@stravica-ai/digital-operator-pa 0.1.0 → 0.1.2

package/dist/engineering-pa-cli/src/sync/git.mjs

@@ -23,8 +23,21 @@
 // under that subtree) — exactly the case a brand-new mount hits. `=all`
 // makes git enumerate every untracked file individually, so each path
 // is checked against the exclusion prefixes on its own merits.
+//
+// `-z` is equally load-bearing: without it, git C-quotes any path
+// containing a space or non-ASCII byte (`core.quotePath` defaults true),
+// emitting `?? "dir/Club photo.jpeg"` with the double-quotes and octal
+// escapes as LITERAL characters in the output. registry-scope.mjs then
+// slices that quoted string off the line and hands it to `git add --`
+// verbatim, so git looks for a file literally named `"dir/Club
+// photo.jpeg"` (quotes included) and fails with `fatal: pathspec … did
+// not match any files`, taking the whole sync tick down with exit 3.
+// `-z` switches the output to NUL-delimited records that are NEVER
+// quoted (git emits the raw bytes), eliminating the entire quoted-
+// pathspec bug class — spaces, quotes, backslashes, and unicode alike.
+// See parsePorcelainPaths in registry-scope.mjs for the NUL parser.
 export async function statusPorcelain(runner, { cwd }) {
-  return runner.spawn('git', ['status', '--porcelain', '--untracked-files=all'], { cwd });
+  return runner.spawn('git', ['status', '--porcelain', '-z', '--untracked-files=all'], { cwd });
 }
 
 export async function currentBranch(runner, { cwd }) {
@@ -93,22 +106,37 @@ export async function push(runner, { cwd }) {
 // git-status(1) `Short Format` — "Unmerged entries have the following
 // second column"): DD, AU, UD, UA, DU, AA, UU. Anything else is a normal
 // modification (M ), untracked (??), etc.
+//
+// Uses `-z` (NUL-delimited, never C-quoted) for the same reason
+// statusPorcelain does: a conflicted path with a space or non-ASCII byte
+// would otherwise be emitted C-quoted and flow — quotes and all — into
+// `git checkout --ours -- <path>` / `git add -- <path>` during
+// auto-resolve, failing the same way the staging path did. NUL records
+// carry the raw bytes, so the paths passed downstream match on disk.
 export async function listConflictedPaths(runner, { cwd }) {
-  const r = await runner.spawn('git', ['status', '--porcelain'], { cwd });
+  const r = await runner.spawn('git', ['status', '--porcelain', '-z'], { cwd });
   if (r.code !== 0) {
     return { code: r.code, stderr: r.stderr, paths: [] };
   }
   const paths = [];
-  for (const line of r.stdout.split('\n')) {
-    // Porcelain v1 line: `XY <path>` where XY is exactly two chars
-    // followed by a space. Renamed entries use `XY <old> -> <new>` — the
-    // conflict codes below never apply to renames, so we treat the tail
-    // as the path verbatim.
-    if (line.length < 4) continue;
-    const xy = line.slice(0, 2);
+  // `-z` records are NUL-terminated (trailing empty token after the final
+  // NUL). Each record is `XY <path>`; XY is exactly two chars followed by
+  // a space. Renamed/copied entries (`R`/`C` in the X column) carry a
+  // SECOND NUL-terminated field — the source path — which we must step
+  // over so it is not mis-scanned as its own record. Conflict codes never
+  // apply to renames, so a rename record never contributes a path here.
+  const records = r.stdout.split('\0');
+  for (let i = 0; i < records.length; i += 1) {
+    const rec = records[i];
+    if (rec.length < 4) continue;
+    const xy = rec.slice(0, 2);
+    if (xy[0] === 'R' || xy[0] === 'C') {
+      i += 1; // consume the trailing source-path field
+      continue;
+    }
     if (xy === 'DD' || xy === 'AU' || xy === 'UD' || xy === 'UA'
         || xy === 'DU' || xy === 'AA' || xy === 'UU') {
-      paths.push(line.slice(3));
+      paths.push(rec.slice(3));
     }
   }
   return { code: 0, stderr: '', paths };

package/dist/engineering-pa-cli/src/sync/registry-scope.mjs

@@ -171,30 +171,44 @@ export function computeCommitScope({ repoRoot, hostnameFn = osHostname }) {
 }
 
 /**
- * Parse `git status --porcelain` output into a flat list of paths. Rename
- * entries (`R  old -> new`) contribute BOTH paths — `git add -- <path>`
- * correctly stages a deletion when given an explicit path that no longer
- * exists on disk (git >= 2.0), so staging both sides of a rename is
- * sufficient without needing `-A` semantics.
+ * Parse `git status --porcelain -z` output into a flat list of paths.
+ * Rename entries contribute BOTH paths — `git add -- <path>` correctly
+ * stages a deletion when given an explicit path that no longer exists on
+ * disk (git >= 2.0), so staging both sides of a rename is sufficient
+ * without needing `-A` semantics.
  *
- * Shares the same C-style-quoting limitation as `listConflictedPaths` in
- * git.mjs (paths with unusual characters are not unquoted) — acceptable,
- * matches existing precedent in this module.
+ * Expects the `-z` (NUL-delimited) format produced by
+ * `git.mjs`'s statusPorcelain — NOT the default newline format. `-z`
+ * records are never C-quoted (git emits raw path bytes), which is the
+ * whole point: the default format wraps any path containing a space or
+ * non-ASCII byte in literal double-quotes with octal escapes, and those
+ * quoted strings then fail `git add -- <path>` with `fatal: pathspec …
+ * did not match any files`. Parsing `-z` eliminates that entire bug class
+ * (spaces, quotes, backslashes, unicode).
+ *
+ * `-z` record shape:
+ *   - normal entry:  `XY <path>` terminated by NUL
+ *   - rename/copy:   `XY <newPath>` NUL `<oldPath>` NUL — the source path
+ *     is a SEPARATE bare field (no XY prefix) that FOLLOWS the new path.
+ *     Note the order is reversed vs the newline format's `old -> new`.
+ * A trailing empty token follows the final NUL; the length guard skips it.
  *
  * @param {string} porcelainOutput
  * @returns {string[]}
  */
 export function parsePorcelainPaths(porcelainOutput) {
   const out = [];
-  for (const rawLine of porcelainOutput.split('\n')) {
-    if (rawLine.length < 4) continue;
-    const rest = rawLine.slice(3);
-    const arrowIdx = rest.indexOf(' -> ');
-    if (arrowIdx !== -1) {
-      out.push(rest.slice(0, arrowIdx));
-      out.push(rest.slice(arrowIdx + 4));
-    } else {
-      out.push(rest);
+  const records = porcelainOutput.split('\0');
+  for (let i = 0; i < records.length; i += 1) {
+    const rec = records[i];
+    if (rec.length < 4) continue;
+    const xy = rec.slice(0, 2);
+    out.push(rec.slice(3));
+    // Rename/copy: the next NUL field is the source path (bare, unquoted).
+    if (xy[0] === 'R' || xy[0] === 'C') {
+      const source = records[i + 1];
+      if (source !== undefined && source.length > 0) out.push(source);
+      i += 1;
     }
   }
   return out;

package/dist/engineering-pa-workspace/src/nav.mjs

@@ -12,9 +12,26 @@
  *   - A missing or absent operator manifest is not an error.
  *   - A malformed manifest is logged and skipped; the other side still loads.
  *
- * Caching: each load checks both manifest mtimes. The cached merged list is
- * returned unchanged if neither file changed since the last load. Missing
- * files are tracked with mtime 0 so their appearance triggers a reload.
+ * Per-device scoping: after merging, entries whose target page is not
+ * materialised on THIS device are dropped (not just warned). The estate runs
+ * one shared nav manifest that lists every page across all library repos, but
+ * `library-sync` only writes a page file onto a device when the repo that owns
+ * it is mounted there. So the presence of the href's target page file IS the
+ * per-entry materialisation signal — an hq-only page (e.g. article-ideas,
+ * content-calendar, both under operator/extensions/workspace/) is absent on a
+ * device that doesn't mount stravica-library-hq, so its nav entry is hidden
+ * rather than rendered as a dangling 404 link. This needs no per-entry "owner"
+ * field and no coupling to the .library-sync manifest internals: the page file
+ * library-sync lays down (or omits) is the source of truth. Hrefs whose shape
+ * we can't resolve to a local page (external links, deep paths) are left
+ * untouched.
+ *
+ * Caching: each load checks both manifest mtimes. The cached (merged + scoped)
+ * list is returned unchanged if neither file changed since the last load.
+ * Missing files are tracked with mtime 0 so their appearance triggers a reload.
+ * `library-sync` rewrites the extension nav.json as part of the same mount tree
+ * whenever it materialises or removes pages, so a materialisation transition
+ * always bumps a manifest mtime and re-triggers scoping.
  */
 
 import { readFileSync, statSync, existsSync } from 'node:fs';
@@ -107,35 +124,50 @@ function mergeItems(coreItems, extItems, warn) {
 }
 
 /**
- * Validate that every item's href resolves to an existing page, either under
- * APP_DIR or EXT_DIR (for top-level /<name>.html). Non-resolving items are
- * kept in the list with a warning so operators can see their work-in-progress.
+ * Classify an href by whether its target page is materialised on this device.
+ * Returns 'present', 'absent', or 'unresolvable'.
+ *
+ *   - Core-shape paths (/core/tools/workspace/app/<file>) resolve under appDir.
+ *   - Top-level extension-shape paths (/<file>.html) resolve under extDir or appDir.
+ *   - Any other shape (external links, deep paths) is 'unresolvable' — we cannot
+ *     (and should not) judge its local presence, so callers leave it untouched.
  */
-function warnOnMissingHrefs(items, appDir, extDir, warn) {
+function pagePresence(href, appDir, extDir) {
+  const corePrefix = '/core/tools/workspace/app/';
+  if (href.indexOf(corePrefix) === 0) {
+    const name = href.slice(corePrefix.length).split('?')[0].split('#')[0];
+    if (!name) return 'unresolvable';
+    return existsSync(join(appDir, name)) ? 'present' : 'absent';
+  }
+  const topMatch = href.match(/^\/([^/?#]+\.html)(?:[?#].*)?$/);
+  if (topMatch) {
+    const name = topMatch[1];
+    const inExt = extDir && existsSync(join(extDir, name));
+    const inApp = existsSync(join(appDir, name));
+    return (inExt || inApp) ? 'present' : 'absent';
+  }
+  return 'unresolvable';
+}
+
+/**
+ * Scope the merged list to this device: drop any entry whose target page is
+ * resolvable-in-shape but absent from disk (i.e. its owning library repo is not
+ * materialised here), logging why. Entries whose page is present, or whose href
+ * shape we can't resolve to a local page, are kept. This is what makes a shared
+ * estate-wide nav manifest render cleanly per-device without hand-editing:
+ * hq-only entries vanish on non-HQ devices because their pages were never
+ * written there.
+ */
+function scopeToMaterialised(items, appDir, extDir, warn) {
+  const kept = [];
   for (const item of items) {
-    const href = item.href;
-    // Core-shape paths: /core/tools/workspace/app/<file>
-    const corePrefix = '/core/tools/workspace/app/';
-    if (href.indexOf(corePrefix) === 0) {
-      const name = href.slice(corePrefix.length).split('?')[0].split('#')[0];
-      if (!existsSync(join(appDir, name))) {
-        warn('[nav] warning: nav item "' + item.id + '" points at missing page ' + href);
-      }
+    if (pagePresence(item.href, appDir, extDir) === 'absent') {
+      warn('[nav] hidden: nav item "' + item.id + '" page not materialised on this device (' + item.href + ')');
       continue;
     }
-    // Top-level extension-shape: /<file>.html
-    const topMatch = href.match(/^\/([^/?#]+\.html)(?:[?#].*)?$/);
-    if (topMatch) {
-      const name = topMatch[1];
-      const inExt = extDir && existsSync(join(extDir, name));
-      const inApp = existsSync(join(appDir, name));
-      if (!inExt && !inApp) {
-        warn('[nav] warning: nav item "' + item.id + '" points at missing page ' + href);
-      }
-      continue;
-    }
-    // Any other shape we leave alone — might be an external link or a deep core path.
+    kept.push(item);
   }
+  return kept;
 }
 
 /**
@@ -172,12 +204,12 @@ export function loadNav(opts) {
     ? readManifest(extManifest, 'extension nav manifest', warn)
     : [];
   const merged = mergeItems(coreItems, extItems, warn);
-  warnOnMissingHrefs(merged, appDir, extDir, warn);
+  const scoped = scopeToMaterialised(merged, appDir, extDir, warn);
 
   CACHE.coreMtimeMs = coreMtime;
   CACHE.extMtimeMs = extMtime;
-  CACHE.items = merged;
-  return merged;
+  CACHE.items = scoped;
+  return scoped;
 }
 
 /**

package/dist/engineering-pa-workspace/src/server.mjs

@@ -60,6 +60,11 @@ const APP_DIR = resolve(__dirname, '..', 'app');
 const DEBUG = process.env.WS_DEBUG === '1';
 const log = DEBUG ? console.log.bind(console) : function () {};
 const warn = DEBUG ? console.warn.bind(console) : function () {};
+// Always-on warning sink. Most diagnostics stay silent unless WS_DEBUG=1, but
+// failures that silently break operator-visible surface area (e.g. a whole
+// extension failing to load, presenting as a vague UI outage) must ALWAYS be
+// visible so the root cause is diagnosable without re-running under WS_DEBUG.
+const warnAlways = console.warn.bind(console);
 
 // --- Extension dir ---
 // Convention: operator/extensions/workspace/ overlays core app pages and
@@ -461,7 +466,11 @@ async function loadExtensions() {
       });
     }
   } catch (e) {
-    warn('[workspace] Extension api.mjs failed to load: ' + e.message);
+    // Always warn — a failed extension import takes out every route the
+    // extension registers, which surfaces to the operator as a broken UI with
+    // no obvious cause. Name the extension and the error; keep the server
+    // alive (a bad extension must not take down the whole workspace).
+    warnAlways('[workspace] Extension failed to load: ' + extApiPath + ' — ' + (e && e.stack ? e.stack : e));
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",
@@ -35,7 +35,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Stravica/engineering-pa-dev.git",
+    "url": "git+https://github.com/Stravica/digital-operator-pa.git",
     "directory": "packages/engineering-pa"
   },
   "publishConfig": {