sneakoscope 8.1.2 → 8.2.0

package/dist/core/triwiki/context-graph/compiler/index.js

@@ -236,23 +236,23 @@ export async function compileContextGraph(input) {
     const root = path.resolve(input.root);
     if (input.useCompileLock === false)
         return compileLocked(input, root, startedAt);
-    try {
-        return await withTriWikiStateLock(root, async () => {
-            const outcome = await withContextGraphCompileLock(root, () => compileLocked(input, root, startedAt));
-            if (outcome.acquired)
-                return outcome.value;
-            await appendContextGraphEvent(root, {
-                type: 'compile.lock_contended',
-                at: input.observedAt ?? new Date().toISOString(),
-                reason: 'lock_held'
-            });
-            return failure('lock_held', ['lock_held'], Date.now() - startedAt);
-        });
-    }
-    catch (error) {
-        if (!String(error).includes('file_lock_timeout:'))
-            throw error;
-        return failure('lock_held', ['triwiki_state_lock_held'], Date.now() - startedAt);
-    }
+    const outcome = await withContextGraphCompileLock(root, async () => {
+        try {
+            return await withTriWikiStateLock(root, () => compileLocked(input, root, startedAt));
+        }
+        catch (error) {
+            if (!String(error).includes('file_lock_timeout:'))
+                throw error;
+            return failure('lock_held', ['triwiki_state_lock_held'], Date.now() - startedAt);
+        }
+    });
+    if (outcome.acquired)
+        return outcome.value;
+    await appendContextGraphEvent(root, {
+        type: 'compile.lock_contended',
+        at: input.observedAt ?? new Date().toISOString(),
+        reason: 'lock_held'
+    });
+    return failure('lock_held', ['lock_held'], Date.now() - startedAt);
 }
 export { DEFAULT_CONTEXT_GRAPH_LIMITS } from './extract.js';

package/dist/core/update/update-migration-state/fast-mode-config.js

@@ -0,0 +1,172 @@
+import os from 'node:os';
+import path from 'node:path';
+import { writeCodexConfigGuarded } from '../../codex/codex-config-guard.js';
+import { readText } from '../../fsx.js';
+import { escapeRegExp } from '../../text/regex.js';
+export async function runConfigFastModeNormalizeStage() {
+    const { reconcileRetiredSksConfigText } = await import('../../auto-review.js');
+    const configPath = path.join(os.homedir(), '.codex', 'config.toml');
+    const text = await readText(configPath, null);
+    if (typeof text !== 'string') {
+        return { ok: true, status: 'ok', actions: ['codex_config_absent'], blockers: [], warnings: [] };
+    }
+    const normalized = normalizeLegacyFastModeConfigForUpdate(text);
+    const retired = reconcileRetiredSksConfigText(normalized.text);
+    const nextText = ensureTrailingNewline(retired.text);
+    const actions = [
+        ...normalized.actions,
+        ...(retired.detected_count > 0 ? ['stripped_retired_sks_config_profiles_and_policies'] : [])
+    ];
+    if (nextText === ensureTrailingNewline(text)) {
+        return {
+            ok: true,
+            status: 'ok',
+            actions: actions.length ? actions : ['fastmode_config_current'],
+            blockers: [],
+            warnings: [],
+            detail: {
+                config_path: configPath,
+                default_profile: normalized.defaultProfile,
+                retired_config_detected_count: retired.detected_count
+            }
+        };
+    }
+    const guardResult = await writeCodexConfigGuarded({
+        configPath,
+        before: text,
+        mutate: () => nextText,
+        cause: 'project-update-fastmode-normalize',
+        backupTag: 'project-update-fastmode-normalize',
+        preserveFastUiKeys: true
+    });
+    if (!guardResult.ok) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['normalize_fastmode_config_blocked'],
+            blockers: [`codex_config_guard:${guardResult.status}`],
+            warnings: [],
+            detail: {
+                config_path: configPath,
+                default_profile: normalized.defaultProfile,
+                retired_config_detected_count: retired.detected_count,
+                guard: guardResult
+            }
+        };
+    }
+    return {
+        ok: true,
+        status: 'ok',
+        actions: actions.length ? actions : ['fastmode_config_current'],
+        blockers: [],
+        warnings: [],
+        detail: {
+            config_path: configPath,
+            default_profile: normalized.defaultProfile,
+            retired_config_detected_count: retired.detected_count,
+            guard: guardResult
+        }
+    };
+}
+function insertTopLevelTomlKey(text, line) {
+    const raw = String(text || '').trimEnd();
+    const firstTable = raw.search(/^\s*\[/m);
+    if (firstTable < 0)
+        return `${line}\n${raw}`.trim() + '\n';
+    return `${raw.slice(0, firstTable).trimEnd()}\n${line}\n\n${raw.slice(firstTable).trimStart()}`.trim() + '\n';
+}
+function normalizeLegacyFastModeConfigForUpdate(text) {
+    let next = String(text || '');
+    const actions = [];
+    const misplaced = tomlTableString(next, 'user.fast_mode', 'default_profile');
+    const topLevel = topLevelTomlString(next, 'default_profile');
+    const legacyFastDefault = misplaced === 'sks-fast-high' || topLevel === 'sks-fast-high';
+    const before = next;
+    next = removeTopLevelTomlKeyLocal(next, 'default_profile');
+    next = removeTomlTableLocal(next, 'user.fast_mode');
+    next = removeTomlTableLocal(next, 'profiles.sks-fast-high');
+    next = removeTomlTableKeyLocal(next, 'notice', 'fast_default_opt_out');
+    if (next !== before)
+        actions.push('stripped_removed_fastmode_config_schema_keys');
+    if (legacyFastDefault && !topLevelTomlString(next, 'service_tier')) {
+        next = insertTopLevelTomlKey(next, 'service_tier = "fast"');
+        actions.push('migrated_legacy_fast_default_to_service_tier');
+    }
+    return { text: ensureTrailingNewline(next), actions, defaultProfile: misplaced || topLevel };
+}
+function removeTopLevelTomlKeyLocal(text, key) {
+    const lines = String(text || '').split('\n');
+    const firstTable = lines.findIndex((line) => /^\s*\[.+\]\s*$/.test(line));
+    const end = firstTable === -1 ? lines.length : firstTable;
+    const keyPattern = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+    return lines
+        .filter((line, index) => index >= end || !keyPattern.test(line))
+        .join('\n')
+        .replace(/^\n+/, '')
+        .replace(/\n{3,}/g, '\n\n');
+}
+function removeTomlTableLocal(text, table) {
+    const lines = String(text || '').trimEnd().split('\n');
+    const header = `[${table}]`;
+    const start = lines.findIndex((line) => line.trim() === header);
+    if (start === -1)
+        return String(text || '');
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (line !== undefined && /^\s*\[.+\]\s*$/.test(line)) {
+            end = index;
+            break;
+        }
+    }
+    return lines
+        .filter((_, index) => index < start || index >= end)
+        .join('\n')
+        .replace(/^\n+/, '')
+        .replace(/\n{3,}/g, '\n\n');
+}
+function tomlTableString(text, table, key) {
+    const block = tomlTableBlock(text, table);
+    const match = block?.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function topLevelTomlString(text, key) {
+    const source = String(text || '');
+    const firstTable = source.search(/^\s*\[/m);
+    const top = firstTable < 0 ? source : source.slice(0, firstTable);
+    const match = top.match(new RegExp(`^\\s*${escapeRegExp(key)}\\s*=\\s*"([^"]*)"\\s*$`, 'm'));
+    return match?.[1] || null;
+}
+function tomlTableBlock(text, table) {
+    const lines = String(text || '').split(/\r?\n/);
+    const start = lines.findIndex((line) => tableHeaderMatches(line, table));
+    if (start < 0)
+        return null;
+    let end = lines.length;
+    for (let index = start + 1; index < lines.length; index += 1) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(lines[index] || '')) {
+            end = index;
+            break;
+        }
+    }
+    return lines.slice(start, end).join('\n');
+}
+function removeTomlTableKeyLocal(text, table, key) {
+    const lines = String(text || '').split(/\r?\n/);
+    let inTable = false;
+    const out = [];
+    for (const line of lines) {
+        if (/^\s*\[[^\]]+\]\s*$/.test(line))
+            inTable = tableHeaderMatches(line, table);
+        if (inTable && new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`).test(line))
+            continue;
+        out.push(line);
+    }
+    return out.join('\n');
+}
+function tableHeaderMatches(line, table) {
+    return new RegExp(`^\\s*\\[${escapeRegExp(table)}\\]\\s*$`).test(line || '');
+}
+function ensureTrailingNewline(text) {
+    return `${String(text || '').trim()}\n`;
+}

package/dist/core/update/update-migration-state/session-state-split.js

@@ -0,0 +1,247 @@
+import { constants as fsConstants } from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { nowIso, sha256, writeJsonAtomic } from '../../fsx.js';
+import { ensureConfinedDirectory, inspectConfinedPath, moveConfinedPath, uniqueConfinedPath } from '../../managed-path-safety.js';
+import { sessionStateKey } from '../../mission.js';
+const LEGACY_CURRENT_STATE_MAX_BYTES = 1024 * 1024;
+export async function runSessionStateSplitStage(root) {
+    const legacyCurrent = path.join(root, '.sneakoscope', 'current.json');
+    const stateCurrent = path.join(root, '.sneakoscope', 'state', 'current.json');
+    const sessionsDir = path.join(root, '.sneakoscope', 'state', 'sessions');
+    await ensureConfinedDirectory(root, sessionsDir);
+    const actions = [];
+    const legacyRead = await readBoundedUpdateState(root, legacyCurrent, { requireLegacyShape: true });
+    if (legacyRead.blocker) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['legacy_current_state_preserved'],
+            blockers: [legacyRead.blocker],
+            warnings: [],
+            detail: { legacy_present: legacyRead.present }
+        };
+    }
+    const currentRead = await readBoundedUpdateState(root, stateCurrent);
+    if (currentRead.blocker) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['current_state_preserved'],
+            blockers: [currentRead.blocker],
+            warnings: [],
+            detail: { legacy_present: legacyRead.present }
+        };
+    }
+    let current = currentRead.value;
+    if (!current && legacyRead.value) {
+        current = legacyRead.value;
+        await writeJsonAtomic(stateCurrent, current);
+        const verified = await readBoundedUpdateState(root, stateCurrent);
+        if (verified.blocker || !verified.value || updateStateDigest(verified.value) !== legacyRead.sha256) {
+            return {
+                ok: false,
+                status: 'failed',
+                actions: ['copy_legacy_current_json_failed_verification'],
+                blockers: [verified.blocker || 'legacy_current_state_copy_verification_failed'],
+                warnings: [],
+                detail: { legacy_present: true }
+            };
+        }
+        actions.push('copied_legacy_current_json_to_state_current');
+    }
+    const missionId = typeof current?.mission_id === 'string'
+        ? current.mission_id
+        : typeof current?.mission === 'string'
+            ? current.mission
+            : null;
+    const rawSessionKey = typeof current?._session_key === 'string' && current._session_key.trim()
+        ? current._session_key
+        : null;
+    const canonicalSessionKey = rawSessionKey ? sessionStateKey(rawSessionKey) : null;
+    if (canonicalSessionKey) {
+        const sessionPath = path.join(sessionsDir, `${canonicalSessionKey}.json`);
+        const sessionRead = await readBoundedUpdateState(root, sessionPath);
+        if (sessionRead.blocker) {
+            return {
+                ok: false,
+                status: 'failed',
+                actions,
+                blockers: [sessionRead.blocker],
+                warnings: [],
+                detail: { legacy_present: legacyRead.present, mission_id: missionId, session_key: canonicalSessionKey }
+            };
+        }
+        if (!sessionRead.present) {
+            await writeJsonAtomic(sessionPath, {
+                ...current,
+                _session_key: canonicalSessionKey,
+                migrated_from: path.relative(root, stateCurrent),
+                migrated_at: nowIso()
+            });
+            const verifiedSession = await readBoundedUpdateState(root, sessionPath);
+            if (verifiedSession.blocker
+                || verifiedSession.value?._session_key !== canonicalSessionKey
+                || verifiedSession.value?.mission_id !== current?.mission_id) {
+                return {
+                    ok: false,
+                    status: 'failed',
+                    actions,
+                    blockers: [verifiedSession.blocker || 'legacy_session_state_copy_verification_failed'],
+                    warnings: [],
+                    detail: { legacy_present: legacyRead.present, mission_id: missionId, session_key: canonicalSessionKey }
+                };
+            }
+            actions.push('wrote_state_session_alias');
+        }
+    }
+    let quarantinePath = null;
+    if (legacyRead.present) {
+        const quarantineBase = path.join(root, '.sneakoscope', 'quarantine', 'update-legacy-state', `current-${legacyRead.sha256?.slice(0, 12) || 'unknown'}.json`);
+        quarantinePath = await uniqueConfinedPath(root, quarantineBase);
+        await moveConfinedPath(root, legacyCurrent, quarantinePath);
+        const quarantined = await readBoundedUpdateState(root, quarantinePath, { requireLegacyShape: true });
+        const legacyAfter = await inspectConfinedPath(root, legacyCurrent);
+        if (legacyAfter.exists
+            || quarantined.blocker
+            || !quarantined.value
+            || quarantined.sha256 !== legacyRead.sha256) {
+            const sourceAfter = await inspectConfinedPath(root, legacyCurrent);
+            if (!sourceAfter.exists && (await inspectConfinedPath(root, quarantinePath)).exists) {
+                await moveConfinedPath(root, quarantinePath, legacyCurrent).catch(() => undefined);
+            }
+            return {
+                ok: false,
+                status: 'failed',
+                actions: [...actions, 'legacy_current_state_quarantine_rolled_back'],
+                blockers: [quarantined.blocker || 'legacy_current_state_quarantine_verification_failed'],
+                warnings: [],
+                detail: { legacy_present: true, mission_id: missionId }
+            };
+        }
+        actions.push('quarantined_legacy_current_json');
+    }
+    if (!actions.length)
+        actions.push('session_state_current');
+    return {
+        ok: true,
+        status: 'ok',
+        actions,
+        blockers: [],
+        warnings: [],
+        detail: {
+            legacy_present: legacyRead.present,
+            mission_id: missionId,
+            session_key: canonicalSessionKey,
+            legacy_quarantine_path: quarantinePath ? path.relative(root, quarantinePath) : null
+        }
+    };
+}
+async function readBoundedUpdateState(root, file, opts = {}) {
+    let inspected;
+    try {
+        inspected = await inspectConfinedPath(root, file);
+    }
+    catch (error) {
+        return {
+            present: true,
+            value: null,
+            sha256: null,
+            blocker: `update_state_path_unsafe:${error?.code || error?.message || String(error)}`
+        };
+    }
+    if (!inspected.exists)
+        return { present: false, value: null, sha256: null, blocker: null };
+    if (inspected.leafSymlink) {
+        return { present: true, value: null, sha256: null, blocker: 'update_state_symlink_refused' };
+    }
+    if (!inspected.stat?.isFile()) {
+        return { present: true, value: null, sha256: null, blocker: 'update_state_non_regular_refused' };
+    }
+    if (inspected.stat.size > LEGACY_CURRENT_STATE_MAX_BYTES) {
+        return { present: true, value: null, sha256: null, blocker: 'update_state_size_limit_exceeded' };
+    }
+    let text;
+    let handle = null;
+    try {
+        const noFollow = process.platform === 'win32' ? 0 : fsConstants.O_NOFOLLOW;
+        handle = await fsp.open(file, fsConstants.O_RDONLY | noFollow);
+        const before = await handle.stat();
+        if (!before.isFile()) {
+            return { present: true, value: null, sha256: null, blocker: 'update_state_non_regular_refused' };
+        }
+        if (before.size > LEGACY_CURRENT_STATE_MAX_BYTES) {
+            return { present: true, value: null, sha256: null, blocker: 'update_state_size_limit_exceeded' };
+        }
+        const buffer = Buffer.alloc(LEGACY_CURRENT_STATE_MAX_BYTES + 1);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        const after = await handle.stat();
+        const pathAfter = await inspectConfinedPath(root, file);
+        if (bytesRead > LEGACY_CURRENT_STATE_MAX_BYTES
+            || bytesRead !== before.size
+            || after.size !== before.size
+            || after.dev !== before.dev
+            || after.ino !== before.ino
+            || !pathAfter.exists
+            || pathAfter.leafSymlink
+            || pathAfter.stat?.dev !== after.dev
+            || pathAfter.stat?.ino !== after.ino) {
+            return { present: true, value: null, sha256: null, blocker: 'update_state_changed_during_safe_read' };
+        }
+        text = buffer.subarray(0, bytesRead).toString('utf8');
+    }
+    catch (error) {
+        return {
+            present: true,
+            value: null,
+            sha256: null,
+            blocker: `update_state_read_failed:${error?.code || error?.message || String(error)}`
+        };
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return { present: true, value: null, sha256: null, blocker: 'update_state_json_invalid' };
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return { present: true, value: null, sha256: null, blocker: 'update_state_object_required' };
+    }
+    const record = value;
+    if (opts.requireLegacyShape && !isRecognizedLegacyCurrentState(record)) {
+        return { present: true, value: null, sha256: null, blocker: 'legacy_current_state_ownership_unproven' };
+    }
+    return {
+        present: true,
+        value: record,
+        sha256: updateStateDigest(record),
+        blocker: null
+    };
+}
+function isRecognizedLegacyCurrentState(value) {
+    const mission = typeof value.mission_id === 'string'
+        ? value.mission_id.trim()
+        : typeof value.mission === 'string'
+            ? value.mission.trim()
+            : '';
+    if (/^M-[A-Za-z0-9][A-Za-z0-9._-]{2,127}$/.test(mission))
+        return true;
+    const mode = typeof value.mode === 'string' ? value.mode.trim() : '';
+    const phase = typeof value.phase === 'string' ? value.phase.trim() : '';
+    if (mode === 'IDLE' && phase === 'IDLE')
+        return true;
+    if (!mode || !phase)
+        return false;
+    const sessionKey = typeof value._session_key === 'string' && value._session_key.trim().length > 0;
+    const routeCommand = typeof value.route_command === 'string' && value.route_command.trim().startsWith('$');
+    const managedStopGate = ['stop_gate', 'stop_gate_abs_path']
+        .some((key) => typeof value[key] === 'string' && String(value[key]).trim().length > 0);
+    return sessionKey || routeCommand || managedStopGate;
+}
+function updateStateDigest(value) {
+    return sha256(JSON.stringify(value));
+}

package/dist/core/update/update-migration-state/simple-stages.js

@@ -0,0 +1,46 @@
+import { codexHookTrustDoctor } from '../../codex-hooks/codex-hook-trust-doctor.js';
+export async function runOtherHarnessCleanupStage(root) {
+    const { scanHarnessConflicts } = await import('../../harness-conflicts.js');
+    const scan = await scanHarnessConflicts(root);
+    if (scan.hard_block) {
+        return {
+            ok: false,
+            status: 'failed',
+            actions: ['other_harness_conflict_detected'],
+            blockers: scan.hard.map((row) => `other_harness_conflict:${row.path}`),
+            warnings: [],
+            detail: {
+                cleaned_count: 0,
+                remaining_count: scan.hard.length,
+                error_count: 0,
+                cleanup_prompt_command: 'sks conflicts cleanup --yes'
+            }
+        };
+    }
+    return {
+        ok: true,
+        status: 'ok',
+        actions: ['other_harness_conflict_check_clean'],
+        blockers: [],
+        warnings: [],
+        detail: {
+            cleaned_count: 0,
+            remaining_count: 0,
+            error_count: 0
+        }
+    };
+}
+export async function runHookTrustRefreshStage(root) {
+    const result = await codexHookTrustDoctor(root, { fix: true, managed: true, actual: true });
+    const blockers = result.ok === false
+        ? (result.blockers || ['hook_trust_refresh_failed'])
+        : [];
+    return {
+        ok: blockers.length === 0,
+        status: blockers.length ? 'failed' : 'ok',
+        actions: ['refreshed_hook_trust'],
+        blockers,
+        warnings: result.warnings || [],
+        detail: { entries: result.current_hash_count ?? null }
+    };
+}