@dzhechkov/harness-core 0.7.5 → 0.7.7

package/src/tg-post.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 /**
  * `dz tg-post` — the pure half: validate an approved draft against what Telegram will accept and
  * what the channel's own accepted design demands.
@@ -103,13 +104,41 @@ export interface TgSendDecision {
  * intention; without it the refusal names the local MSK time it computed, so the operator can check
  * the arithmetic instead of trusting it.
  */
+/**
+ * The dedup key for a post: sha256 of its VISIBLE text (markup stripped). Two drafts that render
+ * identically in Telegram are the same post even if their HTML differs by a whitespace — the key
+ * must be about what the reader sees, not the bytes (G5, ADR-005).
+ */
+export function tgVisibleSha256(html: string): string {
+  const visible = html.replace(/<[^>]*>/g, '').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
+  return createHash('sha256').update(visible.trim(), 'utf-8').digest('hex');
+}
+
+/** One recorded send. sha256 is the visible-text key; ts is ISO. */
+/** One journal line. status: 'pending' written BEFORE the send (crash-window guard), 'sent' after
+ *  Telegram accepts. A legacy line with no status is treated as 'sent'. */
+export interface TgSentRecord { readonly sha256: string; readonly ts: string; readonly status?: 'pending' | 'sent' }
+
 export function decideTgSend(input: {
   readonly issues: readonly TgHtmlIssue[];
   readonly provenanceOutcome: 'allowed' | 'blocked' | 'not-established' | 'skipped';
   readonly confirmed: boolean;
   readonly nowUtcIso: string;
   readonly nightOverride: boolean;
+  /** G6 stop-cord: a `.dz/tg-post/HALT` file exists. Checked FIRST, before anything else. */
+  readonly halted?: boolean;
+  /** sha256 of THIS post's visible text (tgVisibleSha256) — the G5 dedup key. */
+  readonly sha256?: string;
+  /** The send journal as FACTS (the pure half never reads a file). Undefined ⇒ log unreadable. */
+  readonly sentLog?: readonly TgSentRecord[] | undefined;
+  /** G4 ceiling; default 10 (ADR-003). Sends in the trailing 24h are counted against it. */
+  readonly maxPostsPerDay?: number;
 }): TgSendDecision {
+  // G6 (ADR-001 fail-closed-guard-order): the stop-cord is ABSOLUTE and FIRST — it halts even a
+  // perfect post, before any cheaper check, so no bug in a later gate can route around it.
+  if (input.halted === true) {
+    return { action: 'refuse', reason: 'STOP-CORD engaged (.dz/tg-post/HALT exists) — nothing is published while it is present; remove the file to resume' };
+  }
   if (input.issues.length > 0) {
     return { action: 'refuse', reason: `${input.issues.length} formatting issue(s) — Telegram would refuse or mangle this draft` };
   }
@@ -133,5 +162,31 @@ export function decideTgSend(input: {
       return { action: 'refuse', reason: `it is ${String(mskHour).padStart(2, '0')}:xx MSK — the channel posts nothing between 00:00 and 06:00 MSK (ADR-003). Pass --night if this is deliberate` };
     }
   }
-  return { action: 'send', reason: 'formatted, provenance-cleared, confirmed, and inside posting hours' };
+  // G4/G5 need the journal. An UNREADABLE journal (sentLog undefined) is fail-closed: an unreadable
+  // limit counter does not prove the limit is unreached (Step-0 recall — never invert fail-closed on
+  // an absent/degraded input).
+  if (input.sentLog === undefined) {
+    return { action: 'refuse', reason: 'the send journal could not be read — an unreadable limit/dedup counter cannot show the ceiling is unreached; refusing (fail-closed)' };
+  }
+  // G5 dedup: this exact visible-text post already went out.
+  // G5 dedup covers BOTH a completed send AND an in-flight PENDING record of the same visible text
+  // (Codex A- two-phase): a pending row means a prior attempt reached the send path — do not
+  // double-publish. A stuck pending is surfaced (the CLI warns) and cleared by removing its line.
+  if (input.sha256 !== undefined && input.sentLog.some((r) => r.sha256 === input.sha256)) {
+    const prior = input.sentLog.find((r) => r.sha256 === input.sha256);
+    return { action: 'refuse', reason: (prior && prior.status === 'pending')
+      ? 'a PENDING send of this exact post exists (a prior attempt reached the send path) — refusing to double-publish; if that attempt truly failed, remove its line from .dz/tg-post/sent-log.jsonl and retry'
+      : 'this exact post (by visible text) has already been sent — refusing a duplicate' };
+  }
+  // G4 daily limit: sends in the trailing 24h against the ceiling.
+  const nowMs = Date.parse(input.nowUtcIso);
+  const cutoff = Number.isFinite(nowMs) ? nowMs - 24 * 3600_000 : -Infinity;
+  // Only ACCEPTED sends count against the daily limit — a pending row may never have landed, so it
+  // must not eat the ceiling (mirror of 'record after'): status 'pending' is excluded, 'sent'/legacy counted.
+  const inWindow = input.sentLog.filter((r) => { const t = Date.parse(r.ts); return Number.isFinite(t) && t >= cutoff && r.status !== 'pending'; }).length;
+  const ceiling = typeof input.maxPostsPerDay === 'number' && input.maxPostsPerDay > 0 ? Math.floor(input.maxPostsPerDay) : 10;
+  if (inWindow >= ceiling) {
+    return { action: 'refuse', reason: `daily limit reached: ${inWindow} post(s) sent in the last 24h, ceiling ${ceiling} (ADR-003) — the channel does not exceed its own tempo` };
+  }
+  return { action: 'send', reason: 'stop-cord clear, formatted, provenance-cleared, confirmed, inside hours, not a duplicate, under the daily limit' };
 }