@oss-autopilot/core 3.13.1 → 3.13.2

package/dist/commands/dashboard-data.js

@@ -283,7 +283,10 @@ export async function fetchDashboardData(token) {
             // Partitioned over overriddenPRs (#1416): the shelve decision must use
             // the same post-override status the CLI partitions on.
             const shelvedUrls = new Set(stateManager.getState().config.shelvedPRUrls || []);
-            const freshShelved = overriddenPRs.filter((pr) => !CRITICAL_STATUSES.has(pr.status) && (shelvedUrls.has(pr.url) || pr.stalenessTier === 'dormant'));
+            // Single copy of the shelve predicate (#1421): isShelvedForDisplay is
+            // the same rule reconcileShelvePartition applies on rebuilds, so its
+            // regression tests now guard this line too.
+            const freshShelved = overriddenPRs.filter((pr) => isShelvedForDisplay(pr, shelvedUrls));
             digest.shelvedPRs = freshShelved.map(toShelvedPRRef);
             digest.autoUnshelvedPRs = [];
             digest.summary.totalActivePRs = overriddenPRs.length - freshShelved.length;

package/dist/commands/list-move-tier.js

@@ -184,10 +184,20 @@ export async function runListMoveTier(options) {
             'Add the entry to the list first, then re-run list-move-tier.');
     }
     if (result.moved) {
+        // tmp+rename so a crash mid-write can't truncate the curated list —
+        // same atomic pattern as list-mark-done (#1421).
+        const tmp = `${filePath}.tmp-${process.pid}-${Date.now()}`;
         try {
-            fs.writeFileSync(filePath, result.content, 'utf8');
+            fs.writeFileSync(tmp, result.content, 'utf8');
+            fs.renameSync(tmp, filePath);
         }
         catch (error) {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch {
+                // best-effort cleanup
+            }
             throw new Error(`Failed to write file: ${errorMessage(error)}`, { cause: error });
         }
     }

package/dist/core/auth.js

@@ -13,6 +13,22 @@ const MODULE = 'auth';
 // Cached GitHub token (fetched once per session)
 let cachedGitHubToken = null;
 let tokenFetchAttempted = false;
+/**
+ * A `gh auth token` spawn that timed out is transient (#1415): the CLI is
+ * installed and may answer on the next call (slow disk, machine waking,
+ * momentary load). Everything else is definitive for the process lifetime —
+ * ENOENT (gh not installed) and a non-zero exit (not authenticated) will not
+ * change without user action, so those still latch `tokenFetchAttempted`.
+ * The async execFile timeout surfaces as `killed: true` (signal SIGTERM);
+ * the sync execFileSync timeout surfaces as `code: 'ETIMEDOUT'` (no
+ * `killed` property) — both arms are load-bearing, one per path.
+ */
+function isTransientTokenFetchError(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    return e.killed === true || e.code === 'ETIMEDOUT';
+}
 /**
  * Retrieves a GitHub authentication token, checking sources in priority order.
  *
@@ -29,7 +45,6 @@ export function getGitHubToken() {
     if (tokenFetchAttempted) {
         return null;
     }
-    tokenFetchAttempted = true;
     if (process.env.GITHUB_TOKEN) {
         cachedGitHubToken = process.env.GITHUB_TOKEN;
         return cachedGitHubToken;
@@ -40,6 +55,8 @@ export function getGitHubToken() {
             stdio: ['pipe', 'pipe', 'pipe'],
             timeout: 2000,
         }).trim();
+        // Definitive outcome (a token, or authoritatively none) — latch.
+        tokenFetchAttempted = true;
         if (token && token.length > 0) {
             cachedGitHubToken = token;
             debug(MODULE, 'Using GitHub token from gh CLI');
@@ -47,9 +64,14 @@ export function getGitHubToken() {
         }
     }
     catch (err) {
-        // Promote to warn-once-per-session so a slow `gh` (2s timeout) or a
-        // misconfigured CLI is visible without DEBUG=1 (#1209 L6). The
-        // tokenFetchAttempted cache means subsequent calls don't re-warn.
+        // Latch only on definitive failures (#1415): a timeout must not
+        // permanently disable token fetch for a long-lived process (the MCP
+        // server), or gist-mode mutations silently degrade to local-only for
+        // the process lifetime. Promote to warn so a slow `gh` (2s timeout) or
+        // a misconfigured CLI is visible without DEBUG=1 (#1209 L6).
+        if (!isTransientTokenFetchError(err)) {
+            tokenFetchAttempted = true;
+        }
         warn(MODULE, `gh auth token failed (CLI unavailable or not authenticated): ${err instanceof Error ? err.message : String(err)}`);
     }
     return null;
@@ -97,7 +119,6 @@ export async function getGitHubTokenAsync() {
     if (tokenFetchAttempted) {
         return null;
     }
-    tokenFetchAttempted = true;
     if (process.env.GITHUB_TOKEN) {
         cachedGitHubToken = process.env.GITHUB_TOKEN;
         return cachedGitHubToken;
@@ -113,6 +134,8 @@ export async function getGitHubTokenAsync() {
                 }
             });
         });
+        // Definitive outcome (a token, or authoritatively none) — latch.
+        tokenFetchAttempted = true;
         if (token && token.length > 0) {
             cachedGitHubToken = token;
             debug(MODULE, 'Using GitHub token from gh CLI (async)');
@@ -120,7 +143,11 @@ export async function getGitHubTokenAsync() {
         }
     }
     catch (err) {
-        // Same warn-once promotion as the sync version (#1209 L6).
+        // Same transient/definitive split and warn promotion as the sync
+        // version (#1415, #1209 L6).
+        if (!isTransientTokenFetchError(err)) {
+            tokenFetchAttempted = true;
+        }
         warn(MODULE, `gh auth token failed (CLI unavailable or not authenticated): ${err instanceof Error ? err.message : String(err)}`);
     }
     return null;

package/dist/core/index.d.ts

@@ -2,7 +2,7 @@
  * Core module exports
  * Re-exports all core functionality for convenient imports
  */
-export { StateManager, getStateManager, getStateManagerAsync, ensureGistPersistence, maybeCheckpoint, resetStateManager, type Stats, } from './state.js';
+export { StateManager, getStateManager, getStateManagerAsync, ensureGistPersistence, type GistPersistenceStatus, maybeCheckpoint, resetStateManager, type Stats, } from './state.js';
 export { GistStateStore } from './gist-state-store.js';
 export { guidelinesFilename, repoFromGuidelinesFilename, GUIDELINES_FILE_PREFIX, GUIDELINES_MAX_BYTES, GuidelinesNotAvailableError, GuidelinesTooLargeError, } from './guidelines-store.js';
 export { PRMonitor, type PRCheckFailure, type FetchPRsResult, computeDisplayLabel, classifyCICheck, classifyFailingChecks, } from './pr-monitor.js';

package/dist/core/state.d.ts

@@ -441,7 +441,21 @@ export declare function getStateManagerAsync(token?: string): Promise<StateManag
  * // CLI bootstrap
  * await ensureGistPersistence(token);
  */
-export declare function ensureGistPersistence(token: string | null): Promise<void>;
+export type GistPersistenceStatus = 
+/** No state file yet, or config does not request gist mode. */
+'local-mode'
+/** The state file exists but could not be read/parsed for this attempt
+ * (permissions, transient FS error, corrupt JSON). Callers must NOT
+ * memoize this as "local mode chosen" — a later attempt may succeed. */
+ | 'state-unreadable'
+/** Gist mode is configured but no token was available for this attempt. */
+ | 'no-token'
+/** Gist mode active: the singleton is gist-backed. */
+ | 'gist'
+/** Gist mode is configured and a token was available, but init fell back
+ * to local-only (transient network failure). A later call may recover. */
+ | 'degraded';
+export declare function ensureGistPersistence(token: string | null): Promise<GistPersistenceStatus>;
 /**
  * Reset the singleton StateManager instance to null. Intended for test isolation.
  */

package/dist/core/state.js

@@ -924,13 +924,27 @@ export function getStateManager() {
  * StateManager and Gist checkpoints will be no-ops.
  */
 export async function getStateManagerAsync(token) {
-    if (stateManager)
+    // #1415: a LOCAL-mode singleton does not short-circuit when a token is
+    // provided. The only token-bearing caller is ensureGistPersistence, which
+    // already verified the config says `persistence: gist` — so a local
+    // singleton here means a previous transient init failure fell back (or a
+    // tool body lazily created the local manager before auth resolved), and
+    // this call is the retry that must be allowed to upgrade it. The old
+    // unconditional early return made every retry a dead no-op, permanently
+    // latching gist-configured processes into silent local-only writes.
+    if (stateManager && (!token || stateManager.isGistMode()))
         return stateManager;
     if (asyncManagerPromise)
         return asyncManagerPromise;
     if (token) {
         asyncManagerPromise = StateManager.createWithGist(token)
             .then((mgr) => {
+            // Upgrade note: replacing a transient-fallback local singleton fixes
+            // FUTURE operations. Mutations made during the degraded window stay
+            // in the local state.json only — when a Gist already exists they are
+            // NOT merged into it by this upgrade (bootstrapWithMigration seeds a
+            // Gist from local state only on first creation). The per-call MCP
+            // warning is the signal that those writes were at risk.
             stateManager = mgr;
             asyncManagerPromise = null;
             return mgr;
@@ -949,6 +963,9 @@ export async function getStateManagerAsync(token) {
             // marker stays in config, causing permanent cross-machine divergence.
             if (!isTransientNetworkError(err))
                 throw err;
+            // Intentional CLI semantics: a one-shot process warns and proceeds
+            // local-only. Long-lived callers (MCP) detect this via the
+            // ensureGistPersistence return status and retry on later calls.
             warn(MODULE, `Gist initialization failed (transient network error), falling back to local-only mode: ${err}`);
             return getStateManager();
         });
@@ -956,39 +973,32 @@ export async function getStateManagerAsync(token) {
     }
     return getStateManager();
 }
-/**
- * Bootstrap helper for processes that may run in Gist persistence mode.
- *
- * Peeks at the state file to check if Gist mode is configured. If so and a
- * valid token is provided, pre-sets the singleton via {@link getStateManagerAsync}
- * so subsequent synchronous {@link getStateManager} calls return the Gist-backed
- * instance. No-op when the state file is absent, unparseable, or not in Gist mode.
- *
- * Consolidates identical filesystem-peek + getStateManagerAsync logic that
- * was duplicated between the CLI bootstrap (`cli.ts`) and MCP tool bootstrap
- * (`mcp-server/src/tools.ts`) — #1000.
- *
- * @param token - GitHub token with `gist` scope, or `null` to skip activation
- *
- * @example
- * // CLI bootstrap
- * await ensureGistPersistence(token);
- */
 export async function ensureGistPersistence(token) {
-    if (!token)
-        return;
     let persistence;
     try {
         const raw = fs.readFileSync(getStatePath(), 'utf8');
         persistence = JSON.parse(raw)?.config?.persistence;
     }
-    catch {
-        // No state file or unreadable — stay in local mode
-        return;
-    }
-    if (persistence === 'gist') {
-        await getStateManagerAsync(token);
-    }
+    catch (err) {
+        // A missing file is the genuine "fresh local-mode user" case. Anything
+        // else (EACCES, EMFILE, corrupt JSON) must not be silently classified
+        // as a local-mode CHOICE — that would re-create the #1415 latch through
+        // a third door when the caller memoizes the answer.
+        if (err.code === 'ENOENT')
+            return 'local-mode';
+        warn(MODULE, `State file unreadable during gist-persistence check (will retry): ${errorMessage(err)}`);
+        return 'state-unreadable';
+    }
+    if (persistence !== 'gist')
+        return 'local-mode';
+    // #1415: report the distinction the MCP layer needs — "gist configured but
+    // token missing" and "init fell back to local" both mean the process is
+    // NOT writing to the Gist despite the config saying it should, and a
+    // long-lived caller must keep retrying instead of memoizing the outcome.
+    if (!token)
+        return 'no-token';
+    const mgr = await getStateManagerAsync(token);
+    return mgr.isGistMode() ? 'gist' : 'degraded';
 }
 /**
  * Reset the singleton StateManager instance to null. Intended for test isolation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oss-autopilot/core",
-  "version": "3.13.1",
+  "version": "3.13.2",
   "description": "CLI and core library for managing open source contributions",
   "type": "module",
   "bin": {