@dougharness/cli 1.1.0 → 1.1.1

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -93,6 +93,7 @@ import { contextReading, recordAgentContext } from "../lib/agent-context.mjs";
 import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiverCovers } from "../lib/test-totals.mjs";
 import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine } from "../lib/block-ledger.mjs";
 import { docsGateDecision } from "../lib/docs-gate.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable } from "../lib/verified-tree.mjs";
 
 // Only the last this many characters of last_assistant_message are ever scanned for a partial claim
@@ -511,7 +512,8 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
 // card worktree-agent-gate, card worktree-gate-mixed-tree-agent: the trees a SubagentStop verifies, in
 // first-touched order. A worktree-isolated subagent edits under <dir>/.claude/worktrees/<wt>/ (input.cwd inside
 // it, or its own successful Edit-type trace lines carry absolute paths there); a path inside <dir> but outside
-// .claude/worktrees names the main checkout; any other path names nothing. The set is the cwd's worktree plus
+// .claude/worktrees names the main checkout, except <dir>/.doug/.state and anything under it (untracked state,
+// never project code) which names nothing; any other path names nothing. The set is the cwd's worktree plus
 // every tree its trace paths name (a worktree that no longer exists as a directory is skipped). Empty, a main
 // Stop, or any failure resolves to [dir]. Only the verification target varies per tree: state, trace,
 // gate.lock, the ledger, and evidence stay under `dir`. Never throws.
@@ -527,8 +529,11 @@ function verifyDirs(dir, cfg, sessionId, input, subagent) {
     };
     const inMain = (p) => {
       if (typeof p !== "string" || !isAbsolute(p)) return false;
-      const rel = relative(dir, resolve(p));
-      return !!rel && !rel.startsWith("..") && !isAbsolute(rel);
+      const abs = resolve(p);
+      const rel = relative(dir, abs);
+      if (!rel || rel.startsWith("..") || isAbsolute(rel)) return false;
+      const st = relative(join(dir, ".doug/.state"), abs);
+      return !(st === "" || (!st.startsWith("..") && !isAbsolute(st)));
     };
     const trees = [];
     const add = (t) => {
@@ -967,70 +972,6 @@ function verifiedUnchangedAllow(dir, cfg, state, input, subagent, capNote) {
   return notice ? systemMessage(notice) : allow();
 }
 
-// Single-runner lock (card stop-gate-process-storm, goal 3): only one gate runs the verification commands
-// at a time per project, so concurrent SubagentStops share one suite instead of each starting its own (the
-// 2026-09-16 process storm). `.doug/.state/gate.lock` holds `{ pid, session, at }` while a gate's commands
-// run.
-const GATE_LOCK_RELPATH = ".doug/.state/gate.lock";
-function gateLockPath(dir) {
-  return join(dir, GATE_LOCK_RELPATH);
-}
-
-// Reads gate.lock, tolerating garbage (a hook reader must never throw): a missing file, unreadable file, or
-// content that fails to parse or carries no numeric pid all read as null — the same as "no lock", which the
-// caller treats exactly like a stale one.
-function readGateLock(dir) {
-  try {
-    const o = JSON.parse(readFileSync(gateLockPath(dir), "utf8"));
-    // A pid only counts when it is a positive integer (reviewer-found gap): 0 means "this process's own
-    // group" and -1 broadcasts to every process the caller may signal, so process.kill(pid, 0) does not
-    // throw for either and a liveness check that hands them straight to it reads a garbage lock as live.
-    return o && typeof o === "object" && Number.isInteger(o.pid) && o.pid > 0 ? o : null;
-  } catch {
-    return null;
-  }
-}
-
-function pidIsLive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    // EPERM means the pid exists but is owned by another user (permission denied, not "no such process") —
-    // that holder is still alive, just not signallable by us. Every other error (ESRCH: no such process, or
-    // anything else) reads as dead.
-    return err && err.code === "EPERM";
-  }
-}
-
-// Creates gate.lock exclusively (throws EEXIST when one is already there, or any other fs error). The
-// caller decides what a failure means.
-function writeGateLock(dir, sessionId) {
-  mkdirSync(join(dir, ".doug/.state"), { recursive: true });
-  writeFileSync(gateLockPath(dir), JSON.stringify({ pid: process.pid, session: sessionId, at: Date.now() }), { flag: "wx" });
-}
-
-// Overwrites gate.lock with this gate's own pid/session, whether it was stale (a dead pid) or its holder
-// simply never let go inside the wait bound — either way, never lets a lock the gate cannot even write hang
-// it (best-effort; a failure here just leaves lockOwned false to the caller, which never releases a lock it
-// does not hold).
-function takeOverGateLock(dir, sessionId) {
-  try {
-    mkdirSync(join(dir, ".doug/.state"), { recursive: true });
-    writeFileSync(gateLockPath(dir), JSON.stringify({ pid: process.pid, session: sessionId, at: Date.now() }));
-  } catch {
-    // best-effort takeover only
-  }
-}
-
-// Card stop-gate-budget-under-hook-timeout: cfg.stopGate.hookTimeoutSec must equal the platform's own
-// Stop/SubagentStop hook `timeout` (hooks.json/settings.json), but a hook reader never throws (F6), so a
-// missing, non-number, or non-positive value reads as the platform's own default, 600.
-function resolveHookTimeoutSec(cfg) {
-  const sec = cfg && cfg.stopGate && cfg.stopGate.hookTimeoutSec;
-  return typeof sec === "number" && Number.isFinite(sec) && sec > 0 ? sec : 600;
-}
-
 // Computed once per gate run: the wall-clock instant past which the platform itself would cancel this
 // hook (F1 — a timed-out hook is killed, fails open, and its output, including a block message, is
 // discarded), less a margin so the gate's own block reaches Claude Code before that happens. gateStart
@@ -1049,26 +990,8 @@ function gateBudget(cfg, inherited) {
   return { hookTimeoutSec, hookTimeoutMs, deadline };
 }
 
-// A lock whose numeric `at` is older than the hook-timeout budget is stale regardless of a live pid: no
-// legitimate holder can still be running that long, since the platform itself would have killed its hook
-// by then (F1). A missing or non-numeric `at` changes nothing here; the pid liveness check still decides.
-function lockStaleByAge(lock, hookTimeoutMs) {
-  return !!lock && typeof lock.at === "number" && Number.isFinite(lock.at) && Date.now() - lock.at > hookTimeoutMs;
-}
-
-// Card stop-gate-timeout-normalise: cfg.stopGate.timeoutMs normalised once, shared by the per-command timeout
-// and the wait bound below, so the two never disagree on what a garbage or fractional value means. A finite
-// number above 0 floors to an integer, clamped up to at least 1ms (0.5 must not floor to 0 — spawnSync reads a
-// timeout of 0 as none at all, letting a command run past the budget unclamped; 2.5 must not reach spawnSync
-// un-floored — it throws ERR_OUT_OF_RANGE there, and a hook reader must never throw, F6). Anything else
-// (non-number, NaN, Infinity, 0, negative, null) is "unset" (null), read by each call site as its own default.
-function normalizedTimeoutMs(cfg) {
-  const t = cfg.stopGate.timeoutMs;
-  return typeof t === "number" && Number.isFinite(t) && t > 0 ? Math.max(1, Math.floor(t)) : null;
-}
-
 // Card stop-gate-deferral-cap (R2): cfg.stopGate.maxDeferrals normalised the same shape as
-// normalizedTimeoutMs above — a hook reader must never throw (F6/F10), so a finite number >= 1 is floored
+// normalizedTimeoutMs (lib/gate-lock.mjs) — a hook reader must never throw (F6/F10), so a finite number >= 1 is floored
 // and used; anything else (missing, 0, negative, NaN, a string, null, an object) reads as the default, 10.
 function normalizedMaxDeferrals(cfg) {
   const m = cfg && cfg.stopGate && cfg.stopGate.maxDeferrals;
@@ -1709,7 +1632,7 @@ runHook("stop-gate", async (input) => {
           // timeoutMs no longer defaults to a flat 300000ms here — the budget deadline below is the real bound
           // either way, so an unset value waits only for what remains of it, unmultiplied.
           const normalizedTimeout = normalizedTimeoutMs(cfg);
-          const waitBoundMs = normalizedTimeout !== null ? normalizedTimeout * Math.max(1, resolveCommands(cfg).length) : budgetDeadline - Date.now();
+          const waitBoundMs = normalizedTimeout !== null ? lockWaitBoundMs(normalizedTimeout, resolveCommands(cfg).length) : budgetDeadline - Date.now();
           const waitDeadline = Date.now() + waitBoundMs;
           // Card stop-gate-budget-under-hook-timeout: waitDeadline alone can outrun the platform's own hook
           // timeout (F1), so a waiter also stops at budgetDeadline — but there it refuses the stop instead of

package/node_modules/@dougharness/gates/scripts/verify.mjs

@@ -4,11 +4,13 @@
 //   node .doug/hooks/scripts/verify.mjs [--no-credit] [--json] [--dir <project>] [--cwd <tree dir>] [--timeout-ms <n>]
 //     [--record-dir <dir>] [--credit-dir <dir>]... [--by <writer>] [--command <cmd>]...
 // Exit: 0 all green or credited; 1 any command failed or timed out; 2 usage error or no commands.
-// No count ratchet and no scans here (no session baseline); the Stop gate does those. Takes no gate.lock.
+// No count ratchet and no scans here (no session baseline); the Stop gate does those. Takes the Stop gate's .doug/.state/gate.lock around the commands (card verify-takes-gate-lock).
 
 import { spawnSync } from "node:child_process";
+import { unlinkSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadConfig } from "../lib/config.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { runCommand, tail } from "../lib/run.mjs";
 import { parseTotals, readSummaries, sumTotals } from "../lib/test-totals.mjs";
 import { computeTree, readRecord, writeRecord, removeRecord, creditable, resolveCommands } from "../lib/verified-tree.mjs";
@@ -75,8 +77,10 @@ function main() {
     process.stderr.write("[doug] verify: no commands (stopGate.commands is empty and no --command given)\n");
     return 2;
   }
-  const treeBefore = computeTree(cwd);
+  let treeBefore = computeTree(cwd);
 
+  // Credits a verified-tree record of the same tree when one exists; returns the exit code, or null.
+  const tryCredit = () => {
   if (!o.noCredit && treeBefore) {
     const wanted = commands.map((c) => c.command);
     let record = null;
@@ -102,8 +106,59 @@ function main() {
       return 0;
     }
   }
+  return null;
+  };
+  const first = tryCredit();
+  if (first !== null) return first;
 
-  const timeoutMs = o.timeoutMs ? o.timeoutMs : Number.isInteger(cfg.stopGate && cfg.stopGate.timeoutMs) && cfg.stopGate.timeoutMs > 0 ? cfg.stopGate.timeoutMs : 600000;
+  const timeoutMs = o.timeoutMs ? o.timeoutMs : (cfg.stopGate && normalizedTimeoutMs(cfg)) ?? 600000;
+  const waitBoundMs = lockWaitBoundMs(timeoutMs, commands.length);
+
+  // Card verify-takes-gate-lock: one full suite at a time per checkout, the same gate.lock the Stop gate takes
+  // (lib/gate-lock.mjs). A live holder is waited on for up to timeoutMs x command count (the Stop gate's bound), then the record is re-checked (the
+  // holder's green run may have just written it); a lock still held after the bound is taken over and the
+  // commands run. Released only by the exit handler below, so every return path (green, red, throw) frees it.
+  let lockOwned = false;
+  process.on("exit", () => {
+    try {
+      if (!lockOwned) return;
+      const lock = readGateLock(dir);
+      if (lock && lock.pid === process.pid) unlinkSync(gateLockPath(dir));
+    } catch {
+      // never throw from an exit handler
+    }
+  });
+  try {
+    writeGateLock(dir, o.by || "verify");
+    lockOwned = true;
+  } catch (err) {
+    if (!err || err.code !== "EEXIST") {
+      lockOwned = false; // an unwritable .doug/.state: run unlocked rather than hang
+    } else {
+      const hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
+      const stale = (l) => !l || !pidIsLive(l.pid) || lockStaleByAge(l, hookTimeoutMs);
+      const held = readGateLock(dir);
+      if (stale(held)) {
+        takeOverGateLock(dir, o.by || "verify");
+        lockOwned = true;
+      } else {
+        const deadline = Date.now() + waitBoundMs;
+        let live = held;
+        const nap = new Int32Array(new SharedArrayBuffer(4));
+        while (true) {
+          live = readGateLock(dir);
+          if (stale(live) || Date.now() >= deadline) break;
+          Atomics.wait(nap, 0, 0, 200);
+        }
+        treeBefore = computeTree(cwd);
+        const again = tryCredit();
+        if (again !== null) return again;
+        if (!stale(live)) process.stderr.write(`[doug] verify: gate.lock still held by pid ${live.pid} after ${waitBoundMs} ms; running the commands anyway.\n`);
+        takeOverGateLock(dir, o.by || "verify");
+        lockOwned = true;
+      }
+    }
+  }
   const results = [];
   const recCommands = [];
   const totals = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "doug: tailored, approval-gated harness install for Claude Code.",
   "type": "module",
   "license": "MIT",
@@ -13,7 +13,7 @@
     "access": "public"
   },
   "bin": {
-    "doug": "./dist/bin.js"
+    "doug": "dist/bin.js"
   },
   "files": [
     "dist",
@@ -23,8 +23,8 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@dougharness/flow": "1.1.0",
-    "@dougharness/gates": "1.1.0"
+    "@dougharness/flow": "1.1.1",
+    "@dougharness/gates": "1.1.1"
   },
   "bundleDependencies": [
     "@dougharness/flow",

package/templates/board-app.js

@@ -339,7 +339,8 @@ function app() {
       });
       if (res.status === 200) {
         board = await res.json();
-        say("Saved to " + config.record + ".");
+        const warning = res.headers.get("x-doug-warning");
+        say("Saved to " + config.record + "." + (warning ? " " + warning : ""));
       } else {
         let message = "The move was rejected (" + res.status + ").";
         try { const body = await res.json(); if (body && body.error) message = body.error; } catch (_) {}