@ngockhoale/ukit 2.7.7 → 2.7.9

package/templates/.claude/ukit/runtime/token-utils.mjs

@@ -3,6 +3,8 @@ import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 
+import { journalDroppedLockMutation, withAsyncLock } from './async-lock.mjs';
+
 export const DEFAULT_PROMPT_CACHE_MAX_ENTRIES = 20;
 export const DEFAULT_COMPACT_HISTORY_MAX_ENTRIES = 50;
 const DEFAULT_MAX_COMPACT_ANCHORS = 3;
@@ -60,7 +62,17 @@ export async function writeJson(filePath, value) {
   const tempPath = `${filePath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
   try {
     await fs.writeFile(tempPath, `${JSON.stringify(value, null, 2)}\n`, 'utf8');
-    await fs.rename(tempPath, filePath);
+    try {
+      await fs.rename(tempPath, filePath);
+    } catch (renameError) {
+      // EXDEV: the tmp file and the destination sit on different mounts (union
+      // mounts, per-dir bind mounts, tmpfs overlays), so rename cannot link them.
+      // The payload is already fully written — copy it over and unlink the tmp.
+      // Less atomic than rename, but the update must not be silently lost.
+      if (renameError?.code !== 'EXDEV') throw renameError;
+      await fs.copyFile(tempPath, filePath);
+      await fs.rm(tempPath, { force: true });
+    }
   } catch (error) {
     try {
       await fs.rm(tempPath, { force: true });
@@ -74,140 +86,39 @@ export async function writeJson(filePath, value) {
 const LOCK_STALE_MS = 10_000;
 const LOCK_MAX_WAIT_MS = 5_000;
 
-function lockBackoffDelayMs() {
-  return 3 + Math.floor(Math.random() * 9);
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function isPidAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    // EPERM: the process exists but belongs to another user — still alive.
-    return error?.code === 'EPERM';
-  }
-}
-
-async function readLockOwner(lockPath) {
-  try {
-    const raw = JSON.parse(await fs.readFile(path.join(lockPath, 'owner'), 'utf8'));
-    const pid = Number(raw?.pid);
-    return Number.isInteger(pid) && pid > 0
-      ? { pid, token: typeof raw?.token === 'string' ? raw.token : null }
-      : null;
-  } catch {
-    return null;
-  }
-}
-
-// In-process holder registry: same-pid holders are parallel async flows whose liveness a
-// pid probe cannot prove, so the module tracks them itself.
-const inProcessLockHolders = new Map();
-
 /**
  * Serialize read-modify-write mutations of a shared state file — across processes
  * (hook invocations run as separate node processes) and across concurrent async
  * flows in one process (parallel subagents). The lock is a directory created next
  * to the target file: `mkdir` is atomic, so exactly one caller can create it.
- * Ownership is recorded in an `owner` file inside the lock dir: stale reclaim first
- * proves the recorded holder is gone (dead pid, or no in-process holder for our own
- * pid — no owner file means a pre-token holder and keeps the legacy mtime-only
- * reclaim), so a slow-but-alive holder on a crawling disk is waited out, not stolen.
- * Release only removes a dir this acquisition still owns, so a reclaimed-then-
- * re-acquired lock is never deleted out from under its successor.
- * Liveness wins over strictness: if the lock cannot be acquired within maxWaitMs
- * the callback runs anyway (the pre-lock behaviour) — these state files are
- * advisory caches, and losing an update beats freezing a hook mid-flight.
- * Protocol-compatible with src/core/fileOps.js withFileLock (same `<file>.lock`
- * path and owner-file format), so CLI processes and hook processes serialize
- * against each other.
+ *
+ * The entire lock protocol lives in async-lock.mjs (TASK-004 fix round 1): owner
+ * stamping (pid + token + pstart), recycled-pid detection via recordedProcessGone,
+ * claim+quarantine stale reclaim, and verified release exist exactly once there —
+ * this function and the src/core/fileOps.js twin both delegate to it so the two
+ * protocol copies can never drift apart again.
+ *
+ * FAIL-CLOSED (TASK-004, unified with async-lock/ledger policy): if the lock cannot
+ * be acquired within maxWaitMs the callback is SKIPPED — never run unlocked — and
+ * the drop is journaled to `<file>.lock-drops.jsonl`. These state files are
+ * advisory caches: losing an update was already the accepted outcome of the old
+ * fail-open race; now it is explicit and journaled instead of a silent torn write.
  * @param {string} filePath - state file the mutation targets (lock lives beside it)
  * @param {() => Promise<*>} fn - critical section; its result is returned
- * @returns {Promise<*>} whatever fn resolves with
+ * @returns {Promise<*|undefined>} whatever fn resolves with, or undefined when the
+ *   lock wait expired and the mutation was skipped (journaled)
  */
 export async function withFileLock(filePath, fn, { staleMs = LOCK_STALE_MS, maxWaitMs = LOCK_MAX_WAIT_MS } = {}) {
-  const lockPath = `${filePath}.lock`;
-  const startedAt = Date.now();
-  const ownerToken = `${process.pid}-${crypto.randomBytes(8).toString('hex')}`;
-  let locked = false;
-  let ownerStamped = false;
-
-  while (!locked) {
-    try {
-      await fs.mkdir(path.dirname(lockPath), { recursive: true });
-      await fs.mkdir(lockPath); // atomic acquire — EEXIST means another holder exists
-      locked = true;
-      inProcessLockHolders.set(lockPath, ownerToken);
-      try {
-        await fs.writeFile(
-          path.join(lockPath, 'owner'),
-          `${JSON.stringify({ pid: process.pid, token: ownerToken, ts: Date.now() })}\n`,
-          'utf8',
-        );
-        ownerStamped = true;
-      } catch {
-        ownerStamped = false; // unverifiable release skips removal; stale reclaim cleans up
-      }
-      break;
-    } catch (error) {
-      if (error?.code !== 'EEXIST') throw error;
-    }
-
-    // Someone holds the lock. Reclaim it only when the holder is provably gone.
-    try {
-      const stat = await fs.stat(lockPath);
-      if (Date.now() - stat.mtimeMs > staleMs) {
-        const owner = await readLockOwner(lockPath);
-        const liveInProcess = inProcessLockHolders.has(lockPath);
-        // Stealing a live holder reintroduces the exact interleaved-write race this
-        // lock exists to prevent, and the stolen holder's release then deleted the
-        // successor's lock. Only a dead pid (or a leaked same-pid dir with no live
-        // registered flow) may be reclaimed.
-        const reclaimable = !owner || owner.pid === process.pid
-          ? !liveInProcess
-          : !isPidAlive(owner.pid);
-        if (reclaimable) {
-          await fs.rm(lockPath, { recursive: true, force: true });
-          continue; // the slot is free now — retry immediately
-        }
-      }
-    } catch (statError) {
-      // BUG-C22-16: a persistent stat error (EPERM/ENOTDIR/EIO on a failing
-      // mount, or ELOOP/ENOENT on a dangling symlink where mkdir still reports
-      // EEXIST) must not busy-spin — a bare `continue` skipped both the
-      // maxWait break and the backoff sleep, looping mkdir→stat→throw forever.
-      if (Date.now() - startedAt >= maxWaitMs) break; // fail open — run unlocked
-      if (statError?.code === 'ENOENT') continue; // lock vanished — retry immediately
-      await sleep(lockBackoffDelayMs());
-      continue;
-    }
-
-    if (Date.now() - startedAt >= maxWaitMs) break; // fail open — run unlocked
-    await sleep(lockBackoffDelayMs());
-  }
-
-  try {
-    return await fn();
-  } finally {
-    if (locked) {
-      try {
-        // Remove the lock only if THIS acquisition still owns it: after a stale reclaim
-        // another holder may already own the dir, and deleting it would unlock their
-        // critical section for a third waiter.
-        const current = ownerStamped ? await readLockOwner(lockPath) : null;
-        if (current && current.token === ownerToken) {
-          await fs.rm(lockPath, { recursive: true, force: true });
-        }
-        if (inProcessLockHolders.get(lockPath) === ownerToken) inProcessLockHolders.delete(lockPath);
-      } catch {
-        // best-effort release; a stale lock is reclaimed by the next waiter
-      }
-    }
-  }
+  const outcome = await withAsyncLock(filePath, { deadlineMs: maxWaitMs, staleMs }, fn);
+  if (outcome?.ok === true) return outcome.value;
+  // Fail closed: the mutation is dropped, never run unlocked. The drop is
+  // journaled so the lost update is auditable; callers treat undefined as
+  // "update skipped" (they already tolerated losing it silently).
+  await journalDroppedLockMutation(filePath, {
+    reason: 'lock-wait-expired',
+    waitedMs: outcome?.waitedMs ?? maxWaitMs,
+  });
+  return undefined;
 }
 
 export function buildCompactMachineKey(prefix, payload = {}) {

package/templates/.codex/settings.json

@@ -358,10 +358,6 @@
     "non-trivial": "full test + lint + typecheck"
   },
   "verification": {
-    "requiredBeforeCompletion": [
-      "{{runtime.packageManager}} test",
-      "{{runtime.packageManager}} lint",
-      "{{runtime.packageManager}} typecheck"
-    ]
+    "requiredBeforeCompletion": {{verification.requiredBeforeCompletion}}
   }
 }

package/templates/.omp/agents/bug-debugger.md

@@ -49,7 +49,7 @@ Systematic debugging — understand before fixing.
 
 ```
 STATUS: DONE | BLOCKED | PARTIAL
-EXECUTOR_TOOL: [claude-code | kilo-code | codex | other]
+EXECUTOR_TOOL: [claude-code | codex | omp | other]
 EXECUTOR_MODEL: [exact model name you are running as. "unknown" if you cannot tell.]
 EXECUTOR_SUBAGENT: [subagent name within your host, if any, else "-"]
 SUMMARY: [1-2 sentences — root cause and fix]

package/templates/.omp/agents/feature-implementer.md

@@ -71,9 +71,9 @@ and even then, report it, don't ask about it.
 
 ```
 STATUS: DONE | BLOCKED | PARTIAL
-EXECUTOR_TOOL: [claude-code | kilo-code | codex | other]
+EXECUTOR_TOOL: [claude-code | codex | omp | other]
 EXECUTOR_MODEL: [exact model name you are running as — e.g. unic-code, claude-sonnet-4-5, gpt-5-mini. If you truly cannot tell, write "unknown" — reviewer treats unknown as suspicious and asks the human to confirm.]
-EXECUTOR_SUBAGENT: [name of the subagent you are, if your host has multiple — e.g. "Kilo:code", "Claude:feature-implementer". Otherwise "-".]
+EXECUTOR_SUBAGENT: [name of the subagent you are, if your host has multiple — e.g. "Claude:feature-implementer", "omp:task". Otherwise "-".]
 SUMMARY: [1-2 sentences of what was implemented]
 TEST_PLAN_FOLLOWED: [task §4 / inline / N/A — reason]
 FILES_CHANGED: