@codedology/code-forge 0.15.2 → 0.15.3

package/src/worker/queue.mjs

@@ -31,7 +31,9 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { runRecordPath } from '../state/paths.mjs';
+import { reviewExcludeRule } from '../config/validate.mjs';
+import { configInForce } from '../state/config-snapshot.mjs';
+import { runRecordPath, StateError } from '../state/paths.mjs';
 import { loadKey, signRow, verifyRow } from '../state/signer.mjs';
 import { isAlive, readStartTime, UNKNOWN_START_TIME } from '../util/reaper.mjs';
 import { assertRowPath, assertTicketId, contentHash, ticketId, WorkerError } from './ticket.mjs';
@@ -76,7 +78,7 @@ function readJSON(file) {
 }
 
 /**
- * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string, tree?: string, acceptance_revision?: string, kind?: 'answers', by_file?: string, by_hash?: string, answers?: string[]}} Ticket
+ * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string, queued_at?: string | null, started_at?: string | null, finished_at?: string | null, duration_ms?: number | null, tree?: string, acceptance_revision?: string, reopened_at?: string, kind?: 'answers', by_file?: string, by_hash?: string, answers?: string[]}} Ticket
  *   `tree` (B62b): the block's worktree the content was hashed in. It is part of the ticket id,
  *   and the worker only checks it against the tree it takes from the run record (a ticket whose
  *   tree is not that one is `unavailable`, `worktree-mismatch`); it never reads content there.
@@ -86,16 +88,25 @@ function readJSON(file) {
  * The review ticket for `file`'s CURRENT content: the one rule `enqueue` and `clearDone` (B72)
  * share — the repo-relative path, the realpath'd tree (or null), the content hash taken under the
  * tree when given (else under `repoRoot`) and the ticket id over all of them.
- * @param {{repoRoot: string, run: string, block: string, file: string, tree?: string | null}} opts
+ * @param {{repoRoot: string, run: string, block: string, file: string, tree?: string | null, after?: string}} opts
  * @returns {{rel: string, root: string | null, content_hash: string, ticket: string}}
  * @throws {WorkerError} `bad-path` for a bad file path or a tree that cannot be resolved.
  */
-export function resolveTicket({ repoRoot, run, block, file, tree = null }) {
+export function resolveTicket({ repoRoot, run, block, file, tree = null, after }) {
   const rel = assertRowPath(file);
   const root = tree === null ? null : realTree(tree);
   const content_hash = contentHash(root ?? repoRoot, rel);
-  const revision = acceptanceRevision(repoRoot, run, block);
-  return { rel, root, content_hash, ticket: reviewTicketId({ run, block, file: rel, content_hash, tree: root, acceptance_revision: revision }) };
+  return resolveHashTicket({ repoRoot, run, block, file: rel, tree: root, after, content_hash });
+}
+
+/** Resolve already measured content through the same acceptance/reopen identity.
+ * @param {{repoRoot: string, run: string, block: string, file: string, content_hash: string, tree?: string | null, after?: string}} opts
+ */
+export function resolveHashTicket({ repoRoot, run, block, file, content_hash, tree = null, after }) {
+  const rel = assertRowPath(file);
+  const root = tree === null ? null : realTree(tree);
+  const { ticket } = reviewIdentity({ repoRoot, run, block, file: rel, content_hash, tree: root, after });
+  return { rel, root, content_hash, ticket };
 }
 
 /** The mirror lets sandboxed callers resolve the same ticket without the private record.
@@ -107,10 +118,39 @@ function acceptanceRevision(repoRoot, run, block) {
   return typeof revision === 'string' ? revision : undefined;
 }
 
-/** @param {{run: string, block: string, file: string, content_hash: string, tree?: string | null, acceptance_revision?: string}} parts */
+/** @param {{run: string, block: string, file: string, content_hash: string, tree?: string | null, acceptance_revision?: string, reopened_at?: string}} parts */
 function reviewTicketId(parts) {
   const id = ticketId(parts);
-  return parts.acceptance_revision === undefined ? id : createHash('sha256').update(`${id}\0${parts.acceptance_revision}`).digest('hex').slice(0, 24);
+  const revisionId = parts.acceptance_revision === undefined ? id : createHash('sha256').update(`${id}\0${parts.acceptance_revision}`).digest('hex').slice(0, 24);
+  return parts.reopened_at === undefined ? revisionId : createHash('sha256').update(`${revisionId}\0reopen\0${parts.reopened_at}`).digest('hex').slice(0, 24);
+}
+
+/** Reopens get their own identity; ordinary enqueues keep using that attempt afterwards.
+ * @param {{repoRoot: string, run: string, block: string, file: string, content_hash: string, tree: string | null, after?: string}} opts
+ */
+function reviewIdentity({ repoRoot, run, block, file, content_hash, tree, after }) {
+  const acceptance_revision = acceptanceRevision(repoRoot, run, block);
+  let names;
+  try { names = readdirSync(queueDir(repoRoot)); } catch (err) {
+    if (err.code !== 'ENOENT') throw new WorkerError('queue-unreadable', 'the review queue cannot be read');
+    names = [];
+  }
+  const matching = [];
+  for (const name of names) {
+    if (!/^[0-9a-f]{24}\.json$/.test(name)) continue;
+    const t = readJSON(path.join(queueDir(repoRoot), name));
+    // Scope before validation: a stored tree from another ticket must never select this tree.
+    if (t && !t.kind && t.run === run && t.block === block && t.file === file && t.content_hash === content_hash && (t.tree ?? null) === tree && t.acceptance_revision === acceptance_revision) {
+      matching.push(readTicket(repoRoot, name.slice(0, 24)));
+    }
+  }
+  matching.sort((a, b) => a.enqueued_at.localeCompare(b.enqueued_at) || a.ticket.localeCompare(b.ticket));
+  const latest = matching.filter((t) => t.reopened_at !== undefined).at(-1);
+  const afterTime = Date.parse(after ?? '');
+  const fresh = matching.filter((t) => Date.parse(t.enqueued_at) > afterTime).at(-1);
+  const reopened_at = fresh ? fresh.reopened_at : Number.isFinite(afterTime) ? after : latest?.reopened_at;
+  const ticket = reviewTicketId({ run, block, file, content_hash, tree, acceptance_revision, reopened_at });
+  return { ticket, acceptance_revision, reopened_at, matching };
 }
 
 /** Reset only the commit-watch cursor; review evidence and results remain intact.
@@ -126,30 +166,44 @@ export function resetAcceptanceWatch(repoRoot, block) {
  * content is hashed under `tree` when given (B62b: the block's worktree, realpath'd here), else
  * under `repoRoot`. The tree is part of the ticket id, so a main-tree ticket and a tree ticket for
  * the same bytes differ, and the answer names the tree given here, never a stored value.
- * @param {{repoRoot: string, run: string, block: string, file: string, tree?: string | null, now?: Date}} opts
- * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, tree?: string}}
+ * `after` creates a new identity for a reopen. Repeated calls for that row reuse the ticket,
+ * including its eventual completion; ordinary enqueues also reuse the latest reopened attempt.
+ * A manual review queued after the row already counts as fresh and keeps its identity.
+ * @param {{repoRoot: string, run: string, block: string, file: string, tree?: string | null, now?: Date, after?: string}} opts
+ * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, tree?: string} | {status: 'excluded', file: string, rule: string, ticket?: never, content_hash?: never, tree?: never}}
  * @throws {WorkerError} `bad-path` for a relative `tree` or one that cannot be resolved.
  */
-export function enqueue({ repoRoot, run, block, file, tree = null, now = new Date() }) {
+export function enqueue({ repoRoot, run, block, file, tree = null, now = new Date(), after }) {
+  const rule = reviewExclusionFor(repoRoot, run, assertRowPath(file));
+  if (rule !== null) return { status: 'excluded', file, rule };
   const { content_hash } = resolveTicket({ repoRoot, run, block, file, tree });
-  return enqueueHash({ repoRoot, run, block, file, tree, content_hash, now });
+  return enqueueHash({ repoRoot, run, block, file, tree, content_hash, now, after });
 }
 
 /** Queue proven git-object content through the same identity as a manual review.
- * @param {{repoRoot: string, run: string, block: string, file: string, content_hash: string, tree?: string | null, now?: Date}} opts
- * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, tree?: string}}
+ * @param {{repoRoot: string, run: string, block: string, file: string, content_hash: string, tree?: string | null, now?: Date, after?: string}} opts
+ * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, tree?: string} | {status: 'excluded', file: string, rule: string, ticket?: never, content_hash?: never, tree?: never}}
  */
-export function enqueueHash({ repoRoot, run, block, file, content_hash, tree = null, now = new Date() }) {
+export function enqueueHash({ repoRoot, run, block, file, content_hash, tree = null, now = new Date(), after }) {
   const rel = assertRowPath(file);
+  const rule = reviewExclusionFor(repoRoot, run, rel);
+  if (rule !== null) return { status: 'excluded', file: rel, rule };
   const root = tree === null ? null : realTree(tree);
-  const acceptance_revision = acceptanceRevision(repoRoot, run, block);
-  const ticket = reviewTicketId({ run, block, file: rel, content_hash, tree: root, acceptance_revision });
+  const { ticket, acceptance_revision, reopened_at, matching } = reviewIdentity({ repoRoot, run, block, file: rel, content_hash, tree: root, after });
   const target = path.join(queueDir(repoRoot), `${ticket}.json`);
-  const named = { ...(root === null ? {} : { tree: root }), ...(acceptance_revision === undefined ? {} : { acceptance_revision }) };
+  const named = { ...(root === null ? {} : { tree: root }), ...(acceptance_revision === undefined ? {} : { acceptance_revision }), ...(reopened_at === undefined ? {} : { reopened_at }) };
+  const reopenedAt = Date.parse(reopened_at ?? '');
+  if (Number.isFinite(reopenedAt)) {
+    // clearDone may have made the old ticket pending. Retire it before publishing its successor.
+    for (const previous of matching) {
+      if (previous.ticket !== ticket && Date.parse(previous.enqueued_at) <= reopenedAt) supersedeTicket(repoRoot, previous.ticket);
+    }
+  }
   if (!existsSync(target)) {
+    const queued_at = new Date(Number.isFinite(reopenedAt) ? Math.max(now.getTime(), reopenedAt + 1) : now.getTime()).toISOString();
     /** @type {Ticket} */
-    const body = { ticket, run, block, file: rel, content_hash, enqueued_at: now.toISOString(), ...named };
-    // Publish a complete immutable ticket without replacing a concurrent coder's ticket.
+    const body = { ticket, run, block, file: rel, content_hash, enqueued_at: queued_at, queued_at, started_at: null, finished_at: null, duration_ms: null, ...named };
+    // Publish a complete ticket without replacing a concurrent coder's ticket.
     mkdirSync(path.dirname(target), { recursive: true });
     const tmp = `${target}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
     try {
@@ -169,6 +223,23 @@ export function enqueueHash({ repoRoot, run, block, file, content_hash, tree = n
   return { ticket, status: isDone(repoRoot, ticket) ? 'done' : 'queued', file: rel, content_hash, ...named };
 }
 
+/** Use the current run snapshot, including reloads, just as the watch and close do.
+ * @param {string} repoRoot @param {string} run @param {string} file @param {Record<string, any> | null} [fallback]
+ */
+export function reviewExclusionFor(repoRoot, run, file, fallback = null) {
+  const record = readJSON(runRecordPath(run)) ?? readJSON(path.join(repoRoot, '.code-forge', 'runs', `${run}.json`));
+  let cfg;
+  try {
+    cfg = record ? configInForce(record) : null;
+  } catch (err) {
+    if (!(err instanceof StateError) || err.code !== 'config-snapshot') throw err;
+    // Keep the ticket queued so the worker records unavailable/config-snapshot. Never use
+    // exclusions from an untrusted snapshot or the fallback to skip that result.
+    return null;
+  }
+  return reviewExcludeRule(cfg ?? fallback, file);
+}
+
 /** Finish only an unstarted, pending review. A superseded marker has no review result.
  * @param {string} repoRoot @param {string} ticket
  * @param {{write?: (file: string, text: string) => void, link?: (from: string, to: string) => void}} [io] - publication seams for tests.
@@ -222,13 +293,17 @@ export function assertAnswers(answers) {
  * repo-root-relative). Both files are hashed now (under `tree` when given); idempotent like
  * {@link enqueue}. The caller has already refused the same file and the id list.
  * @param {{repoRoot: string, run: string, block: string, file: string, byFile: string, answers: string[], tree?: string | null, now?: Date}} opts
- * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, by_file: string, by_hash: string, answers: string[], tree?: string}}
+ * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, by_file: string, by_hash: string, answers: string[], tree?: string} | {status: 'excluded', file: string, rule: string, ticket?: never, answers?: never}}
  * @throws {WorkerError} `bad-path`, `usage`
  */
 export function enqueueAnswers({ repoRoot, run, block, file, byFile, answers, tree = null, now = new Date() }) {
   const rel = assertRowPath(file);
   const by_file = assertRowPath(byFile);
   const ids = assertAnswers(answers);
+  for (const candidate of [rel, by_file]) {
+    const rule = reviewExclusionFor(repoRoot, run, candidate);
+    if (rule !== null) return { status: 'excluded', file: candidate, rule };
+  }
   const root = tree === null ? null : realTree(tree);
   const content_hash = contentHash(root ?? repoRoot, rel);
   const by_hash = contentHash(root ?? repoRoot, by_file);
@@ -237,7 +312,7 @@ export function enqueueAnswers({ repoRoot, run, block, file, byFile, answers, tr
   const named = root === null ? {} : { tree: root };
   if (!existsSync(target)) {
     /** @type {AnswersTicket} */
-    const body = { ticket, kind: 'answers', run, block, file: rel, content_hash, by_file, by_hash, answers: ids, enqueued_at: now.toISOString(), ...named };
+    const body = { ticket, kind: 'answers', run, block, file: rel, content_hash, by_file, by_hash, answers: ids, enqueued_at: now.toISOString(), queued_at: now.toISOString(), started_at: null, finished_at: null, duration_ms: null, ...named };
     writeAtomic(target, `${JSON.stringify(body)}\n`);
   }
   return { ticket, status: isDone(repoRoot, ticket) ? 'done' : 'queued', file: rel, content_hash, by_file, by_hash, answers: ids, ...named };
@@ -532,6 +607,7 @@ export function readTicket(repoRoot, id) {
     return /** @type {Ticket} */ (t);
   }
   if (t.acceptance_revision !== undefined && typeof t.acceptance_revision !== 'string') throw new WorkerError('bad-ticket', `ticket ${id} has an invalid acceptance revision`);
+  if (t.reopened_at !== undefined && (typeof t.reopened_at !== 'string' || !Number.isFinite(Date.parse(t.reopened_at)))) throw new WorkerError('bad-ticket', `ticket ${id} has an invalid reopen timestamp`);
   if (reviewTicketId(t) !== id) throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
   return /** @type {Ticket} */ (t);
 }
@@ -550,10 +626,17 @@ export function writeResult({ repoRoot, runId, ticket, result, key }) {
   const file = path.join(reviewsDir(repoRoot, runId), `${ticket}.json`);
   writeAtomic(file, `${JSON.stringify(signed)}\n`);
   const openFindings = signed.status === 'reviewed' && signed.approved !== true && Array.isArray(signed.findings) && signed.findings.length > 0;
-  writeAtomic(path.join(queueDir(repoRoot), `${ticket}.done`), `${JSON.stringify({ ticket, status: signed.status, ...measured, ...(openFindings ? { open_findings: true } : {}), result: path.relative(repoRoot, file) })}\n`);
+  const timings = Object.fromEntries(['queued_at', 'started_at', 'finished_at', 'duration_ms'].filter((field) => Object.hasOwn(signed, field)).map((field) => [field, signed[field]]));
+  writeAtomic(path.join(queueDir(repoRoot), `${ticket}.done`), `${JSON.stringify({ ticket, status: signed.status, ...measured, ...timings, ...(openFindings ? { open_findings: true } : {}), result: path.relative(repoRoot, file) })}\n`);
   return signed;
 }
 
+/** Worker-owned lifecycle metadata; identity and enqueue ordering stay unchanged.
+ * @param {string} repoRoot @param {Ticket} ticket @param {Record<string, any>} timings */
+export function writeTicketTimings(repoRoot, ticket, timings) {
+  writeAtomic(path.join(queueDir(repoRoot), `${assertTicketId(ticket.ticket)}.json`), `${JSON.stringify({ ...ticket, ...timings })}\n`);
+}
+
 /**
  * Read a result without verifying it (the coder's `--wait` cannot read the run key).
  * @param {string} repoRoot @param {string} runId @param {string} ticket

package/src/worker/watch.mjs

@@ -2,7 +2,7 @@
 import { randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
-import { reviewFileLoop } from '../config/validate.mjs';
+import { reviewExcludeRule, reviewFileLoop } from '../config/validate.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
 import { readRun } from '../state/run.mjs';
 import { ownsAt } from '../review/gate-check.mjs';
@@ -86,7 +86,7 @@ export async function watchTick({ repoRoot, runId, cfg, readRun: loadRun = readR
       // Stage every hash before publishing anything: an unreadable object queues nothing.
       const hashes = [];
       let unreadable = false;
-      for (const raw of owned) {
+      for (const raw of owned.filter((file) => reviewExcludeRule(snapshotFor(record, '')?.config ?? cfg, file) === null)) {
         const file = assertRowPath(raw);
         const listed = await git(['ls-tree', '-z', head, '--', file]);
         if (listed.result !== 'ok') { unreadable = true; break; }