devrites 3.2.16 → 3.2.18

package/engine/internal/lib/closeout.go

@@ -5,6 +5,9 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+
+	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/state"
 )
 
 // CloseOut retires a shipped feature: it moves the feature directory into the
@@ -30,13 +33,27 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 		return 4
 	}
 
-	work := featureDir(dv, slug)
-	arch := filepath.Join(dv, "archive", slug)
+	work, err := devritespaths.ExistingFeatureDirChecked(dv, slug)
+	if err != nil {
+		if os.IsNotExist(err) {
+			fmt.Fprintf(stderr, "close-out: no workspace for %s\n", slug)
+			return 4
+		}
+		fmt.Fprintf(stderr, "close-out: invalid workspace for %s: %v\n", slug, err)
+		return 1
+	}
+	archiveDir, err := devritespaths.ArchiveDirChecked(dv)
+	if err != nil {
+		fmt.Fprintf(stderr, "close-out: invalid archive directory: %v\n", err)
+		return 1
+	}
+	arch := filepath.Join(archiveDir, slug)
 	active := filepath.Join(dv, "ACTIVE")
 
-	if !isDir(work) {
-		fmt.Fprintf(stderr, "close-out: no workspace at %s\n", work)
-		return 4
+	activeSlug, err := devritespaths.ActiveSlug(dv)
+	if err != nil {
+		fmt.Fprintf(stderr, "close-out: invalid ACTIVE cursor: %v\n", err)
+		return 1
 	}
 	// A broken symlink at the destination still counts as "already there", so use
 	// Lstat rather than Stat to avoid silently overwriting it.
@@ -47,7 +64,7 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 
 	// Fail closed: if the move does not happen, leave the cursor alone and do not
 	// claim success: a lost audit trail must never look like a clean close-out.
-	if err := os.MkdirAll(filepath.Join(dv, "archive"), 0o755); err != nil {
+	if err := os.MkdirAll(archiveDir, 0o755); err != nil {
 		fmt.Fprintf(stderr, "close-out: cannot create archive dir: %v\n", err)
 		return 1
 	}
@@ -57,12 +74,18 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	}
 
 	// Clear ACTIVE only if it still points at the slug we just archived.
-	if isFile(active) {
-		if b, err := os.ReadFile(active); err == nil && stripASCIISpace(string(b)) == slug {
-			_ = os.WriteFile(active, nil, 0o644)
-			fmt.Fprintf(stdout, "close-out: archived %s -> %s and cleared ACTIVE\n", slug, filepath.ToSlash(arch))
-			return 0
+	if activeSlug == slug {
+		if err := state.AtomicWrite(active, nil, 0o644); err != nil {
+			rollbackErr := os.Rename(arch, work)
+			if rollbackErr != nil {
+				fmt.Fprintf(stderr, "close-out: cannot clear ACTIVE after archiving: %v; rollback %s -> %s also failed: %v\n", err, arch, work, rollbackErr)
+			} else {
+				fmt.Fprintf(stderr, "close-out: cannot clear ACTIVE; archive move rolled back: %v\n", err)
+			}
+			return 1
 		}
+		fmt.Fprintf(stdout, "close-out: archived %s -> %s and cleared ACTIVE\n", slug, filepath.ToSlash(arch))
+		return 0
 	}
 	fmt.Fprintf(stdout, "close-out: archived %s -> %s (ACTIVE pointed elsewhere: left as-is)\n", slug, filepath.ToSlash(arch))
 	return 0

package/engine/internal/lib/closeout_test.go

@@ -0,0 +1,99 @@
+package lib
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func runCloseOut(t *testing.T, root string, args ...string) (int, string) {
+	t.Helper()
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := CloseOut(root, args, stdout, stderr)
+	return code, stdout.String() + stderr.String()
+}
+
+func TestCloseOutRejectsWorkspaceSymlinkEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "work"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "work", "feat")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	writeFile(t, filepath.Join(outside, "state.md"), "outside\n")
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "invalid workspace") {
+		t.Fatalf("missing workspace diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(outside, "state.md")) {
+		t.Fatal("close-out moved a workspace through an external symlink")
+	}
+}
+
+func TestCloseOutRejectsArchiveSymlinkEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n")
+	if err := os.Symlink(outside, filepath.Join(root, "archive")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "invalid archive") {
+		t.Fatalf("missing archive diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(root, "work", "feat", "state.md")) {
+		t.Fatal("close-out moved the workspace through an external archive symlink")
+	}
+	if entries, err := os.ReadDir(outside); err != nil {
+		t.Fatal(err)
+	} else if len(entries) != 0 {
+		t.Fatalf("outside archive changed: %v", entries)
+	}
+}
+
+func TestCloseOutRollsBackArchiveWhenActiveCannotBeCleared(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("permission model differs on Windows")
+	}
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n")
+	writeFile(t, filepath.Join(root, "ACTIVE"), "feat\n")
+	if err := os.MkdirAll(filepath.Join(root, "archive"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(root, 0o555); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = os.Chmod(root, 0o755) }()
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 1 {
+		t.Fatalf("close-out = %d, want 1\n%s", code, out)
+	}
+	if !strings.Contains(out, "archive move rolled back") {
+		t.Fatalf("missing rollback diagnostic:\n%s", out)
+	}
+	if !isFile(filepath.Join(root, "work", "feat", "state.md")) {
+		t.Fatal("workspace was not restored after ACTIVE clear failed")
+	}
+	if _, err := os.Lstat(filepath.Join(root, "archive", "feat")); !os.IsNotExist(err) {
+		t.Fatalf("archive remained after rollback: %v", err)
+	}
+	data, err := os.ReadFile(filepath.Join(root, "ACTIVE"))
+	if err != nil || string(data) != "feat\n" {
+		t.Fatalf("ACTIVE changed after rollback: %q, %v", data, err)
+	}
+}

package/engine/internal/lib/context.go

@@ -2,8 +2,10 @@ package lib
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -258,7 +260,10 @@ func upsertContextBlock(path, block string) error {
 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		return fmt.Errorf("create context dir: %w", err)
 	}
-	existingBytes, _ := os.ReadFile(path)
+	existingBytes, err := os.ReadFile(path)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return fmt.Errorf("read existing context file: %w", err)
+	}
 	existing := string(existingBytes)
 	var next string
 	start := strings.Index(existing, contextStart)

package/engine/internal/lib/dispatchwaive.go

@@ -0,0 +1,31 @@
+package lib
+
+import (
+	"fmt"
+	"io"
+)
+
+var dispatchWaiverReasons = map[string]struct{}{
+	"human-gate-before-dispatch": {},
+	"no-active-workspace":        {},
+	"no-eligible-work":           {},
+	"readiness-failed":           {},
+	"wrong-phase":                {},
+}
+
+func ValidDispatchWaiver(reason string) bool {
+	_, ok := dispatchWaiverReasons[reason]
+	return ok
+}
+
+// DispatchWaive validates the reason token used by the agent-dispatch hook.
+// The hook records the successful PostToolUse receipt; this command deliberately
+// owns no separate state.
+func DispatchWaive(args []string, stdout, stderr io.Writer) int {
+	if len(args) != 1 || !ValidDispatchWaiver(args[0]) {
+		fmt.Fprintln(stderr, "usage: devrites-engine dispatch-waive <human-gate-before-dispatch|no-active-workspace|no-eligible-work|readiness-failed|wrong-phase>")
+		return 2
+	}
+	fmt.Fprintf(stdout, "dispatch-waive: accepted %s\n", args[0])
+	return 0
+}

package/engine/internal/lib/dispatchwaive_test.go

@@ -0,0 +1,23 @@
+package lib
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func TestDispatchWaiveAcceptsOnlyKnownSingleReason(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if code := DispatchWaive([]string{"wrong-phase"}, &stdout, &stderr); code != 0 {
+		t.Fatalf("valid reason code=%d stderr=%s", code, stderr.String())
+	}
+	if !strings.Contains(stdout.String(), "accepted wrong-phase") {
+		t.Fatalf("missing receipt: %s", stdout.String())
+	}
+
+	stdout.Reset()
+	stderr.Reset()
+	if code := DispatchWaive([]string{"anything"}, &stdout, &stderr); code != 2 {
+		t.Fatalf("invalid reason code=%d, want 2", code)
+	}
+}

package/engine/internal/lib/extensions.go

@@ -481,7 +481,11 @@ func extensionsSync(extDir, projectDir string, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stderr, "extensions: not syncing: validation failed (run `devrites-engine extensions validate`)")
 		return code
 	}
-	exts, _ := discoverExtensions(extDir)
+	exts, err := discoverExtensions(extDir)
+	if err != nil {
+		fmt.Fprintf(stderr, "extensions: discovery failed: %v\n", err)
+		return 1
+	}
 	if len(exts) == 0 {
 		fmt.Fprintln(stdout, "extensions: nothing to sync")
 		return 0

package/engine/internal/lib/learnings.go

@@ -367,8 +367,11 @@ func countSubdirs(arch string) int {
 // anyFileNewerThan reports whether any regular file under arch was modified after t.
 func anyFileNewerThan(arch string, t time.Time) bool {
 	newer := false
-	_ = filepath.WalkDir(arch, func(_ string, d os.DirEntry, err error) error {
-		if err != nil || d.IsDir() {
+	err := filepath.WalkDir(arch, func(_ string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() {
 			return nil
 		}
 		if info, err := d.Info(); err == nil && info.Mode().IsRegular() && info.ModTime().After(t) {
@@ -377,6 +380,9 @@ func anyFileNewerThan(arch string, t time.Time) bool {
 		}
 		return nil
 	})
+	if err != nil && !os.IsNotExist(err) {
+		return true
+	}
 	return newer
 }
 

package/engine/internal/lib/ledger.go

@@ -92,7 +92,11 @@ func planFold(root, workspaceDir string, stderr io.Writer) ([]capabilityFold, in
 
 	var folds []capabilityFold
 	for _, capability := range order {
-		fold := foldCapability(root, capability, byCap[capability])
+		fold, err := foldCapability(root, capability, byCap[capability])
+		if err != nil {
+			fmt.Fprintf(stderr, "ledger: %v\n", err)
+			return nil, 2
+		}
 		folds = append(folds, fold)
 	}
 	return folds, 0
@@ -102,8 +106,17 @@ func planFold(root, workspaceDir string, stderr io.Writer) ([]capabilityFold, in
 // A requirement with no delta kind (a flat feature spec) folds as ADDED. ADDED and
 // MODIFIED are both an upsert (replace in place if the header exists, else append);
 // REMOVED deletes. Ordering: existing blocks keep their position, new blocks append.
-func foldCapability(root, capability string, deltas []Requirement) capabilityFold {
-	existing, _ := ParseSpec(ledgerCapabilityPath(root, capability))
+func foldCapability(root, capability string, deltas []Requirement) (capabilityFold, error) {
+	path := ledgerCapabilityPath(root, capability)
+	var existing *SpecDoc
+	if _, err := os.Stat(path); err == nil {
+		existing, err = ParseSpec(path)
+		if err != nil {
+			return capabilityFold{}, fmt.Errorf("read capability %s: %w", capability, err)
+		}
+	} else if !os.IsNotExist(err) {
+		return capabilityFold{}, fmt.Errorf("inspect capability %s: %w", capability, err)
+	}
 	var blocks []Requirement
 	idx := map[string]int{}
 	if existing != nil {
@@ -140,7 +153,7 @@ func foldCapability(root, capability string, deltas []Requirement) capabilityFol
 		}
 	}
 	fold.blocks = blocks
-	return fold
+	return fold, nil
 }
 
 // renderLedgerSpec assembles a capability's ledger spec.md from its resolved blocks.

package/engine/internal/lib/ledger_test.go

@@ -160,3 +160,27 @@ The system SHALL group appearance controls together.
 		}
 	}
 }
+
+func TestLedgerSyncDoesNotOverwriteUnreadableCapability(t *testing.T) {
+	root := t.TempDir()
+	capability := ledgerCapabilityPath(root, "billing")
+	if err := os.MkdirAll(capability, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	wsParent := t.TempDir()
+	writeSpec(t, wsParent, "feat", `## ADDED Requirements — capability: billing
+### Requirement: Invoice export
+The system SHALL export invoices.
+`)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := Ledger(root, []string{"sync", filepath.Join(wsParent, "feat")}, stdout, stderr)
+	if code != 2 {
+		t.Fatalf("sync code=%d, want 2; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "read capability billing") {
+		t.Fatalf("stderr=%q, want capability read error", stderr.String())
+	}
+	if info, err := os.Stat(capability); err != nil || !info.IsDir() {
+		t.Fatalf("capability was overwritten: info=%v err=%v", info, err)
+	}
+}

package/engine/internal/lib/mutationgate.go

@@ -1,6 +1,7 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -32,8 +33,11 @@ func MutationGate(root string, args []string, stdout, stderr io.Writer) int {
 	// Config files are looked up relative to the repo root, falling back to the
 	// working directory when this is not a git repo.
 	cwd, _ := os.Getwd()
-	base := gitToplevel(cwd)
-	if base == "" {
+	base, err := gitToplevel(cwd)
+	if errors.Is(err, errNotGitRepository) {
+		base = "."
+	} else if err != nil {
+		fmt.Fprintf(stderr, "mutation-gate: cannot resolve git worktree; using current directory: %v\n", err)
 		base = "."
 	}