);
+    const to = outside ? path.join(worktree, path.relative(main, link)) : link;
+    fs.symlinkSync(to, target, process.platform === "win32" ? "junction" : undefined);
+    return;
+  }
+  fs.symlinkSync(
+    source,
+    target,
+    process.platform === "win32" ? (stat.isDirectory() ? "junction" : "file") : undefined,
+  );
+}
+
+/** Mirror `source` into a new directory `target`; returns the links made. */
+function mirror(main: string, worktree: string, source: string, target: string, top: boolean) {
+  fs.mkdirSync(target);
+  let count = 0;
+  for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+    const from = path.join(source, entry.name);
+    const to = path.join(target, entry.name);
+    if (top && entry.isDirectory() && (entry.name.startsWith("@") || entry.name === ".bin"))
+      count += mirror(main, worktree, from, to, false);
+    else {
+      linkEntry(main, worktree, from, to);
+      count += 1;
+    }
+  }
+  return count;
+}
+
+/**
+ * Give `worktree` node_modules that resolve its own workspace packages and
+ * share the main checkout's installed ones. Null when there is nothing to
+ * link (no node_modules in the main checkout), with a note when it was
+ * skipped; never throws.
+ */
+export function linkWorktreeDependencies(
+  main: string,
+  worktree: string,
+): { linked: LinkedDependencies | null; notes: string[] } {
+  const started = performance.now();
+  const notes: string[] = [];
+  const dirs: string[] = [];
+  let entries = 0;
+  for (const relative of moduleDirs(main)) {
+    const target = path.join(worktree, relative);
+    if (!fs.existsSync(path.dirname(target)) || fs.existsSync(target)) continue;
+    // The trailing slash: the directory does not exist yet, and `node_modules/` only matches one.
+    if (!gitRun(worktree, ["check-ignore", "-q", `${relative.split(path.sep).join("/")}/`]).ok) {
+      notes.push(
+        `${relative.split(path.sep).join("/")} is not ignored by git, so it was not linked from ${main}; install dependencies in the worktree yourself`,
+      );
+      continue;
+    }
+    try {
+      entries += mirror(main, worktree, path.join(main, relative), target, true);
+      dirs.push(relative.split(path.sep).join("/"));
+    } catch (error) {
+      fs.rmSync(target, { recursive: true, force: true });
+      notes.push(
+        `could not link ${relative} from ${main} (${(error as Error).message}); install dependencies in the worktree yourself`,
+      );
+    }
+  }
+  if (dirs.length === 0) return { linked: null, notes };
+  const ms = Math.round(performance.now() - started);
+  notes.push(
+    `linked ${dirs.join(", ")} from ${main} (${entries} entries, ${ms} ms): workspace packages resolve to this worktree, installed packages are shared`,
+  );
+  return { linked: { from: main, dirs, entries, ms }, notes };
+}