canopycms 0.0.67 → 0.0.68-int.101

package/dist/worker/task-runner.js

@@ -1,12 +1,12 @@
 import fs from 'node:fs/promises';
 import { simpleGit } from 'simple-git';
 import { completeTask, dequeueTask, failTask, recoverOrphanedTasks, retryTask, } from '../task-queue/cms-task-queue.js';
-import { createOrUpdatePullRequest } from '../github-service.js';
-import { BranchMetadataFileManager, getBranchMetadataFileManager } from '../branch-metadata.js';
-import { sanitizeBranchName } from '../paths/branch-name.js';
+import { createOrUpdatePullRequest, isRefAlreadyGoneError } from '../github-service.js';
+import { BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, } from '../branch-metadata.js';
+import { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX } from '../paths/branch-name.js';
 import { gitNetworkChildEnv } from '../git-manager.js';
 import { getErrorMessage, redactCredentials } from '../utils/error.js';
-import { isNonFastForwardRejection, isStaleLeaseRejection } from '../utils/git.js';
+import { isNonFastForwardRejection, isStaleLeaseRejection, workflowPushRefusalFile, } from '../utils/git.js';
 import { clearHistoryRewrittenMarker, readPublishedSha } from './history-rewrite.js';
 import { writeWorkerStatus } from '../task-queue/worker-status.js';
 import { workerLog, workerLogError } from './log.js';
@@ -90,6 +90,15 @@ function isRateLimitSignal403(err) {
     return false;
 }
 // Payload validation helpers — fail fast with clear errors instead of silent `as` casts
+/**
+ * Whether `branch` carries the reserved settings-branch prefix. Matching on the prefix
+ * alone, never on a configured name, is what keeps a content branch out: branch creation
+ * rejects the prefix, while a configured name the worker and API disagree on could be a
+ * content branch's.
+ */
+function isSettingsBranch(branch) {
+    return branch.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
+}
 function requireString(payload, key) {
     const val = payload[key];
     if (typeof val !== 'string')
@@ -282,6 +291,13 @@ export async function executeTask(ctx, task, signal) {
             if (sanitizeBranchName(branch) === ctx.sanitizedBaseBranch) {
                 throw new PermanentTaskError(`Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`);
             }
+            // The settings branch is an orphan with no history in common with the
+            // base, so GitHub 422s a PR for it: push it and stop.
+            if (isSettingsBranch(branch)) {
+                await ctx.pushBranchToGitHub(branch);
+                workerLog(`Pushed settings branch ${branch}; settings branches never get a PR`);
+                return { pushed: true };
+            }
             await ctx.pushBranchToGitHub(branch);
             const result = await createOrUpdatePullRequest({
                 octokit: ctx.octokit(),
@@ -291,9 +307,9 @@ export async function executeTask(ctx, task, signal) {
                 base,
                 title: optionalString(payload, 'title', `Submit ${branch}`),
                 body: optionalString(payload, 'body', ''),
-                // Content submits (api/github-sync.ts) set this; settings-branch
-                // syncs (services.ts) deliberately don't.
+                // Content submits (api/github-sync.ts) set both.
                 markReadyIfDraft: payload.markReadyIfDraft === true,
+                mergeSectionIntoBody: payload.mergeSectionIntoBody === true,
                 signal,
             });
             workerLog(result.created
@@ -330,23 +346,73 @@ export async function executeTask(ctx, task, signal) {
         }
         case 'delete-remote-branch': {
             const branch = requireString(payload, 'branch');
-            await ctx.octokit().git.deleteRef({
-                owner: ctx.githubOwner,
-                repo: ctx.githubRepo,
-                ref: `heads/${branch}`,
-                request: { signal },
-            });
+            // Defense-in-depth behind the delete handler's own refusal.
+            if (sanitizeBranchName(branch) === ctx.sanitizedBaseBranch || isSettingsBranch(branch)) {
+                throw new PermanentTaskError(`Refusing to delete "${branch}" on GitHub: the base and settings branches are never deleted`);
+            }
+            // A branch that reused the name after this task was queued (a requeued task can run long
+            // after) owns the GitHub branch once its own submit recorded a different PR. Without one,
+            // the ref is taken to be the deleted branch's, which is wrong only if that submit pushed
+            // and then lost its PR number. Unparseable metadata keeps the GitHub branch; other read
+            // errors retry.
+            const deletedPr = typeof payload.pullRequestNumber === 'number' ? payload.pullRequestNumber : undefined;
+            let live = null;
+            let unreadable = false;
+            try {
+                live = await BranchMetadataFileManager.loadOnly(ctx.branchWorkspacePath(branch));
+            }
+            catch (err) {
+                if (!(err instanceof BranchMetadataCorruptError))
+                    throw err;
+                unreadable = true;
+            }
+            if (unreadable ||
+                (live !== null && (typeof live.branch !== 'object' || live.branch === null))) {
+                workerLog(`Not deleting GitHub branch ${branch}: the branch now under that name is unreadable`);
+                return { deleted: false, skipped: 'metadata-unreadable' };
+            }
+            const livePr = live?.branch.pullRequestNumber;
+            if (livePr !== undefined && livePr !== deletedPr) {
+                workerLog(`Not deleting GitHub branch ${branch}: a newer branch's PR #${livePr} uses it`);
+                return { deleted: false, skipped: 'name-reused' };
+            }
+            try {
+                await ctx.octokit().git.deleteRef({
+                    owner: ctx.githubOwner,
+                    repo: ctx.githubRepo,
+                    ref: `heads/${branch}`,
+                    request: { signal },
+                });
+            }
+            catch (err) {
+                // Already gone is the outcome this task wants; failing it would only park it in failed/.
+                if (!isRefAlreadyGoneError(err))
+                    throw err;
+                workerLog(`GitHub branch ${branch} was already deleted`);
+                return { deleted: false, alreadyGone: true };
+            }
+            workerLog(`Deleted GitHub branch ${branch}`);
             return { deleted: true };
         }
         default:
             throw new PermanentTaskError(`Unknown task action: ${action}`);
     }
 }
+/**
+ * The branch whose metadata records a task's outcome, or null when none does. A
+ * delete-remote-branch task names a branch already deleted here, so a workspace under that
+ * name is leftover or a newer branch's that reused the name.
+ */
+function metadataBranchOf(task) {
+    if (task.action === 'delete-remote-branch')
+        return null;
+    return typeof task.payload.branch === 'string' ? task.payload.branch : null;
+}
 /**
  * Update branch metadata after successful task completion.
  */
 export async function updateBranchMetadata(ctx, task, result) {
-    const branch = typeof task.payload.branch === 'string' ? task.payload.branch : null;
+    const branch = metadataBranchOf(task);
     if (!branch)
         return;
     const branchPath = ctx.branchWorkspacePath(branch);
@@ -395,7 +461,7 @@ export async function updateBranchMetadata(ctx, task, result) {
  * syncFailureReason so the editor can show WHY, not just that it failed.
  */
 async function updateBranchMetadataOnFailure(ctx, task, error) {
-    const branch = typeof task.payload.branch === 'string' ? task.payload.branch : null;
+    const branch = metadataBranchOf(task);
     if (!branch)
         return;
     const branchPath = ctx.branchWorkspacePath(branch);
@@ -415,6 +481,23 @@ async function updateBranchMetadataOnFailure(ctx, task, error) {
         workerLogError(`Failed to update failure metadata for ${branch}:`, err instanceof Error ? err.message : err);
     }
 }
+/**
+ * Fail fast when GitHub refused the push for adding workflow content it does not already hold: the
+ * worker's credential deliberately lacks the workflows permission, so the identical push can never
+ * succeed. Rebasing onto a base that changed a workflow does not trigger it; a workflow edit made
+ * outside the editor, auto-merged by the rebase with a base change to the same file, does.
+ */
+function throwIfWorkflowRefusal(branch, message) {
+    const file = workflowPushRefusalFile(message);
+    if (file === null)
+        return;
+    throw new PermanentTaskError(`Push refused for branch "${branch}": it would put a version of ${file} on GitHub that ` +
+        `GitHub does not already have, and this deployment's GitHub credential is deliberately not ` +
+        `allowed to change workflow files. Such a change usually comes from outside the editor, ` +
+        `such as a direct push to this branch. Nothing was pushed, and ` +
+        `retrying will not help until a developer with permission to change workflow files ` +
+        `resolves it on GitHub.`);
+}
 export async function pushBranchToGitHub(ctx, branch) {
     const git = simpleGit({
         baseDir: ctx.remoteGitPath,
@@ -473,6 +556,7 @@ export async function pushBranchToGitHub(ctx, branch) {
     }
     catch (err) {
         const message = getErrorMessage(err);
+        throwIfWorkflowRefusal(branch, message);
         // A refused lease means GitHub is not at the commit we rewrote, so the
         // marker is stale -- routine, not exceptional: tasks are re-run after a
         // crash (recoverOrphanedTasks) and the marker survives any failure to
@@ -494,6 +578,7 @@ export async function pushBranchToGitHub(ctx, branch) {
             }
             catch (retryErr) {
                 const retryMessage = getErrorMessage(retryErr);
+                throwIfWorkflowRefusal(branch, retryMessage);
                 if (isNonFastForwardRejection(retryMessage)) {
                     throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is neither the commit this ` +
                         `deployment last published nor an ancestor of what it is pushing, so the branch ` +

package/dist/worker/worker-context.d.ts

@@ -38,7 +38,12 @@ export interface WorkerContext {
     readonly sanitizedBaseBranch: SanitizedBranchName;
     /** `{workspacePath}/.tasks` — the task queue and worker-status.json. */
     readonly taskDir: string;
-    /** `{workspacePath}/remote.git` — the shared bare repo. */
+    /**
+     * `{workspacePath}/remote.git` — the shared bare repo. The worker fetches
+     * into and pushes from a workspace clone against this path, never the
+     * clone's `origin`: that holds the path the CLONING process saw (usually
+     * the Lambda), and the clone's config is Lambda-writable.
+     */
     readonly remoteGitPath: string;
     /** `{workspacePath}/content-branches` — the branch workspace root. */
     readonly contentBranchesPath: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.67",
+  "version": "0.0.68-int.101",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {
@@ -27,6 +27,11 @@
       "import": "./dist/client.js",
       "require": "./dist/client.js"
     },
+    "./preview": {
+      "types": "./dist/preview.d.ts",
+      "import": "./dist/preview.js",
+      "require": "./dist/preview.js"
+    },
     "./server": {
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js",
@@ -85,8 +90,9 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.600.0",
+    "@aws-sdk/client-s3": "^3.1092.0",
     "@aws-sdk/s3-presigned-post": "^3.600.0",
+    "@aws-sdk/s3-request-presigner": "^3.600.0",
     "@clack/prompts": "^1.1.0",
     "@codemirror/language": "^6.0.0",
     "@dnd-kit/core": "^6.3.1",