prizmkit 1.1.153 → 1.1.155

package/bundled/dev-pipeline/prizmkit_runtime/runtime_commit.py

@@ -0,0 +1,482 @@
+"""Runtime-owned local commit execution for prepared pipeline tasks."""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import tempfile
+from dataclasses import dataclass
+from pathlib import Path, PurePosixPath
+from typing import Mapping, Sequence
+
+from .checkpoint_state import (
+    load_checkpoint_state,
+    semantic_state_key,
+    validate_checkpoint_data,
+)
+from .gitops import HIDDEN_TOOL_WORKTREE_EXCLUDES
+
+REQUEST_FILENAME = "runtime-commit-request.json"
+REQUEST_SCHEMA_VERSION = 1
+_HEX_COMMIT = re.compile(r"^[0-9a-fA-F]{40,64}$")
+_FORBIDDEN_EXACT_PATHS = {
+    ".claude/settings.local.json",
+    ".codebuddy/settings.local.json",
+    ".codex/settings.local.json",
+    ".agents/settings.local.json",
+    ".pi/settings.local.json",
+}
+_SENSITIVE_NAMES = {
+    ".env",
+    "id_rsa",
+    "id_dsa",
+    "id_ed25519",
+    "credentials.json",
+    "secrets.json",
+}
+_SENSITIVE_SUFFIXES = {".pem", ".p12", ".pfx"}
+_SUPPORT_ROOT_FILES = {"agents.md", "skills-lock.json"}
+_SUPPORT_ROOT_DIRS = {".claude", ".codebuddy", ".codex", ".agents", ".pi"}
+
+
+@dataclass(frozen=True)
+class RuntimeCommitRequest:
+    """Validated commit preparation emitted by the committer stage."""
+
+    artifact_dir: str
+    base_head: str
+    commit_message: str
+    intended_paths: tuple[str, ...]
+    runtime_commit_hash: str = ""
+
+
+@dataclass(frozen=True)
+class RuntimeCommitResult:
+    """Observable result of one runtime commit finalization attempt."""
+
+    status: str
+    reason: str = ""
+    commit_hash: str = ""
+    recovered: bool = False
+
+    @property
+    def committed(self) -> bool:
+        return self.status == "committed"
+
+
+@dataclass(frozen=True)
+class _GitResult:
+    return_code: int
+    stdout: str
+    stderr: str
+
+
+def finalize_runtime_commit(
+    project_root: Path,
+    *,
+    artifact_dir: Path,
+    checkpoint_path: Path,
+) -> RuntimeCommitResult:
+    """Execute and finalize a valid COMMIT_PENDING runtime handoff.
+
+    A completed checkpoint is accepted only for idempotent cleanup recovery
+    when a request remains after commit finalization passed.
+    """
+    try:
+        root = project_root.resolve()
+        artifact = artifact_dir.resolve()
+        checkpoint = checkpoint_path.resolve()
+    except (OSError, RuntimeError):
+        return RuntimeCommitResult("failed", "unsafe_artifact_identity")
+    if not _within(artifact, root) or not _within(checkpoint, artifact):
+        return RuntimeCommitResult("failed", "unsafe_artifact_identity")
+
+    state = load_checkpoint_state(checkpoint, project_root=root)
+    if not state.valid:
+        return RuntimeCommitResult("failed", f"invalid_checkpoint:{state.error_code}")
+    if not state.semantic_commit_ready and not state.semantic_complete:
+        return RuntimeCommitResult("not_ready", "checkpoint_not_commit_ready")
+
+    request_path = artifact / REQUEST_FILENAME
+    request, error = _load_request(request_path, root, artifact)
+    if request is None:
+        if state.semantic_complete and error == "commit_request_missing":
+            return RuntimeCommitResult("not_ready", "runtime_commit_already_finalized")
+        return RuntimeCommitResult("failed", error or "invalid_commit_request")
+
+    if any(_is_tracked(root, path) for path in (request_path, checkpoint)):
+        return RuntimeCommitResult("failed", "runtime_metadata_must_be_untracked")
+
+    current_head = _git(root, "rev-parse", "HEAD")
+    if current_head.return_code != 0:
+        return RuntimeCommitResult("failed", "git_head_unavailable")
+    head = current_head.stdout.strip()
+    recovered = False
+
+    if head == request.base_head:
+        if request.runtime_commit_hash:
+            return RuntimeCommitResult("failed", "premature_runtime_commit_hash")
+        if state.semantic_complete:
+            return RuntimeCommitResult("failed", "completed_checkpoint_without_commit")
+        changed, status_error = _task_visible_changed_paths(
+            root,
+            artifact_dir=artifact,
+            checkpoint_path=checkpoint,
+            request_path=request_path,
+        )
+        if status_error:
+            return RuntimeCommitResult("failed", status_error)
+        if set(changed) != set(request.intended_paths):
+            return RuntimeCommitResult("failed", "intended_paths_mismatch")
+        staged = _stage_intended_paths(root, request.intended_paths)
+        if staged.return_code != 0:
+            return RuntimeCommitResult("failed", "git_stage_failed")
+        if _git(root, "diff", "--cached", "--quiet", "--exit-code").return_code == 0:
+            return RuntimeCommitResult("failed", "empty_staged_change")
+        committed = _git(
+            root,
+            "-c", "core.hooksPath=/dev/null",
+            "-c", "commit.gpgSign=false",
+            "commit", "-m", request.commit_message,
+        )
+        if committed.return_code != 0:
+            return RuntimeCommitResult("failed", "git_commit_failed")
+        head_result = _git(root, "rev-parse", "HEAD")
+        if head_result.return_code != 0:
+            return RuntimeCommitResult("failed", "commit_identity_unavailable")
+        head = head_result.stdout.strip()
+        if not _matches_prepared_commit(root, request, head):
+            return RuntimeCommitResult("failed", "git_commit_content_mismatch", head)
+        hash_error = _record_runtime_commit_hash(request_path, head)
+        if hash_error:
+            return RuntimeCommitResult("failed", hash_error, head)
+    elif _matches_prepared_commit(root, request, head):
+        if request.runtime_commit_hash and request.runtime_commit_hash.lower() != head.lower():
+            return RuntimeCommitResult("failed", "runtime_commit_hash_mismatch")
+        recovered = True
+        if not request.runtime_commit_hash:
+            hash_error = _record_runtime_commit_hash(request_path, head)
+            if hash_error:
+                return RuntimeCommitResult("failed", hash_error, head, recovered)
+    else:
+        return RuntimeCommitResult("failed", "base_head_mismatch")
+
+    checkpoint_error = _finalize_checkpoint(
+        checkpoint,
+        commit_hash=head,
+        base_head=request.base_head,
+    )
+    if checkpoint_error:
+        return RuntimeCommitResult("failed", checkpoint_error, head, recovered)
+
+    final_state = load_checkpoint_state(checkpoint, project_root=root)
+    if not final_state.semantic_complete:
+        return RuntimeCommitResult("failed", "checkpoint_not_completed_after_commit", head, recovered)
+
+    try:
+        request_path.unlink(missing_ok=True)
+    except OSError:
+        return RuntimeCommitResult("failed", "commit_request_cleanup_failed", head, recovered)
+    return RuntimeCommitResult("committed", "runtime_commit_completed", head, recovered)
+
+
+def _load_request(
+    request_path: Path,
+    project_root: Path,
+    artifact_dir: Path,
+) -> tuple[RuntimeCommitRequest | None, str]:
+    try:
+        raw = json.loads(request_path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return None, "commit_request_missing"
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return None, "commit_request_invalid_json"
+    if not isinstance(raw, Mapping) or raw.get("schema_version") != REQUEST_SCHEMA_VERSION:
+        return None, "commit_request_invalid_schema"
+    required_keys = {
+        "schema_version", "artifact_dir", "base_head", "commit_message", "intended_paths",
+    }
+    allowed_keys = required_keys | {"runtime_commit_hash"}
+    if not required_keys.issubset(raw) or not set(raw).issubset(allowed_keys):
+        return None, "commit_request_invalid_schema"
+
+    expected_artifact = artifact_dir.relative_to(project_root).as_posix()
+    artifact_text = str(raw.get("artifact_dir") or "").strip().replace("\\", "/")
+    if artifact_text != expected_artifact:
+        return None, "commit_request_artifact_mismatch"
+
+    base_head = str(raw.get("base_head") or "").strip()
+    if not _HEX_COMMIT.fullmatch(base_head):
+        return None, "commit_request_base_head_invalid"
+
+    message = str(raw.get("commit_message") or "").strip()
+    if not message or "\n" in message or len(message) > 240:
+        return None, "commit_request_message_invalid"
+
+    raw_paths = raw.get("intended_paths")
+    if not isinstance(raw_paths, list) or not raw_paths:
+        return None, "commit_request_paths_invalid"
+    intended: list[str] = []
+    for value in raw_paths:
+        relative = _safe_relative_path(value)
+        if relative is None or _forbidden_commit_path(relative, expected_artifact):
+            return None, "commit_request_path_unsafe"
+        intended.append(relative)
+    if len(intended) != len(set(intended)):
+        return None, "commit_request_paths_duplicate"
+
+    runtime_commit_hash = str(raw.get("runtime_commit_hash") or "").strip()
+    if runtime_commit_hash and not _HEX_COMMIT.fullmatch(runtime_commit_hash):
+        return None, "runtime_commit_hash_invalid"
+
+    return RuntimeCommitRequest(
+        artifact_dir=expected_artifact,
+        base_head=base_head.lower(),
+        commit_message=message,
+        intended_paths=tuple(intended),
+        runtime_commit_hash=runtime_commit_hash.lower(),
+    ), ""
+
+
+def _safe_relative_path(value: object) -> str | None:
+    text = str(value or "").strip().replace("\\", "/")
+    if not text or text.startswith("/") or re.match(r"^[A-Za-z]:/", text):
+        return None
+    path = PurePosixPath(text)
+    if path.is_absolute() or any(part in {"", ".", ".."} for part in path.parts):
+        return None
+    return path.as_posix()
+
+
+def _forbidden_commit_path(path: str, artifact_dir: str) -> bool:
+    lower = path.lower()
+    name = PurePosixPath(lower).name
+    if lower in _FORBIDDEN_EXACT_PATHS:
+        return True
+    if lower == ".git" or lower.startswith(".git/"):
+        return True
+    if _known_support_path(lower):
+        return True
+    artifact_prefix = artifact_dir.lower().rstrip("/") + "/"
+    if lower in {
+        artifact_prefix + REQUEST_FILENAME,
+        artifact_prefix + "workflow-checkpoint.json",
+    }:
+        return True
+    if name in _SENSITIVE_NAMES or (name.startswith(".env.") and name != ".env.example"):
+        return True
+    return PurePosixPath(lower).suffix in _SENSITIVE_SUFFIXES
+
+
+def _task_visible_changed_paths(
+    project_root: Path,
+    *,
+    artifact_dir: Path,
+    checkpoint_path: Path,
+    request_path: Path,
+) -> tuple[tuple[str, ...], str]:
+    result = _git(
+        project_root,
+        "status",
+        "--porcelain=v1",
+        "-z",
+        "--untracked-files=all",
+        "--",
+        ".",
+        *HIDDEN_TOOL_WORKTREE_EXCLUDES,
+    )
+    if result.return_code != 0:
+        return (), "git_status_failed"
+    local_paths = {
+        checkpoint_path.relative_to(project_root).as_posix(),
+        request_path.relative_to(project_root).as_posix(),
+    }
+    visible = []
+    for path in _status_record_paths(result.stdout):
+        if path in local_paths:
+            continue
+        if _known_support_path(path.lower()) or path.lower() in _FORBIDDEN_EXACT_PATHS:
+            continue
+        visible.append(path)
+    return tuple(dict.fromkeys(visible)), ""
+
+
+def _known_support_path(lower_path: str) -> bool:
+    path = PurePosixPath(lower_path)
+    parts = path.parts
+    if lower_path in _SUPPORT_ROOT_FILES:
+        return True
+    if parts and parts[0] in _SUPPORT_ROOT_DIRS:
+        return True
+    if lower_path == ".prizmkit-worktree" or lower_path.startswith(
+        ".prizmkit-worktree/"
+    ):
+        return True
+    if (
+        len(parts) >= 2
+        and parts[0].startswith(".")
+        and parts[1] in {"worktree", "worktrees"}
+    ):
+        return True
+    return lower_path == ".prizmkit" or lower_path.startswith(".prizmkit/")
+
+
+def _status_record_paths(stdout: str) -> tuple[str, ...]:
+    records = stdout.split("\0")
+    changed: list[str] = []
+    index = 0
+    while index < len(records):
+        record = records[index]
+        index += 1
+        if not record or len(record) < 4 or record[2] != " ":
+            continue
+        status = record[:2]
+        changed.append(record[3:])
+        if "R" in status or "C" in status:
+            if index < len(records) and records[index]:
+                changed.append(records[index])
+                index += 1
+    return tuple(dict.fromkeys(path for path in changed if path))
+
+
+def _stage_intended_paths(project_root: Path, paths: Sequence[str]) -> _GitResult:
+    pathspecs = tuple(f":(top,literal){path}" for path in paths)
+    return _git(project_root, "add", "-A", "--", *pathspecs)
+
+
+def _matches_prepared_commit(project_root: Path, request: RuntimeCommitRequest, head: str) -> bool:
+    parents = _git(project_root, "show", "-s", "--format=%P", head)
+    subject = _git(project_root, "show", "-s", "--format=%s", head)
+    paths = _git(
+        project_root,
+        "diff-tree", "--no-commit-id", "--name-only", "--no-renames", "-r", "-z", head,
+    )
+    if any(result.return_code != 0 for result in (parents, subject, paths)):
+        return False
+    parent_list = parents.stdout.strip().split()
+    changed = {path for path in paths.stdout.split("\0") if path}
+    return (
+        len(parent_list) == 1
+        and parent_list[0].lower() == request.base_head.lower()
+        and subject.stdout.strip() == request.commit_message
+        and bool(changed)
+        and changed == set(request.intended_paths)
+    )
+
+
+def _record_runtime_commit_hash(path: Path, commit_hash: str) -> str:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError):
+        return "commit_request_hash_record_failed"
+    if not isinstance(data, dict):
+        return "commit_request_hash_record_failed"
+    data["runtime_commit_hash"] = commit_hash
+    error = _write_json_atomic(path, data)
+    return "commit_request_hash_record_failed" if error else ""
+
+
+def _is_tracked(project_root: Path, path: Path) -> bool:
+    try:
+        relative = path.relative_to(project_root).as_posix()
+    except ValueError:
+        return True
+    return _git(project_root, "ls-files", "--error-unmatch", "--", relative).return_code == 0
+
+
+def _finalize_checkpoint(
+    path: Path,
+    *,
+    commit_hash: str,
+    base_head: str,
+) -> str:
+    """Finalize COMMITTED and persist the Runtime's verified commit receipt."""
+    state = load_checkpoint_state(path)
+    if not state.valid:
+        return "checkpoint_commit_finalization_rejected"
+    if state.semantic_complete:
+        return ""
+    if not state.semantic_commit_ready:
+        return "checkpoint_commit_finalization_rejected"
+    data = dict(state.raw_data)
+    raw_steps = data.get("steps")
+    if not isinstance(raw_steps, list):
+        return "checkpoint_commit_finalization_rejected"
+    committers = [
+        step for step in raw_steps
+        if isinstance(step, dict) and step.get("skill") == "prizmkit-committer"
+    ]
+    if len(committers) != 1:
+        return "checkpoint_commit_finalization_rejected"
+    committer = committers[0]
+    committer["status"] = "completed"
+    committer["stage_result"] = "COMMITTED"
+
+    state_key = semantic_state_key(str(data.get("workflow_type") or ""))
+    semantic = data.get(state_key)
+    if not isinstance(semantic, dict):
+        return "checkpoint_commit_finalization_rejected"
+    semantic.update(
+        {
+            "schema_version": 1,
+            "orchestrator": "pipeline-runtime",
+            "stage": "committer",
+            "status": "completed",
+            "stage_result": "COMMITTED",
+            "current_stage": None,
+            "next_stage": None,
+            "resume_from": None,
+            "blocked_reason": None,
+            "terminal_status": "WORKFLOW_COMPLETED",
+            "runtime_base_head": base_head,
+            "runtime_commit_hash": commit_hash,
+        }
+    )
+    candidate = validate_checkpoint_data(data, path=path, exists=True)
+    if not candidate.valid or not candidate.semantic_complete:
+        return "checkpoint_commit_finalization_rejected"
+    if _write_json_atomic(path, data):
+        return "checkpoint_commit_finalization_failed"
+    finalized = load_checkpoint_state(path)
+    return "" if finalized.semantic_complete else "checkpoint_commit_finalization_rejected"
+
+
+def _write_json_atomic(path: Path, data: Mapping[str, object]) -> str:
+    temp_path: str | None = None
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        fd, temp_path = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
+        with os.fdopen(fd, "w", encoding="utf-8") as handle:
+            json.dump(data, handle, indent=2, ensure_ascii=False)
+            handle.write("\n")
+        os.replace(temp_path, path)
+    except OSError:
+        if temp_path:
+            try:
+                os.unlink(temp_path)
+            except OSError:
+                pass
+        return "atomic_json_write_failed"
+    return ""
+
+
+def _git(project_root: Path, *args: str) -> _GitResult:
+    completed = subprocess.run(
+        ["git", *args],
+        cwd=project_root,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+        check=False,
+    )
+    return _GitResult(completed.returncode, completed.stdout, completed.stderr)
+
+
+def _within(path: Path, root: Path) -> bool:
+    try:
+        path.resolve().relative_to(root.resolve())
+    except ValueError:
+        return False
+    return True

package/bundled/dev-pipeline/prizmkit_runtime/status.py

@@ -2,7 +2,8 @@
 
 from __future__ import annotations
 
-from collections.abc import Mapping
+import json
+from collections.abc import Callable, Mapping
 from dataclasses import dataclass, field
 from pathlib import Path
 
@@ -69,3 +70,107 @@ def default_status_targets(paths: RuntimePaths) -> dict[str, StatusTarget]:
         "bugfix": StatusTarget("bugfix", paths.bugfix_plan, paths.bugfix_state_dir),
         "refactor": StatusTarget("refactor", paths.refactor_plan, paths.refactor_state_dir),
     }
+
+
+@dataclass(frozen=True)
+class AggregateStatusResult:
+    """Deterministic read-only status output across every pipeline family."""
+
+    exit_code: int
+    output: str
+
+
+_FAMILY_PLAN_KEYS = {
+    "feature": "features",
+    "bugfix": "bugs",
+    "refactor": "refactors",
+}
+
+
+def _load_json_object(path: Path, label: str) -> dict[str, object]:
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError) as exc:
+        raise ValueError(f"malformed {label}: {exc}") from exc
+    if not isinstance(data, dict):
+        raise ValueError(f"malformed {label}: expected a JSON object")
+    return data
+
+
+def _validate_status_inputs(target: StatusTarget) -> None:
+    """Validate only state consumed by status, without creating or repairing it."""
+    plan = _load_json_object(target.plan_path, "plan list")
+    items = plan.get(_FAMILY_PLAN_KEYS[target.kind])
+    if not isinstance(items, list):
+        raise ValueError(
+            f"malformed plan list: {_FAMILY_PLAN_KEYS[target.kind]} must be an array"
+        )
+
+    pipeline_state = target.state_dir / "pipeline.json"
+    if pipeline_state.exists():
+        if not pipeline_state.is_file():
+            raise ValueError("malformed runtime state: pipeline.json is not a file")
+        _load_json_object(pipeline_state, "runtime state pipeline.json")
+
+    for item in items:
+        if not isinstance(item, dict):
+            raise ValueError("malformed plan list: every task must be a JSON object")
+        item_id = item.get("id")
+        if not isinstance(item_id, str) or not item_id.strip():
+            raise ValueError("malformed plan list: every task requires a non-empty id")
+        status_path = target.state_dir / item_id / "status.json"
+        if status_path.exists():
+            if not status_path.is_file():
+                raise ValueError(
+                    f"malformed runtime state: {item_id}/status.json is not a file"
+                )
+            _load_json_object(status_path, f"runtime state {item_id}/status.json")
+
+
+def _render_family_result(result: object) -> tuple[int, str]:
+    exit_code = getattr(result, "exit_code", None)
+    render = getattr(result, "render", None)
+    if not isinstance(exit_code, int) or not callable(render):
+        raise ValueError("unparseable configured family result")
+    try:
+        rendered = render()
+    except Exception as exc:  # isolate one broken family result
+        raise ValueError(f"unparseable configured family result: {exc}") from exc
+    if not isinstance(rendered, str) or not rendered.strip():
+        raise ValueError("unparseable configured family result: empty output")
+    return exit_code, rendered.strip()
+
+
+def aggregate_family_status(
+    paths: RuntimePaths,
+    status_handler: Callable[[str], object],
+) -> AggregateStatusResult:
+    """Aggregate canonical family status handlers without mutating runtime state."""
+    targets = default_status_targets(paths)
+    sections: list[str] = []
+    failed = False
+
+    for family in ("feature", "bugfix", "refactor"):
+        target = targets[family]
+        label = family.upper()
+        body: str
+        if not target.plan_path.exists():
+            body = "not configured: plan list not found"
+        elif not target.plan_path.is_file():
+            failed = True
+            body = "error: malformed plan list: path is not a file"
+        else:
+            try:
+                _validate_status_inputs(target)
+                family_exit, rendered = _render_family_result(status_handler(family))
+                if family_exit != 0:
+                    failed = True
+                    body = f"error: {rendered}"
+                else:
+                    body = rendered
+            except Exception as exc:  # render remaining family sections truthfully
+                failed = True
+                body = f"error: {exc}"
+        sections.append(f"{label}\n{'=' * len(label)}\n{body}")
+
+    return AggregateStatusResult(1 if failed else 0, "\n\n".join(sections))