canopycms 0.0.68-int.111 → 0.0.68-int.113

package/dist/worker/task-runner.js

@@ -1,10 +1,12 @@
 import fs from 'node:fs/promises';
 import { completeTask, dequeueTask, failTask, recoverOrphanedTasks, releaseTask, retryTask, } from '../task-queue/cms-task-queue.js';
-import { createOrUpdatePullRequest, isNoCommitsBetweenError, isRefAlreadyGoneError, } from '../github-service.js';
+import { isNoCommitsBetweenError, isRefAlreadyGoneError } from '../github-service.js';
 import { BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, } from '../branch-metadata.js';
 import { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX } from '../paths/branch-name.js';
 import { getErrorMessage, redactCredentials } from '../utils/error.js';
-import { isNonFastForwardRejection, isStaleLeaseRejection, workflowPushRefusalFile, } from '../utils/git.js';
+import { isNonFastForwardRejection, workflowPushRefusalFile } from '../utils/git.js';
+import { GitHubPushError, describeMove } from './github-gateway.js';
+import { RefusedPushError, assertPlainBranchName } from './github-mirror.js';
 import { clearHistoryRewrittenMarker, readPublishedSha } from './history-rewrite.js';
 import { writeWorkerStatus } from '../task-queue/worker-status.js';
 import { workerLog, workerLogError, workerLogWarn } from './log.js';
@@ -184,9 +186,9 @@ export async function processTaskQueue(ctx) {
             const message = getErrorMessage(err);
             workerLogError(`Task ${task.id} (${task.action}) failed:`, message);
             // [REDACT] task.error is persisted (pending/failed task JSON) and served
-            // to the browser by the admin panel's Tasks tab -- a push failure's
-            // message can embed the bot token via buildGitHubUrl(). Console output
-            // above stays raw (journald/CloudWatch is trusted).
+            // to the browser by the admin panel's Tasks tab, so a credential in any
+            // failure's message must not reach it. Console output above stays raw
+            // (journald/CloudWatch is trusted).
             const persistedMessage = redactCredentials(message);
             // DEP-L1: only transient failures are worth retrying; a permanent one
             // would burn the retry budget on an identical doomed request.
@@ -206,16 +208,6 @@ export async function processTaskQueue(ctx) {
                     ? '  Permanently failed (non-retryable error)'
                     : `  Permanently failed after ${maxRetries} retries`);
             }
-            // The credential may have rotated, and the next retry resolves
-            // buildGitHubUrl() afresh to pick a new token up. Without this a push
-            // meeting a revoked token spends its whole retry budget (5s/10s/20s
-            // backoff) waiting on the git-sync loop's refresh up to 5 minutes away,
-            // and fails permanently while the working token sits in the secret store.
-            //
-            // Ungated, and AFTER the outcome is recorded rather than before: the task
-            // is safely in pending/ or failed/ while a network read runs, and that
-            // read is bounded and never throws. See CmsWorker.refreshGitHubCredential.
-            await ctx.refreshGitHubCredential();
         }
         processed++;
     }
@@ -235,7 +227,7 @@ export async function processTaskQueue(ctx) {
  * - an AbortSignal cancels Octokit HTTP calls and kills the push's git process
  *   (pushBranchToGitHub passes it to simple-git's `abort`);
  * - a Promise.race rejects when either fires, so work that cannot observe the
- *   signal (a hung `ctx.buildGitHubUrl()` in pushBranchToGitHub) still ends
+ *   signal (a hung credential resolution in the gateway's push) still ends
  *   the attempt and the worker moves on instead of stalling forever.
  *
  * A raced-out credential resolution is not cancelled. On the App path the mint
@@ -278,30 +270,23 @@ export async function executeTask(ctx, task, signal) {
         case 'push-and-create-pr': {
             const branch = requireString(payload, 'branch');
             await ctx.pushBranchToGitHub(branch, signal);
-            const pr = await ctx.octokit().pulls.create({
-                owner: ctx.githubOwner,
-                repo: ctx.githubRepo,
+            const pr = await ctx.github().createPullRequest({
                 head: branch,
                 base: optionalString(payload, 'baseBranch', ctx.baseBranch),
                 title: optionalString(payload, 'title', `Submit ${branch}`),
                 body: optionalString(payload, 'body', ''),
-                request: { signal },
-            });
-            workerLog(`Created PR #${pr.data.number} for ${branch}`);
-            return { prUrl: pr.data.html_url, prNumber: pr.data.number };
+            }, signal);
+            workerLog(`Created PR #${pr.number} for ${branch}`);
+            return { prUrl: pr.url, prNumber: pr.number };
         }
         case 'push-and-update-pr': {
             const branch = requireString(payload, 'branch');
             const prNumber = requireNumber(payload, 'pullRequestNumber');
             await ctx.pushBranchToGitHub(branch, signal);
-            await ctx.octokit().pulls.update({
-                owner: ctx.githubOwner,
-                repo: ctx.githubRepo,
-                pull_number: prNumber,
+            await ctx.github().updatePullRequest(prNumber, {
                 title: optionalString(payload, 'title', `Submit ${branch}`),
                 body: optionalString(payload, 'body', ''),
-                request: { signal },
-            });
+            }, signal);
             workerLog(`Updated PR #${prNumber} for ${branch}`);
             return { prNumber };
         }
@@ -326,16 +311,13 @@ export async function executeTask(ctx, task, signal) {
             // base, so GitHub 422s a PR for it: push it and stop.
             if (isSettingsBranch(branch)) {
                 await ctx.pushBranchToGitHub(branch, signal);
-                workerLog(`Pushed settings branch ${branch}; settings branches never get a PR`);
+                workerLog(`No PR for ${branch}: settings branches never get one`);
                 return { pushed: true };
             }
             await ctx.pushBranchToGitHub(branch, signal);
             let result;
             try {
-                result = await createOrUpdatePullRequest({
-                    octokit: ctx.octokit(),
-                    owner: ctx.githubOwner,
-                    repo: ctx.githubRepo,
+                result = await ctx.github().createOrUpdatePullRequest({
                     head: branch,
                     base,
                     title: optionalString(payload, 'title', `Submit ${branch}`),
@@ -359,29 +341,13 @@ export async function executeTask(ctx, task, signal) {
         }
         case 'convert-to-draft': {
             const draftPrNumber = requireNumber(payload, 'pullRequestNumber');
-            // GitHub REST API doesn't support converting to draft directly.
-            // Use the GraphQL API via Octokit.
-            const { data: pr } = await ctx.octokit().pulls.get({
-                owner: ctx.githubOwner,
-                repo: ctx.githubRepo,
-                pull_number: draftPrNumber,
-                request: { signal },
-            });
-            await ctx
-                .octokit()
-                .graphql(`mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`, { id: pr.node_id, request: { signal } });
+            await ctx.github().convertPullRequestToDraft(draftPrNumber, signal);
             workerLog(`Converted PR #${draftPrNumber} to draft`);
             return { prNumber: draftPrNumber, draft: true };
         }
         case 'close-pr': {
             const closePrNumber = requireNumber(payload, 'pullRequestNumber');
-            await ctx.octokit().pulls.update({
-                owner: ctx.githubOwner,
-                repo: ctx.githubRepo,
-                pull_number: closePrNumber,
-                state: 'closed',
-                request: { signal },
-            });
+            await ctx.github().updatePullRequest(closePrNumber, { state: 'closed' }, signal);
             return { closed: true };
         }
         case 'delete-remote-branch': {
@@ -421,12 +387,7 @@ export async function executeTask(ctx, task, signal) {
                 return { deleted: false, skipped: 'name-reused' };
             }
             try {
-                await ctx.octokit().git.deleteRef({
-                    owner: ctx.githubOwner,
-                    repo: ctx.githubRepo,
-                    ref: `heads/${branch}`,
-                    request: { signal },
-                });
+                await ctx.github().deleteBranch(branch, signal);
             }
             catch (err) {
                 // Already gone is the outcome this task wants; failing it would only park it in failed/.
@@ -565,15 +526,16 @@ export async function pushBranchToGitHub(ctx, branch, signal) {
     // commit remote.git held when it was read, so what the marker logic at the end compares is
     // what GitHub received.
     await assertSharedRepoConfig(ctx.remoteGitPath, 'bare');
-    // Resolve the tokenized URL ONCE, here: all three pushes below use this
-    // const and none calls ctx.buildGitHubUrl() again. A correctness
-    // requirement, not tidiness, since resolution is async: the retry push sits
-    // INSIDE the stale-lease catch, and a resolution that threw there would
-    // replace the push error being classified, so neither isStaleLeaseRejection
-    // nor isNonFastForwardRejection would run and a genuinely diverged branch
-    // would be retried instead of raising PermanentTaskError. It also means every
-    // push provably carries the same credential.
-    const githubUrl = await ctx.buildGitHubUrl();
+    // Before `branch` reaches any git: `readPublishedSha` below would read a `<rev>:<path>` form as a
+    // tree lookup in remote.git. A refusal is permanent; a failure to run git is retried.
+    try {
+        await assertPlainBranchName(branch);
+    }
+    catch (err) {
+        if (err instanceof RefusedPushError)
+            throw new PermanentTaskError(err.message);
+        throw err;
+    }
     // [SYNC-H1] If the rebase loop rewrote this branch's already-published
     // history, GitHub still holds the commit it replaced, so an ordinary
     // push is non-fast-forward forever. Push under a lease keyed to exactly
@@ -586,71 +548,49 @@ export async function pushBranchToGitHub(ctx, branch, signal) {
     if (outgoingSha === null) {
         throw new Error(`Branch "${branch}" is not in remote.git, so there is nothing to push`);
     }
-    // The whole exchange, retry included, is one mirror session; the mirror kills its git when
-    // `signal` aborts (the task timed out, or the worker's drain deadline hit). GitHub moves the ref
-    // only after receiving the whole pack: a push killed before that changes nothing, and one
-    // killed after it is found already done by the re-run.
-    const outcome = await ctx.githubMirror().exclusive(async (mirror) => {
-        const push = (lease) => mirror.pushToGitHub(githubUrl, branch, outgoingSha, { lease, signal });
-        try {
-            await push(marker);
-            return 'pushed';
-        }
-        catch (err) {
-            const message = getErrorMessage(err);
-            throwIfWorkflowRefusal(branch, message);
-            // A refused lease means GitHub is not at the commit we rewrote, so the
-            // marker is stale -- routine, not exceptional: tasks are re-run after a
-            // crash (recoverOrphanedTasks) and the marker survives any failure to
-            // clear it. The two benign shapes that reach here (GitHub already holds
-            // the rewritten history, or the branch moved past it) are ordinary
-            // fast-forwards a lease has no business blocking.
-            //
-            // So retry PLAIN and let git adjudicate: a non-forced push succeeds if and
-            // only if it fast-forwards, so it can never destroy anything, with no
-            // ancestry check to get wrong and no extra round trip to read GitHub's
-            // tip. Only if THAT is also rejected has the branch genuinely diverged.
-            //
-            // (git evaluates the lease only when it actually has an update to apply,
-            // so an up-to-date ref with a stale lease prints "Everything up-to-date",
-            // exits 0, and is absorbed above without reaching here.)
-            if (marker && isStaleLeaseRejection(message)) {
-                try {
-                    await push();
-                }
-                catch (retryErr) {
-                    const retryMessage = getErrorMessage(retryErr);
-                    throwIfWorkflowRefusal(branch, retryMessage);
-                    if (isNonFastForwardRejection(retryMessage)) {
-                        throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is neither the commit this ` +
-                            `deployment last published nor an ancestor of what it is pushing, so the branch ` +
-                            `has genuinely diverged and nothing was overwritten. Something else moved it on ` +
-                            `GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`);
-                    }
-                    throw retryErr;
-                }
-                return 'pushed-past-stale-lease';
-            }
-            // An ordinary non-fast-forward rejection: GitHub has commits this
-            // deployment never published, so retrying the identical push can never
-            // succeed (DEP-L1's git-failure-is-transient carve-out does NOT apply) and
-            // it fails fast instead of burning the retry budget. Deliberately does NOT
-            // advise renaming the branch: one reaching this point usually has an open
-            // PR, which renaming would orphan.
-            if (isNonFastForwardRejection(message)) {
-                throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is not what this deployment last ` +
-                    `published, so the branch has diverged and needs reconciling. Something else moved it ` +
-                    `on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`);
-            }
+    let outcome;
+    try {
+        outcome = await ctx
+            .github()
+            .push({ branch, sha: outgoingSha, lease: marker, protectedBranches: [ctx.baseBranch] }, signal);
+    }
+    catch (err) {
+        // A retry can never make the branch not protected.
+        if (err instanceof RefusedPushError)
+            throw new PermanentTaskError(err.message);
+        if (!(err instanceof GitHubPushError))
             throw err;
+        throwIfWorkflowRefusal(branch, err.message);
+        // A refused lease was already retried plain, and that retry rejected too: only a
+        // non-fast-forward then means the branch has genuinely diverged.
+        if (err.kind === 'rejected-after-stale-lease') {
+            if (isNonFastForwardRejection(err.message)) {
+                throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is neither the commit this ` +
+                    `deployment last published nor an ancestor of what it is pushing, so the branch ` +
+                    `has genuinely diverged and nothing was overwritten. Something else moved it on ` +
+                    `GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`);
+            }
+            throw err.cause;
         }
-    });
-    if (outcome === 'pushed-past-stale-lease') {
+        // An ordinary non-fast-forward rejection: GitHub has commits this
+        // deployment never published, so retrying the identical push can never
+        // succeed (DEP-L1's git-failure-is-transient carve-out does NOT apply) and
+        // it fails fast instead of burning the retry budget. Deliberately does NOT
+        // advise renaming the branch: one reaching this point usually has an open
+        // PR, which renaming would orphan.
+        if (isNonFastForwardRejection(err.message)) {
+            throw new PermanentTaskError(`Push rejected for branch "${branch}": GitHub's tip is not what this deployment last ` +
+                `published, so the branch has diverged and needs reconciling. Something else moved it ` +
+                `on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`);
+        }
+        throw err.cause;
+    }
+    if (outcome.pastStaleLease) {
         // The lease was refused, so GitHub is provably not at the marker: it
         // has moved past the rewritten commit and the marker is spent.
         await clearHistoryRewrittenMarker(ctx, branchPath, branch);
         await recordPushedToGitHub(ctx, branchPath, branch);
-        workerLog(`Pushed ${branch} to GitHub (GitHub had already moved past the rewritten commit)`);
+        logPushOutcome(ctx, branch, outcome, 'GitHub had already moved past the rewritten commit');
         return;
     }
     // Clear the marker only once GitHub is confirmed to hold something other
@@ -661,7 +601,17 @@ export async function pushBranchToGitHub(ctx, branch, signal) {
         await clearHistoryRewrittenMarker(ctx, branchPath, branch);
     }
     await recordPushedToGitHub(ctx, branchPath, branch);
-    workerLog(`Pushed ${branch} to GitHub`);
+    logPushOutcome(ctx, branch, outcome);
+}
+/** An unmoved ref is routine (a task re-run after a crash), so it is logged at debug level. */
+function logPushOutcome(ctx, branch, outcome, note) {
+    const suffix = note === undefined ? '' : `; ${note}`;
+    if (outcome.moved) {
+        workerLog(`Pushed ${branch} to GitHub (${describeMove(outcome)}${suffix})`);
+    }
+    else {
+        ctx.log.debug(`${branch} already up to date on GitHub${suffix}`);
+    }
 }
 /**
  * Stamp `pushedToGitHubAt`, branch delete's proof that the GitHub branch is this one. Recorded

package/dist/worker/worker-context.d.ts

@@ -1,8 +1,7 @@
-import type { Octokit } from '@octokit/rest';
 import type { SanitizedBranchName } from '../paths/types.js';
 import type { Task, TaskQueueLogger } from '../task-queue/cms-task-queue.js';
 import type { WorkerStatusReport } from '../types.js';
-import type { GitHubMirror } from './github-mirror.js';
+import type { GitHubGateway } from './github-gateway.js';
 /**
  * The slice of {@link import('./cms-worker.js').CmsWorker} that its extracted
  * clusters (task-runner.ts, git-sync.ts, rebase.ts, history-rewrite.ts) may
@@ -14,19 +13,16 @@ import type { GitHubMirror } from './github-mirror.js';
  * back onto the live instance and never snapshotted, and `CmsWorker.ctx()`
  * builds a fresh context per call. That is load-bearing, not stylistic. The
  * `cms-worker*.test.ts` files drive the class by reaching through the instance:
- * they REPLACE `buildGitHubUrl` (aiming pushes at a local fixture repo rather
- * than github.com), `executeTask` and `pushBranchToGitHub`, ASSIGN a mock over
- * the `octokit` field, set `running` directly, and SUBCLASS to override the two
- * rebase test hooks. A context that captured any of those at construction would
- * hand the extracted code the pre-test value — which for `buildGitHubUrl` means
- * a test's push going to github.com for real. Functions (`ctx.octokit()`) make
- * the late binding visible at every call site, which a getter would hide.
+ * they INSTALL a GitHub gateway aimed at a local fixture repository (and an
+ * Octokit stub) with `useLocalGitHubGateway` (test-utils/worker-gateway.ts),
+ * REPLACE `executeTask` and `pushBranchToGitHub`, set `running` directly, and
+ * SUBCLASS to override the two rebase test hooks. A context that captured any
+ * of those at construction would hand the extracted code the pre-test value --
+ * which for the gateway means a test's push going to github.com for real.
+ * Functions (`ctx.github()`) make the late binding visible at every call site,
+ * which a getter would hide.
  */
 export interface WorkerContext {
-    /** GitHub owner, e.g. 'safeinsights'. */
-    readonly githubOwner: string;
-    /** GitHub repo name. */
-    readonly githubRepo: string;
     /**
      * The base branch's RAW git ref name. Git refs (fetch/rev-list/merge against
      * it) must use this; filesystem paths must use `sanitizedBaseBranch`.
@@ -60,35 +56,11 @@ export interface WorkerContext {
     readonly maxRetries: number;
     /** Task-queue debug logger. */
     readonly log: TaskQueueLogger;
-    /** The worker's Octokit client, read at call time (tests replace it). */
-    octokit(): Octokit;
     /**
-     * The tokenized GitHub clone URL, resolved at call time (tests replace this
-     * method to point at a local fixture repo). Async because under GitHub App
-     * auth the credential is minted on demand and lasts about an hour (see
-     * worker/github-auth.ts); the token path resolves immediately.
-     *
-     * A caller that needs the URL more than once resolves it ONCE into a local --
-     * see pushBranchToGitHub, where a second resolution inside the stale-lease
-     * catch would replace the very error being classified. Anything derived from
-     * it can embed the bot token, so a message reaching worker-status.json,
-     * branch.json or a task file goes through `redactCredentials` first.
+     * The worker's GitHub gateway (worker/github-gateway.ts), read at call time:
+     * every use of the GitHub credential and of Octokit goes through it.
      */
-    buildGitHubUrl(): Promise<string>;
-    /**
-     * The worker's private GitHub mirror (worker/github-mirror.ts): every git command given a
-     * `buildGitHubUrl()` URL runs inside one of its sessions, never in `remote.git` or a clone.
-     */
-    githubMirror(): GitHubMirror;
-    /**
-     * Re-read the GitHub credential because an operation that used it just
-     * failed, read at call time. Best-effort and NEVER throws: a failed read, or
-     * one that does not settle within `taskTimeoutMs`, is logged and swallowed,
-     * because every caller is already reporting the failure that matters. The
-     * next `buildGitHubUrl()`/`octokit()` sees any rotated value. See
-     * `CmsWorker.refreshGitHubCredential`.
-     */
-    refreshGitHubCredential(): Promise<void>;
+    github(): GitHubGateway;
     /**
      * Workspace directory for a branch named by its GIT REF name — the form task
      * payloads carry. Sanitizes; `feature/x` lives in `feature-x`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.68-int.111",
+  "version": "0.0.68-int.113",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {