commandmate 0.19.0 → 0.21.0

package/dist/server/src/lib/skills/install-apply.js

@@ -47,6 +47,8 @@ exports.inspectSkillDestination = inspectSkillDestination;
 exports.hasCommittedSkillPayload = hasCommittedSkillPayload;
 exports.writeSkillPayloadFile = writeSkillPayloadFile;
 exports.applySkillInstall = applySkillInstall;
+exports.directoriesForSkillPayload = directoriesForSkillPayload;
+exports.stageSkillRootPayload = stageSkillRootPayload;
 exports.completeSecondarySkillInstallRoots = completeSecondarySkillInstallRoots;
 exports.cleanupSkillInstallStaging = cleanupSkillInstallStaging;
 const fs_1 = require("fs");
@@ -397,7 +399,7 @@ function applySkillInstall(input) {
         }
         return { relativePath: file.path, bytes, executable: file.executable };
     });
-    const directories = directoriesFor(input.snapshot.files.map((f) => f.path), input.snapshot.directories);
+    const directories = directoriesForSkillPayload(input.snapshot.files.map((f) => f.path), input.snapshot.directories);
     // Every destination is proven safe and absent *before* the primary commits, so
     // a secondary that is already blocked cannot leave a committed primary behind.
     for (const prefix of rootPrefixes) {
@@ -463,7 +465,7 @@ function applySkillInstall(input) {
     };
 }
 /** Sorted set of directories a payload implies, plus any the package declared. */
-function directoriesFor(filePaths, declared = []) {
+function directoriesForSkillPayload(filePaths, declared = []) {
     const directories = new Set(declared);
     for (const filePath of filePaths) {
         const parents = filePath.split('/').slice(0, -1);
@@ -476,30 +478,29 @@ function directoriesFor(filePaths, declared = []) {
     return [...directories].sort();
 }
 /**
- * Stage the verified payload into one root and atomically publish it (#1460).
+ * Stage the verified payload for one root without publishing it (#1244).
  *
- * The single-root commit #1235 built, lifted to take the root prefix as a
- * parameter: staging lives under *that* root's reserved namespace so the rename
- * stays on one filesystem, and every check — ancestor lstat walk, exclusive
- * no-follow writes, tree-hash gate, destination-absent, same-filesystem — is
- * applied per root. Throws {@link SkillInstallError} on any failure, having
- * removed its own staging; the destination is untouched unless the rename ran.
+ * The staging half of {@link stageAndCommitSkillRoot}, exported so update can
+ * reuse the exact write path — exclusive no-follow writes, tree-hash gate,
+ * same-filesystem check — and supply its own rename sequence. On any failure the
+ * staging directory is removed and {@link SkillInstallError} is thrown; the
+ * destination is never touched. The caller owns the returned directory: it must
+ * either rename it into place or remove it.
+ *
+ * @internal Shared between install and update apply; not a public API.
  */
-function stageAndCommitSkillRoot(input) {
+function stageSkillRootPayload(input) {
+    if (!exports.SKILL_INSTALL_OPERATION_ID_PATTERN.test(input.stagingName)) {
+        fail(exports.SkillInstallErrorCode.STAGING_IO, { reason: 'staging-name' });
+    }
     const installRootAbs = resolveSkillInstallTargetFor(input.worktreePath, input.rootPrefix, input.skillId);
     assertAncestorsAreRealDirectories(input.worktreeRealPath, input.worktreePath, input.rootPrefix);
-    const destinationBefore = inspectSkillDestination(installRootAbs);
-    if (destinationBefore.present) {
-        fail(destinationBefore.managed
-            ? exports.SkillInstallErrorCode.DESTINATION_EXISTS
-            : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED, destinationBefore.version ? { version: destinationBefore.version } : undefined);
-    }
     const stagingRoot = (0, operation_store_1.getSkillInstallStagingRoot)(input.worktreePath, input.rootPrefix);
     makeDirectory(path_1.default.dirname(stagingRoot), 0o755, true);
     makeDirectory(stagingRoot, exports.SKILL_INSTALL_DIR_MODE, true);
     // Not recursive: a staging directory that already exists means another
-    // operation is using this ID, and silently adopting it would merge two writes.
-    const stagingDir = path_1.default.join(stagingRoot, input.operationId);
+    // operation is using this name, and silently adopting it would merge two writes.
+    const stagingDir = path_1.default.join(stagingRoot, input.stagingName);
     makeDirectory(stagingDir, exports.SKILL_INSTALL_DIR_MODE, false);
     try {
         for (const directory of input.directories) {
@@ -520,6 +521,45 @@ function stageAndCommitSkillRoot(input) {
             fail(exports.SkillInstallErrorCode.PAYLOAD_MISMATCH, { reason: 'tree-hash' });
         }
         assertSameFilesystem(stagingDir, path_1.default.dirname(installRootAbs));
+    }
+    catch (error) {
+        (0, fs_1.rmSync)(stagingDir, { recursive: true, force: true });
+        pruneStagingRoot(stagingRoot);
+        throw error;
+    }
+    return { stagingDir, stagingRoot, installRootAbs };
+}
+/**
+ * Stage the verified payload into one root and atomically publish it (#1460).
+ *
+ * The single-root commit #1235 built, lifted to take the root prefix as a
+ * parameter: staging lives under *that* root's reserved namespace so the rename
+ * stays on one filesystem, and every check — ancestor lstat walk, exclusive
+ * no-follow writes, tree-hash gate, destination-absent, same-filesystem — is
+ * applied per root. Throws {@link SkillInstallError} on any failure, having
+ * removed its own staging; the destination is untouched unless the rename ran.
+ */
+function stageAndCommitSkillRoot(input) {
+    const installRootAbs = resolveSkillInstallTargetFor(input.worktreePath, input.rootPrefix, input.skillId);
+    assertAncestorsAreRealDirectories(input.worktreeRealPath, input.worktreePath, input.rootPrefix);
+    const destinationBefore = inspectSkillDestination(installRootAbs);
+    if (destinationBefore.present) {
+        fail(destinationBefore.managed
+            ? exports.SkillInstallErrorCode.DESTINATION_EXISTS
+            : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED, destinationBefore.version ? { version: destinationBefore.version } : undefined);
+    }
+    const staged = stageSkillRootPayload({
+        worktreePath: input.worktreePath,
+        worktreeRealPath: input.worktreeRealPath,
+        rootPrefix: input.rootPrefix,
+        skillId: input.skillId,
+        stagingName: input.operationId,
+        payload: input.payload,
+        directories: input.directories,
+        receiptBytes: input.receiptBytes,
+        plannedTreeHash: input.plannedTreeHash,
+    });
+    try {
         // Re-checked immediately before the rename rather than only at entry: the
         // exclusive lock keeps CommandMate out, but nothing keeps the user's own
         // editor from creating this directory while the payload was being staged.
@@ -531,18 +571,18 @@ function stageAndCommitSkillRoot(input) {
                 : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED);
         }
         try {
-            (0, fs_1.renameSync)(stagingDir, installRootAbs);
+            (0, fs_1.renameSync)(staged.stagingDir, installRootAbs);
         }
         catch {
             fail(exports.SkillInstallErrorCode.COMMIT_FAILED, { reason: 'rename' });
         }
     }
     catch (error) {
-        (0, fs_1.rmSync)(stagingDir, { recursive: true, force: true });
-        pruneStagingRoot(stagingRoot);
+        (0, fs_1.rmSync)(staged.stagingDir, { recursive: true, force: true });
+        pruneStagingRoot(staged.stagingRoot);
         throw error;
     }
-    pruneStagingRoot(stagingRoot);
+    pruneStagingRoot(staged.stagingRoot);
 }
 /**
  * Converge a committed install's secondary roots forward from the primary (#1460).
@@ -573,7 +613,7 @@ function completeSecondarySkillInstallRoots(worktreePath, worktreeRealPath, skil
         }
         return { relativePath: file.path, bytes, executable: file.executable };
     });
-    const directories = directoriesFor(receipt.files.map((file) => file.path));
+    const directories = directoriesForSkillPayload(receipt.files.map((file) => file.path));
     const plannedTreeHash = (0, preview_diff_1.computeSkillTreeHash)([
         ...receipt.files.map((file) => ({
             path: file.path,

package/dist/server/src/lib/skills/operation-audit.js

@@ -61,11 +61,10 @@ const SELECT_COLUMNS = `
  * The journal already holds the actor, target, source and typed error.
  *
  * The version transition (#1248) is derived from the journal rather than passed
- * in, because for the two operations that exist today the journal fully
- * determines it: an install ends at its target version and starts nowhere, an
- * uninstall starts at the version it removes and ends nowhere. An `update` is
- * the one case where `fromVersion` is not derivable — it has no writer yet
- * (#1243/#1244), and whoever adds one has to supply the replaced version here.
+ * in, because the journal fully determines it: an install ends at its target
+ * version and starts nowhere, an uninstall starts at the version it removes and
+ * ends nowhere, and an update (#1244) records the version it replaces on its
+ * own target (`fromVersion`) precisely so this derivation stays total.
  */
 function buildSkillOperationAuditInput(entry, result, recordedAt) {
     const isUninstall = entry.operation === 'uninstall';
@@ -81,7 +80,7 @@ function buildSkillOperationAuditInput(entry, result, recordedAt) {
         worktreeId: entry.target.worktreeId,
         skillId: entry.target.skillId,
         skillVersion: entry.target.version,
-        fromVersion: isUninstall ? entry.target.version : null,
+        fromVersion: isUninstall ? entry.target.version : (entry.target.fromVersion ?? null),
         toVersion: isUninstall ? null : entry.target.version,
         sourceOrigin: entry.source?.origin ?? null,
         sourceRepository: entry.source?.repository ?? null,

package/dist/server/src/lib/skills/startup-reconcile.js

@@ -32,6 +32,7 @@ const integrity_1 = require("../../lib/skills/integrity");
 const install_plan_1 = require("../../lib/skills/install-plan");
 const install_apply_1 = require("../../lib/skills/install-apply");
 const uninstall_apply_1 = require("../../lib/skills/uninstall-apply");
+const updater_1 = require("../../lib/skills/updater");
 const installed_state_1 = require("../../lib/skills/installed-state");
 const operation_audit_1 = require("../../lib/skills/operation-audit");
 const operation_journal_1 = require("../../lib/skills/operation-journal");
@@ -65,6 +66,19 @@ function buildSkillReconcilerPorts(db, options = {}) {
                 // and an uninstall's payload is by definition no longer present.
                 return isRemovalOperation(entry);
             }
+            if (entry.operation === 'update') {
+                // An interrupted two-rename switch can leave the root empty (old in
+                // the aside directory, or a verified staged payload unpublished), so
+                // the probe first converges the root to old-complete or new-complete
+                // (#1244) and only then answers whether the *new* receipt landed. The
+                // pre-existing old receipt is why the install probe would misread this
+                // entry: with no recorded digest it accepts any parseable receipt.
+                return (0, updater_1.reconcileSkillUpdateTarget)(worktreePath, entry.target.skillId, {
+                    operationId: entry.operationId,
+                    toVersion: entry.target.version,
+                    receiptDigest: entry.receiptDigest,
+                }).committed;
+            }
             return isRemovalOperation(entry)
                 ? (0, uninstall_apply_1.hasRemovedSkillPayload)(worktreePath, entry.target.skillId, entry.receiptDigest)
                 : (0, install_apply_1.hasCommittedSkillPayload)(worktreePath, entry.target.skillId, entry.receiptDigest);
@@ -80,12 +94,19 @@ function buildSkillReconcilerPorts(db, options = {}) {
             if (worktreePath === null) {
                 throw new Error('worktree path is unavailable for reindex');
             }
-            // Converge any secondary root a partial multi-root install did not reach,
-            // copying the byte-identical payload forward from the committed primary
-            // (#1460). Best-effort: a root blocked by a user file must not stall the
-            // index write, which is what actually makes the install visible.
+            // Converge any secondary root the operation did not reach, forward from
+            // the committed primary (#1460). An install only fills absent roots; an
+            // update (#1244) additionally switches a secondary that still holds the
+            // provably clean previous version. Best-effort: a root blocked by a user
+            // file must not stall the index write, which is what actually makes the
+            // operation visible.
             try {
-                (0, install_apply_1.completeSecondarySkillInstallRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                if (entry.operation === 'update') {
+                    (0, updater_1.completeSecondarySkillUpdateRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                }
+                else {
+                    (0, install_apply_1.completeSecondarySkillInstallRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                }
             }
             catch (error) {
                 reconcileLogger.warn('skill-secondary-root-convergence-failed', {