canopycms 0.0.68-int.111 → 0.0.68-int.113

package/dist/worker/cms-worker.d.ts

@@ -118,11 +118,10 @@ export declare function recordWorkerStartupFailure(options: {
 }): Promise<void>;
 export declare class CmsWorker {
     private config;
-    private octokit;
+    private gateway?;
     private taskDir;
     private remoteGitPath;
     private stateDirectory;
-    private githubMirror;
     private contentBranchesPath;
     private resolvedBaseBranch?;
     private settingsBranchResolved?;
@@ -142,7 +141,6 @@ export declare class CmsWorker {
     private contentRoot;
     private log;
     private statusReport?;
-    private githubAuth?;
     private lockLostMessage?;
     private statusWriterAtLock?;
     private settleSelfStopped;
@@ -192,8 +190,8 @@ export declare class CmsWorker {
      * Built FRESH on every call, with instance-backed members as functions rather
      * than copied values. See WorkerContext's INVARIANT: a context that captured
      * any of them at construction time would hand the extracted code the pre-test
-     * value, which for `buildGitHubUrl` means a test's push going to github.com
-     * for real instead of its local fixture repo.
+     * value, which for the GitHub gateway means a test's push going to
+     * github.com for real instead of its local fixture repo.
      */
     private ctx;
     /**
@@ -278,9 +276,19 @@ export declare class CmsWorker {
     /**
      * An unconfigured base branch is the one remote.git's HEAD names, which is what the Lambda
      * reads too (GitManager.detectBaseBranch); before remote.git exists, it is GitHub's default
-     * branch, which the clone then records as that HEAD. Never assumes 'main'.
+     * branch, which the clone then records as that HEAD. So it is too when remote.git has no branch
+     * outside the settings namespace: no base branch is there for HEAD to name, and ensureRemoteGit
+     * replaces it from GitHub unless something in it is at stake. Never assumes 'main'.
      */
     private resolveBaseBranch;
+    /**
+     * Check remote.git's config at boot. A refusal is never a case for replacement: it reports that
+     * something wrote there, and listing the refs a replacement would lose means running git under
+     * that config. The message says so, so System health does not read it as a routine failure.
+     */
+    private assertRemoteGitConfig;
+    /** Whether the bare repo at `gitDir` has a branch that is not a settings branch. */
+    private hasContentBranch;
     /**
      * Point remote.git's HEAD at the base branch this worker uses, so a Lambda left to detect it
      * (GitManager.detectBaseBranch) reads the same name. Only the worker writes it, at boot under
@@ -337,91 +345,41 @@ export declare class CmsWorker {
      * pushed) succeeds and leaves a refs-less repo that `fs.stat` cannot tell from a healthy one, so
      * left unchecked it silently poisons remote.git and the stat short-circuit means it never heals.
      * The base branch is therefore verified right after seeding AND on the already-exists fast
-     * path, since a previous run can have left a poisoned remote.git behind.
+     * path, where a poisoned remote.git is replaced (`replacePoisonedRemoteGit`).
      */
     private ensureRemoteGit;
     /**
-     * Refuse a state directory on the shared filesystem: the mirror there would be as writable by
-     * the Lambda as remote.git is.
+     * Replace an existing remote.git that has no base branch with a fresh seed from GitHub, but only
+     * when every ref in it names a commit a GitHub branch contains, so replacing it loses no commit;
+     * a branch name GitHub lacks, such as a merged branch deleted there, goes. Otherwise refuse,
+     * naming the refs at stake: unpushed work such as a settings branch.
+     *
+     * The refs are compared in the same mirror session that fetches GitHub and seeds the
+     * replacement, and listed again just before the swap, since the Lambda can push into remote.git
+     * while the seed runs. The swap is two renames, so the name remote.git resolves to the old repo,
+     * the new one, or for an instant nothing, never a half-built or half-deleted one.
+     */
+    private replacePoisonedRemoteGit;
+    /**
+     * Seed a new bare repo from GitHub at `<remote.git>.cloning`, verified and configured, and
+     * return its path for the caller to rename into place. `check` runs in the mirror session right
+     * after the GitHub fetch, and its throw stops the seed. Throws with the staging directory gone.
      */
-    private ensureStateDirectoryIsPrivate;
+    private seedRemoteGitStaging;
     processTaskQueue(): Promise<void>;
     private executeTask;
     private updateBranchMetadata;
     private pushBranchToGitHub;
     /**
-     * Resolve which GitHub credential this worker uses, once, and build the
-     * Octokit client from it.
-     *
-     * DEFERRED out of the constructor deliberately, exactly as
-     * `ensureSettingsBranch()` is and for the reason that method records:
-     * `resolveWorkerGitHubAuth` throws for a half-configured credential (both
-     * set, neither set, an unusable mint timeout or refresh interval), and a
-     * throw during `new CmsWorker(...)` lands BEFORE start()'s catch, which
-     * records `lastFatalError` for every entrypoint.
-     *
-     * Idempotent, and it does NOT replace an `octokit` a test has already
-     * assigned onto the instance — see the field's comment.
-     */
-    private ensureGitHubAuth;
-    /**
-     * The Octokit client, built on first use. Every read goes through here rather
-     * than touching the field, which the constructor does not populate: a method
-     * reached without start() would otherwise see `undefined`.
-     * `rebaseActiveBranches()` is exactly that case — apps/test-app's e2e route
-     * calls it directly, and its `pollMergeState` dispatch reads `ctx.octokit()`.
+     * The worker's GitHub gateway, created on first use: inside start()'s try, or wherever a test
+     * entry point first reaches it. Creating it resolves the credential, which throws for a
+     * half-configured one (both set, neither set, an unusable mint timeout or refresh interval) --
+     * never in the constructor, for the reason `ensureSettingsBranch()` gives. Keeps a gateway a
+     * test installed.
      */
-    private octokitClient;
-    /**
-     * The single seam through which every git-over-HTTPS credential reaches a git
-     * command. The only other consumer is Octokit, built from the same resolution
-     * by `ensureGitHubAuth()` above.
-     *
-     * Async because under GitHub App auth `resolveGitToken` mints an installation
-     * token lasting about an hour. NOTHING may cache what this returns — a URL
-     * built from an installation token goes stale with it — and resolving per use
-     * is cheap, since `@octokit/auth-app` answers from its own cache until the
-     * token is near expiry.
-     *
-     * A mint failure propagates AS THROWN, carrying the `.status` that
-     * `isPermanentTaskFailure` classifies on — see github-auth.ts.
-     *
-     * Do NOT add a parallel token accessor alongside it. Every instance-backed
-     * WorkerContext member stays a function precisely so tests can replace it
-     * through the instance (worker-context.ts's INVARIANT); a second credential
-     * path would be one nothing stubs.
-     */
-    private buildGitHubUrl;
-    /**
-     * Prove the GitHub App credential works before anything depends on it.
-     *
-     * Without this the first failure comes out of `ensureRemoteGit`'s bare clone
-     * below, whose catch blames the repository ("may be empty, or the base branch
-     * may not exist") and sends an operator holding a bad private key looking for
-     * a problem that does not exist. Called from start()'s try, so the failure is
-     * also recorded as `lastFatalError` and reaches the admin panel. No-op on the
-     * token path: a PAT is a literal, so the first real request checks everything
-     * this could.
-     *
-     * FATAL UNLESS THE FAILURE POSITIVELY LOOKS TRANSIENT. Both halves are
-     * load-bearing. Not always fatal, because the two credential paths must
-     * degrade alike: on the token path a GitHub 502 during boot is absorbed (a
-     * warm `remote.git` short-circuits `ensureRemoteGit`, `Promise.allSettled`
-     * swallows the initial `syncGit`) so the worker starts and its loops retry,
-     * while rethrowing every error class would make the App path exit and systemd
-     * crash-loop it until GitHub recovered — each iteration telling the operator
-     * to check their private key.
-     *
-     * But fail CLOSED, via `isTransientAuthFailure` rather than the inverse of
-     * `isPermanentTaskFailure`: that classifier defaults a status-less error to
-     * transient, which is right on the task path (bounded by `maxRetries`) and
-     * wrong here (bounded by nothing). A key that never reaches GitHub at all —
-     * the wrong type, or too mangled to sign with — fails locally and
-     * status-lessly, so defaulting to transient would boot a worker with a dead
-     * credential, record no `lastFatalError`, and show healthy in the admin panel
-     * while every task and every sync failed.
-     */
-    private preflightGitHubAppAuth;
+    private github;
+    /** What the in-process gateway is built from; test-utils/worker-gateway.ts builds from it too. */
+    private localGitHubGatewayOptions;
     /**
      * The workspace directory for a branch named by its GIT REF name -- the form
      * task payloads carry (`context.branch.name`), not the directory form.
@@ -460,49 +418,6 @@ export declare class CmsWorker {
     protected afterRebaseCompletedForTesting(): Promise<void>;
     private rebaseActiveBranches;
     syncGit(): Promise<void>;
-    /**
-     * `syncGit`, plus "the credential may have rotated" on the way out.
-     *
-     * One of `refreshGitHubCredential`'s two call sites, and the one that works
-     * when nobody is publishing: it fetches from GitHub every `gitSyncInterval`
-     * whether or not anyone is editing, so a credential that has stopped working
-     * surfaces here even with no push queued for days.
-     *
-     * The SYNC failure is what propagates to `scheduleLoop`'s catch;
-     * `refreshGitHubCredential` never throws, so nothing it does can replace it.
-     */
-    private syncGitWithCredentialRefresh;
-    /**
-     * Re-read the GitHub credential, because an operation using it just failed.
-     *
-     * **Two call sites, each covering what the other cannot.** The git-sync loop
-     * (`syncGitWithCredentialRefresh`) notices a dead credential when nobody is
-     * publishing. `processTaskQueue`'s per-task catch is what saves a publish: a
-     * push task spends its retry budget on a 5s/10s/20s backoff, well inside one
-     * 5-minute sync interval, so with the sync loop as the only trigger a publish
-     * meeting a rotated token fails permanently while the working one is already
-     * in the secret store. Every consumer reaches the credential through
-     * `ensureGitHubAuth()`, which reads it per use, so a refresh from either site
-     * repairs all of them for their NEXT use — but not an attempt already failed.
-     *
-     * NOT gated on the error looking auth-shaped, at either site: a `git
-     * fetch`/`push` rejected for a dead token throws a plain simple-git error
-     * (exit 128, no HTTP `.status`) that `isPermanentTaskFailure` reads as
-     * transient, so a gate keyed on it would never fire. Two floors bound the
-     * cost instead — core's `refreshGitHubTokenMinIntervalMs` (default 60s,
-     * enforced by `refreshCredential` in github-auth.ts) and whatever floor the
-     * provider keeps (the AWS one reads at most once per five minutes) — and both
-     * call sites share both, so a read issued by one throttles the other. On the
-     * GitHub App path the refresh is a no-op.
-     *
-     * **Never throws**: both callers are already reporting the failure that must
-     * reach the log. **Bounded by `taskTimeoutMs`**, because the task loop awaits
-     * it and a read that never settled would stop every publish queued behind it
-     * (an adopter's provider may have no bound at all; the AWS one can take 87s
-     * for one `getSecret`). A losing read is not cancelled and may land later, but
-     * `refreshCredential` discards a result older than one already applied.
-     */
-    private refreshGitHubCredential;
     private pushSettingsBranches;
     private refreshBaseBranchWorkspace;
     private cleanupTrashedBranchDirs;