amalgm 0.1.239 → 0.1.241

package/runtime/scripts/amalgm-mcp/workspace/content.js

@@ -0,0 +1,32 @@
+'use strict';
+
+const crypto = require('crypto');
+
+const CHUNK_BYTES = 512 * 1024;
+
+function sha256(bytes) {
+  return crypto.createHash('sha256').update(bytes).digest('hex');
+}
+
+function describeBytes(bytesInput) {
+  const bytes = Buffer.isBuffer(bytesInput) ? bytesInput : Buffer.from(bytesInput);
+  const chunks = [];
+  for (let offset = 0; offset < bytes.length; offset += CHUNK_BYTES) {
+    const part = bytes.subarray(offset, Math.min(offset + CHUNK_BYTES, bytes.length));
+    chunks.push({ sha256: sha256(part), bytes: part.length });
+  }
+  return chunks;
+}
+
+function manifestChecksum(chunks) {
+  return sha256(Buffer.from(JSON.stringify(
+    chunks.map((chunk) => ({ sha256: chunk.sha256, bytes: chunk.bytes })),
+  )));
+}
+
+module.exports = {
+  CHUNK_BYTES,
+  describeBytes,
+  manifestChecksum,
+  sha256,
+};

package/runtime/scripts/amalgm-mcp/workspace/durable.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+function syncDirectory(directory) {
+  const descriptor = fs.openSync(directory, 'r');
+  try {
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+/**
+ * Durable sync state is replaced, never edited in place. After a process
+ * death, readers therefore see either the complete old value or the complete
+ * new value.
+ */
+function writeFile(file, content, mode = 0o600) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const temporary = path.join(
+    path.dirname(file),
+    `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(8).toString('hex')}.tmp`,
+  );
+  let descriptor = fs.openSync(temporary, 'wx', mode);
+  try {
+    fs.writeFileSync(descriptor, content);
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor);
+    descriptor = null;
+    fs.renameSync(temporary, file);
+    syncDirectory(path.dirname(file));
+  } finally {
+    if (descriptor !== null) fs.closeSync(descriptor);
+    if (fs.existsSync(temporary)) fs.rmSync(temporary, { force: true });
+  }
+}
+
+function writeJson(file, value, { pretty = false } = {}) {
+  writeFile(file, `${JSON.stringify(value, null, pretty ? 2 : 0)}\n`);
+}
+
+module.exports = { writeFile, writeJson };

package/runtime/scripts/amalgm-mcp/workspace/git.js

@@ -18,6 +18,7 @@
  */
 
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const { execFile } = require('child_process');
 const { promisify } = require('util');
@@ -46,14 +47,15 @@ class GitError extends Error {
   }
 }
 
-async function git(args, cwd, { okCodes = [0] } = {}) {
+async function git(args, cwd, { okCodes = [0], env = {} } = {}) {
   try {
-    const { stdout } = await execFileAsync('git', args, {
+    const options = {
       cwd,
-      env: { ...process.env, ...GIT_ENV },
+      env: { ...process.env, ...GIT_ENV, ...env },
       timeout: 15_000,
       maxBuffer: 128 * 1024 * 1024,
-    });
+    };
+    const { stdout } = await execFileAsync('git', args, options);
     return { stdout, exitCode: 0 };
   } catch (error) {
     const exitCode = typeof error.code === 'number' ? error.code : 1;
@@ -64,6 +66,189 @@ async function git(args, cwd, { okCodes = [0] } = {}) {
   }
 }
 
+function changeIdentity(file) {
+  try {
+    const stat = fs.lstatSync(file, { bigint: true });
+    return {
+      dev: stat.dev.toString(),
+      ino: stat.ino.toString(),
+      mode: stat.mode.toString(),
+      size: stat.size.toString(),
+      mtimeNs: stat.mtimeNs.toString(),
+      ctimeNs: stat.ctimeNs.toString(),
+    };
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+}
+
+function sameIdentity(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+async function indexPath(worktreeRoot) {
+  const { stdout } = await git(
+    ['-C', worktreeRoot, 'rev-parse', '--git-path', 'index'],
+    worktreeRoot,
+  );
+  const value = stdout.trim();
+  return path.isAbsolute(value) ? value : path.resolve(worktreeRoot, value);
+}
+
+function worktreePathIdentity(worktreeRoot, relativePath) {
+  const parts = relativePath.split('/');
+  let current = worktreeRoot;
+  for (let index = 0; index < parts.length; index += 1) {
+    current = path.join(current, parts[index]);
+    let stat;
+    try {
+      stat = fs.lstatSync(current, { bigint: true });
+    } catch (error) {
+      if (error?.code === 'ENOENT') return { kind: 'absent' };
+      throw error;
+    }
+    if (index < parts.length - 1 && !stat.isDirectory()) {
+      return { kind: 'unsafe-parent' };
+    }
+    if (index === parts.length - 1) {
+      return {
+        kind: stat.isSymbolicLink()
+          ? 'symlink'
+          : stat.isFile()
+            ? 'file'
+            : 'other',
+        dev: stat.dev.toString(),
+        ino: stat.ino.toString(),
+        mode: stat.mode.toString(),
+        size: stat.size.toString(),
+        mtimeNs: stat.mtimeNs.toString(),
+        ctimeNs: stat.ctimeNs.toString(),
+        ...(stat.isSymbolicLink() ? { target: fs.readlinkSync(current) } : {}),
+      };
+    }
+  }
+  return { kind: 'absent' };
+}
+
+function worktreeIdentity(worktreeRoot, paths) {
+  return Object.fromEntries(
+    paths.map((relativePath) => [
+      relativePath,
+      worktreePathIdentity(worktreeRoot, relativePath),
+    ]),
+  );
+}
+
+async function ignoredNamespacePaths(worktreeRoot) {
+  const { stdout } = await git(
+    [
+      '-C', worktreeRoot,
+      'ls-files',
+      '--others',
+      '--ignored',
+      '--exclude-standard',
+      '--directory',
+      '-z',
+    ],
+    worktreeRoot,
+  );
+  return stdout.split('\0').filter(Boolean).map((entry) => (
+    entry.endsWith('/') ? entry.slice(0, -1) : entry
+  ));
+}
+
+function namespacePathIgnored(relativePath, ignoredPaths) {
+  return ignoredPaths.some((ignored) => (
+    relativePath === ignored || relativePath.startsWith(`${ignored}/`)
+  ));
+}
+
+function directoryIdentity(absolutePath) {
+  const stat = fs.lstatSync(absolutePath, { bigint: true });
+  if (!stat.isDirectory()) return null;
+  return {
+    dev: stat.dev.toString(),
+    ino: stat.ino.toString(),
+    mode: stat.mode.toString(),
+    mtimeNs: stat.mtimeNs.toString(),
+    ctimeNs: stat.ctimeNs.toString(),
+  };
+}
+
+/**
+ * Git's untracked listing names files, not the namespace in which new files
+ * can appear. Capture the complete non-ignored directory membership before
+ * and after the byte reads so delete/list/recreate ABA cannot hide a file.
+ * Ignored subtrees are pruned at their boundary, so dependency churn never
+ * blocks publication.
+ */
+async function visibleNamespaceIdentity(worktreeRoot) {
+  const ignored = await ignoredNamespacePaths(worktreeRoot);
+  const identity = {};
+  let directories = [{ absolute: worktreeRoot, relative: '' }];
+  while (directories.length > 0) {
+    const next = [];
+    for (const directory of directories) {
+      const entries = [];
+      try {
+        const before = directoryIdentity(directory.absolute);
+        if (!before) return { state: 'moving' };
+        for (const dirent of fs.readdirSync(directory.absolute, { withFileTypes: true })) {
+          if (directory.relative === '' && dirent.name === '.git') continue;
+          const relative = directory.relative
+            ? `${directory.relative}/${dirent.name}`
+            : dirent.name;
+          if (namespacePathIgnored(relative, ignored)) continue;
+          const absolute = path.join(directory.absolute, dirent.name);
+          const stat = fs.lstatSync(absolute, { bigint: true });
+          const isDirectory = stat.isDirectory();
+          const kind = isDirectory
+            ? 'directory'
+            : stat.isSymbolicLink()
+              ? 'symlink'
+              : stat.isFile()
+                ? 'file'
+                : 'other';
+          entries.push({
+            name: dirent.name,
+            kind,
+            dev: stat.dev.toString(),
+            ino: stat.ino.toString(),
+            ...(isDirectory ? {
+              mode: stat.mode.toString(),
+              mtimeNs: stat.mtimeNs.toString(),
+              ctimeNs: stat.ctimeNs.toString(),
+            } : {
+              mode: stat.mode.toString(),
+              size: stat.size.toString(),
+              mtimeNs: stat.mtimeNs.toString(),
+              ctimeNs: stat.ctimeNs.toString(),
+              ...(stat.isSymbolicLink() ? { target: fs.readlinkSync(absolute) } : {}),
+            }),
+          });
+          if (isDirectory && !fs.existsSync(path.join(absolute, '.git'))) {
+            next.push({ absolute, relative });
+          }
+        }
+        const after = directoryIdentity(directory.absolute);
+        if (!after || !sameIdentity(before, after)) return { state: 'moving' };
+        identity[directory.relative] = {
+          directory: after,
+          entries: entries.sort((left, right) => left.name.localeCompare(right.name)),
+        };
+      } catch (error) {
+        if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
+          return { state: 'moving' };
+        }
+        throw error;
+      }
+    }
+    directories = next.sort((left, right) => left.relative.localeCompare(right.relative));
+  }
+  return { state: 'ready', value: identity };
+}
+
 const NOT_A_REPO_RE = /not a git repository/i;
 
 /**
@@ -339,7 +524,16 @@ async function captureWorktreeDiff(worktreeRoot, { maxBytes = Infinity } = {}) {
     ['-C', worktreeRoot, 'ls-files', '--others', '--exclude-standard', '-z'],
     worktreeRoot,
   );
-  for (const file of untracked.stdout.split('\0').filter(Boolean).sort()) {
+  const untrackedPaths = untracked.stdout.split('\0').filter(Boolean).sort();
+  if (untrackedPaths.some((file) => file.endsWith('/'))) {
+    return {
+      baseOid,
+      diff: null,
+      reason: 'unsupported-nested-repository',
+      bytes,
+    };
+  }
+  for (const file of untrackedPaths) {
     if (bytes > maxBytes) break;
     const creation = await git(
       ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', '--no-index', '--binary', '--full-index', '--', '/dev/null', file],
@@ -377,47 +571,207 @@ function checkpointCaptureResult({
   return { baseOid, indexDiff, worktreeDiff, bytes };
 }
 
-async function captureCheckpoint(worktreeRoot, { maxBytes = Infinity } = {}) {
+async function captureCheckpointOnce(worktreeRoot, { maxBytes = Infinity } = {}) {
   const baseOid = await headOid(worktreeRoot);
   if (!baseOid) return { baseOid: null, indexDiff: null, worktreeDiff: null, reason: 'unborn' };
+  const sourceIndex = await indexPath(worktreeRoot);
+  const snapshotRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-index-snapshot-'));
+  const snapshotIndex = path.join(snapshotRoot, 'index');
+  try {
+    const initialIndexIdentity = changeIdentity(sourceIndex);
+    if (!initialIndexIdentity) {
+      return {
+        baseOid,
+        indexDiff: null,
+        worktreeDiff: null,
+        reason: 'index-missing',
+        bytes: 0,
+      };
+    }
+    fs.copyFileSync(sourceIndex, snapshotIndex);
+    if (!sameIdentity(initialIndexIdentity, changeIdentity(sourceIndex))) {
+      return {
+        baseOid,
+        indexDiff: null,
+        worktreeDiff: null,
+        reason: 'observation-moved',
+        bytes: 0,
+      };
+    }
+    const snapshotEnv = { GIT_INDEX_FILE: snapshotIndex };
+    let stagedTree;
+    try {
+      stagedTree = (await git(
+        ['-C', worktreeRoot, 'write-tree'],
+        worktreeRoot,
+        { env: snapshotEnv },
+      )).stdout.trim();
+    } catch (error) {
+      if (
+        error instanceof GitError
+        && /unmerged|not uptodate|cannot write.*tree/i.test(error.stderr)
+      ) {
+        return {
+          baseOid,
+          indexDiff: null,
+          worktreeDiff: null,
+          reason: 'index-unmerged',
+          bytes: 0,
+        };
+      }
+      throw error;
+    }
+    const normalizedIndex = path.join(snapshotRoot, 'normalized-index');
+    const normalizedEnv = { GIT_INDEX_FILE: normalizedIndex };
+    await git(
+      ['-C', worktreeRoot, 'read-tree', stagedTree],
+      worktreeRoot,
+      { env: normalizedEnv },
+    );
+    const tracked = await git(
+      ['-C', worktreeRoot, 'ls-files', '-z'],
+      worktreeRoot,
+      { env: normalizedEnv },
+    );
+    const trackedPaths = tracked.stdout.split('\0').filter(Boolean);
+    const initialNamespace = await visibleNamespaceIdentity(worktreeRoot);
+    if (initialNamespace.state !== 'ready') {
+      return {
+        baseOid,
+        indexDiff: null,
+        worktreeDiff: null,
+        reason: 'observation-moved',
+        bytes: 0,
+      };
+    }
+    const untracked = await git(
+      ['-C', worktreeRoot, 'ls-files', '--others', '--exclude-standard', '-z'],
+      worktreeRoot,
+      { env: normalizedEnv },
+    );
+    const untrackedPaths = untracked.stdout.split('\0').filter(Boolean).sort();
+    if (untrackedPaths.some((file) => file.endsWith('/'))) {
+      return {
+        baseOid,
+        indexDiff: null,
+        worktreeDiff: null,
+        reason: 'unsupported-nested-repository',
+        bytes: 0,
+      };
+    }
+    const observedPaths = [...new Set([...trackedPaths, ...untrackedPaths])].sort();
+    const initialWorktreeIdentity = worktreeIdentity(worktreeRoot, observedPaths);
 
-  const staged = await git(
-    ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', '--cached', 'HEAD', '--binary', '--full-index'],
-    worktreeRoot,
-  );
-  const unstaged = await git(
-    ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', '--binary', '--full-index'],
-    worktreeRoot,
-  );
-  const worktreeParts = [unstaged.stdout];
-  let bytes = Buffer.byteLength(staged.stdout) + Buffer.byteLength(unstaged.stdout);
-  const untracked = await git(
-    ['-C', worktreeRoot, 'ls-files', '--others', '--exclude-standard', '-z'],
-    worktreeRoot,
-  );
-  for (const file of untracked.stdout.split('\0').filter(Boolean).sort()) {
-    if (bytes > maxBytes) break;
-    const creation = await git(
-      ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', '--no-index', '--binary', '--full-index', '--', '/dev/null', file],
+    const staged = await git(
+      ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', 'HEAD', stagedTree, '--binary', '--full-index'],
       worktreeRoot,
-      { okCodes: [0, 1] },
+      { env: normalizedEnv },
     );
-    worktreeParts.push(creation.stdout);
-    bytes += Buffer.byteLength(creation.stdout);
+    const unstaged = await git(
+      ['-C', worktreeRoot, ...PATCH_ARGS, 'diff', '--binary', '--full-index'],
+      worktreeRoot,
+      { env: normalizedEnv },
+    );
+    const worktreeParts = [unstaged.stdout];
+    let bytes = Buffer.byteLength(staged.stdout) + Buffer.byteLength(unstaged.stdout);
+    for (const file of untrackedPaths) {
+      if (bytes > maxBytes) break;
+      const creation = await git(
+        [
+          '-C', worktreeRoot, ...PATCH_ARGS,
+          'diff', '--no-index', '--binary', '--full-index', '--', '/dev/null', file,
+        ],
+        worktreeRoot,
+        { okCodes: [0, 1], env: normalizedEnv },
+      );
+      worktreeParts.push(creation.stdout);
+      bytes += Buffer.byteLength(creation.stdout);
+    }
+    const observedOid = await headOid(worktreeRoot);
+    const finalWorktreeIdentity = worktreeIdentity(worktreeRoot, observedPaths);
+    const finalUntracked = await git(
+      ['-C', worktreeRoot, 'ls-files', '--others', '--exclude-standard', '-z'],
+      worktreeRoot,
+      { env: normalizedEnv },
+    );
+    const finalNamespace = await visibleNamespaceIdentity(worktreeRoot);
+    if (
+      !sameIdentity(initialIndexIdentity, changeIdentity(sourceIndex))
+      || !sameIdentity(initialWorktreeIdentity, finalWorktreeIdentity)
+      || untracked.stdout !== finalUntracked.stdout
+      || finalNamespace.state !== 'ready'
+      || !sameIdentity(initialNamespace.value, finalNamespace.value)
+    ) {
+      return {
+        baseOid,
+        indexDiff: null,
+        worktreeDiff: null,
+        reason: 'observation-moved',
+        bytes,
+      };
+    }
+    return checkpointCaptureResult({
+      baseOid,
+      observedOid,
+      indexDiff: staged.stdout,
+      worktreeDiff: worktreeParts.join(''),
+      bytes,
+      maxBytes,
+    });
+  } finally {
+    fs.rmSync(snapshotRoot, { recursive: true, force: true });
   }
-  const observedOid = await headOid(worktreeRoot);
-  return checkpointCaptureResult({
-    baseOid,
-    observedOid,
-    indexDiff: staged.stdout,
-    worktreeDiff: worktreeParts.join(''),
-    bytes,
-    maxBytes,
-  });
+}
+
+function stableCheckpointCapture(first, second) {
+  if (JSON.stringify(first) === JSON.stringify(second)) return second;
+  return {
+    baseOid: second?.baseOid ?? first?.baseOid ?? null,
+    indexDiff: null,
+    worktreeDiff: null,
+    reason: 'observation-moved',
+    bytes: Math.max(
+      Number.isFinite(first?.bytes) ? first.bytes : 0,
+      Number.isFinite(second?.bytes) ? second.bytes : 0,
+    ),
+  };
+}
+
+async function captureStableCheckpoint(read, attempts = 4) {
+  if (!Number.isInteger(attempts) || attempts < 2) {
+    throw new Error('checkpoint capture requires at least two observations');
+  }
+  let previous = await read();
+  let compared = previous;
+  for (let attempt = 1; attempt < attempts; attempt += 1) {
+    const current = await read();
+    compared = stableCheckpointCapture(previous, current);
+    if (compared.reason !== 'observation-moved') return compared;
+    previous = current;
+  }
+  return compared;
+}
+
+/**
+ * A checkpoint is a fact about HEAD, index, and worktree at one stable
+ * instant. Individual Git reads cannot lock all three layers together, so a
+ * capture is usable only after two consecutive complete captures are
+ * byte-identical. A bounded retry absorbs filesystem metadata settling after
+ * a save; alternating or continuously moving state still returns "moving."
+ * Mixed layers are never promoted to provenance.
+ */
+async function captureCheckpoint(worktreeRoot, options = {}) {
+  return captureStableCheckpoint(
+    () => captureCheckpointOnce(worktreeRoot, options),
+  );
 }
 
 module.exports = {
-  _test: { checkpointCaptureResult },
+  _test: {
+    captureStableCheckpoint,
+    checkpointCaptureResult,
+    stableCheckpointCapture,
+  },
   GitError,
   captureCheckpoint,
   captureWorktreeDiff,