@teamvibe/poller 0.7.1 → 0.7.2

package/dist/brain-manager.d.ts

@@ -18,6 +18,14 @@ interface BrainConfig {
  * pushBrainChanges below.
  */
 export declare function cleanupStaleLocks(brainDir: string): Promise<void>;
+/**
+ * Write the local (uncommitted) merge-driver attributes for a brain checkout.
+ * Idempotent and safe to call on every `getBrainPath` invocation, not just on
+ * first clone — this also self-heals brains that were checked out before
+ * this existed. Exported for testing — production call sites go through
+ * `getBrainPath`.
+ */
+export declare function ensureGitAttributes(brainDir: string): Promise<void>;
 export declare function getBrainPath(brain?: BrainConfig, channelId?: string, workspaceId?: string): Promise<string>;
 /**
  * Update a brain repo (respects cooldown). Exported for testing — production

package/dist/brain-manager.js

@@ -1,7 +1,7 @@
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { existsSync, mkdirSync } from 'fs';
-import { readdir, stat, unlink } from 'fs/promises';
+import { readdir, stat, unlink, mkdir, writeFile } from 'fs/promises';
 import { join, basename } from 'path';
 import { config } from './config.js';
 import { logger } from './logger.js';
@@ -128,6 +128,47 @@ async function reportBrainSync(brainId, workspaceId, event) {
         emitError('brain', `Brain sync report error: ${error instanceof Error ? error.message : String(error)}`, { severity: 'warn', context: { brainId } });
     }
 }
+// tv#247: local-only (never committed, never synced) merge-driver config for
+// a brain checkout. `merge=union` is one of git's built-in low-level merge
+// drivers (alongside `text`/`binary`) — an attributes entry alone is enough,
+// no `[merge "union"]` section in git config is needed (verified: a rebase
+// across two branches with independent appends to a `merge=union`-attributed
+// file merges both lines automatically instead of conflicting).
+//
+// Scoped ONLY to genuinely pure-append, line-independent files. Deliberately
+// does NOT cover MEM_REGISTRY.md, MEM_REGISTRY_ARCHIVE.md, semantic/*, or
+// episodic/* — consolidation edits those in place (promotes/removes
+// entries), so a union merge there would resurrect already-promoted-and-
+// removed content instead of resolving the conflict, rather than concatenate
+// two genuinely independent additions.
+//
+// Written to `.git/info/attributes` (not a committed `.gitattributes`)
+// because this is poller-local git behavior, not brain content — channel
+// brain repos are written to only by their own sessions, never by the
+// platform directly.
+const GIT_ATTRIBUTES_CONTENT = ['memory/TODAY.md merge=union', 'memory/daily/*.md merge=union', ''].join('\n');
+/**
+ * Write the local (uncommitted) merge-driver attributes for a brain checkout.
+ * Idempotent and safe to call on every `getBrainPath` invocation, not just on
+ * first clone — this also self-heals brains that were checked out before
+ * this existed. Exported for testing — production call sites go through
+ * `getBrainPath`.
+ */
+export async function ensureGitAttributes(brainDir) {
+    try {
+        const gitDir = join(brainDir, '.git');
+        if (!existsSync(gitDir))
+            return; // not a git repo yet (defensive — getBrainPath always clones first)
+        const infoDir = join(gitDir, 'info');
+        await mkdir(infoDir, { recursive: true });
+        await writeFile(join(infoDir, 'attributes'), GIT_ATTRIBUTES_CONTENT);
+    }
+    catch (error) {
+        // Best-effort: worst case a future push-race on these files needs manual
+        // resolution same as before this existed. Not a reason to fail the caller.
+        logger.warn(`Brain ${brainDir}: failed to write .git/info/attributes: ${error instanceof Error ? error.message : error}`);
+    }
+}
 export async function getBrainPath(brain, channelId, workspaceId) {
     if (!brain?.gitRepoUrl) {
         if (channelId) {
@@ -164,6 +205,9 @@ export async function getBrainPath(brain, channelId, workspaceId) {
         if (workspaceId)
             reportBrainSync(brain.brainId, workspaceId, 'pulled');
     }
+    // Idempotent, local-only — covers both the fresh-clone and existing-dir
+    // branches above, and self-heals brains cloned before this existed.
+    await ensureGitAttributes(brainDir);
     return brainDir;
 }
 /**
@@ -263,6 +307,52 @@ async function gitStashList(brainDir) {
     const { stdout } = await gitExec('git stash list', { cwd: brainDir });
     return stdout.trim();
 }
+// Per-brainId rescue-ref name, seeded with a timestamp the first time a given
+// brainId hits an unresolved push-race conflict, then reused (force-pushed
+// to) on every later pushBrainChangesLocked invocation that still can't
+// converge — e.g. the next message's push attempt while the conflict remains
+// unresolved on disk. Without this, each retry would mint its own
+// `conflict/<brainId>-<ts>` ref and spam origin with one throwaway branch per
+// retry instead of one per actual incident. Cleared on the next successful
+// push for that brainId, since any future conflict after that point is a new,
+// unrelated incident that deserves its own ref.
+const rescueRefNames = new Map();
+/**
+ * Best-effort durability net for a `PUSH_RACE_CONFLICT`: push whatever HEAD
+ * currently points to onto a throwaway ref on origin before the caller
+ * reports the conflict, so the session's commits survive even if this
+ * checkout is lost (crash, re-clone, TTL'd container) before a human/AI does
+ * the manual resolution. Never throws — a failed rescue push just means no
+ * safety net for this occurrence, not a reason to mask the real
+ * PUSH_RACE_CONFLICT error the caller is about to report.
+ *
+ * Callers MUST ensure `HEAD` is the safe, non-mid-rebase content to rescue
+ * before calling this (e.g. after `git rebase --abort` restores the
+ * pre-rebase local branch) — this function pushes HEAD as-is.
+ */
+async function pushRescueRef(brainDir, brainId) {
+    let refName = rescueRefNames.get(brainId);
+    if (!refName) {
+        // Unix seconds (not ms) — matches the <timestamp> format documented on
+        // the consuming side (poller-brain#443's MAINTENANCE.md `oldestAgeDays`
+        // derivation), so both sides agree on how to parse the ref name.
+        refName = `conflict/${brainId}-${Math.floor(Date.now() / 1000)}`;
+        rescueRefNames.set(brainId, refName);
+    }
+    try {
+        await gitExec(`git push --force origin HEAD:refs/heads/${refName}`, { cwd: brainDir });
+        logger.info(`Brain ${brainId} push-race: rescued local commits to ${refName}`);
+        return { refName, pushed: true };
+    }
+    catch (error) {
+        // Distinct sub-case from a successful rescue (same failure class as the
+        // known pb#440 issue — e.g. broken git credentials) — logged separately
+        // so it's never mistaken for "commits are safe on origin".
+        const message = error instanceof Error ? error.message : String(error);
+        logger.error(`Brain ${brainId} push-race: rescue-ref push to ${refName} itself FAILED, local commits remain only on disk: ${message}`);
+        return { refName, pushed: false };
+    }
+}
 /**
  * Scan the commits about to be pushed for blobs over `maxBytes`. Returns the
  * offending paths/sizes, or an empty array if everything is under the limit.
@@ -382,6 +472,10 @@ async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptio
             attempt++;
             try {
                 await gitExec(`git push -u origin ${branch}`, { cwd: brainDir });
+                // A successful push means any earlier unresolved conflict for this
+                // brainId (if any) is now resolved — a future conflict is a new,
+                // unrelated incident, so stop reusing that rescue ref name.
+                rescueRefNames.delete(brainId);
                 if (attempt > 1) {
                     logger.info(`Brain ${brainId} push-race auto-resolved after ${attempt} attempts`);
                     emitError('brain', `Brain ${brainId} push-race auto-resolved after ${attempt} attempts`, {
@@ -427,7 +521,15 @@ async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptio
                     const stashAfter = await gitStashList(brainDir);
                     if (stashAfter !== stashBefore) {
                         logger.error(`Brain ${brainId} push-race: autostash pop left changes stashed after rebase, treating as conflict`);
-                        emitError('brain', `Brain ${brainId} push-race autostash pop conflict — manual sync needed (stash: ${stashAfter.split('\n')[0]})`, { severity: 'error', context: { brainId, errorCode: 'PUSH_RACE_CONFLICT', attempts: attempt, reason: 'autostash_pop_conflict' } });
+                        // The rebase itself (of committed local work onto origin) succeeded
+                        // here — HEAD is the safe, non-mid-rebase content to rescue; only
+                        // the separate stash-pop of uncommitted changes is what's stuck.
+                        const { refName: rescueRef, pushed: rescuePushed } = await pushRescueRef(brainDir, brainId);
+                        emitError('brain', `Brain ${brainId} push-race autostash pop conflict — manual sync needed (stash: ${stashAfter.split('\n')[0]})` +
+                            (rescuePushed ? `, committed local work rescued to ${rescueRef}` : `, rescue push to ${rescueRef} also FAILED`), {
+                            severity: 'error',
+                            context: { brainId, errorCode: 'PUSH_RACE_CONFLICT', attempts: attempt, reason: 'autostash_pop_conflict', rescueRef, rescuePushed },
+                        });
                         return;
                     }
                 }
@@ -442,13 +544,21 @@ async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptio
                             severity: 'error',
                             context: { brainId, errorCode: 'PUSH_RACE_ABORT_FAILED', attempts: attempt },
                         });
+                        // Repo is left mid-rebase / in an uncertain state — do NOT push
+                        // HEAD to a rescue ref here, that would rescue the wrong
+                        // (partially-applied) content instead of the pre-conflict local work.
                         return;
                     }
+                    // `git rebase --abort` above restored HEAD to the pre-rebase local
+                    // branch — i.e. exactly the unpushed, pre-conflict work we need to
+                    // keep durable, not whatever mid-rebase state existed a moment ago.
+                    const { refName: rescueRef, pushed: rescuePushed } = await pushRescueRef(brainDir, brainId);
                     const rebaseMessage = rebaseError instanceof Error ? rebaseError.message : String(rebaseError);
                     logger.error(`Brain ${brainId} push-race rebase conflict: ${rebaseMessage}`);
-                    emitError('brain', `Brain ${brainId} push-race rebase conflict — manual sync needed: ${rebaseMessage}`, {
+                    emitError('brain', `Brain ${brainId} push-race rebase conflict — manual sync needed: ${rebaseMessage}` +
+                        (rescuePushed ? `, local commits rescued to ${rescueRef}` : `, rescue push to ${rescueRef} also FAILED`), {
                         severity: 'error',
-                        context: { brainId, errorCode: 'PUSH_RACE_CONFLICT', attempts: attempt },
+                        context: { brainId, errorCode: 'PUSH_RACE_CONFLICT', attempts: attempt, rescueRef, rescuePushed },
                     });
                     return;
                 }
@@ -457,9 +567,25 @@ async function pushBrainChangesLocked(brainDir, brainId, workspaceId, retryOptio
         }
         const errorCode = NON_FF_REJECTION_RE.test(lastErrorMessage) ? 'PUSH_RACE_UNRESOLVED' : 'PUSH_FAILED';
         logger.warn(`Failed to push brain ${brainId} changes: ${lastErrorMessage}`);
-        emitError('brain', `Failed to push brain ${brainId} changes: ${lastErrorMessage}`, {
+        // PUSH_RACE_UNRESOLVED means the retry budget ran out while HEAD was still
+        // in the safe, non-mid-rebase state left by the last successful rebase
+        // (the loop only reaches here via the `attempt >= maxAttempts` break right
+        // after a push rejection, never after a failed rebase — those return
+        // earlier). Same "local commits only on disk" risk as the two conflict
+        // cases above, just a different exhaustion cause — rescue it too.
+        // PUSH_FAILED (non-NON_FF failures, e.g. auth/network) deliberately
+        // skipped: a rescue push would almost always fail for the identical
+        // reason as the push it's rescuing.
+        let rescueRef;
+        let rescuePushed;
+        if (errorCode === 'PUSH_RACE_UNRESOLVED') {
+            ;
+            ({ refName: rescueRef, pushed: rescuePushed } = await pushRescueRef(brainDir, brainId));
+        }
+        emitError('brain', `Failed to push brain ${brainId} changes: ${lastErrorMessage}` +
+            (errorCode === 'PUSH_RACE_UNRESOLVED' ? (rescuePushed ? `, local commits rescued to ${rescueRef}` : `, rescue push to ${rescueRef} also FAILED`) : ''), {
             severity: errorCode === 'PUSH_RACE_UNRESOLVED' ? 'error' : 'warn',
-            context: { brainId, errorCode, attempts: attempt },
+            context: { brainId, errorCode, attempts: attempt, ...(errorCode === 'PUSH_RACE_UNRESOLVED' ? { rescueRef, rescuePushed } : {}) },
         });
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teamvibe/poller",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "type": "module",
   "main": "./dist/index.js",
   "bin": {