@phyzess/pappra 0.1.0-beta.13 → 0.1.0-beta.18

package/dist/continuity/service.js

@@ -1,14 +1,17 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, open, unlink } from 'node:fs/promises';
+import { mkdir, unlink } from 'node:fs/promises';
+import { ensurePrivateState } from '../infra/private-state.js';
+import { publishPrivateLock } from '../infra/private-lock.js';
+import { captureProcessIdentity } from '../infra/process-identity.js';
 import { isAbsolute, join, resolve } from 'node:path';
 import { createDiagnostic } from '../schemas/diagnostics.js';
 import { diagnosticCodes } from '../schemas/errors.js';
 import { checkpointPointerSchema, checkpointSchema, resumePacketSchema, taskContextSchema, } from '../schemas/continuity.js';
 import { errorMessage, } from '../schemas/outcome.js';
 import { isPathInside } from '../schemas/paths.js';
-import { isTaskRecord } from '../collab/validation.js';
+import { isTaskRecord } from '../schemas/collaboration-state-validation.js';
 import { observePath, readFileBounded, readTextFileBounded, sha256Digest, } from '../infra/fs.js';
-import { loadContinuityWorkspace, snapshotRepository, } from './context.js';
+import { loadContinuityWorkspace, repositoryIdentities, snapshotRepository, } from './context.js';
 import { continuityTaskPaths, ensureContinuityBoundary, ensurePrivateTaskBoundary, readArtifactPath, readContinuityBytes, replaceContinuityBytesIfDigest, writeContinuityBytes, } from './paths.js';
 const MAX_ARTIFACT_BYTES = 8 * 1024 * 1024;
 const MAX_RECORD_BYTES = 8 * 1024 * 1024;
@@ -140,6 +143,9 @@ async function acquireTaskLock(root, taskId) {
     if (!boundary.ok) {
         return { ok: false, path: paths.lockPath, message: boundary.message };
     }
+    const privateState = await ensurePrivateState(root);
+    if (!privateState.ok)
+        return { ok: false, path: paths.lockPath, message: privateState.message };
     try {
         await mkdir(paths.taskDir, { recursive: true, mode: 0o700 });
     }
@@ -151,17 +157,15 @@ async function acquireTaskLock(root, taskId) {
         };
     }
     const token = randomUUID();
-    let handle;
     try {
-        handle = await open(paths.lockPath, 'wx', 0o600);
-        await handle.writeFile(Buffer.from(`${JSON.stringify({ token, pid: process.pid, createdAt: new Date().toISOString() })}\n`));
-        await handle.sync();
-        await handle.close();
-        handle = undefined;
+        await publishPrivateLock(paths.lockPath, Buffer.from(`${JSON.stringify({ token, pid: process.pid, process_identity: captureProcessIdentity() ?? undefined, createdAt: new Date().toISOString() })}\n`), async () => {
+            const current = await ensurePrivateTaskBoundary(root, taskId, paths.lockPath);
+            if (!current.ok)
+                throw new Error(current.message);
+        });
         return { ok: true, path: paths.lockPath, token };
     }
     catch (error) {
-        await handle?.close().catch(() => undefined);
         return {
             ok: false,
             path: paths.lockPath,
@@ -461,6 +465,25 @@ function boundedArray(values) {
         ? { values: values.slice(0, 16), truncated: true }
         : { values: [...values], truncated: false };
 }
+function boundedCoverageIds(values) {
+    const unique = [...new Set(values)].sort();
+    const shown = unique
+        .slice(0, 8)
+        .map((value) => (value.length > 200 ? `${value.slice(0, 197)}...` : value));
+    const text = `${shown.join(', ')}${unique.length > shown.length ? `, ... (${unique.length - shown.length} more)` : ''}`;
+    return text.length > 900 ? `${text.slice(0, 897)}...` : text;
+}
+function repositoryCoverageLimitations(workspace) {
+    const limitations = [];
+    if (workspace.unresolvedRepositories.length > 0) {
+        const entries = workspace.unresolvedRepositories.map((entry) => `${entry.id} (${entry.configuredPath})`);
+        limitations.push(`Repository coverage incomplete: ${entries.length} configured repositories unresolved: ${boundedCoverageIds(entries)}.`);
+    }
+    if (workspace.discoveryTruncated) {
+        limitations.push('Repository discovery was truncated; configured/resolved coverage is incomplete.');
+    }
+    return limitations;
+}
 export class CheckpointService {
     root;
     #options;
@@ -513,6 +536,20 @@ export class CheckpointService {
             };
         }
         const paths = continuityTaskPaths(workspace.root, input.taskId);
+        if (workspace.repositories.length > 64) {
+            const released = await releaseTaskLock(lock.path, lock.token);
+            return {
+                ok: false,
+                status: 'failed',
+                checkpoint: null,
+                checkpointPath: null,
+                latestPath: paths.latestPath,
+                diagnostics: [
+                    diag(diagnosticCodes.document_record_invalid, `Repository coverage has ${workspace.repositories.length} resolved entries; the checkpoint schema supports at most 64. No checkpoint pointer was advanced.`, paths.contextPath, 'Reduce the configured/resolved repository set or declare a later coverage scope; semantic context was not dropped silently.'),
+                ],
+                residualPaths: released.ok ? [] : [lock.path],
+            };
+        }
         const now = new Date().toISOString();
         let checkpointPath = null;
         let result;
@@ -602,8 +639,9 @@ export class CheckpointService {
                     }
                     if (result === undefined) {
                         const observedRepositories = [];
+                        const identities = repositoryIdentities(workspace.repositories, workspace.config.repositories.map((repository) => repository.id));
                         for (const [index, repository,] of workspace.repositories.entries()) {
-                            const snapshot = await snapshotRepository(workspace, repository, index);
+                            const snapshot = await snapshotRepository(workspace, repository, index, identities[index]);
                             if (snapshot.patchBytes !== null &&
                                 snapshot.record.patchDigest !== null) {
                                 const patch = await writePrivatePatch(workspace, input.taskId, snapshot.patchBytes, snapshot.record.patchDigest);
@@ -643,7 +681,15 @@ export class CheckpointService {
                                     ...(input.attempted ?? []),
                                     ...(input.nextActions ?? []),
                                 ].length > 0;
-                                const contextCompleteness = semanticPresent && input.contextCompleteness !== 'partial'
+                                const coverageLimitations = repositoryCoverageLimitations(workspace);
+                                const coverageIncomplete = coverageLimitations.length > 0;
+                                const combinedLimitations = [
+                                    ...(input.limitations ?? []),
+                                    ...coverageLimitations,
+                                ];
+                                const contextCompleteness = semanticPresent &&
+                                    input.contextCompleteness !== 'partial' &&
+                                    !coverageIncomplete
                                     ? 'complete'
                                     : 'partial';
                                 if (!semanticPresent) {
@@ -652,6 +698,10 @@ export class CheckpointService {
                                         : 'Checkpoint has no semantic decisions, attempted work or next actions; stored as partial.', continuityTaskPaths(workspace.root, input.taskId)
                                         .contextPath, 'Add an explicit semantic summary before claiming complete recovery context.'));
                                 }
+                                if (coverageIncomplete) {
+                                    saveDiagnostics.push(diag(diagnosticCodes.document_write_partial, `Checkpoint capture has incomplete repository coverage: ${boundedCoverageIds(workspace.unresolvedRepositories.map((entry) => `${entry.id} (${entry.configuredPath})`))}${workspace.discoveryTruncated ? '; discovery was truncated' : ''}.`, continuityTaskPaths(workspace.root, input.taskId)
+                                        .contextPath, 'Inspect configured repositories; the checkpoint is partial and does not claim complete coverage.'));
+                                }
                                 const checkpoint = {
                                     schema: 'pappra/checkpoint/1',
                                     checkpointId,
@@ -669,7 +719,7 @@ export class CheckpointService {
                                     decisions: [...(input.decisions ?? [])],
                                     attempted: [...(input.attempted ?? [])],
                                     nextActions: [...(input.nextActions ?? [])],
-                                    limitations: [...(input.limitations ?? [])],
+                                    limitations: combinedLimitations,
                                     repositories: observedRepositories,
                                     artifacts: artifacts.artifacts,
                                     validations: (input.validations ?? []).map((validation) => ({
@@ -978,10 +1028,30 @@ export class CheckpointService {
             },
         ];
         const currentRepositories = new Map();
+        const currentIdentities = repositoryIdentities(workspace.repositories, workspace.config.repositories.map((repository) => repository.id));
         for (const [index, repository] of workspace.repositories.entries()) {
-            const snapshot = await snapshotRepository(workspace, repository, index);
+            const snapshot = await snapshotRepository(workspace, repository, index, currentIdentities[index]);
             currentRepositories.set(snapshot.record.repoId, snapshot.record);
         }
+        const storedRepositoryIds = new Set(checkpoint.repositories.map((repository) => repository.repoId));
+        const currentOnly = [...currentRepositories.keys()]
+            .filter((repoId) => !storedRepositoryIds.has(repoId))
+            .sort();
+        const unresolvedIds = workspace.unresolvedRepositories.map((entry) => `${entry.id} (${entry.configuredPath})`);
+        const coverageParts = [];
+        if (unresolvedIds.length > 0) {
+            coverageParts.push(`configured but unresolved: ${boundedCoverageIds(unresolvedIds)}`);
+        }
+        if (currentOnly.length > 0) {
+            coverageParts.push(`current-only: ${boundedCoverageIds(currentOnly)}`);
+        }
+        if (workspace.discoveryTruncated) {
+            coverageParts.push('discovery was truncated');
+        }
+        const coverageMessage = coverageParts.length === 0
+            ? null
+            : `Repository coverage is incomplete: ${coverageParts.join('; ')}.`;
+        const coverageUnknown = coverageMessage !== null;
         const repositoryDrift = [];
         for (const stored of checkpoint.repositories) {
             const patchPath = stored.patchDigest === null
@@ -1072,13 +1142,16 @@ export class CheckpointService {
                 detail,
             });
         }
-        const codeStatus = repositoryDrift.some((entry) => entry.status === 'relocated')
+        const driftStatus = repositoryDrift.some((entry) => entry.status === 'relocated')
             ? 'relocated'
             : repositoryDrift.some((entry) => entry.status === 'changed')
                 ? 'changed'
                 : repositoryDrift.some((entry) => entry.status === 'missing' || entry.status === 'unknown')
                     ? 'unknown'
                     : 'unchanged';
+        const codeStatus = coverageUnknown
+            ? 'unknown'
+            : driftStatus;
         const artifactChecks = [];
         for (const artifact of checkpoint.artifacts) {
             const resolved = await readArtifactPath(workspace.root, artifact.path);
@@ -1129,6 +1202,9 @@ export class CheckpointService {
             entry.patchStatus !== 'not-applicable')) {
             pushBlock('private_patch_unavailable', 'A private patch is missing, changed or unsafe; verification is not current.');
         }
+        if (coverageMessage !== null) {
+            pushBlock('repository_coverage_incomplete', coverageMessage);
+        }
         if (repositoryDrift.some((entry) => entry.storedCaptureStatus !== 'complete' ||
             entry.currentCaptureStatus !== 'complete')) {
             pushBlock('snapshot_incomplete', 'Repository capture was partial or unknown; current verification is not established.');

package/dist/continuity/task-pin.d.ts

@@ -0,0 +1,24 @@
+export declare const TASK_PIN_SCHEMA = "pappra/task-pin/1";
+export declare const TASK_PREFERENCES_SCHEMA = "pappra/task-preferences/1";
+export interface TaskPin {
+    readonly schema: typeof TASK_PIN_SCHEMA;
+    readonly taskId: string;
+    readonly pinnedAt: string;
+}
+export interface TaskPinFailure {
+    readonly ok: false;
+    readonly message: string;
+}
+export declare function readTaskPin(root: string): Promise<TaskPin | null>;
+export declare function pinTask(root: string, taskId: string): Promise<TaskPin | TaskPinFailure>;
+export declare function unpinTask(root: string): Promise<{
+    ok: true;
+} | TaskPinFailure>;
+/**
+ * Stores the personal hook preference in ignored checkout-local state. Shared
+ * workspace configuration is read for identity but is never rewritten.
+ */
+export declare function setAutoResume(root: string, enabled: boolean): Promise<{
+    ok: true;
+} | TaskPinFailure>;
+export declare function readAutoResume(root: string): Promise<boolean>;