canopycms 0.0.67 → 0.0.68-int.94

package/dist/worker/rebase.js

@@ -4,11 +4,14 @@ import { simpleGit } from 'simple-git';
 import { BranchMetadataFileManager, buildMergedBranchUpdate, getBranchMetadataFileManager, } from '../branch-metadata.js';
 import { extractIdFromFilename } from '../content-id-index.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
+import { isSettingsBranchName } from '../paths/branch-name.js';
 import { normalizeFilesystemPath } from '../paths/normalize.js';
 import { ROOT_COLLECTION_ID } from '../paths/types.js';
 import { tryAcquireContentWriteLock } from '../utils/content-write-lock.js';
+import { holdProvisionedWorkspace, releaseProvisionedWorkspace, } from './provisioned-workspace.js';
 import { getErrorMessage, isNodeError, redactCredentials } from '../utils/error.js';
-import { isRebaseInProgress } from '../utils/git.js';
+import { isCanopyInternalPath, isRebaseInProgress } from '../utils/git.js';
+import { TRACKED_CANOPY_STATE_FIX, restoreRetiredSchemaCache, splitByUpstreamTracking, trackedCanopyStateChanges, } from './canopy-state.js';
 import { enqueueGitHubPush, forcePublishToLocalRemote, markHistoryRewritten, readPublishedSha, reconcilePendingRewrite, } from './history-rewrite.js';
 import { workerLog, workerLogWarn } from './log.js';
 /**
@@ -123,7 +126,7 @@ const MAX_REBASE_ROUNDS = 50;
  * - the **unexpected-error** exit aborts HERE, before breaking, so the caller's
  *   `!completed` abort is a caught no-op for that path;
  * - the **lock-compromised** exit leaves the rebase in progress and is aborted
- *   by `rebaseOneBranch`'s own `contentLockCompromised && !completed` branch,
+ *   by `rebaseOneBranch`'s own `lockCompromised() && !completed` branch,
  *   which returns `skippedLocked` before the `!completed` block below it is
  *   reached -- a distinct site that cannot be folded into that one;
  * - the **conflict-resolution-failure** and **MAX_REBASE_ROUNDS** exits are the
@@ -406,7 +409,14 @@ export async function runRebaseCycle(ctx) {
             workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
             continue;
         }
-        const outcome = await rebaseOneBranch(ctx, branchDir, branchPath);
+        // A settings branch is an orphan: rebasing it onto the base would give it content
+        // history. The API refuses to provision one, so a directory under that name is a
+        // leftover and is left alone.
+        if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
+            workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
+            continue;
+        }
+        const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath);
         if (outcome.kind === 'rebased')
             rebased.push(branchDir);
         else if (outcome.kind === 'skippedDirty')
@@ -423,6 +433,39 @@ export async function runRebaseCycle(ctx) {
     }
     return { rebased, skippedDirty, skippedLocked, failed };
 }
+/**
+ * {@link rebaseOneBranch} under the branch's provisioning lock, so no git step races a clone of
+ * this directory. A branch whose lock is held elsewhere is `skippedLocked` and retried next cycle;
+ * one with no `branch.json` yet is skipped as not provisioned. Lock order: provisioning, then the
+ * content-write lock inside it; see `provisioned-workspace.ts` for why that order cannot deadlock.
+ * Never throws, like rebaseOneBranch.
+ */
+async function holdAndRebaseOneBranch(ctx, branchDir, branchPath) {
+    let hold;
+    try {
+        hold = await holdProvisionedWorkspace(ctx.contentBranchesPath, branchDir);
+    }
+    catch (err) {
+        // [REDACT] failed[] is served to the browser via worker-status.json.
+        const error = redactCredentials(`could not take the provisioning lock: ${getErrorMessage(err)}`);
+        workerLogWarn(`  Skipping ${branchDir}: ${error}`);
+        return { kind: 'failed', error };
+    }
+    if (hold.kind === 'locked') {
+        workerLog(`  Skipping ${branchDir}: provisioning lock held elsewhere (retrying next cycle)`);
+        return { kind: 'skippedLocked' };
+    }
+    if (hold.kind === 'not-provisioned') {
+        workerLog(`  Skipping ${branchDir}: not yet provisioned (no branch.json)`);
+        return { kind: 'none' };
+    }
+    try {
+        return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised);
+    }
+    finally {
+        await releaseProvisionedWorkspace(hold.release, branchDir);
+    }
+}
 /**
  * Rebase ONE branch workspace onto the base branch, keeping the branch's
  * version of every conflicting file.
@@ -435,7 +478,7 @@ export async function runRebaseCycle(ctx) {
  * returned as `{ kind: 'failed' }`, so one unreadable branch cannot halt the
  * rest of the cycle ([SYNC-M2]).
  */
-async function rebaseOneBranch(ctx, branchDir, branchPath) {
+async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised) {
     // Read only by the catch below. See the `rebased` rider on
     // BranchRebaseOutcome.
     let didRebase = false;
@@ -489,6 +532,9 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
         // record it and bail before the next one rather than replaying over
         // an editor's concurrent save.
         let contentLockCompromised = false;
+        // Either lock lost means another writer may be live against this tree;
+        // both get the same bail-before-the-next-destructive-step treatment.
+        const lockCompromised = () => contentLockCompromised || isProvisioningLockCompromised();
         try {
             releaseContentLock = await tryAcquireContentWriteLock(branchPath, (lockErr) => {
                 contentLockCompromised = true;
@@ -574,12 +620,37 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
             }
             // Skip dirty branches — the editor has changes that cannot be rebased.
             // Inside the lock, so no write can land between this check and the rebase
-            // below.
-            const dirtyCheck = await branchGit.status();
-            if (dirtyCheck.files.length > 0) {
+            // below. canopycms's own untracked state is not dirt.
+            let dirtyCheck = await branchGit.status();
+            if (await restoreRetiredSchemaCache(branchGit, dirtyCheck)) {
+                workerLog(`  ${branchDir}: restored the retired in-tree schema cache`);
+                dirtyCheck = await branchGit.status();
+            }
+            const editorDirt = dirtyCheck.files.filter((f) => !isCanopyInternalPath(f.path));
+            if (editorDirt.length > 0) {
                 workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
                 return { kind: 'skippedDirty' };
             }
+            // `git rebase` refuses to start over ANY modified tracked file, so
+            // tracked canopycms state blocks. The worker never untracks it here:
+            // replaying a branch commit that touched it writes historical bytes over
+            // the live file, and the abort that follows deletes it. So the index and
+            // the bytes stay untouched, and the wedge is recorded for an operator.
+            const trackedState = trackedCanopyStateChanges(dirtyCheck);
+            if (trackedState.length > 0) {
+                await branchGit.fetch('origin', ctx.baseBranch);
+                const baseTip = (await branchGit.revparse(['FETCH_HEAD'])).trim();
+                const { stillTracked } = await splitByUpstreamTracking(branchGit, trackedState, baseTip);
+                const reason = stillTracked.length > 0
+                    ? `git cannot rebase over modified canopycms state the repo tracks ` +
+                        `(${trackedState.join(', ')}). To fix, ${TRACKED_CANOPY_STATE_FIX}.`
+                    : `git cannot rebase over modified canopycms state this clone still tracks ` +
+                        `(${trackedState.join(', ')}), though the base branch no longer does; ` +
+                        `the clone needs manual repair`;
+                workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+                await recordRebaseFailure(ctx, branchPath, branchDir, reason);
+                return { kind: 'failed', error: reason };
+            }
             // The clone's own ref name: branchDir is the sanitized DIRECTORY name and
             // need not match it. A literal 'HEAD' means a detached clone (a crashed
             // rebase can leave one), where nothing below can safely name a ref, so
@@ -651,7 +722,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
             // the rebase makes unreadable.
             const preRebaseHead = (await branchGit.revparse(['HEAD'])).trim();
             const publishedSha = canPublish ? await readPublishedSha(ctx, branchRef) : null;
-            const { completed, conflictedFiles, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, () => contentLockCompromised);
+            const { completed, conflictedFiles, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, lockCompromised);
             // Outside the round loop's try/catch, so a throwing test hook can
             // never be misread as a rebase error.
             if (completed)
@@ -676,14 +747,14 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
             // history while a concurrent save is uncommitted working-tree state, and
             // that writer is already told to retry via ContentWriteLockBusyError. So
             // when the rebase completed, log the lost exclusivity loudly and finish.
-            if (contentLockCompromised && !completed) {
-                workerLogWarn(`  Skipping ${branchDir}: content-write lock was compromised mid-rebase (retrying next cycle)`);
+            if (lockCompromised() && !completed) {
+                workerLogWarn(`  Skipping ${branchDir}: a lock it held was compromised mid-rebase (retrying next cycle)`);
                 // No-op when no rebase is in progress; failure is expected there.
                 await branchGit.rebase(['--abort']).catch(() => { });
                 return { kind: 'skippedLocked' };
             }
-            if (contentLockCompromised) {
-                workerLogWarn(`  Content-write lock for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`);
+            if (lockCompromised()) {
+                workerLogWarn(`  A lock held for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`);
             }
             if (!completed) {
                 // failureReason is only set on the "unexpected error" break above;

package/dist/worker/task-runner.js

@@ -3,10 +3,10 @@ import { simpleGit } from 'simple-git';
 import { completeTask, dequeueTask, failTask, recoverOrphanedTasks, retryTask, } from '../task-queue/cms-task-queue.js';
 import { createOrUpdatePullRequest } from '../github-service.js';
 import { BranchMetadataFileManager, getBranchMetadataFileManager } from '../branch-metadata.js';
-import { sanitizeBranchName } from '../paths/branch-name.js';
+import { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX } from '../paths/branch-name.js';
 import { gitNetworkChildEnv } from '../git-manager.js';
 import { getErrorMessage, redactCredentials } from '../utils/error.js';
-import { isNonFastForwardRejection, isStaleLeaseRejection } from '../utils/git.js';
+import { isNonFastForwardRejection, isStaleLeaseRejection, workflowPushRefusalFile, } from '../utils/git.js';
 import { clearHistoryRewrittenMarker, readPublishedSha } from './history-rewrite.js';
 import { writeWorkerStatus } from '../task-queue/worker-status.js';
 import { workerLog, workerLogError } from './log.js';
@@ -90,6 +90,15 @@ function isRateLimitSignal403(err) {
     return false;
 }
 // Payload validation helpers — fail fast with clear errors instead of silent `as` casts
+/**
+ * Whether `branch` carries the reserved settings-branch prefix. Matching on the prefix
+ * alone, never on a configured name, is what keeps a content branch out: branch creation
+ * rejects the prefix, while a configured name the worker and API disagree on could be a
+ * content branch's.
+ */
+function isSettingsBranch(branch) {
+    return branch.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
+}
 function requireString(payload, key) {
     const val = payload[key];
     if (typeof val !== 'string')
@@ -282,6 +291,13 @@ export async function executeTask(ctx, task, signal) {
             if (sanitizeBranchName(branch) === ctx.sanitizedBaseBranch) {
                 throw new PermanentTaskError(`Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`);
             }
+            // The settings branch is an orphan with no history in common with the
+            // base, so GitHub 422s a PR for it: push it and stop.
+            if (isSettingsBranch(branch)) {
+                await ctx.pushBranchToGitHub(branch);
+                workerLog(`Pushed settings branch ${branch}; settings branches never get a PR`);
+                return { pushed: true };
+            }
             await ctx.pushBranchToGitHub(branch);
             const result = await createOrUpdatePullRequest({
                 octokit: ctx.octokit(),
@@ -291,9 +307,9 @@ export async function executeTask(ctx, task, signal) {
                 base,
                 title: optionalString(payload, 'title', `Submit ${branch}`),
                 body: optionalString(payload, 'body', ''),
-                // Content submits (api/github-sync.ts) set this; settings-branch
-                // syncs (services.ts) deliberately don't.
+                // Content submits (api/github-sync.ts) set both.
                 markReadyIfDraft: payload.markReadyIfDraft === true,
+                mergeSectionIntoBody: payload.mergeSectionIntoBody === true,
                 signal,
             });
             workerLog(result.created
@@ -415,6 +431,23 @@ async function updateBranchMetadataOnFailure(ctx, task, error) {
         workerLogError(`Failed to update failure metadata for ${branch}:`, err instanceof Error ? err.message : err);
     }
 }
+/**
+ * Fail fast when GitHub refused the push for adding workflow content it does not already hold: the
+ * worker's credential deliberately lacks the workflows permission, so the identical push can never
+ * succeed. Rebasing onto a base that changed a workflow does not trigger it; a workflow edit made
+ * outside the editor, auto-merged by the rebase with a base change to the same file, does.
+ */
+function throwIfWorkflowRefusal(branch, message) {
+    const file = workflowPushRefusalFile(message);
+    if (file === null)
+        return;
+    throw new PermanentTaskError(`Push refused for branch "${branch}": it would put a version of ${file} on GitHub that ` +
+        `GitHub does not already have, and this deployment's GitHub credential is deliberately not ` +
+        `allowed to change workflow files. Such a change usually comes from outside the editor, ` +
+        `such as a direct push to this branch. Nothing was pushed, and ` +
+        `retrying will not help until a developer with permission to change workflow files ` +
+        `resolves it on GitHub.`);
+}
 export async function pushBranchToGitHub(ctx, branch) {
     const git = simpleGit({
         baseDir: ctx.remoteGitPath,
@@ -473,6 +506,7 @@ export async function pushBranchToGitHub(ctx, branch) {
     }
     catch (err) {
         const message = getErrorMessage(err);
+        throwIfWorkflowRefusal(branch, message);
         // A refused lease means GitHub is not at the commit we rewrote, so the
         // marker is stale -- routine, not exceptional: tasks are re-run after a
         // crash (recoverOrphanedTasks) and the marker survives any failure to
@@ -494,6 +528,7 @@ export async function pushBranchToGitHub(ctx, branch) {
             }
             catch (retryErr) {
                 const retryMessage = getErrorMessage(retryErr);
+                throwIfWorkflowRefusal(branch, retryMessage);
                 if (isNonFastForwardRejection(retryMessage)) {
                     throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is neither the commit this ` +
                         `deployment last published nor an ancestor of what it is pushing, so the branch ` +

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.67",
+  "version": "0.0.68-int.94",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {