muse-crew 0.14.4 → 0.14.5

package/lib/check-intent-freshness.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+// check-intent-freshness.js — deterministic manifest-freshness check for a
+// re-claimed one-party publish intent (2026-09-20, critic-0145 F-O3/F-R2).
+//
+// A re-claiming tick must decide: did the dead tick issue the edit (record
+// "recovered") or not (issue it now)? The decision is mechanical, never
+// prose: read the on-disk artifact manifest at the same path the verifier
+// uses (<spaces-root>/<slug>/.space-build/manifest.json — see
+// lib/verify-publish.js) and compare its content_sha256 / built_at against
+// the intent entry's pre-issuance baseline (manifest_before).
+//
+// The manifest ADVANCED — a new build identity, so the dead tick issued —
+// when either:
+//   current.content_sha256 !== baseline.content_sha256  (a new content hash), OR
+//   Date.parse(current.built_at) > Date.parse(baseline.built_at)  (a later build).
+// Otherwise it still shows the pre-edit state and the tick issues fresh.
+//
+// Stdout contract: exactly one JSON object, always small:
+//   { ok:true, advanced:<bool>, baseline:{built_at, content_sha256}, current:{built_at, content_sha256} }
+//   { ok:false, error:"no-baseline"|"unreadable-manifest"|"unparseable-manifest" }
+//
+// Exit codes: 0 ok (JSON on stdout) · 2 usage · 1 IO failure (nothing on
+// stdout — a caller must never treat stdout as a result). Errors go to
+// stderr as JSON.
+//
+// A non-ok result is never a verdict — the caller fails closed: record
+// nothing and let the claim expire into the reclaim path (the scan's F-R3
+// terminal park covers the null-baseline reclaim; an unreadable manifest
+// leaves the task parked for the next tick). Reclaim decisions never rest
+// on prose.
+
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// --help: before required-arg parsing (shebang⇔CLI contract).
+if (process.argv.slice(2).includes("--help")) {
+  console.log(
+    "usage: node check-intent-freshness.js --slug <slug> --manifest-before '<json>' [--spaces-root <path>]\n" +
+    "compares the on-disk artifact manifest's content_sha256/built_at against the pre-issuance baseline; prints {ok, advanced} JSON on stdout"
+  );
+  process.exit(0);
+}
+
+function arg(name, required = true) {
+  const i = process.argv.indexOf(name);
+  if (i < 0 || i + 1 >= process.argv.length) {
+    if (!required) return null;
+    fail("usage", `${name} is required.`, 2);
+  }
+  return process.argv[i + 1];
+}
+function fail(code, message, exitCode) {
+  process.stderr.write(JSON.stringify({ ok: false, error: code, message }) + "\n");
+  process.exit(exitCode);
+}
+
+const slug = arg("--slug");
+const baselineRaw = arg("--manifest-before");
+const spacesRoot = arg("--spaces-root", false) || join(homedir(), "workspace", "ts-spaces");
+
+if (!slug || /[/\\]/.test(slug)) fail("usage", "--slug must be a non-empty slug (no path separators).", 2);
+
+let baseline;
+try {
+  baseline = JSON.parse(baselineRaw);
+} catch {
+  fail("usage", "--manifest-before must be JSON.", 2);
+}
+if (!baseline || typeof baseline !== "object") fail("no-baseline", "--manifest-before is not an object.", 1);
+const baselineSha = typeof baseline.content_sha256 === "string" ? baseline.content_sha256 : null;
+const baselineBuiltAt = typeof baseline.built_at === "string" ? baseline.built_at : null;
+if (!baselineSha && !baselineBuiltAt) {
+  fail("no-baseline", "the baseline carries neither content_sha256 nor built_at — freshness is unprovable.", 1);
+}
+
+let currentManifest;
+try {
+  currentManifest = JSON.parse(readFileSync(join(spacesRoot, slug, ".space-build", "manifest.json"), "utf8"));
+} catch (e) {
+  const code = e && e.code === "ENOENT" ? "unreadable-manifest" : "unreadable-manifest";
+  fail(code, `cannot read the on-disk manifest: ${(e && e.message) || e}`.slice(0, 300), 1);
+}
+if (!currentManifest || typeof currentManifest !== "object") {
+  fail("unparseable-manifest", "the on-disk manifest is not a JSON object.", 1);
+}
+const currentSha = typeof currentManifest.content_sha256 === "string" ? currentManifest.content_sha256 : null;
+const currentBuiltAt = typeof currentManifest.built_at === "string" ? currentManifest.built_at : null;
+
+const hashAdvanced = !!(baselineSha && currentSha && currentSha !== baselineSha);
+const currentBuiltAtMs = currentBuiltAt ? Date.parse(currentBuiltAt) : NaN;
+const baselineBuiltAtMs = baselineBuiltAt ? Date.parse(baselineBuiltAt) : NaN;
+const timeAdvanced = !!(currentBuiltAtMs > 0 && baselineBuiltAtMs > 0 && currentBuiltAtMs > baselineBuiltAtMs);
+const advanced = hashAdvanced || timeAdvanced;
+
+process.stdout.write(JSON.stringify({
+  ok: true,
+  advanced,
+  baseline: { built_at: baselineBuiltAt, content_sha256: baselineSha },
+  current: { built_at: currentBuiltAt, content_sha256: currentSha },
+}) + "\n");

package/lib/compute-publish-diff.js

@@ -14,7 +14,7 @@
 // small JSON summary verbatim. The diff bytes live in a file; the LLM
 // never carries them:
 //
-//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>
+//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file> [--commit <sha>]
 //
 // --base is the previously-stamped provenance source_commit (or the
 // empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
@@ -22,6 +22,14 @@
 // script echoes the base it used so the workflow can guard against the
 // agent running the wrong command (fail-closed, as before).
 //
+// --commit is the diff's head end (2026-09-20, critic-0145 F-O2): the
+// script used to ignore it and always diff base..HEAD. Optional, defaults
+// to HEAD; the workflow's first-prepare call passes nothing (HEAD is the
+// merge commit it just created), while the tick's byte-identical
+// regeneration passes the intent's commit explicitly. The ancestor check,
+// the diff range, and the reported `commit` all target --commit, never an
+// implicit HEAD.
+//
 // Stdout contract: exactly one JSON object, always small (no diff text):
 //   { ok:true, commit, base, ancestor:"yes", diff_file, sha256, bytes,
 //     file_count, changed_lines, files:[<paths>], has_binary, has_rename }
@@ -43,8 +51,8 @@ import { dirname, resolve } from "node:path";
 // --help: before required-arg parsing (shebang⇔CLI contract).
 if (process.argv.slice(2).includes("--help")) {
   console.log(
-    "usage: node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>\n" +
-    "runs git diff <base> <HEAD>, writes the raw diff bytes to --out, prints the small JSON summary on stdout"
+    "usage: node compute-publish-diff.js --repo-path <path> --base <sha> --out <file> [--commit <sha>]\n" +
+    "runs git diff <base> <commit> (default <commit> = HEAD), writes the raw diff bytes to --out, prints the small JSON summary on stdout"
   );
   process.exit(0);
 }
@@ -74,36 +82,49 @@ function git(repoPath, args) {
 const repoPath = arg("--repo-path");
 const base = arg("--base");
 const outFile = arg("--out");
+const commitArg = arg("--commit", false);
 
 if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "--base must be a 40-char hex commit SHA (or the empty-tree SHA).", 2);
 let st = null;
 try { st = statSync(repoPath); } catch { /* falls through */ }
 if (!st || !st.isDirectory()) fail("usage", "--repo-path must be an existing directory.", 2);
 
-const head = git(repoPath, ["rev-parse", "HEAD"]).trim();
-if (!/^[0-9a-f]{40}$/.test(head)) fail("git-failed", "rev-parse HEAD did not return a commit SHA.", 1);
+// The diff's head end: explicit --commit, or HEAD when omitted (the
+// workflow's first-prepare call passes nothing — HEAD is the merge commit
+// it just created). Validated as a 40-hex commit object in this repo;
+// everything below (ancestor check, diff range, reported commit) targets
+// it, never an implicit HEAD (2026-09-20, critic-0145 F-O2).
+let commit;
+if (commitArg === null) {
+  commit = git(repoPath, ["rev-parse", "HEAD"]).trim();
+} else {
+  if (!/^[0-9a-f]{40}$/.test(commitArg)) fail("usage", "--commit must be a 40-char hex commit SHA.", 2);
+  commit = git(repoPath, ["rev-parse", "--verify", commitArg + "^{commit}"]).trim();
+}
+if (!/^[0-9a-f]{40}$/.test(commit)) fail("git-failed", "could not resolve the diff target to a commit SHA.", 1);
 
-// Ancestor check — deterministic, in code. The empty tree is not a commit:
-// git merge-base --is-ancestor fails on it, so a first publish hardcodes
-// ANCESTOR=yes here instead of executing the conditional (clean-room
-// 2026-09-16: an agent ran merge-base on the empty tree directly and parked).
+// Ancestor check — deterministic, in code, against the diff target. The
+// empty tree is not a commit: git merge-base --is-ancestor fails on it, so
+// a first publish hardcodes ANCESTOR=yes here instead of executing the
+// conditional (clean-room 2026-09-16: an agent ran merge-base on the empty
+// tree directly and parked).
 let ancestor = "yes";
 if (base !== EMPTY_TREE) {
   try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, head], { stdio: "ignore" });
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
     ancestor = "yes";
   } catch {
     ancestor = "no";
   }
 }
 if (ancestor !== "yes") {
-  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit: head, base }) + "\n");
+  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit, base }) + "\n");
   process.exit(0);
 }
 
 const outPath = resolve(outFile);
 mkdirSync(dirname(outPath), { recursive: true });
-const diffText = git(repoPath, ["diff", base, head]);
+const diffText = git(repoPath, ["diff", base, commit]);
 writeFileSync(outPath, diffText, "utf8");
 const bytes = readFileSync(outPath);
 const sha256 = createHash("sha256").update(bytes).digest("hex");
@@ -140,7 +161,7 @@ for (const line of diffText.split("\n")) {
 
 process.stdout.write(JSON.stringify({
   ok: true,
-  commit: head,
+  commit,
   base,
   ancestor: "yes",
   diff_file: outPath,