simt-dev 0.7.1 → 0.8.0

package/src/ledger/index.mjs

@@ -6,11 +6,9 @@
 // no longer proves anything about what is on disk now.
 
 import { createHash } from 'node:crypto';
-import { execFile } from 'node:child_process';
-import { appendFile, mkdir, mkdtemp, rm } from 'node:fs/promises';
+import { appendFile, copyFile, mkdir, mkdtemp, open, readFile, rm, stat, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { promisify } from 'node:util';
+import { join, resolve } from 'node:path';
 
 import {
   errorSignature,
@@ -19,11 +17,11 @@ import {
   recordFailThenFix,
 } from '../memory/lessons.mjs';
 import { TREE_EXCLUDES, localRel, readStateFile } from '../state.mjs';
+import { appendEvent } from '../state/events.mjs';
+import { LEDGER_FILE_LEGACY, LEDGER_FILE_REL } from '../name.mjs';
+import { git, gitText } from '../sys/git.mjs';
 
-const exec = promisify(execFile);
-
-export const LEDGER_FILE = localRel('ledger.jsonl');
-const LEDGER_FILE_LEGACY = '.simt/ledger.jsonl';
+export const LEDGER_FILE = localRel(LEDGER_FILE_REL);
 
 /** Phrases that claim a run happened. `unverified` and `not verified` are removed
  *  first, because both contain the word and neither is a claim. Trailers
@@ -33,6 +31,33 @@ const CLAIM =
   /\btests?\s+pass(?:ed|ing)?\b|\btest\s+suite\s+(?:is\s+)?green\b|\bsuite\s+is\s+green\b|\bnpm\s+test\s+pass(?:es|ed)?\b|\bverified\b/i;
 const TRAILER = /^(signed-off-by|co-authored-by|reviewed-by|acked-by|tested-by|fixes|closes)\s*:/i;
 
+/**
+ * Copy the repository's real index into a private one, and answer its path or null.
+ *
+ * The private index exists so `git add -A` cannot stage the author's work. Building it from
+ * nothing meant every path was hashed on every gate run, commit-msg check, `evidence` call
+ * and `pr-body`: on a 20k-file tree that is the whole cost of the command (Q75). Seeding it
+ * from the index git already maintains turns the hash into a no-op for every unchanged
+ * path, and the `add -A` afterwards only has the worktree diff left to do.
+ *
+ * A repository with no index yet (a fresh `git init`) is not an error: there is nothing to
+ * copy, and the add builds it from empty exactly as before.
+ *
+ * @param {string} root
+ * @param {string} target the private index file to populate
+ * @returns {Promise<string|null>} the source index, or null when there is none
+ */
+export async function seedIndex(root, target) {
+  try {
+    const stdout = await gitText(root, ['rev-parse', '--git-path', 'index']);
+    const from = resolve(root, stdout ?? '');
+    await copyFile(from, target);
+    return from;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The tree of everything in the worktree, without staging any of it.
  *
@@ -44,6 +69,8 @@ export async function treeId(root) {
   const index = join(dir, 'index');
   const env = { ...process.env, GIT_INDEX_FILE: index };
   try {
+    // Seed before the add: the add then only hashes what actually changed (Q75).
+    await seedIndex(root, index);
     // Machine-local state is a record of the tree, so it cannot be part of the
     // tree it names. `git add -A` would take it once the file exists, and the
     // line would prove a tree that stopped existing when the line was written
@@ -55,9 +82,8 @@ export async function treeId(root) {
     // carry only the paths git does not already ignore.
     const ignored = await ignoredSet(root, TREE_EXCLUDES);
     const excludes = TREE_EXCLUDES.filter((p) => !ignored.has(p)).map((p) => `:(exclude)${p}`);
-    await exec('git', ['add', '-A', '--', '.', ...excludes], { cwd: root, env });
-    const { stdout } = await exec('git', ['write-tree'], { cwd: root, env });
-    return stdout.trim();
+    await git(root, ['add', '-A', '--', '.', ...excludes], { env });
+    return await gitText(root, ['write-tree'], { env });
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
@@ -74,10 +100,7 @@ export async function treeId(root) {
  */
 async function ignoredSet(root, paths) {
   try {
-    // Paths as argv, not `--stdin`: `promisify(execFile)` drops the `input`
-    // option, so a stdin-fed `check-ignore` waits for input that never comes
-    // and the promise never settles.
-    const { stdout } = await exec('git', ['check-ignore', ...paths], { cwd: root });
+    const stdout = await git(root, ['check-ignore', ...paths]);
     return new Set(String(stdout).split('\n').filter(Boolean));
   } catch {
     // `check-ignore` exits 1 when nothing is ignored - the common case, not an
@@ -95,8 +118,7 @@ async function ignoredSet(root, paths) {
  *  Null when git cannot answer; the caller then falls back to the worktree tree. */
 export async function indexTreeId(root) {
   try {
-    const { stdout } = await exec('git', ['write-tree'], { cwd: root });
-    const tree = String(stdout ?? '').trim();
+    const tree = await gitText(root, ['write-tree']);
     return /^[0-9a-f]{40}$/.test(tree) ? tree : null;
   } catch {
     return null;
@@ -116,8 +138,10 @@ export async function recordRun(root, { cmd, exit, ms, output, gate = null, kind
     ...(typeof gate === 'string' ? { gate } : {}),
     ...(typeof kind === 'string' ? { kind } : {}),
     cmd,
+    command: cmd,
     exit,
     ms,
+    wallMs: ms,
     outputDigest: `sha256-${createHash('sha256').update(output).digest('hex')}`,
     summary: summarise(output, exit),
     ...(exit !== 0
@@ -129,6 +153,14 @@ export async function recordRun(root, { cmd, exit, ms, output, gate = null, kind
   };
   await mkdir(join(root, '.simt', 'local'), { recursive: true });
   await appendFile(join(root, LEDGER_FILE), `${JSON.stringify(line)}\n`);
+  // The same record in the log every other store writes to (Q73): a tailing consumer has
+  // one file to follow, and a ledger line lost to rotation is still recoverable here.
+  await appendEvent(root, {
+    kind: 'gate.finished',
+    tree: worktreeTree,
+    subject: typeof cmd === 'string' ? cmd : null,
+    data: { ...(gate === null ? {} : { gate }), ...(kind === null ? {} : { kind }), line },
+  });
 
   if (exit === 0 && typeof cmd === 'string') {
     let pendingFail = null;
@@ -145,9 +177,84 @@ export async function recordRun(root, { cmd, exit, ms, output, gate = null, kind
     }
   }
 
+  await rotateLedger(root).catch(() => {});
   return line;
 }
 
+/**
+ * Read only the end of the ledger.
+ *
+ * `recordRun` and every evidence check read the whole file, and the file grows without a
+ * bound: a repository that runs a suite a hundred times a day pays for a year of lines on
+ * every commit (Q75). A tail read answers the only question those callers ask - what
+ * happened recently on which trees - in bounded time.
+ *
+ * The first line of the slice is dropped unless the slice starts at byte 0, because a byte
+ * offset lands mid-line and half a JSON object is not evidence.
+ */
+export async function readLedgerTail(root, { entries = 200, bytes = 128 * 1024 } = {}) {
+  const path = join(root, LEDGER_FILE);
+  let text = '';
+  let partial = false;
+  try {
+    const st = await stat(path);
+    const start = Math.max(0, st.size - bytes);
+    partial = start > 0;
+    const handle = await open(path, 'r');
+    try {
+      const buffer = Buffer.alloc(st.size - start);
+      await handle.read(buffer, 0, buffer.length, start);
+      text = buffer.toString('utf8');
+    } finally {
+      await handle.close();
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return { entries: [], errors: [], partial: false };
+  }
+  const lines = text.split('\n').filter((line) => line.trim() !== '');
+  if (partial && lines.length > 0) lines.shift();
+  const parsed = [];
+  const errors = [];
+  for (const raw of lines) {
+    try {
+      const line = JSON.parse(raw);
+      if (typeof line.tree === 'string' && typeof line.exit === 'number') parsed.push(line);
+      else errors.push('a line has no tree or exit');
+    } catch (error) {
+      errors.push(`a line does not parse (${error.message})`);
+    }
+  }
+  return { entries: parsed.slice(-entries), errors, partial };
+}
+
+/**
+ * Keep the ledger bounded: past `maxLines`, the older half moves to `<ledger>.1`.
+ *
+ * Rotation rather than deletion because the ledger is evidence: an archived line is still
+ * readable, and the event log holds the same record independently (Q73). Keeping half
+ * rather than `maxLines` means rotation happens every `maxLines/2` appends instead of on
+ * every one.
+ */
+export async function rotateLedger(root, { maxLines = 5000 } = {}) {
+  const path = join(root, LEDGER_FILE);
+  let text;
+  try {
+    text = await readFile(path, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return { rotated: false };
+    throw error;
+  }
+  const lines = text.split('\n').filter((line) => line.trim() !== '');
+  if (lines.length <= maxLines) return { rotated: false };
+  const keep = Math.max(1, Math.floor(maxLines / 2));
+  const archived = lines.slice(0, lines.length - keep);
+  const kept = lines.slice(lines.length - keep);
+  await writeFile(join(root, `${LEDGER_FILE}.1`), `${archived.join('\n')}\n`, 'utf8');
+  await writeFile(path, `${kept.join('\n')}\n`, 'utf8');
+  return { rotated: true, archived: archived.length, kept: kept.length };
+}
+
 /** Every well-formed line. A line that does not parse is returned as an error so a
  *  damaged ledger cannot look empty. */
 export async function readLedger(root) {

package/src/mcp/paginate.mjs

@@ -0,0 +1,33 @@
+// One page of a list result, and the cursor that asks for the next one.
+//
+// MCP lets a server answer a list method in pages, and a client that ignores `nextCursor`
+// must still see a usable first page. This server has never paginated, which was fine
+// while every list fit in one reply and stops being fine the moment a workspace brings
+// dozens of repositories into `resources/list`: a client that renders what it is given
+// then silently shows a subset of the estate (review 0003 Q66).
+//
+// The cursor is the offset, rendered as a string. The specification calls it opaque, and
+// the client must not parse it, but it has to be stable across calls: an index into a list
+// that is rebuilt in a deterministic order is, and a hash of the last item's name is not -
+// two items can share one.
+
+/** How many entries one reply carries. */
+export const PAGE_SIZE = 50;
+
+/**
+ * The page a cursor asks for, or `null` when the cursor is not one this server issued.
+ *
+ * A cursor outside the list is not clamped to the last page: a client that walked past the
+ * end has a stale cursor, and silently repeating the tail hides that the list changed
+ * under it.
+ */
+export function paginate(items, cursor, size = PAGE_SIZE) {
+  const text = cursor === undefined || cursor === null || cursor === '' ? '0' : String(cursor);
+  // Only the shape this server writes: a decimal offset. `Number` accepts '0x10' and ' ',
+  // and accepting a cursor nobody issued is how pagination silently repeats or skips.
+  if (!/^\d+$/.test(text)) return null;
+  const start = Number(text);
+  const page = items.slice(start, start + size);
+  const next = start + size < items.length ? String(start + size) : null;
+  return { items: page, nextCursor: next };
+}