@oss-autopilot/core 1.16.1 → 1.17.0

package/dist/core/state.js

@@ -8,11 +8,31 @@ import { AgentStateSchema } from './state-schema.js';
 import { loadState, saveState, reloadStateIfChanged, createFreshState, atomicWriteFileSync, } from './state-persistence.js';
 import * as repoScoring from './repo-score-manager.js';
 import { debug, warn } from './logger.js';
-import { errorMessage, ConfigurationError } from './errors.js';
+import { errorMessage, ConfigurationError, ConcurrencyError } from './errors.js';
 import { GistStateStore } from './gist-state-store.js';
 import { getStatePath, getStateCachePath } from './utils.js';
 export { acquireLock, releaseLock, atomicWriteFileSync } from './state-persistence.js';
 const MODULE = 'state';
+/**
+ * Push state to the backing Gist when Gist mode is active. Best-effort:
+ * network/auth failures are logged via `warn()` but never propagated —
+ * the caller's primary mutation has already succeeded locally and the
+ * next successful push (or a daily run) will re-sync.
+ *
+ * Intended for state-mutating PR-flow commands (shelve / unshelve / move /
+ * dismiss / undismiss / claim) so Gist-sync users don't see day-long drift
+ * between machines waiting for the next `daily` checkpoint. See issue #1036.
+ */
+export async function maybeCheckpoint(stateManager, callerModule) {
+    if (!stateManager.isGistMode())
+        return;
+    try {
+        await stateManager.checkpoint();
+    }
+    catch (err) {
+        warn(callerModule, `Gist checkpoint failed (local mutation succeeded, will retry on next push): ${errorMessage(err)}`);
+    }
+}
 /**
  * Singleton manager for persistent agent state stored in ~/.oss-autopilot/state.json.
  *
@@ -173,8 +193,19 @@ export class StateManager {
      *
      * In Gist mode, writes to a local cache file (not the main state file) so the Gist
      * remains the source of truth. Use `checkpoint()` to push state to the Gist.
-     */
-    save() {
+     *
+     * Local-file mode uses optimistic compare-and-swap: if another process has
+     * written `state.json` since we last loaded/saved, `saveState` throws
+     * `ConcurrencyError`. See issue #1030.
+     *
+     * @throws ConcurrencyError (local file mode only) when the on-disk state
+     *   was modified externally between this StateManager's last load/save
+     *   and now. Callers that tolerate silent merge can set
+     *   `{ allowReloadAndLoseMutation: true }` to downgrade the error into a
+     *   warning — but note that doing so abandons any in-memory mutation
+     *   made since the last load. Fail-loud (the default) is preferred.
+     */
+    save(options = {}) {
         this.state.lastRunAt = new Date().toISOString();
         if (this.inMemoryOnly) {
             return;
@@ -182,6 +213,10 @@ export class StateManager {
         if (this.gistStore) {
             // In Gist mode, write to local cache (not main state file).
             // The Gist is the source of truth; local cache is for fallback.
+            // Intentionally NO compare-and-swap on this cache path — two processes
+            // racing on state-cache.json can clobber each other, but the next
+            // `refreshFromGist()` or `checkpoint()` re-syncs from the authoritative
+            // Gist. The trade-off is a transiently-stale offline bootstrap (#1030).
             try {
                 atomicWriteFileSync(getStateCachePath(), JSON.stringify(this.state, null, 2), 0o600);
             }
@@ -192,8 +227,18 @@ export class StateManager {
             }
             return;
         }
-        // Local file mode (existing behavior)
-        this.lastLoadedMtimeMs = saveState(this.state);
+        // Local file mode with optimistic compare-and-swap.
+        try {
+            this.lastLoadedMtimeMs = saveState(this.state, this.lastLoadedMtimeMs);
+        }
+        catch (err) {
+            if (err instanceof ConcurrencyError && options.allowReloadAndLoseMutation) {
+                warn(MODULE, `Concurrent external write detected; reloading and discarding in-memory mutation. ${err.message}`);
+                this.reloadIfChanged();
+                return;
+            }
+            throw err;
+        }
     }
     /** Push current state to Gist (async). Call at well-defined moments (end of daily, after claim). */
     async checkpoint() {

package/dist/core/status-determination.d.ts

@@ -26,9 +26,25 @@ export declare const MIN_RESPONSE_GAP_MS: number;
  * bot (#568), or when author info is unavailable (graceful degradation).
  */
 export declare function isContributorCommit(commitAuthor?: string, contributorUsername?: string): boolean;
+/**
+ * Parse an ISO-8601-ish date string into epoch milliseconds.
+ *
+ * Central helper so the whole module compares dates numerically via `getTime()`
+ * rather than relying on the lexicographic property of UTC ISO strings — the
+ * latter happens to sort correctly today but silently breaks on any other date
+ * format (local-time ISO, `Date.toString()`, non-standard). See #1044.
+ *
+ * Returns `NaN` for `undefined`, empty, or unparseable inputs so callers can
+ * make an explicit fail-closed decision; never throws.
+ */
+export declare function normalizeToEpochMs(date: string | undefined | null): number;
 /**
  * Check whether the contributor's commit is meaningfully after the maintainer's
  * comment — i.e. the commit timestamp is at least MIN_RESPONSE_GAP_MS later (#547).
+ *
+ * Fails closed (returns `false`) if either date is unparseable, avoiding the
+ * silent lexicographic fallback that would produce wrong results for non-UTC
+ * ISO inputs. See #1044.
  */
 export declare function isCommitAfterComment(commitDate: string, commentDate: string): boolean;
 /**

package/dist/core/status-determination.js

@@ -32,17 +32,35 @@ export function isContributorCommit(commitAuthor, contributorUsername) {
         return true; // CI-fix bots act on behalf of the contributor (#568)
     return author === contributorUsername.toLowerCase();
 }
+/**
+ * Parse an ISO-8601-ish date string into epoch milliseconds.
+ *
+ * Central helper so the whole module compares dates numerically via `getTime()`
+ * rather than relying on the lexicographic property of UTC ISO strings — the
+ * latter happens to sort correctly today but silently breaks on any other date
+ * format (local-time ISO, `Date.toString()`, non-standard). See #1044.
+ *
+ * Returns `NaN` for `undefined`, empty, or unparseable inputs so callers can
+ * make an explicit fail-closed decision; never throws.
+ */
+export function normalizeToEpochMs(date) {
+    if (!date)
+        return Number.NaN;
+    return new Date(date).getTime();
+}
 /**
  * Check whether the contributor's commit is meaningfully after the maintainer's
  * comment — i.e. the commit timestamp is at least MIN_RESPONSE_GAP_MS later (#547).
+ *
+ * Fails closed (returns `false`) if either date is unparseable, avoiding the
+ * silent lexicographic fallback that would produce wrong results for non-UTC
+ * ISO inputs. See #1044.
  */
 export function isCommitAfterComment(commitDate, commentDate) {
-    const commitMs = new Date(commitDate).getTime();
-    const commentMs = new Date(commentDate).getTime();
-    if (Number.isNaN(commitMs) || Number.isNaN(commentMs)) {
-        // Fall back to simple string comparison (pre-#547 behavior)
-        return commitDate > commentDate;
-    }
+    const commitMs = normalizeToEpochMs(commitDate);
+    const commentMs = normalizeToEpochMs(commentDate);
+    if (!Number.isFinite(commitMs) || !Number.isFinite(commentMs))
+        return false;
     return commitMs - commentMs >= MIN_RESPONSE_GAP_MS;
 }
 /**
@@ -61,16 +79,31 @@ function isCommentAddressedByCommit(commitDate, commentDate, changesRequestedDat
         return false;
     if (!isCommitAfterComment(commitDate, commentDate))
         return false;
-    // Safety net (#431): if a CHANGES_REQUESTED review came after the commit, it's not addressed
-    if (changesRequestedDate && commitDate < changesRequestedDate)
-        return false;
+    // Safety net (#431): if a CHANGES_REQUESTED review came after the commit, it's not addressed.
+    // Fail-closed on unparseable `changesRequestedDate` (#1044): treat unknown ordering as "not addressed".
+    if (changesRequestedDate) {
+        const commitMs = normalizeToEpochMs(commitDate);
+        const changesRequestedMs = normalizeToEpochMs(changesRequestedDate);
+        if (!Number.isFinite(commitMs) || !Number.isFinite(changesRequestedMs))
+            return false;
+        if (commitMs < changesRequestedMs)
+            return false;
+    }
     return true;
 }
-/** Check whether a changes_requested review has been addressed by a subsequent contributor commit. */
+/**
+ * Check whether a changes_requested review has been addressed by a subsequent contributor commit.
+ *
+ * Fails closed (returns `false`) on unparseable inputs (#1044).
+ */
 function isChangesAddressedByCommit(commitDate, changesRequestedDate) {
     if (!commitDate || !changesRequestedDate)
         return false;
-    return commitDate >= changesRequestedDate;
+    const commitMs = normalizeToEpochMs(commitDate);
+    const changesRequestedMs = normalizeToEpochMs(changesRequestedDate);
+    if (!Number.isFinite(commitMs) || !Number.isFinite(changesRequestedMs))
+        return false;
+    return commitMs >= changesRequestedMs;
 }
 /**
  * Collect all applicable action reasons independently, without short-circuiting (#675).

package/dist/formatters/json.d.ts

@@ -7,7 +7,7 @@ import type { ContributionStats } from '../core/stats.js';
 import type { PRCheckFailure } from '../core/pr-monitor.js';
 import type { SearchPriority } from '../core/types.js';
 import type { CIFormatterDiagnosis, FormatterDetectionResult } from '../core/formatter-detection.js';
-export type ErrorCode = 'AUTH_REQUIRED' | 'RATE_LIMITED' | 'VALIDATION' | 'CONFIGURATION' | 'NETWORK' | 'NOT_FOUND' | 'STATE_CORRUPTED' | 'UNKNOWN';
+export type ErrorCode = 'AUTH_REQUIRED' | 'RATE_LIMITED' | 'VALIDATION' | 'CONFIGURATION' | 'NETWORK' | 'NOT_FOUND' | 'STATE_CORRUPTED' | 'CONCURRENCY' | 'UNKNOWN';
 export interface JsonOutput<T = unknown> {
     success: boolean;
     data?: T;
@@ -104,6 +104,23 @@ export interface CompactRepoGroup {
     repo: string;
     prUrls: string[];
 }
+/**
+ * Phase tags for non-fatal warnings emitted during a `daily` run.
+ * See `DailyWarning` and issue #1042 for the rationale — keeping this a
+ * fixed union so downstream consumers can switch on it without drift.
+ */
+export type DailyWarningPhase = 'fetch' | 'repo-scores' | 'analytics' | 'scout-sync' | 'partition' | 'dismiss-filter' | 'gist-checkpoint';
+/**
+ * A single non-fatal failure surfaced from the `daily` pipeline. Unlike
+ * `PRCheckFailure` (which is scoped to per-PR fetch errors), this covers
+ * ancillary fetches that previously demoted to a log-only `warn()` — repo
+ * metadata, monthly analytics, scout sync, Gist checkpoint, etc.
+ */
+export interface DailyWarning {
+    phase: DailyWarningPhase;
+    operation: string;
+    message: string;
+}
 export interface DailyOutput {
     digest: DailyDigestCompact;
     capacity: CapacityAssessment;
@@ -114,6 +131,12 @@ export interface DailyOutput {
     commentedIssues: CommentedIssue[];
     repoGroups: CompactRepoGroup[];
     failures: PRCheckFailure[];
+    /**
+     * Non-fatal warnings from ancillary pipeline phases (repo metadata,
+     * analytics, scout sync, Gist checkpoint, etc.). Always an array — empty
+     * on clean runs. See #1042.
+     */
+    warnings: DailyWarning[];
 }
 /**
  * Compact version of DailyOutput for reduced JSON payload size (#763).
@@ -133,6 +156,12 @@ export interface CompactDailyOutput {
     commentedIssues: CommentedIssue[];
     /** Number of PRs that failed to fetch. Non-zero indicates partial results. */
     failureCount: number;
+    /**
+     * Non-fatal warnings from ancillary pipeline phases — full list retained so
+     * downstream consumers (dashboard, MCP) can surface degradation even under
+     * the `--compact` payload. See #1042.
+     */
+    warnings: DailyWarning[];
 }
 /**
  * Strip a full DailyOutput down to the compact subset (#763).
@@ -183,8 +212,17 @@ export interface SearchOutput {
         reasonsToApprove: string[];
         reasonsToSkip: string[];
         searchPriority: SearchPriority;
-        /** 0-100 scale composite viability score */
+        /** 0-100 scale composite viability score. Sanitized on the boundary (#1043): out-of-contract values are coerced to 0 and logged. */
         viabilityScore: number;
+        /**
+         * Letter grade (A/B/C/F) computed from the autopilot-tracked repoScore.
+         * Scout's `search` does not emit per-candidate projectHealth, so scout-side
+         * signals are treated as unknown; unscored repos grade 'F'. See #1043.
+         */
+        grade: {
+            letter: 'A' | 'B' | 'C' | 'F';
+            reason: string;
+        };
         repoScore?: {
             /** 1-10 scale repository quality score */
             score: number;

package/dist/formatters/json.js

@@ -16,6 +16,7 @@ export function toCompactDailyOutput(output) {
         actionMenu: output.actionMenu,
         commentedIssues: output.commentedIssues,
         failureCount: output.failures.length,
+        warnings: output.warnings,
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "1.16.1",
+  "version": "1.17.0",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {