@tyhld/conductor 0.12.64 → 0.12.66

package/dist/headless.js

@@ -14,7 +14,7 @@
  *   同じ relayTick に分岐を詰め込むと壊れやすいので、独立したモジュールにする。
  *   共通の管制との通信（fetchControl, fetchCommand, patchStatus 等）は relay.ts から使う。
  */
-import { spawn } from 'node:child_process';
+import { execFileSync, spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { createWriteStream, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
@@ -53,6 +53,23 @@ export const ACTIVE_JOB_PATH_LEGACY = path.join(ACTIVE_JOB_DIR, 'active-job.json
 export function activeJobPath(site) {
     return path.join(ACTIVE_JOB_DIR, `active-job-${site}.json`);
 }
+/**
+ * 作業ディレクトリの git remote origin URL を返す。
+ * git リポジトリでない・origin が無い場合は null。
+ * ★パスの文字が同じでも別のリポなら止める（リポの同一性の照合に使う）。
+ */
+export function resolveGitOrigin(workDir) {
+    try {
+        return execFileSync('git', ['-C', workDir, 'config', '--get', 'remote.origin.url'], {
+            encoding: 'utf8',
+            timeout: 5_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
 /** 実行中のジョブをファイルに書く（中継が死んでも拾い直せるように）。 */
 export function saveActiveJob(site, record) {
     try {
@@ -112,8 +129,12 @@ export function loadAndClearLegacyActiveJob() {
     }
 }
 /**
- * 手元の記録が自分（この中継）のものか4点照合する。
+ * 手元の記録が自分（この中継）のものか照合する。
+ * site, machine, workDir, gitOrigin を比べる。
  * 1点でも不一致なら理由を返す。すべて一致なら null。
+ *
+ * ★commandId は「この便が中央でまだ sent か」の確認（ネットワーク照合）で別に行う。
+ *   ここではローカルの所有者照合のみ。
  */
 export function validateActiveJobOwnership(rec, cfg) {
     const mismatches = [];
@@ -126,10 +147,16 @@ export function validateActiveJobOwnership(rec, cfg) {
     if (rec.workDir !== undefined && rec.workDir !== cfg.workDir) {
         mismatches.push(`workDir: 記録=${rec.workDir} 自分=${cfg.workDir}`);
     }
-    // 4点がそろわない古い記録（0.12.62 以前）は site/machine/workDir が undefined。
-    // 照合できない = 安全に拾えない。
+    // ★git リポの同一性: パスが同じでも別のリポなら止める
+    if (rec.gitOrigin !== undefined) {
+        const currentOrigin = resolveGitOrigin(cfg.workDir);
+        if (currentOrigin !== null && rec.gitOrigin !== currentOrigin) {
+            mismatches.push(`gitOrigin: 記録=${rec.gitOrigin} 自分=${currentOrigin}`);
+        }
+    }
+    // 照合項目がそろわない古い記録は安全に拾えない。
     if (rec.site === undefined || rec.machine === undefined || rec.workDir === undefined) {
-        mismatches.push('4点の照合項目が不足（0.12.62 以前の古い記録）');
+        mismatches.push('照合項目が不足（古い記録）');
     }
     return mismatches.length > 0 ? mismatches.join(', ') : null;
 }
@@ -740,6 +767,18 @@ export async function restoreHeadlessOrphans(cfg, state) {
                 }]);
             return;
         }
+        // ★便IDの照合: 中央でまだ sent のまま残っている便か確かめる
+        const centralStatus = await fetchCommandStatus(cfg, saved.commandId);
+        if (centralStatus !== null && centralStatus !== 'sent') {
+            log(`WARN site=${cfg.site} id=${saved.commandId} 手元の記録の便は中央で ${centralStatus} → 再開しない`);
+            await sendCommandEvents(cfg, saved.commandId, [{
+                    type: 'error',
+                    text: `便IDの照合: 中央の状態が sent ではない（${centralStatus}）→ 再開しない`.slice(0, EVENT_TEXT_MAX),
+                    at: new Date().toISOString(),
+                    attempt: saved.attempt,
+                }]);
+            return;
+        }
         log(`site=${cfg.site} id=${saved.commandId} 手元の記録から孤児を検出（中継再起動後の拾い直し）`);
         const pick = { id: saved.commandId, body: saved.body, site: cfg.site, sentAt: saved.startedAt };
         const attempt = saved.attempt + 1;
@@ -760,7 +799,7 @@ export async function restoreHeadlessOrphans(cfg, state) {
             return;
         }
         state.job = job;
-        saveActiveJob(cfg.site, { commandId: pick.id, body: pick.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir });
+        saveActiveJob(cfg.site, { commandId: pick.id, body: pick.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir, gitOrigin: resolveGitOrigin(cfg.workDir) ?? undefined });
         markDelivered(state.relay, pick.id);
         state.relay.lastHeartbeatAt = null;
         noteReadiness(state.relay, 'delivered', pick.id);
@@ -802,7 +841,7 @@ export async function restoreHeadlessOrphans(cfg, state) {
         return;
     }
     state.job = job;
-    saveActiveJob(cfg.site, { commandId: pick.id, body: pick.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir });
+    saveActiveJob(cfg.site, { commandId: pick.id, body: pick.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir, gitOrigin: resolveGitOrigin(cfg.workDir) ?? undefined });
     markDelivered(state.relay, pick.id);
     state.relay.lastHeartbeatAt = null;
     noteReadiness(state.relay, 'delivered', pick.id);
@@ -895,7 +934,7 @@ export async function headlessTick(cfg, state, hooks) {
                 return;
             }
             state.job = job;
-            saveActiveJob(cfg.site, { commandId: retry.cmd.id, body: retry.cmd.body, sessionId, attempt: retry.attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir });
+            saveActiveJob(cfg.site, { commandId: retry.cmd.id, body: retry.cmd.body, sessionId, attempt: retry.attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir, gitOrigin: resolveGitOrigin(cfg.workDir) ?? undefined });
             rs.lastHeartbeatAt = null;
             noteReadiness(rs, 'delivered', retry.cmd.id);
             await sendCommandEvents(cfg, retry.cmd.id, [{
@@ -951,7 +990,7 @@ export async function headlessTick(cfg, state, hooks) {
             return;
         }
         state.job = job;
-        saveActiveJob(cfg.site, { commandId: cmd.id, body: cmd.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir });
+        saveActiveJob(cfg.site, { commandId: cmd.id, body: cmd.body, sessionId, attempt, startedAt: Date.now(), site: cfg.site, machine: cfg.machine, workDir: cfg.workDir, gitOrigin: resolveGitOrigin(cfg.workDir) ?? undefined });
         markDelivered(rs, cmd.id);
         rs.lastHeartbeatAt = null;
         noteReadiness(rs, 'delivered', cmd.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tyhld/conductor",
-  "version": "0.12.64",
+  "version": "0.12.66",
   "description": "采配くん管制の見守りアプリ（conductor-agent）。各PCで常駐し、中央(devlog-tracker)へ定期的に生存報告(heartbeat)を送る常駐CLI。",
   "type": "module",
   "bin": {

package/sales-template/settings.json

@@ -14,9 +14,10 @@
       "Bash(git push --force:*)",
       "Bash(git push -f:*)",
       "Bash(git push --force-with-lease:*)",
-      "Bash(git push * --force:*)",
-      "Bash(git push * -f:*)",
-      "Bash(git push * --force-with-lease:*)",
+      "Bash(git push * --force)",
+      "Bash(git push * -f)",
+      "Bash(git push * --force-with-lease)",
+      "Bash(git push * +*)",
       "Bash(rm -rf:*)",
       "Bash(rm -fr:*)",
       "Bash(rm -r -f:*)",
@@ -45,8 +46,8 @@
       "Bash(*TRUNCATE*)",
       "Bash(*rest/v1/rpc/exec_sql*)",
       "Bash(cat .env:*)",
-      "Bash(cat .env.*:*)",
-      "Bash(cat *.env:*)",
+      "Bash(cat .env.*)",
+      "Bash(cat *.env)",
       "Bash(printenv:*)",
       "Bash(echo $DATABASE_URL:*)",
       "Bash(echo $DIRECT_URL:*)",

package/scripts/update-guard.sh

@@ -999,6 +999,10 @@ RETIRED_DENY = frozenset({
     "Read(**/.config/gh/hosts.yml)", "Read(**/.npmrc)", "Read(**/*.env)", "Read(**/*.pem)",
     "Read(**/*.key)", "Read(**/credentials.json)", "Read(**/.credentials.json)",
     "Read(**/auth.json)", "Read(**/*login.json)",
+    # ★便 07ee11a2: * と :* を混ぜた書き方は Claude Code が * をリテラル扱いして何も止めない。
+    # 正しい形（* をワイルドカードとして展開）を正本に足したので、壊れた旧形を退役する。
+    "Bash(git push * --force:*)", "Bash(git push * -f:*)", "Bash(git push * --force-with-lease:*)",
+    "Bash(cat .env.*:*)", "Bash(cat *.env:*)",
 })
 retire_hit = [r for r in cur if r in RETIRED_DENY]
 if retire_hit: