@geminixiang/mikan 1.0.0-beta.53 → 1.0.0-beta.55

package/dist/office/index.js

@@ -11,7 +11,7 @@ import * as log from "../log.js";
 import { parseGithubConversationId } from "../adapters/github/ids.js";
 import { legacyConversationCredentialKey } from "../sandbox/identity.js";
 import { migrateConversationVaultKeys } from "../vault/index.js";
-import { atomicWritePrivateFile, isRecord, readTextFileIfExists } from "../utils/file-guards.js";
+import { atomicWritePrivateFile, isRecord, readTextFileIfExists } from "../file-guards.js";
 // ── Office identity (address & keys) ──────────────────────────────────────────
 const OFFICE_KEY_VERSION = "v1";
 const OFFICE_KEY_DOMAIN = "office-address-v1";
@@ -47,20 +47,18 @@ export function assertPlatformName(value) {
         throw new Error(`Unsupported platform: ${JSON.stringify(value)}`);
     return value;
 }
+/** Path separators and the C0/C1 control ranges are never allowed in an id. */
+function isUnsafeConversationIdChar(character) {
+    const code = character.codePointAt(0) ?? 0;
+    return character === "/" || character === "\\" || code <= 0x1f || (code >= 0x7f && code <= 0x9f);
+}
 /** Validate a raw platform conversation identifier before it enters storage. */
 export function assertConversationId(value) {
     if (value.length === 0 || value === "." || value === "..") {
         throw new Error("Conversation id must be non-empty and not a path marker");
     }
-    for (const character of value) {
-        const code = character.codePointAt(0) ?? 0;
-        if (character === "/" ||
-            character === "\\" ||
-            code === 0 ||
-            code <= 0x1f ||
-            (code >= 0x7f && code <= 0x9f)) {
-            throw new Error("Conversation id must not contain path separators or control characters");
-        }
+    if ([...value].some(isUnsafeConversationIdChar)) {
+        throw new Error("Conversation id must not contain path separators or control characters");
     }
     return value;
 }
@@ -85,9 +83,8 @@ export function officeDir(workspaceRoot, address) {
 /**
  * Resolve the host-only state directory for an office.
  *
- * Transitional: settings/package callers that only hold a
- * `stateDir` string keep using this until their option bags carry an
- * `Office` value (which exposes the same path as `stateDir`).
+ * Settings and migration callers that only hold a `stateDir` string use this
+ * when no materialized `Office` value is available.
  */
 export function officeStateDir(stateDir, address) {
     return join(stateDir, "conversations", officeKey(address));
@@ -552,14 +549,16 @@ function parseOfficeRecord(value, path) {
         recordedAt: value.recordedAt,
     });
 }
-function parseRecord(value, path, enabledPlatforms) {
-    if (!isRecord(value))
-        throw new Error(`Invalid office migration record in ${path}`);
-    if (typeof value.rawConversationId !== "string" ||
-        typeof value.sourceDir !== "string" ||
-        typeof value.workspaceRoot !== "string" ||
-        typeof value.status !== "string" ||
-        typeof value.updatedAt !== "string") {
+function hasMigrationStrings(value) {
+    return (typeof value.rawConversationId === "string" &&
+        typeof value.sourceDir === "string" &&
+        typeof value.workspaceRoot === "string" &&
+        typeof value.status === "string" &&
+        typeof value.updatedAt === "string");
+}
+/** Validate the fields every stored migration record must carry. */
+function parseMigrationFields(value, path) {
+    if (!hasMigrationStrings(value)) {
         throw new Error(`Invalid office migration fields in ${path}`);
     }
     assertConversationId(value.rawConversationId);
@@ -570,44 +569,66 @@ function parseRecord(value, path, enabledPlatforms) {
     if (!MIGRATION_STATUSES.has(value.status)) {
         throw new Error(`Invalid office migration status in ${path}`);
     }
-    const ownerPlatform = optionalPlatform(value.ownerPlatform);
-    const targetDir = optionalString(value.targetDir);
-    const error = optionalString(value.error);
-    if (ownerPlatform !== undefined && !enabledPlatforms.includes(ownerPlatform)) {
-        throw new Error(`Office migration owner is not enabled in ${path}`);
-    }
-    if (value.status === "needs-owner" && (ownerPlatform !== undefined || targetDir !== undefined)) {
+    return {
+        rawConversationId: value.rawConversationId,
+        sourceDir: value.sourceDir,
+        workspaceRoot: value.workspaceRoot,
+        status: value.status,
+        updatedAt: value.updatedAt,
+    };
+}
+/**
+ * Ownership rules by status: `needs-owner` must carry neither owner nor
+ * target, `failed` may carry either, every other status must carry both.
+ */
+function assertOwnershipMatchesStatus(status, ownerPlatform, targetDir, path) {
+    const owned = ownerPlatform !== undefined;
+    const targeted = targetDir !== undefined;
+    if (status === "needs-owner" && (owned || targeted)) {
         throw new Error(`Needs-owner migration cannot have an owner or target in ${path}`);
     }
-    if (value.status !== "needs-owner" &&
-        value.status !== "failed" &&
-        (ownerPlatform === undefined || targetDir === undefined)) {
+    if (status !== "needs-owner" && status !== "failed" && !(owned && targeted)) {
         throw new Error(`Prepared office migration is missing ownership in ${path}`);
     }
-    if (ownerPlatform === undefined && targetDir !== undefined) {
+    if (!owned && targeted) {
         throw new Error(`Office migration target has no owner in ${path}`);
     }
+}
+function parseRecord(value, path, enabledPlatforms) {
+    if (!isRecord(value))
+        throw new Error(`Invalid office migration record in ${path}`);
+    const fields = parseMigrationFields(value, path);
+    const ownerPlatform = optionalPlatform(value.ownerPlatform);
+    const targetDir = optionalString(value.targetDir);
+    const error = optionalString(value.error);
+    if (ownerPlatform !== undefined && !enabledPlatforms.includes(ownerPlatform)) {
+        throw new Error(`Office migration owner is not enabled in ${path}`);
+    }
+    assertOwnershipMatchesStatus(fields.status, ownerPlatform, targetDir, path);
     const expectedTargetDir = ownerPlatform
-        ? officeDir(value.workspaceRoot, {
+        ? officeDir(fields.workspaceRoot, {
             platform: ownerPlatform,
-            conversationId: value.rawConversationId,
+            conversationId: fields.rawConversationId,
         })
         : undefined;
     if (targetDir !== expectedTargetDir) {
         throw new Error(`Office migration target does not match its office address in ${path}`);
     }
-    if (value.status === "failed" && !error) {
+    if (fields.status === "failed" && !error) {
         throw new Error(`Failed office migration is missing an error in ${path}`);
     }
+    return buildMigrationRecord(fields, ownerPlatform, expectedTargetDir, error);
+}
+function buildMigrationRecord(fields, ownerPlatform, targetDir, error) {
     return makeRecord({
-        rawConversationId: value.rawConversationId,
-        sourceDir: value.sourceDir,
-        workspaceRoot: value.workspaceRoot,
+        rawConversationId: fields.rawConversationId,
+        sourceDir: fields.sourceDir,
+        workspaceRoot: fields.workspaceRoot,
         ...(ownerPlatform ? { ownerPlatform } : {}),
-        ...(expectedTargetDir ? { targetDir: expectedTargetDir } : {}),
-        status: value.status,
+        ...(targetDir ? { targetDir } : {}),
+        status: fields.status,
         ...(error ? { error } : {}),
-        updatedAt: value.updatedAt,
+        updatedAt: fields.updatedAt,
     });
 }
 function optionalPlatform(value) {
@@ -652,51 +673,44 @@ function assertRegularDirectory(path, label) {
         throw new Error(`${label} must be a regular directory: ${path}`);
     }
 }
-function assertRegistryFileSafe(path) {
+/** `lstat` that reports a missing path as undefined; other errors still throw. */
+function lstatIfExists(path) {
     try {
-        const stat = lstatSync(path);
-        if (stat.isSymbolicLink() || !stat.isFile()) {
-            throw new Error(`Office registry must be a regular file: ${path}`);
-        }
+        return lstatSync(path);
     }
     catch (error) {
         if (isErrno(error, "ENOENT"))
-            return;
+            return undefined;
         throw error;
     }
 }
-function assertPathIfPresent(path, label) {
-    try {
-        const stat = lstatSync(path);
-        if (stat.isSymbolicLink() || !stat.isDirectory()) {
-            throw new Error(`${label} must be a regular directory: ${path}`);
-        }
+function assertRegistryFileSafe(path) {
+    const stat = lstatIfExists(path);
+    if (stat && (stat.isSymbolicLink() || !stat.isFile())) {
+        throw new Error(`Office registry must be a regular file: ${path}`);
     }
-    catch (error) {
-        if (isErrno(error, "ENOENT"))
-            return;
-        throw error;
+}
+function assertPathIfPresent(path, label) {
+    const stat = lstatIfExists(path);
+    if (stat && (stat.isSymbolicLink() || !stat.isDirectory())) {
+        throw new Error(`${label} must be a regular directory: ${path}`);
     }
 }
 function assertPathAbsent(path, label) {
-    try {
-        lstatSync(path);
-    }
-    catch (error) {
-        if (isErrno(error, "ENOENT"))
-            return;
-        throw error;
-    }
-    throw new Error(`${label} must be absent: ${path}`);
+    if (lstatIfExists(path))
+        throw new Error(`${label} must be absent: ${path}`);
 }
 function pathExists(path) {
+    return lstatIfExists(path) !== undefined;
+}
+/** Create the lock directory and stamp it with our token, unwinding on failure. */
+function claimRegistryLock(lockPath, token) {
+    mkdirSync(lockPath, { mode: 0o700 });
     try {
-        lstatSync(path);
-        return true;
+        writeFileSync(join(lockPath, "owner"), `${token}\n`, { mode: 0o600 });
     }
     catch (error) {
-        if (isErrno(error, "ENOENT"))
-            return false;
+        rmSync(lockPath, { recursive: true, force: true });
         throw error;
     }
 }
@@ -705,30 +719,30 @@ function acquireRegistryLease(lockPath, timeoutMs) {
     const token = `${process.pid}:${randomBytes(8).toString("hex")}`;
     for (;;) {
         try {
-            mkdirSync(lockPath, { mode: 0o700 });
-            try {
-                writeFileSync(join(lockPath, "owner"), `${token}\n`, { mode: 0o600 });
-            }
-            catch (error) {
-                rmSync(lockPath, { recursive: true, force: true });
-                throw error;
-            }
+            claimRegistryLock(lockPath, token);
             return () => releaseRegistryLease(lockPath, token);
         }
         catch (error) {
-            if (!isErrno(error, "EEXIST"))
-                throw error;
-            if (registryLockIsStale(lockPath)) {
-                rmSync(lockPath, { recursive: true, force: true });
-                continue;
-            }
-            if (Date.now() >= deadline) {
-                throw new Error(`Timed out acquiring office registry lock: ${lockPath}`, { cause: error });
-            }
-            sleepSync(REGISTRY_LOCK_RETRY_MS);
+            awaitFreeRegistryLock(lockPath, deadline, error);
         }
     }
 }
+/**
+ * Handle one failed lock attempt: rethrow anything but a held lock, clear a
+ * stale lock so the next attempt wins, else wait until the deadline passes.
+ */
+function awaitFreeRegistryLock(lockPath, deadline, error) {
+    if (!isErrno(error, "EEXIST"))
+        throw error;
+    if (registryLockIsStale(lockPath)) {
+        rmSync(lockPath, { recursive: true, force: true });
+        return;
+    }
+    if (Date.now() >= deadline) {
+        throw new Error(`Timed out acquiring office registry lock: ${lockPath}`, { cause: error });
+    }
+    sleepSync(REGISTRY_LOCK_RETRY_MS);
+}
 function releaseRegistryLease(lockPath, token) {
     try {
         if (readFileSync(join(lockPath, "owner"), "utf8").trim() === token) {
@@ -866,41 +880,51 @@ function recoverInterruptedMoves(registry, summary) {
     for (const record of registry.getState().migrations) {
         if (record.status !== "moving")
             continue;
-        const targetDir = record.targetDir;
-        if (!targetDir) {
-            registry.markFailed(record.rawConversationId, "Moving record has no target directory");
-            continue;
-        }
-        const sourceExists = pathExists(record.sourceDir);
-        const targetExists = pathExists(targetDir);
-        if (sourceExists && targetExists) {
-            registry.markFailed(record.rawConversationId, "Both legacy source and office target exist; merge them manually");
-            continue;
-        }
-        if (!sourceExists && !targetExists) {
-            registry.markFailed(record.rawConversationId, "Neither legacy source nor office target exists");
+        const failure = finishInterruptedMove(record);
+        if (failure) {
+            registry.markFailed(record.rawConversationId, failure);
             continue;
         }
-        if (sourceExists)
-            renameSync(record.sourceDir, targetDir);
         registry.markCommitted(record.rawConversationId);
         recordMigratedOffice(registry, record);
         summary.recovered.push(record.rawConversationId);
         log.logInfo(`[office] Recovered interrupted migration: ${record.rawConversationId}`);
     }
 }
+/** Complete one interrupted rename; returns the failure reason when it cannot. */
+function finishInterruptedMove(record) {
+    const targetDir = record.targetDir;
+    if (!targetDir)
+        return "Moving record has no target directory";
+    const sourceExists = pathExists(record.sourceDir);
+    const targetExists = pathExists(targetDir);
+    if (sourceExists && targetExists) {
+        return "Both legacy source and office target exist; merge them manually";
+    }
+    if (!sourceExists && !targetExists)
+        return "Neither legacy source nor office target exists";
+    if (sourceExists)
+        renameSync(record.sourceDir, targetDir);
+    return undefined;
+}
+/**
+ * A legacy directory is claimable unless it already failed (reported via
+ * summary.failed). One that reappears after a committed move is a different
+ * (or resurrected) office the runtime can no longer see, so refusing to boot
+ * beats silently ignoring its data.
+ */
+function isClaimableLegacyDir(registry, workspaceRoot, rawConversationId) {
+    const existing = registry.getMigration(rawConversationId);
+    if (existing?.status === "committed") {
+        throw new Error(`Legacy office directory reappeared after migration: ${join(workspaceRoot, rawConversationId)}`);
+    }
+    return existing?.status !== "failed";
+}
 /** Scan the workspace root and move every claimable legacy office directory. */
 function claimAndMoveLegacyDirs(registry, workspaceRoot, summary) {
     for (const rawConversationId of listLegacyOfficeDirs(workspaceRoot)) {
-        const existing = registry.getMigration(rawConversationId);
-        if (existing?.status === "committed") {
-            // The move already happened; a raw-id dir with this name reappearing
-            // afterwards is a different (or resurrected) office the runtime can no
-            // longer see. Refusing to boot beats silently ignoring its data.
-            throw new Error(`Legacy office directory reappeared after migration: ${join(workspaceRoot, rawConversationId)}`);
-        }
-        if (existing?.status === "failed")
-            continue; // reported via summary.failed
+        if (!isClaimableLegacyDir(registry, workspaceRoot, rawConversationId))
+            continue;
         const record = registry.prepareLegacyMigration({
             rawConversationId,
             sourceDir: join(workspaceRoot, rawConversationId),
@@ -963,26 +987,27 @@ function recordMigratedOffice(registry, record) {
  * are (an operator can still claim one explicitly via `mikan office claim`).
  */
 function listLegacyOfficeDirs(workspaceRoot) {
-    const candidates = [];
-    for (const entry of readdirSync(workspaceRoot, { withFileTypes: true })) {
-        if (entry.name.startsWith("."))
-            continue;
-        if (RESERVED_WORKSPACE_NAMES.has(entry.name))
-            continue;
-        if (isOfficeKey(entry.name))
-            continue;
-        if (entry.isSymbolicLink()) {
-            throw new Error(`Workspace entry must not be a symlink: ${join(workspaceRoot, entry.name)}`);
-        }
-        if (!entry.isDirectory())
-            continue;
-        if (!looksLikeConversationOffice(join(workspaceRoot, entry.name))) {
-            log.logInfo(`[office] Skipping non-office workspace directory (no log.jsonl or sessions/): ${entry.name}`);
-            continue;
-        }
-        candidates.push(entry.name);
+    return readdirSync(workspaceRoot, { withFileTypes: true })
+        .filter((entry) => isLegacyOfficeDir(workspaceRoot, entry))
+        .map((entry) => entry.name)
+        .toSorted();
+}
+function isLegacyOfficeDir(workspaceRoot, entry) {
+    if (entry.name.startsWith("."))
+        return false;
+    if (RESERVED_WORKSPACE_NAMES.has(entry.name))
+        return false;
+    if (isOfficeKey(entry.name))
+        return false;
+    if (entry.isSymbolicLink()) {
+        throw new Error(`Workspace entry must not be a symlink: ${join(workspaceRoot, entry.name)}`);
     }
-    return candidates.toSorted();
+    if (!entry.isDirectory())
+        return false;
+    if (looksLikeConversationOffice(join(workspaceRoot, entry.name)))
+        return true;
+    log.logInfo(`[office] Skipping non-office workspace directory (no log.jsonl or sessions/): ${entry.name}`);
+    return false;
 }
 function looksLikeConversationOffice(dir) {
     return existsSync(join(dir, "log.jsonl")) || existsSync(join(dir, "sessions"));
@@ -993,17 +1018,24 @@ export function formatUnmigratedOfficesError(summary) {
     if (summary.unowned.length > 0) {
         lines.push("", "These legacy conversation directories have no owning platform (several", "platforms are enabled, so ownership cannot be inferred):", ...summary.unowned.map((id) => `  - ${id}`), "", "Assign each one with:", "  mikan office claim <conversationId> <platform>");
     }
-    if (summary.failed.length > 0) {
-        lines.push("", "These migrations previously failed and need manual repair (see", "office-registry.json in the state dir for each error):", ...summary.failed.map((id) => `  - ${id}`));
-    }
-    if (summary.vaultConflicts.length > 0) {
-        lines.push("", "These conversations have credentials under both the legacy and the", "office-key vault directory; merge them manually under <state-dir>/vaults:", ...summary.vaultConflicts.map((id) => `  - ${id}`));
-    }
-    if (summary.stateDirConflicts.length > 0) {
-        lines.push("", "These conversations have host state under both the legacy and the", "office-key directory; merge them manually under <state-dir>/conversations:", ...summary.stateDirConflicts.map((id) => `  - ${id}`));
-    }
+    lines.push(...conflictSection(summary.failed, [
+        "These migrations previously failed and need manual repair (see",
+        "office-registry.json in the state dir for each error):",
+    ]), ...conflictSection(summary.vaultConflicts, [
+        "These conversations have credentials under both the legacy and the",
+        "office-key vault directory; merge them manually under <state-dir>/vaults:",
+    ]), ...conflictSection(summary.stateDirConflicts, [
+        "These conversations have host state under both the legacy and the",
+        "office-key directory; merge them manually under <state-dir>/conversations:",
+    ]));
     return lines.join("\n");
 }
+/** One blank-separated "these need manual work" block, empty when nothing does. */
+function conflictSection(ids, explanation) {
+    if (ids.length === 0)
+        return [];
+    return ["", ...explanation, ...ids.map((id) => `  - ${id}`)];
+}
 /**
  * Bind-spec translator for the container layout migration: rewrites every
  * host path the office migration renamed — workspace dirs, per-conversation