devrites 7.3.0 → 7.3.2

package/engine/internal/lib/claims.go

@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -17,6 +18,7 @@ import (
 
 	"github.com/devrites/devrites/internal/devritespaths"
 	"github.com/devrites/devrites/internal/parallel"
+	"github.com/devrites/devrites/internal/safepath"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -262,6 +264,137 @@ func claimPathsOverlap(a, b string) bool {
 	return a == b || strings.HasPrefix(a, b+"/") || strings.HasPrefix(b, a+"/")
 }
 
+// Retained writer ownership belongs to the repository ledger, not a session or
+// TTL. Caller holds its lock; workspace moves use the same lock.
+func retainedWriterConflicts(root string, latest map[string]*claimRecord, paths []string, probe holderProbe) ([]*claimRecord, error) {
+	var conflicts []*claimRecord
+	var physical []string
+	seen := map[string]bool{}
+	for _, parent := range []string{"work", "archive"} {
+		base := filepath.Join(root, parent)
+		if parent == "archive" {
+			var err error
+			base, err = devritespaths.ArchiveDirChecked(root)
+			if err != nil {
+				return nil, err
+			}
+		}
+		if info, err := os.Lstat(base); os.IsNotExist(err) {
+			continue
+		} else if err != nil {
+			return nil, err
+		} else if !info.IsDir() {
+			return nil, fmt.Errorf("claim: workspace collection %s is not a canonical directory", base)
+		}
+		entries, err := os.ReadDir(base)
+		if err != nil {
+			return nil, err
+		}
+		for _, entry := range entries {
+			if entry.Type().IsRegular() {
+				continue
+			}
+			var dir string
+			if parent == "work" {
+				dir, err = devritespaths.ExistingCanonicalFeatureDirChecked(root, entry.Name())
+			} else {
+				dir, err = devritespaths.ExistingArchivedFeatureDirChecked(root, entry.Name())
+			}
+			if err != nil {
+				return nil, err
+			}
+			path := filepath.Join(dir, "dispatch.json")
+			if info, err := os.Lstat(path); os.IsNotExist(err) {
+				continue
+			} else if err != nil {
+				return nil, err
+			} else if !info.Mode().IsRegular() {
+				return nil, fmt.Errorf("claim: %s is not a regular dispatch ledger", path)
+			}
+			f, _, err := loadDispatchFile(path)
+			if err != nil {
+				return nil, fmt.Errorf("%s: %w", path, err)
+			}
+			for name, w := range f.Waves {
+				// A declared claim is write intent regardless of the host role label.
+				if w.State != "abandoned" || w.Claim == "" {
+					continue
+				}
+				rec := latest[w.Claim]
+				if rec == nil || (w.ClaimSession != "" && w.ClaimSession != rec.Session) {
+					return nil, fmt.Errorf("abandoned writer wave %s/%s has unknown claim %q", entry.Name(), name, w.Claim)
+				}
+				if rec.Released || seen[rec.ID] {
+					continue
+				}
+				seen[rec.ID] = true
+				if retainedWriterGone(probe, rec) {
+					continue
+				}
+				held, err := normalizeClaimPaths(rec.Paths)
+				if err != nil {
+					return nil, fmt.Errorf("abandoned writer claim %s has invalid paths: %w", rec.ID, err)
+				}
+				if physical == nil {
+					physical, err = physicalClaimPaths(root, paths)
+					if err != nil {
+						return nil, err
+					}
+				}
+				held, err = physicalClaimPaths(root, held)
+				if err != nil {
+					return nil, err
+				}
+				if slices.ContainsFunc(held, func(h string) bool {
+					return slices.ContainsFunc(physical, func(p string) bool { return claimPathsOverlap(h, p) })
+				}) {
+					conflicts = append(conflicts, rec)
+				}
+			}
+		}
+	}
+	return conflicts, nil
+}
+
+func retainedWriterGone(probe holderProbe, rec *claimRecord) bool {
+	valid := func(p claimProc) bool {
+		_, err := time.Parse(time.RFC3339, p.Start)
+		return p.PID > 1 && err == nil
+	}
+	if rec.Holder != nil {
+		if !valid(*rec.Holder) {
+			return false
+		}
+	} else {
+		for _, anchor := range rec.Anchors {
+			if !valid(anchor) {
+				return false
+			}
+		}
+	}
+	return probe.gone(rec)
+}
+
+func physicalClaimPaths(root string, paths []string) ([]string, error) {
+	project := root
+	if filepath.Base(root) == devritespaths.DevritesRootName {
+		project = filepath.Dir(root)
+	}
+	out := make([]string, 0, len(paths))
+	for _, path := range paths {
+		normalized, err := parallel.NormalizePath(path)
+		if err != nil {
+			return nil, err
+		}
+		resolved, err := safepath.ResolveExisting(filepath.Join(project, filepath.FromSlash(normalized)))
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, filepath.ToSlash(resolved))
+	}
+	return out, nil
+}
+
 // An unreadable line may be a live claim, so the conflict gates refuse to
 // answer rather than report a path free.
 const unparsedLedgerMsg = "claim: %d unparsed ledger line(s); cannot rule out a conflict, repair the claims ledger\n"
@@ -340,7 +473,7 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	// sessions cannot both pass the check and claim the same path.
 	id, code := "", 0
 	if err := state.WithLock(path+".lock", func() error {
-		id, code = claimAddLocked(path, session, reason, ttl, paths, stdout, stderr)
+		id, code = claimAddLocked(path, session, reason, ttl, paths, paths, stdout, stderr)
 		return nil
 	}); err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -349,7 +482,7 @@ func addClaimTargets(root, session, reason string, ttl int, raw, workspaces []st
 	return id, code
 }
 
-func claimAddLocked(path, session, reason string, ttl int, paths []string, stdout, stderr io.Writer) (string, int) {
+func claimAddLocked(path, session, reason string, ttl int, paths, admissionPaths []string, stdout, stderr io.Writer) (string, int) {
 	latest, order, bad, err := readClaims(path)
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -361,6 +494,15 @@ func claimAddLocked(path, session, reason string, ttl int, paths []string, stdou
 	}
 	now := time.Now().UTC()
 	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(filepath.Dir(path), latest, admissionPaths, probe)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return "", 3
+	}
+	if len(retained) > 0 {
+		printConflicts(stderr, retained)
+		return "", 3
+	}
 	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, now)), session, paths)
 	if len(conflicts) > 0 {
 		printConflicts(stderr, conflicts)
@@ -413,6 +555,8 @@ func claimRelease(root string, args []string, stdout, stderr io.Writer) int {
 	return 0
 }
 
+var errClaimAlreadyReleased = errors.New("already released")
+
 // releaseClaim marks session's claim id released and returns its path count.
 func releaseClaim(root, session, id string) (int, error) {
 	path := claimsPath(root)
@@ -428,7 +572,7 @@ func releaseClaim(root, session, id string) (int, error) {
 		return 0, fmt.Errorf("%q belongs to session %q, not %q", id, rec.Session, session)
 	}
 	if rec.Released {
-		return 0, fmt.Errorf("%q already released", id)
+		return 0, fmt.Errorf("%q %w", id, errClaimAlreadyReleased)
 	}
 	released := *rec
 	released.Released = true
@@ -523,6 +667,18 @@ func claimCheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
 		return 2
 	}
+	code := 0
+	if err := state.WithLock(claimsPath(root)+".lock", func() error {
+		code = claimCheckLocked(root, session, paths, stdout, stderr)
+		return nil
+	}); err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
+	return code
+}
+
+func claimCheckLocked(root, session string, paths []string, stdout, stderr io.Writer) int {
 	latest, order, bad, err := readClaims(claimsPath(root))
 	if err != nil {
 		fmt.Fprintf(stderr, "claim: %v\n", err)
@@ -532,7 +688,17 @@ func claimCheck(root string, args []string, stdout, stderr io.Writer) int {
 		fmt.Fprintf(stderr, unparsedLedgerMsg, bad)
 		return 2
 	}
-	conflicts := claimConflicts(newHolderProbe().withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
+	probe := newHolderProbe()
+	retained, err := retainedWriterConflicts(root, latest, paths, probe)
+	if err != nil {
+		fmt.Fprintf(stderr, "claim: %v\n", err)
+		return 2
+	}
+	if len(retained) > 0 {
+		printConflicts(stdout, retained)
+		return 3
+	}
+	conflicts := claimConflicts(probe.withoutGone(liveClaims(latest, order, time.Now().UTC())), session, paths)
 	if len(conflicts) > 0 {
 		printConflicts(stdout, conflicts)
 		return 3

package/engine/internal/lib/claims_holder.go

@@ -8,6 +8,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/devrites/devrites/internal/hostpack"
 )
 
 // claimAnchorAge separates a claiming session's long-lived host processes from
@@ -27,13 +29,6 @@ type procInfo struct {
 	comm  string
 }
 
-// shells outlive the agent sessions they launch (a terminal pane, a
-// multiplexer's login shell), so a shell never stands for the holder.
-var shells = map[string]bool{
-	"sh": true, "bash": true, "zsh": true, "fish": true, "dash": true, "ksh": true,
-	"tcsh": true, "csh": true, "nu": true, "pwsh": true, "powershell": true, "cmd": true,
-}
-
 // processTable lists running processes keyed by pid, or nil when the host
 // cannot say. Tests replace it.
 var processTable = psProcessTable
@@ -95,9 +90,12 @@ func newHolderProbe() holderProbe {
 	return holderProbe{table: table, host: host, self: lineage(table, os.Getppid())}
 }
 
-// anchors returns the caller's ancestors that started more than
-// claimAnchorAge before now: the session's host processes.
+// anchors retains long-lived ancestry only for an identified session.
+// Unknown writers must not be released merely because their launchers exit.
 func (p holderProbe) anchors(now time.Time) []claimProc {
+	if p.holder(now) == nil {
+		return nil
+	}
 	var out []claimProc
 	for _, proc := range p.self {
 		start, err := time.Parse(time.RFC3339, proc.Start)
@@ -108,13 +106,12 @@ func (p holderProbe) anchors(now time.Time) []claimProc {
 	return out
 }
 
-// holder returns the nearest anchor that is not a shell: the agent session
-// process that owns the claim. A shell or terminal multiplexer above it can
-// outlive the session, so only the session's own exit proves release.
-func (p holderProbe) holder(now time.Time) *claimProc {
-	for _, proc := range p.anchors(now) {
-		name := strings.TrimPrefix(filepath.Base(p.table[proc.PID].comm), "-")
-		if name != "" && !shells[name] {
+// holder identifies the native session independently of its age or wrappers.
+// Only native executable identities prove a session; generic runtimes do not.
+func (p holderProbe) holder(_ time.Time) *claimProc {
+	for _, proc := range p.self {
+		switch filepath.Base(p.table[proc.PID].comm) {
+		case "claude", "codex", hostpack.PiSettings.Host, hostpack.OmpConfig.Host, "devin", "dsh":
 			return &proc
 		}
 	}

package/engine/internal/lib/closeout.go

@@ -7,30 +7,27 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"runtime"
+	"strings"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/gate"
+	"github.com/devrites/devrites/internal/notes"
 	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 )
 
-// releaseLockBeforeRename drops the feature lock before the workspace rename on
-// Windows, which refuses to rename a directory while the lock file inside it is
-// open. renameWorkspace is the rename; both are variables so tests can inject the
-// platform decision and observe the lock at the moment of the rename.
-var (
-	releaseLockBeforeRename = runtime.GOOS == "windows"
-	renameWorkspace         = os.Rename
-)
+// renameWorkspace lets tests observe exclusion at the archive boundary.
+var renameWorkspace = os.Rename
 
-// CloseOut retires a shipped feature: it moves the feature directory into the
-// archive and, when the feature is still the active one, clears the ACTIVE cursor
-// so the next /rite-spec starts clean. The workspace is relocated, never deleted:
-// the audit trail is preserved under archive/<slug>.
+// CloseOut physically archives a workspace, including owner-authorized nonfinal
+// exits. Seal, Ship, Done, and shipped/sealed/done statuses must first satisfy
+// the final gates and retained prerequisites. The workspace is relocated, never
+// deleted: the audit trail is preserved under archive/<slug>.
 //
 // args is `<slug>`; root is the already-resolved .devrites directory. Exit codes:
 //
 //	0  archived (ACTIVE cleared if it pointed here)
+//	3  final prerequisites or a retained parallel lease block archiving
 //	4  no slug given, or the feature has no workspace
 //	5  an archive already exists at the destination: refuse to clobber it
 func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
@@ -70,14 +67,8 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 		return 5
 	}
 
-	// Hold the per-feature lock across the rename and the ACTIVE clear, as
-	// dispatch and the parallel lease ops do across their load-modify-save. A
-	// writer already holding the lock finishes its save before the rename, so
-	// that save is archived. On unix a writer queued behind this close-out
-	// acquires a lock file that now lives in the archive; state.WithFeatureLock
-	// reports state.ErrWorkspaceMoved and the writer does not run, so it cannot
-	// re-create work/<slug>. Windows cannot rename a directory that holds an
-	// open file, so there the lock is released just before the rename.
+	// Hold the stable feature lock through verification, rename, ACTIVE clear,
+	// and rollback so queued writers cannot revive an archived workspace.
 	code := 1
 	if err := parallel.WithControlLock(dv, func() error {
 		leased, err := parallel.WorkspaceLeased(dv, slug)
@@ -89,9 +80,11 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 			code = 3
 			return nil
 		}
-		return state.WithFeatureLockRelease(dv, slug, func(release func()) error {
-			code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
-			return nil
+		return state.WithFeatureLock(dv, slug, func() error {
+			return state.WithLock(claimsPath(dv)+".lock", func() error {
+				code = closeOutLocked(work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
+				return nil
+			})
 		})
 	}); err != nil {
 		fmt.Fprintf(stderr, "state close: %v\n", err)
@@ -103,7 +96,41 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 // closeOutLocked performs the rename and the conditional ACTIVE clear. It runs
 // under the feature lock held by CloseOut and reports an exit code rather than
 // an error, preserving CloseOut's documented exit codes.
-func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+func closeOutLocked(work, arch, archiveDir, archDisplay, active, slug string, stdout, stderr io.Writer) int {
+	root := filepath.Dir(active)
+	ledger, err := readWorkspaceArtifact(root, slug, "state.md")
+	if err != nil {
+		fmt.Fprintf(stderr, "state close: BLOCKED: %v\n", err)
+		return 3
+	}
+	lines := strings.Split(string(ledger), "\n")
+	phase, _ := state.CursorField(lines, "phase")
+	status, _ := state.CursorField(lines, "status")
+	phase = string(state.CanonicalPhase(phase))
+	final := phase == string(state.PhaseSeal) || phase == string(state.PhaseShip) || phase == string(state.PhaseDone) ||
+		status == "sealed" || status == "shipped" || status == "done"
+	if final {
+		result, err := gate.Check(gate.Seal, root, slug)
+		if err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: %v\n", err)
+			return 3
+		}
+		if result.Blocked {
+			fmt.Fprint(stdout, result.Render())
+			return 3
+		}
+		if err := VerifyReleaseUnion(root, slug); err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: release-union: %v\n", err)
+			return 3
+		}
+		if err := CheckFinalPrerequisites(root, slug); err != nil {
+			fmt.Fprintf(stderr, "state close: BLOCKED: final-prerequisites: %v\n", err)
+			return 3
+		}
+		if EvidenceFresh(root, []string{slug}, stdout, stderr) != 0 || !notes.SealCheck(root, slug, stdout) {
+			return 3
+		}
+	}
 	activeSlug, err := devritespaths.PhysicalActiveSlug(filepath.Dir(active))
 	if err != nil {
 		fmt.Fprintf(stderr, "state close: invalid ACTIVE cursor: %v\n", err)
@@ -115,9 +142,6 @@ func closeOutLocked(release func(), work, arch, archiveDir, archDisplay, active,
 		fmt.Fprintf(stderr, "state close: cannot create archive dir: %v\n", err)
 		return 1
 	}
-	if releaseLockBeforeRename {
-		release()
-	}
 	if err := renameWorkspace(work, arch); err != nil {
 		fmt.Fprintf(stderr, "state close: cannot archive %s -> %s: %v\n", work, arch, err)
 		return 1

package/engine/internal/lib/context_io.go

@@ -3,6 +3,7 @@ package lib
 import (
 	"bytes"
 	"crypto/sha256"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -34,10 +35,8 @@ func (s *contextSources) read(name string) ([]byte, error) {
 	if source, ok := s.files[name]; ok {
 		return source.data, source.err
 	}
-	var source contextSource
-	if source.err = contextParents(s.dir, name); source.err == nil {
-		source.data, source.err = readBoundedRegularFile(filepath.Join(s.dir, name), workspaceArtifactLimit)
-	}
+	source := contextSource{}
+	source.data, source.err = readContextArtifact(s.dir, name)
 	if source.err != nil {
 		source.err = fmt.Errorf("workspace artifact %s: %w", name, source.err)
 	}
@@ -48,6 +47,64 @@ func (s *contextSources) read(name string) ([]byte, error) {
 	return source.data, source.err
 }
 
+// Acquire workspace leaves through a confined root, not a checked absolute path.
+func readContextArtifact(dir, name string) ([]byte, error) {
+	if !filepath.IsLocal(name) {
+		return nil, fmt.Errorf("workspace artifact %q escapes workspace", name)
+	}
+	if err := contextParents(dir, name); err != nil {
+		return nil, err
+	}
+	ws, err := os.OpenRoot(dir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = ws.Close() }()
+	before, err := ws.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !before.Mode().IsRegular() {
+		return nil, errors.New("artifact is not a regular file")
+	}
+	if before.Size() < 0 || before.Size() > workspaceArtifactLimit {
+		return nil, fmt.Errorf("artifact exceeds %s limit", byteLimitName(workspaceArtifactLimit))
+	}
+	file, err := ws.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !opened.Mode().IsRegular() || opened.Size() != before.Size() || !os.SameFile(before, opened) {
+		return nil, errors.New("artifact changed type while opening")
+	}
+	body, err := io.ReadAll(io.LimitReader(file, workspaceArtifactLimit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(body)) > workspaceArtifactLimit {
+		return nil, fmt.Errorf("artifact exceeds %s limit", byteLimitName(workspaceArtifactLimit))
+	}
+	after, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	current, err := ws.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !after.Mode().IsRegular() || after.Size() != opened.Size() || after.Size() != int64(len(body)) ||
+		!os.SameFile(opened, after) || !current.Mode().IsRegular() || !os.SameFile(opened, current) ||
+		current.Size() != after.Size() {
+		return nil, errors.New("artifact changed size or type while reading")
+	}
+	return body, nil
+}
+
 // Reject even in-workspace parent links: managed paths name actual directories.
 func contextParents(dir, rel string) error {
 	parent := filepath.Dir(rel)
@@ -169,3 +226,30 @@ func publishContext(featureDir string, opts contextOpts, body []byte) (out strin
 	}
 	return out, false, nil
 }
+
+// Caller holds the feature lock; a wave/role read-set is never replaced.
+func retainPacketContext(workspace, name string, body []byte) error {
+	rel := filepath.Join("packets", name)
+	if err := contextParents(workspace, rel); err != nil {
+		return err
+	}
+	prior, err := (&contextSources{dir: workspace}).read(rel)
+	if err == nil {
+		if !bytes.Equal(prior, body) {
+			return fmt.Errorf("%s already retains a different context; render the new read-set under a new wave", rel)
+		}
+		return nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	ws, err := os.OpenRoot(workspace)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = ws.Close() }()
+	if err := ws.MkdirAll("packets", 0o755); err != nil {
+		return err
+	}
+	return fsutil.WriteFileAtomicIn(ws, rel, body, 0o600)
+}