@quolu/lattice 0.64.1 → 0.64.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quolu/lattice",
-  "version": "0.64.1",
+  "version": "0.64.3",
   "description": "Schedulability compiler for multi-agent development: observe real code boundaries, refactor the conflicting seam, recompile the plan for parallel execution",
   "author": {
     "name": "Quo / クオ at kitepon.dev",

package/src/cli-help.mjs

@@ -86,6 +86,7 @@ Read commands:
   phase status --plan <key>
 
 Write commands:
+  repair-eol --json  # Git checkoutでCRLF化された既存storeをcanonical LFへ戻し、EOL保護を追加する
   dashboard adopt --json  # 衝突したproject_idの配信元rootを現在repoへ明示的に移す
   dashboard remove <project_id> --json  # 登録簿から1件外す（対象repoの外からも叩ける）
   note --plan <key> [--task <id>] (--message <text>|--input <file>)
@@ -251,6 +252,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'todo seam-profile': 'todo seam-profile --plan <key> --file <path> [--json]',
   'todo seam-proposal': 'todo seam-proposal [--plan <key>] [--json] | compile --plan <key>',
   'todo verify': 'todo verify [--plan <key>] [--json]',
+  'todo repair-eol': 'todo repair-eol --json',
   'todo snapshot': 'todo snapshot --rebuild --plan <key>',
   'todo gantt': 'todo gantt serve --port <port> [--scope live|all]  # 動的表示のみ。静的HTML生成は廃止',
   'todo gantt serve': 'todo gantt serve --port <0..65535> [--scope live|all]  # loopback動的viewer',

package/src/project-cli.mjs

@@ -325,7 +325,14 @@ async function resolveProjectState({ cwd, cliVersion, diagnoseStructureArtifacts
     if (error?.code === 'STRUCTURE_ARTIFACT_INVALID') throw error;
     const reason = error instanceof TodoStoreError
       ? `${error.code}:${error.detail?.reason ?? error.message}` : 'store_validation_failed';
-    return invalid(reason);
+    const nextAction = error instanceof TodoStoreError
+      && error.detail?.next_action === 'lattice todo repair-eol --json'
+      ? { command: error.detail.next_action, reason: `${reason}:${error.detail.ref}` }
+      : null;
+    return {
+      exitCode: 1, repoRoot, store: null, todo: null,
+      result: invalidStatus({ cliVersion, repoRoot, reason, nextAction }),
+    };
   }
 }
 

package/src/todo-cli.mjs

@@ -177,6 +177,7 @@ import {
 } from './todo-note-store.mjs';
 import { readTodoParallelCandidatesForStatus } from './todo-parallel-candidates.mjs';
 import { commitTodoStoreMutation } from './todo-store-git-transaction.mjs';
+import { repairTodoStoreWorktreeEol } from './todo-store-worktree-eol.mjs';
 
 const CLI_ERROR_SCHEMA = 'lattice.cli_error.v2';
 const DEFAULT_GANTT_SCOPE = 'live';
@@ -254,7 +255,7 @@ function internalFailure(stderr, error) {
 
 const TODO_COMMAND_NAMES = Object.freeze([
   'status', 'show', 'note', 'bindings', 'independence', 'structure', 'seam-profile', 'seam-proposal',
-  'verify', 'snapshot', 'gantt', 'dashboard', 'phase', 'migrate', 'start', 'block',
+  'verify', 'repair-eol', 'snapshot', 'gantt', 'dashboard', 'phase', 'migrate', 'start', 'block',
   'unblock', 'done', 'reopen', 'evidence', 'split', 'revise', 'revise-phase', 'revise-set',
 ]);
 
@@ -3579,6 +3580,20 @@ async function rebuildSnapshot({ repoRoot, planKey }) {
   return result;
 }
 
+async function repairStoreEol({ repoRoot }) {
+  const repair = await repairTodoStoreWorktreeEol({ repoRoot });
+  const store = await readTodoStore({ repoRoot });
+  const result = {
+    schema: 'lattice.todo_eol_repair_result.v1',
+    project_id: store.project_id,
+    ...repair,
+    repaired_count: repair.repaired_refs.length,
+    result_digest: '',
+  };
+  result.result_digest = todoSelfDigest(result, 'result_digest');
+  return result;
+}
+
 /**
  * `lattice todo` namespace. Exact position, order, and argument count are part of
  * the public contract; usage failures never use a JSON envelope.
@@ -3633,7 +3648,10 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
 
   const automatedStructureRealize = parseAutomatedStructureRealizeArgs(argv);
   let action = null;
-  if ((argv.length === 1 && argv[0] === 'status')
+  if (argv.length === 2 && argv[0] === 'repair-eol' && argv[1] === '--json') {
+    // 壊れたstoreを読めない時の入口なので、dashboard所有権pre-hookを通さない。
+    action = (repoRoot) => repairStoreEol({ repoRoot });
+  } else if ((argv.length === 1 && argv[0] === 'status')
     || (argv.length === 2 && argv[0] === 'status' && argv[1] === '--json')) {
     action = (repoRoot) => status({ repoRoot });
   } else if (argv.length === 3 && argv[0] === 'dashboard'

package/src/todo-store-worktree-eol.mjs

@@ -0,0 +1,220 @@
+import { randomBytes } from 'node:crypto';
+import {
+  lstat, readFile, readdir, rename, rm, writeFile,
+} from 'node:fs/promises';
+import path from 'node:path';
+
+import { gitCatFileBatch, gitSpawnSync } from './git-process.mjs';
+import { TodoStoreError } from './todo-store.mjs';
+
+const STORE_REF = '.lattice/todo';
+const ATTRIBUTES_REF = '.lattice/.gitattributes';
+const EOL_PROTECTION = '# Lattice store artifacts are canonical JSON+LF bytes; EOL conversion corrupts the store.\n* -text\n';
+const INDEX_REFRESH_BATCH_SIZE = 40;
+
+function fail(reason, detail = {}) {
+  throw new TodoStoreError('STORE_EOL_REPAIR_UNSAFE', reason, undefined, detail);
+}
+
+async function regularFileState(absolute, ref) {
+  let stats;
+  try { stats = await lstat(absolute); } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    fail('artifact_unreadable', { ref, message: error.message });
+  }
+  if (stats.isSymbolicLink() || !stats.isFile()) fail('unsafe_artifact_path', { ref });
+  return stats;
+}
+
+async function assertSafeDirectoryChain(repoRoot, relative) {
+  let absolute = repoRoot;
+  let ref = '';
+  for (const segment of relative.replaceAll('\\', '/').split('/')) {
+    ref = path.posix.join(ref, segment);
+    absolute = path.join(absolute, segment);
+    let stats;
+    try { stats = await lstat(absolute); } catch (error) {
+      fail(error?.code === 'ENOENT' ? 'store_missing' : 'store_unreadable', {
+        ref, message: error.message,
+      });
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) fail('unsafe_artifact_path', { ref });
+  }
+  return absolute;
+}
+
+async function safeRegularFileState(repoRoot, ref) {
+  await assertSafeDirectoryChain(repoRoot, path.posix.dirname(ref));
+  return regularFileState(path.join(repoRoot, ref), ref);
+}
+
+async function collectArtifactRefs(repoRoot, relative = STORE_REF) {
+  const absolute = await assertSafeDirectoryChain(repoRoot, relative);
+  let entries;
+  try { entries = await readdir(absolute, { withFileTypes: true }); } catch (error) {
+    fail(error?.code === 'ENOENT' ? 'store_missing' : 'store_unreadable', {
+      ref: relative, message: error.message,
+    });
+  }
+  const refs = [];
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const ref = path.posix.join(relative.replaceAll('\\', '/'), entry.name);
+    if (entry.isSymbolicLink()) fail('unsafe_artifact_path', { ref });
+    if (entry.isDirectory()) refs.push(...await collectArtifactRefs(repoRoot, ref));
+    else if (entry.isFile() && /\.(?:json|jsonl)$/u.test(entry.name)) refs.push(ref);
+    else if (!entry.isFile()) fail('unsafe_artifact_path', { ref });
+  }
+  return refs;
+}
+
+function normalizePureCrlf(bytes, ref) {
+  if (!bytes.includes(13)) return null;
+  const normalized = [];
+  for (let index = 0; index < bytes.length; index += 1) {
+    const byte = bytes[index];
+    if (byte !== 13) {
+      normalized.push(byte);
+      continue;
+    }
+    if (bytes[index + 1] !== 10) fail('artifact_not_pure_crlf_conversion', { ref });
+  }
+  return Buffer.from(normalized);
+}
+
+async function atomicReplace({ repoRoot, ref, absolute, sourceBytes, bytes, mode }) {
+  await safeRegularFileState(repoRoot, ref);
+  const currentBytes = await readFile(absolute);
+  if (!currentBytes.equals(sourceBytes)) fail('artifact_changed_during_repair', { ref });
+  const temporary = `${absolute}.eol-repair-${process.pid}-${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    await writeFile(temporary, bytes, { flag: 'wx', mode: mode & 0o777 });
+    await rename(temporary, absolute);
+  } catch (error) {
+    try { await rm(temporary, { force: true }); } catch { /* noop */ }
+    fail('artifact_write_failed', { ref: path.basename(absolute), message: error.message });
+  }
+}
+
+async function prepareProtection(repoRoot) {
+  const absolute = path.join(repoRoot, ATTRIBUTES_REF);
+  const stats = await safeRegularFileState(repoRoot, ATTRIBUTES_REF);
+  if (stats === null) return { absolute, create: true };
+  const text = await readFile(absolute, 'utf8');
+  if (!text.split(/\r?\n/u).includes('* -text')) {
+    fail('eol_protection_conflict', { ref: ATTRIBUTES_REF, required_rule: '* -text' });
+  }
+  return { absolute, create: false };
+}
+
+function stagedArtifactRefs(repoRoot, refs) {
+  const staged = new Set();
+  for (let offset = 0; offset < refs.length; offset += INDEX_REFRESH_BATCH_SIZE) {
+    const batch = refs.slice(offset, offset + INDEX_REFRESH_BATCH_SIZE);
+    const result = gitSpawnSync(['diff-index', '--cached', '--name-only', '-z', 'HEAD', '--', ...batch], {
+      cwd: repoRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    if (result.error || result.signal || result.status !== 0) {
+      fail('git_index_artifacts_unreadable', { refs: batch, status: result.status ?? null });
+    }
+    for (const ref of (result.stdout ?? '').split('\0')) {
+      if (ref !== '') staged.add(ref.replaceAll('\\', '/'));
+    }
+  }
+  return staged;
+}
+
+function refreshGitIndex(repoRoot, refs) {
+  for (let offset = 0; offset < refs.length; offset += INDEX_REFRESH_BATCH_SIZE) {
+    const batch = refs.slice(offset, offset + INDEX_REFRESH_BATCH_SIZE);
+    const refresh = gitSpawnSync(['update-index', '--refresh', '--', ...batch], {
+      cwd: repoRoot, stdio: 'ignore',
+    });
+    // 対象は呼出前にindex blob=HEADを実証済み。update-index --refreshで内容をstageせずstatだけを揃える。
+    if (refresh.error || refresh.signal || ![0, 1].includes(refresh.status)) {
+      fail('git_index_refresh_failed', { refs: batch, status: refresh.status ?? null });
+    }
+    const verified = gitSpawnSync(['diff-files', '--quiet', '--', ...batch], {
+      cwd: repoRoot, stdio: 'ignore',
+    });
+    if (verified.error || verified.signal || verified.status !== 0) {
+      fail('git_index_refresh_failed', { refs: batch, status: verified.status ?? null });
+    }
+  }
+}
+
+/**
+ * Gitのcheckoutがcanonical LF artifactをCRLFへ変換した既存storeだけを修復する。
+ * JSONの意味・順序・空白には触れず、CRLF除去後にcanonical byte列へ完全一致するfileだけを書く。
+ */
+export async function repairTodoStoreWorktreeEol({ repoRoot }) {
+  const protection = await prepareProtection(repoRoot);
+  const refs = await collectArtifactRefs(repoRoot);
+  const stagedRefs = stagedArtifactRefs(repoRoot, refs);
+  const artifacts = [];
+  for (const ref of refs) {
+    const absolute = path.join(repoRoot, ref);
+    const stats = await safeRegularFileState(repoRoot, ref);
+    const bytes = await readFile(absolute);
+    const normalized = normalizePureCrlf(bytes, ref);
+    artifacts.push({
+      ref, absolute, sourceBytes: bytes, bytes: normalized ?? bytes, mode: stats.mode,
+      converted: normalized !== null,
+    });
+  }
+
+  let headArtifacts = [];
+  let indexArtifacts = [];
+  if (artifacts.length > 0) {
+    const maxBodyBytes = Math.max(...artifacts.map(({ bytes }) => bytes.length));
+    try {
+      headArtifacts = gitCatFileBatch(artifacts.map(({ ref }) => `HEAD:${ref}`), {
+        cwd: repoRoot, maxBodyBytes,
+      });
+    } catch (error) {
+      fail('git_head_artifacts_unreadable', { message: error.message });
+    }
+    try {
+      indexArtifacts = gitCatFileBatch(artifacts.map(({ ref }) => `:${ref}`), {
+        cwd: repoRoot, maxBodyBytes,
+      });
+    } catch (error) {
+      fail('git_index_artifacts_unreadable', { message: error.message });
+    }
+  }
+  const converted = [];
+  const refreshRefs = [];
+  for (const [index, artifact] of artifacts.entries()) {
+    const head = headArtifacts[index];
+    const staged = indexArtifacts[index];
+    if (artifact.converted) {
+      if (head?.type !== 'blob' || !head.bytes.equals(artifact.bytes)) {
+        fail('artifact_not_pure_checkout_conversion', { ref: artifact.ref });
+      }
+      if (stagedRefs.has(artifact.ref)
+        || staged?.type !== 'blob' || !staged.bytes.equals(head.bytes)) {
+        fail('artifact_staged_change_present', { ref: artifact.ref });
+      }
+      converted.push(artifact);
+    }
+    if (!stagedRefs.has(artifact.ref) && head?.type === 'blob' && staged?.type === 'blob'
+      && staged.bytes.equals(head.bytes) && artifact.bytes.equals(head.bytes)) {
+      refreshRefs.push(artifact.ref);
+    }
+  }
+
+  for (const artifact of converted) {
+    await atomicReplace({ repoRoot, ...artifact });
+  }
+  // 0.64.2がLF書換後のstat refreshで止まった部分状態も、再実行だけで回復させる。
+  refreshGitIndex(repoRoot, refreshRefs);
+  if (protection.create) {
+    await assertSafeDirectoryChain(repoRoot, path.posix.dirname(ATTRIBUTES_REF));
+    await writeFile(protection.absolute, EOL_PROTECTION, { flag: 'wx' });
+  }
+
+  return {
+    repaired_refs: converted.map(({ ref }) => ref),
+    protection_ref: ATTRIBUTES_REF,
+    protection_created: protection.create,
+  };
+}

package/src/todo-store.mjs

@@ -135,18 +135,26 @@ function decodeUtf8(bytes, code, reason) {
   catch { fail(code, reason); }
 }
 
-function parseCanonicalJsonLine(bytes, { code, reason, maxBytes, validate }) {
-  if (bytes.length === 0 || bytes.length > maxBytes) fail(code, bytes.length > maxBytes ? 'size_limit_exceeded' : reason);
+function parseCanonicalJsonLine(bytes, { code, reason, maxBytes, validate, ref = null }) {
+  const detail = ref === null ? undefined : { ref };
+  if (bytes.length === 0 || bytes.length > maxBytes) {
+    fail(code, bytes.length > maxBytes ? 'size_limit_exceeded' : reason, detail);
+  }
   const text = decodeUtf8(bytes, code, 'invalid_utf8');
-  if (text.includes('\r') || text.startsWith('\uFEFF')) fail(code, reason);
+  if (text.includes('\r')) {
+    fail(code, 'artifact_eol_converted', {
+      ...detail, next_action: 'lattice todo repair-eol --json',
+    });
+  }
+  if (text.startsWith('\uFEFF')) fail(code, reason, detail);
   const body = text.endsWith('\n') ? text.slice(0, -1) : text;
   let value;
-  try { value = JSON.parse(body); } catch { fail(code, reason); }
-  if (!text.endsWith('\n')) fail(code, reason);
+  try { value = JSON.parse(body); } catch { fail(code, reason, detail); }
+  if (!text.endsWith('\n')) fail(code, reason, detail);
   let expected;
-  try { expected = `${canonicalizeTodoArtifact(value)}\n`; } catch { fail(code, reason); }
-  if (text !== expected) fail(code, 'non_canonical_or_duplicate_key');
-  if (!validate(value)) fail(code, 'schema_invalid');
+  try { expected = `${canonicalizeTodoArtifact(value)}\n`; } catch { fail(code, reason, detail); }
+  if (text !== expected) fail(code, 'non_canonical_or_duplicate_key', detail);
+  if (!validate(value)) fail(code, 'schema_invalid', detail);
   return value;
 }
 
@@ -154,7 +162,9 @@ async function readArtifact(repoRoot, ref, { code, maxBytes, validate, missing =
   const state = await pathState(repoRoot, ref, code, { missing });
   if (state === null) return null;
   const bytes = await readFile(state.absolute);
-  return parseCanonicalJsonLine(bytes, { code, reason: 'artifact_truncated_or_trailing_bytes', maxBytes, validate });
+  return parseCanonicalJsonLine(bytes, {
+    code, reason: 'artifact_truncated_or_trailing_bytes', maxBytes, validate, ref,
+  });
 }
 
 async function readSnapshotArtifact(repoRoot, ref) {
@@ -163,16 +173,23 @@ async function readSnapshotArtifact(repoRoot, ref) {
   const bytes = await readFile(state.absolute);
   return parseCanonicalJsonLine(bytes, {
     code: 'SNAPSHOT_INVALID', reason: 'snapshot_truncated_or_trailing_bytes',
-    maxBytes: TODO_LIMITS.snapshotBytes, validate: validateTodoSnapshot,
+    maxBytes: TODO_LIMITS.snapshotBytes, validate: validateTodoSnapshot, ref,
   });
 }
 
-function parseJournalSegment(bytes) {
+function parseJournalSegment(bytes, ref = null) {
+  const detail = ref === null ? undefined : { ref };
   if (bytes.length === 0 || bytes.length > TODO_LIMITS.journalSegmentBytes) {
-    fail('STORE_CORRUPT', bytes.length > TODO_LIMITS.journalSegmentBytes ? 'journal_segment_limit_exceeded' : 'journal_empty');
+    fail('STORE_CORRUPT', bytes.length > TODO_LIMITS.journalSegmentBytes
+      ? 'journal_segment_limit_exceeded' : 'journal_empty', detail);
   }
   const text = decodeUtf8(bytes, 'STORE_CORRUPT', 'journal_invalid_utf8');
-  if (!text.endsWith('\n') || text.includes('\r') || text.startsWith('\uFEFF')) fail('STORE_CORRUPT', 'journal_byte_contract');
+  if (text.includes('\r')) {
+    fail('STORE_CORRUPT', 'artifact_eol_converted', {
+      ...detail, next_action: 'lattice todo repair-eol --json',
+    });
+  }
+  if (!text.endsWith('\n') || text.startsWith('\uFEFF')) fail('STORE_CORRUPT', 'journal_byte_contract', detail);
   const lines = text.slice(0, -1).split('\n');
   if (lines.some((line) => line.length === 0)) fail('STORE_CORRUPT', 'journal_truncated_or_empty_line');
   return lines.map((line) => {
@@ -205,8 +222,8 @@ async function readJournal(repoRoot, journalRef) {
       const [, startText, endText, previousDigest, segmentDigest] = name.match(
         /^(\d{12})-(\d{12})-([0-9a-f]{64})-([0-9a-f]{64})\.jsonl$/u,
       );
+      const events = parseJournalSegment(bytes, ref);
       if (sha256Bytes(bytes) !== segmentDigest) fail('STORE_CORRUPT', 'sealed_segment_digest_mismatch');
-      const events = parseJournalSegment(bytes);
       if (events[0].sequence !== Number(startText) || events.at(-1).sequence !== Number(endText)) {
         fail('STORE_CORRUPT', 'sealed_segment_range_mismatch');
       }
@@ -220,7 +237,7 @@ async function readJournal(repoRoot, journalRef) {
     if (error?.code !== 'ENOENT') fail('STORE_CORRUPT', 'sealed_segment_read_failed');
   }
   const activeBytes = await readFile(state.absolute);
-  segments.push({ ref: journalRef, bytes: activeBytes, events: parseJournalSegment(activeBytes) });
+  segments.push({ ref: journalRef, bytes: activeBytes, events: parseJournalSegment(activeBytes, journalRef) });
   const events = segments.flatMap(({ events: entries }) => entries);
   const failures = verifyLinearHashChain({
     entries: events,
@@ -291,7 +308,7 @@ async function readPlanScopedJournal(repoRoot, journalRef) {
     if (error?.code === 'ENOENT') return { ref, events: [], activeBytes: Buffer.alloc(0) };
     fail('STORE_CORRUPT', 'plan_scoped_journal_read_failed');
   }
-  const events = parseJournalSegment(bytes);
+  const events = parseJournalSegment(bytes, ref);
   if (!events.every(({ kind }) => TODO_PLAN_SCOPED_EVENT_KINDS.includes(kind))) {
     fail('STORE_CORRUPT', 'plan_scoped_journal_kind_invalid');
   }
@@ -1571,7 +1588,8 @@ export async function readTodoStore(options = {}) {
       snapshotStale = snapshot === null || canonicalizeTodoArtifact(snapshot) !== canonicalizeTodoArtifact(expectedSnapshot);
     } catch (error) {
       if (error instanceof TodoStoreError && error.code === 'SNAPSHOT_INVALID'
-        && !['unsafe_artifact_path', 'path_alias_or_escape', 'path_outside_store'].includes(error.detail.reason)) snapshotStale = true;
+        && !['unsafe_artifact_path', 'path_alias_or_escape', 'path_outside_store',
+          'artifact_eol_converted'].includes(error.detail.reason)) snapshotStale = true;
       else throw error;
     }
     if (options.forWrite === true && snapshotStale) fail('STORE_WRITE_REFUSED', 'snapshot_stale');