@deftai/directive-runtime 0.126.0-beta.2 → 0.126.0-beta.3

package/vendor/directive-core/dist/session/occupancy.js

@@ -76,7 +76,7 @@ import { assertAppendLockOwned, withAppendLock } from "../slice/lock.js";
 import { SWARM_WORKER_ROLES } from "../swarm/routing.js";
 import { recordChildOccupancyLease } from "./child-occupancy.js";
 import { worktreePathOrNull } from "./git.js";
-import { ambientHostSessionOwner, claimsHostSessionIdShape, detectDeclaredIdentityHosts, isUsableHostSessionId, parseCanonicalHostSessionId, printCompanionHostOwner, } from "./host-session-owner.js";
+import { ambientHostSessionOwner, canonicalHostSessionId, claimsHostSessionIdShape, detectDeclaredIdentityHosts, HOST_IDENTITY_PROVIDERS, isUsableHostSessionId, parseCanonicalHostSessionId, printCompanionHostOwner, } from "./host-session-owner.js";
 import { stableJson } from "./json.js";
 import { isLinkedWorktreePath, isMainWorktreePath, listLinkedWorktreeCheckouts, mainWorktreeRoot, } from "./main-worktree.js";
 import { readRitualState } from "./ritual-sentinel.js";
@@ -90,6 +90,15 @@ export const OCCUPANCY_RELPATH = [".deft", "occupancy.json"];
  * later host can self-claim.
  */
 export const DEFT_EXPECTED_DECLARED_HOST_ATTACH = "DEFT_EXPECTED_DECLARED_HOST_ATTACH";
+/** Worktree applying-host record for multi-host PreToolUse deposits (#5676). */
+export const APPLYING_HOST_RELPATH = [".deft", "applying-host.json"];
+export const APPLYING_HOST_SCHEMA = "deft.applying-host.v1";
+/**
+ * Applying-host staleness floor (#5676). Mirrors tip ritual staleness (8h) so a
+ * reconnect SessionStart / read-only session:start republish stays in the same
+ * recovery window as ceremony re-arm; UUID residual stays under #5544.
+ */
+export const APPLYING_HOST_STALE_MS = Number("8") * 60 * 60 * 1000;
 /** Crash recovery TTL: 20 minutes without heartbeat (15–30 window). */
 export const OCCUPANCY_TTL_MS = 20 * 60 * 1000;
 /**
@@ -235,6 +244,272 @@ export const OCCUPANCY_MAX_GRANTS = 32;
 export function occupancyPath(projectRoot) {
     return join(resolve(projectRoot), ...OCCUPANCY_RELPATH);
 }
+export function applyingHostPath(projectRoot) {
+    return join(resolve(projectRoot), ...APPLYING_HOST_RELPATH);
+}
+function isHookHostIdentityProvider(value) {
+    return HOST_IDENTITY_PROVIDERS.includes(value);
+}
+function parseApplyingHostPayload(payload) {
+    if (payload === null || typeof payload !== "object" || Array.isArray(payload))
+        return null;
+    const row = payload;
+    if (row.schema !== APPLYING_HOST_SCHEMA)
+        return null;
+    if (typeof row.provider !== "string" || !isHookHostIdentityProvider(row.provider))
+        return null;
+    if (typeof row.rawSessionId !== "string" || !isUsableHostSessionId(row.rawSessionId))
+        return null;
+    if (typeof row.applyingHostSessionId !== "string")
+        return null;
+    if (typeof row.claimed_at !== "string" || parseTimestamp(row.claimed_at) === null)
+        return null;
+    const transport = row.transport === "grok-hook-event" ? "grok-hook-event" : "native";
+    const expected = canonicalHostSessionId(row.provider, row.rawSessionId);
+    if (row.applyingHostSessionId !== expected)
+        return null;
+    return {
+        schema: APPLYING_HOST_SCHEMA,
+        provider: row.provider,
+        rawSessionId: row.rawSessionId,
+        applyingHostSessionId: expected,
+        claimed_at: row.claimed_at,
+        transport,
+    };
+}
+/** Read the worktree applying-host record (#5676). */
+export function readApplyingHost(projectRoot, now = new Date()) {
+    const path = applyingHostPath(projectRoot);
+    try {
+        if (!existsSync(path))
+            return { status: "missing", record: null };
+    }
+    catch {
+        return { status: "missing", record: null };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(readFileSync(path, { encoding: "utf8" }));
+    }
+    catch {
+        return {
+            status: "invalid",
+            record: null,
+            message: "applying-host record is unreadable; republish via SessionStart or read-only session:start",
+        };
+    }
+    const record = parseApplyingHostPayload(payload);
+    if (record === null) {
+        return {
+            status: "invalid",
+            record: null,
+            message: "applying-host record is malformed; republish via SessionStart or read-only session:start",
+        };
+    }
+    const claimedAt = parseTimestamp(record.claimed_at);
+    if (claimedAt === null) {
+        return {
+            status: "invalid",
+            record: null,
+            message: "applying-host record has invalid claimed_at; republish via SessionStart or read-only session:start",
+        };
+    }
+    if (now.getTime() - claimedAt.getTime() > APPLYING_HOST_STALE_MS) {
+        return {
+            status: "stale",
+            record,
+            message: formatApplyingHostRepairDiagnostic("stale"),
+        };
+    }
+    return { status: "ok", record };
+}
+/**
+ * Supported repair when the applying-host record is missing, stale, or
+ * conflicting (#5676 Prefer-A Recut-5). Mutation session:start is reinforcement
+ * only — first publication is SessionStart or read-only session:start.
+ */
+export function formatApplyingHostRepairDiagnostic(reason = "missing") {
+    const subject = reason === "missing"
+        ? "Applying-host record is missing"
+        : reason === "stale"
+            ? "Applying-host record is stale"
+            : reason === "conflicting"
+                ? "Applying-host record conflicts with this host session"
+                : "Applying-host record is invalid";
+    return (`${subject}. Republish via host SessionStart reconnect and/or ` +
+        "`deft session:start --read-only --session-id=<applyingHostSessionId>` " +
+        "before retrying mutation lifecycle. UUID / Harbor residuals stay under #5544.");
+}
+/** Write/replace the worktree applying-host record (#5676). */
+export function publishApplyingHost(projectRoot, input) {
+    if (!isUsableHostSessionId(input.rawSessionId)) {
+        throw new Error("publishApplyingHost: rawSessionId is not a usable host session id");
+    }
+    const root = resolve(projectRoot);
+    const claimedAt = input.claimedAt ?? new Date();
+    const record = {
+        schema: APPLYING_HOST_SCHEMA,
+        provider: input.provider,
+        rawSessionId: input.rawSessionId,
+        applyingHostSessionId: canonicalHostSessionId(input.provider, input.rawSessionId),
+        claimed_at: timestampIso(claimedAt),
+        transport: input.transport ?? "native",
+    };
+    const target = applyingHostPath(root);
+    assertWriteTargetSafe(root, target);
+    const dir = dirname(target);
+    const tmpName = join(dir, `.applying-host.${process.pid}.json.tmp`);
+    const text = `${stableJson(record, 2)}\n`;
+    try {
+        containedWrite({ root, target: tmpName, data: text, mode: "create" });
+        renameSync(tmpName, target);
+    }
+    finally {
+        try {
+            rmSync(tmpName, { force: true });
+        }
+        catch {
+            /* best-effort cleanup of tmp only */
+        }
+    }
+    return record;
+}
+/**
+ * Publish from a canonical `host:<provider>:v1:<base64url>` owner (#5676).
+ * Returns null when the id is not canonical (opaque UUID leftovers stay #5544).
+ */
+export function publishApplyingHostFromCanonicalSessionId(projectRoot, sessionId, opts = {}) {
+    const parsed = parseCanonicalHostSessionId(sessionId.trim());
+    if (parsed === null)
+        return null;
+    return publishApplyingHost(projectRoot, {
+        provider: parsed.provider,
+        rawSessionId: parsed.rawSessionId,
+        claimedAt: opts.claimedAt,
+        transport: opts.transport,
+    });
+}
+/**
+ * Lifecycle admission against the applying-host record (#5676).
+ *
+ * Matching deposits enforce `applyingHostSessionId`. Non-matching deposits
+ * soft-pass only when the command already names that id. Missing/stale/
+ * conflicting records name SessionStart / read-only repair. Absent record with
+ * no flip-flop shape returns `absent` so single-host flows keep prior behavior.
+ */
+export function evaluateApplyingHostLifecycleAdmission(input) {
+    const read = readApplyingHost(input.projectRoot, input.now ?? new Date());
+    if (read.status === "invalid") {
+        return {
+            kind: "repair",
+            record: null,
+            message: read.message,
+        };
+    }
+    if (read.status === "stale") {
+        // Live occupancy owner cleanup when applying-host TTL elapsed but the lease
+        // is still heartbeat-fresh (#5676 Greptile P1). Soft-pass only when argv
+        // already names that live owner so bare commands keep the rewrite path.
+        const staleLive = liveOccupant(input.projectRoot, input.now ?? new Date());
+        const staleLiveId = staleLive?.sessionId ?? null;
+        const staleNamed = input.namedSessionId?.trim() || null;
+        if (staleLiveId !== null &&
+            read.record.applyingHostSessionId === staleLiveId &&
+            staleNamed === staleLiveId) {
+            return {
+                kind: "soft-pass",
+                record: read.record,
+                reason: "live-lease-owner-cleanup",
+            };
+        }
+        return { kind: "repair", record: read.record, message: read.message };
+    }
+    if (read.status === "missing" || read.record === null) {
+        const named = input.namedSessionId?.trim() || null;
+        const deposit = input.depositSessionId?.trim() || null;
+        if (named !== null && deposit !== null && named !== deposit) {
+            const namedParts = parseCanonicalHostSessionId(named);
+            const depositParts = parseCanonicalHostSessionId(deposit);
+            if (namedParts !== null &&
+                depositParts !== null &&
+                namedParts.rawSessionId === depositParts.rawSessionId &&
+                namedParts.provider !== depositParts.provider) {
+                return {
+                    kind: "repair",
+                    record: null,
+                    message: formatApplyingHostRepairDiagnostic("missing"),
+                };
+            }
+        }
+        return { kind: "absent", record: null };
+    }
+    const record = read.record;
+    // Live occupancy owner cleanup when a later SessionStart replaced applying-host
+    // (#5676 Greptile P1). Only soft-pass when argv already names that live owner so
+    // bare commands still take the rewrite path (do not skip --session-id injection).
+    const live = liveOccupant(input.projectRoot, input.now ?? new Date());
+    const liveId = live?.sessionId ?? null;
+    const named = input.namedSessionId?.trim() || null;
+    if (liveId !== null && record.applyingHostSessionId !== liveId && named === liveId) {
+        return {
+            kind: "soft-pass",
+            record,
+            reason: "live-lease-owner-cleanup",
+        };
+    }
+    if (isHookHostIdentityProvider(input.depositHost) &&
+        input.depositHost === record.provider &&
+        input.depositSessionId !== null &&
+        input.depositSessionId !== record.applyingHostSessionId) {
+        const depositParts = parseCanonicalHostSessionId(input.depositSessionId);
+        if (depositParts === null || depositParts.rawSessionId !== record.rawSessionId) {
+            return {
+                kind: "repair",
+                record,
+                message: formatApplyingHostRepairDiagnostic("conflicting"),
+            };
+        }
+    }
+    const matchingDeposit = input.depositHost === record.provider;
+    if (!matchingDeposit) {
+        // Soft-pass only when argv already names applyingHostSessionId (#5676).
+        // Bare commands must not skip the owner rewrite / explicit-owner gate.
+        if (named === record.applyingHostSessionId) {
+            return {
+                kind: "soft-pass",
+                record,
+                reason: "non-matching-deposit-names-applying-host",
+            };
+        }
+        return {
+            kind: "foreign-owner",
+            record,
+            namedSessionId: named,
+            message: named === null
+                ? `Directive refused bare lifecycle command; applying-host is ` +
+                    `${record.applyingHostSessionId}. Re-run with ` +
+                    `--session-id=${record.applyingHostSessionId}.`
+                : `Directive refused foreign owner ${named}; applying-host is ` +
+                    `${record.applyingHostSessionId}. Re-run with ` +
+                    `--session-id=${record.applyingHostSessionId}.`,
+        };
+    }
+    if (named !== null && named !== record.applyingHostSessionId) {
+        return {
+            kind: "foreign-owner",
+            record,
+            namedSessionId: named,
+            message: `Directive refused foreign owner ${named}; applying-host is ` +
+                `${record.applyingHostSessionId}. Re-run with ` +
+                `--session-id=${record.applyingHostSessionId}.`,
+        };
+    }
+    return {
+        kind: "enforce",
+        record,
+        matchingDeposit: true,
+    };
+}
 /**
  * Resolve the lease root CLI and hooks share for the same worktree (#5544 P2).
  *