@sqdr2/dsh-fusion 0.0.0-stage → 0.3.2

package/src/store-migration.ts

@@ -0,0 +1,65 @@
+import { cpSync, existsSync, mkdirSync, renameSync, rmSync, rmdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+/** Files SQLite may keep open beside the database itself. */
+const SQLITE_SIDECARS = ['-wal', '-shm', '-journal'] as const
+
+/**
+ * Copy a database and its open sidecar files into a new directory.
+ *
+ * This is the fallback for an installation whose old and new plugin
+ * directories sit on different filesystems, where a directory move cannot
+ * work. Only the files this plugin owns are copied and removed; anything else
+ * a user left in the directory stays where it is.
+ *
+ * @param legacy - directory the previous name used.
+ * @param next - directory the current name uses.
+ * @param filename - database file name inside both directories.
+ * @returns whether the database was copied.
+ */
+export function copyLegacyStateFile(legacy: string, next: string, filename = 'state.sqlite'): boolean {
+  const source = join(legacy, filename), target = join(next, filename)
+  if (existsSync(target) || !existsSync(source)) return false
+  try {
+    mkdirSync(next, { recursive: true })
+    cpSync(source, target)
+    for (const suffix of SQLITE_SIDECARS) {
+      if (existsSync(`${source}${suffix}`)) cpSync(`${source}${suffix}`, `${target}${suffix}`)
+    }
+  } catch {
+    for (const suffix of ['', ...SQLITE_SIDECARS]) rmSync(`${target}${suffix}`, { force: true })
+    return false
+  }
+  for (const suffix of ['', ...SQLITE_SIDECARS]) rmSync(`${source}${suffix}`, { force: true })
+  try {
+    rmdirSync(legacy)
+  } catch {
+    // Another file lives there; the copied database is complete either way.
+  }
+  return true
+}
+
+/**
+ * Carry a plugin-owned directory over to the name this release uses.
+ *
+ * A rename must keep the state it already has: the Fusion ledger holds every
+ * task, brief and artifact, so an upgrade that starts an empty store beside
+ * the old one silently loses the user's work. A directory move is tried first
+ * so a live database is never copied while another process has it open; a
+ * cross-device installation falls back to {@link copyLegacyStateFile}.
+ *
+ * @param legacy - directory the previous name used.
+ * @param next - directory the current name uses.
+ * @param filename - database file name inside both directories.
+ * @returns whether a legacy directory was adopted.
+ */
+export function adoptLegacyStateDirectory(legacy: string, next: string, filename = 'state.sqlite'): boolean {
+  if (existsSync(next) || !existsSync(legacy)) return false
+  try {
+    renameSync(legacy, next)
+    return true
+  } catch {
+    // Cross-device or a locked directory: copy the database files instead.
+  }
+  return copyLegacyStateFile(legacy, next, filename)
+}

package/src/task/deletion.ts

@@ -0,0 +1,105 @@
+import { FusionError, TASK_BUSY } from '../errors.js'
+
+/**
+ * Whether a task record may be cleared out of the history.
+ *
+ * The question is not "what phase did this task reach" but "is anything still
+ * writing into the rows a deletion removes". A phase is a projection of the
+ * last event a running process appended; a process that was replaced (Host
+ * restart, HMR reload, crash) never appends the event that would have moved
+ * the phase on, so a finished task keeps the phase and `control.mode` of its
+ * last living moment forever. Deciding on those fields makes such a record
+ * permanently undeletable even though nothing owns it any more.
+ *
+ * So the decision is taken from evidence of a live writer, in two classes:
+ *
+ * - `live`: the Host in this process still owns an Agent, tool call, write
+ *   lease or stop for the task. This is the only authority that can see
+ *   in-process work, and it is what actually keeps a running task undeletable.
+ * - `foreign`: a durable row (native effect, approval, check invocation) left
+ *   in a pending state by a *different* process that is provably still alive.
+ *   Rows written by this process are not evidence: if the in-process authority
+ *   says nothing is live, the row is the residue of an interrupted call.
+ */
+export interface DeletionEvidence {
+  /** Why this task still owns live work in this process, or `undefined` when it owns none. */
+  readonly live: DeletionBlocker | undefined
+  /** Pending durable rows written by another process whose pid still exists. */
+  readonly foreign: readonly string[]
+}
+
+/** What still holds the task, named so the panel can explain it in either language. */
+export type DeletionBlocker =
+  /** A native Agent for this task is not idle. */
+  | 'agent'
+  /** A native tool call is still in flight. */
+  | 'tool'
+  /** A native job or background stop has not proved quiescence. */
+  | 'job'
+  /** The task still holds (or is releasing) the workspace write lease. */
+  | 'lease'
+  /** Only another, still-living process holds it. */
+  | 'foreign-process'
+
+export type DeletionVerdict =
+  | { readonly allowed: true }
+  | { readonly allowed: false; readonly blocker: DeletionBlocker; readonly detail: string }
+
+export const DELETION_ALLOWED: DeletionVerdict = { allowed: true }
+
+/** The one refusal the panel already knows how to translate; the blocker rides alongside it. */
+export class DeletionBlocked extends FusionError {
+  constructor(readonly blocker: DeletionBlocker, readonly detail: string) {
+    super(TASK_BUSY, 'Cannot delete a running task')
+  }
+}
+
+/** Pure decision, so the rule is testable without a Host, a process table or a database. */
+export function deletionVerdict(evidence: DeletionEvidence): DeletionVerdict {
+  if (evidence.live) return { allowed: false, blocker: evidence.live, detail: LIVE_DETAIL[evidence.live] }
+  if (evidence.foreign.length) {
+    const shown = evidence.foreign.slice(0, 3).join(', ')
+    const more = evidence.foreign.length > 3 ? ` and ${evidence.foreign.length - 3} more` : ''
+    return { allowed: false, blocker: 'foreign-process', detail: `another Host process is still working on it (${shown}${more})` }
+  }
+  return DELETION_ALLOWED
+}
+
+const LIVE_DETAIL: Readonly<Record<DeletionBlocker, string>> = {
+  agent: 'its Lead or Sidekick is not idle',
+  tool: 'a native tool call is still in flight',
+  job: 'a native job is still running',
+  lease: 'it still holds the workspace write lease',
+  'foreign-process': 'another Host process is still working on it',
+}
+
+/** Recorded owner of a durable row, when the row carries a usable pid. */
+export function recordedProcessId(value: unknown): number | undefined {
+  if (!value || typeof value !== 'object') return undefined
+  const pid = (value as { processId?: unknown }).processId
+  return typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0 ? pid : undefined
+}
+
+/** Durable state names that mean the row was still open when its process stopped. */
+const OPEN_EFFECT = new Set(['dispatch-started', 'outcome-unknown'])
+
+/**
+ * A row is unfinished when its own state says so. The families disagree on
+ * where they record that, so each one is read through its own field and an
+ * unrecognized shape counts as settled rather than pinning the record forever.
+ */
+export function unfinishedDocument(family: string, value: unknown): boolean {
+  if (!value || typeof value !== 'object') return false
+  const row = value as Record<string, unknown>
+  switch (family) {
+    case 'native-effect': return typeof row.state === 'string' && OPEN_EFFECT.has(row.state)
+    case 'native-approval': return row.state === 'pending'
+    case 'check-invocation': {
+      const evidence = row.evidence
+      if (!evidence || typeof evidence !== 'object') return false
+      const state = (evidence as { state?: unknown }).state
+      return state === 'started' || state === 'outcome-unknown'
+    }
+    default: return false
+  }
+}