create-walle 0.10.1 → 0.10.2

package/template/coding-task-manager/lib/storage/coding-session-model-store.js

@@ -282,10 +282,10 @@ function persistModelSelectionBatch(db, payload = {}, deps = {}) {
   if (!intents.length) return { generation, entries: [] };
   // Fail fast on a wiring mistake instead of a half-working batch (the model half would
   // persist while the codex title half silently threw).
-  for (const name of ['isGenericCodingSessionLabel', 'shouldApplyCodexAutoTitle', 'applyProviderTitle', 'canWriteTier3Title']) {
+  for (const name of ['isGenericCodingSessionLabel', 'applyProviderTitle', 'canWriteTier3Title']) {
     if (typeof deps[name] !== 'function') throw new TypeError(`persistModelSelectionBatch requires deps.${name}`);
   }
-  const { isGenericCodingSessionLabel, shouldApplyCodexAutoTitle } = deps;
+  const { isGenericCodingSessionLabel } = deps;
   const { applyProviderTitle, canWriteTier3Title } = deps;
   const entries = [];
   for (const intent of intents) {
@@ -326,27 +326,26 @@ function persistModelSelectionBatch(db, payload = {}, deps = {}) {
     if (intent.agentType === 'codex') {
       const existingTitle = db.getSessionTitleNew(id) || null;
       const liveLabel = String(intent.liveLabel || '').trim();
-      const session = { label: liveLabel };
-      if (existingTitle?.userRenamed) {
-        entry.titleSynced = true;
-      } else if (!shouldApplyCodexAutoTitle({ session, existingTitle }) && canWriteTier3Title({ userRenamed: existingTitle?.userRenamed, title_source: db.getDomainDb('core').prepare('SELECT title_source FROM ctm_sessions WHERE id=?').get(id)?.title_source })) {
-        if (liveLabel
-            && !isGenericCodingSessionLabel(liveLabel, 'codex')
-            && String(existingTitle?.title || '').trim() !== liveLabel) {
-          db.setSessionTitleNew(id, liveLabel, false);
-          entry.titleApplied = true;
-          entry.title = liveLabel;
-          entry.titleKind = 'live';
-        }
-        entry.titleSynced = true;
-      } else {
-        const agentName = String(intent.title || '').trim();
-        if (agentName) {
-          const outcome = applyProviderTitle({ db, sessionId: id, provider: 'codex', agentName });
-          if (outcome.applied === 'agent') { entry.titleApplied = true; entry.title = agentName; entry.titleKind = 'provider'; }
-          entry.titleSynced = true;
-        }
+      // WP-4/D-10: the thread's own name wins on EVERY observation — no one-shot `titleSynced`
+      // latch, and no `shouldApplyCodexAutoTitle` precedence test that could let a CTM title block
+      // the name (S-22). applyProviderTitle owns the tier rules (tier-1 re-assert, equal-name
+      // no-op, tier-2 write); the label-only fallback runs only when the thread has no name.
+      const agentName = String(intent.title || '').trim();
+      if (agentName) {
+        const outcome = applyProviderTitle({ db, sessionId: id, provider: 'codex', agentName });
+        if (outcome.applied === 'agent') { entry.titleApplied = true; entry.title = agentName; entry.titleKind = 'provider'; }
+      } else if (liveLabel
+          && !isGenericCodingSessionLabel(liveLabel, 'codex')
+          && String(existingTitle?.title || '').trim() !== liveLabel
+          && canWriteTier3Title({ userRenamed: existingTitle?.userRenamed, title_source: db.getDomainDb('core').prepare('SELECT title_source FROM ctm_sessions WHERE id=?').get(id)?.title_source })) {
+        db.setSessionTitleNew(id, liveLabel, false);
+        entry.titleApplied = true;
+        entry.title = liveLabel;
+        entry.titleKind = 'live';
       }
+      // The decision RAN (whatever it decided) — this receipt is the batch's completion signal
+      // (cacheCompleted) and the durable applier's latch; it is no longer a one-shot name gate.
+      entry.titleSynced = true;
     }
     entries.push(entry);
   }

package/template/coding-task-manager/lib/surviving-owner-bootstrap.js

@@ -6,7 +6,7 @@ const { createRecoveryProductionAdapters } = require('./recovery-production-adap
 const { waitFor } = require('../../bin/wait-for');
 
 function createSurvivingOwnerBootstrap(options) {
-  const { dataDir, log = console.warn } = options;
+  const { dataDir, log = console.warn, onSkip = () => {} } = options;
   const adapters = createRecoveryProductionAdapters(options);
   const recovery = createSurvivingOwnerRecovery({ dataDir, ...adapters });
   let loaded = false, unresolved = false, failed = false, lastReason = '';
@@ -28,10 +28,15 @@ function createSurvivingOwnerBootstrap(options) {
   function assertAdmission() {
     if (protectsSession()) throw Object.assign(new Error('Session is preserved by pending owner recovery'), { code: 'OWNER_RECOVERY_PENDING', status: 409 });
   }
-  function admissionResult() {
+  // WP-3 (§9 S-20 / AC-3e): `(id, task)` are accepted for the skip DIAGNOSTIC only -- callers
+  // (server.js _startDeferredRestoreSession/_Attempt/Now) have always passed them and were silently
+  // ignored. The fence VERDICT is unchanged and never inspects them: it is still exactly
+  // "is any owner-recovery operation still pending?".
+  function admissionResult(id, task) {
     try { assertAdmission(); return null; }
     catch (error) {
       if (error.code !== 'OWNER_RECOVERY_PENDING') throw error;
+      onSkip('OwnerRecoveryFence', id || task?.session_id || '', null);
       return { ok: false, status: 'blocked', code: 'owner_recovery_pending', reason: 'owner_recovery_pending', retryable: true, message: error.message };
     }
   }

package/template/coding-task-manager/lib/surviving-owner-recovery.js

@@ -10,6 +10,7 @@ const path = require('path');
 const crypto = require('crypto');
 const { readPrivateJson } = require('./recovery-private-file');
 const { assertRecoveryInput, verifyConfirmationReceipt } = require('./recovery-evidence');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 const DIRNAME = 'surviving-owner-recovery';
 const STAGES = new Set(['staged', 'awaiting-preservation', 'retiring', 'ready-to-adopt', 'completed']);
@@ -27,7 +28,7 @@ function operationPath(dataDir, operationId) {
 async function ensureOperationDir(dataDir) {
   if (!path.isAbsolute(dataDir)) throw new Error('recovery data directory must be absolute');
   const root = await fs.promises.lstat(dataDir);
-  if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.() || (root.mode & 0o022)) throw new Error('unsafe recovery data directory');
+  if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.() || !isWritableOnlyByOwner(root)) throw new Error('unsafe recovery data directory');
   const dir = operationDir(dataDir);
   try { await fs.promises.mkdir(dir, { mode: 0o700 }); }
   catch (error) { if (error.code !== 'EEXIST') throw error; /* expected: existing private operation directory */ }

package/template/coding-task-manager/lib/terminal-draft-http-status.js

@@ -0,0 +1,25 @@
+'use strict';
+
+function terminalDraftHttpStatus(error) {
+  if (!error) return 500;
+  if (error.code === 'CTM_MAIN_DB_REQUEST_FORBIDDEN') return 501;
+  if (error.code === 'CTM_OWNERSHIP_UNAVAILABLE' || error.code === 'CTM_DB_OWNER_UNAVAILABLE' ||
+      error.code === 'CTM_MEDIA_JOURNAL_UNAVAILABLE') return 503;
+  if (error.code === 'CTM_DRAFT_NOT_FOUND' || error.code === 'CTM_DRAFT_SESSION_NOT_FOUND') return 404;
+  if (error.code === 'CTM_DRAFT_PURGED') return 410;
+  if (error.code === 'CTM_DRAFT_SESSION_RETIRING') return 409;
+  if (error.code === 'CTM_SESSION_OWNER_MISMATCH') return 409;
+  if (error.code === 'CTM_DRAFT_REVISION_CONFLICT') return 412;
+  // CTM_IMAGE_IDEMPOTENCY_CONFLICT is the legacy/mobile lanes' equivalent of the draft
+  // lane's idempotency conflict (media-store requestId dedupe) — same 409 semantic
+  // (WP-9 lane-parity: distinguishable from a malformed 400 without inspecting `code`).
+  if (error.code === 'CTM_DRAFT_IDEMPOTENCY_CONFLICT' || error.code === 'CTM_IMAGE_IDEMPOTENCY_CONFLICT' ||
+      error.code === 'CTM_DRAFT_DELIVERY_SUPERSEDED' ||
+      error.code === 'CTM_DRAFT_DELIVERY_STATE') return 409;
+  if (error.code === 'CTM_DRAFT_FROZEN' || error.code === 'CTM_DRAFT_REQUEST_CANCELLED') return 409;
+  if (error.code === 'CTM_DRAFT_IMAGE_INVALID' || error.code === 'CTM_DRAFT_SESSION_REQUIRED' ||
+      error.code === 'CTM_DRAFT_IDENTITY_INVALID' || error.code === 'CTM_DRAFT_DELIVERY_OUTCOME_INVALID') return 400;
+  return 500;
+}
+
+module.exports = { terminalDraftHttpStatus };