devrites 5.14.4 → 6.0.0

package/engine/internal/install/preflight.go

@@ -190,9 +190,16 @@ func (r *runner) recheckPath(rel string) error {
 	if now != before {
 		return fmt.Errorf("refusing to change %s: file changed after preflight; retry the operation", rel)
 	}
+	if afterRecheckPath != nil {
+		afterRecheckPath(rel)
+	}
 	return nil
 }
 
+// afterRecheckPath lets tests swap a path component in the window between the
+// recheck and the write that follows it.
+var afterRecheckPath func(rel string)
+
 func inspectManagedPath(target, rel string) (pathSnapshot, error) {
 	native := filepath.FromSlash(rel)
 	if !filepath.IsLocal(native) {

package/engine/internal/install/uninstall.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/devrites/devrites/internal/hostpack"
 )
@@ -28,12 +29,18 @@ func (r *runner) uninstall() error {
 		return err
 	}
 
+	// Per-path would-be content for a dry run; a nil value means the file
+	// would be removed.
+	dryTree := map[string][]byte{}
 	for _, rel := range entries {
 		merge, ok := hostpack.ManagedMergeForMarker(rel)
 		if !ok {
 			continue
 		}
 		if r.opts.DryRun {
+			if err := dryRunStripMarker(dryTree, r.target, merge); err != nil {
+				return err
+			}
 			fmt.Fprintf(r.opts.Stdout, "  [merge-remove] %s\n", merge.DryRun)
 			continue
 		}
@@ -44,7 +51,7 @@ func (r *runner) uninstall() error {
 			return err
 		}
 		if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel {
-			if err := stripHooksPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
+			if err := r.stripHooksConfined(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel))); err != nil {
 				return fmt.Errorf("strip hooks from %s: %w", merge.TargetRel, err)
 			}
 			continue
@@ -55,7 +62,7 @@ func (r *runner) uninstall() error {
 			}
 			continue
 		}
-		if err := stripMarkerPath(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), merge.Begin, merge.End); err != nil {
+		if err := r.stripMarkerConfined(filepath.Join(r.target, filepath.FromSlash(merge.TargetRel)), merge.Begin, merge.End); err != nil {
 			return fmt.Errorf("strip marker block from %s: %w", merge.TargetRel, err)
 		}
 		// The Codex and pi AGENTS.md blocks share one target; record the strip
@@ -82,7 +89,7 @@ func (r *runner) uninstall() error {
 				if err := r.recheckPath(rel); err != nil {
 					return err
 				}
-				if err := os.Remove(dest); err != nil && !os.IsNotExist(err) {
+				if err := r.removeConfined(dest); err != nil && !os.IsNotExist(err) {
 					return fmt.Errorf("remove %s: %w", rel, err)
 				}
 			}
@@ -98,7 +105,7 @@ func (r *runner) uninstall() error {
 		if err := r.recheckPath(ManifestName); err != nil {
 			return err
 		}
-		_ = os.Remove(mf)
+		_ = r.removeConfined(mf)
 		dirs = append(dirs, filepath.Dir(mf))
 		for _, d := range dirs {
 			pruneEmptyDirs(d, r.target)
@@ -125,3 +132,35 @@ func (r *runner) uninstall() error {
 	}
 	return nil
 }
+
+// dryRunStripMarker runs the real marker strip against an in-memory view of
+// the target (tree), so a dry run follows the same sequence as the real
+// uninstall and reports the same errors without writing anything.
+func dryRunStripMarker(tree map[string][]byte, target string, merge hostpack.ManagedMerge) error {
+	if merge.MarkerRel == hostpack.LegacyCodexHooksMerge.MarkerRel || merge.TargetRel == hostpack.ClaudeSettingsMerge.TargetRel {
+		return nil
+	}
+	path := filepath.Join(target, filepath.FromSlash(merge.TargetRel))
+	data, seen := tree[path]
+	if !seen {
+		var err error
+		// #nosec G304 -- managed file path from the install manifest
+		if data, err = os.ReadFile(path); err != nil {
+			if os.IsNotExist(err) {
+				return nil
+			}
+			return fmt.Errorf("strip marker block from %s: read %s: %w", merge.TargetRel, path, err)
+		}
+	} else if data == nil {
+		return nil
+	}
+	next, err := hostpack.StripMarkerBlock(data, merge.Begin, merge.End)
+	if err != nil {
+		return fmt.Errorf("strip marker block from %s: %w in %s; fix it and rerun", merge.TargetRel, err, path)
+	}
+	if strings.TrimSpace(string(next)) == "" {
+		next = nil
+	}
+	tree[path] = next
+	return nil
+}

package/engine/internal/lib/claims.go

@@ -29,6 +29,9 @@ const (
 	claimDefaultTTL = 30
 	claimMinTTL     = 1
 	claimMaxTTL     = 240
+	// claimMaxLine bounds one ledger line; the reader's scanner cannot
+	// return a longer one.
+	claimMaxLine = 1 << 20
 )
 
 const claimUsage = `usage: devrites-engine claim <add|release|list|check> ...
@@ -86,7 +89,7 @@ func readClaims(path string) (latest map[string]*claimRecord, order []string, ba
 	}
 	defer func() { _ = f.Close() }()
 	scanner := bufio.NewScanner(f)
-	scanner.Buffer(make([]byte, 64<<10), 1<<20)
+	scanner.Buffer(make([]byte, 64<<10), claimMaxLine)
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		if line == "" {
@@ -103,7 +106,10 @@ func readClaims(path string) (latest map[string]*claimRecord, order []string, ba
 		r := rec
 		latest[rec.ID] = &r
 	}
-	return latest, order, bad, scanner.Err()
+	if err := scanner.Err(); err != nil {
+		return nil, nil, 0, fmt.Errorf("read %s: %w (a line may exceed %d bytes; repair or remove the oversized line by hand)", path, err, claimMaxLine)
+	}
+	return latest, order, bad, nil
 }
 
 func liveClaims(latest map[string]*claimRecord, order []string, now time.Time) []*claimRecord {
@@ -127,6 +133,9 @@ func appendClaim(path string, rec *claimRecord) error {
 	if err != nil {
 		return err
 	}
+	if len(line) >= claimMaxLine {
+		return fmt.Errorf("claim record is %d bytes once encoded, limit is %d; shorten --reason", len(line), claimMaxLine)
+	}
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600) // #nosec G304 -- path is the validated project claims ledger
 	if err != nil {
 		return err
@@ -198,6 +207,10 @@ func claimConflicts(live []*claimRecord, session string, paths []string) []*clai
 	return out
 }
 
+// An unreadable line may be a live claim, so the conflict gates refuse to
+// answer rather than report a path free.
+const unparsedLedgerMsg = "claim: %d unparsed ledger line(s); cannot rule out a conflict, repair the claims ledger\n"
+
 func printConflicts(w io.Writer, conflicts []*claimRecord) {
 	for _, rec := range conflicts {
 		fmt.Fprintf(w, "claim: BLOCKED: %s held by session %q until %s", strings.Join(rec.Paths, ","), rec.Session, rec.ExpiresAt)
@@ -264,11 +277,15 @@ func claimAdd(root string, args []string, stdout, stderr io.Writer) int {
 }
 
 func claimAddLocked(path, session, reason string, ttl int, paths []string, stdout, stderr io.Writer) int {
-	latest, order, _, err := readClaims(path)
+	latest, order, bad, err := readClaims(path)
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
 		return 2
 	}
+	if bad > 0 {
+		fmt.Fprintf(stderr, unparsedLedgerMsg, bad)
+		return 2
+	}
 	now := time.Now().UTC()
 	conflicts := claimConflicts(liveClaims(latest, order, now), session, paths)
 	if len(conflicts) > 0 {
@@ -411,11 +428,15 @@ func claimCheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
 		return 2
 	}
-	latest, order, _, err := readClaims(claimsPath(root))
+	latest, order, bad, err := readClaims(claimsPath(root))
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
 		return 2
 	}
+	if bad > 0 {
+		fmt.Fprintf(stderr, unparsedLedgerMsg, bad)
+		return 2
+	}
 	conflicts := claimConflicts(liveClaims(latest, order, time.Now().UTC()), session, paths)
 	if len(conflicts) > 0 {
 		printConflicts(stdout, conflicts)

package/engine/internal/lib/claims_test.go

@@ -183,6 +183,35 @@ func TestClaimLedgerToleratesMalformedLines(t *testing.T) {
 	}
 }
 
+func TestClaimCheckFailsClosedOnUnparsedLine(t *testing.T) {
+	root := claimTestRoot(t)
+	path := filepath.Join(root, ClaimsFile)
+	full, err := json.Marshal(&claimRecord{
+		ID: "cl-1", Session: "s-1", Paths: []string{"b.txt"},
+		ClaimedAt: "2026-01-01T00:00:00Z",
+		ExpiresAt: time.Now().Add(time.Hour).UTC().Format(time.RFC3339),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	truncated := string(full[:len(full)-12]) + "\n"
+	if err := os.WriteFile(path, []byte(truncated), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	latest, order, bad, err := readClaims(path)
+	if err != nil || bad != 1 || len(liveClaims(latest, order, time.Now())) != 0 {
+		t.Fatalf("premise: want 1 unparsed line and no live claims, got bad=%d live=%d err=%v", bad, len(liveClaims(latest, order, time.Now())), err)
+	}
+	code, out, errOut := runClaim(t, root, "check", "--session", "s-2", "b.txt")
+	if code == 0 || !strings.Contains(out+errOut, "unparsed") {
+		t.Fatalf("check over unreadable ledger must fail closed: code=%d out=%q err=%q", code, out, errOut)
+	}
+	code, out, errOut = runClaim(t, root, "add", "--session", "s-2", "b.txt")
+	if code == 0 || !strings.Contains(out+errOut, "unparsed") {
+		t.Fatalf("add over unreadable ledger must fail closed: code=%d out=%q err=%q", code, out, errOut)
+	}
+}
+
 func TestClaimAddConcurrentOverlapOneWins(t *testing.T) {
 	root := claimTestRoot(t)
 	const n = 8
@@ -208,3 +237,31 @@ func TestClaimAddConcurrentOverlapOneWins(t *testing.T) {
 		t.Fatalf("overlapping concurrent claims: %d succeeded, want exactly 1", wins)
 	}
 }
+
+func TestClaimAddRejectsOversizedRecord(t *testing.T) {
+	root := claimTestRoot(t)
+	ledger := filepath.Join(root, ClaimsFile)
+	reason := strings.Repeat("<", 190000)
+	code, _, errOut := runClaim(t, root, "add", "--session", "s1", "--reason", reason, "a.txt")
+	if code != 2 {
+		t.Fatalf("oversized add should exit 2, got %d stderr=%.200s", code, errOut)
+	}
+	if info, err := os.Stat(ledger); err == nil && info.Size() != 0 {
+		t.Fatalf("oversized add wrote %d bytes to the ledger", info.Size())
+	}
+	if code, _, e := runClaim(t, root, "list"); code != 0 {
+		t.Fatalf("list after refused add: %d %s", code, e)
+	}
+}
+
+func TestClaimReadNamesLedgerOnOversizedLine(t *testing.T) {
+	root := claimTestRoot(t)
+	ledger := filepath.Join(root, ClaimsFile)
+	if err := os.WriteFile(ledger, []byte(strings.Repeat("x", (1<<20)+10)+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	code, _, errOut := runClaim(t, root, "list")
+	if code != 2 || !strings.Contains(errOut, ledger) || !strings.Contains(errOut, "repair") {
+		t.Fatalf("list: code=%d stderr=%q", code, errOut)
+	}
+}

package/engine/internal/lib/closeout.go

@@ -1,15 +1,27 @@
 package lib
 
 import (
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"runtime"
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/state"
 )
 
+// releaseLockBeforeRename drops the feature lock before the workspace rename on
+// Windows, which refuses to rename a directory while the lock file inside it is
+// open. renameWorkspace is the rename; both are variables so tests can inject the
+// platform decision and observe the lock at the moment of the rename.
+var (
+	releaseLockBeforeRename = runtime.GOOS == "windows"
+	renameWorkspace         = os.Rename
+)
+
 // CloseOut retires a shipped feature: it moves the feature directory into the
 // archive and, when the feature is still the active one, clears the ACTIVE cursor
 // so the next /rite-spec starts clean. The workspace is relocated, never deleted:
@@ -30,8 +42,8 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 
 	work, err := devritespaths.ExistingFeatureDirChecked(dv, slug)
 	if err != nil {
-		if os.IsNotExist(err) {
-			fmt.Fprintf(stderr, "state close: no workspace for %s\n", slug)
+		if errors.Is(err, fs.ErrNotExist) {
+			fmt.Fprintf(stderr, "state close: no workspace for %s at %s\n", slug, filepath.Join(dv, "work", slug))
 			return 4
 		}
 		fmt.Fprintf(stderr, "state close: invalid workspace for %s: %v\n", slug, err)
@@ -62,13 +74,39 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 		return 5
 	}
 
+	// Hold the per-feature lock across the rename and the ACTIVE clear, as
+	// dispatch and the parallel lease ops do across their load-modify-save. A
+	// writer already holding the lock finishes its save before the rename, so
+	// that save is archived. On unix a writer queued behind this close-out
+	// acquires a lock file that now lives in the archive; state.WithFeatureLock
+	// reports state.ErrWorkspaceMoved and the writer does not run, so it cannot
+	// re-create work/<slug>. Windows cannot rename a directory that holds an
+	// open file, so there the lock is released just before the rename.
+	code := 1
+	if err := state.WithFeatureLockRelease(dv, slug, func(release func()) error {
+		code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, activeSlug, slug, stdout, stderr)
+		return nil
+	}); err != nil {
+		fmt.Fprintf(stderr, "state close: cannot lock feature %s: %v\n", slug, err)
+		return 1
+	}
+	return code
+}
+
+// closeOutLocked performs the rename and the conditional ACTIVE clear. It runs
+// under the feature lock held by CloseOut and reports an exit code rather than
+// an error, preserving CloseOut's documented exit codes.
+func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, activeSlug, slug string, stdout, stderr io.Writer) int {
 	// Fail closed: if the move does not happen, leave the cursor alone and do not
 	// claim success: a lost audit trail must never look like a clean close-out.
 	if err := os.MkdirAll(archiveDir, 0o755); err != nil {
 		fmt.Fprintf(stderr, "state close: cannot create archive dir: %v\n", err)
 		return 1
 	}
-	if err := os.Rename(work, arch); err != nil {
+	if releaseLockBeforeRename {
+		release()
+	}
+	if err := renameWorkspace(work, arch); err != nil {
 		fmt.Fprintf(stderr, "state close: cannot archive %s -> %s: %v\n", work, arch, err)
 		return 1
 	}

package/engine/internal/lib/closeout_test.go

@@ -2,11 +2,15 @@ package lib
 
 import (
 	"bytes"
+	"io"
 	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/devrites/devrites/internal/state"
 )
 
 func writeFile(t *testing.T, path, body string) {
@@ -120,3 +124,143 @@ func TestCloseOutRollsBackArchiveWhenActiveCannotBeCleared(t *testing.T) {
 		t.Fatalf("ACTIVE changed after rollback: %q, %v", data, err)
 	}
 }
+
+// TestCloseOutSerializesRenameBehindFeatureLock holds the per-feature lock in a
+// concurrent writer and requires close-out to wait for it. Without the lock the
+// rename lands while the writer is mid-save, and the writer's MkdirAll re-creates
+// work/<slug> after the workspace has been archived.
+//
+// The barrier is channel-based: `locked` proves the writer owns the lock before
+// close-out starts, and `release` hands the workspace back only after close-out
+// has stayed blocked for the bounded wait below. That wait never signals
+// success: success is proven by the archive carrying the writer's file and
+// work/<slug> being gone. It only bounds how long an unsynchronized rename may
+// take to appear, so a missing lock fails fast instead of hanging.
+func TestCloseOutSerializesRenameBehindFeatureLock(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n- Schema: 4\n")
+	writeFile(t, filepath.Join(root, "ACTIVE"), "feat\n")
+
+	// dispatch.json is what a concurrent `dispatch` mid-save writes; it is
+	// written the way saveDispatch writes it, MkdirAll included, so the
+	// resurrection path is exercised rather than simulated.
+	dispatchPath := filepath.Join(root, "work", "feat", "dispatch.json")
+	locked := make(chan struct{})
+	release := make(chan struct{})
+	wrote := make(chan error, 1)
+	writerDone := make(chan error, 1)
+	go func() {
+		writerDone <- state.WithFeatureLock(root, "feat", func() error {
+			close(locked)
+			<-release
+			// Still holding the lock, as dispatch does across its load-modify-save.
+			if err := os.MkdirAll(filepath.Dir(dispatchPath), 0o755); err != nil {
+				wrote <- err
+				return err
+			}
+			wrote <- state.AtomicWrite(dispatchPath, []byte(`{"phase":"start"}`), 0o600)
+			return nil
+		})
+	}()
+	<-locked
+
+	closeDone := make(chan int, 1)
+	go func() { closeDone <- CloseOut(root, []string{"feat"}, io.Discard, io.Discard) }()
+
+	select {
+	case code := <-closeDone:
+		t.Fatalf("state close returned %d while an in-process writer held %s: "+
+			"the rename is not serialized behind the feature lock, so a concurrent "+
+			"writer can re-create work/feat after the workspace has been archived",
+			code, filepath.Join("work", "feat", ".lock"))
+	case <-time.After(750 * time.Millisecond):
+		// Still blocked on the lock: correct.
+	}
+
+	// Release the writer only once close-out is demonstrably parked, then let the
+	// writer's save land. With the lock held across the rename, the rename cannot
+	// have happened yet, so this file is archived rather than left behind.
+	close(release)
+	if err := <-wrote; err != nil {
+		t.Fatalf("concurrent dispatch save: %v", err)
+	}
+	if err := <-writerDone; err != nil {
+		t.Fatalf("concurrent writer lock: %v", err)
+	}
+
+	var code int
+	select {
+	case code = <-closeDone:
+	case <-time.After(10 * time.Second):
+		t.Fatal("state close did not finish after the feature lock was released")
+	}
+	if code != 0 {
+		t.Fatalf("state close = %d, want 0 after the concurrent writer released the lock\n", code)
+	}
+	if !isFile(filepath.Join(root, "archive", "feat", "dispatch.json")) {
+		t.Fatal("concurrent dispatch.json was not archived: the rename did not run after the writer's save")
+	}
+	if _, err := os.Lstat(filepath.Join(root, "work", "feat")); !os.IsNotExist(err) {
+		t.Fatalf("work/feat was re-created by the concurrent writer after close-out: %v", err)
+	}
+	if data, err := os.ReadFile(filepath.Join(root, "ACTIVE")); err != nil || len(data) != 0 {
+		t.Fatalf("ACTIVE = %q (%v), want cleared", data, err)
+	}
+}
+
+// TestCloseOutReleasesFeatureLockBeforeRenameWhenPlatformRequires injects the
+// Windows decision and checks, from inside the rename, that the feature lock is
+// free: another locker acquires it while the workspace still exists. With the
+// lock still held at the rename that locker stays blocked.
+func TestCloseOutReleasesFeatureLockBeforeRenameWhenPlatformRequires(t *testing.T) {
+	root := t.TempDir()
+	writeFile(t, filepath.Join(root, "work", "feat", "state.md"), "inside\n- Schema: 4\n")
+	writeFile(t, filepath.Join(root, "ACTIVE"), "feat\n")
+
+	origRelease, origRename := releaseLockBeforeRename, renameWorkspace
+	t.Cleanup(func() { releaseLockBeforeRename, renameWorkspace = origRelease, origRename })
+	releaseLockBeforeRename = true
+
+	var lockFreeAtRename bool
+	renameWorkspace = func(from, to string) error {
+		acquired := make(chan struct{})
+		done := make(chan error, 1)
+		go func() {
+			done <- state.WithFeatureLock(root, "feat", func() error {
+				close(acquired)
+				return nil
+			})
+		}()
+		select {
+		case <-acquired:
+			lockFreeAtRename = true
+			<-done
+		case <-time.After(750 * time.Millisecond):
+			// Still blocked: the rename is about to run with the lock held.
+			// The locker is drained after CloseOut returns.
+			t.Cleanup(func() { <-done })
+		}
+		return os.Rename(from, to)
+	}
+
+	code, out := runCloseOut(t, root, "feat")
+	if code != 0 {
+		t.Fatalf("state close = %d, want 0\n%s", code, out)
+	}
+	if !lockFreeAtRename {
+		t.Fatal("the feature lock was still held when the workspace was renamed")
+	}
+	if !isFile(filepath.Join(root, "archive", "feat", "state.md")) {
+		t.Fatal("workspace was not archived")
+	}
+}
+
+func TestCloseOutMissingWorkspaceNamesResolvedPath(t *testing.T) {
+	root := t.TempDir()
+
+	code, out := runCloseOut(t, root, "ghost")
+	want := filepath.Join(root, "work", "ghost")
+	if code != 4 || !strings.Contains(out, "ghost") || !strings.Contains(out, want) {
+		t.Fatalf("state close missing workspace = %d, want exit 4 naming %q\n%s", code, want, out)
+	}
+}

package/engine/internal/lib/context.go

@@ -152,7 +152,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 		}
 		for _, rel := range workspaceList {
 			if writeContextEntry(&bundle, filepath.Join(featureDir, filepath.FromSlash(rel)),
-				"workspace/"+rel, seen) {
+				"workspace/"+rel, seen, false) {
 				loaded++
 			}
 		}
@@ -162,7 +162,7 @@ func RunContext(root string, args []string, stdout, stderr io.Writer) int {
 	if opts.role != "" {
 		rel := roleAgentPath(manifest, opts.role)
 		if writeContextEntry(&bundle, filepath.Join(skillsRoot, "..", "agents", filepath.FromSlash(rel)),
-			"agents/"+rel, seen) {
+			"agents/"+rel, seen, true) {
 			loaded++
 		} else {
 			// The agent contract is a pack file, not a workspace artifact: a
@@ -280,7 +280,7 @@ func expandIncludes(abs string, data []byte) []byte {
 	})
 }
 
-func writeContextEntry(bundle *strings.Builder, abs, label string, seen map[string]bool) bool {
+func writeContextEntry(bundle *strings.Builder, abs, label string, seen map[string]bool, expand bool) bool {
 	if seen[abs] {
 		return false
 	}
@@ -291,7 +291,11 @@ func writeContextEntry(bundle *strings.Builder, abs, label string, seen map[stri
 		fmt.Fprintf(bundle, "MISSING: %s\n\n", label)
 		return false
 	}
-	bundle.Write(expandIncludes(abs, data))
+	if expand {
+		bundle.Write(expandIncludes(abs, data))
+	} else {
+		bundle.Write(data)
+	}
 	if len(data) > 0 && data[len(data)-1] != '\n' {
 		bundle.WriteByte('\n')
 	}

package/engine/internal/lib/context_next_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -143,6 +144,9 @@ func TestDispatchWaveBarrier(t *testing.T) {
 	if c, _, _ := run("feat", "open", "--phase", "review", "--wave", "w1", "--role", "a", "--role", "b"); c != 0 {
 		t.Fatal("open failed")
 	}
+	if c, _, e := run("feat", "status"); c == 0 {
+		t.Fatalf("bare status should fail while a wave is open: %s", e)
+	}
 	if c, _, e := run("feat", "seal", "--wave", "w1"); c == 0 {
 		t.Fatalf("seal before all starts should fail: %s", e)
 	}
@@ -173,6 +177,9 @@ func TestDispatchWaveBarrier(t *testing.T) {
 	if c, o, _ := run("feat", "status", "--wave", "w1"); c != 0 || !strings.Contains(o.String(), "complete") {
 		t.Fatalf("status should report complete: %d %s", c, o)
 	}
+	if c, _, e := run("feat", "status"); c != 0 {
+		t.Fatalf("bare status should pass once every wave is complete: %s", e)
+	}
 	// metrics auto-recorded for start+return
 	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
 	if code := RunMetrics(root, []string{"summary", "feat"}, stdout, stderr); code != 0 ||
@@ -519,6 +526,75 @@ func TestDiffScopeAllowlist(t *testing.T) {
 	if code != 0 || !strings.Contains(stdout.String(), "2 changed") {
 		t.Fatalf("code=%d\n%s", code, stdout.String())
 	}
+
+	// A changed path whose own name contains the porcelain rename separator
+	// is checked as that full path, never as a fragment of it. Windows forbids
+	// '>' in file names, so the case cannot exist there.
+	if runtime.GOOS != "windows" {
+		sepRepo := t.TempDir()
+		initGitRepository(t, sepRepo)
+		runDiffScopeGit(t, sepRepo, "config", "user.email", "tests@example.invalid")
+		runDiffScopeGit(t, sepRepo, "config", "user.name", "DevRites Tests")
+		writeFile(t, filepath.Join(sepRepo, "docs", "secret -> notes.md"), "v1\n")
+		writeFile(t, filepath.Join(sepRepo, "docs", "secret"), "v1\n")
+		runDiffScopeGit(t, sepRepo, "add", "-A")
+		runDiffScopeGit(t, sepRepo, "commit", "-qm", "base")
+		writeFile(t, filepath.Join(sepRepo, "docs", "secret -> notes.md"), "changed out of contract\n")
+
+		stdout.Reset()
+		stderr.Reset()
+		code = RunCheckDiffScope(root, []string{"feat", "--allow", "notes.md", "--cwd", sepRepo}, stdout, stderr)
+		if code != 3 || !strings.Contains(stdout.String(), "BLOCKED: docs/secret -> notes.md outside allowlist") {
+			t.Fatalf("separator-named path checked as its tail: code=%d want 3 with the full path\n%s", code, stdout.String())
+		}
+		stdout.Reset()
+		stderr.Reset()
+		code = RunCheckDiffScope(root, []string{"feat", "--allow", "docs/secret -> notes.md", "--cwd", sepRepo}, stdout, stderr)
+		if code != 0 {
+			t.Fatalf("declared path rejected: code=%d\n%s", code, stdout.String())
+		}
+
+		// A rename reports its new name and a separator-named file reports its
+		// full name, even when both end in the same tail.
+		runDiffScopeGit(t, sepRepo, "mv", "docs/secret", "notes.md")
+		stdout.Reset()
+		stderr.Reset()
+		code = RunCheckDiffScope(root, []string{"feat", "--allow", "notes.md", "--cwd", sepRepo}, stdout, stderr)
+		if code != 3 || !strings.Contains(stdout.String(), "BLOCKED: docs/secret -> notes.md outside allowlist") ||
+			!strings.Contains(stdout.String(), "BLOCKED: docs/secret outside allowlist") {
+			t.Fatalf("rename and separator-named file not distinguishable: code=%d\n%s", code, stdout.String())
+		}
+	}
+
+	// An ordinary rename is reported by its new name, and its old name is
+	// checked against the allowlist too.
+	renameRepo := t.TempDir()
+	initGitRepository(t, renameRepo)
+	runDiffScopeGit(t, renameRepo, "config", "user.email", "tests@example.invalid")
+	runDiffScopeGit(t, renameRepo, "config", "user.name", "DevRites Tests")
+	writeFile(t, filepath.Join(renameRepo, "old.go"), "package old\n")
+	runDiffScopeGit(t, renameRepo, "add", "-A")
+	runDiffScopeGit(t, renameRepo, "commit", "-qm", "base")
+	runDiffScopeGit(t, renameRepo, "mv", "old.go", "new.go")
+	stdout.Reset()
+	stderr.Reset()
+	code = RunCheckDiffScope(root, []string{"feat", "--allow", "old.go", "--cwd", renameRepo}, stdout, stderr)
+	if code != 3 || !strings.Contains(stdout.String(), "BLOCKED: new.go outside allowlist") {
+		t.Fatalf("rename not reported by its new name: code=%d\n%s", code, stdout.String())
+	}
+	stdout.Reset()
+	stderr.Reset()
+	code = RunCheckDiffScope(root, []string{"feat", "--allow", "new.go", "--cwd", renameRepo}, stdout, stderr)
+	if code != 3 || !strings.Contains(stdout.String(), "BLOCKED: old.go outside allowlist") {
+		t.Fatalf("rename old name not checked: code=%d\n%s", code, stdout.String())
+	}
+}
+
+func runDiffScopeGit(t *testing.T, repo string, args ...string) {
+	t.Helper()
+	if out, err := runGitCommand(repo, nil, args...); err != nil {
+		t.Fatalf("git %v: %v\n%s", args, err, out)
+	}
 }
 
 func TestDispatchConcurrentReturnsCompleteWave(t *testing.T) {
@@ -572,3 +648,27 @@ func TestDispatchAbandonRecordsReason(t *testing.T) {
 		t.Fatalf("abandon reason not persisted: %v\n%s", err, data)
 	}
 }
+
+func TestContextWorkspaceIncludeMarkerStaysLiteral(t *testing.T) {
+	root, featureDir := newWorkspace(t, "build")
+	marker := "<!-- include:../../outside.txt -->"
+	writeFile(t, filepath.Join(featureDir, "spec.md"), marker+"\n")
+	writeFile(t, filepath.Join(root, "outside.txt"), "SENTINEL-OUTSIDE\n")
+	skills := newSkillsRoot(t)
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	code := RunContext(root, []string{"feat", "--phase", "build", "--skills-root", skills}, stdout, stderr)
+	if code != 0 {
+		t.Fatalf("code=%d\n%s%s", code, stdout, stderr)
+	}
+	bundle, err := os.ReadFile(filepath.Join(featureDir, "ctx", "build.bundle.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(bundle)
+	if strings.Contains(text, "SENTINEL-OUTSIDE") {
+		t.Fatalf("workspace include marker was expanded:\n%s", text)
+	}
+	if !strings.Contains(text, marker) {
+		t.Fatalf("workspace include marker not kept literal:\n%s", text)
+	}
+}