agent-yes 1.228.0 → 1.229.0

package/ts/todoStore.ts

@@ -87,6 +87,19 @@ export interface TodoRecord extends JsonlDoc {
   orphanedFrom?: string;
   /** Up to a few currently-idle agent ids suggested as replacements, computed at the moment of orphaning — a snapshot, not live; re-run reconcile for a fresh list. */
   reassignCandidates?: string[];
+  /**
+   * Incremented every time `block` is written (set OR cleared) — never
+   * reset, never derived from `block`'s own content. Exists specifically so
+   * a caller that read a block, did other work, and now wants to clear
+   * EXACTLY that block instance (`clearBlockIfMatches`) can detect an ABA
+   * race: another process replacing the block with a byte-for-byte
+   * IDENTICAL `{type, who, question/options/actionLink}` value would be
+   * invisible to a content-only comparison, silently erasing that (distinct,
+   * newer) block instance as if it were the one originally read
+   * (codex-review round-17 Important). Absent on records written before
+   * this field existed — treated as `0`.
+   */
+  blockRev?: number;
   createdAt: string;
   updatedAt: string;
 }
@@ -621,7 +634,11 @@ export class TodoStore {
     // reload-and-recompute-from-fresh dance the way `blockedBy` does below —
     // it still goes through the write lock via `rawUpdate` for existence
     // validation to run against a fresh record.
-    return this.rawUpdate(id, () => ({ block }));
+    //
+    // `blockRev` bumps on every write regardless of whether `block` actually
+    // changed value — see the field's doc comment for why identity, not
+    // content, is what `clearBlockIfMatches` needs.
+    return this.rawUpdate(id, (fresh) => ({ block, blockRev: (fresh.blockRev ?? 0) + 1 }));
   }
 
   /**
@@ -641,7 +658,118 @@ export class TodoStore {
           `task ${id}: block changed since this was decided (expected waiting-on-agent for "${expectedAgentId}") — not clearing`,
         );
       }
-      return { block: null };
+      return { block: null, blockRev: (fresh.blockRev ?? 0) + 1 };
+    });
+  }
+
+  /**
+   * Clears `block` ONLY if the FRESH record's `blockRev` still equals
+   * `expectedBlockRev` — the generalized form of `clearWaitingOnAgentBlock`
+   * above, for a caller (e.g. `askApi.ts`'s `answerAsk`) that decided to
+   * clear a specific `blocked-by-human` block instance from a snapshot
+   * taken at the start of a longer operation.
+   *
+   * Compares `blockRev`, NOT the block's own content: an earlier version of
+   * this method compared `JSON.stringify(fresh.block)` against the snapshot,
+   * which missed an ABA race — another process could replace the block with
+   * a byte-for-byte IDENTICAL `{type, who, question/options/actionLink}`
+   * value (e.g. the exact same question asked again) between the caller's
+   * read and this call, and the content-only check would see no difference,
+   * silently erasing that distinct, newer block instance as if it were the
+   * one the caller actually decided to answer (codex-review round-17
+   * Important). `blockRev` increments on every write to `block` regardless
+   * of whether the new value differs from the old one, so it uniquely
+   * identifies THIS PARTICULAR block-setting event, not just its shape.
+   *
+   * Clearing unconditionally by `id` alone (or by content alone) could
+   * silently erase a genuinely different, newer block that another process
+   * set in the meantime — the task would then look unblocked even though a
+   * real, later block exists (codex-review Important). Throws instead of
+   * silently no-op-ing so the caller can report the conflict rather than
+   * claim success.
+   */
+  clearBlockIfMatches(id: string, expectedBlockRev: number): Promise<TodoRecord> {
+    return this.rawUpdate(id, (fresh) => {
+      if ((fresh.blockRev ?? 0) !== expectedBlockRev) {
+        throw new Error(`task ${id}: block changed since this was decided — not clearing`);
+      }
+      return { block: null, blockRev: (fresh.blockRev ?? 0) + 1 };
+    });
+  }
+
+  /**
+   * Atomically clears a `blocked-by-human` block AND, if `gate` is given,
+   * appends its evidence and advances the transition it names — all inside
+   * ONE `rawUpdate` write (one lock acquisition, one reload, one write).
+   *
+   * This exists specifically so `askApi.ts`'s `answerAsk()` never composes
+   * "verify blockRev, approve() a gate, transition(), clearBlockIfMatches()"
+   * as separate locked writes again. That composition (this method's
+   * predecessor) had a real gap: `approve()`/`transition()` could durably
+   * succeed — evidence appended, state advanced — and ONLY THEN could the
+   * final `clearBlockIfMatches()` fail because another process replaced the
+   * block in between. The task was left in a state no caller intended:
+   * already transitioned/evidenced for the OLD block, while `block` still
+   * held a DIFFERENT, newer `blocked-by-human` ask that was never gated at
+   * all (codex-review round-18 Important — the exact race this module's
+   * whole `blockRev` mechanism exists to close, just one step further out
+   * than `clearBlockIfMatches` alone could reach). Folding everything into
+   * one `rawUpdate` cycle makes the two outcomes (nothing changed / gate +
+   * transition + clear all changed together) the only two possible ones —
+   * there is no window in which one succeeded and the other didn't.
+   *
+   * `blockRev` re-validates `canTransition` against the FRESH state (not a
+   * value captured before this call), matching `transition()`'s own
+   * concurrent-state-drift defense — a state change unrelated to `block`
+   * (and so invisible to the `blockRev` check alone) must still be caught.
+   *
+   * Independent verification (this module's single most important
+   * invariant — see the file's own header comment) is re-checked here
+   * against the FRESH owner, exactly as `approve()` checks it: `gate`, when
+   * given, is never applied if its `validator` is the task's own owner.
+   * This method does not call `approve()` (it is not a separate write), so
+   * skipping this check here would silently let a human answer their own
+   * gated ask with no independent-verification enforcement at all.
+   */
+  answerHumanBlock(
+    id: string,
+    expectedBlockRev: number,
+    gate: { name: string; toState: string; validator: string; note: string } | null,
+  ): Promise<TodoRecord> {
+    return this.rawUpdate(id, (fresh) => {
+      if ((fresh.blockRev ?? 0) !== expectedBlockRev) {
+        throw new Error(
+          `task ${id}: this ask has changed since it was loaded (expected blockRev ${expectedBlockRev}, current ${fresh.blockRev ?? 0}) — refresh and try again`,
+        );
+      }
+      const patch: Partial<Omit<TodoRecord, "_id">> = {
+        block: null,
+        blockRev: (fresh.blockRev ?? 0) + 1,
+      };
+      if (gate) {
+        if (
+          fresh.owner &&
+          fresh.owner.trim().toLowerCase() === gate.validator.trim().toLowerCase()
+        ) {
+          throw new Error(
+            `task ${id}: independent verification required — validator "${gate.validator}" is the same identity as owner "${fresh.owner}"; the worker cannot certify their own work`,
+          );
+        }
+        if (!canTransition(fresh.kind, fresh.state, gate.toState)) {
+          throw new Error(
+            `task ${id}: no transition ${fresh.state} -> ${gate.toState} for kind "${fresh.kind}" (state changed concurrently) — not clearing`,
+          );
+        }
+        const evidenceEntry: GateEvidence = {
+          gate: gate.name,
+          passedAt: new Date().toISOString(),
+          validator: gate.validator,
+          note: gate.note,
+        };
+        patch.verifyEvidence = [...fresh.verifyEvidence, evidenceEntry];
+        patch.state = gate.toState;
+      }
+      return patch;
     });
   }
 

package/dist/SUPPORTED_CLIS-Bfresz1n.js

@@ -1,11 +0,0 @@
-import "./ts-Cl3CmLH9.js";
-import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-Dhjyjxs_.js";
-import "./JsonlStore-Bm5Nj6v_.js";
-import "./globalPidIndex-CoNr7tS8.js";
-import "./pidStore-DCqpU_bI.js";
-import "./messageLog-Bb_Ie3Ck.js";
-import "./todoAutomation-Cwnh4aWo.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-C5d64Xqj.js";
-
-export { SUPPORTED_CLIS };

package/dist/pidStore-CatWvn5W.js

@@ -1,6 +0,0 @@
-import "./logger-CDIsZ-Pp.js";
-import "./JsonlStore-Bm5Nj6v_.js";
-import "./globalPidIndex-CoNr7tS8.js";
-import { t as PidStore } from "./pidStore-DCqpU_bI.js";
-
-export { PidStore };

package/dist/spawnGate-CIC7b7nm.js

@@ -1,5 +0,0 @@
-import "./logger-CDIsZ-Pp.js";
-import "./globalPidIndex-CoNr7tS8.js";
-import { i as waitForSpawnCapacity, n as spawnGateEnabled, r as spawnRejectionReason, t as memAvailableMb } from "./spawnGate-CeFYH-Ib.js";
-
-export { waitForSpawnCapacity };