synartesis 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 What changed, and why it mattered. Dates are release dates.
 
+## 0.4.2 — 2026-09-09
+
+Three bugs, found by auditing the paths the last pass did not touch. Each is
+pinned by a test that fails against 0.4.1.
+
+### Fixed
+
+- **One approval could authorise two irreversible calls.** Spending a standing
+  approval was an announcement rather than a claim: `markInFlight` and
+  `adoptApproval` both wrote unconditionally, so two proxies — which share one
+  journal, the reason `close` is never automatic — could read the same approved
+  row before either had used it, and both proceed. One person's yes, two emails
+  sent, which is the single thing this is here to prevent.
+
+  Both are now conditional on the row still being `approved` and report whether
+  they won it. `adoptApproval` spends first and only carries the approval across
+  if it did. The proxy treats losing the race as never having had an approval:
+  it asks. The guard already existed for inverses, and its comment describes
+  this exact failure; the approval path never got one.
+
+- **`prune` deleted sessions still waiting on a person.** `--help` and the
+  README both promise that nothing waiting on a person is ever pruned. The query
+  enforced it for `pending`, `gated` and `rolling_back`, and not for the two
+  other statuses that mean the same thing: `approved`, somebody's yes the agent
+  has not spent, and `unrecoverable`, an undo that stopped because somebody had
+  changed the resource and is waiting for them to choose. Pruning the first threw
+  away a human decision; the second threw away both the conflict and the undo
+  they were deciding about.
+
+- **Forcing an undo walked around the double-apply guard.** `markRollingBack`
+  claims an action by moving it out of `applied`, so two rollbacks cannot both
+  send one inverse. `undo --force`, added in 0.4.1, acts on rows an earlier
+  refusal left `unrecoverable` — which the claim did not know about, so it never
+  claimed them and never reported that it had not. Two concurrent forced undos
+  both sent the inverse: harmless for an idempotent write, a second real change
+  to the world for a compensable one.
+
 ## 0.4.1 — 2026-09-09
 
 ### Added

package/dist/{chunk-FOA4UIDE.js → chunk-LAZLEAZW.js}

@@ -470,9 +470,26 @@ var SqliteJournal = class {
       this.#db.prepare("UPDATE actions SET status = 'pending', error = ? WHERE id = ?").run(error, actionId);
     });
   }
-  markRollingBack(actionId) {
+  /**
+   * Claim an action to send its inverse, or report that somebody else has.
+   *
+   * Conditional, so the transition is a claim rather than an announcement. Two
+   * rollbacks of one run both read the action as applied and both sent its
+   * inverse; for a compensating call rather than a restore, that is a second
+   * real change to the world.
+   *
+   * `from` is which statuses may be claimed. It exists because `undo --force`
+   * acts on rows left `unrecoverable` by an earlier refusal, and a claim that
+   * only knew `applied` never claimed those at all -- so the guard above was
+   * simply absent on the one path where a person had already been told the
+   * resource is contested.
+   */
+  markRollingBack(actionId, from = ["applied"]) {
     return this.#run("markRollingBack", () => {
-      const result = this.#db.prepare("UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status = 'applied'").run(actionId);
+      const slots = from.map(() => "?").join(",");
+      const result = this.#db.prepare(
+        `UPDATE actions SET status = 'rolling_back' WHERE id = ? AND status IN (${slots})`
+      ).run(actionId, ...from);
       return result.changes === 1;
     });
   }
@@ -507,9 +524,19 @@ var SqliteJournal = class {
       this.#db.prepare("UPDATE actions SET status = 'gated', error = ? WHERE id = ?").run(why ?? null, actionId);
     });
   }
+  /**
+   * Spend a standing approval, or report that somebody else already has.
+   *
+   * Conditional for the same reason markRollingBack is. Several proxies share
+   * one journal, so two can read the same approved row before either has used
+   * it, and an unconditional write let both proceed -- one person's yes
+   * authorising two irreversible calls, which is the single thing this is here
+   * to prevent.
+   */
   markInFlight(actionId) {
-    this.#run("markInFlight", () => {
-      this.#db.prepare("UPDATE actions SET status = 'pending' WHERE id = ?").run(actionId);
+    return this.#run("markInFlight", () => {
+      const result = this.#db.prepare("UPDATE actions SET status = 'pending' WHERE id = ? AND status = 'approved'").run(actionId);
+      return result.changes === 1;
     });
   }
   /**
@@ -542,12 +569,18 @@ var SqliteJournal = class {
     });
   }
   adoptApproval(actionId, granted) {
-    this.#run("adoptApproval", () => {
+    return this.#run("adoptApproval", () => {
       const move = this.#db.transaction(() => {
+        const spent = this.#db.prepare(
+          "UPDATE actions SET status = 'denied', error = ? WHERE id = ? AND status = 'approved'"
+        ).run(`${SPENT_APPROVAL} ${actionId}`, granted.id);
+        if (spent.changes !== 1) {
+          return false;
+        }
         this.#db.prepare("UPDATE actions SET approved_by = ?, approved_at = ? WHERE id = ?").run(granted.approvedBy ?? null, granted.approvedAt ?? null, actionId);
-        this.#db.prepare("UPDATE actions SET status = 'denied', error = ? WHERE id = ?").run(`${SPENT_APPROVAL} ${actionId}`, granted.id);
+        return true;
       });
-      move.immediate();
+      return move.immediate();
     });
   }
   listGated() {
@@ -639,10 +672,18 @@ var SqliteJournal = class {
              FROM runs r
             WHERE r.status != 'active'
               AND COALESCE(r.ended_at, r.started_at) < ?
+              -- Everything a person still has business with. approved is
+              -- somebody's yes that the agent has not spent yet, and
+              -- unrecoverable is an undo that stopped because somebody had
+              -- changed the resource, waiting for them to choose. Both were
+              -- missing, so the promise made in --help and the README -- that
+              -- nothing waiting on a person is ever pruned -- was not one this
+              -- query kept.
               AND NOT EXISTS (
                     SELECT 1 FROM actions a
                      WHERE a.run_id = r.id
-                       AND a.status IN ('pending','gated','rolling_back'))
+                       AND a.status IN
+                           ('pending','gated','approved','rolling_back','unrecoverable'))
             ORDER BY at, r.rowid`
       ).all(before).map(
         (row) => z.object({
@@ -1493,4 +1534,4 @@ export {
   observeState,
   connectStdioUpstream
 };
-//# sourceMappingURL=chunk-FOA4UIDE.js.map
+//# sourceMappingURL=chunk-LAZLEAZW.js.map

package/dist/cli.js

@@ -25,7 +25,7 @@ import {
   toPayload,
   verifyAgainstServers,
   wasRefused
-} from "./chunk-FOA4UIDE.js";
+} from "./chunk-LAZLEAZW.js";
 import {
   DriftConflict,
   ManifestError,
@@ -491,8 +491,11 @@ ${seen}` : seen;
     if (dryRun) {
       continue;
     }
-    const claimed = journal.markRollingBack(action.id);
-    if (!claimed && action.status === "applied") {
+    const claimed = journal.markRollingBack(
+      action.id,
+      force ? ["applied", "unrecoverable"] : ["applied"]
+    );
+    if (!claimed && action.status !== "rolling_back") {
       const reason = "another undo is already working on this action";
       halted = { seq: action.seq, reason, detail: "" };
       steps[steps.length - 1] = {

package/dist/proxy.js

@@ -19,7 +19,7 @@ import {
   runRead,
   toPayload,
   verifyAgainstServers
-} from "./chunk-FOA4UIDE.js";
+} from "./chunk-LAZLEAZW.js";
 import {
   SnapshotError,
   UpstreamError,
@@ -588,10 +588,11 @@ function createProxyServer(options) {
           seq: reusable.seq,
           idempotencyKey: reusable.idempotencyKey
         };
+        let spent = true;
         if (inherited !== void 0) {
-          journal.adoptApproval(pending.actionId, inherited);
+          spent = journal.adoptApproval(pending.actionId, inherited);
         } else if (granted !== void 0 && waiting === void 0) {
-          journal.markInFlight(granted.id);
+          spent = journal.markInFlight(granted.id);
         }
         if (granted !== void 0) {
           log?.info(
@@ -654,7 +655,7 @@ function createProxyServer(options) {
           }
         };
         const askedAlready = wantsGate;
-        if (wantsGate && granted === void 0) {
+        if (wantsGate && (granted === void 0 || !spent)) {
           await decide("this action cannot be undone");
         }
         let snapshot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "synartesis",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "An undo layer for AI agents.",
   "type": "module",
   "private": false,