create-pmos 0.34.0 → 0.37.0

package/workspace/server.js

@@ -687,9 +687,19 @@ function budgetsFor(A, root) {
 // or a DECISIONS.md gets the initiative lens + curated knowledge; anything else is a plain document
 // tree. Detection is nested-aware so a repo that vendors a PMOS bundle under a sub-folder still
 // shows its initiatives (the reported defect) — including a kit whose records are its whole bundle.
+// Memoised for the same reason repoIdentity is: wsList() calls this for every workspace on every
+// push, and a cold answer for a plain repo costs up to four depth-2 walks. A repo that gains its
+// first planning/ dir reads as 'plain' for at most one TTL — the staleness class the branch chip
+// already accepts.
+const wsShapeCache = new Map();   // root -> { at, shape }
 function wsShape(root) {
-  return planningRoots(root).length || initiativeDirs(root).length
+  const hit = wsShapeCache.get(root);
+  const now = Date.now();
+  if (hit && now - hit.at < REPO_KEY_TTL_MS) return hit.shape;
+  const shape = planningRoots(root).length || initiativeDirs(root).length
     || fs.existsSync(path.join(root, 'DECISIONS.md')) ? 'pmos' : 'plain';
+  wsShapeCache.set(root, { at: now, shape });
+  return shape;
 }
 
 // ── Library: the file tree the sidebar browses. ───────────────────────────────────────
@@ -1400,18 +1410,14 @@ function deriveState(ev) {
   if (ev.runs) return { state: 'building', why: `${ev.runs} run${ev.runs > 1 ? 's' : ''} logged, nothing merged yet` };
   return { state: 'planning', why: 'no run, no merge, no acceptance — nothing has happened yet' };
 }
-// BOTH acceptance ledgers, oldest-wins-never: the workspace writes to its state dir, while the
-// ladder and every hand-recorded acceptance in pmos-self live in planning/runs/. Reading only the
-// state dir is why this surface reported 0 accepted against 23 real acceptance rows — the same
-// "one field, several readers, none agreeing" defect the anchor resolver was built to end.
-function acceptanceFilesFor(w) {
-  return ledgerFilesFor(w, 'acceptances.jsonl');
-}
-// The general form of the comment above, because the defect it describes was never specific to
-// acceptances. `deriveNeeds` read evals.jsonl, acceptances.jsonl AND outcome_checks.jsonl from the
-// state dir alone, so the supervision surface under-reported everything pmos-self records in
-// planning/runs/ — the same "one field, several readers, none agreeing" shape, three ledgers wide.
-// One helper with three call sites, so the fourth ledger added later cannot reintroduce it.
+// BOTH ledger locations, always: the workspace writes to its state dir, while the ladder and every
+// hand-recorded acceptance in pmos-self live in planning/runs/. Reading only the state dir is why
+// the initiative surface reported 0 accepted against 23 real acceptance rows, and the defect was
+// never specific to acceptances: `deriveNeeds` read evals.jsonl, acceptances.jsonl AND
+// outcome_checks.jsonl from the state dir alone, so the supervision surface under-reported
+// everything pmos-self records in planning/runs/ — the same "one field, several readers, none
+// agreeing" shape, three ledgers wide. One helper on every ledger read, so the fourth ledger
+// added later cannot reintroduce it.
 function ledgerFilesFor(w, basename) {
   const out = [];
   const d = stateDirFor(w);
@@ -1435,33 +1441,28 @@ function readLedger(w, basename) {
 }
 function readAcceptances(w) {
   const acc = new Map();   // initiative_id -> { action, at }
-  for (const f of acceptanceFilesFor(w)) {
-    let text = '';
-    try { text = fs.readFileSync(f, 'utf8'); } catch { continue; }
-    for (const line of text.split('\n')) {
-      if (!line.trim()) continue;
-      // Tolerate both shapes: this server's {action} and the kit's {accepted} (D54 adapter).
-      // THE BOOLEAN OUTRANKS THE LABEL. `action` is an open vocabulary describing what the PM did
-      // — this corpus holds accept, merge, publish, return — while `accepted` is the D12 verdict
-      // itself. Reading `action` first (the previous behaviour) meant every row labelled `merge` or
-      // `publish` carried `accepted: true` and was still not counted: 7 of 16 real acceptances went
-      // missing, and the surface reported those initiatives as merely `building`.
-      try {
-        const r = JSON.parse(line);
-        if (!r.initiative_id) continue;
-        const label = String(r.action || '').toLowerCase();
-        const action = r.accepted === true ? 'accept'
-          : r.accepted === false ? 'return'
-            : label === 'return' ? 'return'
-              : ['accept', 'approve', 'merge', 'publish'].includes(label) ? 'accept'
-                : null;
-        const at = r.at || r.date || null;
-        // Last write wins, but a row with no timestamp never displaces a dated one.
-        const prev = acc.get(r.initiative_id);
-        if (prev && prev.at && !at) continue;
-        acc.set(r.initiative_id, { action, at });
-      } catch {}
-    }
+  for (const r of readLedger(w, 'acceptances.jsonl')) {
+    // Tolerate both shapes: this server's {action} and the kit's {accepted} (D54 adapter).
+    // THE BOOLEAN OUTRANKS THE LABEL. `action` is an open vocabulary describing what the PM did
+    // — this corpus holds accept, merge, publish, return — while `accepted` is the D12 verdict
+    // itself. Reading `action` first (the previous behaviour) meant every row labelled `merge` or
+    // `publish` carried `accepted: true` and was still not counted: 7 of 16 real acceptances went
+    // missing, and the surface reported those initiatives as merely `building`.
+    if (!r.initiative_id) continue;
+    const label = String(r.action || '').toLowerCase();
+    const action = r.accepted === true ? 'accept'
+      : r.accepted === false ? 'return'
+        : label === 'return' ? 'return'
+          : ['accept', 'approve', 'merge', 'publish'].includes(label) ? 'accept'
+            : null;
+    const at = r.at || r.date || null;
+    // Last write wins, judged by timestamp — the two ledgers arrive in FILE order, not time order,
+    // so a dated earlier row must yield only to a LATER date (ISO strings compare lexicographically;
+    // a bare YYYY-MM-DD loses same-day ties to a full stamp). An undated row never displaces a dated
+    // one; between undated rows, last read wins.
+    const prev = acc.get(r.initiative_id);
+    if (prev && prev.at && (!at || at < prev.at)) continue;
+    acc.set(r.initiative_id, { action, at });
   }
   return acc;
 }
@@ -1499,7 +1500,8 @@ function surfaceInitiatives(root, w) {
     const a = acc.get(g.id) || {};
     const deliveredBy = !del.ok ? null : del.byBranch.has(g.id) ? 'branch' : del.byMention.has(g.id) ? 'mention' : null;
     const { state, why } = deriveState({
-      accepted: a.action === 'accept' || a.action === 'approve', acceptedAt: a.at,
+      // readAcceptances already folds every accepting label (approve/merge/publish) into 'accept'.
+      accepted: a.action === 'accept', acceptedAt: a.at,
       returned: a.action === 'return',
       needs: needsBy.get(g.id) || 0,
       delivery: del.ok ? 'known' : 'unknown',
@@ -1606,15 +1608,16 @@ function surfaceOkr(root) {
     let files = [];
     try { files = fs.readdirSync(dir).filter((f) => f.endsWith('.md')); } catch { continue; }
     for (const f of files) {
-      let head = '';
-      try { head = fs.readFileSync(path.join(dir, f), 'utf8').slice(0, 4096); } catch { continue; }
-      const m = /^parent_kr:[ \t]*(.*)$/m.exec(head);
-      if (!m) continue;
-      const r = A.resolveAnchor(m[1], index, budgets);
+      // The LEADING frontmatter block only — body text must never be able to fake a declaration —
+      // and the same reader surfaceSpine uses, so the two panels cannot disagree on one record.
+      // A present-but-empty `parent_kr:` still reaches resolveAnchor and counts as `empty`.
+      const fm = leadingFrontmatter(path.join(dir, f));
+      if (fm.parent_kr === undefined) continue;
+      const r = A.resolveAnchor(fm.parent_kr, index, budgets);
       if (r.kind === 'empty') { empty++; continue; }
       checked++;
       if (r.status === 'unresolvable' || r.status === 'unknown') {
-        unresolvable.push({ initiative: f.replace(/\.md$/, ''), raw: String(m[1]).trim().slice(0, 80), reason: r.reason, status: r.status });
+        unresolvable.push({ initiative: f.replace(/\.md$/, ''), raw: String(fm.parent_kr).trim().slice(0, 80), reason: r.reason, status: r.status });
       }
     }
   }
@@ -1818,7 +1821,10 @@ function reportToMarkdown(surface) {
 function fireSchedule(sched) {
   const w = workspaces.get(sched.ws) || homeWorkspace();
   const root = w ? w.root : SELF_ROOT;
-  const task = taskById(sched.task) || taskById(sched.skill);
+  // One corpus load probing both keys — taskById would re-read every .skill file per probe.
+  const tasks = loadTasks();
+  const byId = (id) => tasks.find((t) => t.id === id || t.skill === id) || null;
+  const task = byId(sched.task) || byId(sched.skill);
   // AGENT task — fire as a real PTY session running its skill (async; the skill files its own
   // deliverable). The workspace starts it + stamps 'started'; run-now and the tick share this path.
   if (task && task.kind === 'agent') {
@@ -2049,7 +2055,9 @@ function broadcast(obj) {
 }
 // The agent process behind a session. tmux spawns the command directly (see ensureTmuxSession's
 // `-- cmd`, no shell), so pane_pid IS the agent — one hop, no guessing. Cached because a pid
-// cannot change for the life of a session.
+// cannot change for the life of a session — but a FAILED lookup is not a pid: tmux can be
+// transiently busy, and caching its null would disable the harness drill-in until restart. The
+// retry costs one shell-out per transcript re-resolution, already throttled to ~2s by txFoundAt.
 function agentPid(s) {
   if (s.agentPid !== undefined) return s.agentPid;
   let pid = null;
@@ -2060,7 +2068,7 @@ function agentPid(s) {
   } else if (s.pty && s.pty.pid) {
     pid = s.pty.pid;
   }
-  s.agentPid = pid;
+  if (pid != null) s.agentPid = pid;
   return pid;
 }
 
@@ -2557,14 +2565,6 @@ function exitedSession(base, workdir, why) {
   sessions.set(s.id, s); persist(s); pushSessions(); pushWorkspaces(); return s;
 }
 
-// Live (non-exited) sessions belonging to a workspace. Used to decide whether isolating a branch
-// would actually protect anyone, and to refuse removing a worktree somebody is working in.
-function liveSessionCount(wsIdent) {
-  let n = 0;
-  for (const s of sessions.values()) if (s.ws === wsIdent && s.state !== 'exited') n++;
-  return n;
-}
-
 // The next unused session id. `seq` is a per-process counter, so it can only be trusted once it
 // has been floored by what is already on disk and in memory (see restorePersisted) — this loop is
 // the last guard: a fresh session must never take an id another session's record already owns,
@@ -2737,12 +2737,14 @@ function spawnWithBranch({ name, agent, cwd, ws, branch, createBranch, isolate,
   if (!pres.ok) return { ok: false, error: pres.error };
   let targetWs = w.id;
   let notice = null;
-  // Isolation exists to protect OTHER sessions. Alone in a workspace there are none to protect, so
-  // a plain checkout costs nothing and leaves no folder behind — which is the difference between
-  // "a worktree when it earns its keep" and a directory per branch forever. The client sends what
-  // the PM actually saw; this default only decides for a caller that expressed no preference (an
-  // older client, a scheduled run).
-  if (isolate === undefined || isolate === null) isolate = liveSessionCount(w.id) > 0;
+  // Isolation exists to protect OTHER sessions. Alone in the working TREE there are none to
+  // protect, so a plain checkout costs nothing and leaves no folder behind — which is the
+  // difference between "a worktree when it earns its keep" and a directory per branch forever.
+  // Counted by tree, not workspace id, for the reason worktreeReport states: a session in a
+  // workspace registered at a SUBDIRECTORY of this tree is one this checkout would switch branches
+  // under — two ids, one checkout. The client sends what the PM actually saw; this default only
+  // decides for a caller that expressed no preference (an older client, a scheduled run).
+  if (isolate === undefined || isolate === null) isolate = treeTenants(treeForWs(w.id), null).length > 0;
 
   if (branch) {
     if (!gitInfo.isRepo(w.root)) {
@@ -3165,8 +3167,10 @@ function needsResult(w) {
     question: n.question || n.t || '(unstated)', derived: !!n.derived, doc: n.doc || null,
     deliverable: n.deliverable || null,
   }));
-  if (!items.length) return { ok: true, empty: true };
-  return { ok: true, empty: false, data: { items } };
+  // `all` is the RAW combined queue — what readNeeds(w) computes — carried so /api/needs can serve
+  // both the strict state and the queue from one derivation instead of deriving twice per request.
+  if (!items.length) return { ok: true, empty: true, all };
+  return { ok: true, empty: false, data: { items }, all };
 }
 // R12 — the per-tree aggregate the collapsed sidebar rows need, and R10's honesty rule applied to
 // the count itself. It deliberately routes through needsResult(), the STRICT reader: readNeeds()
@@ -4223,11 +4227,15 @@ async function handleRequest(req, res) {
   if (p === '/api/schedules' && req.method === 'GET') {
     const wsFilter = getWs(url.searchParams.get('ws'));
     const id = wsFilter ? wsFilter.id : null;
+    // One skills-corpus read per request, not one per schedule row — taskById re-reads every
+    // .skill file, and the PM's forty-five schedules made that forty-five reads per GET.
+    const tasks = loadTasks();
+    const taskOf = (tid) => tasks.find((t) => t.id === tid || t.skill === tid) || null;
     const list = readSchedules().filter((s) => !id || s.ws === id).map((s) => {
       // `profile_applies` is the difference between "no profile was chosen" and "a profile could
       // not apply here at all": a skill-kind task runs IN THIS PROCESS and never creates a PTY, so
       // the detail row states that instead of offering a control that would do nothing (R8.3).
-      const t = taskById(s.task || s.skill);
+      const t = taskOf(s.task || s.skill);
       return { ...s, next: scheduleLogic.nextRun(s),
         profile: s.profile == null ? null : s.profile,
         profile_applies: !!(t && t.kind === 'agent') };
@@ -4413,8 +4421,18 @@ async function handleRequest(req, res) {
   if (p === '/api/needs') {
     const w = getWs(url.searchParams.get('ws'));
     const strict = needsResult(w);
+    // One derivation per request, not three: the strict read already holds the combined queue
+    // (`all` — identical to readNeeds when the read succeeds; on a corrupt file readNeeds keeps its
+    // lenient derived-only fallback), and the by_ws cache is seeded from the same read so the
+    // selected tree is not derived again — fresher than any cache hit, so R10 still holds.
+    if (w) {
+      let sig; try { sig = needsSig(w); } catch { sig = 'unreadable'; }
+      needsAgg.set(w.id, { at: Date.now(), sig, value: strict.ok
+        ? { count: strict.empty ? 0 : strict.data.items.length, error: null }
+        : { count: null, error: strict.error } });
+    }
     return json(res, {
-      needs: readNeeds(w),
+      needs: strict.ok ? strict.all : readNeeds(w),
       state: strict.ok ? { ok: true } : { ok: false, error: strict.error },
       by_ws: needsByWorkspace(),
     });
@@ -4804,14 +4822,21 @@ async function handleRequest(req, res) {
     let changedText = '';
     try { changedText = fs.readFileSync(full, 'utf8'); } catch {}
     const docs = [];
+    let oversized = 0;
     for (const f of markdownDocs(w.root)) {
       if (f === rel) continue;
       const fp = path.resolve(w.root, f);
       if (!insideRoot(w.root, fp)) continue;
-      try { docs.push({ path: f, text: fs.readFileSync(fp, 'utf8') }); } catch {}
+      // Same per-file bound as the search corpus: a pathological multi-MB document is skipped and
+      // COUNTED (the honesty contract — `considered` must not silently shrink), never read whole
+      // onto the thread that carries every PTY byte.
+      try {
+        if (fs.statSync(fp).size > SEARCH_CONTENT_BYTES) { oversized++; continue; }
+        docs.push({ path: f, text: fs.readFileSync(fp, 'utf8') });
+      } catch {}
     }
     const cands = relatedDocs.candidates({ changedPath: rel, changedText, removed: last.before, docs });
-    return json(res, { ok: true, change: last, candidates: cands.slice(0, 12), considered: docs.length, total: cands.length });
+    return json(res, { ok: true, change: last, candidates: cands.slice(0, 12), considered: docs.length, skipped_oversized: oversized, total: cands.length });
   }
   if (p === '/api/align/start' && req.method === 'POST') {
     // Hand the change and its candidates to an agent, which DRAFTS the realigning edits (R5). The

package/workspace/test-run.js

@@ -27,7 +27,7 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { execFileSync } = require('child_process');
+const { execFileSync, spawnSync } = require('child_process');
 
 const HOST = '127.0.0.1';
 
@@ -42,6 +42,28 @@ function claimEphemeralPort() {
   return n;
 }
 
+/**
+ * Poll a child server until it answers 200, instead of sleeping a fixed interval. A fixed sleep
+ * that expires early is a suite that aborts on its first request — observed as a lost race on a
+ * loaded machine (the first page.goto got ECONNREFUSED and the run stopped partway), and an
+ * aborted run's count is not a coverage claim. Booting is slower than a plain HTTP server:
+ * node-pty loads and sessions are restored before the port is bound. server.js does all of that
+ * (including the first-run shell spawn) BEFORE it listens, so a 200 means the server is fully up.
+ *
+ * `probe` must be a path every child serves regardless of workspace shape; `/pm/tokens.css` is
+ * routed unconditionally. The poll is read-only, so it changes no server state (the F-restart
+ * block in test.js relies on that: no tmux reset between its two servers).
+ */
+async function waitForServer(base, { deadline = 30000, probe = '/pm/tokens.css', step = 150 } = {}) {
+  const t0 = Date.now();
+  for (;;) {
+    const r = await fetch(base + probe).catch(() => null);
+    if (r && r.status === 200) return;
+    if (Date.now() - t0 > deadline) throw new Error(`server did not start on ${base} within ${Math.round(deadline / 1000)}s`);
+    await new Promise((res) => setTimeout(res, step));
+  }
+}
+
 /**
  * Arm a suite. MUST be called before `require('./server')` and before any child is spawned —
  * server.js resolves its state root at require time, and a child inherits the environment as it
@@ -51,10 +73,23 @@ function claimEphemeralPort() {
  */
 function configure({ name = 'run', port = null } = {}) {
   if (state) return state;
-  const stateDir = process.env.PMOS_STATE_DIR
-    ? path.resolve(process.env.PMOS_STATE_DIR)
-    : fs.mkdtempSync(path.join(os.tmpdir(), `pmos-state-${name}-`));
-  fs.mkdirSync(stateDir, { recursive: true });
+  // DELETE the ambient values rather than adopt them. PMOS_STATE_DIR, PMOS_WS_PORT and
+  // PMOS_TMUX_SOCK are the PM's documented REAL-workspace overrides (workspace/README.md,
+  // bin/pmos.js, lib/state-root.js even advises exporting PMOS_STATE_DIR to resolve a state
+  // conflict). Adopting them here pointed the suite at live state: resetState() then rm -rf'd the
+  // PM's own sessions/registry, an exported port made the boot poll answer 200 from the PM's REAL
+  // server and drive it, and killTmux() killed their daemon. Same fix as PMOS_SELF_ROOT in
+  // test.js: the only value meaning "this run's own" is the one minted here.
+  delete process.env.PMOS_STATE_DIR;
+  delete process.env.PMOS_WS_PORT;
+  delete process.env.PMOS_TMUX_SOCK;
+  const stateDir = fs.mkdtempSync(path.join(os.tmpdir(), `pmos-state-${name}-`));
+  // Remove the scratch tree when the suite exits, green or red — nothing did, and every run left
+  // a pmos-state-* directory (scrollback, registry JSON) in tmpdir. Registered beside the mkdtemp
+  // above so it can only ever remove a directory THIS run made; removal at process exit only, so
+  // state survives between child servers within a run (the F-restart block needs that). `exit`
+  // handlers are synchronous-only — rmSync qualifies. A SIGKILLed suite still leaks, as before.
+  process.on('exit', () => { try { fs.rmSync(stateDir, { recursive: true, force: true }); } catch {} });
   // In the environment BEFORE server.js is required here and before any child inherits it. Every
   // boot site in every suite goes through process.env, so this is a chokepoint by construction
   // rather than a convention each call site has to remember — and a convention that must be
@@ -62,7 +97,8 @@ function configure({ name = 'run', port = null } = {}) {
   // which is exactly how this class of defect got in.
   process.env.PMOS_STATE_DIR = stateDir;
   // A private tmux socket, never the PM's own ('pmos'), so a suite cannot reach their sessions.
-  process.env.PMOS_TMUX_SOCK = process.env.PMOS_TMUX_SOCK || `pmos-${name}-${process.pid}`;
+  const tmuxSock = `pmos-${name}-${process.pid}`;
+  process.env.PMOS_TMUX_SOCK = tmuxSock;
 
   const chosen = Number(port) > 0 ? Number(port) : claimEphemeralPort();
 
@@ -74,11 +110,17 @@ function configure({ name = 'run', port = null } = {}) {
     },
     /** A port nobody else holds, for a suite that needs a second server. */
     port: claimEphemeralPort,
-    /** Remove the scratch state directory. Safe by construction: this run made it. */
-    cleanup() { try { fs.rmSync(stateDir, { recursive: true, force: true }); } catch {} },
+    /** Poll a spawned server until it answers — see waitForServer above. */
+    waitForServer,
+    /** Kill the tmux daemon this run minted, with every pane on it. Safe by construction: the
+     *  socket is private and per-pid, so this can never reach the PM's own ('pmos'). Every suite
+     *  that spawns the server must call this on its way out — SIGKILLing the server child leaves
+     *  the daemon and its shells running indefinitely, and per-pid sockets accumulate without
+     *  bound. */
+    killTmux() { try { spawnSync('tmux', ['-L', tmuxSock, 'kill-server'], { stdio: 'ignore' }); } catch {} },
   };
   Object.assign(module.exports, state);
   return state;
 }
 
-module.exports = { configure, claimEphemeralPort, HOST };
+module.exports = { configure, claimEphemeralPort, waitForServer, HOST };