devrites 3.2.16 → 3.2.18

package/engine/internal/lib/runbook_context_test.go

@@ -60,6 +60,28 @@ func TestContextSyncRejectsUnsafePath(t *testing.T) {
 	}
 }
 
+func TestContextSyncDoesNotOverwriteUnreadableTarget(t *testing.T) {
+	project := t.TempDir()
+	root := filepath.Join(project, ".devrites")
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	target := filepath.Join(project, "AGENTS.md")
+	if err := os.Mkdir(target, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	stderr := &bytes.Buffer{}
+	if code := Context(root, []string{"sync", "AGENTS.md"}, &bytes.Buffer{}, stderr); code != 1 {
+		t.Fatalf("unreadable target code = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "read existing context file") {
+		t.Fatalf("stderr=%q, want target read error", stderr.String())
+	}
+	if info, err := os.Stat(target); err != nil || !info.IsDir() {
+		t.Fatalf("target was replaced: info=%v err=%v", info, err)
+	}
+}
+
 func TestContextSyncRefusesExternalWorkspaceOverride(t *testing.T) {
 	project := t.TempDir()
 	root := filepath.Join(project, ".devrites")
@@ -137,3 +159,24 @@ func TestRunbookDryRunDoesNotExecuteShell(t *testing.T) {
 		t.Fatal("dry run executed shell step")
 	}
 }
+
+func TestRunbookReportsCompletionStateWriteFailure(t *testing.T) {
+	root := filepath.Join(t.TempDir(), ".devrites")
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(t.TempDir(), "demo.yaml")
+	if err := os.WriteFile(path, []byte("steps:\n  - rite: build\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "runs"), []byte("blocks state directory"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := executeRunbook(root, path, 0, "test-run", false, stdout, stderr); code != 1 {
+		t.Fatalf("executeRunbook code = %d, want 1; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	if strings.Contains(stdout.String(), "completed") || !strings.Contains(stderr.String(), "runbook:") {
+		t.Fatalf("completion write failure was misreported; stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+}

package/engine/internal/lib/testintegrity.go

@@ -52,10 +52,10 @@ func TestIntegrity(root string, args []string, stdout, stderr io.Writer) int {
 	}
 
 	cwd, _ := os.Getwd()
-	gitRoot := gitToplevel(cwd)
-	if gitRoot == "" {
-		fmt.Fprintln(stderr, "test-integrity: not a git repo: gate skipped; inspect the test diff manually.")
-		return 0
+	gitRoot, err := gitToplevel(cwd)
+	if err != nil {
+		fmt.Fprintf(stderr, "test-integrity: cannot resolve git worktree: %v\n", err)
+		return 2
 	}
 
 	trees, err := captureSliceTreeRange(gitRoot, root, d)

package/engine/internal/lib/testintegrity_test.go

@@ -77,6 +77,21 @@ func TestIsSourceFileRecognisesCode(t *testing.T) {
 	}
 }
 
+func TestIntegrityFailsClosedWhenGitIsUnavailable(t *testing.T) {
+	newGitRepo(t)
+	root := workspace(t, "feat")
+	t.Setenv("PATH", t.TempDir())
+
+	var stdout, stderr bytes.Buffer
+	code := TestIntegrity(root, []string{"feat"}, &stdout, &stderr)
+	if code != 2 {
+		t.Fatalf("test-integrity = %d, want 2\nstdout: %s\nstderr: %s", code, stdout.String(), stderr.String())
+	}
+	if !strings.Contains(stderr.String(), "cannot resolve git worktree") {
+		t.Fatalf("missing fail-closed diagnostic: %s", stderr.String())
+	}
+}
+
 func TestIntegrityDetectsDeletionFromDirtySliceBaseline(t *testing.T) {
 	gitRoot := newGitRepo(t)
 	root := workspace(t, "feat")

package/engine/internal/lib/tickafk.go

@@ -23,7 +23,7 @@ import (
 //	5  the file is missing, or the field holds a non-numeric value
 func TickAfk(args []string, stdout, stderr io.Writer) int {
 	path := argAt(args, 0)
-	if path == "" || !isFile(path) {
+	if path == "" {
 		where := path
 		if where == "" {
 			where = "<unset>"
@@ -32,7 +32,11 @@ func TickAfk(args []string, stdout, stderr io.Writer) int {
 		return 5
 	}
 
-	data, _ := os.ReadFile(path)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		fmt.Fprintf(stderr, "tick-afk: read state.md at %s: %v\n", path, err)
+		return 5
+	}
 	lines := splitLinesNoTrailing(data)
 
 	remaining, found := readBudget(lines)

package/engine/internal/lib/util.go

@@ -1,42 +1,147 @@
 package lib
 
 import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 )
 
-// gitToplevel returns the absolute path of the git working tree containing dir,
-// or "" when dir is not inside a repository. The git-backed gates
-// (test-integrity and reconcile) skip rather than block when it is empty.
-func gitToplevel(dir string) string {
-	out, err := exec.Command("git", "-C", dir, "rev-parse", "--show-toplevel").Output()
+var errNotGitRepository = errors.New("not a git repository")
+
+const (
+	gitCommandTimeout = 30 * time.Second
+	gitOutputLimit    = 16 << 20
+)
+
+type cappedGitOutput struct {
+	bytes.Buffer
+	truncated bool
+}
+
+func (w *cappedGitOutput) Write(p []byte) (int, error) {
+	remaining := gitOutputLimit - w.Len()
+	if remaining > 0 {
+		if len(p) > remaining {
+			_, _ = w.Buffer.Write(p[:remaining])
+			w.truncated = true
+		} else {
+			_, _ = w.Buffer.Write(p)
+		}
+	} else {
+		w.truncated = true
+	}
+	return len(p), nil
+}
+
+type gitCommandError struct {
+	args     []string
+	output   string
+	exitCode int
+	err      error
+}
+
+func (e *gitCommandError) Error() string {
+	detail := strings.TrimSpace(e.output)
+	if detail == "" {
+		return fmt.Sprintf("git %s: %v", strings.Join(e.args, " "), e.err)
+	}
+	return fmt.Sprintf("git %s: %v: %s", strings.Join(e.args, " "), e.err, detail)
+}
+
+func (e *gitCommandError) Unwrap() error { return e.err }
+
+func runGitCommand(dir string, env []string, args ...string) ([]byte, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), gitCommandTimeout)
+	defer cancel()
+	commandArgs := append([]string{"-C", dir}, args...)
+	cmd := exec.CommandContext(ctx, "git", commandArgs...)
+	cmd.WaitDelay = 2 * time.Second
+	if env == nil {
+		env = os.Environ()
+	} else {
+		env = append([]string{}, env...)
+	}
+	cmd.Env = append(
+		env,
+		"GIT_TERMINAL_PROMPT=0",
+		"GCM_INTERACTIVE=never",
+		"GIT_PAGER=cat",
+		"PAGER=cat",
+		"LC_ALL=C",
+	)
+	var output cappedGitOutput
+	cmd.Stdout = &output
+	cmd.Stderr = &output
+	err := cmd.Run()
+	if err == nil {
+		return output.Bytes(), nil
+	}
+	code := -1
+	var exitErr *exec.ExitError
+	if errors.As(err, &exitErr) {
+		code = exitErr.ExitCode()
+	}
+	if ctx.Err() != nil {
+		err = ctx.Err()
+	}
+	detail := output.String()
+	if output.truncated {
+		detail += "\n[git output truncated]"
+	}
+	return nil, &gitCommandError{
+		args:     args,
+		output:   detail,
+		exitCode: code,
+		err:      err,
+	}
+}
+
+func gitErrorExitCode(err error) (int, bool) {
+	var commandErr *gitCommandError
+	if !errors.As(err, &commandErr) {
+		return 0, false
+	}
+	return commandErr.exitCode, commandErr.exitCode >= 0
+}
+
+// gitToplevel returns the absolute path of the Git working tree containing dir.
+// Repository absence is distinct from Git execution failure so integrity gates
+// can fail closed on a missing binary, corrupt repository, or poisoned runtime.
+func gitToplevel(dir string) (string, error) {
+	out, err := runGitCommand(dir, nil, "rev-parse", "--show-toplevel")
 	if err != nil {
-		return ""
+		var commandErr *gitCommandError
+		if errors.As(err, &commandErr) {
+			detail := strings.ToLower(commandErr.output)
+			if strings.Contains(detail, "not a git repository") ||
+				strings.Contains(detail, "not a git work tree") {
+				return "", errNotGitRepository
+			}
+		}
+		return "", err
+	}
+	root := strings.TrimSpace(string(out))
+	if root == "" {
+		return "", fmt.Errorf("git rev-parse returned an empty top-level path")
 	}
-	return filepath.Clean(strings.TrimSpace(string(out)))
+	return filepath.Clean(root), nil
 }
 
 // gitDiffNames lists the paths that differ, relative to gitRoot. With one ref it
 // diffs the working tree against that ref; with two it diffs the two tree objects.
-func gitDiffNames(gitRoot string, refs ...string) []string {
-	args := append([]string{"-C", gitRoot, "diff", "--name-only"}, refs...)
-	out, err := exec.Command("git", args...).Output()
+func gitDiffNames(gitRoot string, refs ...string) ([]string, error) {
+	args := append([]string{"diff", "--name-only"}, refs...)
+	out, err := runGitCommand(gitRoot, nil, args...)
 	if err != nil {
-		return nil
+		return nil, err
 	}
-	return splitLinesNoTrailing(out)
-}
-
-// stripASCIISpace removes every whitespace character from s (used to normalise an
-// ACTIVE pointer before comparing it to a slug).
-func stripASCIISpace(s string) string {
-	return strings.Map(func(r rune) rune {
-		if strings.ContainsRune(spaceChars, r) {
-			return -1
-		}
-		return r
-	}, s)
+	return splitLinesNoTrailing(out), nil
 }
 
 // isAllDigits reports whether s is a non-empty run of ASCII digits.

package/engine/internal/profile/profile.go

@@ -68,7 +68,11 @@ func Run(args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintln(stdout, path)
 		return 0
 	case "refresh":
-		p := derive(root, rootSHA, headSHA)
+		p, err := derive(root, rootSHA, headSHA)
+		if err != nil {
+			fmt.Fprintf(stderr, "devrites: profile cache refresh failed: %v\n", err)
+			return 1
+		}
 		if err := writeCache(path, p); err != nil {
 			fmt.Fprintf(stderr, "devrites: profile cache write failed: %v\n", err)
 			return 1
@@ -151,9 +155,12 @@ func writeCache(path string, p Profile) error {
 	return os.Rename(name, path)
 }
 
-func derive(root, rootSHA, headSHA string) Profile {
+func derive(root, rootSHA, headSHA string) (Profile, error) {
 	p := Profile{ProfileSchemaVersion: schemaVersion, RootSHA: rootSHA, HeadSHA: headSHA, Inputs: map[string]FileInfo{}}
-	entries, _ := os.ReadDir(root)
+	entries, err := os.ReadDir(root)
+	if err != nil {
+		return Profile{}, fmt.Errorf("read repository root: %w", err)
+	}
 	for _, e := range entries {
 		name := e.Name()
 		if strings.HasPrefix(name, ".git") || name == "node_modules" {
@@ -165,12 +172,15 @@ func derive(root, rootSHA, headSHA string) Profile {
 		p.TopLevel = append(p.TopLevel, name)
 	}
 	sort.Strings(p.TopLevel)
-	_ = filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
+	if err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
 		if err != nil {
-			return nil
+			return err
 		}
 		rel, err := filepath.Rel(root, path)
-		if err != nil || rel == "." {
+		if err != nil {
+			return err
+		}
+		if rel == "." {
 			return nil
 		}
 		rel = filepath.ToSlash(rel)
@@ -185,23 +195,27 @@ func derive(root, rootSHA, headSHA string) Profile {
 			p.Manifests = append(p.Manifests, rel)
 		}
 		if isProfileInput(rel) {
-			if info, ok := fileInfo(path); ok {
-				p.Inputs[rel] = info
+			info, err := fileInfo(path)
+			if err != nil {
+				return err
 			}
+			p.Inputs[rel] = info
 		}
 		return nil
-	})
+	}); err != nil {
+		return Profile{}, fmt.Errorf("walk repository: %w", err)
+	}
 	sort.Strings(p.Manifests)
-	return p
+	return p, nil
 }
 
-func fileInfo(path string) (FileInfo, bool) {
+func fileInfo(path string) (FileInfo, error) {
 	raw, err := os.ReadFile(path)
 	if err != nil {
-		return FileInfo{}, false
+		return FileInfo{}, fmt.Errorf("read profile input %s: %w", path, err)
 	}
 	sum := sha256.Sum256(raw)
-	return FileInfo{SHA256: hex.EncodeToString(sum[:]), Bytes: len(raw)}, true
+	return FileInfo{SHA256: hex.EncodeToString(sum[:]), Bytes: len(raw)}, nil
 }
 
 func cleanProfileInputs(root string) bool {

package/engine/internal/profile/profile_test.go

@@ -0,0 +1,13 @@
+package profile
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+func TestDeriveReportsUnreadableRoot(t *testing.T) {
+	_, err := derive(filepath.Join(t.TempDir(), "missing"), "root", "head")
+	if err == nil {
+		t.Fatal("derive succeeded for a missing repository root")
+	}
+}

package/engine/main.go

@@ -56,7 +56,8 @@ Usage:
   devrites-engine mutation-gate [slug]     Advisory: detect the mutation runner and scope it
   devrites-engine test-integrity [slug]    Gate: no test deleted, skipped, or de-asserted
   devrites-engine review-integrity [slug]  Gate: no adversarial review axis is silent (zero findings, no justification)
-  devrites-engine reconcile <sub> [slug]   A1 gate: snapshot|check|close the wright's source writes
+  devrites-engine dispatch-waive <reason>  Record a deterministic pre-dispatch STOP reason
+  devrites-engine reconcile <sub> [slug]   A1 gate: snapshot|check|restore-check|close the wright's source writes
   devrites-engine resolve <qid> "<ans>"    Resolve an open question; keep state.md consistent
   devrites-engine close-out <slug>         Archive a shipped feature and clear ACTIVE
   devrites-engine archive-search "<nouns>" Find prior shipped specs that overlap the query
@@ -238,6 +239,8 @@ func run(args []string, stdin io.Reader, stdout, stderr io.Writer) int {
 		return lib.TestIntegrity(root, args[1:], stdout, stderr)
 	case "review-integrity":
 		return lib.ReviewIntegrity(root, args[1:], stdout, stderr)
+	case "dispatch-waive":
+		return lib.DispatchWaive(args[1:], stdout, stderr)
 	case "reconcile":
 		return lib.Reconcile(root, args[1:], stdout, stderr)
 	case "resolve":

package/engine/testdata/golden/TestParityReconcile/close-window.golden

@@ -1,2 +1,3 @@
 exit 0
+reconcile: OK: every slice change matches the orchestrator allowlist; baseline retained for post-slice gates (run "reconcile close" afterward).
 reconcile: closed slice window for feat.

package/engine/testdata/golden/TestParityReconcile/not-git.golden

@@ -1 +1 @@
-exit 0
+exit 6

package/engine/testdata/golden/TestParityTestIntegrity/not-git.golden

@@ -1 +1 @@
-exit 0
+exit 2