muse-crew 0.14.5 → 0.14.7

package/lib/serve-artifact.js

@@ -14,9 +14,17 @@
 //
 // Fidelity notes (what this is and isn't):
 // - The served client and action handlers are the artifact's own built code.
-// - The Ctx is locally built: privileged handlers run from the space's own
+// - The Ctx is locally built: ctx.db is a drizzle db over a fresh per-run
+//   SQLite database, migrated from the space's own drizzle/ migrations (the
+//   same migration path a fresh production install takes) — never the
+//   shipped app.db, so the server stays read-only w.r.t. the space
+//   directory and QA writes can never contaminate production data;
+//   privileged handlers run from the space's own
 //   server/dist/privileged.js when present; blobs are stored in a per-run
-//   temp dir and served back at /__blobs/<key>.
+//   temp dir and served back at /__blobs/<key>. When the space has no
+//   drizzle migrations (or drizzle-orm can't be resolved from its
+//   node_modules), the server still boots and ctx.db throws a clear error
+//   when called.
 // - Environment (CREW_HOME and friends) is inherited from the caller — export
 //   what the artifact's server needs before starting this.
 //
@@ -27,6 +35,7 @@ import { join, normalize, dirname, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, writeFile, mkdir, mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
+import { openQaDb } from "./qa-db.js";
 
 function parseArgs(argv) {
   const out = { spaceDir: null, port: 0, tag: null };
@@ -85,6 +94,23 @@ async function main() {
     privilegedByName = new Map(privilegedHandlers.entries.map((e) => [e.contract.name, e.handler]));
   }
 
+  // ctx.db: best-effort. A space with drizzle/ migrations gets a working db
+  // (fresh per-run, migrated from the space's own migrations — the harness
+  // can finally drive db-backed success paths); anything else still boots
+  // and ctx.db throws a clear error when called, instead of 500ing as
+  // "not a function".
+  let dbAccessor;
+  let qaHandle = null;
+  try {
+    const qa = await openQaDb(args.spaceDir);
+    dbAccessor = () => qa.db;
+    qaHandle = qa;
+  } catch (err) {
+    const reason = String((err && err.message) || err);
+    process.stderr.write("serve-artifact.js: ctx.db unavailable: " + reason.slice(0, 200) + "\n");
+    dbAccessor = () => { throw new Error("ctx.db is not available in the local QA server: " + reason); };
+  }
+
   // Local blob store (outside the space dir — the server stays read-only
   // w.r.t. the space). Keys are path-safe segments; anything else is rejected.
   const BLOB_DIR = await mkdtemp(join(tmpdir(), "serve-artifact-blobs-"));
@@ -100,6 +126,7 @@ async function main() {
   function makeCtx(def) {
     const declared = new Set(((def && def.privileged) || []).map((c) => c.name));
     return {
+      db: dbAccessor,
       async executePrivileged(contract, actionArgs) {
         if (!contract || typeof contract.name !== "string") throw new Error("executePrivileged: bad contract descriptor");
         if (!declared.has(contract.name)) throw new Error("executePrivileged(" + contract.name + ") was not declared by this action");
@@ -201,6 +228,23 @@ async function main() {
   server.listen(args.port, "127.0.0.1", () => {
     process.stdout.write("READY port=" + server.address().port + "\n");
   });
+
+  // Graceful shutdown: SIGTERM/SIGINT close the listener and the QA db, then
+  // exit. (An earlier revision only closed the db on signal — the process
+  // ignored termination and leaked. Caught by tests/serve-artifact-db.test.js.)
+  let shuttingDown = false;
+  for (const sig of ["SIGTERM", "SIGINT"]) {
+    process.on(sig, () => {
+      if (shuttingDown) return;
+      shuttingDown = true;
+      const finish = () => {
+        try { if (qaHandle) qaHandle.close(); } catch {}
+        process.exit(0);
+      };
+      server.close(finish);
+      setTimeout(finish, 1500).unref();
+    });
+  }
 }
 
 main().catch((e) => {

package/lib/test-detached-integrate.sh

@@ -50,6 +50,18 @@
 #   crash): re-running integrate takes the lock and pushes instead of
 #   parking on MERGED_EMPTY.
 #
+# Fixture F3 (stale-record recovery — blocker 35, 2026-09-21): rework moved
+#   the task branch backward after the merge was recorded, so the recorded
+#   merge carries abandoned work. Re-running integrate must fail closed
+#   with STALE_MERGE — never push the stale state, never fall through to
+#   MERGED_EMPTY (an unpushed merge sits on the line).
+#
+# Fixture I (push-target identity — blocker 35, 2026-09-21): the
+#   ERROR-after-MERGED retry path. I1: stale record → STALE_MERGE and the
+#   remote ref does not move. I2: branch restored to the merged tip → the
+#   legitimate retry still PUSHEDs. I3: the manual R5 shape (stale record
+#   plus a newer manual merge of the current tip on the line) → PUSHEDs.
+#
 # Fixture H (detached HEAD with an origin — 2026-09-19 detached-HEAD audit
 # REDO): H1 proves push-destination fails closed when origin/HEAD is unset
 # (genuinely unknowable destination); H2-H5 prove the detached line pushes
@@ -327,6 +339,116 @@ echo "$out" | grep -q '^MERGED_EMPTY' && fail "F2: wrongly MERGED_EMPTY while th
 
 echo "fixture F (merged-but-unpushed recovery): all checks passed"
 
+# ---------------- Fixture F3: stale record — branch moved after the merge ----------------
+# (blocker 35, room #26 J3, 2026-09-21): rework moved the task branch
+# BACKWARD after the merge was recorded (the recorded merge now carries
+# abandoned work). The recovery must NOT push the stale recorded state
+# labeled as the deliverable — STALE_MERGE fails closed, and it must not
+# fall through to MERGED_EMPTY either (an unpushed merge sits on the
+# line; MERGED_EMPTY would report PASS while a later publish diff would
+# still carry the abandoned work).
+# Reuse fixture D's repo (no remote): new task, merge, then reset the
+# branch to its pre-work base.
+cd "$D_DIR"
+export CREW_REPO="$D_DIR"
+export CREW_HOME="$T/home-d"
+tid="stale1"
+# Fixture F2's integrate left noremote1's lock held — release it so this
+# task's integrate doesn't back off on a foreign holder.
+"$REPO_DIR/lib/merge-lock.sh" release "noremote1" >/dev/null 2>&1 || fail "F3: lock release failed"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "F3 prepare failed: $out"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "F3 resolve-branch failed"
+F3_BASE=$(git rev-parse "$BRANCH")
+echo work >> "$D_DIR/.worktrees/$tid/f.txt"
+(cd "$D_DIR/.worktrees/$tid" && git commit -qam "work w1")
+F3_W1=$(git rev-parse "$BRANCH")
+git worktree remove --force "$D_DIR/.worktrees/$tid" || fail "F3: worktree remove failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "F3 integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "F3: expected MERGED, got: $out"
+F3_M1=$(git rev-parse HEAD)
+# Rework abandons w1: the branch goes back to its pre-work base.
+git branch -q -f "$BRANCH" "$F3_BASE" || fail "F3: branch reset failed"
+[ "$(git rev-parse "$BRANCH")" = "$F3_BASE" ] || fail "F3: branch not reset"
+"$REPO_DIR/lib/merge-lock.sh" release "$tid" >/dev/null 2>&1 || fail "F3: lock release failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) && \
+  fail "F3: integrate with a stale record should fail, got: $out"
+echo "$out" | grep -q '^STALE_MERGE' || fail "F3: expected STALE_MERGE, got: $out"
+echo "$out" | grep -q '^MERGED_EMPTY' && fail "F3: fell through to MERGED_EMPTY on a stale record: $out"
+echo "$out" | grep -q 'recovered:' && fail "F3: recovered a stale merge: $out"
+[ "$(git rev-parse HEAD)" = "$F3_M1" ] || fail "F3: HEAD moved during STALE_MERGE"
+echo "fixture F3 (stale record fails closed on re-integrate): all checks passed"
+
+# ---------------- Fixture I: branch + origin — stale push-target and the R5-manual shape ----------------
+# (blocker 35): the ERROR-after-MERGED retry path (push-target) pushed live
+# HEAD with no check. I1: stale record → STALE_MERGE, the remote ref does
+# not move. I2: branch restored to the merged tip → the legitimate retry
+# still PUSHEDs (identity check is not a refusal policy). I3: the manual
+# R5 shape (stale record + a newer manual merge of the CURRENT tip on the
+# line) → PUSHEDs — the identity check must not strand a good line.
+I_DIR="$T/fixture-i"
+I_REMOTE="$T/remote-i.git"
+git init -q --bare "$I_REMOTE"
+mkdir -p "$I_DIR"
+cd "$I_DIR"
+git init -q -b main .
+git config user.email test@test.t
+git config user.name test
+echo base > f.txt
+git add -A
+git commit -qm "base"
+git remote add origin "$I_REMOTE"
+git push -q origin main
+git symbolic-ref refs/remotes/origin/HEAD refs/remotes/origin/main
+export CREW_REPO="$I_DIR"
+export CREW_HOME="$I_DIR/home"
+export CREW_LIB="$REPO_DIR/lib"
+tid="staleorigin1"
+out=$(bash "$LIFECYCLE" prepare "$tid") || fail "I prepare failed: $out"
+BRANCH=$(bash "$LIFECYCLE" resolve-branch "$tid") || fail "I resolve-branch failed"
+I_BASE=$(git rev-parse "$BRANCH")
+echo work >> "$I_DIR/.worktrees/$tid/f.txt"
+(cd "$I_DIR/.worktrees/$tid" && git commit -qam "work w1")
+I_W1=$(git rev-parse "$BRANCH")
+git worktree remove --force "$I_DIR/.worktrees/$tid" || fail "I: worktree remove failed"
+out=$(bash "$LIFECYCLE" integrate "$tid" "merge: $tid" 2>&1) || fail "I integrate failed: $out"
+echo "$out" | grep -q '^MERGED:' || fail "I: expected MERGED, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I: expected inline PUSHED, got: $out"
+I_M1=$(git rev-parse HEAD)
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_M1" ] || fail "I: remote not at M1"
+
+# I1: rework abandons w1 (branch back to base); push-target must refuse.
+git branch -q -f "$BRANCH" "$I_BASE" || fail "I1: branch reset failed"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) && \
+  fail "I1: push-target with a stale record should fail, got: $out"
+echo "$out" | grep -q '^STALE_MERGE' || fail "I1: expected STALE_MERGE, got: $out"
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_M1" ] || \
+  fail "I1: remote moved despite STALE_MERGE"
+echo "fixture I1 (stale push-target fails closed): passed"
+
+# I2: branch restored to the merged tip — the legitimate retry pushes.
+git branch -q -f "$BRANCH" "$I_W1" || fail "I2: branch restore failed"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "I2 push-target failed: $out"
+echo "$out" | grep -q '^PUSH_IDENTITY_OK' || fail "I2: expected PUSH_IDENTITY_OK, got: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I2: expected PUSHED, got: $out"
+echo "fixture I2 (legitimate retry still pushes): passed"
+
+# I3: the manual R5 shape — stale record M1, but the line carries a newer
+# manual merge of the CURRENT tip w2. push-target must PUSH (no regression).
+echo work2 >> "$I_DIR/.worktrees/$tid/f.txt"
+(cd "$I_DIR/.worktrees/$tid" && git commit -qam "work w2")
+I_W2=$(git rev-parse "$BRANCH")
+git merge -q --no-ff "$BRANCH" -m "manual r5 merge" || fail "I3: manual merge failed"
+I_R=$(git rev-parse HEAD)
+[ "$(git rev-list --parents -n 1 "$I_R" | awk '{print $3}')" = "$I_W2" ] || \
+  fail "I3: manual merge ^2 is not the branch tip"
+out=$(bash "$LIFECYCLE" push-target "$tid" 2>&1) || fail "I3 push-target failed: $out"
+echo "$out" | grep -q '^PUSHED: origin/main' || fail "I3: expected PUSHED for the R5-manual shape, got: $out"
+[ "$(git --git-dir="$I_REMOTE" rev-parse refs/heads/main)" = "$I_R" ] || \
+  fail "I3: remote not at the manual merge"
+echo "fixture I3 (R5-manual shape still pushes): passed"
+
+echo "fixture I (stale push-target identity): all checks passed"
+
 # ---------------- Fixture G: push-target after MERGED_EMPTY ----------------
 # (2026-09-19 REVIEW #8: MERGED_EMPTY takes no lock and writes no record —
 # push-target must skip loudly, not report a misleading "lock lost".)

package/lib/test-merge-lock.sh

@@ -7,7 +7,10 @@
 # process is alive (PID liveness is never consulted); an expired lease is
 # reclaimed with logging; refresh extends the lease; release is
 # holder-only; status emits parseable holder/age/remaining fields; every
-# op appends to the merge-lock audit log. Exits 0 only if every case passes.
+# op appends to the merge-lock audit log. Case 14 pins the R-B1 fix: the
+# stale break's read→rm→create is serialized on the sidecar flock, so 8
+# concurrent reclaimers of an expired lease produce exactly one winner per
+# round (60 rounds). Exits 0 only if every case passes.
 
 set -uo pipefail
 
@@ -120,6 +123,32 @@ out=$(env -u CREW_REPO -u CREW_HOME "$LOCK" acquire task-x "task-x/run" 2>&1); c
 [ "$code" -eq 2 ] && [[ "$out" == *"BLOCKED"* ]] \
   && ok "13c: unset both on acquire exits 2 with BLOCKED" || no "13c: exit $code, out: $out"
 
+# --- Case 14: concurrent reclaim of an expired lease — exactly one winner ---
+# R-B1 (2026-09-21): the stale break used to rm the lock file before the
+# noclobber create, outside any atomic op, so N concurrent reclaimers could
+# all believe they held the lock (Reliability reproduced 54/60 bad rounds
+# with 8 contenders). The break is now serialized on the sidecar flock with
+# an in-critical-section re-read: exactly one contender exits 0 per round,
+# whatever the interleave (winners counted by exit code, not by reading the
+# lock file afterwards).
+bad_rounds=0
+for round in $(seq 1 60); do
+  printf 'task_id=old-task\nholder=old-task/run-old\nacquired_at=1577836800\nlease_seconds=600\n' \
+    > "$CREW_REPO/.worktrees/.merge-lock"
+  codes_file="$TMPBASE/reclaim-codes-$round"
+  rm -f "$codes_file"
+  for n in $(seq 1 8); do
+    ( "$LOCK" acquire "reclaimer-$n" "reclaimer-$n/run" >/dev/null 2>&1; echo "$?" >> "$codes_file" ) &
+  done
+  wait
+  winners=$(grep -c '^0$' "$codes_file" 2>/dev/null || true)
+  rm -f "$codes_file"
+  [ "$winners" -eq 1 ] || bad_rounds=$((bad_rounds + 1))
+done
+[ "$bad_rounds" -eq 0 ] \
+  && ok "14: 60 rounds x 8 concurrent reclaimers — exactly one exit-0 winner per round" \
+  || no "14: $bad_rounds/60 rounds had != 1 winner"
+
 echo ""
 echo "merge-lock: $pass passed, $fail failed"
 [ "$fail" -eq 0 ]