@codedology/code-forge 0.7.7 → 0.8.0

package/src/worker/queue.mjs

@@ -9,10 +9,13 @@
  *
  * The forbidden list (§8.4 ★) denies a coder any write under `reviews/` and to `queue/*.done`;
  * the MAC makes an edit visible anyway (T1/T2). Writes are atomic (temp file + rename).
+ *
+ * B62b: `<repo>` is always the MAIN tree's top level, where the worker runs — a block with its own
+ * worktree still queues there; only the reviewed content is read in the block's tree.
  */
 
 import { randomBytes } from 'node:crypto';
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { loadKey, signRow, verifyRow } from '../state/signer.mjs';
 import { isAlive, readStartTime, UNKNOWN_START_TIME } from '../util/reaper.mjs';
@@ -54,26 +57,48 @@ function readJSON(file) {
 }
 
 /**
- * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string}} Ticket
+ * @typedef {{ticket: string, run: string, block: string, file: string, content_hash: string, enqueued_at: string, tree?: string}} Ticket
+ *   `tree` (B62b): the block's worktree the content was hashed in. It is part of the ticket id,
+ *   and the worker only checks it against the tree it takes from the run record (a ticket whose
+ *   tree is not that one is `unavailable`, `worktree-mismatch`); it never reads content there.
  */
 
 /**
  * Enqueue `file` (already repo-root-relative) for review. Idempotent by content hash: the same
- * content returns the same ticket and never rewrites it.
- * @param {{repoRoot: string, run: string, block: string, file: string, now?: Date}} opts
- * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string}}
+ * content returns the same ticket and never rewrites it. The queue is under `repoRoot`; the
+ * content is hashed under `tree` when given (B62b: the block's worktree, realpath'd here), else
+ * under `repoRoot`. The tree is part of the ticket id, so a main-tree ticket and a tree ticket for
+ * the same bytes differ, and the answer names the tree given here, never a stored value.
+ * @param {{repoRoot: string, run: string, block: string, file: string, tree?: string | null, now?: Date}} opts
+ * @returns {{ticket: string, status: 'queued' | 'done', file: string, content_hash: string, tree?: string}}
+ * @throws {WorkerError} `bad-path` for a relative `tree` or one that cannot be resolved.
  */
-export function enqueue({ repoRoot, run, block, file, now = new Date() }) {
+export function enqueue({ repoRoot, run, block, file, tree = null, now = new Date() }) {
   const rel = assertRowPath(file);
-  const content_hash = contentHash(repoRoot, rel);
-  const ticket = ticketId({ run, block, file: rel, content_hash });
+  const root = tree === null ? null : realTree(tree);
+  const content_hash = contentHash(root ?? repoRoot, rel);
+  const ticket = ticketId({ run, block, file: rel, content_hash, tree: root });
   const target = path.join(queueDir(repoRoot), `${ticket}.json`);
+  const named = root === null ? {} : { tree: root };
   if (!existsSync(target)) {
     /** @type {Ticket} */
-    const body = { ticket, run, block, file: rel, content_hash, enqueued_at: now.toISOString() };
+    const body = { ticket, run, block, file: rel, content_hash, enqueued_at: now.toISOString(), ...named };
     writeAtomic(target, `${JSON.stringify(body)}\n`);
   }
-  return { ticket, status: isDone(repoRoot, ticket) ? 'done' : 'queued', file: rel, content_hash };
+  return { ticket, status: isDone(repoRoot, ticket) ? 'done' : 'queued', file: rel, content_hash, ...named };
+}
+
+/**
+ * @param {string} tree @returns {string} `tree` realpath'd.
+ * @throws {WorkerError} `bad-path` when it is relative or cannot be resolved.
+ */
+function realTree(tree) {
+  if (!path.isAbsolute(tree)) throw new WorkerError('bad-path', `the content tree ${tree} is not an absolute path`);
+  try {
+    return realpathSync(tree);
+  } catch {
+    throw new WorkerError('bad-path', `the content tree ${tree} cannot be resolved`);
+  }
 }
 
 /** @param {string} repoRoot @param {string} ticket */
@@ -113,6 +138,7 @@ export function readTicket(repoRoot, id) {
   const t = readJSON(path.join(queueDir(repoRoot), `${assertTicketId(id)}.json`));
   if (!t || typeof t !== 'object') throw new WorkerError('bad-ticket', `ticket ${id} is not readable JSON`);
   assertRowPath(t.file);
+  if (t.tree !== undefined && (typeof t.tree !== 'string' || !path.isAbsolute(t.tree))) throw new WorkerError('bad-ticket', `ticket ${id} names a tree that is not an absolute path`);
   if (typeof t.run !== 'string' || typeof t.block !== 'string' || typeof t.content_hash !== 'string' || ticketId(t) !== id) {
     throw new WorkerError('bad-ticket', `ticket ${id} does not match its id`);
   }

package/src/worker/ticket.mjs

@@ -1,6 +1,7 @@
 /**
  * Review tickets (plan §4.8, V4; block B11): repo-root-relative paths, content hashes and ticket
- * ids. Pure functions plus the one `git rev-parse --show-toplevel` call.
+ * ids. Pure functions plus the `git rev-parse` calls that find the repository root (and, B62b,
+ * the main working tree of a linked worktree: `mainRootOf`).
  *
  * Path rule (V4): a ticket's `file` — and every `review.*` row the worker writes — is relative to
  * the REPOSITORY ROOT (realpath'd `git rev-parse --show-toplevel`), whatever directory the coder
@@ -8,8 +9,9 @@
  * `bad-path` before anything is written; so is a result outside the root or under `.git/` or
  * `.code-forge/`. A stored value is re-checked by `assertRowPath` (tickets are coder-writable).
  *
- * Ticket id = the first 24 hex chars of `sha256(run \0 block \0 file \0 content_hash)`: the same
- * content enqueued twice is the same ticket (idempotent), an edited file is a new one.
+ * Ticket id = the first 24 hex chars of `sha256(run \0 block \0 file \0 content_hash)`, plus
+ * `\0 tree` for content hashed in a block's worktree (B62b): the same content enqueued twice is
+ * the same ticket (idempotent), an edited file is a new one.
  */
 
 import { createHash } from 'node:crypto';
@@ -73,6 +75,39 @@ export async function repoRootOf(cwd) {
   return realpathSync(top);
 }
 
+/**
+ * B62b: the top level of the MAIN working tree of the repository containing `cwd`, realpath'd —
+ * `cwd`'s own top level ({@link repoRootOf}) unless `cwd` is inside a linked worktree (`git
+ * worktree add`), whose main tree is the first record `git worktree list` prints. The review queue
+ * and the worker live there, whichever tree the coder works in. A repository whose main entry is
+ * bare has no main working tree to hold them, and is refused.
+ * @param {string} cwd
+ * @returns {Promise<string>}
+ * @throws {WorkerError} `no-repo` (also for git older than 2.36), `bare-main`, `no-main-tree`
+ */
+export async function mainRootOf(cwd) {
+  const top = await repoRootOf(cwd);
+  const opts = { cwd, env: gitChildEnv(), timeoutMs: 10000 };
+  const dirs = await exec(['git', 'rev-parse', '--path-format=absolute', '--git-dir', '--git-common-dir'], opts);
+  if (dirs.result !== 'ok') throw new WorkerError('no-repo', `not inside a git repository, or git is older than 2.36 (code-forge needs git >= 2.36): ${dirs.stderr.trim()}`);
+  const [gitDir, commonDir] = dirs.stdout.split('\n');
+  if (!gitDir || !commonDir) throw new WorkerError('no-repo', 'git rev-parse printed no git directory');
+  if (realOrSelf(gitDir) === realOrSelf(commonDir)) return top;
+  const list = await exec(['git', 'worktree', 'list', '--porcelain', '-z'], opts);
+  if (list.result !== 'ok') throw new WorkerError('no-repo', `the main working tree of the repository cannot be listed (code-forge needs git >= 2.36): ${list.stderr.trim()}`);
+  // records end with an empty field; the first record is the main tree's
+  const first = list.stdout.split('\0\0')[0].split('\0');
+  const where = first.find((line) => line.startsWith('worktree '));
+  if (!where) throw new WorkerError('no-repo', 'git worktree list printed no main working tree');
+  if (first.includes('bare')) throw new WorkerError('bare-main', `the repository's main entry ${where.slice('worktree '.length)} is bare: it has no main working tree for the review queue`);
+  const main = where.slice('worktree '.length);
+  try {
+    return realpathSync(main);
+  } catch {
+    throw new WorkerError('no-main-tree', `the repository's main working tree ${main} does not exist (moved or removed): the review queue lives there`);
+  }
+}
+
 /**
  * Refuse a stored row path that is not a plain repo-root-relative POSIX path (V4).
  * @param {unknown} value
@@ -187,9 +222,14 @@ export function readRegularFileNoFollow(repoRoot, file) {
 }
 
 /**
- * @param {{run: string, block: string, file: string, content_hash: string}} t
+ * B62b: a ticket that names the tree its content was hashed in (`tree`, a block's worktree) has
+ * the tree in its identity too — `sha256(run \0 block \0 file \0 content_hash \0 tree)` — so a
+ * main-tree ticket and a tree ticket for the same bytes are two tickets. Without a tree the id is
+ * the one from before B62b.
+ * @param {{run: string, block: string, file: string, content_hash: string, tree?: string | null}} t
  * @returns {string} the ticket id.
  */
-export function ticketId({ run, block, file, content_hash }) {
-  return createHash('sha256').update([run, block, file, content_hash].join('\0')).digest('hex').slice(0, 24);
+export function ticketId({ run, block, file, content_hash, tree = null }) {
+  const parts = tree === null ? [run, block, file, content_hash] : [run, block, file, content_hash, tree];
+  return createHash('sha256').update(parts.join('\0')).digest('hex').slice(0, 24);
 }