@moretea-labs/forge 1.7.0 → 1.7.2

package/src/runtime/workflow/schedules/store.ts

@@ -28,6 +28,7 @@ interface ScheduleRequestRecord {
   createdAt: string;
 }
 type CreateScheduleInput = Omit<RepositorySchedule, 'schemaVersion' | 'revision' | 'scheduleId' | 'createdAt' | 'updatedAt' | 'consecutiveFailures'>;
+type ScheduleMutableUpdate = Partial<Omit<RepositorySchedule, 'schemaVersion' | 'revision' | 'scheduleId' | 'repoId' | 'requestId' | 'createdAt' | 'updatedAt'>>;
 
 export interface ScheduleOccurrenceHandoffInput {
   title: string;
@@ -62,6 +63,30 @@ function occurrenceIndexPath(controllerHome: string, repoId: string): string {
 function requestPath(controllerHome: string, repoId: string, requestId: string): string {
   return join(schedulesRoot(controllerHome, repoId), 'indexes', 'requests', `${createHash('sha256').update(requestId).digest('hex')}.json`);
 }
+
+const EXTERNAL_CONTROLLER_WAKE_MAX_FAILURES = 3;
+const EXTERNAL_CONTROLLER_WAKE_DAILY_BUDGET_MINUTES = 60;
+const EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES = 10;
+
+function boundedSchedulePolicy(schedule: RepositorySchedule): RepositorySchedule['policy'] {
+  const policy = {
+    ...schedule.policy,
+    backoffBaseMinutes: Math.max(1, schedule.policy.backoffBaseMinutes ?? schedule.policy.cooldownMinutes ?? 1),
+    backoffMaxMinutes: Math.max(1, schedule.policy.backoffMaxMinutes ?? 24 * 60),
+  };
+  if (schedule.action.operation !== 'external_controller_wake') return policy;
+  // A Work-bound controller wake is expensive and can affect the user's
+  // browser. No schedule payload may convert a transient tool outage into an
+  // all-day retry loop. Larger work needs an explicit future user action after
+  // the bounded lane records useful failure evidence.
+  return {
+    ...policy,
+    maxFailures: Math.max(1, Math.min(policy.maxFailures, EXTERNAL_CONTROLLER_WAKE_MAX_FAILURES)),
+    dailyBudgetMinutes: Math.max(1, Math.min(policy.dailyBudgetMinutes, EXTERNAL_CONTROLLER_WAKE_DAILY_BUDGET_MINUTES)),
+    cooldownMinutes: Math.max(policy.cooldownMinutes, EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES),
+    backoffBaseMinutes: Math.max(policy.backoffBaseMinutes, EXTERNAL_CONTROLLER_WAKE_MIN_COOLDOWN_MINUTES),
+  };
+}
 function canonical(value: unknown): unknown {
   if (Array.isArray(value)) return value.map(canonical);
   if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value as Record<string, unknown>)
@@ -136,22 +161,62 @@ export function getSchedule(controllerHome: string, repoId: string, scheduleId:
     ...schedule,
     revision: Number.isFinite(schedule.revision) ? schedule.revision : 1,
     requestId: schedule.requestId || `legacy-schedule:${schedule.scheduleId}`,
-    policy: {
-      ...schedule.policy,
-      backoffBaseMinutes: Math.max(1, schedule.policy.backoffBaseMinutes ?? schedule.policy.cooldownMinutes ?? 1),
-      backoffMaxMinutes: Math.max(1, schedule.policy.backoffMaxMinutes ?? 24 * 60),
-    },
+    policy: boundedSchedulePolicy(schedule),
     consecutiveNoops: Math.max(0, schedule.consecutiveNoops ?? 0),
   };
 }
 
+function persistScheduleRevision(
+  controllerHome: string,
+  current: RepositorySchedule,
+  candidate: RepositorySchedule,
+): RepositorySchedule {
+  const next: RepositorySchedule = {
+    ...candidate,
+    schemaVersion: current.schemaVersion,
+    revision: current.revision + 1,
+    scheduleId: current.scheduleId,
+    repoId: current.repoId,
+    requestId: current.requestId,
+    createdAt: current.createdAt,
+    updatedAt: new Date().toISOString(),
+  };
+  writeJsonAtomic(schedulePath(controllerHome, next.repoId, next.scheduleId), next);
+  appendRuntimeEvent(controllerHome, { repoId: next.repoId, entityType: 'schedule', entityId: next.scheduleId, eventType: 'schedule_updated', requestId: next.requestId, revision: next.revision, data: { enabled: next.enabled, pausedReason: next.pausedReason } });
+  return next;
+}
+
+/**
+ * Persist a caller-owned Schedule snapshot only when its revision is still the
+ * current authority. User/configuration mutations use this path so stale
+ * writers fail closed instead of overwriting a newer decision.
+ */
 export function saveSchedule(controllerHome: string, schedule: RepositorySchedule): RepositorySchedule {
   return withControllerLock(controllerHome, { scope: 'task', repoId: schedule.repoId, taskId: `schedule-${schedule.scheduleId}` }, `save-schedule:${schedule.scheduleId}`, () => {
     const current = getSchedule(controllerHome, schedule.repoId, schedule.scheduleId);
-    const next = { ...schedule, revision: current.revision + 1, updatedAt: new Date().toISOString() };
-    writeJsonAtomic(schedulePath(controllerHome, next.repoId, next.scheduleId), next);
-    appendRuntimeEvent(controllerHome, { repoId: next.repoId, entityType: 'schedule', entityId: next.scheduleId, eventType: 'schedule_updated', requestId: next.requestId, revision: next.revision, data: { enabled: next.enabled, pausedReason: next.pausedReason } });
-    return next;
+    if (schedule.revision !== current.revision) {
+      throw new Error(`SCHEDULE_REVISION_CONFLICT: ${schedule.scheduleId}:expected=${schedule.revision}:actual=${current.revision}`);
+    }
+    return persistScheduleRevision(controllerHome, current, schedule);
+  }, 10_000);
+}
+
+/**
+ * Apply runtime-owned settlement/observation fields to the latest Schedule
+ * authority while holding the Schedule lock. Identity and revision fields are
+ * never writable through this path. Long-running occurrences use this instead
+ * of replaying a stale whole-record snapshot after user state may have changed.
+ */
+export function updateSchedule(
+  controllerHome: string,
+  repoId: string,
+  scheduleId: string,
+  update: (current: RepositorySchedule) => ScheduleMutableUpdate,
+): RepositorySchedule {
+  return withControllerLock(controllerHome, { scope: 'task', repoId, taskId: `schedule-${scheduleId}` }, `update-schedule:${scheduleId}`, () => {
+    const current = getSchedule(controllerHome, repoId, scheduleId);
+    const changes = update(current);
+    return persistScheduleRevision(controllerHome, current, { ...current, ...changes });
   }, 10_000);
 }
 
@@ -269,7 +334,11 @@ export function saveOccurrence(controllerHome: string, occurrence: ScheduleOccur
   const next = withControllerLock(controllerHome, { scope: 'task', repoId: occurrence.repoId, taskId: `schedule-${occurrence.scheduleId}` }, `save-occurrence:${occurrence.occurrenceId}`, () => {
     const existingPath = occurrencePath(controllerHome, occurrence.repoId, occurrence.occurrenceId);
     const previous = existsSync(existingPath) ? readJsonFile<ScheduleOccurrence>(existingPath) : undefined;
-    const saved = { ...occurrence, revision: (previous?.revision ?? occurrence.revision ?? 0) + 1, updatedAt: new Date().toISOString() };
+    const expectedRevision = previous?.revision ?? 0;
+    if (occurrence.revision !== expectedRevision) {
+      throw new Error(`SCHEDULE_OCCURRENCE_REVISION_CONFLICT: ${occurrence.occurrenceId}:expected=${occurrence.revision}:actual=${expectedRevision}`);
+    }
+    const saved = { ...occurrence, revision: expectedRevision + 1, updatedAt: new Date().toISOString() };
     writeJsonAtomic(existingPath, saved);
     upsertOccurrenceIndexUnlocked(controllerHome, saved);
     const schedule = getSchedule(controllerHome, saved.repoId, saved.scheduleId);