@savvy-web/silk-effects 5.3.1 → 5.5.0

package/repos/schemas/reports.js

@@ -1,9 +1,25 @@
+import { RepoNote } from "./manifest.js";
 import { Schema } from "effect";
 
 //#region src/repos/schemas/reports.ts
 /**
 * Status of one vendored repo: gitlink presence and dirtiness, plus notes
 * that no longer match the pinned ref.
+*
+* @remarks
+* `commit` is an alias of `stagedCommit`, retained for one release so an
+* existing consumer reading `entry.commit` keeps working while it migrates to
+* the index-aware triple. It carries no independent release tag beyond
+* `@public` (this schema has no narrower audience to gate it behind).
+* Removal is scheduled by a tracked issue, not gated on a renderer migration
+* precondition here.
+*
+* Not fully behavior-preserving: `commit: stagedCommit ?? null` reads `null`
+* for a gitlink committed at `HEAD` but staged for REMOVAL, where the prior
+* single-`commit` field showed the committed oid. `stagedCommit` is `None`
+* in exactly that case (nothing is staged), so the alias reports "nothing
+* staged" rather than "here is what HEAD still has" — a real, if narrow,
+* difference from the pre-triple `commit` field's behavior.
 * @public
 */
 const RepoStatusEntry = Schema.Struct({
@@ -11,7 +27,14 @@ const RepoStatusEntry = Schema.Struct({
 	ref: Schema.String,
 	purpose: Schema.String,
 	present: Schema.Boolean,
+	/** @deprecated alias of `stagedCommit`; retained for one release. */
 	commit: Schema.NullOr(Schema.String),
+	/** The gitlink oid staged in the index (`git ls-files --stage`) — sees a pin BEFORE it is committed. */
+	stagedCommit: Schema.optionalKey(Schema.String),
+	/** The gitlink oid committed at `HEAD` (`git ls-tree HEAD`). */
+	committedCommit: Schema.optionalKey(Schema.String),
+	/** The commit actually checked out in the submodule worktree (`git rev-parse HEAD` inside it); absent when there is no checkout. */
+	checkedOutCommit: Schema.optionalKey(Schema.String),
 	dirty: Schema.Boolean,
 	staleNoteIds: Schema.Array(Schema.String)
 });
@@ -26,14 +49,17 @@ const ReposStatusReport = Schema.Struct({
 /**
 * Result of reconciling working-tree submodules with the manifest: missing
 * repos initialized, sparse-checkout patterns re-applied, already-present
-* repos left alone, and stale locks cleared.
+* repos left alone, stale locks cleared, drifted submodule URLs reconciled,
+* and orphan manifest entries (no gitlink at all) registered.
 * @public
 */
 const ReposSyncReport = Schema.Struct({
 	initialized: Schema.Array(Schema.String),
 	sparseApplied: Schema.Array(Schema.String),
 	upToDate: Schema.Array(Schema.String),
-	clearedLocks: Schema.Array(Schema.String)
+	clearedLocks: Schema.Array(Schema.String),
+	urlSynced: Schema.Array(Schema.String),
+	registered: Schema.Array(Schema.String)
 });
 /**
 * Result of re-pinning a vendored repo to a new ref.
@@ -57,6 +83,51 @@ const ReposAddResult = Schema.Struct({
 	path: Schema.String
 });
 /**
+* Result of removing a vendored repo from the manifest: the gitlink, module
+* gitdir, and `.gitmodules` section are all gone, and the entry's notes are
+* surfaced so any durable ones can be promoted elsewhere before this result
+* is committed.
+* @public
+*/
+const ReposRemoveResult = Schema.Struct({
+	name: Schema.String,
+	path: Schema.String,
+	commitMessage: Schema.String,
+	removedNotes: Schema.Array(RepoNote)
+});
+/**
+* Result of renaming a vendored repo's manifest key: the `.repos/<name>`
+* worktree moved, the module gitdir's `core.worktree` values re-pointed, the
+* `.gitmodules` section canonicalized to the new name, and the manifest key
+* renamed.
+* @public
+*/
+const ReposRenameResult = Schema.Struct({
+	oldName: Schema.String,
+	newName: Schema.String,
+	path: Schema.String,
+	commitMessage: Schema.String
+});
+/**
+* Result of hard-resetting one or more vendored repos to their staged (or
+* committed) gitlink commit and re-applying sparse-checkout paths.
+*
+* @remarks
+* `restored` lists every repo actually reset, paired with the commit it was
+* reset to. `skippedClean` is populated ONLY by the names-omitted form of
+* {@link ReposManagerShape.restore} — repos left untouched because `status`
+* reported them clean; an explicit-names call never skips anything (an
+* explicit ask is always honored), so it always reports an empty array.
+* @public
+*/
+const ReposRestoreResult = Schema.Struct({
+	restored: Schema.Array(Schema.Struct({
+		name: Schema.String,
+		commit: Schema.String
+	})),
+	skippedClean: Schema.Array(Schema.String)
+});
+/**
 * Result of an agent-note mutation against a vendored repo.
 * @public
 */
@@ -72,4 +143,4 @@ const ReposNoteResult = Schema.Struct({
 });
 
 //#endregion
-export { RepoStatusEntry, ReposAddResult, ReposNoteResult, ReposPinResult, ReposStatusReport, ReposSyncReport };
+export { RepoStatusEntry, ReposAddResult, ReposNoteResult, ReposPinResult, ReposRemoveResult, ReposRenameResult, ReposRestoreResult, ReposStatusReport, ReposSyncReport };

package/repos/services/config-store.js

@@ -1,7 +1,7 @@
 import { MANIFEST_PATH, REPOS_DIR } from "../constants.js";
 import { ReposConfigError } from "../errors.js";
 import { ReposManifestFile } from "../schemas/manifest.js";
-import { Context, Effect, FileSystem, Layer, Path, Schema } from "effect";
+import { Clock, Context, Effect, FileSystem, Layer, Option, Path, Schedule, Schema } from "effect";
 
 //#region src/repos/services/config-store.ts
 /**
@@ -71,10 +71,44 @@ var ReposConfigStore = class extends Context.Service()("@savvy-web/silk-effects/
 				kind: "invalid"
 			})));
 		});
+		const lockSchedule = Schedule.exponential("25 millis").pipe(Schedule.upTo({ duration: "2 seconds" }));
+		const LOCK_MAX_AGE_MS = 6e4;
+		const acquireLock = (root) => Effect.gen(function* () {
+			const lockPath = `${manifestPath(root)}.lock`;
+			const dir = path.join(root, REPOS_DIR);
+			yield* fs.makeDirectory(dir, { recursive: true }).pipe(Effect.mapError((cause) => new ReposConfigError({
+				path: lockPath,
+				reason: `mkdir failed: ${String(cause)}`,
+				kind: "invalid"
+			})));
+			yield* Effect.gen(function* () {
+				const info = yield* fs.stat(lockPath).pipe(Effect.option);
+				if (Option.isSome(info) && Option.isSome(info.value.mtime)) {
+					if ((yield* Clock.currentTimeMillis) - info.value.mtime.value.getTime() >= LOCK_MAX_AGE_MS) yield* fs.remove(lockPath).pipe(Effect.ignore);
+				}
+				yield* Effect.scoped(fs.open(lockPath, { flag: "wx" })).pipe(Effect.asVoid);
+			}).pipe(Effect.retry({
+				schedule: lockSchedule,
+				while: (error) => error.reason._tag === "AlreadyExists"
+			}), Effect.mapError((cause) => new ReposConfigError({
+				path: lockPath,
+				reason: `timed out acquiring lock after 2s at ${lockPath}: ${String(cause)}. If no other savvy process is running, a previous run likely crashed while holding it -- remove ${lockPath} and retry.`,
+				kind: "invalid"
+			})));
+		});
+		const releaseLock = (root) => fs.remove(`${manifestPath(root)}.lock`).pipe(Effect.ignore);
+		const update = (root, fn) => Effect.scoped(Effect.gen(function* () {
+			yield* Effect.acquireRelease(acquireLock(root), () => releaseLock(root));
+			const result = fn(yield* read(root).pipe(Effect.catchTag("ReposConfigError", (error) => error.kind === "missing" ? Effect.succeed({ repos: {} }) : Effect.fail(error))));
+			const next = Effect.isEffect(result) ? yield* result : result;
+			yield* write(root, next);
+			return next;
+		}));
 		return {
 			exists,
 			read,
-			write
+			write,
+			update
 		};
 	}));
 };

package/repos/services/drift.js

@@ -0,0 +1,168 @@
+import { REPOS_DIR } from "../constants.js";
+import { GitSubmoduleError } from "../errors.js";
+import { RepoDrift, ReposDriftReport } from "../schemas/drift.js";
+import { ReposConfigStore } from "./config-store.js";
+import { Context, Effect, FileSystem, Layer, Option, Path, Result } from "effect";
+import { Git, Gitmodules } from "@effected/git";
+
+//#region src/repos/services/drift.ts
+/**
+* Reconciles the four authorities a vendored repo's state is spread across —
+* the manifest, `.gitmodules`, the worktree, and `git submodule status` —
+* and reports every disagreement found. Read-only: no staging, no lockdown
+* interaction, so it runs unmodified against a locked (`ReposLockdown`)
+* tree.
+* @public
+*/
+var ReposDrift = class extends Context.Service()("@savvy-web/silk-effects/ReposDrift") {
+	/**
+	* Production implementation of {@link ReposDrift}.
+	* @public
+	*/
+	static layer = Layer.effect(this, Effect.gen(function* () {
+		const configStore = yield* ReposConfigStore;
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const git = yield* Git;
+		/** Map any typed `@effected/git` failure onto this module's `GitSubmoduleError`. */
+		const asSubmoduleError = (command, cwd) => (error) => new GitSubmoduleError({
+			command,
+			cwd,
+			reason: error.message
+		});
+		const isPresent = (repoPath) => fs.readDirectory(repoPath).pipe(Effect.map((files) => files.length > 0), Effect.orElseSucceed(() => false));
+		const check = (root) => Effect.gen(function* () {
+			const manifest = yield* configStore.read(root);
+			const manifestEntries = Object.entries(manifest.repos);
+			const gitmodulesPath = path.join(root, ".gitmodules");
+			const gitmodulesText = yield* fs.readFileString(gitmodulesPath).pipe(Effect.map(Option.some), Effect.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect.succeed(Option.none()) : Effect.fail(asSubmoduleError("read .gitmodules", gitmodulesPath)(error))));
+			if (Option.isNone(gitmodulesText)) {
+				const drifts = manifestEntries.map(([name, entry]) => RepoDrift.make({
+					name,
+					kind: "unregisteredManifestEntry",
+					detail: `manifest entry "${name}" has no corresponding .gitmodules section (.gitmodules is absent)`,
+					manifestValue: entry.url
+				}));
+				return ReposDriftReport.make({
+					drifts,
+					clean: drifts.length === 0
+				});
+			}
+			const parsed = Gitmodules.parseResult(gitmodulesText.value);
+			if (Result.isFailure(parsed)) return ReposDriftReport.make({
+				drifts: [RepoDrift.make({
+					name: ".gitmodules",
+					kind: "gitmodulesUnparsable",
+					detail: `.gitmodules failed to parse: ${parsed.failure.message}`
+				})],
+				clean: false
+			});
+			const gitmodules = parsed.success;
+			const statuses = yield* git.submoduleStatus(root).pipe(Effect.mapError(asSubmoduleError("git submodule status", root)));
+			const statusByPath = new Map(statuses.map((status) => [status.path, status]));
+			const drifts = [];
+			const matchedSectionNames = /* @__PURE__ */ new Set();
+			const pairedByName = /* @__PURE__ */ new Map();
+			for (const [name] of manifestEntries) {
+				const expectedPath = `${REPOS_DIR}/${name}`;
+				const nameMatch = gitmodules.entries.find((candidate) => candidate.name === expectedPath && !matchedSectionNames.has(candidate.name));
+				if (nameMatch) {
+					matchedSectionNames.add(nameMatch.name);
+					pairedByName.set(name, {
+						section: nameMatch,
+						viaPath: false
+					});
+				}
+			}
+			for (const [name] of manifestEntries) {
+				if (pairedByName.has(name)) continue;
+				const expectedPath = `${REPOS_DIR}/${name}`;
+				const pathMatch = gitmodules.entries.find((candidate) => candidate.path === expectedPath && !matchedSectionNames.has(candidate.name));
+				if (pathMatch) {
+					matchedSectionNames.add(pathMatch.name);
+					pairedByName.set(name, {
+						section: pathMatch,
+						viaPath: true
+					});
+				}
+			}
+			for (const [name, entry] of manifestEntries) {
+				const expectedPath = `${REPOS_DIR}/${name}`;
+				const paired = pairedByName.get(name);
+				if (!paired) {
+					drifts.push(RepoDrift.make({
+						name,
+						kind: "unregisteredManifestEntry",
+						detail: `manifest entry "${name}" has no corresponding .gitmodules section`,
+						manifestValue: entry.url
+					}));
+					continue;
+				}
+				const { section, viaPath } = paired;
+				const pathMatch = viaPath ? section : void 0;
+				if (pathMatch) drifts.push(RepoDrift.make({
+					name,
+					kind: "pathMismatch",
+					detail: `manifest entry "${name}" paired with .gitmodules section "${pathMatch.name}" by its path "${expectedPath}" -- the section name diverges from the manifest entry name`,
+					manifestValue: name,
+					observedValue: pathMatch.name
+				}));
+				else if (section.path !== expectedPath) drifts.push(RepoDrift.make({
+					name,
+					kind: "pathMismatch",
+					detail: `manifest entry "${name}" expects path "${expectedPath}" but .gitmodules records "${section.path}"`,
+					manifestValue: expectedPath,
+					observedValue: section.path
+				}));
+				if (section.url !== entry.url) drifts.push(RepoDrift.make({
+					name,
+					kind: "urlMismatch",
+					detail: `manifest entry "${name}" expects url "${entry.url}" but .gitmodules records "${section.url}"`,
+					manifestValue: entry.url,
+					observedValue: section.url
+				}));
+				if (section.shallow !== true) drifts.push(RepoDrift.make({
+					name,
+					kind: "missingShallow",
+					detail: `.gitmodules does not record submodule.${section.name}.shallow = true`,
+					observedValue: section.shallow === void 0 ? "unset" : String(section.shallow)
+				}));
+				const repoPath = path.join(root, section.path);
+				const present = yield* isPresent(repoPath);
+				const status = statusByPath.get(section.path);
+				if (!present || status?.state === "uninitialized") drifts.push(RepoDrift.make({
+					name,
+					kind: "missingWorktree",
+					detail: `manifest entry "${name}" expects a checked-out worktree at "${section.path}" but none is present`
+				}));
+				else if (status?.state === "outOfSync") drifts.push(RepoDrift.make({
+					name,
+					kind: "checkoutDiverged",
+					detail: `the worktree checked out at "${section.path}" no longer matches the commit recorded in the superproject index`
+				}));
+				else if (status?.state === "conflict") drifts.push(RepoDrift.make({
+					name,
+					kind: "checkoutDiverged",
+					detail: `submodule index entry for "${section.path}" is in an unresolved merge conflict`
+				}));
+			}
+			for (const section of gitmodules.entries) {
+				if (matchedSectionNames.has(section.name)) continue;
+				drifts.push(RepoDrift.make({
+					name: section.name,
+					kind: "orphanGitmodulesEntry",
+					detail: `.gitmodules section "${section.name}" has no corresponding manifest entry`,
+					observedValue: section.path
+				}));
+			}
+			return ReposDriftReport.make({
+				drifts,
+				clean: drifts.length === 0
+			});
+		});
+		return { check };
+	}));
+};
+
+//#endregion
+export { ReposDrift };

package/repos/services/lockdown.js

@@ -0,0 +1,119 @@
+import { REPOS_DIR } from "../constants.js";
+import { ReposLockdownError } from "../errors.js";
+import { Context, Effect, Exit, FileSystem, Layer, Option, Path } from "effect";
+
+//#region src/repos/services/lockdown.ts
+const FILE_LOCKED_BASE_MODE = 292;
+const DIR_LOCKED_MODE = 365;
+const FILE_UNLOCKED_BASE_MODE = 420;
+const DIR_UNLOCKED_MODE = 493;
+const EXEC_BITS = 73;
+/**
+* Preserves the executable bit through a lock/unlock transition: a file
+* whose current mode has any of the owner/group/other execute bits set
+* locks to `0o555` and unlocks to `0o755` instead of stripping execute
+* permission entirely.
+*/
+const fileModeFor = (baseMode, currentMode) => baseMode | (currentMode & EXEC_BITS ? EXEC_BITS : 0);
+/**
+* Derives a submodule's git metadata directory (`.git/modules/...`) from the
+* checkout itself rather than assuming it is named after the manifest key.
+*
+* A submodule worktree's `<root>/.repos/<name>/.git` is normally a FILE
+* containing a single `gitdir: <path>` line pointing at the real metadata
+* directory, which git names after whatever path/name the submodule was
+* REGISTERED under — not necessarily the manifest key (e.g. this repo's own
+* `effect` entry has gitdir `.git/modules/.repos/effect-smol`). This helper
+* reads that pointer and resolves it (relative pointers are relative to the
+* directory containing the `.git` file) so callers always land on the real
+* metadata directory.
+*
+* Falls back to the name-based path `<root>/.git/modules/<REPOS_DIR>/<name>`
+* whenever the pointer can't be read (submodule not initialized, `.git`
+* missing) — this never fails, it only degrades to prior behavior. If
+* `<root>/.repos/<name>/.git` is itself a directory (a plain, non-submodule
+* checkout), it is used directly as the metadata directory.
+*
+* @internal
+*/
+const resolveModuleDir = (fs, path, root, name) => Effect.gen(function* () {
+	const fallback = path.join(root, ".git", "modules", REPOS_DIR, name);
+	const dotGit = path.join(root, REPOS_DIR, name, ".git");
+	const info = yield* fs.stat(dotGit).pipe(Effect.option);
+	if (Option.isNone(info)) return fallback;
+	if (info.value.type === "Directory") return dotGit;
+	const content = yield* fs.readFileString(dotGit).pipe(Effect.option);
+	if (Option.isNone(content)) return fallback;
+	const match = /^gitdir:\s*(.+)$/m.exec(content.value);
+	if (!match?.[1]) return fallback;
+	const pointer = match[1].trim();
+	const resolved = path.isAbsolute(pointer) ? pointer : path.resolve(path.dirname(dotGit), pointer);
+	const relative = path.relative(root, resolved);
+	if (relative.startsWith("..") || path.isAbsolute(relative)) return fallback;
+	return resolved;
+});
+/**
+* Enforces OS-level read-only permissions on vendored repos so they cannot
+* be accidentally edited outside the sync flow.
+* @public
+*/
+var ReposLockdown = class extends Context.Service()("@savvy-web/silk-effects/ReposLockdown") {
+	/**
+	* Production layer over the core FileSystem.
+	* @public
+	*/
+	static layer = Layer.effect(this, Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const path = yield* Path.Path;
+		const chmod = (entryPath, mode) => fs.chmod(entryPath, mode).pipe(Effect.mapError((cause) => new ReposLockdownError({
+			path: entryPath,
+			reason: `chmod failed: ${String(cause)}`
+		})));
+		const isSymlink = (entryPath) => fs.readLink(entryPath).pipe(Effect.option, Effect.map(Option.isSome));
+		const walk = (dir, fileBaseMode, dirMode, order) => Effect.gen(function* () {
+			if (order === "unlock") yield* chmod(dir, dirMode);
+			const entries = yield* fs.readDirectory(dir).pipe(Effect.mapError((cause) => new ReposLockdownError({
+				path: dir,
+				reason: `readDirectory failed: ${String(cause)}`
+			})));
+			for (const entry of entries) {
+				const entryPath = path.join(dir, entry);
+				if (yield* isSymlink(entryPath)) continue;
+				const maybeInfo = yield* fs.stat(entryPath).pipe(Effect.option);
+				if (Option.isNone(maybeInfo)) continue;
+				const info = maybeInfo.value;
+				if (info.type === "Directory") yield* walk(entryPath, fileBaseMode, dirMode, order);
+				else yield* chmod(entryPath, fileModeFor(fileBaseMode, info.mode));
+			}
+			if (order === "lock") yield* chmod(dir, dirMode);
+		});
+		const walkRoot = (root, name, fileBaseMode, dirMode, order) => Effect.gen(function* () {
+			const moduleDir = yield* resolveModuleDir(fs, path, root, name);
+			for (const dir of [path.join(root, REPOS_DIR, name), moduleDir]) {
+				if (!(yield* fs.exists(dir).pipe(Effect.mapError((cause) => new ReposLockdownError({
+					path: dir,
+					reason: `stat failed: ${String(cause)}`
+				}))))) continue;
+				yield* walk(dir, fileBaseMode, dirMode, order);
+			}
+		});
+		const lock = (root, name) => walkRoot(root, name, FILE_LOCKED_BASE_MODE, DIR_LOCKED_MODE, "lock");
+		const unlock = (root, name) => walkRoot(root, name, FILE_UNLOCKED_BASE_MODE, DIR_UNLOCKED_MODE, "unlock");
+		const withUnlocked = (root, name, effect) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+			const unlockExit = yield* Effect.exit(unlock(root, name));
+			const resultExit = Exit.isFailure(unlockExit) ? Exit.failCause(unlockExit.cause) : yield* Effect.exit(restore(effect));
+			const relockExit = yield* Effect.exit(lock(root, name));
+			if (Exit.isFailure(resultExit)) return yield* Exit.failCause(resultExit.cause);
+			if (Exit.isFailure(relockExit)) return yield* Exit.failCause(relockExit.cause);
+			return resultExit.value;
+		}));
+		return {
+			lock,
+			unlock,
+			withUnlocked
+		};
+	}));
+};
+
+//#endregion
+export { ReposLockdown, resolveModuleDir };