@zq-silk/yui 0.15.9 → 0.15.11

package/dist/release/releaseWorkflowPorts.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { chmod, mkdir, mkdtemp, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { releaseWorkflowScratchRoot } from "../storage/homeLayout.js";
 import { runUpdate } from "../cli/updateOrchestrator.js";
 import { activatedControllerEntrypoint } from "../cli/updatePorts.js";
 import { restartFileTaskController, stopFileTaskController } from "../controller/clientRuntime.js";
@@ -581,7 +581,7 @@ export function createReleaseWorkflowPorts(deps) {
                 // publish` read THIS snapshot, so a TOCTOU replacement of the
                 // original path after the integrity check cannot change what is
                 // published. The snapshot is removed once publish completes.
-                const snapshot = await writeVerifiedTarballSnapshot(bytes);
+                const snapshot = await writeVerifiedTarballSnapshot(deps.home, bytes);
                 try {
                     // Inspect the tarball manifest before publishing: the actual
                     // package name/version must match the frozen declaration, not
@@ -727,8 +727,12 @@ export function createReleaseWorkflowPorts(deps) {
                 // P2-2 (rr19): Install in a fresh temp directory with an isolated
                 // npm cache, so npx cannot reuse a local node_modules binary. Then
                 // run the installed binary directly and verify the output matches
-                // the pinned version.
-                const smokeDir = await mkdtemp(join(tmpdir(), "yui-smoke-"));
+                // the pinned version. The smoke directory is a Yui-authored release
+                // artifact, so it lands under the Home release-workflow scratch root,
+                // never a shared system temp root.
+                const scratch = releaseWorkflowScratchRoot(deps.home);
+                await mkdir(scratch, { recursive: true, mode: 0o700 });
+                const smokeDir = await mkdtemp(join(scratch, "yui-smoke-"));
                 const smokeCache = join(smokeDir, "npm-cache");
                 try {
                     const install = await run("npm", [
@@ -1642,10 +1646,14 @@ async function queryControllerLifecycle(run, globalYui, home, expectedVersion) {
  * random name and read-only permissions (P1-3, rr22). The manifest
  * inspection and `npm publish` both read this snapshot, so replacing the
  * original path after the integrity check cannot change what is published.
- * The caller removes the snapshot once publish completes.
+ * The caller removes the snapshot once publish completes. The snapshot is a
+ * Yui-authored release artifact, so it lands under the Home release-workflow
+ * scratch root, never a shared system temp root.
  */
-async function writeVerifiedTarballSnapshot(bytes) {
-    const snapshot = join(tmpdir(), `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
+async function writeVerifiedTarballSnapshot(home, bytes) {
+    const scratch = releaseWorkflowScratchRoot(home);
+    await mkdir(scratch, { recursive: true, mode: 0o700 });
+    const snapshot = join(scratch, `yui-release-snapshot-${randomBytes(12).toString("hex")}.tgz`);
     // "wx" fails if the random name already exists, so a pre-existing file
     // (or symlink) can never be overwritten or followed.
     await writeFile(snapshot, bytes, { flag: "wx" });

package/dist/repository/gitWorkspace.js

@@ -679,7 +679,10 @@ export class NodeGitWorkspace {
         return this.#ensureManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: worktreeIdentity(input.taskSegment, input.roleName),
+            identity: {
+                directory: input.directory,
+                branch: worktreeIdentity(input.taskSegment, input.roleName).branch
+            },
             baseRef: input.baseRef
         });
     }
@@ -687,7 +690,10 @@ export class NodeGitWorkspace {
         return this.#ensureManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: integrationWorktreeIdentity(input.taskSegment, input.integrationId),
+            identity: {
+                directory: input.directory,
+                branch: integrationWorktreeIdentity(input.taskSegment, input.integrationId).branch
+            },
             baseRef: input.baseRef,
             allowRebase: true
         });
@@ -734,19 +740,19 @@ export class NodeGitWorkspace {
         if (state === "dirty")
             return state;
         const container = resolve(input.container);
-        const identity = worktreeIdentity(input.taskSegment, input.roleName);
-        const path = managedPath(container, identity.directory);
+        const branch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+        const path = managedPath(container, input.directory);
         const project = await this.inspect(input.repositoryPath);
         if (state === "missing") {
             if (input.deleteBranch === true) {
-                await git(["-C", project.root, "worktree", "prune"]);
-                await deleteBranchIfPresent(project.root, identity.branch);
+                await removeMissingWorktreeRegistration(project.root, path, branch);
+                await deleteBranchIfPresent(project.root, branch);
             }
             return state;
         }
         await git(["-C", project.root, "worktree", "remove", "--", path]);
         if (input.deleteBranch === true) {
-            await deleteBranchIfPresent(project.root, identity.branch);
+            await deleteBranchIfPresent(project.root, branch);
         }
         return "removed";
     }
@@ -779,6 +785,36 @@ export class NodeGitWorkspace {
         }
         return "removed";
     }
+    async removeTaskClone(input) {
+        const identity = worktreeIdentity(input.taskSegment, "main");
+        const expected = managedPath(resolve(input.container), input.directory);
+        if (resolve(input.path) !== expected || input.branch !== identity.branch) {
+            throw new Error("Task clone does not match its recorded managed identity.");
+        }
+        const kind = await pathKind(expected);
+        if (kind === undefined)
+            return "missing";
+        if (kind === "symlink")
+            throw new Error("Task clone must not be a symbolic link.");
+        await canonicalContainer(input.container, false);
+        if (await realpath(expected) !== expected || await pathKind(join(expected, ".git")) !== "directory") {
+            throw new Error("Task clone is not a standalone owned Git directory.");
+        }
+        const repository = await this.inspect(expected);
+        if (repository.root !== expected || repository.gitDirectory !== join(expected, ".git")) {
+            throw new Error("Task clone Git ownership cannot be established.");
+        }
+        await assertExpectedBranch(expected, input.branch);
+        if (!await this.isClean(expected))
+            return "dirty";
+        const worktrees = (await git(["-C", expected, "worktree", "list", "--porcelain", "-z"]))
+            .split("\0").filter(line => line.startsWith("worktree "));
+        if (worktrees.length !== 1 || worktrees[0] !== `worktree ${expected}`) {
+            throw new Error("Task clone still owns Git worktree registrations; retained.");
+        }
+        await rm(expected, { recursive: true });
+        return "removed";
+    }
     async inspectRecordedWorktree(input) {
         const inspected = await inspectExactRecordedWorktree(input);
         return inspected?.state ?? "missing";
@@ -824,7 +860,7 @@ export class NodeGitWorkspace {
     }
     async inspectWorktree(input) {
         const container = resolve(input.container);
-        const path = managedPath(container, worktreeIdentity(input.taskSegment, input.roleName).directory);
+        const path = managedPath(container, input.directory);
         const kind = await pathKind(path);
         if (kind === undefined)
             return "missing";
@@ -840,7 +876,10 @@ export class NodeGitWorkspace {
         return this.#removeManagedWorktree({
             repositoryPath: input.repositoryPath,
             container: input.container,
-            identity: integrationWorktreeIdentity(input.taskSegment, input.integrationId),
+            identity: {
+                directory: input.directory,
+                branch: integrationWorktreeIdentity(input.taskSegment, input.integrationId).branch
+            },
             discardChanges: input.discardChanges
         });
     }
@@ -851,6 +890,9 @@ export class NodeGitWorkspace {
         if (kind === "symlink")
             throw new Error("Managed worktree path must not be a symbolic link.");
         const repository = await this.inspect(input.repositoryPath);
+        if (kind === undefined) {
+            await removeMissingWorktreeRegistration(repository.root, path, input.identity.branch);
+        }
         if (kind === "directory") {
             const canonicalContainerPath = await canonicalContainer(container, false);
             await assertOwnedWorktree(repository, canonicalContainerPath, path);
@@ -884,6 +926,21 @@ export class NodeGitWorkspace {
         return kind === "directory" ? "removed" : "missing";
     }
 }
+/** Missing paths do not imply missing Git metadata. Never prune another
+ * workspace's registration as a side effect of cleaning this exact owner.
+ */
+async function removeMissingWorktreeRegistration(repositoryRoot, path, branch) {
+    const records = (await git(["-C", repositoryRoot, "worktree", "list", "--porcelain", "-z"])).split("\0\0");
+    const fields = records.map(record => record.split("\0")).find(record => record.includes(`worktree ${path}`));
+    if (fields === undefined)
+        return;
+    if (!fields.includes(`branch refs/heads/${branch}`) || fields.some(field => field.startsWith("locked"))) {
+        throw new Error(`Missing worktree has uncertain or locked Git ownership: ${path}; metadata retained.`);
+    }
+    if (await pathKind(path) !== undefined)
+        throw new Error(`Worktree reappeared before metadata cleanup: ${path}.`);
+    await git(["-C", repositoryRoot, "worktree", "remove", "--force", "--", path]);
+}
 async function deleteBranchIfPresent(repositoryRoot, branch) {
     const branchRef = `refs/heads/${branch}`;
     if (!await gitSucceeds([
@@ -960,9 +1017,9 @@ async function assertOwnedWorktree(project, container, path) {
 }
 async function inspectExactRecordedWorktree(input) {
     const container = resolve(input.container);
-    const identity = worktreeIdentity(input.taskSegment, input.roleName);
-    const expectedPath = managedPath(container, identity.directory);
-    if (resolve(input.path) !== expectedPath || input.branch !== identity.branch) {
+    const expectedBranch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+    const expectedPath = managedPath(container, input.directory);
+    if (resolve(input.path) !== expectedPath || input.branch !== expectedBranch) {
         throw new Error("Recorded managed worktree identity is invalid.");
     }
     const kind = await pathKind(expectedPath);
@@ -1023,9 +1080,9 @@ async function resolveRefCommit(repositoryPath, ref) {
 async function recordedWorktreeWithoutRepository(input, cause) {
     if (await pathKind(input.repositoryPath) !== undefined)
         throw cause;
-    const identity = worktreeIdentity(input.taskSegment, input.roleName);
-    const expectedPath = managedPath(resolve(input.container), identity.directory);
-    if (resolve(input.path) !== expectedPath || input.branch !== identity.branch) {
+    const branch = worktreeIdentity(input.taskSegment, input.roleName).branch;
+    const expectedPath = managedPath(resolve(input.container), input.directory);
+    if (resolve(input.path) !== expectedPath || input.branch !== branch) {
         throw cause;
     }
     if (await pathKind(expectedPath) === undefined)

package/dist/repository/taskWorkspaceCoordinator.js

@@ -1,4 +1,8 @@
 import { isDeepStrictEqual } from "node:util";
+import { lstat } from "node:fs/promises";
+import { isArchivePersistenceFailure, recordArchiveCleanup } from "../task/archiveDiagnostics.js";
+import { projectTaskRemoteDeliveryFromStore } from "../commands/taskRemoteDeliveryCommand.js";
+import { WorkItemChangeSetManager } from "../workspace/workItemChangeSetManager.js";
 import { hasRuntimeLifecycleWork, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { managedWorkspaceKey } from "../worktree/managedWorkspace.js";
 import { acquireProjectMaintenanceLocks } from "./projectMaintenanceLock.js";
@@ -247,6 +251,7 @@ export class TaskWorkspaceCoordinator {
                 if (attempt === null
                     || attempt.status === "running"
                     || attempt.status === "blocked"
+                    || attempt.status === "conflicted"
                     || attempt.status === "validating") {
                     throw new Error(`IntegrationAttempt must be terminal before archive cleanup: ${workspace.owner.integrationAttemptId}.`);
                 }
@@ -330,6 +335,135 @@ export class TaskWorkspaceCoordinator {
             releaseMaintenance?.();
         }
     }
+    /** Best-effort cleanup only after explicit force admission has committed.
+     * This is one foreground attempt, not a retry worker. Each independent result
+     * is durable before continuing, and a failed audit write really fails.
+     */
+    async cleanupArchivedTask(taskId, disposition) {
+        const task = this.store.getTask(taskId);
+        if (task?.status !== "archived"
+            || !this.store.listEvents(taskId).some(e => e.type === "task.archived" && e.payload.force === "true")) {
+            throw new Error(`Force archive must commit before cleanup: ${taskId}.`);
+        }
+        const attempt = async (diagnostic, action) => {
+            recordArchiveCleanup(this.store, taskId, diagnostic, "started");
+            let status;
+            let detail = diagnostic.detail;
+            try {
+                const result = await action();
+                status = result === "dirty" ? "retained" : result;
+                if (result === "dirty")
+                    detail = "Dirty workspace retained; force archive does not discard local changes.";
+            }
+            catch (error) {
+                if (isArchivePersistenceFailure(error))
+                    throw error;
+                status = "retained";
+                detail = error instanceof Error ? error.message : String(error);
+            }
+            recordArchiveCleanup(this.store, taskId, { ...diagnostic, detail }, status);
+            return status !== "retained";
+        };
+        let runtimeReleased = true;
+        for (const role of this.store.listRoles(taskId)) {
+            const released = await attempt({ resource: `role:${taskId}/${role.name}`,
+                detail: "Exact Role runtime stop." }, async () => {
+                const provider = this.store.getTaskRoleSessionSet(taskId, role.name)?.providerBinding;
+                const mailbox = this.store.getWorkMailbox({ kind: "role", taskId, roleName: role.name });
+                if (mailbox?.processing != null && (provider?.run == null
+                    || !["completed", "failed", "cancelled"].includes(provider.run.status))) {
+                    throw new Error(`Original mailbox claim ${mailbox.processing.batchId} retained; execution outcome is not known.`);
+                }
+                if (provider?.run != null && !["completed", "failed", "cancelled"].includes(provider.run.status)) {
+                    throw new Error(`Provider input ${provider.run.attemptId}/${provider.run.status} retained; establish exact quiescence before resolving it.`);
+                }
+                await this.#stopLiveRoles(taskId, [role.name]);
+                return "released";
+            });
+            runtimeReleased &&= released;
+        }
+        const physicalReleased = await attempt({ resource: `runtime:${taskId}`,
+            detail: "Verify exact physical resource release before workspace deletion." }, async () => {
+            const activeRun = this.store.listRuns(taskId).find(r => r.status === "active");
+            const job = this.store.listDurableJobs(taskId).find(j => ["queued", "running", "unknown-needs-attention"].includes(j.status));
+            if (activeRun !== undefined || job !== undefined) {
+                throw new Error(`Execution resources retained: ${activeRun?.id ?? job?.id}; archive is not proof of quiescence.`);
+            }
+            if (!runtimeReleased)
+                throw new Error("One or more Role runtimes could not be safely released.");
+            if (this.runtime.assertTaskPhysicalResourcesReleased === undefined) {
+                throw new Error("Physical resource release inspection is unavailable; workspace references retained.");
+            }
+            await this.runtime.assertTaskPhysicalResourcesReleased(taskId);
+            return "released";
+        });
+        if (physicalReleased) {
+            // Task main owns the Git objects of its dependent worktrees, so it is
+            // always last and remains when any dependent cleanup is unresolved.
+            const workspaces = this.store.listManagedWorkspaces(taskId).sort((a, b) => Number(a.owner.type === "task") - Number(b.owner.type === "task"));
+            for (const workspace of workspaces) {
+                await attempt({ resource: managedWorkspaceKey(workspace.owner),
+                    detail: "Remove only clean, exactly owned workspace resources.",
+                    paths: [workspace.root, ...workspace.entries.filter(e => e.access === "write").map(e => e.path)]
+                }, async () => {
+                    const release = acquireProjectMaintenanceLocks(this.preparer.home, workspace.entries.map(e => e.projectId));
+                    try {
+                        if (!isDeepStrictEqual(this.store.getManagedWorkspace(workspace.owner), workspace)) {
+                            throw new Error("Workspace ownership changed; retained.");
+                        }
+                        const owner = workspace.owner;
+                        switch (owner.type) {
+                            case "work-item": {
+                                const item = this.store.getWorkItem(taskId, owner.workItemId);
+                                if (item?.status === "accepted" && disposition === "integrated") {
+                                    await new WorkItemChangeSetManager(this.store).assertIntegrated(taskId, item.id);
+                                }
+                                return this.preparer.cleanupWorkItemWorkspace(taskId, owner.workItemId, item?.status === "retired" ? "abandoned" : disposition);
+                            }
+                            case "review-round":
+                                return this.preparer.cleanupReviewRoundWorkspace(taskId, owner.reviewRoundId);
+                            case "execution-lane":
+                                return this.preparer.cleanupExecutionLaneWorkspace(taskId, owner.executionGroupId, owner.executionLaneId);
+                            case "integration-attempt":
+                                if (await this.preparer.inspectIntegrationWorkspace(taskId, owner.integrationAttemptId) === "dirty")
+                                    return "dirty";
+                                return this.preparer.cleanupIntegrationWorkspace(taskId, owner.integrationAttemptId);
+                            case "task": {
+                                const current = this.store.getTask(taskId);
+                                const delivery = projectTaskRemoteDeliveryFromStore(this.store, current);
+                                if (!delivery.allMerged || !delivery.allVerified) {
+                                    throw new Error("Task main retained: local commits are not covered by verified remote delivery. Force does not discard them.");
+                                }
+                                for (const entry of workspace.entries.filter(e => e.access === "write")) {
+                                    const expected = delivery.projects.find(p => p.projectId === entry.projectId)?.expectedLocalCommit;
+                                    const path = await lstat(entry.path).catch(error => {
+                                        if (error.code === "ENOENT")
+                                            return null;
+                                        throw error;
+                                    });
+                                    if (expected !== null && expected !== undefined
+                                        && path !== null) {
+                                        const actual = await this.preparer.git.inspect(entry.path, "HEAD");
+                                        if (actual.baseCommit !== expected)
+                                            throw new Error(`Task main HEAD changed: ${entry.path}; retained.`);
+                                    }
+                                }
+                                const result = await this.preparer.cleanupTaskForArchive(taskId);
+                                if (result.status !== "removed")
+                                    throw new Error(result.error ?? "Task main or dependent workspace retained.");
+                                return "removed";
+                            }
+                        }
+                    }
+                    finally {
+                        release();
+                    }
+                });
+            }
+        }
+        recordArchiveCleanup(this.store, taskId, { resource: `task:${taskId}`,
+            detail: "Foreground cleanup attempt finished; inspect retained resource references and warnings." }, "finished");
+    }
     #assertTaskArchiveSnapshot(snapshot) {
         this.#assertTaskArchiveLifecycle(snapshot.task);
         const managedWorkspaces = [...this.store.listManagedWorkspaces(snapshot.task.id)]