@naxodev/apnea 0.2.0 → 0.2.1

package/extension/workflows/dispatch.ts

@@ -1,6 +1,10 @@
 import * as path from "node:path"
 import { Cause, Clock, Effect, Exit, Result } from "effect"
+import { inferKind } from "../domain/artifact-kind.ts"
+import { parseFrontMatter } from "../domain/frontmatter.ts"
+import { looksLikeShellOnly } from "../domain/herdr.ts"
 import {
+  abs,
   packageRoot,
   phaseDir,
   planPath,
@@ -17,16 +21,22 @@ import {
   toolAllowed,
   type DispatchKind,
 } from "../domain/state-machine.ts"
-import { timeoutMsForKind } from "../domain/timeouts.ts"
+import { deadlineAfter, timeoutMsForKind } from "../domain/timeouts.ts"
 import {
+  ArtifactInvalid,
   GateRefused,
   HerdrError,
   IllegalKind,
   type AppError,
 } from "../errors.ts"
 import type { Role } from "../domain/types.ts"
-import { ROLE_MODE } from "../domain/types.ts"
+import {
+  LEGACY_CODE_REWORK,
+  LEGACY_PLAN_REWORK,
+  ROLE_MODE,
+} from "../domain/types.ts"
 import { ok, type ToolResult } from "../result.ts"
+import { validateArtifactCompletion } from "../schema/frontmatter.ts"
 import { Config } from "../services/config.ts"
 import { FileSystem } from "../services/file-system.ts"
 import { Herdr } from "../services/herdr.ts"
@@ -36,8 +46,10 @@ import { Vcs } from "../services/vcs.ts"
 export type DispatchParams = {
   kind: DispatchKind
   task_markdown?: string
-  /** Increment round after CHANGES_REQUIRED (protocol: only then). */
+  /** @deprecated Assertion only. Persisted state owns rework through 0.2.x. */
   rework?: boolean
+  /** Reuse persisted pending ownership after a demonstrably dead delivery. */
+  redeliver?: boolean
 }
 
 function taskBody(opts: {
@@ -134,14 +146,14 @@ export const dispatchWorkflow = (
     const herdr = yield* Herdr
 
     const state = yield* store.require(root)
-    const stateBeforeDispatch = structuredClone(state)
+    const redeliver = params.redeliver === true
 
     const allowed = toolAllowed(state.step, "dispatch_role")
     if (Result.isFailure(allowed)) {
       return yield* allowed.failure
     }
 
-    if (state.pending_artifact != null) {
+    if (state.pending_artifact != null && !redeliver) {
       return yield* new GateRefused({
         gate: "dispatch_pending",
         message:
@@ -153,6 +165,110 @@ export const dispatchWorkflow = (
         },
       })
     }
+    if (state.pending_artifact == null && redeliver) {
+      return yield* new GateRefused({
+        gate: "redelivery",
+        message: "redeliver=true requires an existing pending dispatch",
+      })
+    }
+
+    const role = expectedRole(params.kind)
+    const pendingArtifact = state.pending_artifact
+    if (redeliver && pendingArtifact != null) {
+      const inferred = inferKind(pendingArtifact)
+      if (Result.isFailure(inferred) || inferred.success !== params.kind) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: `pending artifact does not belong to ${params.kind}`,
+          details: {
+            pending_artifact: pendingArtifact,
+            inferred_kind: Result.isSuccess(inferred)
+              ? inferred.success
+              : "unknown",
+          },
+        })
+      }
+      if (state.pending_role !== role) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: `pending role does not match ${params.kind}`,
+          details: { pending_role: state.pending_role, expected_role: role },
+        })
+      }
+      const pendingAbs = abs(pendingArtifact, root)
+      if (yield* fs.projectPathExists(root, pendingAbs)) {
+        const pendingText = yield* fs.readProjectFile(root, pendingAbs).pipe(
+          Effect.mapError(
+            (error) =>
+              new ArtifactInvalid({
+                artifact: pendingArtifact,
+                message: error.message,
+              }),
+          ),
+        )
+        const frontmatter = parseFrontMatter(pendingText)
+        const completion = validateArtifactCompletion(
+          inferred.success,
+          frontmatter,
+          pendingArtifact,
+        )
+        if (Result.isSuccess(completion) && completion.success !== null) {
+          return yield* new GateRefused({
+            gate: "redelivery",
+            message:
+              "pending artifact is already complete; call workflow_wait instead of redelivering",
+            details: {
+              artifact: pendingArtifact,
+              kind: inferred.success,
+              verdict: completion.success.frontmatter.verdict ?? null,
+              next: "workflow_wait",
+              guidance: "call workflow_wait to ingest the completed artifact",
+            },
+          })
+        }
+      }
+      if (state.pending_delivery === null) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message:
+            "pending delivery mode is unknown; null-pane legacy ownership is ambiguous",
+          details: { pending_delivery: null, liveness: "ambiguous" },
+        })
+      }
+      if (
+        state.pending_delivery === "interactive" &&
+        state.pending_pane_id === null
+      ) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message:
+            "interactive delivery has no persisted pane id; prior acceptance is ambiguous",
+          details: { pending_delivery: "interactive", liveness: "ambiguous" },
+        })
+      }
+      if (
+        state.pending_delivery === "manual" &&
+        state.pending_pane_id !== null
+      ) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: "manual delivery cannot own an interactive pane",
+          details: {
+            pending_delivery: "manual",
+            pane_id: state.pending_pane_id,
+            liveness: "ambiguous",
+          },
+        })
+      }
+      if (state.required_rework !== null || params.rework === true) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message:
+            "redelivery reuses consumed ownership and cannot start or assert rework",
+          details: { required_rework: state.required_rework },
+        })
+      }
+    }
 
     const kinds = allowedKinds(state.step)
     if (!kinds.includes(params.kind)) {
@@ -163,40 +279,109 @@ export const dispatchWorkflow = (
       })
     }
 
-    // Rework flag validation
-    if (params.rework) {
-      const okRework =
-        (params.kind === "plan" && state.step === "planning") ||
-        (params.kind === "code" && state.step === "coding") ||
-        (params.kind === "phase_package" &&
-          state.step === "phase_packaging" &&
-          state.phase_package_rework) ||
-        (params.kind === "plan_review" && state.step === "plan_review") ||
-        (params.kind === "code_review" && state.step === "code_review")
-      // After CHANGES_REQUIRED, step moves back to planning/coding; rework
-      // dispatch is plan/code with rework=true.
-      if (!okRework && !(params.kind === "plan" || params.kind === "code")) {
-        return yield* new GateRefused({
-          gate: "rework",
-          message:
-            "rework=true only valid for plan/code after CHANGES_REQUIRED, phase_package after package rework, or same-gate re-review",
-        })
-      }
+    const legacyPlanAssertion =
+      state[LEGACY_PLAN_REWORK] === true &&
+      state.step === "planning" &&
+      params.kind === "plan" &&
+      params.rework === true
+    const legacyCodeAssertion =
+      state[LEGACY_CODE_REWORK] === true &&
+      state.step === "coding" &&
+      params.kind === "code" &&
+      params.rework === true
+    if (legacyPlanAssertion) state.required_rework = "plan"
+    if (legacyCodeAssertion) state.required_rework = "code"
+
+    const requiredRework = state.required_rework
+    if (params.rework === true && requiredRework === null) {
+      return yield* new GateRefused({
+        gate: "rework",
+        message:
+          "rework=true is only a deprecated assertion; state has no required rework",
+      })
     }
+    if (requiredRework !== null && params.kind !== requiredRework) {
+      return yield* new GateRefused({
+        gate: "rework",
+        message: `state requires ${requiredRework} rework before dispatching ${params.kind}`,
+        details: { required_rework: requiredRework },
+      })
+    }
+    const isRework = !redeliver && requiredRework === params.kind
+    const stateBeforeDispatch = structuredClone(state)
 
-    const role = expectedRole(params.kind)
     const cfg = yield* config.load(root)
     const roleTimeoutMs = timeoutMsForKind(params.kind, cfg.timeouts_ms)
     // Validate the orchestrator's current pane before creating task artifacts.
     // A stale inherited environment is equivalent to running outside Herdr;
     // other CLI failures remain typed errors and stop dispatch.
-    const herdrAvailability = yield* herdr.availability
+    const availability = yield* Effect.result(herdr.availability)
+    if (Result.isFailure(availability)) {
+      if (redeliver && state.pending_pane_id != null) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: "cannot verify whether the prior pane is still live",
+          details: { pane_id: state.pending_pane_id, liveness: "ambiguous" },
+        })
+      }
+      return yield* availability.failure
+    }
+    const herdrAvailability = availability.success
+
+    if (redeliver && state.pending_pane_id != null) {
+      if (herdrAvailability !== "available") {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message:
+            "cannot prove the prior pane is dead while Herdr is unavailable",
+          details: { pane_id: state.pending_pane_id, liveness: "ambiguous" },
+        })
+      }
+      const pane = yield* Effect.exit(herdr.paneGet(state.pending_pane_id))
+      if (Exit.isFailure(pane)) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: "cannot verify whether the prior pane is still live",
+          details: { pane_id: state.pending_pane_id, liveness: "ambiguous" },
+        })
+      }
+      if (!pane.value.ok && pane.value.missing !== true) {
+        return yield* new GateRefused({
+          gate: "redelivery",
+          message: "prior pane lookup failed without proof that it is missing",
+          details: { pane_id: state.pending_pane_id, liveness: "ambiguous" },
+        })
+      }
+      if (pane.value.ok && pane.value.agent_status !== "done") {
+        const foreground = yield* Effect.exit(
+          herdr.paneForegroundNames(state.pending_pane_id),
+        )
+        const shellOnly =
+          Exit.isSuccess(foreground) && looksLikeShellOnly(foreground.value)
+        if (!shellOnly) {
+          const status = pane.value.agent_status ?? "unknown"
+          return yield* new GateRefused({
+            gate: "redelivery",
+            message: `prior pane is ${status}; refusing duplicate delivery`,
+            details: {
+              pane_id: state.pending_pane_id,
+              liveness:
+                status === "working" ||
+                status === "blocked" ||
+                status === "idle"
+                  ? "live"
+                  : "ambiguous",
+            },
+          })
+        }
+      }
+    }
 
     // --- Round numbers (increment ONLY on rework after CHANGES_REQUIRED) ---
     let round = 1
     if (params.kind === "plan" || params.kind === "plan_review") {
       const key = roundKey(0, "plan_review")
-      if (params.rework && params.kind === "plan") {
+      if (isRework && params.kind === "plan") {
         // starting a new plan revision after CHANGES_REQUIRED → next review round
         setRound(state, key, getRound(state, key) + 1)
       } else if (!state.rounds[key]) {
@@ -209,12 +394,9 @@ export const dispatchWorkflow = (
       params.kind === "phase_package"
     ) {
       const key = codeReviewRoundKey(state.phase_index)
-      if (params.rework && params.kind === "code") {
+      if (isRework && params.kind === "code") {
         setRound(state, key, getRound(state, key) + 1)
-      } else if (
-        params.kind === "phase_package" &&
-        state.phase_package_rework
-      ) {
+      } else if (isRework && params.kind === "phase_package") {
         setRound(state, key, getRound(state, key) + 1)
       } else if (!state.rounds[key]) {
         setRound(state, key, 1)
@@ -228,6 +410,7 @@ export const dispatchWorkflow = (
         ? roundKey(0, "plan_review")
         : codeReviewRoundKey(state.phase_index)
     if (
+      !redeliver &&
       (params.kind === "plan" ||
         params.kind === "code" ||
         params.kind === "phase_package" ||
@@ -264,7 +447,7 @@ export const dispatchWorkflow = (
         artifactAbs = path.join(d, "phase-package.md")
         extra =
           extra ||
-          (state.phase_package_rework
+          (isRework || (redeliver && state.current_code_review !== null)
             ? `Revise the phase ${state.phase_index} package after code review \`${state.current_code_review}\`. Preserve approved-plan scope and address package findings.`
             : `Emit phase package for phase ${state.phase_index} only from approved plan \`${rel(planPath(root), root)}\`.`)
         break
@@ -304,6 +487,20 @@ export const dispatchWorkflow = (
         break
     }
 
+    const artifactRel = rel(artifactAbs, root)
+    if (redeliver && artifactRel !== pendingArtifact) {
+      return yield* new GateRefused({
+        gate: "redelivery",
+        message: "pending artifact is not the current phase and round target",
+        details: {
+          pending_artifact: pendingArtifact,
+          expected_artifact: artifactRel,
+          phase_index: state.phase_index,
+          round,
+        },
+      })
+    }
+
     // Resolve the brief BEFORE clear-before-dispatch. This block can refuse,
     // and the rename below is a mutation: refusing after it left the prior
     // artifact stranded at a timestamped .bak path, so a failed dispatch
@@ -359,15 +556,14 @@ export const dispatchWorkflow = (
     }
 
     // clear-before-dispatch
-    yield* fs.mkdir(path.dirname(artifactAbs), { recursive: true })
+    yield* fs.mkdirProject(root, path.dirname(artifactAbs))
     let backupAbs: string | null = null
-    if (yield* fs.exists(artifactAbs)) {
+    if (yield* fs.projectPathExists(root, artifactAbs)) {
       const backupMillis = yield* Clock.currentTimeMillis
       backupAbs = `${artifactAbs}.bak.${backupMillis}`
-      yield* fs.rename(artifactAbs, backupAbs)
+      yield* fs.renameProjectFile(root, artifactAbs, backupAbs)
     }
 
-    const artifactRel = rel(artifactAbs, root)
     const body = taskBody({
       kind: params.kind,
       role,
@@ -382,14 +578,14 @@ export const dispatchWorkflow = (
       tasksDir(root),
       `${params.kind}-p${state.phase_index}-r${round}-${taskFileMillis}.md`,
     )
-    while (yield* fs.exists(taskFile)) {
+    while (yield* fs.projectPathExists(root, taskFile)) {
       taskFileMillis += 1
       taskFile = path.join(
         tasksDir(root),
         `${params.kind}-p${state.phase_index}-r${round}-${taskFileMillis}.md`,
       )
     }
-    yield* fs.writeFile(taskFile, body)
+    yield* fs.writeProjectFile(root, taskFile, body)
     const taskRef = {
       task: rel(taskFile, root),
       artifact: artifactRel,
@@ -410,19 +606,25 @@ export const dispatchWorkflow = (
     const rollbackLaunch = (restoreState = true) =>
       Effect.gen(function* () {
         const errors: string[] = []
-        const attempt = (label: string, operation: Effect.Effect<void>) =>
+        const attempt = (
+          label: string,
+          operation: Effect.Effect<void, unknown>,
+        ) =>
           Effect.gen(function* () {
             const exit = yield* Effect.exit(operation)
             if (Exit.isFailure(exit)) {
               errors.push(`${label}: ${Cause.pretty(exit.cause)}`)
             }
           })
-        yield* attempt("remove task", fs.remove(taskFile))
-        yield* attempt("remove replacement artifact", fs.remove(artifactAbs))
+        yield* attempt("remove task", fs.removeProjectFile(root, taskFile))
+        yield* attempt(
+          "remove replacement artifact",
+          fs.removeProjectFile(root, artifactAbs),
+        )
         if (backupAbs != null) {
           yield* attempt(
             "restore prior artifact",
-            fs.rename(backupAbs, artifactAbs),
+            fs.renameProjectFile(root, backupAbs, artifactAbs),
           )
         }
         if (restoreState) {
@@ -434,19 +636,26 @@ export const dispatchWorkflow = (
         return errors
       })
 
-    const markPending = (launchedAt: number): void => {
+    const markPending = (
+      launchedAt: number,
+      delivery: "manual" | "interactive",
+    ): void => {
       state.pending_artifact = artifactRel
       state.pending_role = role
+      state.pending_delivery = delivery
       state.pending_started_at = launchedAt
-      state.pending_deadline_ms = launchedAt + roleTimeoutMs
-      if (params.kind === "phase_package") state.phase_package_rework = false
+      state.pending_deadline_ms = deadlineAfter(launchedAt, roleTimeoutMs)
+      if (isRework) state.required_rework = null
       resetRecoveryLadder(state)
     }
 
     // Persist ownership before crossing an external launch boundary. If this
     // process dies after Herdr accepts work, a retry must not start a duplicate.
     const preparedAt = yield* Clock.currentTimeMillis
-    markPending(preparedAt)
+    markPending(
+      preparedAt,
+      herdrAvailability === "unavailable" ? "manual" : "interactive",
+    )
     state.pending_pane_id = null
     state.pending_pane_label = null
     const preparedState = yield* Effect.exit(store.save(state, root))
@@ -497,14 +706,22 @@ export const dispatchWorkflow = (
     )
     if (Result.isFailure(launched)) {
       if (launched.failure.details?.delivery === "unknown") {
-        const paneId = String(launched.failure.details.pane_id)
-        const paneLabel = String(launched.failure.details.pane_label)
-        state.pending_pane_id = paneId
-        state.pending_pane_label = paneLabel
-        state.role_panes[role] = {
-          pane_id: paneId,
-          label: paneLabel,
-          profile_fingerprint: profileFingerprint,
+        const paneId = launched.failure.details.pane_id
+        const paneLabel = launched.failure.details.pane_label
+        // Only a pane-backed save actually preserves pending ownership; a
+        // split failure never reached the state machine, so claiming
+        // `pending_preserved` here would send operators to redeliver against
+        // ownership that was never written.
+        const preserved =
+          typeof paneId === "string" && typeof paneLabel === "string"
+        if (preserved) {
+          state.pending_pane_id = paneId
+          state.pending_pane_label = paneLabel
+          state.role_panes[role] = {
+            pane_id: paneId,
+            label: paneLabel,
+            profile_fingerprint: profileFingerprint,
+          }
         }
         yield* store.save(state, root)
         return yield* new HerdrError({
@@ -516,7 +733,7 @@ export const dispatchWorkflow = (
             ...(launched.failure.details ?? {}),
             task_attempted: taskRef.task,
             artifact: artifactRel,
-            pending_preserved: true,
+            pending_preserved: preserved,
           },
         })
       }
@@ -555,7 +772,7 @@ export const dispatchWorkflow = (
     // the top of the workflow charged that startup against the role's own
     // deadline and burned wait's 12s liveness grace before the first poll.
     const launchedAt = yield* Clock.currentTimeMillis
-    markPending(launchedAt)
+    markPending(launchedAt, "interactive")
     yield* store.save(state, root)
 
     return ok(

package/extension/workflows/setup.ts

@@ -1,4 +1,5 @@
 import * as path from "node:path"
+import * as os from "node:os"
 import { Effect, Result } from "effect"
 import { globalConfigPath, projectConfigPath } from "../domain/paths.ts"
 import {
@@ -9,7 +10,7 @@ import {
 } from "../domain/setup.ts"
 import { ConfigError, type AppError } from "../errors.ts"
 import { ok, type ToolResult } from "../result.ts"
-import { decodeGlobalConfig } from "../schema/config.ts"
+import { decodeGlobalConfig, decodeProjectConfig } from "../schema/config.ts"
 import { FileSystem } from "../services/file-system.ts"
 
 export type SetupParams = {
@@ -70,6 +71,8 @@ export type SetupDeps = {
   onPath: (bin: string) => boolean
   /** Prepare host-specific role resources, or return null when none are needed. */
   materializeRoleAgentDir: () => string | null
+  /** Trusted account home. Production uses node:os.homedir(). */
+  trustedHome?: () => string
 }
 
 /**
@@ -84,24 +87,6 @@ export const setupWorkflow = (
   Effect.gen(function* () {
     const fs = yield* FileSystem
 
-    const readJsonSafe = (
-      filePath: string,
-    ): Effect.Effect<Record<string, unknown>> =>
-      Effect.gen(function* () {
-        const present = yield* fs.exists(filePath)
-        if (!present) return {}
-        const text = yield* fs.readFile(filePath)
-        try {
-          const v = JSON.parse(text)
-          if (v && typeof v === "object" && !Array.isArray(v)) {
-            return v as Record<string, unknown>
-          }
-          return {}
-        } catch {
-          return {}
-        }
-      })
-
     const has: Detected = {
       pi: deps.onPath("pi"),
       claude: deps.onPath("claude"),
@@ -118,27 +103,64 @@ export const setupWorkflow = (
       })
     }
 
-    const gPath = globalConfigPath()
-    yield* fs.mkdir(path.dirname(gPath), { recursive: true })
+    const trustedHome = deps.trustedHome?.() ?? os.homedir()
+    const gPath = globalConfigPath(trustedHome)
 
-    const prev = yield* readJsonSafe(gPath)
     const force = params.force === true
+    let replacedMalformedGlobal = false
+    let prev: Record<string, unknown> = {}
+    if (yield* fs.exists(gPath)) {
+      const text = yield* fs.readTrustedGlobalFile(trustedHome, gPath)
+      try {
+        const parsed: unknown = JSON.parse(text)
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+          throw new Error("global config must be a JSON object")
+        }
+        prev = parsed as Record<string, unknown>
+      } catch (error) {
+        if (!force) {
+          return yield* new ConfigError({
+            message: `existing global config is malformed; refusing to replace it without --force: ${error instanceof Error ? error.message : String(error)}`,
+            path: gPath,
+          })
+        }
+        replacedMalformedGlobal = true
+      }
+    }
     const globalConfig = buildGlobalConfig({ has, prev, force })
 
     const serialized = `${JSON.stringify(globalConfig, null, 2)}\n`
-    yield* fs.writeFile(gPath, serialized)
 
     let projectPath: string | null = null
     if (params.project) {
       const pPath = projectConfigPath(root)
+      if (yield* fs.projectPathExists(root, pPath)) {
+        const text = yield* fs.readProjectFile(root, pPath)
+        let parsed: unknown
+        try {
+          parsed = JSON.parse(text)
+        } catch (error) {
+          return yield* new ConfigError({
+            message: `invalid JSON at ${pPath}: ${error instanceof Error ? error.message : String(error)}`,
+            path: pPath,
+          })
+        }
+        const decoded = decodeProjectConfig(parsed)
+        if (Result.isFailure(decoded)) return yield* decoded.failure
+      }
+      projectPath = pPath
+    }
+
+    yield* fs.writeTrustedGlobalFile(trustedHome, gPath, serialized)
+
+    if (projectPath) {
       // project: roles only — never cmd
       const projectCfg = { roles: pickRoles(has) }
       yield* fs.writeProjectFile(
         root,
-        pPath,
+        projectPath,
         `${JSON.stringify(projectCfg, null, 2)}\n`,
       )
-      projectPath = pPath
     }
 
     const missing = detectionNotes(has)
@@ -162,15 +184,14 @@ export const setupWorkflow = (
     let agentsMdPath: string | null = null
     if (params.agents_md) {
       const target = path.join(root, "AGENTS.md")
-      const present = yield* fs.exists(target)
-      const existing = present ? yield* fs.readFile(target) : null
-      yield* fs.writeFile(target, mergeAgentsMd(existing))
+      const present = yield* fs.projectPathExists(root, target)
+      const existing = present ? yield* fs.readProjectFile(root, target) : null
+      yield* fs.writeProjectFile(root, target, mergeAgentsMd(existing))
       agentsMdPath = target
     }
 
-    // A failed decode after writing is a note, not a failure — a user with a
-    // malformed pre-existing config must still get a written config and an
-    // actionable note, never a hard refusal where today there is none.
+    // Generated defaults can still inherit malformed profile or role shapes
+    // from valid JSON. Report those separately from JSON parse refusals.
     const decoded = decodeGlobalConfig(globalConfig)
     if (Result.isFailure(decoded)) {
       missing.push(
@@ -190,5 +211,11 @@ export const setupWorkflow = (
     if (params.agents_md) {
       data.agents_md = agentsMdPath
     }
-    return ok(`wrote global config ${gPath}`, data)
+    if (replacedMalformedGlobal) data.replaced_malformed_global = true
+    return ok(
+      replacedMalformedGlobal
+        ? `replaced malformed global config ${gPath}`
+        : `wrote global config ${gPath}`,
+      data,
+    )
   })