@muggleai/works 5.14.0-staging.97 → 5.14.0-staging.98
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -85,3 +85,33 @@ watcher_pid_alive() {
|
|
|
85
85
|
[ -n "$pid" ] || return 1
|
|
86
86
|
kill -0 "$pid" 2>/dev/null
|
|
87
87
|
}
|
|
88
|
+
|
|
89
|
+
# True when the slot's lease is held by a live loop that no longer belongs to the
|
|
90
|
+
# session arming now — the deaf-orphan case.
|
|
91
|
+
#
|
|
92
|
+
# A live PID proves the loop is running; it never proves anything is listening.
|
|
93
|
+
# On Windows a detached loop outlives the session that launched it, keeps
|
|
94
|
+
# polling, and keeps touching its heartbeat, while its stdout is the dead
|
|
95
|
+
# session's monitor pipe. Every liveness signal reads healthy and the events
|
|
96
|
+
# reach nobody. Because arming skipped on a live PID alone, that corpse blocked
|
|
97
|
+
# a live session from arming the PR for the whole lifetime cap — seven days
|
|
98
|
+
# since the default moved off six hours.
|
|
99
|
+
#
|
|
100
|
+
# Deliberately narrow. It answers only "is this lease held on behalf of some
|
|
101
|
+
# other session", which is decidable from state already on disk. It says nothing
|
|
102
|
+
# about a loop orphaned by its own session's monitor dying, where the owner still
|
|
103
|
+
# matches; that one needs a signal from the reader, which no file here carries.
|
|
104
|
+
#
|
|
105
|
+
# Conservative on every unknown — no watch.pid, a dead PID, no owner.json, or no
|
|
106
|
+
# current session id all answer false, so a slot is never reclaimed on a guess.
|
|
107
|
+
watcher_lease_is_foreign() {
|
|
108
|
+
local slot="$1" current_session="$2" owner_pid owner_session
|
|
109
|
+
[ -n "$current_session" ] || return 1
|
|
110
|
+
[ -f "${slot}/watch.pid" ] || return 1
|
|
111
|
+
owner_pid=$(tr -d ' \r\n' < "${slot}/watch.pid" 2>/dev/null)
|
|
112
|
+
watcher_pid_alive "$owner_pid" || return 1
|
|
113
|
+
[ -f "${slot}/owner.json" ] || return 1
|
|
114
|
+
owner_session=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "${slot}/owner.json" | head -1)
|
|
115
|
+
[ -n "$owner_session" ] || return 1
|
|
116
|
+
[ "$owner_session" != "$current_session" ]
|
|
117
|
+
}
|
|
@@ -14,7 +14,11 @@ Read the `DRAIN` lines it prints: they are the outstanding work the monitor will
|
|
|
14
14
|
|
|
15
15
|
1. **Drain.** Run one tick per [`contract.md`](contract.md). It acts on everything already outstanding — actionable threads (`gitlab`: discussions), body-only reviews past the watermark (GitHub-only — GitLab has no review envelope), a stale branch, red CI — and finalizes a terminal PR. If the tick dispatched a cycle, stop here: the cycle's exit path settles the watch when it finishes.
|
|
16
16
|
2. **Seed the watermark.** *(`pr-watch-arm.sh` does this; the reasoning is kept because the floors are subtle and wrong ones are quiet.)* Resolve the provider once per [`../_shared/vcs/detect-vcs.md`](../_shared/vcs/detect-vcs.md) — every fetch in this sequence uses that provider's recipes. Write the slot's watch watermark ([`state-schemas.md`](state-schemas.md#watch-watermarkenv)) to the ids the **drain itself read** — the max review-id and comment-id observed at the drain's own fetch (Step 1), snapshotted at that read. Never let the loop capture its own baseline — the arming session writes it; and **never** from a fresh fetch taken after the drain, which would include a comment that arrived after the drain read the wave and mark it seen unread. Seeded to the drain's floor, anything landing after that read stays above the watermark and the monitor's first iteration surfaces it. Seed the CI floor (`CIRED`) from the same drain read: set it to the head SHA when the checks have **already settled red** at that read (no check pending, one or more in the `fail` bucket per [`../_shared/vcs/common/ci-rollup.md`](../_shared/vcs/common/ci-rollup.md)) — that red is what the drain just handled — and empty otherwise, so an escalated red head the drain already saw does not re-fire on the loop's first iteration. Seed the rebase floor (`REBASED`) the same way, from the drain's branch-standing read per [`../_shared/vcs/common/branch-standing.md`](../_shared/vcs/common/branch-standing.md): set it to the current `rebase_key` (`<head_sha>..<base_tip_sha>`) when the drain found the branch already behind or conflicting — that staleness is what the drain just handled — and empty otherwise, so a branch the drain already rebased or escalated does not re-fire on the loop's first iteration. Seed the blocked-CI floor (`BLOCKED_CIDIGEST`) to the blocked fingerprint's `ci_digest` when arming while `last_seen.blocked` is already set, and empty otherwise — empty is the not-blocked state, in which the loop's blocked-resume probe stays dormant.
|
|
17
|
-
3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds)
|
|
17
|
+
3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds) **and `owner.json` records this session**, a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
|
|
18
|
+
|
|
19
|
+
**A live lease owned by a different session does not count as owned** — check it with `watcher_lease_is_foreign` from [`../../scripts/pr-watch-guards.sh`](../../scripts/pr-watch-guards.sh). A live PID proves the loop is running, never that anything is listening: an orphan left by a dead session keeps polling and keeps touching its heartbeat while its stdout is that session's closed monitor pipe, so every liveness signal reads healthy and the events reach nobody. Skipping on the PID alone let such a corpse block this session from arming the PR for the whole lifetime cap — seven days, since the default moved off six hours. When the guard reports a foreign lease, kill that PID, delete `watch.pid`, and arm fresh; note it in the slot's `followup.log` so the reclaim is visible.
|
|
20
|
+
|
|
21
|
+
This is narrow on purpose. It reclaims only a lease held on behalf of *another* session, which is decidable from `owner.json` alone. A loop orphaned by its **own** session's monitor dying still reads as owned, and nothing on disk distinguishes it — that needs a signal from the reader, which no slot file carries. Treat an armed watcher as evidence a poller exists, never as proof a review will be seen.
|
|
18
22
|
|
|
19
23
|
Otherwise **claim the slot for this session** before starting anything: write `owner.json` ([`state-schemas.md`](state-schemas.md#ownerjson)) with `session_id` from `$CLAUDE_CODE_SESSION_ID` and `claimed_at` now. Arming is what establishes ownership, so every arming point records it here rather than each caller remembering to. If `$CLAUDE_CODE_SESSION_ID` is unset, write no `owner.json` — an unidentifiable owner is worse than none, since [`reconcile.md`](reconcile.md) would read a bogus id as some other session's claim and could never recover the slot.
|
|
20
24
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"release": "5.13.0",
|
|
3
|
-
"buildId": "run-
|
|
4
|
-
"commitSha": "
|
|
5
|
-
"buildTime": "2026-09-
|
|
3
|
+
"buildId": "run-98-1",
|
|
4
|
+
"commitSha": "e54fb7c620d882db7a9333d6f2e252fbd6c6c543",
|
|
5
|
+
"buildTime": "2026-09-05T01:07:04Z",
|
|
6
6
|
"serviceName": "muggle-ai-works-mcp"
|
|
7
7
|
}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@muggleai/works",
|
|
3
3
|
"mcpName": "io.github.multiplex-ai/muggle",
|
|
4
|
-
"version": "5.14.0-staging.
|
|
4
|
+
"version": "5.14.0-staging.98",
|
|
5
5
|
"description": "Ship quality products with AI-powered E2E acceptance testing that validates your web app like a real user — from Claude Code and Cursor to PR.",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "dist/index.js",
|
|
@@ -85,3 +85,33 @@ watcher_pid_alive() {
|
|
|
85
85
|
[ -n "$pid" ] || return 1
|
|
86
86
|
kill -0 "$pid" 2>/dev/null
|
|
87
87
|
}
|
|
88
|
+
|
|
89
|
+
# True when the slot's lease is held by a live loop that no longer belongs to the
|
|
90
|
+
# session arming now — the deaf-orphan case.
|
|
91
|
+
#
|
|
92
|
+
# A live PID proves the loop is running; it never proves anything is listening.
|
|
93
|
+
# On Windows a detached loop outlives the session that launched it, keeps
|
|
94
|
+
# polling, and keeps touching its heartbeat, while its stdout is the dead
|
|
95
|
+
# session's monitor pipe. Every liveness signal reads healthy and the events
|
|
96
|
+
# reach nobody. Because arming skipped on a live PID alone, that corpse blocked
|
|
97
|
+
# a live session from arming the PR for the whole lifetime cap — seven days
|
|
98
|
+
# since the default moved off six hours.
|
|
99
|
+
#
|
|
100
|
+
# Deliberately narrow. It answers only "is this lease held on behalf of some
|
|
101
|
+
# other session", which is decidable from state already on disk. It says nothing
|
|
102
|
+
# about a loop orphaned by its own session's monitor dying, where the owner still
|
|
103
|
+
# matches; that one needs a signal from the reader, which no file here carries.
|
|
104
|
+
#
|
|
105
|
+
# Conservative on every unknown — no watch.pid, a dead PID, no owner.json, or no
|
|
106
|
+
# current session id all answer false, so a slot is never reclaimed on a guess.
|
|
107
|
+
watcher_lease_is_foreign() {
|
|
108
|
+
local slot="$1" current_session="$2" owner_pid owner_session
|
|
109
|
+
[ -n "$current_session" ] || return 1
|
|
110
|
+
[ -f "${slot}/watch.pid" ] || return 1
|
|
111
|
+
owner_pid=$(tr -d ' \r\n' < "${slot}/watch.pid" 2>/dev/null)
|
|
112
|
+
watcher_pid_alive "$owner_pid" || return 1
|
|
113
|
+
[ -f "${slot}/owner.json" ] || return 1
|
|
114
|
+
owner_session=$(sed -n 's/.*"session_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "${slot}/owner.json" | head -1)
|
|
115
|
+
[ -n "$owner_session" ] || return 1
|
|
116
|
+
[ "$owner_session" != "$current_session" ]
|
|
117
|
+
}
|
|
@@ -14,7 +14,11 @@ Read the `DRAIN` lines it prints: they are the outstanding work the monitor will
|
|
|
14
14
|
|
|
15
15
|
1. **Drain.** Run one tick per [`contract.md`](contract.md). It acts on everything already outstanding — actionable threads (`gitlab`: discussions), body-only reviews past the watermark (GitHub-only — GitLab has no review envelope), a stale branch, red CI — and finalizes a terminal PR. If the tick dispatched a cycle, stop here: the cycle's exit path settles the watch when it finishes.
|
|
16
16
|
2. **Seed the watermark.** *(`pr-watch-arm.sh` does this; the reasoning is kept because the floors are subtle and wrong ones are quiet.)* Resolve the provider once per [`../_shared/vcs/detect-vcs.md`](../_shared/vcs/detect-vcs.md) — every fetch in this sequence uses that provider's recipes. Write the slot's watch watermark ([`state-schemas.md`](state-schemas.md#watch-watermarkenv)) to the ids the **drain itself read** — the max review-id and comment-id observed at the drain's own fetch (Step 1), snapshotted at that read. Never let the loop capture its own baseline — the arming session writes it; and **never** from a fresh fetch taken after the drain, which would include a comment that arrived after the drain read the wave and mark it seen unread. Seeded to the drain's floor, anything landing after that read stays above the watermark and the monitor's first iteration surfaces it. Seed the CI floor (`CIRED`) from the same drain read: set it to the head SHA when the checks have **already settled red** at that read (no check pending, one or more in the `fail` bucket per [`../_shared/vcs/common/ci-rollup.md`](../_shared/vcs/common/ci-rollup.md)) — that red is what the drain just handled — and empty otherwise, so an escalated red head the drain already saw does not re-fire on the loop's first iteration. Seed the rebase floor (`REBASED`) the same way, from the drain's branch-standing read per [`../_shared/vcs/common/branch-standing.md`](../_shared/vcs/common/branch-standing.md): set it to the current `rebase_key` (`<head_sha>..<base_tip_sha>`) when the drain found the branch already behind or conflicting — that staleness is what the drain just handled — and empty otherwise, so a branch the drain already rebased or escalated does not re-fire on the loop's first iteration. Seed the blocked-CI floor (`BLOCKED_CIDIGEST`) to the blocked fingerprint's `ci_digest` when arming while `last_seen.blocked` is already set, and empty otherwise — empty is the not-blocked state, in which the loop's blocked-resume probe stays dormant.
|
|
17
|
-
3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds)
|
|
17
|
+
3. **Dedup, then watch.** First read `<slot>/watch.pid` ([`state-schemas.md`](state-schemas.md#watchpid)): if it names a live process (`kill -0 "$pid"` succeeds) **and `owner.json` records this session**, a watcher already owns this slot — **skip arming, do not start a second**. This is what stops orphaned watchers from accumulating: the in-session monitor dying does not stop the OS loop it launched (on Windows a detached Git Bash loop keeps running and polling `gh` forever after the session ends), so checking a live task list is not enough — the PID lease is.
|
|
18
|
+
|
|
19
|
+
**A live lease owned by a different session does not count as owned** — check it with `watcher_lease_is_foreign` from [`../../scripts/pr-watch-guards.sh`](../../scripts/pr-watch-guards.sh). A live PID proves the loop is running, never that anything is listening: an orphan left by a dead session keeps polling and keeps touching its heartbeat while its stdout is that session's closed monitor pipe, so every liveness signal reads healthy and the events reach nobody. Skipping on the PID alone let such a corpse block this session from arming the PR for the whole lifetime cap — seven days, since the default moved off six hours. When the guard reports a foreign lease, kill that PID, delete `watch.pid`, and arm fresh; note it in the slot's `followup.log` so the reclaim is visible.
|
|
20
|
+
|
|
21
|
+
This is narrow on purpose. It reclaims only a lease held on behalf of *another* session, which is decidable from `owner.json` alone. A loop orphaned by its **own** session's monitor dying still reads as owned, and nothing on disk distinguishes it — that needs a signal from the reader, which no slot file carries. Treat an armed watcher as evidence a poller exists, never as proof a review will be seen.
|
|
18
22
|
|
|
19
23
|
Otherwise **claim the slot for this session** before starting anything: write `owner.json` ([`state-schemas.md`](state-schemas.md#ownerjson)) with `session_id` from `$CLAUDE_CODE_SESSION_ID` and `claimed_at` now. Arming is what establishes ownership, so every arming point records it here rather than each caller remembering to. If `$CLAUDE_CODE_SESSION_ID` is unset, write no `owner.json` — an unidentifiable owner is worse than none, since [`reconcile.md`](reconcile.md) would read a bogus id as some other session's claim and could never recover the slot.
|
|
20
24
|
|