sentinelayer-cli 0.46.5 → 0.48.0

package/src/daemon/operator-control.js

@@ -1,6 +1,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { bindOutputFileSystem, requireOutputFileSystem } from "../config/output-filesystem.js";
 import { ASSIGNMENT_STATUSES, resolveAssignmentLedgerStorage, listAssignments } from "./assignment-ledger.js";
 import { DAEMON_BUDGET_LIFECYCLE_STATES, listBudgetStates } from "./budget-governor.js";
 import { WORK_ITEM_STATUSES, listErrorQueue, resolveErrorDaemonStorage } from "./error-worker.js";
@@ -82,14 +83,16 @@ function loadJsonFile(filePath, defaultFactory) {
     });
 }
 
-async function writeJsonFile(filePath, payload = {}) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+async function writeJsonFile(filePath, payload = {}, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
 }
 
-async function appendJsonLine(filePath, payload = {}) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
+async function appendJsonLine(filePath, payload = {}, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
 }
 
 function resolveBudgetHealthColor(budgetLifecycleState = "") {
@@ -271,12 +274,12 @@ export async function resolveOperatorControlStorage({
     env,
     homeDir,
   });
-  return {
+  return bindOutputFileSystem({
     ...daemonStorage,
     operatorStatePath: path.join(daemonStorage.baseDir, "operator-control-state.json"),
     operatorEventsPath: path.join(daemonStorage.baseDir, "operator-events.ndjson"),
     operatorSnapshotsDir: path.join(daemonStorage.baseDir, "operator-snapshots"),
-  };
+  }, daemonStorage.outputFs);
 }
 
 export async function buildOperatorControlSnapshot({
@@ -427,8 +430,8 @@ export async function buildOperatorControlSnapshot({
     workItems: rows,
     agentRoster,
   };
-  await fsp.mkdir(storage.operatorSnapshotsDir, { recursive: true });
-  await writeJsonFile(runPath, snapshot);
+  await storage.outputFs.mkdir(storage.operatorSnapshotsDir, { recursive: true });
+  await writeJsonFile(runPath, snapshot, storage.outputFs);
 
   const nextControlState = normalizeControlState(
     {
@@ -442,7 +445,7 @@ export async function buildOperatorControlSnapshot({
     normalizedNow
   );
   await Promise.all([
-    writeJsonFile(storage.operatorStatePath, nextControlState),
+    writeJsonFile(storage.operatorStatePath, nextControlState, storage.outputFs),
     appendJsonLine(storage.operatorEventsPath, {
       timestamp: normalizedNow,
       eventType: "operator_snapshot",
@@ -452,7 +455,7 @@ export async function buildOperatorControlSnapshot({
       activeAgents: snapshot.summary.activeAgents,
       statusCounts: statusSummary.statusCounts,
       healthCounts: statusSummary.healthCounts,
-    }),
+    }, storage.outputFs),
   ]);
 
   return {
@@ -606,8 +609,8 @@ export async function applyOperatorStopControl({
   }
 
   await Promise.all([
-    writeJsonFile(storage.queuePath, queue),
-    writeJsonFile(assignmentStorage.ledgerPath, ledger),
+    writeJsonFile(storage.queuePath, queue, storage.outputFs),
+    writeJsonFile(assignmentStorage.ledgerPath, ledger, assignmentStorage.outputFs),
     appendJsonLine(storage.operatorEventsPath, {
       timestamp: normalizedNow,
       eventType: "operator_stop",
@@ -618,7 +621,7 @@ export async function applyOperatorStopControl({
       reason: normalizedReason,
       jiraIssueKey,
       jiraCommented,
-    }),
+    }, storage.outputFs),
   ]);
 
   return {

package/src/daemon/reliability-lane.js

@@ -1,6 +1,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { bindOutputFileSystem, requireOutputFileSystem } from "../config/output-filesystem.js";
 import { appendAdminErrorEvent, resolveErrorDaemonStorage, runErrorDaemonWorker } from "./error-worker.js";
 
 const RELIABILITY_SCHEMA_VERSION = "1.0.0";
@@ -142,14 +143,16 @@ async function readJsonFile(filePath, defaultFactory) {
   }
 }
 
-async function writeJsonFile(filePath, payload = {}) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+async function writeJsonFile(filePath, payload = {}, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
 }
 
-async function appendJsonLine(filePath, payload = {}) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
+async function appendJsonLine(filePath, payload = {}, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
 }
 
 async function listRunArtifacts(runsDir, outputRoot) {
@@ -197,14 +200,14 @@ export async function resolveReliabilityLaneStorage({
     homeDir,
   });
   const reliabilityDir = path.join(daemonStorage.baseDir, "reliability");
-  return {
+  return bindOutputFileSystem({
     ...daemonStorage,
     reliabilityDir,
     configPath: path.join(reliabilityDir, "lane-config.json"),
     billboardPath: path.join(reliabilityDir, "maintenance-billboard.json"),
     eventsPath: path.join(reliabilityDir, "reliability-events.ndjson"),
     runsDir: path.join(reliabilityDir, "runs"),
-  };
+  }, daemonStorage.outputFs);
 }
 
 export async function setMaintenanceBillboard({
@@ -249,7 +252,7 @@ export async function setMaintenanceBillboard({
   };
 
   await Promise.all([
-    writeJsonFile(storage.billboardPath, next),
+    writeJsonFile(storage.billboardPath, next, storage.outputFs),
     appendJsonLine(storage.eventsPath, {
       timestamp: normalizedNow,
       eventType: "maintenance_update",
@@ -258,7 +261,7 @@ export async function setMaintenanceBillboard({
       actor: normalizedActor,
       reason: normalizedReason,
       message: next.message,
-    }),
+    }, storage.outputFs),
   ]);
 
   return {
@@ -439,11 +442,11 @@ export async function runReliabilityLane({
       : null,
   };
 
-  await fsp.mkdir(storage.runsDir, { recursive: true });
+  await storage.outputFs.mkdir(storage.runsDir, { recursive: true });
   await Promise.all([
-    writeJsonFile(storage.configPath, config),
-    writeJsonFile(storage.billboardPath, billboard),
-    writeJsonFile(runPath, runPayload),
+    writeJsonFile(storage.configPath, config, storage.outputFs),
+    writeJsonFile(storage.billboardPath, billboard, storage.outputFs),
+    writeJsonFile(runPath, runPayload, storage.outputFs),
     appendJsonLine(storage.eventsPath, {
       timestamp: normalizedNow,
       eventType: "reliability_run",
@@ -454,7 +457,7 @@ export async function runReliabilityLane({
       checkCount: checkResults.length,
       failureCount: failureResults.length,
       maintenanceEnabled: billboard.enabled,
-    }),
+    }, storage.outputFs),
   ]);
 
   return {

package/src/daemon/scope-engine.js

@@ -3,7 +3,8 @@ import fsp from "node:fs/promises";
 import path from "node:path";
 import process from "node:process";
 
-import { resolveOutputRoot } from "../config/service.js";
+import { bindOutputFileSystem, requireOutputFileSystem } from "../config/output-filesystem.js";
+import { resolveOutputContext } from "../config/service.js";
 import { createAgentEvent } from "../events/schema.js";
 import { collectCodebaseIngest } from "../ingest/engine.js";
 import { appendToStream } from "../session/stream.js";
@@ -707,31 +708,33 @@ export async function resolveScopeEngineStorage({
   env,
   homeDir,
 } = {}) {
-  const outputRoot = await resolveOutputRoot({
+  const { outputRoot, outputFs } = await resolveOutputContext({
     cwd: path.resolve(String(targetPath || ".")),
     outputDirOverride: outputDir,
     env,
     homeDir,
   });
+  requireOutputFileSystem(outputFs);
   const observabilityRoot = path.join(outputRoot, "observability");
   const baseDir = path.join(observabilityRoot, "scope-engine");
-  return {
+  return bindOutputFileSystem({
     outputRoot,
     observabilityRoot,
     baseDir,
     runsDir: path.join(baseDir, "runs"),
-  };
+  }, outputFs);
 }
 
 async function writeScopeEnvelopeArtifact(storage, workItemId, envelope, nowIso) {
+  requireOutputFileSystem(storage.outputFs);
   const artifactPath = path.join(
     storage.observabilityRoot,
     buildDayKey(nowIso),
     normalizeString(workItemId),
     "scope_envelope.json"
   );
-  await fsp.mkdir(path.dirname(artifactPath), { recursive: true });
-  await fsp.writeFile(artifactPath, `${JSON.stringify(envelope, null, 2)}\n`, "utf-8");
+  await storage.outputFs.mkdir(path.dirname(artifactPath), { recursive: true });
+  await storage.outputFs.writeFile(artifactPath, `${JSON.stringify(envelope, null, 2)}\n`, "utf-8");
   return artifactPath;
 }
 
@@ -740,9 +743,10 @@ function buildRunMetadataPath(storage, runId) {
 }
 
 async function persistRunMetadata(storage, payload) {
+  requireOutputFileSystem(storage.outputFs);
   const runPath = buildRunMetadataPath(storage, payload.runId);
-  await fsp.mkdir(path.dirname(runPath), { recursive: true });
-  await fsp.writeFile(runPath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+  await storage.outputFs.mkdir(path.dirname(runPath), { recursive: true });
+  await storage.outputFs.writeFile(runPath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
   return runPath;
 }
 

package/src/daemon/watchdog.js

@@ -1,6 +1,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
+import { bindOutputFileSystem, requireOutputFileSystem } from "../config/output-filesystem.js";
 import { loadConfig } from "../config/service.js";
 import { listAssignments, resolveAssignmentLedgerStorage } from "./assignment-ledger.js";
 import { listBudgetStates } from "./budget-governor.js";
@@ -302,14 +303,16 @@ async function readJsonFile(filePath, defaultFactory) {
   }
 }
 
-async function writeJsonFile(filePath, payload) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
+async function writeJsonFile(filePath, payload, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
 }
 
-async function appendEvent(filePath, payload) {
-  await fsp.mkdir(path.dirname(filePath), { recursive: true });
-  await fsp.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
+async function appendEvent(filePath, payload, outputFs) {
+  requireOutputFileSystem(outputFs);
+  await outputFs.mkdir(path.dirname(filePath), { recursive: true });
+  await outputFs.appendFile(filePath, `${JSON.stringify(payload)}\n`, "utf-8");
 }
 
 function buildRunId(nowIso, count) {
@@ -756,12 +759,12 @@ export async function resolveWatchdogStorage({
     env,
     homeDir,
   });
-  return {
+  return bindOutputFileSystem({
     ...daemonStorage,
     watchdogStatePath: path.join(daemonStorage.baseDir, "watchdog-state.json"),
     watchdogEventsPath: path.join(daemonStorage.baseDir, "watchdog-events.ndjson"),
     watchdogRunsDir: path.join(daemonStorage.baseDir, "watchdog-runs"),
-  };
+  }, daemonStorage.outputFs);
 }
 
 export async function runWatchdogTick({
@@ -879,7 +882,7 @@ export async function runWatchdogTick({
     normalizedNow
   );
 
-  await fsp.mkdir(storage.watchdogRunsDir, { recursive: true });
+  await storage.outputFs.mkdir(storage.watchdogRunsDir, { recursive: true });
   const runId = nextState.lastRunId;
   const runPath = path.join(storage.watchdogRunsDir, `${runId}.json`);
   const runPayload = {
@@ -913,8 +916,8 @@ export async function runWatchdogTick({
   };
 
   await Promise.all([
-    writeJsonFile(runPath, runPayload),
-    writeJsonFile(storage.watchdogStatePath, nextState),
+    writeJsonFile(runPath, runPayload, storage.outputFs),
+    writeJsonFile(storage.watchdogStatePath, nextState, storage.outputFs),
     appendEvent(storage.watchdogEventsPath, {
       timestamp: normalizedNow,
       eventType: "watchdog_tick",
@@ -925,7 +928,7 @@ export async function runWatchdogTick({
       notificationCount: notifications.length,
       sentNotificationCount: notifications.filter((item) => item.sent).length,
       failedNotificationCount: notifications.filter((item) => !item.sent && !item.dryRun).length,
-    }),
+    }, storage.outputFs),
   ]);
 
   return {

package/src/engram/build-state.js

@@ -28,7 +28,7 @@
 import fsp from "node:fs/promises";
 import path from "node:path";
 
-import { namespaceDir } from "./store.js";
+import { namespaceDir, ensureNamespace, resolveNamespaceDir, verifyNamespace } from "./store.js";
 
 export const BUILD_STATES = Object.freeze({
   ABSENT: "absent",
@@ -63,13 +63,32 @@ async function writeAtomic(file, value) {
   await fsp.rename(tmp, file);
 }
 
-export function createBuildState({ storeRoot } = {}) {
+/**
+ * Resolve and verify the namespace directory for read-only build-state access.
+ * Uses resolveNamespaceDir (legacy migration) but NEVER creates a directory
+ * or sidecar on reads.  Returns the dir path or null when absent.
+ */
+async function resolveForRead(root, namespace, legacyLossyDirs) {
+  const dir = await resolveNamespaceDir(root, namespace, legacyLossyDirs);
+  try {
+    await fsp.access(dir);
+  } catch {
+    return null;
+  }
+  await verifyNamespace(dir, namespace);
+  return dir;
+}
+
+export function createBuildState({ storeRoot, legacyLossyDirs = "refuse" } = {}) {
   const root = path.resolve(String(storeRoot || "."));
 
   async function read(namespace) {
+    const dir = await resolveForRead(root, namespace, legacyLossyDirs);
+    if (!dir) return { state: BUILD_STATES.ABSENT };
+
     let raw;
     try {
-      raw = await fsp.readFile(stateFile(root, namespace), "utf-8");
+      raw = await fsp.readFile(path.join(dir, STATE_FILE), "utf-8");
     } catch (error) {
       if (error && error.code === "ENOENT") return { state: BUILD_STATES.ABSENT };
       throw error;
@@ -106,6 +125,8 @@ export function createBuildState({ storeRoot } = {}) {
 
     /** Mark a build STARTED. Must be called before the first chunk is written. */
     async begin(namespace, { docDigest = null, expectedChunks = null, startedAt } = {}) {
+      const dir = await resolveNamespaceDir(root, namespace, legacyLossyDirs);
+      await ensureNamespace(dir, namespace);
       const record = {
         state: BUILD_STATES.BUILDING,
         namespace: namespace.raw,