@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.140

package/dist/services/memory-repair-current-view.js

@@ -0,0 +1,299 @@
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedRegisteredMemoryCorrections } from "./memory-repair-registration.js";
+import { PreparedRetainedSecondMemoryRepairs } from "./memory-retained-second-repairs.js";
+import { PreparedSettledMemoryRepair } from "./memory-repair-history.js";
+import { MemoryRepairDocumentBaseline } from "./memory-repair-document-delta.js";
+import { PreparedMemoryRepairWorkspace } from "./memory-repair-workspace.js";
+import { reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+import { appendAudit } from "./audit.js";
+const token = Symbol("memory-repair-current-view");
+const event = "memory.repair_current_view";
+const nonMemory = (entry) => entry.path !== ".memory-bank" && !entry.path.startsWith(".memory-bank/");
+function isRegistration(value) {
+    return PreparedRegisteredMemoryCorrections.isPrepared(value) || PreparedRetainedSecondMemoryRepairs.isPrepared(value);
+}
+function inputView(registration) {
+    return PreparedRetainedSecondMemoryRepairs.isPrepared(registration) ? registration.initialInputView()
+        : registration.review().original().registration().view;
+}
+function bundle(registration) {
+    return PreparedRetainedSecondMemoryRepairs.isPrepared(registration) ? registration.bundle()
+        : registration.review().original().bundle();
+}
+function refuse(reason) {
+    throw new AppError("memory_repair_current_view_invalid", "Current repair inputs lack settled graph and document custody", 1, { reason, effect: "no_effect" });
+}
+/** SQL-only graph selection. This record is not a current-view/start owner. */
+export function selectMemoryRepairGraph(context, registration, workId, phase, retainedStates) {
+    if (!isRegistration(registration))
+        refuse("registered_corrections_required");
+    if (phase !== "created" && phase !== "running")
+        refuse("invalid_graph_phase");
+    registration.assertCustody(context);
+    const receipt = registration.receipt(), batch = registration.batch();
+    const target = batch.works.find(item => receipt.work_ids[item.key] === workId);
+    if (!target)
+        refuse("foreign_repair_work");
+    const generation = assertRunMutationAllowed(context, receipt.scope.project_id, receipt.run_id);
+    const states = batch.works.map((item, index) => {
+        const id = receipt.work_ids[item.key];
+        const row = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [receipt.scope.project_id, receipt.run_id, id]);
+        if (!row)
+            refuse("missing_registered_work");
+        const retained = retainedStates?.[index];
+        if (retainedStates && (!retained || retained.key !== item.key || retained.work_id !== id || !["created", "running", "paused", "completed", "failed", "cancelled"].includes(retained.status)))
+            refuse("retained_graph_changed");
+        return { key: item.key, work_id: id, status: retained?.status ?? row.status };
+    });
+    if (retainedStates && retainedStates.length !== states.length)
+        refuse("retained_graph_changed");
+    if (states.find(item => item.work_id === workId)?.status !== phase)
+        refuse(phase === "created" ? "unstarted_target_required" : "running_target_required");
+    const completed = new Set(states.filter(item => item.status === "completed").map(item => item.key));
+    for (const item of batch.works) {
+        if ((item.key === target.key || completed.has(item.key)) && item.depends_on.some(key => !completed.has(key)))
+            refuse("unsettled_dependency");
+    }
+    const ids = new Set(states.filter(item => item.status === "completed").map(item => item.work_id));
+    if (!ids.size) {
+        if (phase === "created")
+            refuse("settled_history_required");
+        return { generation, states, settlements: [], target };
+    }
+    const rows = context.db.all(`SELECT a.id,json_extract(a.payload_json,'$.work_id') AS work_id FROM audit_events a JOIN works w ON w.work_id=json_extract(a.payload_json,'$.work_id') AND w.project_id=a.project_id AND w.run_id=json_extract(a.payload_json,'$.run_id') WHERE a.project_id=? AND a.event_type='memory.repair_work_settlement' AND w.run_id=? AND w.parent_work_id=? AND w.work_id IN (${[...ids].map(() => "?").join(",")}) ORDER BY a.id LIMIT 257`, [receipt.scope.project_id, receipt.run_id, receipt.scope.parent_work_id, ...ids]);
+    const settlements = rows.filter(row => ids.has(row.work_id));
+    if (rows.length > 256 || !settlements.length || settlements.length !== ids.size || new Set(settlements.map(item => item.work_id)).size !== ids.size)
+        refuse("settled_history_required");
+    return { generation, states, settlements, target };
+}
+function selection(context, registration, workId, retainedStates) {
+    return selectMemoryRepairGraph(context, registration, workId, "created", retainedStates);
+}
+function registered(context, registration, workId) {
+    const scope = registration.receipt().scope;
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? LIMIT 2", [scope.project_id, event, scope.run_id, workId]);
+    if (!rows.length)
+        return null;
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 40 * 1024 * 1024)
+        refuse("ambiguous_or_unbounded_view_receipt");
+    try {
+        const value = JSON.parse(rows[0].payload_json);
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            refuse("invalid_view_receipt");
+        return value;
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return refuse("invalid_view_receipt");
+    }
+}
+/** SQL-only retained selection. A returned record is not prepared authority;
+ * consumers must check their independent baseline/start/receipt binding.
+ */
+export function readMemoryRepairCurrentViewReceipt(context, registration, workId) {
+    registration.assertCustody(context);
+    const value = registered(context, registration, workId);
+    if (!value)
+        refuse("registered_view_required");
+    return structuredClone(value);
+}
+function retainedBytes(value) {
+    if (typeof value !== "string" || value.length > Math.ceil(8 * 1024 * 1024 / 3) * 4)
+        refuse("unbounded_view_bytes");
+    const bytes = Buffer.from(value, "base64");
+    if (bytes.length > 8 * 1024 * 1024 || bytes.toString("base64") !== value)
+        refuse("changed_view_bytes");
+    return bytes;
+}
+function compose(histories, paths, registration) {
+    let baseline = (PreparedRetainedSecondMemoryRepairs.isPrepared(registration)
+        ? registration.initialDocumentBaseline() : histories[0].before()).withWritePaths(paths);
+    const versions = new Set([hybridDigest(baseline.entries())]);
+    for (const history of histories) {
+        if (!versions.has(hybridDigest(history.before().entries())))
+            refuse("unexplained_historical_input_view");
+        baseline = baseline.composeSettledDelta(history.before(), history.after());
+        versions.add(hybridDigest(baseline.entries()));
+    }
+    return baseline;
+}
+/** Current-view preparation/restoration is read-only. Explicit registration
+ * owns only the bounded view audit, never a provider, copy or shared document.
+ * Registering a baseline and binding its launch/publication remain separate
+ * operations; this owner cannot bypass them.
+ */
+export class PreparedMemoryRepairCurrentView {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #selection in value;
+    }
+    sha256;
+    workId;
+    #registration;
+    #selection;
+    #histories;
+    #baseline;
+    #exported;
+    #workspace;
+    #input;
+    #registered = false;
+    constructor(key, registration, workId, selected, histories, baseline, exported, workspace, input) {
+        if (key !== token)
+            refuse("current_view_token_required");
+        this.#registration = registration;
+        this.workId = workId;
+        this.#selection = structuredClone(selected);
+        this.#histories = histories;
+        this.#baseline = baseline;
+        this.#exported = exported;
+        this.#workspace = workspace;
+        this.#input = structuredClone(input);
+        this.sha256 = hybridDigest({ registration: registration.sha256, work_id: workId, selected, histories: histories.map(item => item.sha256),
+            baseline_sha256: baseline.sha256, exported_sha256: exported.sha256, workspace_sha256: workspace.sha256, input });
+        Object.freeze(this);
+    }
+    static prepare(context, registration, workId) {
+        if (!isRegistration(registration))
+            refuse("registered_corrections_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        const selected = context.db.readSnapshot(() => selection(context, registration, workId));
+        const histories = selected.settlements.map(item => PreparedSettledMemoryRepair.prepare(context, registration, item.work_id));
+        const paths = selected.target.payload.memory_repair.write_paths;
+        const baseline = compose(histories, paths, registration);
+        const view = inputView(registration);
+        const workspaceRoot = bundle(registration).execution.snapshot().scope.workspace;
+        const input = { base: view.base, explicit_inputs: view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path) };
+        baseline.revalidate(workspaceRoot);
+        const candidates = reviewSourcePaths(workspaceRoot, input.explicit_inputs, input.base);
+        if (!candidates)
+            refuse("source_inventory_unavailable");
+        const available = new Set(baseline.entries().filter(entry => entry.kind === "file").map(entry => entry.path));
+        const exported = baseline.exported(candidates.filter(logical => logical.startsWith(".memory-bank/") && available.has(logical)));
+        const workspace = PreparedMemoryRepairWorkspace.capture(workspaceRoot, input, exported);
+        const nonMemorySha256 = hybridDigest(workspace.entries().filter(nonMemory));
+        for (const history of histories) {
+            if (hybridDigest(history.workspaceManifest().entries().filter(nonMemory)) !== nonMemorySha256)
+                refuse("non_memory_source_changed");
+        }
+        const copyInput = { ...input, source_sha256: reviewSourceHash(workspaceRoot, input.explicit_inputs, input.base) };
+        const prepared = new PreparedMemoryRepairCurrentView(token, registration, workId, selected, histories, baseline, exported, workspace, copyInput);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    /** Restore admitted bytes and graph evidence, not today's documents. A
+     * later caller must separately establish launch/Session/publication scope.
+     */
+    static restore(context, registration, workId) {
+        if (!isRegistration(registration))
+            refuse("registered_corrections_required");
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        registration.assertCustody(context);
+        const value = registered(context, registration, workId);
+        if (!value)
+            refuse("registered_view_required");
+        const rawSelection = value.selected;
+        if (!rawSelection || !Array.isArray(rawSelection.states))
+            refuse("invalid_view_receipt");
+        const selected = context.db.readSnapshot(() => selection(context, registration, workId, rawSelection.states));
+        if (hybridDigest(selected) !== hybridDigest(rawSelection))
+            refuse("retained_graph_changed");
+        const histories = selected.settlements.map(item => PreparedSettledMemoryRepair.prepare(context, registration, item.work_id));
+        const baseline = MemoryRepairDocumentBaseline.restore(retainedBytes(value.baseline_base64), value.baseline_sha256);
+        if (compose(histories, selected.target.payload.memory_repair.write_paths, registration).sha256 !== baseline.sha256)
+            refuse("retained_document_view_changed");
+        const exported = MemoryRepairDocumentBaseline.restore(retainedBytes(value.exported_baseline_base64), value.exported_baseline_sha256);
+        if (baseline.exported(exported.entries().filter(entry => entry.kind === "file").map(entry => entry.path)).sha256 !== exported.sha256)
+            refuse("retained_export_changed");
+        const workspace = PreparedMemoryRepairWorkspace.restore(retainedBytes(value.workspace_manifest_base64), value.workspace_manifest_sha256, exported);
+        const view = inputView(registration);
+        const input = value.input;
+        if (!input || typeof input.source_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(input.source_sha256)
+            || input.base !== view.base || hybridDigest(input.explicit_inputs) !== hybridDigest(view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path)))
+            refuse("retained_source_input_changed");
+        const nonMemorySha256 = hybridDigest(workspace.entries().filter(nonMemory));
+        if (histories.some(history => hybridDigest(history.workspaceManifest().entries().filter(nonMemory)) !== nonMemorySha256))
+            refuse("retained_non_memory_changed");
+        const prepared = new PreparedMemoryRepairCurrentView(token, registration, workId, selected, histories, baseline, exported, workspace, input);
+        if (hybridDigest(prepared.receipt()) !== hybridDigest(value))
+            refuse("registered_view_changed");
+        prepared.#registered = true;
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    receipt() {
+        const scope = this.#registration.receipt().scope;
+        const receipt = { schema_id: "dd-flow/memory-repair-current-view@1", project_id: scope.project_id, run_id: scope.run_id,
+            work_id: this.workId, generation: this.#selection.generation, registration_sha256: this.#registration.sha256,
+            view_sha256: this.sha256, selected: structuredClone(this.#selection),
+            histories: this.#histories.map(history => ({ work_id: history.workId, sha256: history.sha256 })), input: this.copyInput(),
+            baseline_sha256: this.#baseline.sha256, baseline_base64: this.#baseline.bytes().toString("base64"),
+            exported_baseline_sha256: this.#exported.sha256, exported_baseline_base64: this.#exported.bytes().toString("base64"),
+            workspace_manifest_sha256: this.#workspace.sha256, workspace_manifest_base64: this.#workspace.bytes().toString("base64") };
+        if (Buffer.byteLength(JSON.stringify(receipt)) > 40 * 1024 * 1024)
+            refuse("unbounded_view_receipt");
+        return receipt;
+    }
+    register(context) {
+        this.revalidate(context);
+        const receipt = this.receipt(), expected = hybridDigest(receipt);
+        const result = context.db.writeTransaction(() => {
+            if (!context.db.isOwnedWriteTransaction?.())
+                refuse("owned_view_writer_required");
+            this.assertCustody(context);
+            if (!context.db.get("SELECT 1 FROM works WHERE project_id=? AND run_id=? AND work_id=? AND status='created'", [receipt.project_id, receipt.run_id, this.workId])
+                || context.db.get("SELECT 1 FROM work_sessions WHERE work_id=? LIMIT 1", [this.workId])
+                || (context.db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name='work_launches'")
+                    && context.db.get("SELECT 1 FROM work_launches WHERE work_id=? LIMIT 1", [this.workId])))
+                refuse("unstarted_target_required");
+            const prior = registered(context, this.#registration, this.workId);
+            if (prior && hybridDigest(prior) !== expected)
+                refuse("registered_view_changed");
+            if (!prior)
+                appendAudit(context, { projectId: receipt.project_id, eventType: event, payload: receipt });
+            if (hybridDigest(registered(context, this.#registration, this.workId)) !== expected)
+                refuse("view_receipt_readback_failed");
+            return { work_id: this.workId, view_sha256: this.sha256, receipt_sha256: expected, replayed: Boolean(prior) };
+        });
+        this.#registered = true;
+        try {
+            this.revalidate(context);
+        }
+        catch (error) {
+            throw new AppError("memory_repair_current_view_pending", "Current view committed but custody changed before baseline consumption", 1, { effect: "committed", view_sha256: this.sha256, cause: error instanceof Error ? error.message : String(error) });
+        }
+        return result;
+    }
+    baseline() { return this.#baseline; }
+    exportedBaseline() { return this.#exported; }
+    workspaceManifest() { return this.#workspace; }
+    copyInput() { return structuredClone(this.#input); }
+    assertCustody(context) {
+        if (hybridDigest(selection(context, this.#registration, this.workId, this.#registered ? this.#selection.states : undefined)) !== hybridDigest(this.#selection))
+            refuse("current_view_graph_changed");
+        for (const history of this.#histories)
+            history.assertCustody(context);
+        if (this.#registered && hybridDigest(registered(context, this.#registration, this.workId)) !== hybridDigest(this.receipt()))
+            refuse("registered_view_changed");
+    }
+    revalidate(context) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        this.assertCustody(context);
+        const root = bundle(this.#registration).execution.snapshot().scope.workspace;
+        this.#baseline.revalidate(root);
+        const view = inputView(this.#registration);
+        const fresh = PreparedMemoryRepairWorkspace.capture(root, { base: view.base,
+            explicit_inputs: view.run_inputs.filter(ref => ref.root === "workspace").map(ref => ref.path) }, this.#exported);
+        if (fresh.sha256 !== this.#workspace.sha256)
+            refuse("selected_source_inventory_changed");
+        if (reviewSourceHash(root, this.#input.explicit_inputs, this.#input.base) !== this.#input.source_sha256)
+            refuse("selected_source_hash_changed");
+        for (const history of this.#histories)
+            history.revalidate(context);
+        this.assertCustody(context);
+    }
+}