devrites 5.14.3 → 6.0.0

package/engine/internal/gate/gate_test.go

@@ -436,6 +436,47 @@ func TestOpenBlockingQuestionGates(t *testing.T) {
 	}
 }
 
+func TestOpenBlockingQuestionGatesFieldPrefixesAreCaseInsensitive(t *testing.T) {
+	got := OpenBlockingQuestionGates([]byte("## Q-2026-01-001-003\nStatus: open\nGate: blocking\n"))
+	if strings.Join(got, ",") != "blocking" {
+		t.Fatalf("OpenBlockingQuestionGates=%v, want [blocking]", got)
+	}
+}
+
+func TestOpenBlockingQuestionGatesIgnoresFencedExamples(t *testing.T) {
+	const live = "## q-1\nstatus: open\ngate: blocking\n"
+	for _, tc := range []struct {
+		name string
+		data string
+		want string
+	}{
+		{"fenced only is documentation", "# Questions\n\n```markdown\n" + live + "```\n", ""},
+		{"tilde fenced only is documentation", "~~~markdown\n" + live + "~~~\n", ""},
+		{"unfenced control still blocks", live, "blocking"},
+		{"live question beside a fenced example", "```markdown\n" + live + "```\n\n## q-2\nstatus: open\ngate: escalating\n", "escalating"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := strings.Join(OpenBlockingQuestionGates([]byte(tc.data)), ","); got != tc.want {
+				t.Fatalf("OpenBlockingQuestionGates=%q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestOpenBlockingQuestionGatesRejectsUnmaskableInput(t *testing.T) {
+	gates, err := openBlockingQuestionGates([]byte("## q-1\nstatus: open\ngate: blocking\n\xff\n"))
+	if err == nil || len(gates) != 0 {
+		t.Fatalf("unmaskable input gates=%v err=%v, want no gates and an error", gates, err)
+	}
+}
+
+func TestOpenBlockingQuestionGatesFailsClosedOnUnmaskableInput(t *testing.T) {
+	got := OpenBlockingQuestionGates([]byte("## q-1\nstatus: open\ngate: blocking\n\xff\n"))
+	if len(got) == 0 {
+		t.Fatalf("OpenBlockingQuestionGates=%v for unparseable input, want a non-empty fail-closed result", got)
+	}
+}
+
 func TestCheckObservationUsesRetainedPhaseQuestionsReadinessAndReview(t *testing.T) {
 	root := t.TempDir()
 	workspace := writeReadinessFixture(t, root, "retained", "build")
@@ -762,3 +803,63 @@ func TestCheckLeavesProofLedgerOvershootAdvisory(t *testing.T) {
 		t.Fatalf("proof ledgers must stay advisory: %v", res.StateProblems)
 	}
 }
+
+func TestAcceptanceMapBlocksSpecsItCannotParse(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		spec string
+		want string
+	}{
+		{"canonical control", "# Spec\n\n## Acceptance criteria\n- AC-001: a.\n- AC-002: b.\n", "acceptance AC-001 is not referenced in test-plan.md"},
+		{"trailing colon", "# Spec\n\n## Acceptance criteria:\n- AC-001: a.\n", "## Acceptance criteria"},
+		{"h3 heading", "# Spec\n\n### Acceptance criteria\n- AC-001: a.\n", "## Acceptance criteria"},
+		{"suffixed heading", "# Spec\n\n## Acceptance criteria (draft)\n- AC-001: a.\n", "## Acceptance criteria"},
+		{"two digit id", "# Spec\n\n## Acceptance criteria\n- AC-01: a.\n", "AC-###"},
+		{"four digit id", "# Spec\n\n## Acceptance criteria\n- AC-0001: a.\n", "AC-###"},
+		{"one digit id", "# Spec\n\n## Acceptance criteria\n- AC-1: a.\n", "AC-###"},
+		{"trailing heading whitespace", "# Spec\n\n## Acceptance criteria   \n- AC-001: a.\n", "acceptance AC-001 is not referenced in test-plan.md"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			root := t.TempDir()
+			workspace := writeReadinessFixture(t, root, "unparsed", "build")
+			testutil.WriteFile(t, filepath.Join(workspace, "spec.md"), tc.spec)
+			testutil.AppendFile(t, filepath.Join(workspace, "eng-review.md"), "\n"+mustReadinessBinding(t, root, "unparsed")+"\n")
+			result, err := Check(Readiness, root, "unparsed")
+			if err != nil {
+				t.Fatal(err)
+			}
+			joined := strings.Join(result.StateProblems, "\n")
+			if !result.Blocked || !strings.Contains(joined, "acceptance-map: ") || !strings.Contains(joined, tc.want) {
+				t.Fatalf("blocked=%v want acceptance-map problem containing %q, got %q", result.Blocked, tc.want, joined)
+			}
+		})
+	}
+}
+
+func TestAcceptanceMapBlocksPartiallyParsedSpecs(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		spec string
+		want string
+	}{
+		{"canonical id beside two digit id", "# Spec\n\n## Acceptance criteria\n- AC-001: a.\n- AC-02: b.\n", "AC-02"},
+		{"second acceptance heading", "# Spec\n\n## Acceptance criteria\n- AC-001: a.\n\n## Acceptance criteria (phase 2)\n- AC-002: b.\n", "## Acceptance criteria (phase 2)"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			root := t.TempDir()
+			workspace := writeReadinessFixture(t, root, "partial", "build")
+			testutil.WriteFile(t, filepath.Join(workspace, "spec.md"), tc.spec)
+			testutil.AppendFile(t, filepath.Join(workspace, "tasks.md"), "\nAC-001 AC-002\n")
+			testutil.AppendFile(t, filepath.Join(workspace, "test-plan.md"), "\nAC-001 AC-002\n")
+			testutil.AppendFile(t, filepath.Join(workspace, "eng-review.md"), "\n"+mustReadinessBinding(t, root, "partial")+"\n")
+			result, err := Check(Readiness, root, "partial")
+			if err != nil {
+				t.Fatal(err)
+			}
+			joined := strings.Join(result.StateProblems, "\n")
+			if !result.Blocked || !strings.Contains(joined, "acceptance-map: ") || !strings.Contains(joined, tc.want) {
+				t.Fatalf("blocked=%v want acceptance-map problem containing %q, got %q", result.Blocked, tc.want, joined)
+			}
+		})
+	}
+}

package/engine/internal/hostpack/hostpack.go

@@ -315,7 +315,7 @@ func ShouldRemoveOnUninstall(rel string, entries []string) bool {
 	return true
 }
 
-func MergeMarkerBlock(current, block []byte, begin, end string) []byte {
+func MergeMarkerBlock(current, block []byte, begin, end string) ([]byte, error) {
 	lines := strings.SplitAfter(string(current), "\n")
 	var out strings.Builder
 	inBlock := false
@@ -341,6 +341,9 @@ func MergeMarkerBlock(current, block []byte, begin, end string) []byte {
 		}
 		out.WriteString(line)
 	}
+	if inBlock {
+		return nil, fmt.Errorf("unterminated %s marker", begin)
+	}
 	if !found {
 		if out.Len() > 0 && !strings.HasSuffix(out.String(), "\n") {
 			out.WriteByte('\n')
@@ -351,7 +354,54 @@ func MergeMarkerBlock(current, block []byte, begin, end string) []byte {
 			out.WriteByte('\n')
 		}
 	}
-	return []byte(out.String())
+	return []byte(out.String()), nil
+}
+
+func StripMarkerBlock(data []byte, begin, end string) ([]byte, error) {
+	var out strings.Builder
+	inBlock := false
+	for _, line := range strings.SplitAfter(string(data), "\n") {
+		trim := strings.TrimSuffix(line, "\n")
+		trim = strings.TrimSuffix(trim, "\r")
+		switch trim {
+		case begin:
+			inBlock = true
+			continue
+		case end:
+			inBlock = false
+			continue
+		}
+		if !inBlock {
+			out.WriteString(line)
+		}
+	}
+	if inBlock {
+		return nil, fmt.Errorf("unterminated %s marker", begin)
+	}
+	return []byte(out.String()), nil
+}
+
+func ValidateMarkerBlocks(current []byte, merges ...MarkerMerge) error {
+	for _, merge := range merges {
+		if _, err := MergeMarkerBlock(current, nil, merge.Begin, merge.End); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func StripCodexConfigBlocks(data []byte) ([]byte, error) {
+	for _, markers := range [][2]string{
+		{CodexConfigMerge.Begin, CodexConfigMerge.End},
+		{"# BEGIN DEVRITES CODEX MCP", "# END DEVRITES CODEX MCP"},
+		{"### BEGIN DEVRITES CODEX MCP", "### END DEVRITES CODEX MCP"},
+	} {
+		var err error
+		if data, err = StripMarkerBlock(data, markers[0], markers[1]); err != nil {
+			return nil, err
+		}
+	}
+	return data, nil
 }
 
 func render(name string, data any) ([]byte, error) {

package/engine/internal/hostpack/hostpack_test.go

@@ -142,8 +142,14 @@ func TestAliasTemplateOutput(t *testing.T) {
 func TestMergeMarkerBlockIsIdempotent(t *testing.T) {
 	block := []byte("<!-- BEGIN DEVRITES CODEX -->\nDevRites\n<!-- END DEVRITES CODEX -->\n")
 	current := []byte("user\n\n<!-- BEGIN DEVRITES CODEX -->\nold\n<!-- END DEVRITES CODEX -->\n")
-	once := MergeMarkerBlock(current, block, "<!-- BEGIN DEVRITES CODEX -->", "<!-- END DEVRITES CODEX -->")
-	twice := MergeMarkerBlock(once, block, "<!-- BEGIN DEVRITES CODEX -->", "<!-- END DEVRITES CODEX -->")
+	once, err := MergeMarkerBlock(current, block, "<!-- BEGIN DEVRITES CODEX -->", "<!-- END DEVRITES CODEX -->")
+	if err != nil {
+		t.Fatal(err)
+	}
+	twice, err := MergeMarkerBlock(once, block, "<!-- BEGIN DEVRITES CODEX -->", "<!-- END DEVRITES CODEX -->")
+	if err != nil {
+		t.Fatal(err)
+	}
 	if string(once) != string(twice) {
 		t.Fatalf("merge not idempotent:\nonce:\n%s\ntwice:\n%s", once, twice)
 	}
@@ -186,3 +192,78 @@ func TestTemplateFSIsEmbedded(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestMergeMarkerBlockKeepsUserContentAfterUnterminatedBegin(t *testing.T) {
+	block := []byte("<!-- BEGIN X -->\nmanaged\n<!-- END X -->\n")
+	current := []byte("user intro\n\n<!-- BEGIN X -->\nstale\n\nIMPORTANT USER SECTION\nsecond line\n")
+	got, err := MergeMarkerBlock(current, block, "<!-- BEGIN X -->", "<!-- END X -->")
+	if err == nil {
+		t.Fatalf("unterminated BEGIN marker accepted, output:\n%s", got)
+	}
+	if got != nil {
+		t.Fatalf("expected no output on error, got:\n%s", got)
+	}
+}
+
+func TestStripMarkerBlockKeepsUserContentAfterUnterminatedBegin(t *testing.T) {
+	current := []byte("user intro\n\n<!-- BEGIN X -->\nstale\n\nIMPORTANT USER SECTION\nsecond line\n")
+	got, err := StripMarkerBlock(current, "<!-- BEGIN X -->", "<!-- END X -->")
+	if err == nil {
+		t.Fatalf("unterminated BEGIN marker accepted, output:\n%s", got)
+	}
+	if got != nil {
+		t.Fatalf("expected no output on error, got:\n%s", got)
+	}
+}
+
+func TestStripMarkerBlockRemovesBalancedBlock(t *testing.T) {
+	current := []byte("a\n<!-- BEGIN X -->\nmanaged\n<!-- END X -->\nb\n")
+	got, err := StripMarkerBlock(current, "<!-- BEGIN X -->", "<!-- END X -->")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "a\nb\n" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestValidateMarkerBlocksRejectsAnyUnterminatedBlock(t *testing.T) {
+	current := []byte("intro\n" + PiAgentsMerge.Begin + "\nold\nKEEP ME\n")
+	err := ValidateMarkerBlocks(current, CodexAgentsMerge, PiAgentsMerge)
+	if err == nil {
+		t.Fatal("unterminated PI marker accepted alongside a balanced Codex target")
+	}
+	if !strings.Contains(err.Error(), PiAgentsMerge.Begin) {
+		t.Fatalf("error does not name the unterminated marker: %v", err)
+	}
+}
+
+func TestValidateMarkerBlocksAcceptsBalancedBlocks(t *testing.T) {
+	current := []byte("a\n" + CodexAgentsMerge.Begin + "\nx\n" + CodexAgentsMerge.End + "\nb\n")
+	if err := ValidateMarkerBlocks(current, CodexAgentsMerge, PiAgentsMerge, DevinAgentsMerge); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestStripCodexConfigBlocksRejectsUnterminatedBlock(t *testing.T) {
+	current := []byte(CodexConfigMerge.Begin + "\nold\n[user]\nkeep = 1\n")
+	got, err := StripCodexConfigBlocks(current)
+	if err == nil {
+		t.Fatalf("unterminated BEGIN marker accepted, output:\n%s", got)
+	}
+	if !strings.Contains(err.Error(), CodexConfigMerge.Begin) {
+		t.Fatalf("error does not name the unterminated marker: %v", err)
+	}
+}
+
+func TestStripCodexConfigBlocksRemovesCurrentAndLegacyBlocks(t *testing.T) {
+	current := []byte("a = 1\n" + CodexConfigMerge.Begin + "\nx\n" + CodexConfigMerge.End +
+		"\n# BEGIN DEVRITES CODEX MCP\ny\n# END DEVRITES CODEX MCP\n### BEGIN DEVRITES CODEX MCP\nz\n### END DEVRITES CODEX MCP\nb = 2\n")
+	got, err := StripCodexConfigBlocks(current)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != "a = 1\nb = 2\n" {
+		t.Fatalf("got %q", got)
+	}
+}

package/engine/internal/install/apply.go

@@ -148,6 +148,8 @@ func (r *runner) installFile(src, rel string) error {
 
 func (r *runner) installData(data []byte, rel string) error {
 	dest := filepath.Join(r.target, filepath.FromSlash(rel))
+	sum := sha256.Sum256(data)
+	hash := fmt.Sprintf("sha256:%x", sum[:])
 	action := "install"
 	if exists(dest) {
 		record, managed := r.prev[rel]
@@ -159,13 +161,22 @@ func (r *runner) installData(data []byte, rel string) error {
 		case r.opts.Force:
 			action = "overwrite(force)"
 		default:
-			if r.opts.DryRun {
-				fmt.Fprintf(r.opts.Stdout, "  [skip] %s (exists, not DevRites-managed)\n", rel)
+			// A run that dies before writeManifest leaves the tree populated with
+			// no ownership record, so every residue file reaches this branch as
+			// foreign. When it already holds the payload bytes, adopt it instead
+			// of skipping it: that is what makes the retry self-healing and keeps
+			// the follow-on uninstall able to remove the tree.
+			if snapshot, ok := r.preflight[filepath.ToSlash(rel)]; ok && !snapshot.missing && snapshot.hash == hash {
+				action = "adopt"
 			} else {
-				fmt.Fprintf(r.opts.Stderr, "warning: skip %s (exists, not DevRites-managed; use --force to overwrite)\n", rel)
+				if r.opts.DryRun {
+					fmt.Fprintf(r.opts.Stdout, "  [skip] %s (exists, not DevRites-managed)\n", rel)
+				} else {
+					fmt.Fprintf(r.opts.Stderr, "warning: skip %s (exists, not DevRites-managed; use --force to overwrite)\n", rel)
+				}
+				r.stats.skipped++
+				return nil
 			}
-			r.stats.skipped++
-			return nil
 		}
 	}
 	if r.opts.DryRun {
@@ -174,13 +185,15 @@ func (r *runner) installData(data []byte, rel string) error {
 		if err := r.recheckPath(rel); err != nil {
 			return err
 		}
-		if err := fsutil.WriteFileAtomic(dest, data, 0o644); err != nil {
-			return fmt.Errorf("cannot write %s: %w", rel, err)
+		if action != "adopt" {
+			if err := r.writeConfined(dest, data, 0o644); err != nil {
+				return fmt.Errorf("cannot write %s: %w", rel, err)
+			}
 		}
 	}
 	r.addManifest(rel)
-	r.addInstallRecord(rel, data)
-	if action == "install" {
+	r.addInstallRecord(rel, hash)
+	if action == "install" || action == "adopt" {
 		r.stats.installed++
 	} else {
 		r.stats.overwrote++
@@ -188,16 +201,46 @@ func (r *runner) installData(data []byte, rel string) error {
 	return nil
 }
 
+// writeConfined writes dest, which must lie under the install target, through
+// a root opened on the target so a directory component replaced by a symlink
+// after the path recheck cannot redirect the write.
+func (r *runner) writeConfined(dest string, data []byte, perm fs.FileMode) error {
+	rel, err := filepath.Rel(r.target, dest)
+	if err != nil {
+		return err
+	}
+	root, err := os.OpenRoot(r.target)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = root.Close() }()
+	return fsutil.WriteFileAtomicIn(root, rel, data, perm)
+}
+
+// removeConfined removes dest, which must lie under the install target,
+// through a root opened on the target.
+func (r *runner) removeConfined(dest string) error {
+	rel, err := filepath.Rel(r.target, dest)
+	if err != nil {
+		return err
+	}
+	root, err := os.OpenRoot(r.target)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = root.Close() }()
+	return root.Remove(rel)
+}
+
 func (r *runner) addManifest(rel string) {
 	r.manifest = append(r.manifest, filepath.ToSlash(rel))
 }
 
-func (r *runner) addInstallRecord(rel string, data []byte) {
+func (r *runner) addInstallRecord(rel, hash string) {
 	if r.records == nil {
 		r.records = map[string]string{}
 	}
-	sum := sha256.Sum256(data)
-	r.records[filepath.ToSlash(rel)] = fmt.Sprintf("sha256:%x", sum[:])
+	r.records[filepath.ToSlash(rel)] = hash
 }
 
 func (r *runner) installMarker(rel, text string) error {
@@ -270,18 +313,18 @@ func (r *runner) pruneDropped() error {
 					return err
 				}
 				if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
-					if err := stripHooksPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
+					if err := r.stripHooksConfined(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
 						return fmt.Errorf("strip hooks from %s: %w", merge.TargetRel, err)
 					}
 				} else if merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
 					if err := r.stripClaudeSettings(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), true); err != nil {
 						return fmt.Errorf("strip DevRites settings from %s: %w", merge.TargetRel, err)
 					}
-				} else if err := stripMarkerPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), merge.Begin, merge.End); err != nil {
+				} else if err := r.stripMarkerConfined(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), merge.Begin, merge.End); err != nil {
 					return fmt.Errorf("strip marker block from %s: %w", merge.TargetRel, err)
 				}
 			}
-			if err := os.Remove(dead); err != nil && !os.IsNotExist(err) {
+			if err := r.removeConfined(dead); err != nil && !os.IsNotExist(err) {
 				return fmt.Errorf("remove %s: %w", rel, err)
 			}
 			pruneEmptyDirs(filepath.Dir(dead), r.target)
@@ -312,7 +355,7 @@ func (r *runner) writeManifest() error {
 	if err := r.recheckPath(ManifestName); err != nil {
 		return err
 	}
-	return fsutil.WriteFileAtomic(filepath.Join(r.target, ManifestName), []byte(b.String()), 0o644)
+	return r.writeConfined(filepath.Join(r.target, ManifestName), []byte(b.String()), 0o644)
 }
 
 func (r *runner) flagsString() string {

package/engine/internal/install/binary.go

@@ -17,7 +17,11 @@ import (
 )
 
 func (r *runner) installBinary() error {
-	if !r.opts.WithBinary || os.Getenv("DEVRITES_NO_BINARY") == "1" {
+	if os.Getenv("DEVRITES_NO_BINARY") == "1" {
+		fmt.Fprintln(r.opts.Stdout, "  engine binary: skipped (DEVRITES_NO_BINARY=1).")
+		return nil
+	}
+	if !r.opts.WithBinary {
 		fmt.Fprintln(r.opts.Stdout, "  engine binary: skipped (--no-binary).")
 		return nil
 	}
@@ -147,6 +151,11 @@ func (r *runner) binaryInstallFailure(err error) error {
 		return err
 	}
 	fmt.Fprintf(r.opts.Stderr, "warning: engine binary: %v; continuing without it.\n", err)
+	consequence := "the devrites-engine command will not be on PATH"
+	if exists(binaryDest()) {
+		consequence = "the existing devrites-engine binary was kept"
+	}
+	fmt.Fprintf(r.opts.Stdout, "  engine binary: skipped (%v); %s.\n", err, consequence)
 	return nil
 }