@twinsearth/w2m-dsh-plugin 1.9.15 → 1.9.17

package/src/relay/offer-journal.mjs

@@ -0,0 +1,71 @@
+/**
+ * Offer journal (v2 R8): the command an in-flight task will be offered with lives HERE, not in the
+ * ledger.
+ *
+ * The ledger must never carry `command_argv` (it is the relay's durable, copyable record), yet a
+ * relay restart still needs the command to re-offer unclaimed work. The journal is that narrow,
+ * short-lived control-plane store: one 0600 file per task, written before the task is announced,
+ * removed when the task settles or is cancelled. It is not an artifact and carries no output.
+ */
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, unlinkSync, writeSync } from 'node:fs';
+import { join } from 'node:path';
+
+const journalDir = (stateDir) => join(stateDir, 'offers');
+const journalPath = (stateDir, taskId) => join(journalDir(stateDir), String(taskId).replace(/[^A-Za-z0-9._-]/g, '_') + '.json');
+
+export function writeOfferJournal(stateDir, taskId, payload) {
+  if (typeof stateDir !== 'string' || stateDir === '' || typeof taskId !== 'string' || taskId === '') {
+    return { ok: false, code: 'JOURNAL_INPUT_INVALID' };
+  }
+  mkdirSync(journalDir(stateDir), { recursive: true });
+  const path = journalPath(stateDir, taskId);
+  const tmp = path + '.tmp-' + process.pid;
+  const text = JSON.stringify({
+    v: 1,
+    task_id: taskId,
+    argv: Array.isArray(payload?.argv) ? payload.argv : [],
+    stages: Array.isArray(payload?.stages) ? payload.stages : null,
+    reduce_argv: Array.isArray(payload?.reduce_argv) ? payload.reduce_argv : null,
+    written_at: new Date().toISOString(),
+  });
+  const fd = openSync(tmp, 'w', 0o600);
+  try {
+    writeSync(fd, text);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+  return { ok: true, path };
+}
+
+export function readOfferJournal(stateDir, taskId) {
+  const path = journalPath(stateDir, taskId);
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    if (parsed?.task_id !== taskId) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function deleteOfferJournal(stateDir, taskId) {
+  try { unlinkSync(journalPath(stateDir, taskId)); return true; } catch { return false; }
+}
+
+/** Remove journals whose task no longer exists (settled, cancelled, or lost). */
+export function pruneOfferJournals(stateDir, liveTaskIds) {
+  const dir = journalDir(stateDir);
+  if (!existsSync(dir)) return 0;
+  const live = liveTaskIds instanceof Set ? liveTaskIds : new Set(liveTaskIds ?? []);
+  let removed = 0;
+  for (const name of readdirSync(dir)) {
+    if (!name.endsWith('.json')) continue;
+    const taskId = name.slice(0, -5);
+    if (live.has(taskId)) continue;
+    try { unlinkSync(join(dir, name)); removed += 1; } catch { /* best effort */ }
+  }
+  return removed;
+}

package/src/relay/p0-projection.mjs

@@ -81,6 +81,16 @@ export function projectLedgerLine(line) {
   try { record = JSON.parse(line); } catch { return { changed: false, line }; }
   // Real ledger lines nest the envelope one level down: {type:'result.stored', result:{envelope:{...}}}.
   // Handle that shape first, then the flat result, then a bare envelope record.
+  // v2 R8: a legacy task record still carries the command itself. Project it to hash + length,
+  // so the scrub can bring old ledgers in line with "persist only metadata".
+  if (record?.type === 'task.created' && record.task && typeof record.task === 'object') {
+    const task = record.task;
+    if (!Array.isArray(task.command_argv)) return { changed: false, line };
+    task.command_argv_len = task.command_argv.length;
+    delete task.command_argv;
+    record.projection = { dropped: ['task.command_argv'], at: new Date().toISOString() };
+    return { changed: true, line: JSON.stringify(record) };
+  }
   let holder = null;
   if (record?.result && typeof record.result === 'object' && record.result.envelope && typeof record.result.envelope === 'object') holder = { parent: record.result, key: 'envelope' };
   else if (record?.result && typeof record.result === 'object') holder = { parent: record, key: 'result' };

package/src/relay/report.mjs

@@ -614,10 +614,13 @@ export function renderReportMarkdown(agg, task = null) {
     L.push('');
   }
   if (task) {
-    L.push('## 原始命令');
+    // R8: the markdown report is readable by any paired device token, so it must never carry the
+    // command itself. The hash is the command identity; the length is the only shape we expose.
+    L.push('## 命令指纹');
     L.push('');
     L.push('```');
-    L.push(jcs(task.command_argv));
+    L.push('command_hash: ' + (typeof task.command_hash === 'string' ? task.command_hash : '-'));
+    L.push('command_argv_len: ' + (Array.isArray(task.command_argv) ? task.command_argv.length : '-'));
     L.push('```');
     L.push('');
   }

package/src/relay/scrub.mjs

@@ -1,81 +1,94 @@
-/**
- * relay 状态清理（P0）：旧 blob 清除 + ledger 内容投影重建。
- * 只处理已落盘的数据，不联网；dry-run 先报清单，apply 先备份再原子替换。
- */
-import {
-  copyFileSync, existsSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync,
-} from 'node:fs';
-import { createHash } from 'node:crypto';
-import { join } from 'node:path';
-
-import { projectLedgerLine } from './p0-projection.mjs';
-
-export const LEDGER_CONTENT_FIELDS = ['stdout_head', 'stdout_tail', 'stderr_head', 'stderr_tail', 'command_argv', 'pipeline_hash_material', 'changed_files'];
-const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
-
-
-/** 清理 ledger：默认 dry-run；apply 时备份 .bak-<ts> 后原子替换。 */
-export function scrubLedger(ledgerPath, { dryRun = true, now = Date.now() } = {}) {
-  if (!existsSync(ledgerPath)) return { ok: true, exists: false, changed: 0, lines: 0, backup: null };
-  const text = readFileSync(ledgerPath, 'utf8');
-  const lines = text.split('\n').filter((line) => line.trim() !== '');
-  let changed = 0;
-  const rewritten = lines.map((line) => {
-    const projected = projectLedgerLine(line);
-    if (projected.changed) changed += 1;
-    return projected.line;
-  });
-  if (dryRun || changed === 0) return { ok: true, exists: true, changed, lines: lines.length, backup: null, dryRun };
-  const backup = ledgerPath + '.bak-' + now;
-  copyFileSync(ledgerPath, backup);
-  const tmp = ledgerPath + '.tmp-' + process.pid;
-  writeFileSync(tmp, rewritten.join('\n') + '\n', 'utf8');
-  renameSync(tmp, ledgerPath);
-  return { ok: true, exists: true, changed, lines: lines.length, backup, dryRun: false };
-}
-
-/** 清点/删除 relay blob 目录（内容寻址文件）。 */
-export function scrubBlobs(blobDir, { dryRun = true, now = Date.now() } = {}) {
-  if (!existsSync(blobDir)) return { ok: true, exists: false, files: [], bytes: 0, deleted: 0, manifest: null };
-  const files = [];
-  let bytes = 0;
-  for (const name of readdirSync(blobDir)) {
-    const path = join(blobDir, name);
-    if (!statSync(path).isFile()) continue;
-    files.push(name);
-    bytes += statSync(path).size;
-  }
-  const manifest = {
-    at: new Date(now).toISOString(),
-    files: files.map((name) => ({ name, sha256: sha256(readFileSync(join(blobDir, name))) })),
-  };
-  if (dryRun) return { ok: true, exists: true, files, bytes, deleted: 0, manifest, dryRun };
-  for (const name of files) unlinkSync(join(blobDir, name));
-  return { ok: true, exists: true, files, bytes, deleted: files.length, manifest, dryRun: false };
-}
-
-/** 验收：扫描目录中是否仍存在内容字段/数据面 marker。 */
-export function scanForContent(rootDir, markers = []) {
-  const hits = [];
-  const walk = (dir) => {
-    for (const name of readdirSync(dir)) {
-      // Backups/temporaries are not live state: they hold the bytes the scrub just moved out.
-      if (/\.bak-|\.tmp-|\.corrupt-/.test(name)) continue;
-      const path = join(dir, name);
-      const stat = statSync(path);
-      if (stat.isDirectory()) { walk(path); continue; }
-      if (stat.size > 32 * 1024 * 1024) continue;
-      // The projection metadata names the dropped fields; scanning it for those names would report
-      // the scrub itself as a leak, so it is removed before the marker check.
-      const text = readFileSync(path, 'utf8').replace(/"projection"\s*:\s*\{[^{}]*\}/g, '');
-      for (const field of LEDGER_CONTENT_FIELDS) {
-        if (text.includes('"' + field + '"')) hits.push({ file: path, marker: field });
-      }
-      for (const marker of markers) {
-        if (marker !== '' && text.includes(marker)) hits.push({ file: path, marker });
-      }
-    }
-  };
-  if (existsSync(rootDir)) walk(rootDir);
-  return { ok: hits.length === 0, hits };
-}
+/**
+ * relay 状态清理（P0）：旧 blob 清除 + ledger 内容投影重建。
+ * 只处理已落盘的数据，不联网；dry-run 先报清单，apply 先备份再原子替换。
+ */
+import {
+  copyFileSync, existsSync, readdirSync, readFileSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync,
+} from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+
+import { projectLedgerLine } from './p0-projection.mjs';
+
+export const LEDGER_CONTENT_FIELDS = ['stdout_head', 'stdout_tail', 'stderr_head', 'stderr_tail', 'command_argv', 'pipeline_hash_material', 'changed_files'];
+const sha256 = (buf) => createHash('sha256').update(buf).digest('hex');
+
+
+/** 清理 ledger：默认 dry-run；apply 时备份 .bak-<ts> 后原子替换。 */
+export function scrubLedger(ledgerPath, { dryRun = true, now = Date.now() } = {}) {
+  if (!existsSync(ledgerPath)) return { ok: true, exists: false, changed: 0, lines: 0, backup: null };
+  const text = readFileSync(ledgerPath, 'utf8');
+  const lines = text.split('\n').filter((line) => line.trim() !== '');
+  let changed = 0;
+  const rewritten = lines.map((line) => {
+    const projected = projectLedgerLine(line);
+    if (projected.changed) changed += 1;
+    return projected.line;
+  });
+  if (dryRun || changed === 0) return { ok: true, exists: true, changed, lines: lines.length, backup: null, dryRun };
+  const backup = ledgerPath + '.bak-' + now;
+  copyFileSync(ledgerPath, backup);
+  const tmp = ledgerPath + '.tmp-' + process.pid;
+  writeFileSync(tmp, rewritten.join('\n') + '\n', 'utf8');
+  renameSync(tmp, ledgerPath);
+  return { ok: true, exists: true, changed, lines: lines.length, backup, dryRun: false };
+}
+
+/** 清点/删除 relay blob 目录（内容寻址；真实布局是 blobs/<aa>/<sha>，递归处理）。 */
+export function scrubBlobs(blobDir, { dryRun = true, now = Date.now() } = {}) {
+  if (!existsSync(blobDir)) return { ok: true, exists: false, files: [], bytes: 0, deleted: 0, manifest: null };
+  const files = [];
+  let bytes = 0;
+  const walk = (dir, rel) => {
+    for (const name of readdirSync(dir)) {
+      const path = join(dir, name);
+      const stat = statSync(path);
+      const relPath = rel === '' ? name : rel + '/' + name;
+      if (stat.isDirectory()) { walk(path, relPath); continue; }
+      files.push(relPath);
+      bytes += stat.size;
+    }
+  };
+  walk(blobDir, '');
+  const manifest = {
+    at: new Date(now).toISOString(),
+    files: files.map((name) => ({ name, sha256: sha256(readFileSync(join(blobDir, name.split('/').join('/')))) })),
+  };
+  if (dryRun) return { ok: true, exists: true, files, bytes, deleted: 0, manifest, dryRun };
+  for (const name of files) unlinkSync(join(blobDir, name));
+  // Remove the empty sharding directories the files lived in, but never the blob root itself.
+  const prune = (dir) => {
+    for (const name of readdirSync(dir)) {
+      const path = join(dir, name);
+      if (statSync(path).isDirectory()) { prune(path); try { rmdirSync(path); } catch { /* not empty */ } }
+    }
+  };
+  prune(blobDir);
+  return { ok: true, exists: true, files, bytes, deleted: files.length, manifest, dryRun: false };
+}
+
+/** 验收：扫描目录中是否仍存在内容字段/数据面 marker。 */
+export function scanForContent(rootDir, markers = []) {
+  const hits = [];
+  const walk = (dir) => {
+    for (const name of readdirSync(dir)) {
+      // Backups/temporaries are not live state: they hold the bytes the scrub just moved out.
+      if (/\.bak-|\.tmp-|\.corrupt-/.test(name)) continue;
+      const path = join(dir, name);
+      const stat = statSync(path);
+      if (stat.isDirectory()) { walk(path); continue; }
+      if (stat.size > 32 * 1024 * 1024) continue;
+      // The projection metadata names the dropped fields; scanning it for those names would report
+      // the scrub itself as a leak, so it is removed before the marker check.
+      const text = readFileSync(path, 'utf8').replace(/"projection"\s*:\s*\{[^{}]*\}/g, '');
+      for (const field of LEDGER_CONTENT_FIELDS) {
+        if (text.includes('"' + field + '"')) hits.push({ file: path, marker: field });
+      }
+      for (const marker of markers) {
+        if (marker !== '' && text.includes(marker)) hits.push({ file: path, marker });
+      }
+    }
+  };
+  if (existsSync(rootDir)) walk(rootDir);
+  return { ok: hits.length === 0, hits };
+}

package/src/relay/server.mjs

@@ -22,6 +22,17 @@ function readRelayVersion() {
   return process.env.W2M_RELAY_VERSION ?? 'unknown';
 }
 export const RELAY_VERSION = readRelayVersion();
+
+/**
+ * Capabilities a dispatcher may rely on. A relay that does not advertise a feature is an older
+ * relay: joint-dev must refuse rather than assume the field will be honoured.
+ */
+export const RELAY_FEATURES = Object.freeze([
+  'target-machines',
+  'result-projection',
+  'guard-v1',
+  'relay-version-v1',
+]);
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -1591,7 +1602,9 @@ export class RelayServer {
       rabbit_time: this.state.nowIso(),
       uptime_ms: this.state.nowMs() - this._startedAtMs,
       relay_id: this.relayId,
-    version: RELAY_VERSION,
+      version: RELAY_VERSION,
+      relay_version: RELAY_VERSION,
+      features: RELAY_FEATURES,
       started_at: rfc3339(this._startedAtMs),
       effective_scheme: this.effectiveScheme(req),
       base_path: this.basePath,