alissa-tools-github-devloop 0.8.60__tar.gz → 0.8.62__tar.gz

{alissa_tools_github_devloop-0.8.60/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.60
+Version: 0.8.62
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62}/src/main/alissa/tools/github/devloop/alissa.py

@@ -267,6 +267,16 @@ class Alissa:
             )
         return [entry for entry in data if isinstance(entry, dict)]
 
+    def list_queues(self) -> "object":
+        """`alissa tmux queue ls --json`, parsed, or None when the CLI does
+        not answer (`parking.queued_items` reads None as unknown, never
+        empty). Read by the self-upgrade idle check only."""
+        try:
+            return json.loads(run(["alissa", "tmux", "queue", "ls", "--json"], timeout=60))
+        except (CommandError, OSError, ValueError) as exc:
+            log.debug("could not list the alissa tmux queue (%s)", exc)
+            return None
+
     def tail_session(self, name: str, lines: int = 20) -> str:
         """The last `lines` of ONE managed session's terminal, or "" when the
         CLI cannot answer.

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62}/src/main/alissa/tools/github/devloop/fleet_vitals.py

@@ -58,6 +58,15 @@ it; the console's out-of-pass push leaves it out (that process never
 resolves the feed authority nor refreshes the allowlist, so its answer would
 be a different one). A Studio whose strict schema predates the block gets
 the `idle` treatment: resent without it, offered again after BLOCK_REPROBE_S.
+
+Fleet auto-upgrade (issue #206, Studio AU-1) makes the ANSWER matter: every
+answer carries an `upgrade` block (`self_upgrade.parse_upgrade`; absent on an
+older Studio). The pusher keeps the last one read (`FleetVitalsPusher.upgrade`)
+and hands each answer to the daemon's `SelfUpgrader`, which drains and
+upgrades on it. The request side gains `upgradeFailed: {version, reason}`,
+the seat's report that a version would not start and was rolled back: sent
+once, on the next snapshot after the rollback, and treated like the other
+optional blocks by a Studio that refuses it.
 """
 
 from __future__ import annotations
@@ -71,6 +80,7 @@ from datetime import datetime, timezone
 from typing import Callable, Mapping, Sequence
 
 from . import parking
+from . import self_upgrade as self_upgrade_mod
 from .alissa_client import AlissaAuthError, AlissaClient, AlissaError
 from .config import REPOS_BOWS, Config
 from .version import version as running_version
@@ -102,7 +112,7 @@ FAILED = "failed"
 # The blocks Studio's schema gained after the base contract, each in its own
 # lane: `idle` (seat parking L3) and `config` (provisioner L5). A strict 400
 # naming one of them is an old Studio, not a bad snapshot.
-OPTIONAL_BLOCKS = ("idle", "config")
+OPTIONAL_BLOCKS = ("idle", "config", "upgradeFailed")
 
 # How long a snapshot leaves an optional block out after Studio refused it as
 # an unknown key, before it offers the block again. An hour: one extra POST
@@ -450,6 +460,7 @@ class FleetVitalsPusher:
         memory_reader: "Callable[[], Mapping | None]" = sysinfo.memory_usage,
         clock: "Callable[[], float]" = time.time,
         config_reader: "Callable[[], Mapping | None] | None" = None,
+        upgrader: "self_upgrade_mod.SelfUpgrader | None" = None,
     ):
         self.config = config
         self.client = client
@@ -466,6 +477,12 @@ class FleetVitalsPusher:
         # as an unknown key). Absent = offer it.
         self._refused_until: "dict[str, float]" = {}
         self.last: "dict | None" = None
+        # The daemon's self-upgrade state (issue #206), or None -- the
+        # console's pusher -- to read the answer and act on nothing.
+        self.upgrader = upgrader
+        # The last `upgrade` block a vitals answer carried (issue #206), kept
+        # across answers that lack one.
+        self.upgrade: "self_upgrade_mod.UpgradeAnswer | None" = None
 
     def push_pass(self, roster: "Sequence[Mapping] | None") -> str:
         """Build this pass's snapshot and POST it once. Returns PUSHED or
@@ -514,12 +531,43 @@ class FleetVitalsPusher:
                 "pushed this pass; the next pass builds a fresh one", exc,
             )
             return FAILED
+        report = self._upgrade_report()
+        if report is not None:
+            snapshot["upgradeFailed"] = report
         for key, until in self._refused_until.items():
             if now < until:
                 snapshot.pop(key, None)
         self.last = snapshot
         return self._post(snapshot)
 
+    def _upgrade_report(self) -> "dict | None":
+        """The `upgradeFailed` report owed to Studio, or None. A reader that
+        fails costs the report this pass, never the snapshot."""
+        if self.upgrader is None:
+            return None
+        try:
+            return self.upgrader.report()
+        except Exception as exc:
+            log.warning("fleet vitals: could not read the upgrade report (%s)", exc)
+            return None
+
+    def _answered(self, answer: object, snapshot: "Mapping") -> None:
+        """Read one successful answer: keep its `upgrade` block and hand it
+        to the upgrader, then mark a carried `upgradeFailed` delivered.
+        Never raises: the push already succeeded."""
+        try:
+            parsed = self_upgrade_mod.parse_upgrade(answer)
+            if parsed is not None:
+                self.upgrade = parsed
+            if self.upgrader is None:
+                return
+            self.upgrader.observe(answer)
+            sent = snapshot.get("upgradeFailed")
+            if isinstance(sent, Mapping):
+                self.upgrader.reported(sent)
+        except Exception as exc:
+            log.warning("fleet vitals: could not read the upgrade answer (%s)", exc)
+
     @staticmethod
     def _refused_blocks(exc: AlissaError, snapshot: "Mapping") -> "list[str]":
         """The optional blocks of `snapshot` a 400 names: a Studio whose
@@ -536,7 +584,7 @@ class FleetVitalsPusher:
 
     def _post(self, snapshot: "dict") -> str:
         try:
-            self.client.post_fleet_vitals(snapshot)
+            answer = self.client.post_fleet_vitals(snapshot)
         except AlissaAuthError as exc:
             if exc.code == NOT_ACTIVATED:
                 self._warn_not_activated(exc)
@@ -561,6 +609,7 @@ class FleetVitalsPusher:
                 return self._post(trimmed)
             self._warn_failed(exc)
             return FAILED
+        self._answered(answer, snapshot)
         sessions = snapshot.get("sessions") or {}
         log.debug(
             "fleet vitals: pushed (%s live / %s managed session(s), %d inbox "

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62}/src/main/alissa/tools/github/devloop/loop.py

@@ -470,6 +470,7 @@ from . import loop_events as loop_events_mod
 from . import parking as parking_mod
 from . import proc as proc_mod
 from . import prompts as prompts_mod
+from . import self_upgrade as self_upgrade_mod
 from .alissa import MANAGED_PREFIX, SHELL_COMMANDS, Alissa
 from .alissa_client import AlissaClient
 from .bows import BowRepoSource
@@ -513,6 +514,7 @@ from .ghclient import (
 )
 from .proc import CommandError, run
 from .state import State
+from .version import version as running_version
 
 log = logging.getLogger(__name__)
 
@@ -2274,7 +2276,9 @@ ESCALATION_LIVE_STALLED = "live-stalled"
 # assignment. Once-ever like ESCALATION_ASSIGNMENT -- the remedy (unassign,
 # or leave it to whoever is working it by hand) does not change per poll.
 # ASSIGNED_OUTSIDE_SEEN is the episode's durable first-seen clock, kept in the
-# activity_log ledger so a daemon restart does not restart the wait.
+# activity_log ledger so a daemon restart does not restart the wait, and
+# dropped by the first issue pass that no longer reaches the skip (issue
+# #204), so the next episode on the same issue starts a clock of its own.
 ESCALATION_ASSIGNED_OUTSIDE = "assigned-outside"
 ASSIGNED_OUTSIDE_SEEN = "assigned-outside-seen"
 
@@ -4623,6 +4627,7 @@ class DevWatcher:
         repo_source: "BowRepoSource | None" = None,
         loop_events: "loop_events_mod.LoopEventEmitter | None" = None,
         fleet_vitals: "fleet_vitals_mod.FleetVitalsPusher | None" = None,
+        self_upgrade: "self_upgrade_mod.SelfUpgrader | None" = None,
     ):
         self.config = config
         self.github = github or GitHub(config.developer_login)
@@ -4672,14 +4677,23 @@ class DevWatcher:
         # fleet_vitals_enabled is off -- the loop-events shape exactly: no
         # client built, no request ever made, same endpoint and token,
         # injectable so a test never opens a socket.
+        # Fleet auto-upgrade (issue #206): the drain and self-upgrade state,
+        # fed by the vitals answer. Built always (it reads nothing until an
+        # answer arrives, so a seat without vitals never drains on it).
+        self.self_upgrade = self_upgrade or self_upgrade_mod.SelfUpgrader(
+            running_version.value, dry_run=config.dry_run,
+        )
         self.fleet_vitals = fleet_vitals or (
             fleet_vitals_mod.FleetVitalsPusher(
                 config, AlissaClient(base=config.alissa_endpoint),
                 config_reader=self._vitals_config,
+                upgrader=self.self_upgrade,
             )
             if config.fleet_vitals_enabled
             else None
         )
+        if self.fleet_vitals is not None and getattr(self.fleet_vitals, "upgrader", None) is None:
+            self.fleet_vitals.upgrader = self.self_upgrade
         # The reaper's name-slug -> (owner, repo) index (see `_anchor_repo`),
         # rebuilt only when the allowlist itself changes rather than per
         # session per sweep.
@@ -4737,6 +4751,10 @@ class DevWatcher:
         self._shell_streaks: "dict[str, tuple[int, int]]" = {}
         # The process reaper's own clock (janitor cadence, issue #186).
         self._orphans_at: "float | None" = None
+        # The issues whose assigned-outside episode this issue pass saw
+        # still running (issue #204): `_assigned_outside` adds to it, and the
+        # end of `_poll_issues` ends every other episode's first-seen clock.
+        self._outside_seen: "set[tuple[str, int]]" = set()
 
     # -- per-issue decision ------------------------------------------------
 
@@ -4856,6 +4874,13 @@ class DevWatcher:
         if claim is not None:
             return self._claim_deferral(claim, attempts)
 
+        # What adoption put on the ledger, carried by hand for the reads below
+        # that would otherwise go back to the ledger for it: a dry run writes
+        # no row, so without these the dry pass judged the attempt cap
+        # against 0 billed attempts and liveness against no session name at
+        # all, and could SPAWN where the real pass ESCALATES (issue #204).
+        adopted = 0
+        adopted_session: "str | None" = None
         if login in issue.assignees and age is None:
             # Self-assigned but the ledger never spawned. Issue #200: when the
             # issue's own activity comment carries an EXPIRED spawn line by
@@ -4867,6 +4892,7 @@ class DevWatcher:
             orphans = self._orphaned_spawns(issue, session_name(issue, 1))
             if orphans:
                 attempts, age = self._adopt_orphaned_spawns(issue, orphans)
+                adopted, adopted_session = attempts, orphans[-1].session
             else:
                 # No spawn line at all: assigned outside this daemon (by
                 # hand, or under another workspace's ledger). Not ours to
@@ -4931,8 +4957,9 @@ class DevWatcher:
             )
             linked = [url for url, state in links if state == PR_OPEN]
             if linked:
-                row_session = self.state.newest_spawn_session(
-                    issue.full_name, number
+                row_session = (
+                    self.state.newest_spawn_session(issue.full_name, number)
+                    or adopted_session
                 )
                 liveness = self.session_liveness(row_session, roster)
                 if liveness is Liveness.ALIVE and row_session:
@@ -5067,9 +5094,11 @@ class DevWatcher:
                 # rows resolve INDETERMINATE otherwise, and since they respawn
                 # unconditionally TODAY, deferring them forever would be a
                 # regression dressed as caution.
-                live_session = self.state.newest_spawn_session(
-                    issue.full_name, number
-                ) or session_name(issue, attempts)
+                live_session = (
+                    self.state.newest_spawn_session(issue.full_name, number)
+                    or adopted_session
+                    or session_name(issue, attempts)
+                )
                 liveness = self.session_liveness(live_session, roster)
                 # Falling through means DEAD, and DEAD here is CONFIRMED (a
                 # successful listing without this name) -- so the retry below
@@ -5181,7 +5210,13 @@ class DevWatcher:
         # Billable attempts only (issue #142): an attempt refunded by a
         # usage limit never counts toward the cap; the numbering below still
         # counts it, so session names stay monotonic.
-        billed = self.state.attempt_count(issue.full_name, number, billable=True)
+        # An adopted orphan is billable by construction (its row never carries
+        # a limit stamp), and on a dry run it has no row to count: `max` lets
+        # the dry pass reach the cap decision the real one does (issue #204).
+        billed = max(
+            self.state.attempt_count(issue.full_name, number, billable=True),
+            adopted,
+        )
         if billed >= self.config.attempt_cap:
             if self.state.escalated(issue.full_name, number, ESCALATION_CAP):
                 return Decision(Action.CAPPED, "already escalated", attempts)
@@ -5290,7 +5325,23 @@ class DevWatcher:
         this spawn is between its gate and its enqueue sees the claim and
         refuses itself, so a park can never race a spawn. A ledger that
         cannot answer stands the spawn down too -- a spawn that cannot prove
-        the seat is not drained does not happen."""
+        the seat is not drained does not happen.
+
+        The fleet auto-upgrade drain (issue #206) is checked FIRST: while
+        Studio's answer says drain, or a self-hosted seat is waiting to
+        upgrade, no spawn path starts a session. The item defers like a
+        parking drain and the state change is logged once by the upgrader,
+        not once per item."""
+        hold = self.self_upgrade.hold()
+        if hold is not None:
+            detail = self.self_upgrade.hold_detail()
+            log.debug("%s: not spawning %s — %s", slug, name, detail)
+            return Decision(
+                Action.DEFERRED,
+                f"spawns held — {detail}; running sessions finish normally",
+                attempt, round=round_,
+                defer_token=loop_events_mod.DEFER_DRAINED,
+            )
         try:
             drain = self.state.claim_spawn(name)
         except sqlite3.Error as exc:
@@ -10263,8 +10314,10 @@ class DevWatcher:
         Rows are numbered 1..k in line order (the ledger has none for this
         issue), keeping the session name the line carries; numbering by the
         name's own suffix could REPLACE a row when a line is missing. Not
-        written on a dry run (no ledger write is), but the returned values
-        let the dry pass reach the same decision."""
+        written on a dry run (no ledger write is); `evaluate` carries the
+        returned count and the newest line's session name into the reads
+        that would otherwise look for these rows (the attempt cap, the
+        lane's liveness), so the dry pass reaches the same decision."""
         for attempt, orphan in enumerate(orphans, start=1):
             log.warning(
                 "%s: adopted orphaned attempt %d from activity log (`%s`, "
@@ -10294,8 +10347,15 @@ class DevWatcher:
         Not silent forever (issue #200): once the skip has persisted for
         STALLED_DEFER_MULTIPLE stale windows (clock: the episode's durable
         first-seen row) it posts ONE operator comment, recorded only after
-        it lands so a failed post retries next poll."""
+        it lands so a failed post retries next poll.
+
+        The clock is per EPISODE (issue #204): the issue pass ends it the
+        first time it does not reach this skip for the issue -- unassigned,
+        adopted, spawned, closed or unlabeled -- so a hand assignment weeks
+        later waits its own full window instead of paging on its first
+        poll. The page itself stays once-ever."""
         full_name, number = issue.full_name, issue.number
+        self._outside_seen.add((full_name, number))
         reason = (
             f"assigned to {login} outside this daemon (no spawn on the "
             f"ledger) — unassign the issue to let the loop take it"
@@ -13552,11 +13612,12 @@ class DevWatcher:
             revert_results=revert_results,
         )
         vitals = self._push_fleet_vitals(roster)
+        upgrade = self._after_pass_upgrade(roster)
         log.info(
             "poll summary: %d candidate(s) — %d spawned, %d in-flight, "
             "%d skipped, %d escalated, %d capped, %d deferred; "
             "%d worker session(s) reaped, %d foreign; %d parked on a prompt, "
-            "%d answered%s%s; vitals: %s",
+            "%d answered%s%s; vitals: %s%s",
             len(results),
             counts[Action.SPAWNED],
             counts[Action.IN_FLIGHT],
@@ -13571,9 +13632,26 @@ class DevWatcher:
             " (spawns HELD)" if sweep.hold else "",
             f"; deferred: {budget.headroom}" if budget.headroom else "",
             vitals,
+            f"; upgrade: {upgrade}" if upgrade != self_upgrade_mod.NONE else "",
         )
         return results
 
+    def _after_pass_upgrade(self, roster: SessionLiveness) -> str:
+        """The pass's self-upgrade step (issue #206), after the vitals push
+        read this pass's answer: `exit` once the seat has been idle for two
+        polls (no live worker session, no undispatched queue item) with a
+        self-hosted upgrade wanted (the request file is then
+        written and `run_forever` returns), `wait` while draining towards
+        one, `none` otherwise. Never raises."""
+        try:
+            return self.self_upgrade.after_pass(
+                roster.entries,
+                queued=lambda: parking_mod.queued_items(self.alissa.list_queues()),
+            )
+        except Exception as exc:
+            log.warning("self-upgrade: the after-pass check failed (%s)", exc)
+            return self_upgrade_mod.NONE
+
     def _push_fleet_vitals(self, roster: SessionLiveness) -> str:
         """The pass's fleet-vitals push (issue #116): one console snapshot
         to Studio, built from the pass's own roster and the ledgers the pass
@@ -13803,6 +13881,7 @@ class DevWatcher:
         )
 
         results = []
+        self._outside_seen = set()
         for owner, repo, number, assignees in _oldest_first(found):
             slug = f"{owner}/{repo}#{number}"
             # Defense in depth: the search is already repo-scoped, but nothing
@@ -13837,10 +13916,21 @@ class DevWatcher:
                     log.error("%s: %s", slug, exc)
                     # Owed: an evaluation that failed is unknown, never settled.
                     decision = Decision(Action.SKIPPED, str(exc), owed=True)
+                    # Unknown is not ended either: a transient failure must
+                    # not restart an assigned-outside wait.
+                    self._outside_seen.add((f"{owner}/{repo}", number))
 
             level = logging.INFO if decision.action != Action.SKIPPED else logging.DEBUG
             log.log(level, "%s → %s (%s)", slug, decision.action.value, decision.reason)
             results.append((slug, decision))
+        # Issue #204: an assigned-outside episode lasts exactly as long as
+        # the skip keeps answering. Every first-seen clock this pass did not
+        # reach the skip for has ended; drop it, or a later hand assignment
+        # of the same issue inherits a wait that is weeks old and pages on
+        # its first poll. Not reached when the pass raised (RateLimited), and
+        # never on a dry run, which writes nothing.
+        if not self.config.dry_run:
+            self.state.prune_activity(ASSIGNED_OUTSIDE_SEEN, self._outside_seen)
         return results
 
     def _poll_prs(
@@ -13973,6 +14063,11 @@ class DevWatcher:
                 try:
                     self.poll_once()
                     backoff = self.config.poll_interval
+                    if self.self_upgrade.exit_requested:
+                        # Issue #206: exit 0 so the container restarts and
+                        # the entrypoint installs the target at boot.
+                        log.info("stopping for the self-upgrade")
+                        return
                 except RateLimited as exc:
                     backoff = min(backoff * 2, 900)
                     log.warning("rate limited (%s) — backing off %ds", exc, backoff)

alissa_tools_github_devloop-0.8.62/src/main/alissa/tools/github/devloop/self_upgrade.py

@@ -0,0 +1,622 @@
+"""Self-upgrade -- the devloop half of fleet auto-upgrade (MDF M6, AU-4,
+issue #206; Studio's contract: studio.alissa.app docs/design/
+fleet-auto-upgrade.md, AU-1).
+
+Every ``POST /v1/loop/fleet-vitals`` answer carries an ``upgrade`` block::
+
+    {"mode": "managed" | "self_hosted",
+     "target": {"version", "digest"} | null,
+     "autoUpgrade": bool, "paused": bool, "drain": bool}
+
+This module reads it and acts on it in four steps:
+
+1. **Read.** `parse_upgrade` turns the answer into an `UpgradeAnswer`, or
+   None when the block is absent or malformed (an older Studio). The
+   `SelfUpgrader` keeps the last good answer in memory. An answer without
+   the block leaves the last one in place.
+2. **Drain.** `SelfUpgrader.hold` names why no new worker session may start:
+   ``drain`` is true (either mode), or a self-hosted seat has a target to
+   move to. A seat has a target to move to when `autoUpgrade` is on, the
+   pause switch is off, `target.version` is strictly newer than the running
+   version (numeric ``X.Y.Z``; an older or equal pin, or a version that does
+   not parse, is never a target), and that version is not in the skip list. Running sessions are never
+   touched. One INFO line per change of state, not per poll.
+3. **Exit at idle.** Self-hosted only (a managed seat is swapped by the
+   backend, AU-2). After two consecutive polls with no live
+   ``ali-(develop|fix|maintain|revert)-`` session and no undispatched item
+   in the alissa tmux queue, `after_pass` writes the
+   request file (`REQUEST_FILE` under `upgrade_dir()`) and asks the daemon
+   to exit with code 0. The container's restart policy brings it back, and
+   the entrypoint installs the target at boot.
+4. **Confirm.** The first vitals POST answered on the new version marks the
+   request confirmed. The entrypoint rolls back an unconfirmed upgrade. It
+   reinstalls `previous`, adds the target to the file's skip list and leaves
+   an ``upgradeFailed`` report. `report` hands that report to the next
+   snapshot, and `reported` marks it sent once a POST carrying it succeeds.
+5. **Unserved.** A process that finds an unconfirmed request for a target
+   it does not run, written by this same version (``previous``), knows its
+   predecessor's exit produced no upgrade: the boot step never ran (a
+   non-container or non-root start, a boot block that failed before its
+   first write) or installed somewhere the daemon does not import from.
+   It skips the target and reports it, so the seat never loops drain →
+   exit → restart.
+
+Never while paused, never in managed mode, never with a live session: those
+three are checked here, at the moment of the exit, not only when the hold
+starts.
+
+The request file is shared with ``docker/claude/entrypoint.sh`` (the
+`self_upgrade_boot` block). Both sides keep every key they do not own, so
+neither can drop the other's state. Its keys:
+
+* ``target`` -- ``{"version", "digest"}``, written by the daemon.
+* ``previous`` -- the version the daemon ran when it asked.
+* ``requestedAt`` -- ISO-8601 UTC.
+* ``confirmed`` / ``confirmedAt`` -- written by the daemon after the first
+  answered poll on the target.
+* ``boots`` / ``firstBootAt`` / ``firstBootTs`` / ``lastError`` -- the
+  entrypoint's attempt record for this target. ``firstBootTs`` is the epoch
+  seconds its 10-minute window reads; ``firstBootAt`` the same as ISO-8601.
+* ``rollbackReason`` -- why the entrypoint rolled back, kept across the
+  retries of a ``rollback_failed`` reinstall.
+* ``state`` -- ``requested`` (daemon), then ``installed``,
+  ``install_failed``, ``rollback_failed`` (retried at the next boot),
+  ``rolled_back`` or ``not_newer`` (a target not newer than the installed
+  version, never installed) (entrypoint), then ``confirmed`` or
+  ``unserved`` (daemon). A ``not_newer`` request this version wrote is
+  unserved too: the daemon runs an older copy than the boot step sees.
+* ``skip`` -- versions never to move to again. A newer target clears it.
+* ``upgradeFailed`` -- ``{"version", "reason"}``, the report owed to Studio.
+  ``upgradeFailedReported`` is set once a POST carried it.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import tempfile
+import time
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Callable, Mapping, Sequence
+
+from . import parking
+
+log = logging.getLogger(__name__)
+
+SEAT = "devloop"
+MANAGED = "managed"
+SELF_HOSTED = "self_hosted"
+MODES = (MANAGED, SELF_HOSTED)
+
+# The shared request file. The directory follows ALISSA_UPGRADE_DIR so a
+# test or a non-container run can point it elsewhere. The entrypoint reads
+# the same variable.
+UPGRADE_DIR_ENV = "ALISSA_UPGRADE_DIR"
+DEFAULT_UPGRADE_DIR = "/workspace/.alissa-upgrade"
+REQUEST_FILE = f"{SEAT}.json"
+
+# How many consecutive polls with no live worker session count as idle.
+IDLE_POLLS = 2
+
+# The worker sessions that make a seat busy, by their bare (un-prefixed)
+# name: the four edges' sessions.
+WORKER_SESSION = re.compile(r"^(?:develop|fix|maintain|revert)-")
+
+# The hold reasons `hold` returns, and the poll summary quotes.
+HOLD_DRAIN = "drain"
+HOLD_UPGRADE = "upgrade"
+
+# The request states in which an upgrade is still on its way: the only ones
+# the daemon confirms or calls unserved. Every other state is final, or a
+# failure the entrypoint owns.
+PENDING_STATES = ("requested", "installed")
+
+# The states in which a request this version wrote left the seat where it
+# was: still pending, or refused at boot as not newer than the installed
+# version (the daemon imports an older copy than the root pass sees). Any
+# of them on a later process means the exit did not move the seat.
+UNSERVED_STATES = PENDING_STATES + ("not_newer",)
+
+# `after_pass` outcomes.
+EXIT = "exit"
+WAIT = "wait"
+NONE = "none"
+
+
+def upgrade_dir(environ: "Mapping[str, str] | None" = None) -> str:
+    env = os.environ if environ is None else environ
+    return (env.get(UPGRADE_DIR_ENV) or "").strip() or DEFAULT_UPGRADE_DIR
+
+
+def iso(ts: float) -> str:
+    return datetime.fromtimestamp(int(ts), tz=timezone.utc).strftime(
+        "%Y-%m-%dT%H:%M:%SZ"
+    )
+
+
+def version_key(version: str) -> "tuple[int, ...] | None":
+    """`X.Y.Z` as a comparable tuple, or None for anything else."""
+    parts = str(version).strip().split(".")
+    if len(parts) != 3 or not all(p.isdigit() for p in parts):
+        return None
+    return tuple(int(p) for p in parts)
+
+
+@dataclass(frozen=True)
+class UpgradeAnswer:
+    """One vitals answer's ``upgrade`` block."""
+
+    mode: str
+    target_version: "str | None"
+    target_digest: "str | None"
+    auto_upgrade: bool
+    paused: bool
+    drain: bool
+
+    @property
+    def target(self) -> "dict | None":
+        if self.target_version is None:
+            return None
+        return {"version": self.target_version, "digest": self.target_digest}
+
+
+def parse_upgrade(payload: object) -> "UpgradeAnswer | None":
+    """The ``upgrade`` block of a vitals answer, or None.
+
+    None when the answer is not an object or carries no ``upgrade`` (a Studio
+    older than AU-1), or when the block is not one this daemon can act on
+    (an unknown `mode`, a non-boolean flag). A malformed block is never read
+    as a partial one: a guessed `paused: false` would let a seat upgrade
+    through the operator's switch. A `target` without a string version is
+    read as no target."""
+    if not isinstance(payload, Mapping):
+        return None
+    block = payload.get("upgrade")
+    if not isinstance(block, Mapping):
+        return None
+    mode = block.get("mode")
+    flags = [block.get(k) for k in ("autoUpgrade", "paused", "drain")]
+    if mode not in MODES or not all(isinstance(f, bool) for f in flags):
+        return None
+    version = digest = None
+    target = block.get("target")
+    if isinstance(target, Mapping):
+        raw = target.get("version")
+        if isinstance(raw, str) and raw.strip():
+            version = raw.strip()
+            raw_digest = target.get("digest")
+            digest = raw_digest if isinstance(raw_digest, str) else None
+    auto_upgrade, paused, drain = flags
+    return UpgradeAnswer(
+        mode=str(mode), target_version=version, target_digest=digest,
+        auto_upgrade=bool(auto_upgrade), paused=bool(paused), drain=bool(drain),
+    )
+
+
+def live_worker_sessions(roster: "Sequence[Mapping] | None") -> "list[str] | None":
+    """The live worker sessions in an ``alissa tmux ls`` listing, or None
+    when the listing failed (unknown is never idle). Live follows the
+    fleet-vitals rule (`parking.roster_counts`): the row's `live` flag, else
+    `status != "gone"`."""
+    if roster is None:
+        return None
+    names: "list[str]" = []
+    for row in roster:
+        if not isinstance(row, Mapping):
+            continue
+        if not bool(row.get("live", row.get("status") != "gone")):
+            continue
+        for key in ("name", "session"):
+            bare = parking.bare_session(row.get(key))
+            if WORKER_SESSION.match(bare):
+                names.append(bare)
+                break
+    return names
+
+
+# -- the request file ---------------------------------------------------------
+
+
+def read_request(path: str) -> "dict | None":
+    """The request file, or None when it is absent. An unreadable or
+    non-object file is None too, with a WARNING: the daemon must not crash
+    on a file the entrypoint half-wrote."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            data = json.load(fh)
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as exc:
+        log.warning("self-upgrade: could not read %s (%s) — ignoring it", path, exc)
+        return None
+    if not isinstance(data, dict):
+        log.warning("self-upgrade: %s is not a JSON object — ignoring it", path)
+        return None
+    return data
+
+
+def write_request(path: str, data: "Mapping") -> None:
+    """Write the request file atomically (a temp file in the same directory,
+    then a rename), so the entrypoint never reads half a file. Raises
+    OSError."""
+    directory = os.path.dirname(path) or "."
+    os.makedirs(directory, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(prefix=".devloop-", suffix=".json", dir=directory)
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            json.dump(dict(data), fh, indent=2, sort_keys=True)
+            fh.write("\n")
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
+def _target_version(data: "Mapping") -> "str | None":
+    target = data.get("target")
+    version = target.get("version") if isinstance(target, Mapping) else None
+    return version if isinstance(version, str) else None
+
+
+def _count(queued: "Callable[[], int | None]") -> "int | None":
+    """`queued()`, with a failure read as unknown (never idle)."""
+    try:
+        return queued()
+    except Exception as exc:
+        log.warning("self-upgrade: could not count the alissa queue (%s)", exc)
+        return None
+
+
+def skip_list(data: "Mapping | None") -> "list[str]":
+    if not data:
+        return []
+    skip = data.get("skip")
+    if not isinstance(skip, list):
+        return []
+    return [str(v) for v in skip if isinstance(v, str)]
+
+
+# -- the upgrader -------------------------------------------------------------
+
+
+class SelfUpgrader:
+    """The daemon's self-upgrade state: the last answer, the hold, the idle
+    streak and the request file.
+
+    Every method is best-effort and never raises. The daemon's job is
+    spawning sessions, and an upgrade that cannot be done must leave the
+    seat running."""
+
+    def __init__(
+        self,
+        running: str,
+        *,
+        directory: "str | None" = None,
+        clock: "Callable[[], float]" = time.time,
+        dry_run: bool = False,
+    ):
+        self.running = running
+        self.path = os.path.join(directory or upgrade_dir(), REQUEST_FILE)
+        self._clock = clock
+        self.dry_run = dry_run
+        self.answer: "UpgradeAnswer | None" = None
+        self._hold: "str | None" = None
+        self._idle_polls = 0
+        # Targets this process could not request (the file would not
+        # write): never held for again in this process, or the seat would
+        # drain for ever without ever exiting.
+        self._unwritable: "set[str]" = set()
+        self.exit_requested = False
+
+    # -- reading the answer --
+
+    def observe(self, payload: object) -> "UpgradeAnswer | None":
+        """Read one vitals answer. Keeps the last good block (an answer
+        without one changes nothing), confirms a pending upgrade the first
+        time an answer arrives on the target version, and clears the skip
+        list when a newer target arrives. Returns the block read, or None."""
+        answer = parse_upgrade(payload)
+        if answer is None:
+            if payload is not None:
+                log.debug("self-upgrade: the vitals answer carries no upgrade block")
+            return None
+        self.answer = answer
+        try:
+            self._confirm()
+            self._unserved()
+            self._clear_skip(answer)
+        except OSError as exc:
+            log.warning("self-upgrade: could not update %s (%s)", self.path, exc)
+        self._update_hold()
+        return answer
+
+    def _confirm(self) -> None:
+        data = read_request(self.path)
+        if not data or data.get("confirmed"):
+            return
+        if data.get("state") not in PENDING_STATES:
+            # A failed or rolled-back target is never confirmed, even when
+            # a rollback that could not reinstall left the daemon on it.
+            return
+        version = _target_version(data)
+        if version != self.running or version in skip_list(data):
+            return
+        data["confirmed"] = True
+        data["confirmedAt"] = iso(self._clock())
+        data["state"] = "confirmed"
+        write_request(self.path, data)
+        log.info(
+            "self-upgrade: confirmed — this daemon runs %s and Studio answered "
+            "its first poll (upgraded from %s)", self.running,
+            data.get("previous") or "unknown",
+        )
+
+    def _unserved(self) -> None:
+        """Skip and report a target whose last request never moved this
+        seat: the file still holds an unconfirmed, pending request that
+        THIS version wrote (`previous == running`) for another version,
+        or a request of this version's that the boot step refused as
+        `not_newer`. Asking again would only repeat the drain, the exit and
+        the restart for ever. A file that cannot be written puts the target out of
+        reach for this process instead."""
+        data = read_request(self.path)
+        if not data or data.get("confirmed"):
+            return
+        state = data.get("state")
+        version = _target_version(data)
+        if state not in UNSERVED_STATES or not version or version == self.running:
+            return
+        if data.get("previous") != self.running:
+            return
+        skip = skip_list(data)
+        if version in skip:
+            return
+        if state == "requested":
+            reason = "the boot step never acted on the request (no install was tried)"
+        elif state == "not_newer":
+            reason = (
+                "the boot step refused it: not newer than the installed "
+                f"version, but the daemon still runs {self.running}"
+            )
+        else:
+            reason = f"installed at boot, but the daemon still runs {self.running}"
+        data.update({
+            "state": "unserved", "skip": skip + [version], "lastError": reason,
+            "upgradeFailed": {"version": version, "reason": reason},
+            "upgradeFailedReported": False,
+        })
+        try:
+            write_request(self.path, data)
+        except OSError as exc:
+            self._unwritable.add(version)
+            log.warning(
+                "self-upgrade: the request for %s was never served (%s) and "
+                "%s could not be updated (%s) — this process will not try %s "
+                "again", version, reason, self.path, exc, version,
+            )
+            return
+        log.warning(
+            "self-upgrade: the request for %s → %s was never served: %s — "
+            "%s is now on the skip list and reported to Studio; this seat "
+            "keeps running %s", self.running, version, reason, version,
+            self.running,
+        )
+
+    def _clear_skip(self, answer: UpgradeAnswer) -> None:
+        version = answer.target_version
+        new = version_key(version or "")
+        if new is None:
+            return
+        data = read_request(self.path)
+        skip = skip_list(data)
+        if not skip or version in skip:
+            return
+        keys = [k for k in (version_key(v) for v in skip) if k is not None]
+        if keys and new <= max(keys):
+            return
+        assert data is not None
+        data["skip"] = []
+        write_request(self.path, data)
+        log.info(
+            "self-upgrade: target %s is newer than every skipped version "
+            "(%s) — skip list cleared", version, ", ".join(skip),
+        )
+
+    # -- the hold --
+
+    def _skipped(self, version: str) -> bool:
+        return version in skip_list(read_request(self.path))
+
+    def wanted(self) -> "str | None":
+        """The version a self-hosted seat should move to now, or None."""
+        a = self.answer
+        if a is None or a.mode != SELF_HOSTED:
+            return None
+        if not a.auto_upgrade or a.paused:
+            return None
+        version = a.target_version
+        if not version:
+            return None
+        # Only a strictly newer target. A pin briefly older than what runs
+        # (a merge rolls the seat before the platform pin moves) must never
+        # drain and downgrade the seat. Unparseable on either side: never.
+        new, cur = version_key(version), version_key(self.running)
+        if new is None or cur is None or new <= cur:
+            return None
+        if version in self._unwritable or self._skipped(version):
+            return None
+        return version
+
+    def hold(self) -> "str | None":
+        """Why no new worker session may start now (`HOLD_DRAIN`,
+        `HOLD_UPGRADE`), or None. Read by every spawn path."""
+        return self._hold
+
+    def hold_detail(self) -> str:
+        """The hold in words, for a deferral's reason."""
+        if self._hold == HOLD_DRAIN:
+            return "Studio asked this seat to drain for a managed upgrade"
+        if self._hold == HOLD_UPGRADE:
+            return (
+                f"draining to self-upgrade {self.running} → "
+                f"{self.answer.target_version if self.answer else '?'}"
+            )
+        return ""
+
+    def _update_hold(self) -> None:
+        if self.answer is not None and self.answer.drain:
+            new = HOLD_DRAIN
+        elif self.wanted() is not None:
+            new = HOLD_UPGRADE
+        else:
+            new = None
+        if new == self._hold:
+            return
+        old, self._hold = self._hold, new
+        if new is None:
+            self._idle_polls = 0
+            log.info(
+                "self-upgrade: drain lifted (was: %s) — new worker sessions may "
+                "start again", old,
+            )
+        else:
+            log.info(
+                "self-upgrade: draining — %s; no new worker session starts, "
+                "running ones finish normally", self.hold_detail(),
+            )
+
+    # -- the exit --
+
+    def after_pass(
+        self,
+        roster: "Sequence[Mapping] | None",
+        queued: "Callable[[], int | None] | None" = None,
+    ) -> str:
+        """Called once per completed pass, after the vitals push. Returns
+        EXIT when the daemon should exit now for the upgrade (the request is
+        written), WAIT while it is draining towards one, NONE otherwise.
+
+        `roster` is the pass's ``alissa tmux ls`` listing. `queued` counts
+        the undispatched items in the alissa tmux queue (None: unknown). It
+        is read only when the roster is idle: an item queued before the
+        hold came on is in neither listing yet, and a restart would kill the
+        session it dispatches to."""
+        # Re-checked here, not only at the hold's start: a skip list the
+        # entrypoint just wrote, or a target that moved, must stop the exit.
+        self._update_hold()
+        version = self.wanted()
+        if version is None or self.answer is None:
+            self._idle_polls = 0
+            return NONE
+        live = live_worker_sessions(roster)
+        if live is None or live:
+            if self._idle_polls:
+                log.info(
+                    "self-upgrade: not idle any more (%s) — idle count reset",
+                    "the session listing failed" if live is None
+                    else ", ".join(live),
+                )
+            self._idle_polls = 0
+            return WAIT
+        waiting = 0 if queued is None else _count(queued)
+        if waiting is None or waiting:
+            if self._idle_polls:
+                log.info(
+                    "self-upgrade: not idle any more (%s) — idle count reset",
+                    "the alissa queue listing failed" if waiting is None
+                    else f"{waiting} undispatched item(s) in the alissa queue",
+                )
+            self._idle_polls = 0
+            return WAIT
+        self._idle_polls += 1
+        if self._idle_polls < IDLE_POLLS:
+            log.info(
+                "self-upgrade: idle on poll %d of %d before the exit to %s",
+                self._idle_polls, IDLE_POLLS, version,
+            )
+            return WAIT
+        if self.dry_run:
+            log.info(
+                "[dry-run] self-upgrade: idle — would write %s and exit to "
+                "upgrade %s → %s", self.path, self.running, version,
+            )
+            return WAIT
+        try:
+            self._request(self.answer)
+        except OSError as exc:
+            self._unwritable.add(version)
+            log.warning(
+                "self-upgrade: could not write %s (%s) — NOT upgrading to %s; "
+                "the drain is lifted and this process will not try %s again",
+                self.path, exc, version, version,
+            )
+            self._update_hold()
+            return NONE
+        self.exit_requested = True
+        log.info(
+            "self-upgrade: idle on %d consecutive polls — wrote %s; exiting "
+            "with code 0 so the container restarts and installs %s (from %s)",
+            IDLE_POLLS, self.path, version, self.running,
+        )
+        return EXIT
+
+    def _request(self, answer: UpgradeAnswer) -> None:
+        old = read_request(self.path) or {}
+        data: dict = {
+            "target": answer.target,
+            "previous": self.running,
+            "requestedAt": iso(self._clock()),
+            "state": "requested",
+            "confirmed": False,
+            "boots": 0,
+            "skip": skip_list(old),
+        }
+        # A report not yet delivered survives a new request.
+        if old.get("upgradeFailed") and not old.get("upgradeFailedReported"):
+            data["upgradeFailed"] = old["upgradeFailed"]
+            data["upgradeFailedReported"] = False
+        write_request(self.path, data)
+
+    # -- the failure report --
+
+    def report(self) -> "dict | None":
+        """The ``upgradeFailed`` report the next snapshot owes Studio, or
+        None. Only a well-formed `{version, reason}` is offered: the request
+        schema is strict."""
+        data = read_request(self.path)
+        if not data or data.get("upgradeFailedReported"):
+            return None
+        failed = data.get("upgradeFailed")
+        if not isinstance(failed, Mapping):
+            return None
+        version, reason = failed.get("version"), failed.get("reason")
+        if not isinstance(version, str) or not re.fullmatch(r"[A-Za-z0-9._-]{1,128}", version):
+            return None
+        reason = " ".join(str(reason or "rolled back").split())[:300] or "rolled back"
+        return {"version": version, "reason": reason}
+
+    def reported(self, sent: "Mapping") -> None:
+        """Mark the report delivered, after a POST carrying `sent`
+        succeeded."""
+        data = read_request(self.path)
+        if not data:
+            return
+        failed = data.get("upgradeFailed")
+        if not isinstance(failed, Mapping) or failed.get("version") != sent.get("version"):
+            return
+        data["upgradeFailedReported"] = True
+        try:
+            write_request(self.path, data)
+        except OSError as exc:
+            log.warning("self-upgrade: could not update %s (%s)", self.path, exc)
+            return
+        log.info(
+            "self-upgrade: reported to Studio that %s would not start "
+            "(rolled back to %s)", sent.get("version"), self.running,
+        )

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62}/src/main/alissa/tools/github/devloop/state.py

@@ -1289,6 +1289,54 @@ class State:
                 f"record_activity({repo_slug}#{number}, {kind})", write),
         )
 
+    def prune_activity(
+        self, kind: str, keep: "set[tuple[str, int]]"
+    ) -> int:
+        """Drop every activity_log row of exactly this KIND whose
+        (repo_slug, number) is not in `keep`. Returns how many rows were
+        dropped (0 when the store refused the write).
+
+        For a kind whose row is an EPISODE's first-seen clock rather than a
+        posted line's dedupe (issue #204: `assigned-outside-seen`): the
+        caller passes the subjects whose episode it saw still running this
+        pass, and every other clock of the kind ends, so a later episode on
+        the same item starts its own wait instead of inheriting this one's.
+
+        BEST-EFFORT with the SELECT inside the closure, and a pass with
+        nothing to drop reports `False`, for the reasons `prune_escalations`
+        gives. A held (unwritten) row of the kind is released alongside."""
+        dropped: "list[tuple[str, int]]" = []
+
+        def write() -> "bool | None":
+            del dropped[:]
+            rows = self._db.execute(
+                "SELECT repo_slug, number FROM activity_log WHERE kind=?",
+                (kind,),
+            ).fetchall()
+            dropped.extend(
+                (row["repo_slug"], int(row["number"])) for row in rows
+                if (row["repo_slug"], int(row["number"])) not in keep
+            )
+            if not dropped:
+                return False
+            for repo_slug, number in dropped:
+                self._db.execute(
+                    "DELETE FROM activity_log WHERE repo_slug=? AND number=? "
+                    "AND kind=?",
+                    (repo_slug, number, kind),
+                )
+            self._db.commit()
+            return True
+
+        wrote = self._best_effort(f"prune_activity({kind})", write)
+        for key in [
+            key for key in self._pending_gates
+            if key[0] == "activity_log" and key[3] == kind
+            and (key[1], key[2]) not in keep
+        ]:
+            self._pending_gates.pop(key, None)
+        return len(dropped) if wrote else 0
+
     # -- janitor holdouts (issue #99) ---------------------------------------
     #
     # The workspace janitor's once-per-episode memory. Every method here is

alissa_tools_github_devloop-0.8.62/src/main/alissa/tools/github/devloop/version

@@ -0,0 +1 @@
+0.8.62

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62/src/main/alissa_tools_github_devloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.60
+Version: 0.8.62
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.60 → alissa_tools_github_devloop-0.8.62}/src/main/alissa_tools_github_devloop.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ src/main/alissa/tools/github/devloop/loop_events.py
 src/main/alissa/tools/github/devloop/parking.py
 src/main/alissa/tools/github/devloop/proc.py
 src/main/alissa/tools/github/devloop/prompts.py
+src/main/alissa/tools/github/devloop/self_upgrade.py
 src/main/alissa/tools/github/devloop/state.py
 src/main/alissa/tools/github/devloop/version
 src/main/alissa/tools/github/devloop/version.py

alissa_tools_github_devloop-0.8.60/src/main/alissa/tools/github/devloop/version

@@ -1 +0,0 @@
-0.8.60