taskchef 7.28.1 → 8.0.0

package/src/config-audit.js

@@ -0,0 +1,99 @@
+import { open, readFile, readdir, rename, stat, unlink } from "node:fs/promises";
+import path from "node:path";
+import { taskChefError } from "./state-store.js";
+
+export async function appendAuditUnlocked(workspace, record) {
+  const filePath = path.join(workspace, "config-audit.jsonl");
+  const size = await stat(filePath).then((details) => details.size).catch((error) => {
+    if (error.code === "ENOENT") return 0;
+    throw error;
+  });
+  if (size >= 10 * 1024 * 1024) {
+    const timestamp = new Date().toISOString().replaceAll(":", "-").replaceAll(".", "-");
+    await rename(filePath, path.join(workspace, `config-audit.${timestamp}.jsonl`));
+    const archives = (await readdir(workspace))
+      .filter((name) => /^config-audit\..+\.jsonl$/.test(name))
+      .sort()
+      .reverse();
+    for (const name of archives.slice(10)) await unlink(path.join(workspace, name));
+  }
+  const handle = await open(filePath, "a", 0o600);
+  try {
+    await handle.writeFile(`${JSON.stringify({ schemaVersion: 1, ...record })}\n`);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+async function readLatestAuditRecordsUnlocked(workspace) {
+  const filePath = path.join(workspace, "config-audit.jsonl");
+  const content = await readFile(filePath, "utf8").catch((error) => {
+    if (error.code === "ENOENT") return "";
+    throw error;
+  });
+  const latest = new Map();
+  for (const [index, line] of content.trimEnd().split("\n").entries()) {
+    if (line.length === 0) continue;
+    let record;
+    try {
+      record = JSON.parse(line);
+    } catch {
+      throw taskChefError(
+        "STATE_RECOVERY_REQUIRED",
+        `configuration audit is malformed at line ${index + 1}`,
+      );
+    }
+    if (record.transactionId) latest.set(record.transactionId, record);
+  }
+  return latest;
+}
+
+export async function validateAuditUnlocked(workspace) {
+  await readLatestAuditRecordsUnlocked(workspace);
+}
+
+export async function reconcileAuditUnlocked(workspace, currentHash) {
+  const latest = await readLatestAuditRecordsUnlocked(workspace);
+  for (const record of latest.values()) {
+    if (record.phase !== "prepared" && record.phase !== "recovery-required") continue;
+    if (currentHash === record.beforeHash) {
+      await appendAuditUnlocked(workspace, {
+        ...record,
+        timestamp: new Date().toISOString(),
+        phase: "aborted",
+        reconciliation: "matched-before",
+      });
+    } else if (currentHash === record.afterHash) {
+      await appendAuditUnlocked(workspace, {
+        ...record,
+        timestamp: new Date().toISOString(),
+        phase: "committed",
+        reconciliation: "matched-after",
+      });
+    } else {
+      throw taskChefError(
+        "STATE_RECOVERY_REQUIRED",
+        `configuration does not match either side of transaction ${record.transactionId}`,
+        { transactionId: record.transactionId },
+      );
+    }
+  }
+}
+
+export async function supersedeAuditTransactionsUnlocked(workspace, recoveryTransactionId) {
+  const latest = await readLatestAuditRecordsUnlocked(workspace);
+  const superseded = [];
+  for (const record of latest.values()) {
+    if (record.transactionId === recoveryTransactionId
+        || !new Set(["prepared", "recovery-required"]).has(record.phase)) continue;
+    await appendAuditUnlocked(workspace, {
+      ...record,
+      timestamp: new Date().toISOString(),
+      phase: "superseded",
+      supersededBy: recoveryTransactionId,
+    });
+    superseded.push(record.transactionId);
+  }
+  return superseded;
+}

package/src/config-mutations.js

@@ -0,0 +1,98 @@
+import { semanticHash, taskChefError } from "./state-store.js";
+
+function fieldsChanged(before, after) {
+  const fields = {};
+  for (const key of ["name", "description", "isGitRepository", "githubRepos"]) {
+    if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
+      fields[key] = { before: before[key] ?? null, after: after[key] ?? null };
+    }
+  }
+  return fields;
+}
+
+export function projectSetHash(projects) {
+  return semanticHash({ schemaVersion: 1, projects }, "taskchef-project-set-v1");
+}
+
+export function configHash(config) {
+  return semanticHash(config, "taskchef-config-v1");
+}
+
+export function projectDiff(beforeProjects, afterProjects) {
+  const before = new Map(beforeProjects.map((project) => [project.path, project]));
+  const after = new Map(afterProjects.map((project) => [project.path, project]));
+  const added = [];
+  const changed = [];
+  const removed = [];
+  for (const project of afterProjects) {
+    const prior = before.get(project.path);
+    if (!prior) added.push(project);
+    else {
+      const fields = fieldsChanged(prior, project);
+      if (Object.keys(fields).length) changed.push({ path: project.path, before: prior, after: project, fields });
+    }
+  }
+  for (const project of beforeProjects) {
+    if (!after.has(project.path)) removed.push(project);
+  }
+  return { added, changed, removed };
+}
+
+export function mutationPreview(workspace, operation, beforeConfig, afterConfig) {
+  const diff = projectDiff(beforeConfig.projects, afterConfig.projects);
+  const preview = {
+    schemaVersion: 1,
+    operation,
+    beforeConfigHash: configHash(beforeConfig),
+    afterConfigHash: configHash(afterConfig),
+    beforeProjectSetHash: projectSetHash(beforeConfig.projects),
+    afterProjectSetHash: projectSetHash(afterConfig.projects),
+    beforeCount: beforeConfig.projects.length,
+    afterCount: afterConfig.projects.length,
+    diff,
+    projects: afterConfig.projects,
+  };
+  return {
+    ...preview,
+    planHash: semanticHash({
+      schemaVersion: 1,
+      workspace,
+      operation,
+      beforeConfigHash: preview.beforeConfigHash,
+      afterConfigHash: preview.afterConfigHash,
+      diff,
+    }, "taskchef-mutation-plan-v1"),
+  };
+}
+
+function exactStringSet(actual, expected) {
+  if (!Array.isArray(actual) || new Set(actual).size !== actual.length) return false;
+  return actual.length === expected.length
+    && [...actual].sort().every((value, index) => value === [...expected].sort()[index]);
+}
+
+export function assertMutationAuthorization(preview, authorization = {}, {
+  destructive = preview.diff.removed.length > 0,
+  replacement = false,
+} = {}) {
+  if (authorization.expectConfigHash !== preview.beforeConfigHash) {
+    throw taskChefError("STALE_PREVIEW", "configuration changed or --expect-config-hash is missing", preview);
+  }
+  if (!destructive && !replacement) return;
+  const removedNames = preview.diff.removed.map((project) => project.name);
+  if (authorization.expectProjectCount !== preview.beforeCount
+    || authorization.expectAfterCount !== preview.afterCount
+    || authorization.confirmPlan !== preview.planHash
+    || !exactStringSet(authorization.confirmRemoved, removedNames)) {
+    throw taskChefError(
+      "CONFIRMATION_REQUIRED",
+      "destructive project mutation requires exact preview-bound count, hash, plan, and removed-name confirmation",
+      preview,
+    );
+  }
+  const collapses = preview.beforeCount > 0
+    && (preview.afterCount === 0 || preview.afterCount / preview.beforeCount <= 0.5);
+  if (collapses && authorization.confirmCountCollapse !== `${preview.beforeCount}:${preview.afterCount}`) {
+    throw taskChefError("CONFIRMATION_REQUIRED", "project-count collapse requires exact before:after confirmation", preview);
+  }
+}