@mcptoolshop/style-dataset-lab 3.2.0 → 3.4.0

package/lib/paths.js

@@ -10,12 +10,176 @@ import { inputError } from './errors.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
-/** Absolute path to the repository root. */
-export const REPO_ROOT = join(__dirname, '..');
+// ─── Workspace root resolution (SDL-C1) ───────────────────────────
+//
+// `REPO_ROOT` used to be `join(__dirname, '..')` — always the directory
+// this module happens to live in. That is correct for an in-repo checkout,
+// but for an npm-installed consumer it resolves to
+// `node_modules/@mcptoolshop/style-dataset-lab`, so `sdlab init demo`
+// silently wrote the user's whole project tree into node_modules — gone on
+// the next `npm ci`.
+//
+// The fix is a 4-step search, cheapest/most-explicit signal first:
+//   1. SDLAB_ROOT env var, if set and it exists.
+//   2. Walk up from process.cwd() looking for a directory containing
+//      `projects/`. First hit wins — this is how a user's own workspace
+//      (wherever it lives) gets found.
+//   3. The module's own root, IF it already has a `projects/` dir — this is
+//      what preserves every existing in-repo dev/test workflow, where cwd
+//      already resolves via step 2 anyway, but is kept as an explicit
+//      fallback for callers with an unusual cwd.
+//   4. process.cwd() itself — a fresh workspace where `init` will create
+//      `projects/`.
+//
+// Whatever step wins, the result is never allowed to sit inside a
+// node_modules directory — that is the exact shape of the original bug, so
+// it is a hard error instead of a silent write into someone's
+// node_modules tree.
+
+/**
+ * True if any path segment of `absPath` is literally `node_modules`.
+ */
+function isInsideNodeModules(absPath) {
+  return resolve(absPath)
+    .split(/[\\/]+/)
+    .some((seg) => seg.toLowerCase() === 'node_modules');
+}
+
+function assertNotInNodeModules(absPath, label) {
+  if (isInsideNodeModules(absPath)) {
+    throw inputError(
+      'INPUT_ROOT_IN_NODE_MODULES',
+      `Resolved workspace root (${label}) sits inside a node_modules directory: ${absPath}`,
+      'Run sdlab from your own project directory, or set SDLAB_ROOT to your workspace path.'
+    );
+  }
+  return absPath;
+}
+
+/**
+ * Walk up from `startDir` looking for a directory that contains a
+ * `projects/` subdirectory. Returns the first hit, or null if the walk
+ * reaches the filesystem root without finding one.
+ */
+function walkUpForProjectsDir(startDir) {
+  let dir = resolve(startDir);
+  while (true) {
+    if (existsSync(join(dir, 'projects'))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null; // reached the filesystem root
+    dir = parent;
+  }
+}
+
+/**
+ * Pure resolution logic for the workspace root, taking every input
+ * explicitly (cwd, env, module root) rather than reading global process
+ * state directly. This is what makes it possible to unit-test all four
+ * branches deterministically without mutating the real process.cwd() or
+ * environment (which are shared, global, and unsafe to mutate across a
+ * concurrently-run test suite).
+ *
+ * Production callers should use `getWorkspaceRoot()` instead, which
+ * supplies the real process.cwd()/env and memoizes the result.
+ *
+ * @param {string} cwd
+ * @param {{env?: Object, moduleRoot?: string}} [opts]
+ * @returns {string} absolute workspace root
+ */
+export function resolveWorkspaceRootFrom(cwd, opts = {}) {
+  const env = opts.env || process.env;
+  const moduleRoot = opts.moduleRoot || join(__dirname, '..');
+
+  // 1. SDLAB_ROOT env var, if set and it exists.
+  const envRoot = env.SDLAB_ROOT;
+  if (envRoot && existsSync(envRoot)) {
+    return assertNotInNodeModules(resolve(envRoot), 'from SDLAB_ROOT');
+  }
+
+  // 2. Walk up from cwd looking for projects/.
+  const fromCwd = walkUpForProjectsDir(cwd);
+  if (fromCwd) {
+    return assertNotInNodeModules(fromCwd, 'found by walking up from the current directory');
+  }
+
+  // 3. The module root itself is the repo checkout.
+  if (existsSync(join(moduleRoot, 'projects'))) {
+    return assertNotInNodeModules(resolve(moduleRoot), 'the style-dataset-lab install directory');
+  }
+
+  // 4. Fresh workspace — init will create projects/ here.
+  return assertNotInNodeModules(resolve(cwd), 'the current directory');
+}
+
+let _workspaceRootCache = null;
+
+/**
+ * Resolve (and memoize) the workspace root using the real process.cwd()
+ * and process.env. Safe to call repeatedly — it only walks the filesystem
+ * once per process, unless reset.
+ * @returns {string}
+ */
+export function getWorkspaceRoot() {
+  if (_workspaceRootCache === null) {
+    _workspaceRootCache = resolveWorkspaceRootFrom(process.cwd());
+  }
+  return _workspaceRootCache;
+}
+
+/**
+ * Clear the memoized workspace root so the next getWorkspaceRoot() call
+ * re-resolves from scratch. Exists for tests that need to exercise the
+ * resolver under different SDLAB_ROOT/cwd conditions within one process.
+ */
+export function resetWorkspaceRootCache() {
+  _workspaceRootCache = null;
+}
+
+/**
+ * Absolute path to the workspace root — the directory that contains (or
+ * will contain) `projects/`. Kept as a plain exported constant for
+ * backward compatibility with the ~30 existing call sites that do
+ * `join(REPO_ROOT, ...)`, but its VALUE now comes from the resolver above
+ * rather than being hardcoded to this module's own location.
+ */
+export const REPO_ROOT = getWorkspaceRoot();
+
+/**
+ * Absolute path to the INSTALLED PACKAGE's own root — always module-relative,
+ * never the user's workspace.
+ *
+ * There are two distinct roots and conflating them is a shipping bug:
+ *
+ *   - **workspace root** (`getWorkspaceRoot()`) — where the user's `projects/`
+ *     live. Correctly cwd-relative, so an npm-installed user's data lands in
+ *     their own directory instead of inside `node_modules`.
+ *   - **package root** (this) — where assets that SHIP IN THE TARBALL live:
+ *     `templates/` (domain starter packs) and `runtime/` (ComfyUI workflow
+ *     graphs). These belong to the install, not to the workspace.
+ *
+ * In a repo checkout the two coincide, which is exactly why the distinction
+ * is easy to lose and impossible to catch with in-repo tests. Measured in a
+ * clean-room tarball install: with `templates/` resolved against the
+ * workspace root, `sdlab init demo --domain character-design` failed with
+ * `INPUT_UNKNOWN_DOMAIN: Available: generic,` — the five domain packs were
+ * sitting in the package the whole time, being looked for in the user's cwd.
+ */
+export function getPackageRoot() {
+  return resolve(join(__dirname, '..'));
+}
+
+// ─── Project name / path safety (SDL-C3) ──────────────────────────
+
+// A project name must be a single path segment: no separators, no `..`.
+// This is deliberately a blacklist (not the stricter creation-time
+// `/^[a-z0-9][a-z0-9-]*[a-z0-9]$/` from scripts/init.js) so existing
+// project directories keep resolving; it is paired with the
+// resolveSafeProjectPath() containment check below as defense in depth.
+const UNSAFE_PROJECT_NAME_RE = /\.\.|[\\/]/;
 
 /**
  * Resolve the root directory for a named project.
- * @param {string} name — project name (e.g. 'star-freight')
+ * @param {string} name — a single path segment, e.g. 'my-project'
  * @returns {string} absolute path to projects/<name>/
  */
 export function getProjectRoot(name) {
@@ -26,12 +190,32 @@ export function getProjectRoot(name) {
       'Pass --project <name>.'
     );
   }
-  const root = join(REPO_ROOT, 'projects', name);
+  if (UNSAFE_PROJECT_NAME_RE.test(name)) {
+    throw inputError(
+      'INPUT_UNSAFE_PROJECT_NAME',
+      `Project name "${name}" is not valid — it contains a path separator or "..".`,
+      `--project takes a name, not a path: it names a directory under projects/. ` +
+      `Try --project my-project. Run "sdlab init <name>" to create one.`
+    );
+  }
+  const projectsDir = join(getWorkspaceRoot(), 'projects');
+  // Defense in depth: even though the blacklist above already rejects the
+  // characters needed to escape projectsDir, reuse the same containment
+  // pattern as every other user-path entry point in this file so a future
+  // change to the blacklist can't silently reopen the traversal.
+  const root = resolveSafeProjectPath(projectsDir, name, { flagName: 'project' });
   if (!existsSync(root)) {
     throw inputError(
       'INPUT_UNKNOWN_PROJECT',
       `Project "${name}" not found at ${root}.`,
-      `Run: sdlab init ${name} --domain <domain>`
+      // Two different causes land here and they need opposite responses, so
+      // name both rather than assuming the project is missing. Since the
+      // workspace root is resolved from the current directory, running from
+      // the wrong place produces this same error — and blindly following
+      // "run init" would then scaffold a duplicate project somewhere else.
+      `Looking under ${projectsDir} (workspace resolved from the current directory).\n` +
+      `  · Wrong directory? cd to your workspace, or set SDLAB_ROOT to it.\n` +
+      `  · New project?     sdlab init ${name} --domain character-design`
     );
   }
   return root;
@@ -100,8 +284,13 @@ export function getRunsDir(projectRoot) {
 }
 
 /**
- * Return the runtime templates directory (repo-level).
+ * Return the ComfyUI runtime workflow templates directory.
+ *
+ * PACKAGE-relative, deliberately — see `getPackageRoot()`. `runtime/` ships
+ * inside the npm tarball; it is not workspace content. Resolving it against
+ * the workspace root made `listWorkflowTemplates()` return `[]` for every
+ * installed user, which is the bug `getPackageRoot()` exists to prevent.
  */
 export function getRuntimeDir() {
-  return join(REPO_ROOT, 'runtime');
+  return join(getPackageRoot(), 'runtime');
 }

package/lib/reingest-selected.js

@@ -6,7 +6,7 @@
  * canon-binding flow as everything else. No bypass.
  */
 
-import { writeFile, mkdir, copyFile } from 'node:fs/promises';
+import { writeFile, mkdir, copyFile, rename, unlink } from 'node:fs/promises';
 import { join, extname } from 'node:path';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { getRunsDir } from './paths.js';
@@ -16,6 +16,35 @@ import { buildGeneratedProvenance } from './generated-provenance.js';
 import { buildBaseRecord } from './records.js';
 import { inputError } from './errors.js';
 
+// SDL-H7: the only shape a selection id can ever legitimately have,
+// mirroring generateSelectionId() in lib/selections.js (selection_<date>_<seq>,
+// same prefix/date/seq scheme as run/batch ids). Validated BEFORE the id is
+// used anywhere — including before loadSelection(), which does its own
+// unguarded join — so a traversal payload never reaches the filesystem, and
+// before the join at `selectionDir` below, which this module writes
+// provenance.jsonl into. A mismatch reuses loadSelection's own
+// SELECTION_NOT_FOUND shape (not a distinct code) because no real selection
+// can ever have an id outside this shape.
+const SELECTION_ID_RE = /^selection_\d{4}-\d{2}-\d{2}_\d{3}$/;
+
+/**
+ * B03: atomic write helper — write temp + rename, mirroring the same
+ * temp-file-then-rename checkpoint pattern lib/batch-runs.js uses for its
+ * per-slot manifest checkpoint. Rename is atomic on a single filesystem, so
+ * a crash mid-write can never leave a half-written provenance.jsonl in
+ * place of a good one.
+ */
+async function atomicWriteText(targetPath, text) {
+  const tmpPath = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    await writeFile(tmpPath, text);
+    await rename(tmpPath, targetPath);
+  } catch (err) {
+    try { await unlink(tmpPath); } catch { /* ignore */ }
+    throw err;
+  }
+}
+
 /**
  * Re-ingest a selection — creates candidate records from chosen outputs.
  *
@@ -27,6 +56,14 @@ import { inputError } from './errors.js';
  * @returns {Promise<{created: string[], skipped: string[]}>}
  */
 export async function reingestSelection({ projectRoot, projectId, selectionId, dryRun }) {
+  if (typeof selectionId !== 'string' || !SELECTION_ID_RE.test(selectionId)) {
+    throw inputError(
+      'SELECTION_NOT_FOUND',
+      `Selection "${selectionId}" not found`,
+      'Check the selection ID or run: sdlab select --run <id> --approve <files>',
+    );
+  }
+
   const manifest = loadSelection(projectRoot, selectionId);
 
   if (!manifest.reingest_ready) {
@@ -69,7 +106,46 @@ export async function reingestSelection({ projectRoot, projectId, selectionId, d
 
   const created = [];
   const skipped = [];
+
+  // B03: provenance.jsonl is now built incrementally — checkpointed (atomic
+  // full-rewrite, temp+rename) after every item — instead of accumulated in
+  // memory and overwritten once at the end. `provenanceLines` seeds from
+  // whatever is ALREADY on disk (e.g. left by an interrupted prior run of
+  // this same selection) so: (a) a rerun never duplicates a line for a
+  // record it already logged, and (b) a partial rerun can never ERASE lines
+  // a previous call already committed — the old end-of-run `writeFile`
+  // overwrote with only the CURRENT call's accumulator, so a second call
+  // touching fewer items than the first could silently wipe out provenance
+  // the first call had already written to disk.
+  const provenancePath = join(selectionDir, 'provenance.jsonl');
   const provenanceLines = [];
+  const seenProvenanceIds = new Set();
+  if (existsSync(provenancePath)) {
+    for (const line of readFileSync(provenancePath, 'utf-8').split('\n')) {
+      if (!line.trim()) continue;
+      provenanceLines.push(line);
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed?.record_id) seenProvenanceIds.add(parsed.record_id);
+      } catch {
+        // Tolerate a corrupt/partial trailing line from a prior crash —
+        // keep it verbatim rather than dropping it, just don't index it.
+      }
+    }
+  }
+
+  /**
+   * Checkpoint one provenance line: skips dryRun, and skips a record_id
+   * that's already logged (idempotent — safe to call on both the fresh-write
+   * path and the skip/backfill path below).
+   */
+  async function checkpointProvenance(recordId, prov) {
+    if (dryRun) return;
+    if (seenProvenanceIds.has(recordId)) return;
+    provenanceLines.push(JSON.stringify({ record_id: recordId, ...prov }));
+    seenProvenanceIds.add(recordId);
+    await atomicWriteText(provenancePath, provenanceLines.join('\n') + '\n');
+  }
 
   // D-010: use entries() — not indexOf() — to avoid O(n^2) behavior and
   // silent duplicate-ID bugs when manifest.items contains structurally
@@ -88,12 +164,11 @@ export async function reingestSelection({ projectRoot, projectId, selectionId, d
     seenIds.add(recordId);
     const recordPath = join(recordsDir, `${recordId}.json`);
 
-    if (existsSync(recordPath)) {
-      skipped.push(recordId);
-      continue;
-    }
-
-    // Resolve the run manifest for this item
+    // Resolve the run manifest for this item + build its provenance BEFORE
+    // the existsSync check below — B03: a skipped (already-created) item
+    // still needs its provenance backfilled if an earlier interrupted run
+    // stopped short of appending it, so this can't be gated behind "the
+    // record is new".
     let runManifest;
     if (manifest.source_type === 'run') {
       runManifest = getRunManifest(manifest.source_id);
@@ -126,6 +201,16 @@ export async function reingestSelection({ projectRoot, projectId, selectionId, d
       projectRoot,
     });
 
+    if (existsSync(recordPath)) {
+      // B03: the record already landed on disk (this item was completed by
+      // a prior, possibly-interrupted run of this same re-ingest). Backfill
+      // its provenance line if that prior run never got to append one —
+      // never let a record exist with no corresponding provenance entry.
+      await checkpointProvenance(recordId, prov);
+      skipped.push(recordId);
+      continue;
+    }
+
     // Image source in selection/chosen/
     const srcImage = join(selectionDir, 'chosen', item.filename);
     const ext = extname(item.filename) || '.png';
@@ -166,18 +251,15 @@ export async function reingestSelection({ projectRoot, projectId, selectionId, d
       }
       // Write record
       await writeFile(recordPath, JSON.stringify(record, null, 2) + '\n');
+      // B03: checkpoint immediately after the record write (per-item,
+      // matching lib/batch-runs.js's per-slot checkpoint pattern) — NOT
+      // batched to the end of the run. A crash on item 120 of 200 must
+      // leave provenance for 1-119 durably on disk, not lose it because
+      // item 200 never finished.
+      await checkpointProvenance(recordId, prov);
     }
 
     created.push(recordId);
-    provenanceLines.push(JSON.stringify({ record_id: recordId, ...prov }));
-  }
-
-  // Write provenance log
-  if (!dryRun && provenanceLines.length > 0) {
-    await writeFile(
-      join(selectionDir, 'provenance.jsonl'),
-      provenanceLines.join('\n') + '\n',
-    );
   }
 
   return { created, skipped };