superpowers-manager 0.5.2 → 0.7.0

package/dist/commands/uninstall.js

@@ -1,72 +1,21 @@
-// Ports scripts/uninstall. The shell sourced common.sh, provenance.sh,
-// lifecycle.sh and adapter.sh; the predicates now live in src/harnesses/codex/lifecycle.ts
-// and the adapter arrives through ctx.adapter.
 import { tmpdir } from "node:os";
 import { oneLine } from "../cli-arguments.js";
 import { withWorkspace, workspaceRemovalFailure } from "../workspace.js";
+import { GatherFailure, callAdapter, } from "./adapter-call.js";
 import { runWithMutation } from "./mutation.js";
 import { replayOutcome } from "./probe.js";
 async function invoke(call, failure, outcomes) {
-    let result;
-    try {
-        result = await call();
-    }
-    catch {
-        return { ok: false, message: failure.unexpected };
-    }
-    outcomes.push(result.outcome);
-    const outcome = result.outcome;
-    if (result.status !== 0 || !outcome.ok) {
-        return {
-            ok: false,
-            message: outcome.ok ? failure.invalidStatus : null,
-        };
-    }
-    return {
-        ok: true,
-        result: { status: result.status, outcome },
-    };
-}
-// withWorkspace throws for mkdtemp failure before the callback ever runs
-// ("cannot create workspace",
-// `src/workspace.ts:120::throw new SafetyError("workspace", "cannot create workspace"`).
-// A bare re-throw would silently drop every outcome collected before that
-// point -- a narrow
-// DIAG-ADAPTER-01 regression the shell never had, since it replayed each
-// adapter response as it went rather than batching replay to the end. This
-// carries the outcomes collected so far alongside the original cause, so
-// runUninstall's catch can still replay them before reporting the cause.
-//
-// The post-success cleanup failure no longer reaches here: onCleanupFailure
-// below suppresses withWorkspace's throw for that case and records the
-// warning as data, so the computed UninstallOutcome survives it. The
-// outcome-carrying is still load-bearing for mkdtemp, and the shape stays
-// identical to src/commands/install.ts's GatherFailure.
-class GatherFailure extends Error {
-    inner;
-    outcomes;
-    constructor(inner, outcomes) {
-        super("uninstall gather failed");
-        this.inner = inner;
-        this.outcomes = outcomes;
-    }
+    const result = await callAdapter(call, failure);
+    if (result.result !== null)
+        outcomes.push(result.result.outcome);
+    return result;
 }
-// Every step that can throw or fail closed, returning the outcome as data and
-// performing NO writes. Same shape as gatherProbe
-// (`src/commands/probe.ts::readonly facts: ProbeSnapshot<R>;`) and for the same
-// reason: a write inside this try could raise EPIPE, be caught here, and be
-// relabelled as a domain failure.
+// Collect outcomes without writing so output failures cannot be classified as
+// inspection failures. Replay collected outcomes after gathering completes.
 async function gatherUninstall(ctx) {
-    // `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/uninstall:20-21::TMPDIR=` exported TMPDIR="$uninstall_workspace" so every
-    // child confined its temporary files to the tree the workspace trap
-    // removed. The AdapterContext passed to ctx.adapter below does the same.
     const parent = ctx.env.TMPDIR ?? tmpdir();
-    // Declared OUTSIDE the withWorkspace callback (rather than inside, as an
-    // earlier draft had it) so the catch below -- which wraps the ENTIRE
-    // withWorkspace call, not just the callback -- can still see whatever was
-    // collected before a workspace throw. Both `mkdtemp` failure (nothing
-    // collected yet) and a post-success cleanup failure (everything the
-    // callback collected) reach this same array.
+    // Kept outside the workspace callback so a workspace failure preserves every
+    // outcome collected before it.
     const outcomes = [];
     let cleanupWarning = null;
     try {
@@ -90,9 +39,8 @@ async function gatherUninstall(ctx) {
             const removed = await invoke(() => ctx.adapter.remove(removalInput, adapterContext), removeFailure, outcomes);
             if (!removed.ok)
                 return failed(removed.message);
-            // Stage 3: inspect ownership AGAIN. This overwrites the first
-            // inspection (`git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/uninstall:29-30::spw_verify_uninstalled_resources`), so everything below reads the
-            // POST-uninstall state, not the pre-uninstall one read above.
+            // Stage 3: inspect ownership again. Everything below reads this
+            // post-removal state, not the inspection before removal.
             const afterFailure = ctx.adapter.presentation.callFailure("post-remove", adapterContext);
             const after = await invoke(() => ctx.adapter.inspectOwnership(adapterContext), afterFailure, outcomes);
             if (!after.ok)
@@ -125,13 +73,13 @@ async function gatherUninstall(ctx) {
     catch (cause) {
         // Reachable only for mkdtemp failure, with nothing collected yet: this
         // callback never throws -- every ctx.adapter throw is already caught
-        // inside invoke(), and presenceFlag/verifyUninstalledResources/
+        // inside invoke(), and presenceFlag/
         // reportLegacyState are pure (src/harnesses/codex/lifecycle.ts's header comment) -- so a
         // post-success cleanup failure is handled by onCleanupFailure above and
         // cannot reach here. Wrapping with `outcomes` anyway keeps the class
         // total over its declared contract rather than assuming the callback's
         // purity at the throw site.
-        throw new GatherFailure(cause, outcomes);
+        throw new GatherFailure("uninstall gather failed", cause, outcomes);
     }
 }
 export async function runUninstall(argv, ctx) {
@@ -147,30 +95,8 @@ async function performUninstall(argv, ctx) {
         run = await gatherUninstall(ctx);
     }
     catch (cause) {
-        // gatherUninstall throws exactly one shape: GatherFailure, wrapping
-        // withWorkspace's "cannot create workspace" SafetyError
-        // (`src/workspace.ts:120::throw new SafetyError("workspace", "cannot create workspace"`),
-        // alongside whatever outcomes were collected before that throw -- none,
-        // for that cause. Replaying first, before
-        // reporting the cause, keeps the arm honest for any outcome-bearing
-        // throw the class is declared to carry (DIAG-ADAPTER-01). The
-        // post-success cleanup failure no longer arrives here: gatherUninstall's
-        // onCleanupFailure records it as `cleanupWarning` and the computed
-        // outcome survives, which is what `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/uninstall:34-35::complete` did. The
-        // `instanceof` guard is defensive rather than load-bearing --
-        // gatherUninstall's own catch is the only thing that can throw here, and
-        // it always wraps -- but this catch does not assume that invariant
-        // blindly.
-        //
-        // A cause outside ctx.adapter's AdapterFailure guard
-        // (`src/harnesses/codex/adapter.ts:1081::async function runCodexOperation<T = JsonValue>(`) does NOT
-        // reach here: invoke() catches it inside gatherUninstall and converts it
-        // to a hand-written message carried as UninstallOutcome data, exactly as
-        // src/commands/probe.ts's inspect() does for the same cause.
-        //
-        // gatherUninstall performs no writes of its own, so this catch cannot
-        // also be reached by an EPIPE from uninstall's own output -- every write
-        // below runs only after this try/catch has resolved.
+        // Replay collected outcomes before reporting a gather failure. The
+        // cleanup reporter retains post-success cleanup failures as data.
         const outcomes = cause instanceof GatherFailure ? cause.outcomes : [];
         for (const outcome of outcomes)
             replayOutcome(outcome, ctx);
@@ -179,9 +105,7 @@ async function performUninstall(argv, ctx) {
         return 1;
     }
     const { outcome, cleanupWarning } = run;
-    // Replay first, on both paths: the shell validator replayed every
-    // response's messages whether or not that response was a failure
-    // (`git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/core/validate-adapter-response.py:268::replay(messages)`).
+    // Replay before reporting a command-level result on either path.
     for (const each of outcome.outcomes)
         replayOutcome(each, ctx);
     let status;

package/dist/commands/update.js

@@ -1,21 +1,10 @@
-// Ports scripts/update. The shell sourced common.sh and lifecycle.sh; the
-// predicates now live in src/harnesses/codex/lifecycle.ts. Unlike install and uninstall,
-// update issues no ctx.adapter call of its own: every adapter interaction
-// this module needs already happens inside gatherProbe, runPrepare or
-// runInstall, each of which owns its own §4.2a-conformant invoke() gate. That
-// is also why update opens no temporary workspace of its own -- there is no
-// mutation here for one to protect.
+// Update delegates adapter calls to probe, prepare, and install. Those
+// mutating commands own their workspaces, so update opens none itself.
 import { oneLine } from "../cli-arguments.js";
+import { runInstall, writeOutput } from "./install.js";
 import { gatherProbe, replayOutcome } from "./probe.js";
-import { runInstall } from "./install.js";
 import { runPrepare } from "./prepare.js";
 import { runWithMutation } from "./mutation.js";
-function writeOutput(output, ctx) {
-    for (const line of output.stdout)
-        ctx.stdout.write(`${line}\n`);
-    for (const line of output.stderr)
-        ctx.stderr.write(`${line}\n`);
-}
 export async function runUpdate(argv, ctx) {
     return await runWithMutation("update", ctx, async (scoped) => performUpdate(argv, scoped));
 }
@@ -28,17 +17,8 @@ async function performUpdate(argv, ctx) {
         probe = await gatherProbe(ctx);
     }
     catch (cause) {
-        // gatherProbe performs no writes of its own (src/commands/probe.ts), so
-        // this catch cannot also be reached by an EPIPE from update's own
-        // output -- update writes nothing before this call resolves, unlike
-        // install's NOTE line.
-        //
-        // This is a THIRD consumer of gatherProbe's throw channel --
-        // `src/commands/probe.ts:469-527::THREE exceptions, all inherited and none a regression:`'s
-        // runProbe catch is the first and src/commands/install.ts's runInstall catch
-        // is the second. Because all three wrap the identical function, runProbe's
-        // long comment there enumerates exactly what can reach this stream too; not
-        // repeated here.
+        // Gathering does not write, so this catch cannot misclassify an output
+        // failure. oneLine() bounds any inherited diagnostic to one line.
         ctx.stderr.write(`error: ${oneLine(cause)}\n`);
         return 1;
     }

package/dist/effective-selection.js

@@ -34,19 +34,18 @@ export function selectionConfigDir(env) {
 export function selectionStatePath(env) {
     return `${selectionConfigDir(env)}/selection.json`;
 }
-// Composes exactly what `src/selection-state-cli.ts:39::const normalized`
-// composes. The shell wrote a normalized document to a mktemp file and read
-// five fields back with five python3 invocations; in-process this is one call.
+// Normalizes the record returned by readSelectionState directly. The shell
+// wrote a normalized document to a mktemp file and read five fields back with
+// five python3 invocations; in-process this is one call.
 export async function loadSavedSelection(env) {
     return normalizeSaved(await readSelectionState(selectionStatePath(env)));
 }
 export const UPSTREAM_URL_DEFAULT = "https://github.com/obra/superpowers";
 // Ports the env > saved > package-default precedence ladder from
 // `git show ad56569a4c161e7b122967442e2b026eeb6395f6:scripts/core/selection.sh:88-162::spw_compute_effective_selection`.
-// validateSource runs before any ref resolution -- pinned by
-// tests/unit/effective-selection.test.js's "source validation precedes ref
-// resolution": a credential-bearing source must fail before Git is ever
-// invoked.
+// validateSource runs before any ref resolution. A credential-bearing source
+// must fail before Git is invoked; the resolver-log check lives in
+// `tests/baseline/selection-location.test.ts::SEL-PRECEDENCE-VALIDATE-01 invalid saved state stops resolution`.
 export async function computeEffectiveSelection(root, env) {
     const saved = await loadSavedSelection(env);
     let upstreamSourceOrigin;
@@ -63,8 +62,7 @@ export async function computeEffectiveSelection(root, env) {
         upstreamSourceOrigin = "package-default";
         effectiveSource = UPSTREAM_URL_DEFAULT;
     }
-    // Before any Git access. Pinned by tests/unit/effective-selection.test.js's
-    // "source validation precedes ref resolution".
+    // Before any Git access; the selection-location test above checks the log.
     validateSource(effectiveSource);
     let selectionOrigin;
     let selectionMode;

package/dist/git-tree.js

@@ -0,0 +1,85 @@
+import { execFile } from "node:child_process";
+import { chmod, mkdir, symlink, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { promisify } from "node:util";
+import { ARTIFACT_RECEIPT } from "./artifact-tree.js";
+import { COMMIT_RE } from "./domain/refs.js";
+import { assertNoFollowType, assertSymlinkTargetContained, } from "./safe-path.js";
+import { SafetyError } from "./safety-error.js";
+const exec = promisify(execFile);
+const DECODER = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+async function gitBytes(repository, args) {
+    try {
+        return (await exec("git", ["--no-replace-objects", "-C", repository, ...args], {
+            encoding: null,
+            maxBuffer: 256 * 1024 * 1024,
+        })).stdout;
+    }
+    catch (cause) {
+        throw new SafetyError("git-tree", `cannot read Git tree objects from repository: ${repository}`, { cause });
+    }
+}
+export async function materializeGitTree(repository, commit, destination) {
+    try {
+        if (!COMMIT_RE.test(commit))
+            throw new Error("commit");
+        if (!(await gitBytes(repository, ["cat-file", "-t", commit])).equals(Buffer.from("commit\n")))
+            throw new Error("not a commit");
+        await assertNoFollowType(destination, ["missing"]);
+        const bytes = await gitBytes(repository, [
+            "ls-tree",
+            "-rz",
+            "--full-tree",
+            commit,
+        ]);
+        const entries = [];
+        let offset = 0;
+        while (offset < bytes.length) {
+            const end = bytes.indexOf(0, offset);
+            if (end < 0)
+                throw new Error("tree framing");
+            const record = DECODER.decode(bytes.subarray(offset, end));
+            offset = end + 1;
+            const match = /^(100644|100755|120000) blob ([a-f0-9]{40})\t([\s\S]+)$/.exec(record);
+            if (!match)
+                throw new Error("tree entry");
+            const path = match[3];
+            if (path
+                .split("/")
+                .some((part) => !part ||
+                part === "." ||
+                part === ".." ||
+                part.toLowerCase() === ".git") ||
+                isAbsolute(path) ||
+                path.includes("\\") ||
+                path.split("/")[0] === ARTIFACT_RECEIPT)
+                throw new Error("tree path");
+            entries.push({ mode: match[1], oid: match[2], path });
+        }
+        await mkdir(destination, { recursive: true });
+        for (const entry of entries)
+            await mkdir(dirname(join(destination, entry.path)), { recursive: true });
+        for (const entry of entries.filter((entry) => entry.mode !== "120000")) {
+            const path = join(destination, entry.path), mode = entry.mode === "100755" ? 0o755 : 0o644;
+            await writeFile(path, await gitBytes(repository, ["cat-file", "blob", entry.oid]), { flag: "wx", mode });
+            await chmod(path, mode);
+        }
+        for (const entry of entries.filter((entry) => entry.mode === "120000")) {
+            const target = DECODER.decode(await gitBytes(repository, ["cat-file", "blob", entry.oid]));
+            const path = join(destination, entry.path), suffix = relative(resolve(destination), resolve(dirname(path), target));
+            if (!target ||
+                target.includes("\0") ||
+                isAbsolute(target) ||
+                suffix === ".." ||
+                suffix.startsWith("../") ||
+                isAbsolute(suffix))
+                throw new Error("link escape");
+            await symlink(target, path);
+        }
+        for (const entry of entries.filter((entry) => entry.mode === "120000"))
+            await assertSymlinkTargetContained(destination, join(destination, entry.path));
+    }
+    catch (cause) {
+        throw new SafetyError("git-tree", `cannot materialize Git tree from ${repository} into ${destination}`, { cause });
+    }
+}

package/dist/harness-command-result.js

@@ -0,0 +1,47 @@
+import { AdapterMessageLog, failureResult, successResult, } from "./adapter-result.js";
+import { SEMVER_RE } from "./domain/refs.js";
+function appendCaptured(log, label, channel, captured) {
+    log.appendBytes(channel, Buffer.from(captured.text));
+    if (captured.droppedBytes > 0)
+        log.appendText(channel, `${label} ${channel} omitted ${captured.droppedBytes} bytes at the capture limit`);
+}
+export function nativeCommandResult(label, result) {
+    const operation = `${label.toLowerCase()}-command`;
+    if (result.kind === "launchFailed") {
+        const errno = /^[A-Z][A-Z0-9_]*$/u.test(result.errno)
+            ? result.errno
+            : "UNKNOWN";
+        return failureResult(operation, "launch-failed", `cannot launch configured ${label} executable (${errno})`, [], []);
+    }
+    const log = new AdapterMessageLog();
+    if (result.kind === "timedOut") {
+        appendCaptured(log, label, "stdout", result.stdout);
+        appendCaptured(log, label, "stderr", result.stderr);
+        return failureResult(operation, "timeout", `${label} command timed out after ${result.afterMs} ms`, [], log.snapshot());
+    }
+    if (result.code !== 0) {
+        appendCaptured(log, label, "stdout", result.stdout);
+        appendCaptured(log, label, "stderr", result.stderr);
+        return failureResult(operation, "nonzero-exit", result.code === null
+            ? `${label} command exited without a status`
+            : `${label} command exited with status ${result.code}`, [], log.snapshot());
+    }
+    if (result.stdout.droppedBytes > 0 || result.stderr.droppedBytes > 0) {
+        appendCaptured(log, label, "stdout", result.stdout);
+        appendCaptured(log, label, "stderr", result.stderr);
+        return failureResult(operation, "output-limit", `${label} command output exceeded the capture limit`, [], log.snapshot());
+    }
+    appendCaptured(log, label, "stderr", result.stderr);
+    return successResult(operation, { stdout: result.stdout.text }, log.snapshot());
+}
+export function normalizeSnapshotRuntimeVersion(label, result) {
+    if (!result.outcome.ok)
+        return { status: result.status, outcome: result.outcome };
+    const operation = `${label.toLowerCase()}-runtime`;
+    if (result.status !== 0)
+        return failureResult(operation, "invalid-status", `${label} runtime inspection returned a nonzero status`, [], result.outcome.messages);
+    const version = result.outcome.result.stdout.trim();
+    if (!SEMVER_RE.test(version))
+        return failureResult(operation, "invalid-version", `${label} runtime inspection returned an invalid version response`, [], result.outcome.messages);
+    return successResult(operation, version, result.outcome.messages);
+}