@deftai/directive-runtime 0.129.5 → 0.129.6

package/vendor/directive-core/dist/session/occupancy.js

@@ -327,8 +327,11 @@ export function readApplyingHost(projectRoot, now = new Date()) {
  * Supported repair when the applying-host record is missing, stale, or
  * conflicting (#5676 Prefer-A Recut-5). Mutation session:start is reinforcement
  * only — first publication is SessionStart or read-only session:start.
+ *
+ * When a live foreign occupant holds the lease (#6101), do not prescribe another
+ * owner's session-id republish recipe — name the incumbent and supported exits.
  */
-export function formatApplyingHostRepairDiagnostic(reason = "missing") {
+export function formatApplyingHostRepairDiagnostic(reason = "missing", opts = {}) {
     const subject = reason === "missing"
         ? "Applying-host record is missing"
         : reason === "stale"
@@ -336,11 +339,26 @@ export function formatApplyingHostRepairDiagnostic(reason = "missing") {
             : reason === "conflicting"
                 ? "Applying-host record conflicts with this host session"
                 : "Applying-host record is invalid";
+    const live = opts.liveSessionId?.trim() || null;
+    const caller = opts.callerSessionId?.trim() || null;
+    if (live !== null && live !== caller) {
+        return (`${subject}. Live occupant ${live} still holds this worktree. ` +
+            "Supported exits: that owner runs occupancy:release / session:end, or wait for lease TTL. " +
+            "Do not republish applying-host with another owner's session-id.");
+    }
     return (`${subject}. Republish via host SessionStart reconnect and/or ` +
         "`deft session:start --read-only --session-id=<applyingHostSessionId>` " +
         "before retrying mutation lifecycle. UUID / Harbor residuals stay under #5544.");
 }
-/** Write/replace the worktree applying-host record (#5676). */
+/**
+ * Write/replace the worktree applying-host record (#5676 / #6101 / #6143).
+ *
+ * Under the occupancy writer lock, skip when a live foreign occupant holds the
+ * lease — keyed to the canonical session id being written. Without
+ * `allowForeignTakeover`, also skip replacing a different provider's fresh
+ * no-lease claim (RO SessionStart must not displace). No unlocked write
+ * fallback. Deferred is distinct from non-canonical null on the FromCanonical path.
+ */
 export function publishApplyingHost(projectRoot, input) {
     if (!isUsableHostSessionId(input.rawSessionId)) {
         throw new Error("publishApplyingHost: rawSessionId is not a usable host session id");
@@ -355,39 +373,148 @@ export function publishApplyingHost(projectRoot, input) {
         claimed_at: timestampIso(claimedAt),
         transport: input.transport ?? "native",
     };
-    const target = applyingHostPath(root);
-    assertWriteTargetSafe(root, target);
-    const dir = dirname(target);
-    const tmpName = join(dir, `.applying-host.${process.pid}.json.tmp`);
-    const text = `${stableJson(record, 2)}\n`;
-    try {
-        containedWrite({ root, target: tmpName, data: text, mode: "create" });
-        renameSync(tmpName, target);
-    }
-    finally {
+    return withOccupancyLock(root, (fence) => {
+        const live = liveOccupant(root, claimedAt);
+        if (live !== null && live.sessionId !== record.applyingHostSessionId) {
+            return {
+                status: "deferred",
+                reason: "live-foreign-occupant",
+                liveSessionId: live.sessionId,
+                attemptedSessionId: record.applyingHostSessionId,
+            };
+        }
+        const existing = readApplyingHost(root, claimedAt);
+        if (existing.status === "ok" &&
+            existing.record.provider !== record.provider &&
+            live?.sessionId !== record.applyingHostSessionId &&
+            input.allowForeignTakeover !== true) {
+            return {
+                status: "deferred",
+                reason: "foreign-fresh-claim",
+                liveSessionId: existing.record.applyingHostSessionId,
+                attemptedSessionId: record.applyingHostSessionId,
+            };
+        }
+        fence();
+        const target = applyingHostPath(root);
+        assertWriteTargetSafe(root, target);
+        const dir = dirname(target);
+        const tmpName = join(dir, `.applying-host.${process.pid}.json.tmp`);
+        const text = `${stableJson(record, 2)}\n`;
         try {
-            rmSync(tmpName, { force: true });
+            containedWrite({ root, target: tmpName, data: text, mode: "create" });
+            renameSync(tmpName, target);
         }
-        catch {
-            /* best-effort cleanup of tmp only */
+        finally {
+            try {
+                rmSync(tmpName, { force: true });
+            }
+            catch {
+                /* best-effort cleanup of tmp only */
+            }
         }
-    }
-    return record;
+        return { status: "published", record };
+    });
 }
 /**
- * Publish from a canonical `host:<provider>:v1:<base64url>` owner (#5676).
+ * Publish from a canonical `host:<provider>:v1:<base64url>` owner (#5676 / #6101 / #6143).
  * Returns null when the id is not canonical (opaque UUID leftovers stay #5544).
+ * Deferred live-foreign / foreign-fresh skip is a discriminated result, never collapsed into null.
  */
 export function publishApplyingHostFromCanonicalSessionId(projectRoot, sessionId, opts = {}) {
     const parsed = parseCanonicalHostSessionId(sessionId.trim());
     if (parsed === null)
         return null;
-    return publishApplyingHost(projectRoot, {
+    const result = publishApplyingHost(projectRoot, {
         provider: parsed.provider,
         rawSessionId: parsed.rawSessionId,
         claimedAt: opts.claimedAt,
         transport: opts.transport,
+        allowForeignTakeover: opts.allowForeignTakeover,
     });
+    if (result.status === "published") {
+        return result;
+    }
+    // Collapse foreign-fresh-claim for session:start's narrower deferred report.
+    return {
+        status: "deferred",
+        reason: "live-foreign-occupant",
+        liveSessionId: result.liveSessionId,
+        attemptedSessionId: result.attemptedSessionId,
+    };
+}
+/**
+ * Clear the worktree applying-host record (#6143).
+ *
+ * Owner match always clears. With no live foreign occupant, any presented caller
+ * may clear an abandoned no-lease soft claim. Live foreign lease keeps the
+ * record (#5913 / #6101 keep-outs).
+ */
+export function clearApplyingHost(projectRoot, input = {}) {
+    const root = resolve(projectRoot);
+    const now = input.now ?? new Date();
+    const caller = input.sessionId?.trim() || null;
+    return withOccupancyLock(root, (fence) => {
+        const read = readApplyingHost(root, now);
+        if (read.status === "missing") {
+            return { status: "missing" };
+        }
+        if (read.status === "invalid" || read.record === null) {
+            fence();
+            containedRemove({ root, target: applyingHostPath(root) });
+            return { status: "cleared", previousSessionId: "<invalid>" };
+        }
+        const record = read.record;
+        const live = liveOccupant(root, now);
+        const liveId = live?.sessionId ?? null;
+        const owns = caller !== null && caller === record.applyingHostSessionId;
+        if (!owns && liveId !== null && liveId !== caller) {
+            return {
+                status: "denied",
+                record,
+                message: `Directive refused applying-host:release for caller ${caller ?? "<missing>"}. ` +
+                    `Live occupant ${liveId} still holds this worktree. Wait for that owner to ` +
+                    "run occupancy:release / session:end, or occupancy:steal --confirm.",
+            };
+        }
+        if (!owns && liveId !== null && liveId === caller) {
+            // Live lease holder may clear a replaced applying-host soft claim.
+        }
+        else if (!owns && liveId === null) {
+            // Abandoned no-lease soft claim — clearable without impersonating owner.
+        }
+        else if (!owns) {
+            return {
+                status: "denied",
+                record,
+                message: `Directive refused applying-host:release for caller ${caller ?? "<missing>"}. ` +
+                    `Recorded applying-host is ${record.applyingHostSessionId}. Re-run as that owner, ` +
+                    "or clear after the lease is gone.",
+            };
+        }
+        fence();
+        containedRemove({ root, target: applyingHostPath(root) });
+        return {
+            status: "cleared",
+            previousSessionId: record.applyingHostSessionId,
+        };
+    }, input.lockDeps);
+}
+/** Foreign-owner deny names the caller and takeover/wait path — never the owner's id (#6143 P2). */
+export function formatApplyingHostForeignOwnerDeny(input) {
+    const caller = input.callerSessionId?.trim() || null;
+    const live = input.liveSessionId?.trim() || null;
+    const callerLabel = caller ?? "<unresolved-caller>";
+    if (live !== null) {
+        return (`Directive refused foreign lifecycle for caller ${callerLabel}. ` +
+            `Live occupant ${live} still holds this worktree. Take over with ` +
+            "`occupancy:steal --confirm`, wait for occupancy:release / session:end, or " +
+            "`applying-host:release` from the owner. Do not re-run with another owner's --session-id.");
+    }
+    return (`Directive refused foreign lifecycle for caller ${callerLabel}. ` +
+        "Applying-host soft claim has no live lease for this caller path; use " +
+        "`applying-host:release`, wait for SessionStart soft-claim takeover, or " +
+        "retry bare lifecycle after the claim is cleared. Do not re-run with another owner's --session-id.");
 }
 /**
  * Lifecycle admission against the applying-host record (#5676).
@@ -398,7 +525,10 @@ export function publishApplyingHostFromCanonicalSessionId(projectRoot, sessionId
  * no flip-flop shape returns `absent` so single-host flows keep prior behavior.
  */
 export function evaluateApplyingHostLifecycleAdmission(input) {
-    const read = readApplyingHost(input.projectRoot, input.now ?? new Date());
+    const now = input.now ?? new Date();
+    const deposit = input.depositSessionId?.trim() || null;
+    const named = input.namedSessionId?.trim() || null;
+    const read = readApplyingHost(input.projectRoot, now);
     if (read.status === "invalid") {
         return {
             kind: "repair",
@@ -407,26 +537,28 @@ export function evaluateApplyingHostLifecycleAdmission(input) {
         };
     }
     if (read.status === "stale") {
-        // Live occupancy owner cleanup when applying-host TTL elapsed but the lease
-        // is still heartbeat-fresh (#5676 Greptile P1). Soft-pass only when argv
-        // already names that live owner so bare commands keep the rewrite path.
-        const staleLive = liveOccupant(input.projectRoot, input.now ?? new Date());
+        // Deposit-keyed live-owner cleanup (#6101 Prefer-A Recut-2): key solely on
+        // depositSessionId === liveId with no applyingHostSessionId relation conjunct.
+        // Maps onto dispatcher liveOwnerBypass so bare keeps rewrite injection.
+        const staleLive = liveOccupant(input.projectRoot, now);
         const staleLiveId = staleLive?.sessionId ?? null;
-        const staleNamed = input.namedSessionId?.trim() || null;
-        if (staleLiveId !== null &&
-            read.record.applyingHostSessionId === staleLiveId &&
-            staleNamed === staleLiveId) {
+        if (staleLiveId !== null && deposit === staleLiveId) {
             return {
-                kind: "soft-pass",
+                kind: "live-owner-cleanup",
                 record: read.record,
-                reason: "live-lease-owner-cleanup",
             };
         }
-        return { kind: "repair", record: read.record, message: read.message };
+        return {
+            kind: "repair",
+            record: read.record,
+            message: formatApplyingHostRepairDiagnostic("stale", {
+                liveSessionId: staleLiveId,
+                callerSessionId: deposit ?? named,
+            }),
+        };
     }
     if (read.status === "missing" || read.record === null) {
-        const named = input.namedSessionId?.trim() || null;
-        const deposit = input.depositSessionId?.trim() || null;
+        const missingLive = liveOccupant(input.projectRoot, now);
         if (named !== null && deposit !== null && named !== deposit) {
             const namedParts = parseCanonicalHostSessionId(named);
             const depositParts = parseCanonicalHostSessionId(deposit);
@@ -437,24 +569,25 @@ export function evaluateApplyingHostLifecycleAdmission(input) {
                 return {
                     kind: "repair",
                     record: null,
-                    message: formatApplyingHostRepairDiagnostic("missing"),
+                    message: formatApplyingHostRepairDiagnostic("missing", {
+                        liveSessionId: missingLive?.sessionId ?? null,
+                        callerSessionId: deposit,
+                    }),
                 };
             }
         }
         return { kind: "absent", record: null };
     }
     const record = read.record;
-    // Live occupancy owner cleanup when a later SessionStart replaced applying-host
-    // (#5676 Greptile P1). Only soft-pass when argv already names that live owner so
+    // Deposit-keyed live-owner cleanup when applying-host was replaced (#6101).
+    // Delete dead ok-branch soft-pass; map onto liveOwnerBypass via new kind so
     // bare commands still take the rewrite path (do not skip --session-id injection).
-    const live = liveOccupant(input.projectRoot, input.now ?? new Date());
+    const live = liveOccupant(input.projectRoot, now);
     const liveId = live?.sessionId ?? null;
-    const named = input.namedSessionId?.trim() || null;
-    if (liveId !== null && record.applyingHostSessionId !== liveId && named === liveId) {
+    if (liveId !== null && deposit === liveId && record.applyingHostSessionId !== liveId) {
         return {
-            kind: "soft-pass",
+            kind: "live-owner-cleanup",
             record,
-            reason: "live-lease-owner-cleanup",
         };
     }
     if (isHookHostIdentityProvider(input.depositHost) &&
@@ -466,7 +599,10 @@ export function evaluateApplyingHostLifecycleAdmission(input) {
             return {
                 kind: "repair",
                 record,
-                message: formatApplyingHostRepairDiagnostic("conflicting"),
+                message: formatApplyingHostRepairDiagnostic("conflicting", {
+                    liveSessionId: liveId,
+                    callerSessionId: deposit ?? named,
+                }),
             };
         }
     }
@@ -481,27 +617,39 @@ export function evaluateApplyingHostLifecycleAdmission(input) {
                 reason: "non-matching-deposit-names-applying-host",
             };
         }
+        // #6143 P1: no-lease fresh claim is advisory — other-provider bare lifecycle
+        // may take over (republish). Keep-outs #5913/#6101 still bind when a live
+        // lease exists.
+        if (liveId === null) {
+            return {
+                kind: "advisory-takeover",
+                record,
+                callerSessionId: deposit,
+            };
+        }
         return {
             kind: "foreign-owner",
             record,
             namedSessionId: named,
-            message: named === null
-                ? `Directive refused bare lifecycle command; applying-host is ` +
-                    `${record.applyingHostSessionId}. Re-run with ` +
-                    `--session-id=${record.applyingHostSessionId}.`
-                : `Directive refused foreign owner ${named}; applying-host is ` +
-                    `${record.applyingHostSessionId}. Re-run with ` +
-                    `--session-id=${record.applyingHostSessionId}.`,
+            message: formatApplyingHostForeignOwnerDeny({
+                callerSessionId: deposit,
+                liveSessionId: liveId,
+                namedSessionId: named,
+            }),
         };
     }
     if (named !== null && named !== record.applyingHostSessionId) {
+        // Same-provider wrong named id: still foreign, but deny names the caller
+        // (#6143 P2) and never tells the caller to impersonate applying-host.
         return {
             kind: "foreign-owner",
             record,
             namedSessionId: named,
-            message: `Directive refused foreign owner ${named}; applying-host is ` +
-                `${record.applyingHostSessionId}. Re-run with ` +
-                `--session-id=${record.applyingHostSessionId}.`,
+            message: formatApplyingHostForeignOwnerDeny({
+                callerSessionId: deposit,
+                liveSessionId: liveId,
+                namedSessionId: named,
+            }),
         };
     }
     return {
@@ -1720,6 +1868,14 @@ export function releaseOccupancy(projectRoot, input = {}) {
     return withOccupancyLock(root, (fence) => {
         const existing = readOccupancy(root);
         if (existing === null) {
+            // #6143: release with no lease still clears an abandoned applying-host soft claim.
+            try {
+                fence();
+                containedRemove({ root, target: applyingHostPath(root) });
+            }
+            catch {
+                /* best-effort */
+            }
             return {
                 action: "released",
                 sessionId: caller,
@@ -1788,6 +1944,13 @@ export function releaseOccupancy(projectRoot, input = {}) {
             };
         }
         removeOccupancyFile(root, fence);
+        // #6143 P3: session:end / occupancy:release clear applying-host with the lease.
+        try {
+            containedRemove({ root, target: applyingHostPath(root) });
+        }
+        catch {
+            /* best-effort; lease release already succeeded */
+        }
         return {
             action: "released",
             sessionId: still.sessionId,