@getpipher/armory-todo 0.5.0 → 0.5.2

package/extensions/todo.ts

@@ -42,6 +42,7 @@ import { autoPruneOnSessionStart } from "../src/auto-prune";
 import { loadConfig } from "../src/config";
 import { projectsOverview } from "../src/projects";
 import { renameProject } from "../src/registry";
+import { readAndClearWipeAlert } from "../src/backup";
 
 const ACTIONS = ["list", "add", "update", "get", "complete", "delete", "clear", "park", "prune", "restore", "health", "projects", "project_rename"] as const;
 
@@ -79,6 +80,16 @@ export default function (pi: ExtensionAPI) {
   // Warm + report on session start (every new/resume/fork/reload).
   pi.on("session_start", async (_event, ctx) => {
     try {
+      // v0.5.2: surface a pending wipe-alert sentinel FIRST (most prominent).
+      let wipeMsg = "";
+      try {
+        const alert = readAndClearWipeAlert();
+        if (alert) {
+          wipeMsg = `⚠ WIPE RECOVERED: ${alert.before}→${alert.after} at ${alert.at}${alert.snap ? `, snap=${alert.snap}` : ""} — check ~/.pi/agent/todo/todo-audit.log + run \`ps aux | grep -iE 'tsx|pi'\` to catch the wiper live`;
+        }
+      } catch {
+        // alert optional
+      }
       let autoMsg = "";
       let ageDays = 7;
       try {
@@ -101,7 +112,7 @@ export default function (pi: ExtensionAPI) {
       } catch {
         // health check optional
       }
-      if (ctx.hasUI) ctx.ui.notify(msg, "info");
+      if (ctx.hasUI) ctx.ui.notify((wipeMsg ? wipeMsg + "\n" : "") + msg, "info");
     } catch {
       // store unavailable — never crash the session
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@getpipher/armory-todo",
-  "version": "0.5.0",
-  "description": "Global, cross-session TODO for pi — persists across all sessions and is auto-injected into every prompt. The disk-backed counterpart to branch-scoped pi todo extensions.",
+  "version": "0.5.2",
+  "description": "Global, cross-session TODO for pi \u2014 persists across all sessions and is auto-injected into every prompt. The disk-backed counterpart to branch-scoped pi todo extensions.",
   "keywords": [
     "pi-package",
     "pi-extension",
@@ -35,7 +35,7 @@
     ]
   },
   "scripts": {
-    "test": "for t in todo-store todo-title-notes todo-archive todo-config todo-migrate todo-health todo-hard-prune todo-auto-prune registry projects panel-data todo-caps; do node test/$t.test.mts || exit 1; done"
+    "test": "for t in todo-store todo-title-notes todo-archive todo-config todo-migrate todo-health todo-hard-prune todo-auto-prune registry projects panel-data todo-caps todo-backup; do node test/$t.test.mts || exit 1; done"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
@@ -53,4 +53,4 @@
       "optional": true
     }
   }
-}
+}

package/src/archive.ts

@@ -12,6 +12,7 @@ import { migrateV2ToV3 } from "./migrate.ts";
 import type { Todo } from "./todo-store.ts";
 import { loadConfig } from "./config.ts";
 import { loadStore, saveStore, TodoError } from "./todo-store.ts";
+import { backupFile, snapshotOnDrop, appendAudit, countTodosInFile } from "./backup.ts";
 
 export interface ArchiveStore {
   version: 3;
@@ -61,6 +62,11 @@ export function loadArchive(): ArchiveStore {
 export function saveArchive(store: ArchiveStore): void {
   store.updatedAt = now();
   const path = getArchivePath();
+  // v0.5.1 write-audit + backup (post data-loss hardening).
+  const before = countTodosInFile(path);
+  const after = store.todos.length;
+  backupFile(path);
+  const dropSnap = snapshotOnDrop(path, before, after);
   const dir = dirname(path);
   mkdirSync(dir, { recursive: true });
   const tmp = `${path}.tmp`;
@@ -71,6 +77,7 @@ export function saveArchive(store: ArchiveStore): void {
     // some filesystems ignore mode bits
   }
   renameSync(tmp, path);
+  appendAudit("archive", before, after, dropSnap);
 }
 
 export interface PruneInput {

package/src/backup.ts

@@ -0,0 +1,123 @@
+// Write-audit + backup for armory-todo (v0.5.1 hardening, post v0.2.0 data-loss
+// incident). Every saveStore / saveArchive now:
+//   1. backs up the current file to <path>.bak (rolling previous version — the
+//      immediate recovery target);
+//   2. if the save would DROP the todo count (after < before), also snapshots
+//      the pre-write file to <path>.bak-drop-<ts> (timestamped, never
+//      overwritten — the preserved pre-wipe state, the trap);
+//   3. appends one compact line to <TODO_DIR>/todo-audit.log (counts only, no
+//      todo content — privacy-safe) flagging drops with ⚠ DROP.
+//
+// This means the v0.2.0-style "migration wiped the store" incident is now
+// recoverable: the .bak-drop-<ts> holds the pre-wipe state, and the audit log
+// names the moment + the count delta.
+//
+// Pure fs helpers (no pi imports) so they're unit-testable in isolation.
+
+import { chmodSync, copyFileSync, existsSync, mkdirSync, appendFileSync, statSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getTodoDir } from "./paths.ts";
+
+/** Copy the current file to <path>.bak (rolling previous version). No-op if the
+ *  file doesn't exist yet (first-ever save). Returns true if a backup was made. */
+export function backupFile(path: string): boolean {
+  if (!existsSync(path)) return false;
+  try {
+    copyFileSync(path, `${path}.bak`);
+    return true;
+  } catch {
+    // best-effort; a failed backup must not block the write
+    return false;
+  }
+}
+
+/** If a count drop is detected (after < before), snapshot the pre-write file to
+ *  <path>.bak-drop-<ts> (preserved — never overwritten by the rolling .bak).
+ *  Returns the snapshot path, or null if no snapshot was taken. */
+export function snapshotOnDrop(path: string, before: number, after: number): string | null {
+  if (before <= after) return null;            // no drop (growth or steady)
+  if (!existsSync(path)) return null;          // nothing to snapshot
+  const ts = new Date().toISOString().replace(/[:.]/g, "-");
+  const snap = `${path}.bak-drop-${ts}`;
+  try {
+    copyFileSync(path, snap);
+    return snap;
+  } catch {
+    return null;
+  }
+}
+
+/** Append one compact audit line. Counts only (no todo content). Flags drops.
+ *  `box` is "todo" or "archive" (which file was saved). */
+export function appendAudit(box: "todo" | "archive", before: number, after: number, dropSnap: string | null): void {
+  try {
+    const dir = getTodoDir();
+    mkdirSync(dir, { recursive: true });
+    const logPath = join(dir, "todo-audit.log");
+    const ts = new Date().toISOString();
+    const delta = after - before;
+    const flag = after < before ? " [⚠ DROP]" : "";
+    const snap = dropSnap ? ` snap=${dropSnap.split("/").pop()}` : "";
+    appendFileSync(logPath, `${ts} save ${box}.json ${before}→${after} ${delta >= 0 ? "+" : ""}${delta}${flag}${snap}\n`, { encoding: "utf8" });
+    try { chmodSync(logPath, 0o600); } catch { /* fs may ignore mode */ }
+  } catch {
+    // best-effort; audit must not block the write
+  }
+}
+
+/** Count todos in an existing store file (for the before-count). Returns 0 if the
+ *  file is missing/unreadable/not a valid store. */
+export function countTodosInFile(path: string): number {
+  try {
+    if (!existsSync(path)) return 0;
+    const raw = statSync(path).size === 0 ? null : readJson(path);
+    if (!raw || !Array.isArray(raw.todos)) return 0;
+    return raw.todos.length;
+  } catch {
+    return 0;
+  }
+}
+
+function readJson(path: string): any {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+// --- v0.5.2 wipe alert (one-shot sentinel) ---
+const WIPE_ALERT_PATH = join(getTodoDir(), ".wipe-alert");
+
+/** On a drop, write a one-shot sentinel at <TODO_DIR>/.wipe-alert so the next
+ *  pi session_start can surface the recovery prominently. Overwritten by each
+ *  new drop (the latest wins). The session_start handler reads + deletes it. */
+export function writeWipeAlert(before: number, after: number, snap: string | null): void {
+  try {
+    const dir = getTodoDir();
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, ".wipe-alert");
+    const payload = {
+      at: new Date().toISOString(),
+      before,
+      after,
+      snap: snap ? snap.split("/").pop() : null,
+      snapPath: snap,
+    };
+    writeFileSync(path, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf8", mode: 0o600 });
+    try { chmodSync(path, 0o600); } catch { /* fs may ignore mode */ }
+  } catch {
+    // best-effort; alert must not block the write
+  }
+}
+
+/** Read + delete the wipe-alert sentinel (one-shot). Returns the payload if a
+ *  pending alert exists, else null. The caller surfaces it in session_start
+ *  then it's gone (until the next drop). */
+export function readAndClearWipeAlert(): { at: string; before: number; after: number; snap: string | null; snapPath: string | null } | null {
+  try {
+    const path = join(getTodoDir(), ".wipe-alert");
+    if (!existsSync(path)) return null;
+    const payload = JSON.parse(readFileSync(path, "utf8"));
+    try { unlinkSync(path); } catch { /* best-effort clear */ }
+    return payload;
+  } catch {
+    return null;
+  }
+}

package/src/todo-store.ts

@@ -22,6 +22,7 @@ import { migrateIfNeeded, migrateV2ToV3 } from "./migrate.ts";
 import { loadConfig } from "./config.ts";
 import { loadRegistry, getProjectEntry } from "./registry.ts";
 import { checkNotesCap, checkProjectCap, overBudgetProjects } from "./caps.ts";
+import { backupFile, snapshotOnDrop, appendAudit, countTodosInFile, writeWipeAlert } from "./backup.ts";
 
 export type Priority = "low" | "med" | "high" | "critical";
 export type Status = "open" | "in_progress" | "parked" | "done" | "cancelled";
@@ -150,6 +151,12 @@ export function loadStore(): Store {
 export function saveStore(store: Store): void {
   store.updatedAt = now();
   const path = getLivePath();
+  // v0.5.1 write-audit + backup (post data-loss hardening): back up the current
+  // file, snapshot pre-write state on a count drop, then audit-log the save.
+  const before = countTodosInFile(path);
+  const after = store.todos.length;
+  backupFile(path);
+  const dropSnap = snapshotOnDrop(path, before, after);
   const dir = dirname(path);
   mkdirSync(dir, { recursive: true });
   const tmp = `${path}.tmp`;
@@ -160,6 +167,8 @@ export function saveStore(store: Store): void {
     // some filesystems ignore mode bits; not fatal
   }
   renameSync(tmp, path);
+  appendAudit("todo", before, after, dropSnap);
+  if (after < before) writeWipeAlert(before, after, dropSnap);
 }
 
 function assertPriority(p: unknown): asserts p is Priority {