muse-crew 0.6.5 → 0.6.6

package/lib/AGENTS.md

@@ -5,7 +5,7 @@ Shell scripts for the crew's infrastructure. Called by workflow scripts, cron, a
 - `build-registry.js` — deterministic extractor that generates `workflows/registry.json` (workflow step registry) from the workflow files' `meta` blocks at release time; invoked by `crew-release.sh` deploy
 - `crew-release.sh` — immutable release manager: deploy, rollback, prune
 - `merge-lock.sh` — serialized merge lock for concurrent agents: time-based holder lease (bug 2fc8f52f — an unexpired lease is held regardless of process liveness; only an expired lease may be broken). Lock file is key=value: task_id, opaque holder identity (never a PID), acquired_at epoch, lease_seconds (default 600, override via MERGE_LOCK_LEASE_SECONDS). acquire/refresh/release/status/force-release; holder-only refresh and release; every op appends to $CREW_HOME/.merge-lock.log
-- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or `LOCKED by <holder> since <ts> (pid <pid>)`, always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
+- `worktree-lifecycle.sh` — the worktree lifecycle seam: prepare/cleanup/inspect/integrate/verify-merge/status/post-deploy/refresh-lock/lock-status over git worktrees (`.worktrees/<id>`, branch `task/<id>`). The crew registry (`<repo>/.worktrees/.registry/<id>`) is the source of truth for task→branch/path — never reconstruct it from git state. Prepare fails closed on dirty `main`; cleanup is forgiving. `lock-status` reports the merge-lock state explicitly (`UNLOCKED`, or key=value: locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds — always exit 0) so Publish can distinguish an empty-diff Integrate (no lock taken) from a refresh failure.
 - `test-worktree-backend.sh` — regression tests for the lifecycle script (validate, prepare/reuse, inspect, status, cleanup, idempotent cleanup, dirty-main preflight) on a scratch repo
 - `test-version-write.sh` — regression tests for the escape-preserving step-8 version write in publish-npm.sh (fixture: current package.json with the \\u2014 escape; extracts the shipped block by anchor)
 - `test-publish-verify.sh` — regression tests for the retry-tolerant step-12 verification in publish-npm.sh (canary 5a027278): extracts the shipped block by anchor and runs it against a fake npm whose read replica lags (non-zero exits, then the old version, then the target) — requires convergence on success, fail-closed `PUBLISH_FAILED=verify` on exhaustion, and `--prefer-online` on every read

package/lib/publish-npm.sh

@@ -115,6 +115,28 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
     # empty diff and fails closed at the numstat check.
     # STEP-8-ANCHOR: version write (escape-preserving)
     PKG_JSON="$REPO_PATH/package.json"
+    # STRANDED-ANCHOR: resume after a killed publish (release commit made,
+    # registry never updated). If the working tree's package.json already
+    # carries TARGET_VERSION and HEAD is the script's own release commit for
+    # it, the version write is a no-op by design — skip it and let step 9
+    # confirm the commit. If HEAD is NOT the release commit, fail closed:
+    # a foreign version bump must never be papered over by a publish.
+    PRE_VER="$(PKG_JSON="$PKG_JSON" node -p "JSON.parse(require('fs').readFileSync(process.env.PKG_JSON,'utf8')).version")" \
+      || fail "version-write" "could not parse package.json before write"
+    STRANDED=0
+    if [ "$PRE_VER" = "$TARGET_VERSION" ]; then
+      case "$HEAD_MSG" in
+        "release: $PKG@$TARGET_VERSION"*)
+          STRANDED=1
+          echo "PUBLISH_STRANDED_RESUME=1"
+          ;;
+        *)
+          fail "version-diff" "package.json already at $TARGET_VERSION but HEAD is not its release commit: $HEAD_MSG"
+          ;;
+      esac
+    fi
+    # STRANDED-END
+    if [ "$STRANDED" = "0" ]; then
     ESCAPED_VER="$(printf '%s' "$TARGET_VERSION" | sed 's/[&\\]/\\&/g')"
     sed -i -E 's/^([[:space:]]*"version"[[:space:]]*:[[:space:]]*)"[^"]*"/\1"'"$ESCAPED_VER"'"/' "$PKG_JSON" \
       || fail "version-write" "sed could not write $TARGET_VERSION into package.json"
@@ -129,6 +151,7 @@ if [ "$ALREADY_PUBLISHED" = "0" ]; then
     ADD_DEL="$(git -C "$REPO_PATH" diff --numstat -- package.json | tr '\t' ' ')"
     [ "$ADD_DEL" = "1 1 package.json" ] \
       || fail "version-diff" "expected a single-line version change, got: $ADD_DEL"
+    fi
     # STEP-8-END
 
     # 9. Commit only if changed (retried run leaves the commit in place).

package/lib/test-publish-skip.sh

@@ -59,8 +59,9 @@ fi
 bash "$MERGE_LOCK" acquire "$TASK" "$$" >/dev/null
 OUT="$(bash "$LIFECYCLE" lock-status "$TASK" 2>&1)"
 CODE=$?
-if [ $CODE -eq 0 ] && printf '%s' "$OUT" | grep -Eq "^LOCKED by $TASK since .+ \(pid [0-9]+\)$"; then
-  ok "lock-status reports LOCKED by <holder> since <ts> (pid <pid>) (exit 0)"
+if [ $CODE -eq 0 ] && printf '%s' "$OUT" | grep -Eq "^locked=true$" \
+  && printf '%s' "$OUT" | grep -Eq "^task_id=$TASK$"; then
+  ok "lock-status reports key=value (locked=true, task_id=$TASK) (exit 0)"
 else
   no "lock-status LOCKED: code=$CODE out='$OUT'"
 fi

package/lib/test-publish-stranded.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# test-publish-stranded.sh — regression test for the stranded-release resume
+# in lib/publish-npm.sh (park 2026-09-11).
+#
+# A service restart can kill a Publish run between the release commit and the
+# registry PUT. The release commit is pushed, but npm never got the tarball.
+# Replaying the script must not fail the version-diff guard (the write is a
+# no-op because package.json already carries the target): the script detects
+# the stranded state and resumes at pack/publish. A package.json already at
+# the target whose HEAD is NOT the script's own release commit is a foreign
+# version bump and must fail closed.
+#
+# Self-contained: extracts the shipped STRANDED block from lib/publish-npm.sh
+# by anchor and runs it against scratch checkouts.
+#
+# Anchors: `# STRANDED-ANCHOR` ... `# STRANDED-END` in lib/publish-npm.sh.
+
+set -uo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PUBLISH="$SCRIPT_DIR/publish-npm.sh"
+
+PKG="muse-crew"
+TARGET_VERSION="9.9.9"
+STRANDED_MSG="release: muse-crew@9.9.9 (task-aaa)"
+STRANDED_MSG_BARE="release: muse-crew@9.9.9"
+
+pass=0
+fail_count=0
+ok() { echo "PASS: $1"; pass=$((pass + 1)); }
+no() { echo "FAIL: $1"; fail_count=$((fail_count + 1)); }
+
+TMPBASE="$(mktemp -d)"
+trap 'rm -rf "$TMPBASE"' EXIT
+
+# --- Extract the shipped STRANDED block by anchor ---
+BLOCK="$TMPBASE/stranded.sh"
+sed -n '/# STRANDED-ANCHOR/,/# STRANDED-END/p' "$PUBLISH" > "$BLOCK"
+if grep -q 'PUBLISH_STRANDED_RESUME=1' "$BLOCK" && grep -q 'fail "version-diff"' "$BLOCK"; then
+  ok "extracted STRANDED block from publish-npm.sh"
+else
+  no "STRANDED extraction failed (anchors missing)"
+fi
+
+# make_checkout <version> <head-msg>: a scratch git checkout whose
+# package.json carries <version> and whose HEAD message is <head-msg>.
+make_checkout() {
+  local ver="$1" msg="$2" dir="$TMPBASE/checkout-$RANDOM"
+  mkdir -p "$dir"
+  git -C "$dir" init -q
+  git -C "$dir" config user.email "test@test"
+  git -C "$dir" config user.name "test"
+  printf '{\n  "name": "muse-crew",\n  "version": "%s"\n}\n' "$ver" > "$dir/package.json"
+  git -C "$dir" add package.json
+  git -C "$dir" commit -q -m "$msg"
+  printf '%s' "$dir"
+}
+
+# run_stranded <checkout-dir> <head-msg>: runs the shipped block with
+# PKG_JSON/PKG/TARGET_VERSION/HEAD_MSG set; captures stdout in $OUT.
+run_stranded() {
+  local dir="$1" msg="$2" runner="$TMPBASE/runner-$RANDOM.sh"
+  {
+    echo 'fail() { echo "PUBLISH_FAILED=$1"; shift; echo "$1"; exit 1; }'
+    cat "$BLOCK"
+    echo 'echo "STRANDED_RESULT=$STRANDED"'
+  } > "$runner"
+  chmod +x "$runner"
+  OUT="$(PKG_JSON="$dir/package.json" PKG="$PKG" \
+    TARGET_VERSION="$TARGET_VERSION" HEAD_MSG="$msg" \
+    bash "$runner" 2>&1)"
+  local code=$?
+  echo "$OUT"
+  return "$code"
+}
+
+# --- Case 1: stranded release commit (with task id) — resume, no write ---
+DIR1="$(make_checkout "$TARGET_VERSION" "$STRANDED_MSG")"
+BEFORE1="$(cat "$DIR1/package.json")"
+OUT="$(run_stranded "$DIR1" "$STRANDED_MSG")"
+CODE=$?
+if [ "$CODE" -eq 0 ]; then
+  ok "stranded resume: block exits 0"
+else
+  no "stranded resume: block exited $CODE (output: $OUT)"
+fi
+case "$OUT" in
+  *"PUBLISH_STRANDED_RESUME=1"*)
+    ok "stranded resume: prints PUBLISH_STRANDED_RESUME=1" ;;
+  *) no "stranded resume: missing PUBLISH_STRANDED_RESUME=1 (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"STRANDED_RESULT=1"*)
+    ok "stranded resume: STRANDED=1 (skips the version write)" ;;
+  *) no "stranded resume: expected STRANDED=1 (output: $OUT)" ;;
+esac
+if [ "$(cat "$DIR1/package.json")" = "$BEFORE1" ]; then
+  ok "stranded resume: package.json untouched (write skipped)"
+else
+  no "stranded resume: package.json was modified"
+fi
+
+# --- Case 2: bare release message form (no task id) — also resumes ---
+DIR2="$(make_checkout "$TARGET_VERSION" "$STRANDED_MSG_BARE")"
+OUT="$(run_stranded "$DIR2" "$STRANDED_MSG_BARE")"
+CODE=$?
+if [ "$CODE" -eq 0 ] && grep -q 'PUBLISH_STRANDED_RESUME=1' <<< "$OUT"; then
+  ok "bare release message form also resumes"
+else
+  no "bare release message form failed to resume (code $CODE, output: $OUT)"
+fi
+
+# --- Case 3: foreign version bump — fail closed ---
+DIR3="$(make_checkout "$TARGET_VERSION" "merge: some other fix")"
+OUT="$(run_stranded "$DIR3" "merge: some other fix")"
+CODE=$?
+if [ "$CODE" -ne 0 ]; then
+  ok "foreign version: block fails closed (non-zero exit)"
+else
+  no "foreign version: block exited 0 despite foreign HEAD"
+fi
+case "$OUT" in
+  *"PUBLISH_FAILED=version-diff"*)
+    ok "foreign version: keeps the PUBLISH_FAILED=version-diff marker" ;;
+  *) no "foreign version: missing PUBLISH_FAILED=version-diff (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"not its release commit"*)
+    ok "foreign version: detail names the mismatch" ;;
+  *) no "foreign version: missing mismatch detail (output: $OUT)" ;;
+esac
+
+# --- Case 4: normal path (package.json behind) — no resume, write proceeds ---
+DIR4="$(make_checkout "9.9.8" "merge: some other fix")"
+OUT="$(run_stranded "$DIR4" "merge: some other fix")"
+CODE=$?
+if [ "$CODE" -eq 0 ]; then
+  ok "normal path: block exits 0"
+else
+  no "normal path: block exited $CODE (output: $OUT)"
+fi
+case "$OUT" in
+  *"STRANDED_RESULT=0"*)
+    ok "normal path: STRANDED=0 (version write proceeds)" ;;
+  *) no "normal path: expected STRANDED=0 (output: $OUT)" ;;
+esac
+case "$OUT" in
+  *"PUBLISH_STRANDED_RESUME=1"*) no "normal path: must not print PUBLISH_STRANDED_RESUME=1" ;;
+  *) ok "normal path: no stranded-resume marker" ;;
+esac
+
+echo ""
+echo "$pass passed, $fail_count failed."
+[ "$fail_count" -eq 0 ]

package/lib/worktree-lifecycle.sh

@@ -20,7 +20,7 @@
 #   cleanup   <task_id>                  — remove worktree + branch (no lock)
 #   status    <task_id>                  — report worktree state
 #   refresh-lock <task_id>               — refresh merge lock timestamp (resets staleness clock)
-#   lock-status <task_id>                — report merge lock state: UNLOCKED or LOCKED by <holder> since <ts> (pid <pid>)
+#   lock-status <task_id>                — report merge lock state: UNLOCKED, or key=value lock status (locked=true, task_id, holder, acquired_at, lease_seconds, age_seconds, remaining_seconds)
 #   sweep     [report|clean]             — find/clean orphans + stale locks
 #
 # Exit codes:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "muse-crew",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "Opinionated orchestration for Muse \u2014 workflows, identities, and tooling for autonomous software development.",
   "license": "UNLICENSED",
   "private": false,

package/workflows/crew-dispatch.js

@@ -384,12 +384,6 @@ if (parkJobs.length > 0) {
   } catch (parkErr) {
     log("WARNING: park batch failed (" + (parkErr.message || String(parkErr)).slice(0, 200) + ") — tasks remain retryable");
   }
-} else {
-  // Cap disabled, or no retry candidates: pre-cap behavior.
-  for (var dr = 0; dr < retryCandidates.length; dr++) {
-    var drc = retryCandidates[dr];
-    eligible.push({ task: drc.task, startStep: drc.startStep, reason: "retry", workflow: drc.workflow });
-  }
 }
 
 log("Eligible: " + eligible.length + " tasks (" + retryCandidates.length + " retry candidates)");
@@ -617,7 +611,20 @@ await agent(
   { key: "ack", label: "Acknowledging poll", schema: { type: "object" } }
 );
 
-var recommended = results.filter(function(r) { return r.action === "recommended"; });
+var recommended = [];
+var seenClaims = {};
+results.forEach(function(r) {
+  if (r.action !== "recommended") { return; }
+  if (seenClaims[r.task_id]) {
+    // Mechanical guard: a single run must never emit the same task twice in
+    // its claims array. The self-claim stand-down path was designed for
+    // cross-tick races, not for one run claiming a task against itself.
+    log("WARNING: dropped duplicate claim for task " + r.task_id + " within this run (kept first)");
+    return;
+  }
+  seenClaims[r.task_id] = true;
+  recommended.push(r);
+});
 var completed = results.filter(function(r) { return r.action === "completed"; });
 var msg = "Dispatch complete.";
 if (recommended.length > 0) {