dsh-tower 2.0.3 → 2.1.0-beta.1

package/lib/git.js

@@ -1,21 +1,68 @@
+import { TowerToolError } from '../domain/errors.js'
 // Minimal git port: array arguments only, bounded output, no shell.
-import { execFile } from 'node:child_process'
+import { execFile } from '../adapters/vcs-git.js'
 import path from 'node:path'
 
 const GIT_TIMEOUT_MS = 15000
 const MAX_BUFFER = 16 * 1024 * 1024
+let configuredTimeoutMs = GIT_TIMEOUT_MS
 
-export class GitError extends Error {
-  constructor(args, detail, code, meta = {}) {
-    super(`git ${args.join(' ')} failed: ${detail}`)
-    this.name = 'GitError'
-    this.code = code
-    this.timedOut = meta.timedOut === true
-    this.bufferOverflow = meta.bufferOverflow === true
-    this.stdout = meta.stdout ?? ''
+/** @typedef {{ timeoutMs?: number, maxBuffer?: number }} GitOptions */
+/** @typedef {{ path: string, branch?: string, head?: string }} WorktreeEntry */
+
+/** Override the default Git timeout from resolved Tower config. */
+export function setGitTimeout(ms) {
+  const value = Number(ms)
+  if (Number.isFinite(value) && value >= 1000) configuredTimeoutMs = value
+}
+
+/** Process default retained for manual adapter use; Tower instances pass their own. */
+export function configuredGitTimeout() {
+  return configuredTimeoutMs
+}
+
+const BLOCKED_GIT_ENV = new Set([
+  'GIT_DIR',
+  'GIT_WORK_TREE',
+  'GIT_INDEX_FILE',
+  'GIT_OBJECT_DIRECTORY',
+  'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+  'GIT_COMMON_DIR',
+  'GIT_NAMESPACE',
+  'GIT_PREFIX',
+  'GIT_CEILING_DIRECTORIES',
+  'GIT_CONFIG_GLOBAL',
+  'GIT_CONFIG_SYSTEM',
+  'GIT_CONFIG_NOSYSTEM',
+  'GIT_DISCOVERY_ACROSS_FILESYSTEM',
+  'GIT_QUARANTINE_PATH',
+])
+
+/**
+ * Git must not inherit a repository redirect from the DSH process environment.
+ * @param {NodeJS.ProcessEnv} [source]
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function gitEnv(source = process.env) {
+  /** @type {NodeJS.ProcessEnv} */
+  const env = {}
+  for (const [key, value] of Object.entries(source)) {
+    if (BLOCKED_GIT_ENV.has(key)) continue
+    env[key] = value
   }
+  return env
 }
 
+import { GitError } from '../domain/errors.js'
+export { GitError }
+
+/**
+ * Run one git command with bounded output and no shell.
+ * @param {string} cwd
+ * @param {string[]} args
+ * @param {GitOptions} [options]
+ * @returns {Promise<string>}
+ */
 export function git(cwd, args, options = {}) {
   return new Promise((resolve, reject) => {
     execFile(
@@ -23,10 +70,10 @@ export function git(cwd, args, options = {}) {
       args,
       {
         cwd,
-        timeout: options.timeoutMs ?? GIT_TIMEOUT_MS,
+        timeout: options.timeoutMs ?? configuredTimeoutMs,
         maxBuffer: options.maxBuffer ?? MAX_BUFFER,
         windowsHide: true,
-        env: process.env,
+        env: gitEnv(),
       },
       (error, stdout, stderr) => {
         if (error) {
@@ -48,6 +95,13 @@ export function git(cwd, args, options = {}) {
   })
 }
 
+/**
+ * Run git when its failure is not an error (existence probes).
+ * @param {string} cwd
+ * @param {string[]} args
+ * @param {GitOptions} [options]
+ * @returns {Promise<string | null>}
+ */
 export async function tryGit(cwd, args, options) {
   try {
     return await git(cwd, args, options)
@@ -59,17 +113,29 @@ export async function tryGit(cwd, args, options) {
 /**
  * Resolve an absolute caller path to the repository root, its common git dir
  * (shared by all worktrees), and the current branch of that checkout.
+ * @param {string} repoRoot
+ * @returns {Promise<{ root: string, commonDir: string, branch: string | null }>}
  */
 export async function resolveRepo(repoRoot) {
   if (typeof repoRoot !== 'string' || repoRoot.trim().length === 0) {
-    throw new Error('repoRoot is required')
+    throw new TowerToolError('repo-invalid', 'repoRoot is required')
   }
   if (!path.isAbsolute(repoRoot)) {
-    throw new Error(`repoRoot must be an absolute path: ${repoRoot}`)
+    throw new TowerToolError('repo-invalid', `repoRoot must be an absolute path: ${repoRoot}`)
+  }
+  let top
+  try {
+    top = await git(repoRoot, ['rev-parse', '--show-toplevel'])
+  } catch (error) {
+    throw new TowerToolError('repo-invalid', `not a git repository: ${repoRoot}`, { cause: error })
   }
-  const top = await git(repoRoot, ['rev-parse', '--show-toplevel'])
   const root = path.resolve(top)
-  const commonRaw = await git(root, ['rev-parse', '--git-common-dir'])
+  let commonRaw
+  try {
+    commonRaw = await git(root, ['rev-parse', '--git-common-dir'])
+  } catch (error) {
+    throw new TowerToolError('repo-invalid', `not a git repository: ${root}`, { cause: error })
+  }
   const commonDir = path.isAbsolute(commonRaw)
     ? path.resolve(commonRaw)
     : path.resolve(root, commonRaw)
@@ -81,25 +147,30 @@ export async function resolveRepo(repoRoot) {
   }
 }
 
+/** @param {string} root @returns {Promise<boolean>} */
 export async function hasAnyCommit(root) {
   const out = await tryGit(root, ['rev-list', '-n', '1', '--all'])
   return Boolean(out && out.trim())
 }
 
+/** @param {string} root @param {string} branch @returns {Promise<boolean>} */
 export async function localBranchExists(root, branch) {
   const out = await tryGit(root, ['show-ref', '--verify', '--quiet', `refs/heads/${branch}`])
   return out !== null
 }
 
+/** @param {string} cwd @param {string} ref @returns {Promise<string>} */
 export async function revParse(cwd, ref) {
   const out = await git(cwd, ['rev-parse', ref])
   return out.trim()
 }
 
+/** @param {string} cwd @param {string} branch @returns {Promise<boolean>} */
 export async function branchExists(cwd, branch) {
   return (await localBranchExists(cwd, branch)) === true
 }
 
+/** @param {string} cwd @returns {Promise<string | null>} */
 export async function currentBranch(cwd) {
   const out = await tryGit(cwd, ['symbolic-ref', '--short', '-q', 'HEAD'])
   return out && out.trim() ? out.trim() : null
@@ -110,9 +181,12 @@ export async function addWorktree(cwd, { path: worktreePath, branch, commit }) {
   return worktreePath
 }
 
+/** @param {string} cwd @returns {Promise<WorktreeEntry[]>} */
 export async function listWorktrees(cwd) {
   const out = await git(cwd, ['worktree', 'list', '--porcelain'])
+  /** @type {WorktreeEntry[]} */
   const entries = []
+  /** @type {WorktreeEntry | null} */
   let current = null
   for (const line of out.split('\n')) {
     if (line.startsWith('worktree ')) {
@@ -128,22 +202,26 @@ export async function listWorktrees(cwd) {
   return entries
 }
 
+/** @param {string} cwd @returns {Promise<boolean>} */
 export async function isClean(cwd) {
   const out = await git(cwd, ['status', '--porcelain'])
   return out.trim().length === 0
 }
 
+/** @param {string} cwd @returns {Promise<string | null>} */
 export async function currentCommonDir(cwd) {
   const raw = await tryGit(cwd, ['rev-parse', '--git-common-dir'])
   if (raw === null) return null
   return path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(cwd, raw)
 }
 
+/** @param {string} cwd @param {string} fromRef @returns {Promise<number>} */
 export async function countCommits(cwd, fromRef) {
   const out = await git(cwd, ['rev-list', '--count', `${fromRef}..HEAD`])
   return Number(out.trim() || 0)
 }
 
+/** @param {string} cwd @param {string} ancestor @param {string} descendant @returns {Promise<boolean>} */
 export async function isAncestor(cwd, ancestor, descendant) {
   const out = await tryGit(cwd, ['merge-base', '--is-ancestor', ancestor, descendant])
   return out !== null

package/lib/hmr.js

@@ -18,10 +18,11 @@
 //   `restartReason` means the whole process must be restarted.
 // - `runExclusive` rejects nested transactions; a tool call is never inside
 //   one, so a tool-triggered reload is safe.
-import { TowerToolError } from './errors.js'
+import { TowerToolError } from '../domain/errors.js'
 
 /** Entry ids Tower expects to be active after a reconciliation. */
 export const DEFAULT_REQUIRED_IDS = Object.freeze([
+  'tower-bundle',
   'tower',
   'tower-skills',
   'preset-tower-worker',
@@ -94,7 +95,7 @@ function warn(logger, message) {
  * @param {string[]} [options.requiredIds] Entry ids whose inactivity is reported as a failure.
  * @param {number} [options.delayMs] Delay before a scheduled reload runs.
  * @param {{ warn?: Function }} [options.logger] Optional logger for failed scheduled reloads.
- * @returns {{ available: boolean, requiredIds: string[], delayMs: number, status: Function, schedule: Function, runNow: Function }}
+ * @returns {{ available: boolean, requiredIds: string[], delayMs: number, status: Function, schedule: Function, runNow: Function, dispose: Function }}
  */
 export function createHmrBridge(ctx, options = {}) {
   const requiredIds = Object.freeze(normalizeRequiredIds(options.requiredIds))
@@ -186,7 +187,7 @@ export function createHmrBridge(ctx, options = {}) {
     get available() {
       return available()
     },
-    requiredIds,
+    requiredIds: [...requiredIds],
     delayMs,
     status,
     schedule,

package/lib/leases.js

@@ -11,7 +11,7 @@
 // Fail-closed protocol: a held, expired, or token-mismatched lease is reported,
 // never silently taken over. Only the token holder may release a lease, and
 // releasing an expired lease requires an explicit `force: true`.
-import fsp from 'node:fs/promises'
+import { fsp } from '../adapters/store-fs.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 
@@ -28,6 +28,7 @@ const LOCK_POLL_MS = 20
 const NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/
 
 function fail(code, message) {
+  /** @type {Error & {code?: string}} */
   const error = new Error(message)
   error.code = code
   throw error
@@ -147,7 +148,7 @@ async function lockIsStale(lockFile) {
   } catch {
     at = null
   }
-  const age = Number.isFinite(at) ? Date.now() - at : Date.now() - stat.mtimeMs
+  const age = at !== null && Number.isFinite(at) ? Date.now() - at : Date.now() - stat.mtimeMs
   return age > LOCK_STALE_MS
 }
 

package/lib/legacy.js

@@ -9,7 +9,7 @@
 //
 // `validateLegacyMap` is the audit-only mapping check: a map is a record that
 // legacy id X corresponds to DSH mission Y. It never adopts or restores work.
-import fsp from 'node:fs/promises'
+import { fsp } from '../adapters/store-fs.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 
@@ -23,6 +23,7 @@ const CODEX_ID_RE = /^T\d{4,}$/
 const SHA256_RE = /^[a-f0-9]{64}$/
 
 function fail(code, message) {
+  /** @type {Error & {code?: string}} */
   const error = new Error(message)
   error.code = code
   throw error
@@ -58,6 +59,10 @@ async function realpathOrResolve(target) {
   }
 }
 
+/**
+ * @param {string} error
+ * @param {'tower-codex'|'dsh'|null} [format]
+ */
 function invalidResult(error, format = null) {
   return {
     ok: false,
@@ -121,6 +126,11 @@ function validateReviews(reviews, id) {
   return null
 }
 
+/**
+ * @param {any} payload
+ * @param {'tower-codex'|'dsh'} format
+ * @returns {{error:string|null, missions:Array<{id:string,status:string,kind:string}>, missionIds:string[], paused:string[]}}
+ */
 function validateMissions(payload, format) {
   const statuses = format === 'tower-codex' ? CODEX_STATUSES : DSH_STATUSES
   const idRe = format === 'tower-codex' ? CODEX_ID_RE : DSH_ID_RE
@@ -130,17 +140,17 @@ function validateMissions(payload, format) {
   const seen = new Set()
   for (let index = 0; index < payload.missions.length; index += 1) {
     const mission = payload.missions[index]
-    if (!isPlainObject(mission)) return { error: `missions[${index}] must be an object` }
+    if (!isPlainObject(mission)) return { error: `missions[${index}] must be an object`, missions: [], missionIds: [], paused: [] }
     if (typeof mission.id !== 'string' || !idRe.test(mission.id)) {
-      return { error: `missions[${index}] has unsupported id ${JSON.stringify(mission.id)} (expected ${format === 'tower-codex' ? 'T####' : 'M#'})` }
+      return { error: `missions[${index}] has unsupported id ${JSON.stringify(mission.id)} (expected ${format === 'tower-codex' ? 'T####' : 'M#'})`, missions: [], missionIds: [], paused: [] }
     }
-    if (seen.has(mission.id)) return { error: `duplicate legacy mission id ${mission.id}` }
+    if (seen.has(mission.id)) return { error: `duplicate legacy mission id ${mission.id}`, missions: [], missionIds: [], paused: [] }
     seen.add(mission.id)
     if (typeof mission.status !== 'string' || !statuses.includes(mission.status)) {
-      return { error: `mission ${mission.id} has unknown status ${JSON.stringify(mission.status)}` }
+      return { error: `mission ${mission.id} has unknown status ${JSON.stringify(mission.status)}`, missions: [], missionIds: [], paused: [] }
     }
     if (mission.kind !== undefined && mission.kind !== 'build' && mission.kind !== 'survey') {
-      return { error: `mission ${mission.id} has unknown kind ${JSON.stringify(mission.kind)}` }
+      return { error: `mission ${mission.id} has unknown kind ${JSON.stringify(mission.kind)}`, missions: [], missionIds: [], paused: [] }
     }
     for (const problem of [
       validateScope(mission.scope, mission.id),
@@ -148,7 +158,7 @@ function validateMissions(payload, format) {
       validateDeps(mission.deps, mission.id),
       validateReviews(mission.reviews, mission.id),
     ]) {
-      if (problem) return { error: problem }
+      if (problem) return { error: problem, missions: [], missionIds: [], paused: [] }
     }
     missions.push({ id: mission.id, status: mission.status, kind: mission.kind ?? 'build' })
     missionIds.push(mission.id)
@@ -180,7 +190,8 @@ export function validateLegacySnapshot(payload) {
   }
   if (!Array.isArray(payload.missions)) return invalidResult('legacy snapshot has no missions array')
 
-  let format
+  /** @type {'tower-codex'|'dsh'} */
+  let format = 'dsh'
   if (payload.missions.length === 0) {
     format = isNonEmptyString(payload.baseBranch) ? 'tower-codex' : 'dsh'
   } else {
@@ -236,7 +247,7 @@ export function validateLegacySnapshot(payload) {
  * same bytes; it never writes state.json, never activates/adopts a mission, and
  * `paused` stays paused in the returned summary.
  *
- * @returns {{summary:object, snapshot:object}} where `snapshot` is the record
+ * @returns {Promise<{summary:object, snapshot:object}>} where `snapshot` is the record
  *   the caller may append to `state.legacySnapshots`.
  */
 export async function importLegacySnapshot(input = {}) {

package/lib/modeState.js

@@ -0,0 +1,39 @@
+// Owned mode state instead of a bare module-level Map.
+export class ModeState {
+  constructor(entries) {
+    this.map = new Map(entries ?? [])
+  }
+
+  has(key) {
+    return this.map.has(key)
+  }
+
+  get(key) {
+    return this.map.get(key)
+  }
+
+  set(key, value) {
+    this.map.set(key, value)
+    return this
+  }
+
+  delete(key) {
+    return this.map.delete(key)
+  }
+
+  values() {
+    return this.map.values()
+  }
+
+  entries() {
+    return this.map.entries()
+  }
+
+  replace(entries) {
+    this.map = new Map(entries ?? [])
+  }
+
+  clear() {
+    this.map.clear()
+  }
+}

package/lib/modeStore.js

@@ -3,20 +3,13 @@
 // The session-projection route needs zod schemas, which this bundle cannot
 // resolve from the DSH installation on every deployment; a small atomic JSON
 // store under DSH_HOME/tower-mode keeps the mode across restarts.
-import fs from 'node:fs'
+import { fs } from '../adapters/store-fs.js'
 import os from 'node:os'
 import path from 'node:path'
+import { acquireLockSync, readJsonSync, writeJsonAtomicSync } from './persistence.js'
 
 const DEFAULT_MAX_ENTRIES = 200
 
-function sleepSync(ms) {
-  try {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
-  } catch {
-    // best effort; a busy loop would be worse
-  }
-}
-
 function defaultStoreDir() {
   const home = process.env.DSH_HOME || path.join(os.homedir(), '.dsh')
   return path.join(home, 'tower-mode')
@@ -34,8 +27,7 @@ function storeFile(baseDir) {
 export function loadModes(baseDir) {
   const modes = new Map()
   try {
-    const raw = fs.readFileSync(storeFile(baseDir), 'utf8')
-    const parsed = JSON.parse(raw)
+    const parsed = readJsonSync(storeFile(baseDir))
     const entries = parsed && typeof parsed === 'object' && parsed.modes && typeof parsed.modes === 'object'
       ? parsed.modes
       : {}
@@ -52,6 +44,7 @@ export function loadModes(baseDir) {
           lastChange: value.lastChange && typeof value.lastChange === 'object' ? value.lastChange : null,
           lock,
           baseBranch: typeof value.baseBranch === 'string' && value.baseBranch.trim() ? value.baseBranch.trim() : null,
+          lastDisclosure: typeof value.lastDisclosure === 'string' ? value.lastDisclosure : null,
           at: Number(value.at) || 0,
         })
       }
@@ -62,33 +55,42 @@ export function loadModes(baseDir) {
   return modes
 }
 
-/** Persist the current modes atomically; failures never break the command. */
-export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES) {
+/** Persist the current modes atomically with a short cross-process lock. */
+export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES, options = {}) {
+  const dir = storeDir(baseDir)
+  const file = storeFile(baseDir)
+  const lock = path.join(dir, 'modes.lock')
+  const timeoutMs = Number(options.timeoutMs) > 0 ? Number(options.timeoutMs) : 5000
   try {
-    const dir = storeDir(baseDir)
     fs.mkdirSync(dir, { recursive: true })
-    const limit = Number.isInteger(maxEntries) && maxEntries > 0 ? maxEntries : DEFAULT_MAX_ENTRIES
-    const entries = [...modes.entries()]
-      .sort((a, b) => (Number(b[1]?.at) || 0) - (Number(a[1]?.at) || 0))
-      .slice(0, limit)
-    const payload = { version: 1, modes: Object.fromEntries(entries) }
-    const file = storeFile(baseDir)
-    const tmp = `${file}.tmp-${process.pid}`
-    fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8')
-    let lastError = null
-    for (let attempt = 0; attempt < 5; attempt += 1) {
+    const held = acquireLockSync(lock, { timeoutMs, invalidPidIsDead: true })
+    if (!held) return false
+    try {
+      const limit = Number.isInteger(maxEntries) && maxEntries > 0 ? maxEntries : DEFAULT_MAX_ENTRIES
+      let disk = {}
       try {
-        fs.renameSync(tmp, file)
-        return true
-      } catch (error) {
-        lastError = error
-        if (!['EPERM', 'EBUSY', 'EACCES'].includes(error?.code)) break
-        sleepSync(10 * (attempt + 1))
+        const parsed = readJsonSync(file)
+        if (parsed && typeof parsed === 'object' && parsed.modes && typeof parsed.modes === 'object') disk = parsed.modes
+      } catch {
+        disk = {}
+      }
+      // Merge by timestamp so two sessions saving concurrently do not erase
+      // each other's mode changes. A disk-only entry from another process is
+      // preserved unless this process has a newer record for the same key.
+      const merged = { ...disk }
+      for (const [key, value] of modes.entries()) {
+        const previous = merged[key]
+        if (!previous || (Number(value?.at) || 0) >= (Number(previous?.at) || 0)) merged[key] = value
       }
+      const entries = Object.entries(merged)
+        .sort((a, b) => (Number(b[1]?.at) || 0) - (Number(a[1]?.at) || 0))
+        .slice(0, limit)
+      const payload = { version: 1, modes: Object.fromEntries(entries) }
+      writeJsonAtomicSync(file, payload)
+      return true
+    } finally {
+      held.release()
     }
-    try { fs.unlinkSync(tmp) } catch {}
-    if (lastError) return false
-    return true
   } catch {
     return false
   }