specrails-desktop 2.29.1 → 2.29.2

package/server/dist/pr-lifecycle.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PR_LIFECYCLE_JSON_FIELDS = void 0;
+exports.observePrLifecycle = observePrLifecycle;
+exports.isExactOpenPr = isExactOpenPr;
+const SHA_RE = /^[0-9a-f]{40,64}$/i;
+exports.PR_LIFECYCLE_JSON_FIELDS = 'state,isDraft,headRefName,baseRefName,headRefOid,mergeCommit,commits';
+function firstLine(result) {
+    return (result.stderr.trim() || result.stdout.trim()).split('\n')[0].trim().slice(0, 512);
+}
+function oid(value) {
+    return typeof value === 'string' && SHA_RE.test(value) ? value.toLowerCase() : null;
+}
+/**
+ * Observe one exact PR and, when requested, whether its immutable commit/merge
+ * evidence contains a delivery SHA. The helper never guesses from a ledger row:
+ * command failure, malformed JSON, and missing commit evidence remain explicit.
+ */
+async function observePrLifecycle(exec, repoDir, prUrl, expectedSha) {
+    let result;
+    try {
+        result = await exec.run('gh', ['pr', 'view', prUrl, '--json', exports.PR_LIFECYCLE_JSON_FIELDS], repoDir);
+    }
+    catch (err) {
+        return { ok: false, detail: (err instanceof Error ? err.message : String(err)).slice(0, 512) };
+    }
+    if (result.code !== 0)
+        return { ok: false, detail: firstLine(result) || `exit ${result.code}` };
+    try {
+        const parsed = JSON.parse(result.stdout);
+        const normalizedState = typeof parsed.state === 'string' ? parsed.state.toUpperCase() : '';
+        if (normalizedState !== 'OPEN' && normalizedState !== 'CLOSED' && normalizedState !== 'MERGED') {
+            return { ok: false, detail: `unrecognized PR state: ${normalizedState || 'missing'}` };
+        }
+        const headRefOid = oid(parsed.headRefOid);
+        const mergeCommitOid = oid(parsed.mergeCommit?.oid);
+        const commitsReturned = Array.isArray(parsed.commits);
+        const commitOids = commitsReturned
+            ? [...new Set(parsed.commits.map((commit) => oid(commit?.oid)).filter((value) => value !== null))]
+            : [];
+        const expected = expectedSha && SHA_RE.test(expectedSha) ? expectedSha.toLowerCase() : null;
+        // A merged PR's live head branch can advance after the merge. Its current
+        // headRefOid is therefore NOT proof that the merge included that object.
+        // Only the PR's commit snapshot / merge commit are valid MERGED evidence.
+        const observedOids = new Set([
+            ...(normalizedState === 'OPEN' ? [headRefOid] : []),
+            mergeCommitOid,
+            ...commitOids,
+        ].filter((value) => value !== null));
+        const includesExpectedSha = expected === null
+            ? null
+            : observedOids.has(expected)
+                ? true
+                : commitsReturned
+                    ? false
+                    : null;
+        return {
+            ok: true,
+            state: normalizedState,
+            isDraft: parsed.isDraft === true,
+            headRefName: typeof parsed.headRefName === 'string' ? parsed.headRefName : null,
+            baseRefName: typeof parsed.baseRefName === 'string' ? parsed.baseRefName : null,
+            headRefOid,
+            mergeCommitOid,
+            commitOids,
+            includesExpectedSha,
+        };
+    }
+    catch {
+        return { ok: false, detail: 'unparseable gh pr view output' };
+    }
+}
+/** OPEN is continuation-safe only for the same recorded head/base identity. */
+function isExactOpenPr(observation, branch, baseBranch) {
+    return observation.ok && observation.state === 'OPEN' &&
+        observation.headRefName === branch && observation.baseRefName === baseBranch;
+}

package/server/dist/pr-publisher.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.defaultExec = void 0;
+exports.defaultExec = exports.PR_COMMAND_TIMEOUT_MS = void 0;
+exports.createBoundedExec = createBoundedExec;
 exports.parsePrUrl = parsePrUrl;
 exports.pushBranch = pushBranch;
 exports.publishDraftPr = publishDraftPr;
@@ -25,36 +26,97 @@ exports.publishDraftPr = publishDraftPr;
 const child_process_1 = require("child_process");
 const git_guardrails_1 = require("./git-guardrails");
 const win_spawn_1 = require("./util/win-spawn");
-exports.defaultExec = {
-    run(cmd, args, cwd) {
-        return new Promise((resolve) => {
-            // `windowsSpawnEnv()` backfills SystemRoot / ComSpec / USERPROFILE, which a
-            // GUI-launched / pkg-stripped Windows sidecar can lack — without them the
-            // `git`/`gh` child (and the `sh -c` the `!gh …` credential helper runs) can
-            // fail to start. NOT `GIT_EXEC_ENV`: that hardened env disables credentials
-            // (GIT_ASKPASS=echo / GIT_TERMINAL_PROMPT=0), which the push must keep. No-op
-            // on POSIX (returns process.env), so mac/Linux behaviour is byte-identical.
-            const env = (0, win_spawn_1.windowsSpawnEnv)();
-            (0, child_process_1.execFile)(cmd, args, { cwd, env, maxBuffer: 16 * 1024 * 1024, windowsHide: true }, (err, stdout, stderr) => {
-                const code = err && typeof err.code === 'number' ? err.code : err ? 1 : 0;
-                resolve({ code, stdout: stdout?.toString() ?? '', stderr: stderr?.toString() ?? '' });
+exports.PR_COMMAND_TIMEOUT_MS = 120_000;
+function createBoundedExec(timeoutMs = exports.PR_COMMAND_TIMEOUT_MS) {
+    const boundedTimeoutMs = Math.max(1, Math.floor(timeoutMs));
+    return {
+        run(cmd, args, cwd) {
+            return new Promise((resolve) => {
+                // `windowsSpawnEnv()` backfills SystemRoot / ComSpec / USERPROFILE, which a
+                // GUI-launched / pkg-stripped Windows sidecar can lack — without them the
+                // `git`/`gh` child (and the `sh -c` the `!gh …` credential helper runs) can
+                // fail to start. NOT `GIT_EXEC_ENV`: that hardened env disables credentials
+                // (GIT_ASKPASS=echo / GIT_TERMINAL_PROMPT=0), which the push must keep. No-op
+                // on POSIX (returns process.env), so mac/Linux behaviour is byte-identical.
+                const env = (0, win_spawn_1.windowsSpawnEnv)();
+                // These commands can run while holding the per-repository mutation lock.
+                // A wedged credential helper/network child must be reaped before the lock
+                // can be released; otherwise every later launch/decision/checkout hangs
+                // behind it forever. Two minutes is deliberately generous for push/gh.
+                (0, child_process_1.execFile)(cmd, args, {
+                    cwd,
+                    env,
+                    maxBuffer: 16 * 1024 * 1024,
+                    windowsHide: true,
+                    timeout: boundedTimeoutMs,
+                    killSignal: 'SIGTERM',
+                }, (err, stdout, stderr) => {
+                    const code = err && typeof err.code === 'number' ? err.code : err ? 1 : 0;
+                    const errorText = err ? err.message : '';
+                    resolve({
+                        code,
+                        stdout: stdout?.toString() ?? '',
+                        stderr: stderr?.toString() || errorText,
+                    });
+                });
             });
-        });
-    },
-};
+        },
+    };
+}
+exports.defaultExec = createBoundedExec();
 /** Extract the first PR URL gh prints (e.g. https://github.com/o/r/pull/12). */
 function parsePrUrl(stdout) {
     const m = stdout.match(/https?:\/\/\S+\/pull\/\d+/);
     return m ? m[0] : undefined;
 }
+/**
+ * Recover an ambiguously-created PR by its exact remote identity. GitHub does
+ * not allow a second open PR for the same head in the common case, but we still
+ * require exactly one OPEN head/base match before adopting it: a fuzzy title or
+ * ticket match would attach the delivery to someone else's review.
+ */
+async function findExactOpenPr(exec, input) {
+    const lookup = await exec.run('gh', [
+        'pr', 'list', '--state', 'open', '--head', input.branch, '--base', input.baseBranch,
+        '--json', 'url,isDraft,headRefName,baseRefName,state',
+    ], input.repoDir);
+    if (lookup.code !== 0)
+        return null;
+    try {
+        const parsed = JSON.parse(lookup.stdout);
+        if (!Array.isArray(parsed))
+            return null;
+        const exact = parsed.filter((candidate) => candidate.state === 'OPEN' &&
+            candidate.headRefName === input.branch &&
+            candidate.baseRefName === input.baseBranch &&
+            typeof candidate.url === 'string' &&
+            parsePrUrl(candidate.url) === candidate.url);
+        if (exact.length !== 1)
+            return null;
+        return {
+            prUrl: exact[0].url,
+            ...(typeof exact[0].isDraft === 'boolean' ? { isDraft: exact[0].isDraft } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /** Push a committed delivery branch, including the gh-credential retry used by
  *  draft PR creation. This is also used for follow-up commits on an existing PR:
  *  that path must update the same remote PR branch without trying to create a
  *  second PR. */
 async function pushBranch(exec, input) {
     const remote = input.remote ?? 'origin';
-    const { repoDir, branch, baseBranch } = input;
-    const pushArgs = ['push', '-u', remote, branch];
+    const { repoDir, branch, baseBranch, sourceSha } = input;
+    if (sourceSha !== undefined && !/^[0-9a-f]{40,64}$/i.test(sourceSha)) {
+        return { state: 'local-only', branch, reason: 'invalid verified source commit' };
+    }
+    // A raw commit refspec deliberately omits `-u`: git cannot configure branch
+    // tracking from an object id, and an existing PR branch already has a remote.
+    const pushArgs = sourceSha
+        ? ['push', remote, `${sourceSha}:refs/heads/${branch}`]
+        : ['push', '-u', remote, branch];
     (0, git_guardrails_1.assertGitAllowed)('git', pushArgs, { protectedBranch: baseBranch });
     let push = await exec.run('git', pushArgs, repoDir);
     if (push.code !== 0 && isCredentialFailure(push)) {
@@ -71,19 +133,24 @@ async function publishDraftPr(exec, input) {
     const { repoDir, branch, baseBranch } = input;
     // 1. Push the branch (set upstream). Failure → local-only, never throw.
     //    Guardrail: never force-push, never push the integration branch itself.
-    const pushed = await pushBranch(exec, { repoDir, branch, baseBranch, remote });
+    const pushed = await pushBranch(exec, { repoDir, branch, baseBranch, remote, sourceSha: input.sourceSha });
     if (pushed.state === 'local-only')
         return pushed;
     // 2. Open a DRAFT PR. Failure (no gh / not authed / perms) → pushed, never throw.
     const pr = await exec.run('gh', ['pr', 'create', '--draft', '--base', baseBranch, '--head', branch, '--title', input.title, '--body', input.body], repoDir);
-    if (pr.code !== 0) {
-        return { state: 'pushed', branch, reason: reasonFrom(pr) };
-    }
-    const prUrl = parsePrUrl(pr.stdout);
+    const prUrl = pr.code === 0 ? parsePrUrl(pr.stdout) : undefined;
     if (!prUrl) {
-        // gh exited 0 but we couldn't find a URL — treat as pushed (the PR likely
-        // exists) rather than claiming a URL we don't have.
-        return { state: 'pushed', branch, reason: 'pr-created-no-url' };
+        // `gh pr create` can report success without a parseable URL, return an
+        // "already exists" error on a retry, or fail after GitHub accepted the
+        // request. Resolve every ambiguous outcome by exact head/base identity.
+        const existing = await findExactOpenPr(exec, { repoDir, branch, baseBranch });
+        if (existing)
+            return { state: 'pr-created', branch, ...existing };
+        return {
+            state: 'pushed',
+            branch,
+            reason: pr.code === 0 ? 'pr-created-no-url' : reasonFrom(pr),
+        };
     }
     return { state: 'pr-created', branch, prUrl };
 }

package/server/dist/process-admission.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Process-wide and project-scoped admission barrier for subprocess work.
+ *
+ * Shutdown is not instantaneous: existing HTTP/WebSocket handlers can resume
+ * after their manager has been disposed. A generation lease lets those
+ * continuations prove that their project is still live before spawning or
+ * touching a DB, while the global barrier closes every generic AI-CLI wrapper
+ * at the beginning of process shutdown.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProcessAdmissionClosedError = void 0;
+exports.assertProcessAdmission = assertProcessAdmission;
+exports.captureProcessAdmission = captureProcessAdmission;
+exports.beginAppProcessQuiescence = beginAppProcessQuiescence;
+exports.beginProjectProcessQuiescence = beginProjectProcessQuiescence;
+exports.openProjectProcessAdmission = openProjectProcessAdmission;
+exports.resetProcessAdmissionForTests = resetProcessAdmissionForTests;
+class ProcessAdmissionClosedError extends Error {
+    projectId;
+    code = 'PROCESS_ADMISSION_CLOSED';
+    constructor(projectId) {
+        super(projectId
+            ? `Process admission is closed for project ${projectId}`
+            : 'Process admission is closed during application shutdown');
+        this.projectId = projectId;
+        this.name = 'ProcessAdmissionClosedError';
+    }
+}
+exports.ProcessAdmissionClosedError = ProcessAdmissionClosedError;
+let appOpen = true;
+let appGeneration = 0;
+const projectGenerations = new Map();
+const closedProjects = new Set();
+function assertProcessAdmission(projectId) {
+    if (!appOpen || (projectId !== undefined && closedProjects.has(projectId))) {
+        throw new ProcessAdmissionClosedError(projectId);
+    }
+}
+function captureProcessAdmission(projectId) {
+    assertProcessAdmission(projectId);
+    const capturedAppGeneration = appGeneration;
+    const capturedProjectGeneration = projectId === undefined
+        ? 0
+        : (projectGenerations.get(projectId) ?? 0);
+    const isCurrent = () => appOpen &&
+        appGeneration === capturedAppGeneration &&
+        (projectId === undefined || (!closedProjects.has(projectId) &&
+            (projectGenerations.get(projectId) ?? 0) === capturedProjectGeneration));
+    return {
+        projectId,
+        isCurrent,
+        assertCurrent() {
+            if (!isCurrent())
+                throw new ProcessAdmissionClosedError(projectId);
+        },
+    };
+}
+/** Close app-wide admission before any shutdown await can yield. Idempotent. */
+function beginAppProcessQuiescence() {
+    if (!appOpen)
+        return;
+    appOpen = false;
+    appGeneration += 1;
+}
+/** Invalidate all earlier continuations and reject new work for one project. */
+function beginProjectProcessQuiescence(projectId) {
+    closedProjects.add(projectId);
+    projectGenerations.set(projectId, (projectGenerations.get(projectId) ?? 0) + 1);
+}
+/** Open a freshly hydrated project context with a new continuation epoch. */
+function openProjectProcessAdmission(projectId) {
+    closedProjects.delete(projectId);
+    projectGenerations.set(projectId, (projectGenerations.get(projectId) ?? 0) + 1);
+}
+/** @internal Test isolation only; production shutdown is intentionally final. */
+function resetProcessAdmissionForTests() {
+    appOpen = true;
+    appGeneration += 1;
+    projectGenerations.clear();
+    closedProjects.clear();
+}