muse-crew 0.6.6 → 0.6.7

package/workflows/tests/read-board-parse.test.mjs

@@ -0,0 +1,162 @@
+// Regression tests for the read-board prompt/schema contradiction fix
+// (dispatcher 2026-09-12 13:21 PDT tick).
+//
+// The read-board prompt told the agent to return the stdout "verbatim,
+// byte-for-byte" (a string) while the agent-call schema demanded a
+// top-level object with ready_tasks. The LLM resolved the contradiction
+// non-deterministically: some ticks returned the parsed object and
+// validated, others returned the raw string (or an envelope) and burned
+// retries until the session blocked.
+//
+// The mechanical fix: the read-board agent() call carries NO schema — the
+// agent ferries the raw stdout string (parsing forbidden in the prompt) and
+// the workflow parses deterministically. The contract moved from the
+// agent's formatting choice to the deterministic parse, which must:
+//
+// - converge every return shape (raw string, parsed object, envelope
+//   string, envelope object) onto the same boardData,
+// - fail closed (throw) on invalid JSON, non-JSON returns, and envelopes
+//   with no ready_tasks — never a silent empty task set,
+// - read projects from the normalized boardData (the old code read
+//   boardResult.projects from the raw return, which broke when the return
+//   was a string).
+//
+// These tests extract parseBoardJson and unwrapBoardResult from the real
+// crew-dispatch.js source and assert the behavior, plus structural pins on
+// the call site. Same extract-and-evaluate pattern as
+// work-agent-failure.test.mjs.
+
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import assert from "node:assert/strict";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const DISPATCH = join(here, "..", "crew-dispatch.js");
+
+function extract(src, name, params) {
+  // Brace-counting extraction: find "function <name>(<params>) {" and scan
+  // to the matching close brace. Robust against inner blocks.
+  const startRe = new RegExp("[ ]*function " + name + "\\(" + params + "\\) \\{");
+  const m = src.match(startRe);
+  assert.ok(m, name + " function not found");
+  const start = m.index;
+  let depth = 0;
+  let i = start + m[0].length - 1; // at the opening brace
+  for (; i < src.length; i++) {
+    if (src[i] === "{") depth++;
+    else if (src[i] === "}") {
+      depth--;
+      if (depth === 0) return src.slice(start, i + 1);
+    }
+  }
+  assert.fail("unbalanced braces in " + name);
+}
+
+const source = readFileSync(DISPATCH, "utf8");
+const parseBoardJson = new Function(
+  "return (" + extract(source, "parseBoardJson", "boardReturn") + ")"
+)();
+const unwrapBoardResult = new Function(
+  "return (" + extract(source, "unwrapBoardResult", "boardResult") + ")"
+)();
+
+// The full deterministic pipeline the dispatcher runs on the agent return.
+function converge(boardReturn) {
+  return unwrapBoardResult(parseBoardJson(boardReturn));
+}
+
+const TASKS = [
+  { id: "task-1", title: "First", state: "todo" },
+  { id: "task-2", title: "Second", state: "todo" }
+];
+const PROJECTS = [{ id: "orchestra-dashboard" }, { id: "muse-crew" }];
+const BOARD = { ready_tasks: TASKS, projects: PROJECTS, config: {}, counts: {} };
+
+let pass = 0, fail = 0;
+function ok(name, fn) {
+  try {
+    fn();
+    pass++;
+    console.log("PASS: " + name);
+  } catch (e) {
+    fail++;
+    console.log("FAIL: " + name + " — " + e.message);
+  }
+}
+function throwsClosed(name, fn) {
+  ok(name, () => {
+    assert.throws(fn, (e) => e instanceof Error && e.message.length > 0,
+      "expected a fail-closed throw, got none");
+  });
+}
+
+// ── Convergent return shapes ─────────────────────────────────────────
+ok("raw stdout string converges to boardData", () => {
+  const boardData = converge(JSON.stringify(BOARD));
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+  assert.deepStrictEqual(boardData.projects, PROJECTS);
+});
+
+ok("parsed object return converges to the same boardData", () => {
+  const boardData = converge(BOARD);
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+  assert.deepStrictEqual(boardData.projects, PROJECTS);
+});
+
+ok("envelope string {\"data\": {...}} converges", () => {
+  const boardData = converge(JSON.stringify({ data: BOARD }));
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+});
+
+ok("envelope object {result: {ready_tasks}} converges", () => {
+  const boardData = converge({ result: { ready_tasks: TASKS } });
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+});
+
+ok("envelope object {stdout: json-string} converges", () => {
+  const boardData = converge({ stdout: JSON.stringify(BOARD) });
+  assert.deepStrictEqual(boardData.ready_tasks, TASKS);
+});
+
+ok("string and object returns converge identically (deep equal)", () => {
+  const fromString = converge(JSON.stringify(BOARD));
+  const fromObject = converge(JSON.parse(JSON.stringify(BOARD)));
+  assert.deepStrictEqual(fromString, fromObject);
+});
+
+// ── Fail-closed: never a silent empty task set ──────────────────────
+throwsClosed("invalid JSON string throws", () => converge("{not json"));
+throwsClosed("truncated JSON throws", () => converge('{"ready_tasks": ['));
+throwsClosed("null throws", () => converge(null));
+throwsClosed("undefined throws", () => converge(undefined));
+throwsClosed("number throws", () => converge(42));
+throwsClosed("empty string throws", () => converge(""));
+throwsClosed("valid JSON without ready_tasks throws", () => converge(JSON.stringify({ foo: 1 })));
+throwsClosed("envelope without ready_tasks throws", () => converge(JSON.stringify({ data: {} })));
+
+// ── Structural pins on the call site ────────────────────────────────
+ok("read-board agent call exists", () => {
+  assert.ok(source.includes('key: "read-board"'), "key marker missing");
+});
+ok("read-board agent call carries no schema", () => {
+  const keyIdx = source.indexOf('key: "read-board"');
+  const nextAgentIdx = source.indexOf("await agent(", keyIdx + 1);
+  const callWindow = nextAgentIdx === -1 ? source.slice(keyIdx) : source.slice(keyIdx, nextAgentIdx);
+  assert.ok(!callWindow.includes("schema:"), "schema found on read-board call");
+});
+ok("read-board prompt demands a raw string and forbids parsing", () => {
+  assert.ok(source.includes("Do NOT parse the JSON"),
+    "prompt must forbid parsing");
+  assert.ok(source.includes("byte-for-byte, unmodified"),
+    "prompt must demand verbatim ferry");
+});
+ok("projects is read from normalized boardData, not the raw return", () => {
+  assert.ok(source.includes("const projects = boardData.projects"),
+    "projects must come from boardData (raw return may be a string)");
+  assert.ok(!source.includes("boardResult.projects"),
+    "stale boardResult.projects read must be gone");
+});
+
+console.log("\n" + pass + " passed, " + fail + " failed.");
+process.exit(fail > 0 ? 1 : 0);

package/lib/orphan-sweep.sh

@@ -1,287 +0,0 @@
-#!/usr/bin/env bash
-# orphan-sweep.sh — find and clean orphaned worktrees, stale merge locks,
-# and stale lifecycle pins
-#
-# Usage:
-#   orphan-sweep.sh report  — list orphans (read-only for worktrees);
-#                              expired-lease locks are released
-#   orphan-sweep.sh clean   — remove safe-to-clean orphans (merged branches only),
-#                              release expired-lease merge locks, and remove pins whose
-#                              task has no running session
-#
-# Active-run knowledge is injected by the caller, never fetched here:
-#   CREW_ACTIVE_TASKS      — space-separated task IDs with a running session
-#   CREW_ACTIVE_TASKS_FILE — path to a file with one task ID per line
-#                            (blank lines and '#' comments are ignored)
-# Both inputs feed one active set, matched exactly against worktree dir names
-# and pin dir names. Both inputs must contain full task UUIDs (lowercase
-# 8-4-4-4-12 hex, e.g. 7dbe861d-cddd-479f-87e9-9423539c08a3): clean mode
-# validates every entry against that format and exits 2 with a BLOCKED line
-# on any malformed entry, because a truncated or reformatted ID would never
-# match exactly and would silently defeat the never-touch-active-runs
-# promise.
-# A task in the active set is never touched: its worktree, any merge lock
-# it holds, and its lifecycle pin are skipped regardless of merge status,
-# lock age, or PID liveness.
-#
-# Lifecycle pins live on persistent disk ($CREW_HOME/.pins/<task>) so a VM
-# reboot (which wipes tmpfs /tmp) can't strand a run mid-flight. A pin whose
-# task has no running session is safe to remove: any new run re-pins
-# idempotently (mkdir -p + cp) before use.
-#
-# Restart-fragility guard (bug a8bf78ca): pin reaping requires REAP_AFTER
-# (default 3, override via ORPHAN_SWEEP_REAP_AFTER) consecutive clean-mode
-# observations with valid active-run data showing the task absent. A single
-# observation never reaps a pin — a daemon restart can make a live task's
-# session read as not-running for one observation window. A first absence
-# only plants a tombstone marker ($CREW_HOME/.pins/.sweep-suspects/<task>);
-# a task present in the active set is never touched and clears its marker.
-# Report mode and BLOCKED clean (no active-run data) never touch markers.
-#
-# Fail closed: clean mode without either input refuses to remove anything
-# and exits 2. Report mode without either input still runs read-only but
-# prints a banner noting the ACTIVE checks were skipped.
-#
-# Callers (the sweep cron body; worktree-lifecycle.sh cmd_sweep is a
-# passthrough) must export CREW_ACTIVE_TASKS.
-#
-# "Safe to clean" means the task branch is fully merged into main.
-# Dirty or unmerged worktrees are always preserved and reported.
-
-set -euo pipefail
-
-REPO="${CREW_REPO:-$HOME/workspace/ts-spaces/orchestra-dashboard}"
-WORKTREE_DIR="$REPO/.worktrees"
-LOCK_FILE="$WORKTREE_DIR/.merge-lock"
-MERGE_LOCK_SCRIPT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/merge-lock.sh"
-
-cmd="${1:-report}"
-found=0
-any_failed=0
-
-# --- Active-run set (union of both inputs) ---
-have_active_data=0
-ACTIVE_TASKS=""
-if [ -n "${CREW_ACTIVE_TASKS+set}" ]; then
-  have_active_data=1
-  ACTIVE_TASKS="${ACTIVE_TASKS} ${CREW_ACTIVE_TASKS}"
-fi
-if [ -n "${CREW_ACTIVE_TASKS_FILE+set}" ]; then
-  if [ -r "${CREW_ACTIVE_TASKS_FILE}" ]; then
-    have_active_data=1
-    while IFS= read -r line || [ -n "$line" ]; do
-      case "$line" in ''|\#*) continue ;; esac
-      ACTIVE_TASKS="${ACTIVE_TASKS} ${line}"
-    done < "${CREW_ACTIVE_TASKS_FILE}"
-  fi
-fi
-
-task_is_active() {
-  [ -n "${1:-}" ] || return 1
-  case " ${ACTIVE_TASKS} " in
-    *" $1 "*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# Fail closed on malformed active-run IDs: the guard below matches entries
-# exactly against full-UUID directory names, branch names, and merge-lock
-# holders. A short/truncated/reformatted ID would never match and would
-# silently defeat the never-touch-active-runs promise. No prefix or fuzzy
-# matching — ambiguous prefixes could match multiple runs; refusing is
-# the correct behavior.
-UUID_RE='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
-if [ "$cmd" = "clean" ] && [ "$have_active_data" -eq 1 ]; then
-  for entry in $ACTIVE_TASKS; do
-    if [[ ! "$entry" =~ $UUID_RE ]]; then
-      echo "BLOCKED: CREW_ACTIVE_TASKS entry '$entry' is not a full task UUID (expected lowercase 8-4-4-4-12 hex) — refusing to clean"
-      exit 2
-    fi
-  done
-fi
-
-if [ "$cmd" = "clean" ] && [ "$have_active_data" -eq 0 ]; then
-  echo "BLOCKED: clean mode requires the active-run list (set CREW_ACTIVE_TASKS or CREW_ACTIVE_TASKS_FILE) — refusing to remove anything"
-  exit 2
-fi
-
-if [ "$cmd" != "clean" ] && [ "$have_active_data" -eq 0 ]; then
-  echo "NOTE: no active-run data provided; ACTIVE checks skipped"
-fi
-
-# --- Stale merge lock (lease-based; bug 2fc8f52f) ---
-# Owner identity comes from merge-lock.sh status key=value fields — never
-# from a PID. Fail-closed: a lock whose task has a running session is
-# untouched regardless of lease age; a lock whose task has no running
-# session is broken only when its lease is expired. The break goes through
-# merge-lock.sh release (or force-release for an unparseable file with no
-# identifiable holder) so it lands in the merge-lock audit log.
-if [ -f "$LOCK_FILE" ]; then
-  lock_status="$("$MERGE_LOCK_SCRIPT" status 2>/dev/null || echo UNLOCKED)"
-  if [ "$lock_status" = "UNLOCKED" ]; then
-    : # lock file vanished between the check and the read — nothing held
-  else
-    lock_holder=$(printf '%s\n' "$lock_status" | sed -n 's/^task_id=//p' | head -1)
-    lock_remaining=$(printf '%s\n' "$lock_status" | sed -n 's/^remaining_seconds=//p' | head -1)
-    lock_age=$(printf '%s\n' "$lock_status" | sed -n 's/^age_seconds=//p' | head -1)
-    if task_is_active "$lock_holder"; then
-      echo "ACTIVE_LOCK: held by ${lock_holder:-unknown} (active run on dashboard) — skipping"
-      found=1
-    elif [ "${lock_remaining:-unknown}" != "unknown" ] && [ "$lock_remaining" -gt 0 ]; then
-      echo "HELD_LOCK: held by ${lock_holder:-unknown} (lease ${lock_remaining}s remaining) — skipping"
-      found=1
-    else
-      echo "STALE_LOCK: held by ${lock_holder:-unknown} (age ${lock_age:-unknown}s, lease expired, no running session)"
-      found=1
-      if [ -n "$lock_holder" ]; then
-        rel_out=$("$MERGE_LOCK_SCRIPT" release "$lock_holder" 2>&1) || true
-      else
-        rel_out=$("$MERGE_LOCK_SCRIPT" force-release 2>&1) || true
-      fi
-      case "$rel_out" in
-        *RELEASED*)
-          echo "  → released (lease expired)"
-          ;;
-        *)
-          echo "  → FAILED: could not release lock: $rel_out"
-          any_failed=1
-          ;;
-      esac
-    fi
-  fi
-fi
-
-# --- Prune git worktree metadata ---
-cd "$REPO"
-git worktree prune 2>/dev/null
-
-# --- Scan worktree directories ---
-if [ -d "$WORKTREE_DIR" ]; then
-  for wt in "$WORKTREE_DIR"/*/; do
-    [ -d "$wt" ] || continue
-    task_id=$(basename "$wt")
-
-    # Skip hidden dirs and lock files
-    [[ "$task_id" == .* ]] && continue
-
-    branch="task/$task_id"
-
-    found=1
-
-    # Active runs are never touched, regardless of merge status.
-    if task_is_active "$task_id"; then
-      echo "ACTIVE: $task_id — dashboard shows a running session, skipped"
-      continue
-    fi
-
-    # Is the branch merged into main?
-    merged=$(git branch --merged main 2>/dev/null | sed 's/^[* +]*//' | grep -Fx "$branch" || true)
-
-    # Is the worktree dirty?
-    dirty=$(cd "$wt" && git status --porcelain 2>/dev/null | wc -l)
-
-    if [ -n "$merged" ]; then
-      echo "MERGED: $task_id — branch merged into main, safe to remove"
-      if [ "$cmd" = "clean" ]; then
-        git worktree remove "$wt" 2>/dev/null || true
-        git branch -d "$branch" 2>/dev/null || true
-        if [ ! -d "$wt" ] && ! git show-ref --verify --quiet "refs/heads/$branch"; then
-          echo "  → removed"
-        else
-          echo "  → FAILED: removal attempted but worktree/branch still present, left in place"
-          any_failed=1
-        fi
-      fi
-    elif [ "$dirty" -gt 0 ]; then
-      echo "DIRTY: $task_id — $dirty uncommitted changes, preserved"
-    else
-      echo "UNMERGED: $task_id — committed work not yet merged, preserved"
-    fi
-  done
-fi
-
-# --- Reap stale lifecycle pins (restart-fragility guard; bug a8bf78ca) ---
-# A pin whose task is absent from the active set is reaped only after
-# REAP_AFTER consecutive clean-mode observations with valid active-run
-# data still show it absent. Counters only — no wall clock.
-PINS_DIR="${CREW_HOME:-$HOME/workspace/.jarvis}/.pins"
-SUSPECTS_DIR="$PINS_DIR/.sweep-suspects"
-REAP_AFTER="${ORPHAN_SWEEP_REAP_AFTER:-3}"
-if [ "$cmd" = "clean" ]; then
-  if ! [[ "$REAP_AFTER" =~ ^[1-9][0-9]*$ ]]; then
-    echo "BLOCKED: ORPHAN_SWEEP_REAP_AFTER='$REAP_AFTER' is not a positive integer — refusing to clean"
-    exit 2
-  fi
-fi
-if [ -d "$PINS_DIR" ]; then
-  for pin in "$PINS_DIR"/*/; do
-    [ -d "$pin" ] || continue
-    task_id=$(basename "$pin")
-
-    # Skip hidden dirs (the .sweep-suspects dir lives under PINS_DIR)
-    [[ "$task_id" == .* ]] && continue
-
-    found=1
-
-    # Active runs are never touched; a pending tombstone is stale.
-    if task_is_active "$task_id"; then
-      if [ -f "$SUSPECTS_DIR/$task_id" ]; then
-        rm -f "$SUSPECTS_DIR/$task_id"
-      fi
-      echo "ACTIVE_PIN: $task_id — dashboard shows a running session, kept"
-      continue
-    fi
-
-    # Clean mode: count consecutive negative observations; reap only after
-    # REAP_AFTER of them. Report mode stays read-only and never touches
-    # markers — only clean-mode observations count.
-    if [ "$cmd" = "clean" ]; then
-      count=0
-      marker="$SUSPECTS_DIR/$task_id"
-      if [ -f "$marker" ]; then
-        count=$(cat "$marker" 2>/dev/null || echo 0)
-        [[ "$count" =~ ^[0-9]+$ ]] || count=0
-      fi
-      count=$((count + 1))
-      if [ "$count" -lt "$REAP_AFTER" ]; then
-        mkdir -p "$SUSPECTS_DIR"
-        printf '%s\n' "$count" > "$marker"
-        echo "SUSPECT_PIN: $task_id — no running session (observation $count/$REAP_AFTER), kept for now"
-        continue
-      fi
-      echo "STALE_PIN: $task_id — no running session for $REAP_AFTER consecutive observations, removing"
-      rm -rf "$pin"
-      rm -f "$marker"
-      if [ ! -d "$pin" ]; then
-        echo "  → removed"
-      else
-        echo "  → FAILED: pin still present after rm, left in place"
-        any_failed=1
-      fi
-      continue
-    fi
-
-    echo "STALE_PIN: $task_id — no running session, safe to remove"
-  done
-
-  # Prune tombstones whose pin dir no longer exists (e.g. a run cleaned up
-  # its own pin). Deleting state is a clean-mode action only.
-  if [ "$cmd" = "clean" ] && [ -d "$SUSPECTS_DIR" ]; then
-    for marker in "$SUSPECTS_DIR"/*; do
-      [ -f "$marker" ] || continue
-      marker_task=$(basename "$marker")
-      if [ ! -d "$PINS_DIR/$marker_task" ]; then
-        rm -f "$marker"
-      fi
-    done
-  fi
-fi
-
-if [ "$found" -eq 0 ]; then
-  echo "CLEAN: no orphans, no stale locks, no stale pins"
-fi
-
-if [ "$any_failed" -eq 1 ]; then
-  exit 1
-fi
-exit 0