muse-crew 0.14.4 → 0.14.6

package/lib/retry-publish.js

@@ -1,405 +0,0 @@
-#!/usr/bin/env node
-// retry-publish.js — Deterministic unknown-recovery retry protocol (2026-09-18, should-fix 5).
-//
-// The cron Step 4.4 retry protocol was prose-owned: the cron agent performed
-// lock handling, journaling, diff generation, ledger writes, mirroring, and
-// cleanup by following template instructions. A missed step (or a tick dying
-// mid-protocol) left the lock held or the state inconsistent.
-//
-// This command owns all deterministic transitions with try/finally lock
-// release. Only the unavoidable `artifact_edit` tool call remains
-// agent-mediated (it requires the artifact namespace, which this process
-// cannot load).
-//
-// Two phases:
-//   Phase 1 (prepare): acquire merge lock, re-check HEAD, re-classify,
-//     journal intent, generate diff. Outputs JSON with the diff path/sha
-//     for the agent to feed to artifact_edit. The lock is HELD on success
-//     (the agent must call phase 2 to release it).
-//   Phase 2 (complete): given the artifact_edit outcome (accepted/refused),
-//     write the outcome notes, append the ledger entry, mirror verification,
-//     and RELEASE the lock in a finally block.
-//
-// Crash safety: if the agent dies between phases, the lock expires after
-// 600s and the note journal (`publish: retry-intended` without
-// `publish: retry-issued`) lets the next scan mirror verification-requested
-// without re-triggering — exactly one retry, enforced from notes.
-//
-// Usage:
-//   node retry-publish.js --crew-home <path> --task-id <uuid> --phase prepare
-//   node retry-publish.js --crew-home <path> --task-id <uuid> --phase complete --edit-outcome <accepted|refused> [--refusal-text <text>]
-//
-// Exit codes: 0 = success, 1 = terminal stop (no retry), 2 = usage error.
-
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, unlinkSync } from "fs";
-import { join } from "path";
-import { execFileSync } from "child_process";
-import { randomUUID as uuid } from "crypto";
-
-const args = process.argv.slice(2);
-function arg(name, required = true, def = undefined) {
-  const i = args.indexOf(name);
-  if (i === -1 || i + 1 >= args.length) {
-    if (required) { console.error(`missing required arg ${name}`); process.exit(2); }
-    return def;
-  }
-  return args[i + 1];
-}
-function fail(code, msg, exitCode = 1) {
-  process.stdout.write(JSON.stringify({ ok: false, code, message: msg }) + "\n");
-  process.exit(exitCode);
-}
-
-// --help: handled before any required-arg parsing so
-// `node retry-publish.js --help` always exits 0 (entry-gate contract).
-if (args.includes("--help")) {
-  console.log(
-    "usage: node retry-publish.js --crew-home <path> --task-id <uuid> --phase <prepare|complete>\n" +
-    "  prepare:  acquire the merge lock, re-check HEAD, re-classify, journal intent, emit the diff\n" +
-    "  complete: --edit-outcome <accepted|refused> [--refusal-text <text>] — write the outcome,\n" +
-    "            append the ledger entry, mirror verification, and release the lock\n" +
-    "exit 0 = success, 1 = terminal stop, 2 = usage error"
-  );
-  process.exit(0);
-}
-
-const crewHome = arg("--crew-home");
-const taskId = arg("--task-id");
-const phase = arg("--phase");
-
-if (!["prepare", "complete"].includes(phase)) {
-  console.error("phase must be 'prepare' or 'complete'");
-  process.exit(2);
-}
-
-// Retry protocol: phase-1 state is a persistent-disk pin
-// ($CREW_HOME/.pins/ — never /tmp: tmpfs is wiped on cell reboot, and the
-// lock release depends on phase 2 reading this state).
-function pinsDir() {
-  const dir = join(crewHome, ".pins");
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-function retryStatePath() {
-  return join(pinsDir(), `retry-publish-${taskId}.json`);
-}
-
-// --- Shared helpers ---------------------------------------------------------
-
-function nowISO() { return new Date().toISOString(); }
-
-function writePublishNote(db, taskId, message) {
-  db.prepare(
-    `INSERT INTO events (id, type, task_id, identity, message, timestamp)
-     VALUES (?, 'note', ?, NULL, ?, ?)`
-  ).run(uuid(), taskId, message, nowISO());
-}
-
-// Load the crew DB. We use better-sqlite3 via the crew-api's own dependency
-// resolution — fall back to a clear error if unavailable.
-let Database;
-try {
-  Database = (await import("better-sqlite3")).default;
-} catch {
-  fail("db-unavailable", "better-sqlite3 is not available to retry-publish.js");
-}
-const dbPath = join(crewHome, "crew.db");
-if (!existsSync(dbPath)) fail("no-db", `crew database not found at ${dbPath}`);
-const db = new Database(dbPath);
-
-const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-
-function runMergeLock(action) {
-  const lockScript = join(crewHome, "lib", "merge-lock.sh");
-  try {
-    execFileSync(lockScript, [action, taskId], {
-      env: { ...process.env, CREW_HOME: crewHome },
-      encoding: "utf8",
-      timeout: 30000,
-    });
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, error: (e.stderr || e.message || "").slice(0, 300) };
-  }
-}
-
-// --- Phase 1: prepare --------------------------------------------------------
-// Acquires the lock, re-checks HEAD, re-classifies, journals intent,
-// generates the diff. On success the lock is HELD and the output carries
-// the diff path/sha for the agent's artifact_edit child.
-
-if (phase === "prepare") {
-  // Derive the unknown attempt (same derivation as scan-publish-unknown).
-  const task = db.prepare("SELECT id, state, project FROM tasks WHERE id = ?").get(taskId);
-  if (!task) fail("unknown-task", `task ${taskId} not found`);
-  if (task.state !== "parked") fail("not-parked", `task is not parked (state=${task.state})`);
-
-  const project = db.prepare("SELECT id, deploy_slug, repo_path FROM projects WHERE id = ?").get(task.project);
-  const slug = project && project.deploy_slug;
-  if (!slug) fail("no-slug", "project has no deploy_slug");
-  const repoPath = (project && project.repo_path) || null;
-
-  const ledgerPath = join(crewHome, ".publish-ledger", slug + ".jsonl");
-  let entries = [];
-  try {
-    entries = readFileSync(ledgerPath, "utf8").split("\n")
-      .filter((l) => l.trim().length > 0)
-      .map((l) => JSON.parse(l))
-      .filter((e) => e.task_id === taskId);
-  } catch (e) {
-    fail("ledger-unreadable", `cannot read publish ledger: ${e.message}`);
-  }
-  const unknownEntry = entries[entries.length - 1];
-  if (!unknownEntry || unknownEntry.outcome !== "unknown") {
-    fail("not-unknown", "latest ledger entry is not unknown — nothing to retry");
-  }
-  const commit = unknownEntry.commit;
-  const attempt = unknownEntry.attempt || null;
-  if (!commit || !/^[0-9a-f]{40}$/.test(commit)) {
-    fail("bad-commit", "unknown ledger entry carries no usable commit hash");
-  }
-
-  // 1. Re-check HEAD: must still be the retry target.
-  let head;
-  try {
-    head = execFileSync("git", ["-C", repoPath, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
-  } catch (e) {
-    fail("head-unreadable", `git rev-parse HEAD failed: ${e.message}`);
-  }
-  if (head !== commit) {
-    writePublishNote(db, taskId,
-      `publish: retry-superseded ${commit} — HEAD is ${head}; the retry target moved. Recovery aborted.`);
-    process.stdout.write(JSON.stringify({ ok: true, phase: "prepare", outcome: "superseded", commit, head }) + "\n");
-    process.exit(0);
-  }
-
-  // 2. Acquire the merge lock.
-  const lock = runMergeLock("acquire");
-  if (!lock.ok) {
-    process.stdout.write(JSON.stringify({
-      ok: true, phase: "prepare", outcome: "lock-held",
-      message: `merge lock held for ${taskId}; the drop note is still latest, so the next tick retries`,
-    }) + "\n");
-    process.exit(0);
-  }
-
-  // From here to the end of phase 1, the lock is held. Any failure must
-  // release it — try/finally.
-  let lockHeld = true;
-  const releaseLock = () => {
-    if (lockHeld) {
-      runMergeLock("release");
-      lockHeld = false;
-    }
-  };
-
-  try {
-    // 3. Inside the lock, re-classify.
-    let base = EMPTY_TREE;
-    try {
-      const prov = db.prepare("SELECT provenance_source_commit FROM projects WHERE id = ?").get(project.id);
-      if (prov && /^[0-9a-f]{40}$/.test(prov.provenance_source_commit)) base = prov.provenance_source_commit;
-    } catch (e) {
-      releaseLock();
-      fail("provenance-query-failed", `provenance lookup failed: ${e.message} — failing closed`);
-    }
-
-    const classifierPath = join(crewHome, "lib", "classify-publish-absence.js");
-    // Find the trigger entry for the manifest baseline: the OLDEST submitted
-    // entry by ts (D1, 2026-09-19; entry_kind cut 2026-09-20 — the retired
-    // kind-preference could never change the bound anchor) — it binds
-    // issued_at (falling back to its ts when the capture was unobserved),
-    // the same anchor verify-publish.js and findTriggerEntry use.
-    // agent_id is null on the issuance entry (no receipt observed at trigger
-    // time) — the baseline comes from manifest_before, never agent_id.
-    const submitted = entries.filter((e) =>
-      e.outcome === "submitted" && e.commit === commit && (attempt == null || e.attempt === attempt));
-    submitted.sort((a, b) => (a.ts || "").localeCompare(b.ts || ""));
-    const trigger = submitted[0] || null;
-    const manifestBefore = trigger && trigger.manifest_before ? JSON.stringify(trigger.manifest_before) : null;
-
-    // Find the park note timestamp for quiesce calculation.
-    const parkNote = db.prepare(
-      `SELECT message, timestamp FROM events WHERE task_id = ? AND type = 'note'
-       AND (message LIKE '%publish: dropped%' OR message LIKE '%publish outcome unknown%')
-       ORDER BY timestamp DESC LIMIT 1`
-    ).get(taskId);
-    if (!parkNote) {
-      releaseLock();
-      fail("no-park-note", "no dropped/unknown park note found — cannot determine quiesce window");
-    }
-
-    const classifierArgs = [
-      classifierPath,
-      "--slug", slug,
-      "--commit", commit,
-      "--base", base,
-      "--trigger-ts", trigger ? (trigger.issued_at || trigger.ts) : parkNote.timestamp,
-      "--park-ts", parkNote.timestamp,
-      "--repo-path", repoPath,
-    ];
-    if (manifestBefore) classifierArgs.push("--manifest-before", manifestBefore);
-
-    let classification;
-    try {
-      const out = execFileSync("node", classifierArgs, { encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
-      classification = JSON.parse(out);
-    } catch (e) {
-      releaseLock();
-      fail("classifier-failed", `classify-publish-absence.js failed: ${(e.stderr || e.message).slice(0, 300)}`);
-    }
-
-    if (!classification.ok || classification.decision !== "provably-dropped") {
-      // Not dropped — release the lock and route via the existing
-      // record-retry-recheck path (the code owns the routing).
-      releaseLock();
-      process.stdout.write(JSON.stringify({
-        ok: true, phase: "prepare", outcome: "not-dropped",
-        decision: classification.decision,
-        message: "re-classification is not provably-dropped; the tick routes via record-retry-recheck",
-        classification,
-      }) + "\n");
-      process.exit(0);
-    }
-
-    // 3b. Capture the pre-retry manifest baseline (inside the lock).
-    let retryBaseline = null;
-    try {
-      const m = JSON.parse(readFileSync(join(process.env.HOME, "workspace", "ts-spaces", slug, ".space-build", "manifest.json"), "utf8"));
-      if (m && typeof m.built_at === "string" && typeof m.content_sha256 === "string") {
-        retryBaseline = { built_at: m.built_at, content_sha256: m.content_sha256 };
-      }
-    } catch { /* missing/unparsable → null; the verifier fails closed without a baseline */ }
-
-    // 4. Journal the intent BEFORE the trigger.
-    writePublishNote(db, taskId,
-      `publish: retry-intended ${commit} ${nowISO()} — re-issuing the dropped edit once; if this tick dies before the trigger returns, the next scan mirrors verification-requested rather than re-triggering.`);
-
-    // 5. Regenerate the diff deterministically.
-    const diffPath = `/tmp/retry-diff-${taskId}.txt`;
-    let diffMeta;
-    try {
-      const out = execFileSync("node", [
-        join(crewHome, "lib", "compute-publish-diff.js"),
-        "--repo-path", repoPath,
-        "--base", base,
-        "--out", diffPath,
-      ], { encoding: "utf8" });
-      diffMeta = JSON.parse(out);
-    } catch (e) {
-      releaseLock();
-      fail("diff-failed", `compute-publish-diff.js failed: ${(e.stderr || e.message).slice(0, 300)} — intent note stands; next tick mirrors verification-requested`);
-    }
-    if (!diffMeta.ok) {
-      releaseLock();
-      fail("diff-not-ok", `compute-publish-diff.js returned ok:false — intent note stands; next tick mirrors verification-requested`);
-    }
-
-    // Success: lock remains HELD. The agent spawns the artifact_edit child
-    // with the diff, then calls phase 2 (complete) to finish.
-    // Persist the phase-1 state for phase 2 (crash recovery reads the notes,
-    // but phase 2 needs the exact commit/attempt/baseline/ledger path).
-    const statePath = retryStatePath();
-    writeFileSync(statePath, JSON.stringify({
-      task_id: taskId, commit, attempt, slug, repoPath,
-      project_id: project.id, ledger_path: ledgerPath,
-      retry_baseline: retryBaseline,
-      diff_path: diffPath, diff_sha256: diffMeta.sha256,
-      prepared_at: nowISO(),
-    }));
-
-    process.stdout.write(JSON.stringify({
-      ok: true, phase: "prepare", outcome: "ready",
-      task_id: taskId, commit, attempt,
-      diff_path: diffPath, diff_sha256: diffMeta.sha256,
-      slug,
-      message: "lock held; spawn the artifact_edit child with the diff, then call phase 2 (complete)",
-    }) + "\n");
-    process.exit(0);
-  } catch (e) {
-    releaseLock();
-    throw e;
-  }
-}
-
-// --- Phase 2: complete -------------------------------------------------------
-// Given the artifact_edit outcome, write the outcome notes, append the
-// ledger entry, mirror verification, and RELEASE the lock (finally).
-
-if (phase === "complete") {
-  const editOutcome = arg("--edit-outcome");
-  if (!["accepted", "refused"].includes(editOutcome)) {
-    console.error("--edit-outcome must be 'accepted' or 'refused'");
-    process.exit(2);
-  }
-  const refusalText = arg("--refusal-text", false, "");
-
-  const statePath = retryStatePath();
-  if (!existsSync(statePath)) {
-    fail("no-prepare-state", `no phase-1 state at ${statePath} — the prepare phase did not complete or the state was cleaned`);
-  }
-  const state = JSON.parse(readFileSync(statePath, "utf8"));
-  const { commit, attempt, slug, ledger_path: ledgerPath, retry_baseline: retryBaseline } = state;
-
-  let lockHeld = true;
-  const releaseLock = () => {
-    if (lockHeld) {
-      runMergeLock("release");
-      lockHeld = false;
-    }
-  };
-
-  try {
-    if (editOutcome === "refused") {
-      // Conclusive negative: rejected, not unknown. Terminal.
-      writePublishNote(db, taskId,
-        `publish: retry-refused ${commit} — the platform refused the re-issued edit (${refusalText.split("\n")[0].slice(0, 200)}); not retrying again.`);
-      process.stdout.write(JSON.stringify({ ok: true, phase: "complete", outcome: "refused", commit }) + "\n");
-    } else {
-      // The child ended after the edit call with no explicit refusal —
-      // fire-and-forget, same shape as the first attempt.
-      writePublishNote(db, taskId,
-        `publish: retry-issued ${commit} — the dropped edit was re-issued once; no explicit refusal was observed.`);
-
-      // Mirror verification with a settle window.
-      const settleMs = Number(process.env.CREW_RETRY_SETTLE_MS) > 0
-        ? Number(process.env.CREW_RETRY_SETTLE_MS)
-        : 20 * 60 * 1000;
-      const notBefore = new Date(Date.now() + settleMs).toISOString();
-      const retryAttempt = attempt ? `${attempt}-retry1` : "retry1";
-      writePublishNote(db, taskId,
-        `publish: verification-requested ${commit} attempt=${retryAttempt} not-before=${notBefore} — unknown-recovery retried the dropped edit once; content verification is the arbiter. Waiting on the manual read-back in docs/publish-verification.md.`);
-
-      // Append the -retry1 ledger entry with the pre-retry baseline (required).
-      const ledgerEntry = {
-        ts: nowISO(),
-        task_id: taskId,
-        workflow: "unknown-recovery",
-        slug,
-        commit,
-        attempt: retryAttempt,
-        agent_id: null,
-        applied_report: null,
-        outcome: "submitted",
-        manifest_before: retryBaseline,
-        detail: "retry trigger re-issued after provably-dropped classification",
-      };
-      try {
-        appendFileSync(ledgerPath, JSON.stringify(ledgerEntry) + "\n");
-      } catch (e) {
-        // Best-effort: the note journal is the source of truth, not the ledger.
-        console.error(`ledger append failed (non-fatal): ${e.message}`);
-      }
-
-      process.stdout.write(JSON.stringify({
-        ok: true, phase: "complete", outcome: "issued",
-        commit, attempt: retryAttempt, not_before: notBefore,
-      }) + "\n");
-    }
-  } finally {
-    releaseLock();
-    // Clean up the phase-1 state file (best-effort).
-    try { unlinkSync(statePath); } catch {}
-  }
-  process.exit(0);
-}