cclaw-cli 6.8.0 → 6.9.0

package/dist/internal/detect-supply-chain-changes.js

@@ -0,0 +1,138 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+const WORKFLOW_PATH = /(^|\/)\.github\/workflows\//u;
+const CURSOR_CONFIG_PATH = /(^|\/)\.cursor\//u;
+const PACKAGE_JSON_PATH = /(^|\/)package\.json$/u;
+const SUPPLY_CHAIN_DEP_KEYS = [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies"
+];
+async function resolveDiffBase(projectRoot) {
+    try {
+        const { stdout } = await execFileAsync("git", ["rev-parse", "HEAD~1"], {
+            cwd: projectRoot
+        });
+        const base = stdout.trim();
+        return base.length > 0 ? base : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readFileAtRev(projectRoot, rev, filePath) {
+    try {
+        const { stdout } = await execFileAsync("git", ["show", `${rev}:${filePath}`], {
+            cwd: projectRoot,
+            maxBuffer: 32 * 1024 * 1024
+        });
+        return stdout;
+    }
+    catch {
+        return null;
+    }
+}
+function dependencyMapsDiffer(before, after) {
+    const beforeKeys = before ? Object.keys(before).sort() : [];
+    const afterKeys = after ? Object.keys(after).sort() : [];
+    if (beforeKeys.length !== afterKeys.length)
+        return true;
+    for (let i = 0; i < beforeKeys.length; i += 1) {
+        if (beforeKeys[i] !== afterKeys[i])
+            return true;
+        const k = beforeKeys[i];
+        if (before[k] !== after[k]) {
+            return true;
+        }
+    }
+    return false;
+}
+async function packageJsonHasDependencyDiff(projectRoot, base, filePath) {
+    const beforeRaw = await readFileAtRev(projectRoot, base, filePath);
+    const afterRaw = await readFileAtRev(projectRoot, "HEAD", filePath);
+    // If either side is missing or unparseable, treat as changed (be conservative).
+    if (beforeRaw === null || afterRaw === null)
+        return true;
+    let beforeJson;
+    let afterJson;
+    try {
+        beforeJson = JSON.parse(beforeRaw);
+    }
+    catch {
+        return true;
+    }
+    try {
+        afterJson = JSON.parse(afterRaw);
+    }
+    catch {
+        return true;
+    }
+    const beforeObj = beforeJson !== null && typeof beforeJson === "object"
+        ? beforeJson
+        : {};
+    const afterObj = afterJson !== null && typeof afterJson === "object"
+        ? afterJson
+        : {};
+    for (const key of SUPPLY_CHAIN_DEP_KEYS) {
+        const beforeMap = (beforeObj[key] !== null && typeof beforeObj[key] === "object")
+            ? beforeObj[key]
+            : undefined;
+        const afterMap = (afterObj[key] !== null && typeof afterObj[key] === "object")
+            ? afterObj[key]
+            : undefined;
+        if (dependencyMapsDiffer(beforeMap, afterMap)) {
+            return true;
+        }
+    }
+    return false;
+}
+export async function detectSupplyChainChanges(projectRoot) {
+    const base = await resolveDiffBase(projectRoot);
+    if (!base) {
+        return { triggered: false, changedFiles: [], reasons: [] };
+    }
+    let changed = [];
+    try {
+        const range = `${base}..HEAD`;
+        const { stdout } = await execFileAsync("git", ["diff", "--name-only", range], {
+            cwd: projectRoot
+        });
+        changed = stdout
+            .split(/\r?\n/gu)
+            .map((line) => line.trim())
+            .filter((line) => line.length > 0);
+    }
+    catch {
+        return { triggered: false, changedFiles: [], reasons: [] };
+    }
+    const matchedFiles = [];
+    const reasons = [];
+    for (const filePath of changed) {
+        if (WORKFLOW_PATH.test(filePath)) {
+            matchedFiles.push(filePath);
+            reasons.push(`.github/workflows changed: ${filePath}`);
+            continue;
+        }
+        if (CURSOR_CONFIG_PATH.test(filePath)) {
+            matchedFiles.push(filePath);
+            reasons.push(`.cursor config changed: ${filePath}`);
+            continue;
+        }
+        if (PACKAGE_JSON_PATH.test(filePath)) {
+            // Only flag when supply-chain dependency keys differ.
+            const depDiffers = await packageJsonHasDependencyDiff(projectRoot, base, filePath);
+            if (depDiffers) {
+                matchedFiles.push(filePath);
+                reasons.push(`${filePath} dependencies/devDependencies/peerDependencies/optionalDependencies changed`);
+            }
+            continue;
+        }
+    }
+    return {
+        triggered: matchedFiles.length > 0,
+        changedFiles: matchedFiles,
+        reasons
+    };
+}

package/dist/internal/flow-state-repair.d.ts

@@ -7,6 +7,13 @@ export interface FlowStateRepairArgs {
     reason: string;
     json: boolean;
     quiet: boolean;
+    /**
+     * v6.9.0 — when true, normalize `state/early-loop.json` to the canonical
+     * shape derived from `early-loop-log.jsonl`. Lets operators recover from
+     * legacy hand-written `early-loop.json` files that drifted from the
+     * source-of-truth log.
+     */
+    earlyLoop: boolean;
 }
 export declare function parseFlowStateRepairArgs(tokens: string[]): FlowStateRepairArgs;
 export declare function runFlowStateRepair(projectRoot: string, args: FlowStateRepairArgs, io: InternalIo): Promise<number>;

package/dist/internal/flow-state-repair.js

@@ -1,10 +1,15 @@
+import fs from "node:fs/promises";
 import path from "node:path";
 import { RUNTIME_ROOT } from "../constants.js";
+import { clampEarlyLoopStatusForWrite, computeEarlyLoopStatus, isEarlyLoopStage } from "../early-loop.js";
+import { writeFileSafe } from "../fs-utils.js";
 import { repairFlowStateGuard } from "../run-persistence.js";
+import { readFlowState } from "../runs.js";
 export function parseFlowStateRepairArgs(tokens) {
     let reason;
     let json = false;
     let quiet = false;
+    let earlyLoop = false;
     for (let i = 0; i < tokens.length; i += 1) {
         const token = tokens[i];
         const nextToken = tokens[i + 1];
@@ -16,6 +21,10 @@ export function parseFlowStateRepairArgs(tokens) {
             quiet = true;
             continue;
         }
+        if (token === "--early-loop") {
+            earlyLoop = true;
+            continue;
+        }
         if (token === "--reason") {
             if (!nextToken || nextToken.startsWith("--")) {
                 throw new Error("--reason requires a short slug value.");
@@ -33,33 +42,63 @@ export function parseFlowStateRepairArgs(tokens) {
     if (!reason || reason.length === 0) {
         throw new Error("internal flow-state-repair requires --reason=<slug> (e.g. --reason=manual_edit_recovery).");
     }
-    return { reason, json, quiet };
+    return { reason, json, quiet, earlyLoop };
+}
+async function repairEarlyLoopFile(projectRoot, io) {
+    const flow = await readFlowState(projectRoot).catch(() => null);
+    if (!flow) {
+        return { performed: false, skipped: "flow-state-unreadable" };
+    }
+    const stage = flow.currentStage;
+    if (!isEarlyLoopStage(stage)) {
+        return { performed: false, skipped: `current-stage-${stage}-not-early-loop` };
+    }
+    const runId = flow.activeRunId.trim();
+    if (runId.length === 0) {
+        io.stderr.write("cclaw internal flow-state-repair --early-loop: active run has no runId; cannot derive canonical early-loop.json.\n");
+        return { performed: false, skipped: "missing-active-runId" };
+    }
+    const stateDir = path.join(projectRoot, RUNTIME_ROOT, "state");
+    const logPath = path.join(stateDir, "early-loop-log.jsonl");
+    const status = await computeEarlyLoopStatus(stage, runId, logPath);
+    const persisted = clampEarlyLoopStatusForWrite(status);
+    const finalStatus = persisted.status;
+    const target = path.join(stateDir, "early-loop.json");
+    await writeFileSafe(target, `${JSON.stringify(finalStatus, null, 2)}\n`);
+    return {
+        performed: true,
+        stage,
+        runId,
+        iteration: finalStatus.iteration,
+        openConcernCount: finalStatus.openConcerns.length
+    };
 }
 export async function runFlowStateRepair(projectRoot, args, io) {
     const result = await repairFlowStateGuard(projectRoot, args.reason);
     const logRel = path.relative(projectRoot, result.repairLogPath).replace(/\\/gu, "/");
     const guardRel = path.relative(projectRoot, result.guardPath).replace(/\\/gu, "/");
+    let earlyLoopOutcome = null;
+    if (args.earlyLoop) {
+        earlyLoopOutcome = await repairEarlyLoopFile(projectRoot, io);
+    }
+    void fs;
+    const payload = {
+        ok: true,
+        command: "flow-state-repair",
+        reason: args.reason,
+        sidecar: result.sidecar,
+        guardPath: guardRel,
+        repairLogPath: logRel,
+        completedStageMetaBackfilled: result.completedStageMetaBackfilled,
+        earlyLoop: earlyLoopOutcome,
+        runtimeRoot: RUNTIME_ROOT
+    };
     if (args.json) {
-        io.stdout.write(`${JSON.stringify({
-            ok: true,
-            command: "flow-state-repair",
-            reason: args.reason,
-            sidecar: result.sidecar,
-            guardPath: guardRel,
-            repairLogPath: logRel,
-            runtimeRoot: RUNTIME_ROOT
-        })}\n`);
+        io.stdout.write(`${JSON.stringify(payload)}\n`);
         return 0;
     }
     if (!args.quiet) {
-        io.stdout.write(`${JSON.stringify({
-            ok: true,
-            command: "flow-state-repair",
-            reason: args.reason,
-            sidecar: result.sidecar,
-            guardPath: guardRel,
-            repairLogPath: logRel
-        }, null, 2)}\n`);
+        io.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
     }
     return 0;
 }

package/dist/run-persistence.d.ts

@@ -92,6 +92,8 @@ export interface FlowStateRepairResult {
     sidecar: FlowStateGuardSidecar;
     repairLogPath: string;
     guardPath: string;
+    /** Stages that were retro-backfilled into completedStageMeta during repair. */
+    completedStageMetaBackfilled: FlowStage[];
 }
 /**
  * Recompute the write-guard sidecar from the current on-disk flow-state

package/dist/run-persistence.js

@@ -700,6 +700,43 @@ export async function writeFlowState(projectRoot, state, options = {}) {
 export async function writeFlowStateGuarded(projectRoot, state, options = {}) {
     await writeFlowState(projectRoot, state, options);
 }
+/**
+ * v6.9.0 — backfill missing `completedStageMeta` rows for any stage that
+ * already lives in `completedStages` but has no audit timestamp. Uses the
+ * stage's artifact mtime when available, otherwise the current time. This
+ * runs as part of `flow-state-repair` so legacy v6.8 flow-state.json files
+ * get their meta carried forward without a destructive rewrite.
+ */
+async function backfillCompletedStageMeta(projectRoot, state) {
+    const meta = { ...(state.completedStageMeta ?? {}) };
+    const backfilled = [];
+    for (const stage of state.completedStages) {
+        if (meta[stage] && typeof meta[stage].completedAt === "string" && meta[stage].completedAt.length > 0) {
+            continue;
+        }
+        let completedAt = new Date().toISOString();
+        try {
+            const { resolveArtifactPath } = await import("./artifact-paths.js");
+            const resolved = await resolveArtifactPath(stage, {
+                projectRoot,
+                track: state.track,
+                intent: "read"
+            });
+            const stat = await fs.stat(resolved.absPath);
+            completedAt = new Date(stat.mtimeMs).toISOString();
+        }
+        catch {
+            // artifact missing or unreadable — fall back to "now" so the meta row
+            // is at least consistently populated; operators can re-edit if needed.
+        }
+        meta[stage] = { completedAt };
+        backfilled.push(stage);
+    }
+    if (backfilled.length === 0) {
+        return { state, backfilled };
+    }
+    return { state: { ...state, completedStageMeta: meta }, backfilled };
+}
 /**
  * Recompute the write-guard sidecar from the current on-disk flow-state
  * contents and append an audit entry to `.cclaw/.flow-state-repair.log`.
@@ -720,12 +757,26 @@ export async function repairFlowStateGuard(projectRoot, reason) {
         throw new Error(`flow-state-repair: ${FLOW_STATE_REL_PATH} does not exist; nothing to repair.`);
     }
     return withDirectoryLock(flowStateLockPath(projectRoot), async () => {
-        const raw = await fs.readFile(statePath, "utf8");
+        let raw = await fs.readFile(statePath, "utf8");
         let runId = "unknown-run";
+        let backfilledStages = [];
         try {
             const parsed = JSON.parse(raw);
             const coerced = coerceFlowState(parsed).state;
             runId = coerced.activeRunId;
+            const { state: nextState, backfilled } = await backfillCompletedStageMeta(projectRoot, coerced);
+            backfilledStages = backfilled;
+            if (backfilled.length > 0) {
+                // Persist the migrated state inside the same lock window so the
+                // sha sidecar below covers the post-migration bytes, not the
+                // pre-migration ones.
+                await writeFlowState(projectRoot, nextState, {
+                    allowReset: true,
+                    skipLock: true,
+                    writerSubsystem: "flow-state-repair-backfill"
+                });
+                raw = await fs.readFile(statePath, "utf8");
+            }
         }
         catch {
             // parsing failure falls back to "unknown-run"; repair intentionally
@@ -743,9 +794,17 @@ export async function repairFlowStateGuard(projectRoot, reason) {
         await writeFileSafe(guardPath, `${JSON.stringify(sidecar, null, 2)}\n`, { mode: 0o600 });
         const logPath = repairLogPath(projectRoot);
         await ensureDir(path.dirname(logPath));
-        const logLine = `${sidecar.writtenAt} reason=${trimmed} runId=${sidecar.runId} sha256=${sidecar.sha256}\n`;
+        const backfillNote = backfilledStages.length > 0
+            ? ` backfilledCompletedStageMeta=${backfilledStages.join(",")}`
+            : "";
+        const logLine = `${sidecar.writtenAt} reason=${trimmed} runId=${sidecar.runId} sha256=${sidecar.sha256}${backfillNote}\n`;
         await fs.appendFile(logPath, logLine, "utf8");
-        return { sidecar, repairLogPath: logPath, guardPath };
+        return {
+            sidecar,
+            repairLogPath: logPath,
+            guardPath,
+            completedStageMetaBackfilled: backfilledStages
+        };
     });
 }
 export function flowStateGuardSidecarPathFor(projectRoot) {