dsh-tower 2.0.3 → 2.1.0-beta.1

package/lib/store.js

@@ -1,14 +1,31 @@
+import { TowerToolError } from '../domain/errors.js'
 // Durable repo-scoped store: exclusive lock + atomic JSON + append-only activity.
-import fsp from 'node:fs/promises'
+// The atomic/lock/JSON primitives are shared with the mode store (#56 P2b).
+import { fsp } from '../adapters/store-fs.js'
+import {
+  PROCESS_STARTED_AT,
+  acquireLock,
+  lockRecord,
+  readLock,
+} from './persistence.js'
 import path from 'node:path'
 import crypto from 'node:crypto'
 
+export {
+  readJson,
+  writeJsonAtomic,
+  writeJsonAtomicSync,
+  renameWithRetry,
+  appendJsonl,
+} from './persistence.js'
+
 export function pathsFor(commonDir) {
   const dir = path.join(commonDir, 'dsh-tower')
   return {
     dir,
     state: path.join(dir, 'state.json'),
     lock: path.join(dir, 'state.lock'),
+    gitLock: path.join(dir, 'git.lock'),
     activity: path.join(dir, 'activity.jsonl'),
   }
 }
@@ -26,55 +43,6 @@ export async function ensureDir(dir) {
   await fsp.mkdir(dir, { recursive: true })
 }
 
-export async function readJson(file) {
-  const text = await fsp.readFile(file, 'utf8')
-  try {
-    return JSON.parse(text)
-  } catch (error) {
-    throw new Error(`corrupt tower state at ${file}: ${error.message}`)
-  }
-}
-
-export async function writeJsonAtomic(file, value) {
-  const dir = path.dirname(file)
-  const tmp = path.join(dir, `.${path.basename(file)}.tmp-${process.pid}-${crypto.randomUUID()}`)
-  const handle = await fsp.open(tmp, 'w')
-  try {
-    await handle.writeFile(JSON.stringify(value, null, 2), 'utf8')
-    await handle.sync()
-  } finally {
-    await handle.close()
-  }
-  await renameWithRetry(tmp, file)
-}
-
-/**
- * Windows can reject a rename while an indexer, antivirus, or a concurrent
- * reader still holds the destination; retry briefly instead of failing a
- * successful mutation. The temp file is removed when the rename never lands.
- */
-async function renameWithRetry(tmp, file) {
-  for (let attempt = 0; ; attempt += 1) {
-    try {
-      await fsp.rename(tmp, file)
-      return
-    } catch (error) {
-      const transient = error?.code === 'EPERM' || error?.code === 'EBUSY' || error?.code === 'EACCES'
-      if (!transient || attempt >= 12) {
-        await fsp.unlink(tmp).catch(() => {})
-        throw error
-      }
-      await sleep(10 + attempt * 15)
-    }
-  }
-}
-
-export { renameWithRetry }
-
-export async function appendJsonl(file, value) {
-  await fsp.appendFile(file, `${JSON.stringify(value)}\n`, 'utf8')
-}
-
 export function shortHash(text) {
   return crypto.createHash('sha256').update(String(text)).digest('hex').slice(0, 12)
 }
@@ -94,53 +62,57 @@ export async function readActivityTail(file, limit = 12) {
   return out
 }
 
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms))
+export async function readStateLock(paths) {
+  return readLock(paths.lock)
 }
 
 /**
- * Hold the repo-wide tower lock for one mutation. Stale locks are reported,
- * never silently stolen (matches the fail-closed protocol).
+ * Hold the repo-wide tower lock for one mutation. A lock whose recorded PID is
+ * provably dead is reclaimed atomically; a live lock is reported, never stolen.
  */
 export async function withLock(paths, fn, options = {}) {
   const timeoutMs = options.timeoutMs ?? 5000
   const pollMs = options.pollMs ?? 25
   const token = crypto.randomUUID()
-  const record = JSON.stringify({ token, pid: process.pid, at: Date.now() })
-  const deadline = Date.now() + timeoutMs
-
-  for (;;) {
-    try {
-      await fsp.writeFile(paths.lock, record, { flag: 'wx' })
-      break
-    } catch (error) {
-      if (error.code !== 'EEXIST') throw error
-      if (Date.now() > deadline) {
-        let owner = null
-        try {
-          owner = await fsp.readFile(paths.lock, 'utf8')
-        } catch {
-          owner = null
-        }
-        throw new Error(
-          `tower state is locked by another writer${owner ? ` (${owner})` : ''}; retry after it finishes`,
-        )
-      }
-      await sleep(pollMs)
-    }
+  const record = lockRecord(token, { startedAt: PROCESS_STARTED_AT })
+  const held = await acquireLock(paths.lock, { token, record, timeoutMs, pollMs })
+  if (!held) {
+    const owner = await readStateLock(paths)
+    const ownerRecord = owner.record
+    const payload = owner.raw ?? (ownerRecord ? JSON.stringify(ownerRecord) : null)
+    throw new TowerToolError(
+      'state-locked',
+      `tower state is locked by another writer${payload ? ` (${payload})` : ''}; retry after it finishes`,
+    )
   }
+  const startedAt = Date.now()
+  try {
+    return await fn(paths)
+  } finally {
+    await held.release()
+    await fsp
+      .appendFile(path.join(paths.dir, 'lock-holds.jsonl'), `${JSON.stringify({ at: Date.now(), ms: Date.now() - startedAt, pid: process.pid })}\n`, 'utf8')
+      .catch(() => {})
+  }
+}
 
+/** Serialize git mutations without holding the state lock. */
+export async function withGitLock(paths, fn, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 60000
+  const pollMs = options.pollMs ?? 25
+  const lock = paths.gitLock
+  const token = crypto.randomUUID()
+  const startedAt = Date.now()
+  const held = await acquireLock(lock, { token, record: lockRecord(token, { kind: 'git' }), timeoutMs, pollMs })
+  if (!held) {
+    throw new TowerToolError('state-locked', 'another git mutation is in progress for this repository; retry after it finishes')
+  }
   try {
     return await fn(paths)
   } finally {
-    try {
-      const current = await fsp.readFile(paths.lock, 'utf8').catch(() => null)
-      if (current) {
-        const parsed = JSON.parse(current)
-        if (parsed && parsed.token === token) await fsp.unlink(paths.lock)
-      }
-    } catch {
-      // a lock left behind by a crash is reported by the next writer, not fixed here
-    }
+    await held.release()
+    await fsp
+      .appendFile(path.join(paths.dir, 'lock-holds.jsonl'), `${JSON.stringify({ at: Date.now(), ms: Date.now() - startedAt, pid: process.pid, phase: 'git' })}\n`, 'utf8')
+      .catch(() => {})
   }
 }

package/lib/tests.js

@@ -1,3 +1,4 @@
+import { TowerToolError } from '../domain/errors.js'
 // Tower test discovery (2.1): fail-closed admission evidence from the
 // repository's own `package.json` `tower.testDiscovery` block.
 //
@@ -18,10 +19,10 @@
 //   minCount/required shortfall) returns `ok: false` in the receipt;
 // - an invalid discovery configuration (or invalid call arguments) throws a
 //   plain `Error`, which the tool layer wraps as `tower:invalid-argument`.
-import { spawn } from 'node:child_process'
-import { createWriteStream } from 'node:fs'
+import { spawn } from '../adapters/vcs-git.js'
+import { createWriteStream } from '../adapters/store-fs.js'
 import crypto from 'node:crypto'
-import fsp from 'node:fs/promises'
+import { fsp } from '../adapters/store-fs.js'
 import path from 'node:path'
 
 import { tryGit } from './git.js'
@@ -45,7 +46,7 @@ function nonEmptyString(value) {
 }
 
 function normalizePositiveInteger(value, name) {
-  if (!Number.isInteger(value) || value <= 0) throw new Error(`${name} must be an integer > 0`)
+  if (!Number.isInteger(value) || value <= 0) throw new TowerToolError('invalid-argument', `${name} must be an integer > 0`)
   return value
 }
 
@@ -253,6 +254,40 @@ export function parseJsonArray(stdout) {
   return { tests, ok: failed === 0, count: tests.length, failed, error: null }
 }
 
+/** Test discovery is repository-controlled code: do not hand it secrets. */
+const TEST_ENV_ALLOW = new Set([
+  'PATH',
+  'Path',
+  'PATHEXT',
+  'SystemRoot',
+  'WINDIR',
+  'ComSpec',
+  'HOME',
+  'USERPROFILE',
+  'TMP',
+  'TEMP',
+  'TMPDIR',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'SHELL',
+  'TERM',
+  'APPDATA',
+  'LOCALAPPDATA',
+  'ProgramFiles',
+  'ProgramFiles(x86)',
+  'NODE_PATH',
+])
+
+export function testProcessEnv(source = process.env) {
+  const env = {}
+  for (const [key, value] of Object.entries(source)) {
+    if (!TEST_ENV_ALLOW.has(key)) continue
+    env[key] = value
+  }
+  return env
+}
+
 /** Platform shell for discovery commands (PowerShell 7 on Windows, bash on POSIX). */
 function shellSpec(platform = process.platform) {
   if (platform === 'win32') {
@@ -379,7 +414,7 @@ function spawnToFiles({ command, cwd, timeoutMs, maxBytes, stdoutPath, stderrPat
         windowsHide: true,
         // POSIX: a process group lets a timeout kill grandchildren too.
         detached: process.platform !== 'win32',
-        env: process.env,
+        env: testProcessEnv(),
       })
     } catch (error) {
       spawnError = error
@@ -446,7 +481,7 @@ async function resolveDiagnosticsDir({ worktreePath, diagnosticsDir, missionId }
 
 function normalizeDiscoveryInput(config) {
   if (isPlainObject(config) && Object.prototype.hasOwnProperty.call(config, 'configured')) {
-    if (config.error) throw new Error(`test discovery configuration is invalid: ${config.error}`)
+    if (config.error) throw new TowerToolError('invalid-argument', `test discovery configuration is invalid: ${config.error}`)
     if (config.configured === false) return { configured: false, config: null, error: null }
     return { configured: true, config: config.config, error: null }
   }
@@ -493,16 +528,16 @@ export async function runDiscovery(options = {}) {
   } = options
   const startedAt = new Date().toISOString()
 
-  if (!nonEmptyString(worktreePath)) throw new Error('worktreePath is required')
-  if (!path.isAbsolute(worktreePath)) throw new Error(`worktreePath must be an absolute path: ${worktreePath}`)
+  if (!nonEmptyString(worktreePath)) throw new TowerToolError('invalid-argument', 'worktreePath is required')
+  if (!path.isAbsolute(worktreePath)) throw new TowerToolError('invalid-argument', `worktreePath must be an absolute path: ${worktreePath}`)
   const effectiveTimeout = normalizePositiveInteger(timeoutMs, 'timeoutMs')
   const effectiveMaxBytes = normalizePositiveInteger(maxBytes, 'maxBytes')
   if (runner !== undefined && runner !== null && typeof runner !== 'function') {
-    throw new Error('runner must be a function')
+    throw new TowerToolError('invalid-argument', 'runner must be a function')
   }
   if (diagnosticsDir !== undefined && diagnosticsDir !== null) {
     if (!nonEmptyString(diagnosticsDir) || !path.isAbsolute(diagnosticsDir)) {
-      throw new Error(`diagnosticsDir must be an absolute path: ${diagnosticsDir}`)
+      throw new TowerToolError('invalid-argument', `diagnosticsDir must be an absolute path: ${diagnosticsDir}`)
     }
   }
 
@@ -524,7 +559,7 @@ export async function runDiscovery(options = {}) {
 
   if (!discovery.configured) return finishUnconfigured(discovery.error)
   const normalized = normalizeDiscovery(discovery.config)
-  if (!normalized.ok) throw new Error(`invalid tower.testDiscovery config: ${normalized.error}`)
+  if (!normalized.ok) throw new TowerToolError('invalid-argument', `invalid tower.testDiscovery config: ${normalized.error}`)
 
   const dir = await resolveDiagnosticsDir({ worktreePath, diagnosticsDir, missionId })
   const commands = []