@khorsheed/dsh-ankh-guard 0.1.0 → 0.2.0

package/lib/restart-context-DmnQXNf-.js

@@ -1,421 +0,0 @@
-import { c as stateFile } from "./state-Dhx9VG44.js";
-import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-//#region lib/types/git.js
-/**
-* Git helpers for the self-restart guard: the credential binds to the current
-* HEAD, checkpoints are real commits, and rollback is a hard reset. All calls
-* are synchronous child-process invocations scoped to the repo directory.
-*/
-/**
-* The repository's current HEAD, or null when the directory is not inside a
-* git repository (or git itself is unavailable).
-* @param repoDir - repository directory.
-* @returns the full HEAD sha, or null.
-*/
-function currentHead(repoDir) {
-	try {
-		const out = execFileSync("git", ["rev-parse", "HEAD"], {
-			cwd: repoDir,
-			encoding: "utf8",
-			stdio: "pipe"
-		}).trim();
-		return out.length > 0 ? out : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Commit the whole working tree as a checkpoint snapshot (empty commits
-* allowed — a clean tree still records a rollback point).
-* @param repoDir - repository directory.
-* @param message - checkpoint commit message.
-* @param artifactPattern - staged paths matching this are reported as
-* build-artifact-looking warnings (deployment-specific — see
-* SRC_ARTIFACT_PATTERN in defaults.ts; omit for none).
-* @returns the new HEAD sha, or a failure reason.
-*/
-function commitCheckpoint(repoDir, message, artifactPattern) {
-	try {
-		execFileSync("git", ["add", "-A"], {
-			cwd: repoDir,
-			stdio: "pipe"
-		});
-		const staged = execFileSync("git", [
-			"diff",
-			"--cached",
-			"--name-only"
-		], {
-			cwd: repoDir,
-			encoding: "utf8"
-		});
-		const artifacts = artifactPattern === void 0 ? [] : staged.split("\n").filter((file) => artifactPattern.test(file));
-		execFileSync("git", [
-			"commit",
-			"--allow-empty",
-			"-m",
-			message
-		], {
-			cwd: repoDir,
-			stdio: "pipe"
-		});
-		const sha = currentHead(repoDir);
-		if (sha === null) return {
-			ok: false,
-			error: "checkpoint commit succeeded but HEAD became unreadable"
-		};
-		return {
-			ok: true,
-			sha,
-			artifacts
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: `git checkpoint failed: ${String(error)}`
-		};
-	}
-}
-/**
-* Roll the checkout back to a checkpoint commit WITHOUT losing work: the
-* discarded HEAD becomes a `guard-backup-*` branch, and uncommitted tracked
-* changes become a second `-wip` anchor commit (`git stash create` snapshots
-* the worktree without touching it; untracked files survive `reset --hard`
-* on their own). Every reset path — the watchdog, the CLI, the agent-facing
-* service — funnels through here, so recovery never depends on the reflog.
-* @param repoDir - repository directory.
-* @param sha - the checkpoint commit to reset to.
-* @returns success with the recovery anchor refs, or a failure reason.
-*/
-function resetToCheckpoint(repoDir, sha) {
-	const anchors = [];
-	try {
-		const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[-:T]/g, "").replace(/\..*$/, "");
-		const anchor = `guard-backup-${stamp.slice(0, 8)}-${stamp.slice(8)}-${Math.random().toString(36).slice(2, 6)}`;
-		const head = currentHead(repoDir);
-		if (head !== null && head !== sha) try {
-			execFileSync("git", [
-				"branch",
-				anchor,
-				"HEAD"
-			], {
-				cwd: repoDir,
-				stdio: "pipe"
-			});
-			anchors.push(anchor);
-		} catch {}
-		let wip = "";
-		try {
-			wip = execFileSync("git", ["stash", "create"], {
-				cwd: repoDir,
-				encoding: "utf8"
-			}).trim();
-		} catch {}
-		if (wip !== "") try {
-			execFileSync("git", [
-				"branch",
-				`${anchor}-wip`,
-				wip
-			], {
-				cwd: repoDir,
-				stdio: "pipe"
-			});
-			anchors.push(`${anchor}-wip`);
-		} catch {}
-		execFileSync("git", [
-			"reset",
-			"--hard",
-			sha
-		], {
-			cwd: repoDir,
-			stdio: "pipe"
-		});
-		return {
-			ok: true,
-			anchors
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: `git reset --hard ${sha} failed: ${String(error)}`,
-			anchors
-		};
-	}
-}
-//#endregion
-//#region lib/types/restart-context.js
-/**
-* Restart-record context injection and interrupted-session continuity. After
-* a scheduled restart, the FULL report waits for the initiating session's
-* root agent, whenever it resumes (session restore is lazy, so no other
-* session is ever woken for reporting); a record without an initiator is
-* claimed by the first root agent created. Separately, a snapshot written at
-* SIGTERM time (`interrupted-sessions.json`) records which root sessions had
-* a live turn when the process stopped, so the next restart boot can resume
-* those sessions and queue a "continue" turn. Pure logic reads the durable
-* files; the plugin wires them into `agent/created` and `agent.followup`.
-*/
-/** Absolute path of the restart record inside a state directory. */
-function restartRecordFile(stateDir) {
-	return stateFile(stateDir, "lastRestart");
-}
-/** Absolute path of the interrupted-session snapshot inside a state directory. */
-function interruptedSnapshotFile(stateDir) {
-	return stateFile(stateDir, "interruptedSessions");
-}
-/**
-* The pending restart record, or null when none is awaiting a report (absent,
-* unparseable, or settled). The record stays pending until the initiator
-* resumes or the next restart replaces it (a new exitAt) — those are the only
-* retirement paths.
-* @param stateDir - state directory.
-* @returns the record without `reportedAt`, or null.
-*/
-function pendingRestartRecord(stateDir) {
-	const file = restartRecordFile(stateDir);
-	if (!existsSync(file)) return null;
-	try {
-		const record = JSON.parse(readFileSync(file, "utf8"));
-		return record.reportedAt !== void 0 ? null : record;
-	} catch {
-		return null;
-	}
-}
-/**
-* The model-visible restart report (Chinese product copy, factual).
-* @param record - the pending restart record.
-* @param canaryPending - whether the restart marker is still present (the
-* watchdog has not yet run/cleared the canary).
-* @returns the report text, or an empty string for a malformed record.
-*/
-function restartContextText(record, canaryPending) {
-	if (record.exitAt === void 0 && record.error === void 0) return "";
-	const time = record.exitAt !== void 0 ? new Date(record.exitAt).toISOString() : "未知时间";
-	if (record.unexpected === true) return `[ankh-guard] 服务最近发生过一次非计划退出（崩溃或被手动停止）：${time}，watchdog 已自动拉起实例。请向用户简要回报这次非计划重启。`;
-	return `[ankh-guard] 服务最近重启过：${time}，退出${record.error !== void 0 ? `失败（${record.error}）` : "成功"}，${canaryPending ? "金丝雀尚未完成" : "金丝雀已处理"}。请向用户简要回报本次重启结果。`;
-}
-/**
-* The model-visible "continue" prompt for a session whose turn was
-* interrupted by the restart (its log tail was closed with
-* `reason.kind === 'interrupted'` by crash-recovery repair).
-* @param exitAt - epoch milliseconds of the exit that interrupted the turn.
-* @returns the prompt text.
-*/
-function continueInterruptedText(exitAt) {
-	return `[ankh-guard] 服务于 ${new Date(exitAt).toISOString()} 重启，你上次正在进行的回合被中断（日志已标记 interrupted）。请检查当前状态并继续未完成的任务；若任务已不再适用，简要说明原因后停止。`;
-}
-/**
-* The combined prompt for a session that is BOTH the restart's initiator and
-* an interrupted session: one turn continues the work and reports the
-* restart, instead of two near-duplicate turns.
-* @param record - the pending restart record.
-* @param canaryPending - whether the restart marker is still present.
-* @returns the prompt text, or an empty string for a malformed record.
-*/
-function continueAndReportText(record, canaryPending) {
-	if (record.exitAt === void 0 && record.error === void 0) return "";
-	const time = record.exitAt !== void 0 ? new Date(record.exitAt).toISOString() : "未知时间";
-	if (record.unexpected === true) return `[ankh-guard] 服务于 ${time} 发生非计划退出（崩溃或被手动停止），watchdog 已自动拉起实例。你上次正在进行的回合被中断（日志已标记 interrupted）。请检查当前状态并继续未完成的任务，并向用户简要回报这次非计划重启；若任务已不再适用，简要说明原因后停止。`;
-	return `[ankh-guard] 服务于 ${time} 重启，退出${record.error !== void 0 ? `失败（${record.error}）` : "成功"}，${canaryPending ? "金丝雀尚未完成" : "金丝雀已处理"}。你上次正在进行的回合被中断（日志已标记 interrupted）。请检查当前状态并继续未完成的任务，并向用户简要回报本次重启结果；若任务已不再适用，简要说明原因后停止。`;
-}
-/**
-* Acknowledge a restart record so it injects exactly once.
-* @param stateDir - state directory.
-* @param record - the record being reported.
-* @param now - epoch milliseconds of the acknowledgement.
-*/
-function acknowledgeRestartRecord(stateDir, record, now) {
-	try {
-		atomicWrite(restartRecordFile(stateDir), `${JSON.stringify({
-			...record,
-			reportedAt: now
-		})}\n`);
-	} catch {}
-}
-/**
-* Record an unplanned-exit recovery (the watchdog respawned the instance with
-* no restart marker), unless a record still awaits its report. Returns whether
-* the record was written — the caller (CLI verb, invoked by the watchdog) logs
-* either way, so the watchdog log must never claim a write that was skipped.
-* @param stateDir - state directory.
-* @param now - epoch milliseconds of the recovery.
-* @returns true when the record was written, false when a pending record was kept.
-*/
-function writeUnexpectedExitRecord(stateDir, now) {
-	if (pendingRestartRecord(stateDir) !== null) return false;
-	mkdirSync(stateDir, { recursive: true });
-	atomicWrite(restartRecordFile(stateDir), `${JSON.stringify({
-		exitAt: now,
-		unexpected: true
-	})}\n`);
-	return true;
-}
-/**
-* Record the restart verb's outcome for the report machinery (the restart
-* verb is otherwise invisible to it: it writes no marker and no record, so a
-* restart it drove would never be reported to any session). Mirrors the exit
-* agent's record semantics; a still-pending earlier record is replaced only
-* by a completed newer restart.
-* @param stateDir - state directory.
-* @param record - the outcome fields (exitAt/pid for a stop, error on failure).
-*/
-function writeRestartOutcome(stateDir, record) {
-	mkdirSync(stateDir, { recursive: true });
-	atomicWrite(restartRecordFile(stateDir), `${JSON.stringify(record)}\n`);
-}
-/**
-* Record the watchdog's ADOPTION takeover — the first restart a deployment
-* ever sees: `supervise` handed the port to the watchdog, which stopped the
-* pre-existing owner and booted the supervised instance. The session that
-* established supervision promised the user a verification report; without
-* this record nothing wakes it after the bounce (the adoption writes no
-* restart marker and no outcome record). Never overwrites a record that still
-* awaits its report.
-* @param stateDir - state directory.
-* @param now - epoch milliseconds of the takeover boot.
-* @param initiator - the session that established supervision, when known.
-* @returns whether the record was written.
-*/
-function writeAdoptionRecord(stateDir, now, initiator) {
-	if (pendingRestartRecord(stateDir) !== null) return false;
-	mkdirSync(stateDir, { recursive: true });
-	atomicWrite(restartRecordFile(stateDir), `${JSON.stringify({
-		exitAt: now,
-		...initiator !== void 0 && initiator !== "" ? { initiator } : {}
-	})}\n`);
-	return true;
-}
-/**
-* Persist the launch record (atomic). The instance-facing side of
-* {@link writeInstanceLaunch}: only an `instance`-sourced record may be
-* replaced by another — a `supervisor` record carries the FULL supervision
-* chain (watchdog, launch wrapper) and the inner process must not overwrite
-* it with its own bare argv.
-* @param stateDir - state directory.
-* @param launch - the launch facts.
-* @returns whether the record was written.
-*/
-function writeInstanceLaunch(stateDir, launch) {
-	if (readInstanceLaunch(stateDir)?.source === "supervisor") return false;
-	mkdirSync(stateDir, { recursive: true });
-	atomicWrite(stateFile(stateDir, "instanceLaunch"), `${JSON.stringify(launch)}\n`);
-	return true;
-}
-/** POSIX single-quote one word for a shell command line. */
-function shellQuote(word) {
-	return `'${word.replace(/'/g, "'\\''")}'`;
-}
-/**
-* Render the instance's launch as a shell command: cwd, DSH_* env, and the
-* FULL node invocation — execArgv included, because a tsx chain
-* (`node --import tsx …`) rendered without it becomes a bare `node bin.ts`
-* that cannot load TypeScript sources.
-*/
-/**
-* Per-invocation transients, never launch configuration: the restart driver's
-* own marker, the calling session's identity, and the shell/web hand-off
-* vars. A recorded launch must not leak them into the next instance (a
-* restart driver reading DSH_ANKH_RESTART_DRIVER would misbehave; a stale
-* DSH_SESSION_ID misattributes reports).
-*/
-const TRANSIENT_ENV_KEYS = /* @__PURE__ */ new Set([
-	"DSH_ANKH_RESTART_DRIVER",
-	"DSH_SESSION_ID",
-	"DSH_SESSION_JSONL",
-	"DSH_WEB_URL",
-	"DSH_SHELL"
-]);
-function buildLaunchCommand(execPath, execArgv, args, cwd, env) {
-	const envPart = Object.entries(env).filter(([key]) => !TRANSIENT_ENV_KEYS.has(key)).map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ");
-	const argv = [
-		execPath,
-		...execArgv,
-		...args
-	].map(shellQuote).join(" ");
-	return `cd ${shellQuote(cwd)} && ${envPart !== "" ? `${envPart} ` : ""}${argv}`;
-}
-/** Replace any record unconditionally (the supervisor's own write path). */
-function writeInstanceLaunchAsSupervisor(stateDir, launch) {
-	mkdirSync(stateDir, { recursive: true });
-	atomicWrite(stateFile(stateDir, "instanceLaunch"), `${JSON.stringify(launch)}\n`);
-}
-/**
-* Read the launch record, or null when absent/unparseable (older deployments,
-* or the plugin never applied in this home).
-* @param stateDir - state directory.
-* @returns the record, or null.
-*/
-function readInstanceLaunch(stateDir) {
-	try {
-		const launch = JSON.parse(readFileSync(stateFile(stateDir, "instanceLaunch"), "utf8"));
-		return typeof launch.command === "string" ? launch : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Read the shutdown snapshot, or null when absent/unparseable. Malformed
-* snapshots are dropped by the caller's delete-after-read, never retried.
-* @param stateDir - state directory.
-* @returns the snapshot, or null.
-*/
-function readInterruptedSnapshot(stateDir) {
-	const file = interruptedSnapshotFile(stateDir);
-	if (!existsSync(file)) return null;
-	try {
-		const snapshot = JSON.parse(readFileSync(file, "utf8"));
-		if (!Array.isArray(snapshot.resume) || !Array.isArray(snapshot.interrupted)) return null;
-		return snapshot;
-	} catch {
-		return null;
-	}
-}
-/**
-* Write the shutdown snapshot (synchronous — called from a signal handler).
-* The state directory is created on demand: a fresh deployment has no
-* `$DSH_HOME/state` yet, and a missing directory must not silently drop the
-* snapshot.
-* @param stateDir - state directory.
-* @param snapshot - the snapshot to persist.
-*/
-function writeInterruptedSnapshot(stateDir, snapshot) {
-	try {
-		mkdirSync(stateDir, { recursive: true });
-		atomicWrite(interruptedSnapshotFile(stateDir), `${JSON.stringify(snapshot)}\n`);
-	} catch {}
-}
-/** Write a small durable file atomically (tmp + rename in the same directory). */
-function atomicWrite(file, content) {
-	const tmp = `${file}.${process.pid}.tmp`;
-	writeFileSync(tmp, content);
-	renameSync(tmp, file);
-}
-/**
-* Persist the skill-registration outcome (atomic, best-effort). A migration
-* or repackaging that drops the skill is otherwise invisible until someone
-* notices the catalog entry missing — this record lets `check-env` surface it.
-* @param stateDir - state directory.
-* @param record - the outcome of this boot's registration attempt.
-*/
-function writeSkillRegistration(stateDir, record) {
-	try {
-		mkdirSync(stateDir, { recursive: true });
-		atomicWrite(stateFile(stateDir, "skillRegistration"), `${JSON.stringify(record)}\n`);
-	} catch {}
-}
-/**
-* Read the skill-registration record, or null when absent/unparseable (the
-* plugin never applied with this state dir, or predates the record).
-* @param stateDir - state directory.
-* @returns the record, or null.
-*/
-function readSkillRegistration(stateDir) {
-	try {
-		const record = JSON.parse(readFileSync(stateFile(stateDir, "skillRegistration"), "utf8"));
-		return typeof record.registered === "boolean" && typeof record.at === "number" ? record : null;
-	} catch {
-		return null;
-	}
-}
-//#endregion
-export { writeUnexpectedExitRecord as _, interruptedSnapshotFile as a, resetToCheckpoint as b, readInterruptedSnapshot as c, writeAdoptionRecord as d, writeInstanceLaunch as f, writeSkillRegistration as g, writeRestartOutcome as h, continueInterruptedText as i, readSkillRegistration as l, writeInterruptedSnapshot as m, buildLaunchCommand as n, pendingRestartRecord as o, writeInstanceLaunchAsSupervisor as p, continueAndReportText as r, readInstanceLaunch as s, acknowledgeRestartRecord as t, restartContextText as u, commitCheckpoint as v, currentHead as y };