alissa-tools-github-revloop 0.31.17__tar.gz → 0.31.19__tar.gz

{alissa_tools_github_revloop-0.31.17/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.31.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.17
+Version: 0.31.19
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19}/src/main/alissa/tools/github/revloop/janitor.py

@@ -35,6 +35,12 @@ Three properties everything here is written around:
 * **Nothing raises past its own concern.** A folder that vanishes mid-sweep,
   an unreadable hub, a failed removal: logged and skipped, because this runs
   at the end of a poll pass that must complete.
+
+Two more bound it (issue #175). The layout is fixed: hubs are found at
+`<root>/<repo>` with the session cwd at `<hub>/main`, so under any other
+`hub_template` (`layout_supported` says no) the caller sweeps nothing rather
+than mis-key the hold. And one sweep removes at most `MAX_REMOVALS` folders in
+`MAX_SWEEP_SECONDS`; the rest wait for the next interval (`deferred`).
 """
 
 from __future__ import annotations
@@ -43,6 +49,7 @@ import logging
 import os
 import re
 import shutil
+import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Callable, Iterable
@@ -70,6 +77,23 @@ SOURCE_DIR = ".source"
 KIND_SCRATCH = "scratch"
 KIND_REVIEW = "review-checkout"
 
+# One sweep's bound (issue #175): at most this many removals, and no removal
+# started past this many seconds into the sweep. It runs synchronously at the
+# end of a poll pass, so a large backlog is drained over several intervals
+# instead of stalling one pass for minutes.
+MAX_REMOVALS = 25
+MAX_SWEEP_SECONDS = 120.0
+
+# The one hub layout the janitor knows: `discover_hubs` reads the root's
+# direct children and `scan_hub` reads `<hub>/main`. Named in the caller's
+# refusal WARNING.
+SUPPORTED_TEMPLATE = "{root}/{repo}/main"
+
+# What `layout_supported` probes a template with: two owners that differ, so a
+# template that puts the owner in the path resolves to two different places.
+_PROBE_OWNERS = ("janitor-probe-owner-a", "janitor-probe-owner-b")
+_PROBE_REPO = "janitor-probe-repo"
+
 Runner = Callable[..., str]
 
 
@@ -158,12 +182,34 @@ class SweepResult:
     fresh: int = 0
     failed: "list[tuple[Path, str]]" = field(default_factory=list)
     pruned: int = 0
+    # Unheld stale candidates the per-sweep bound left for the next interval.
+    deferred: int = 0
 
     @property
     def freed(self) -> int:
         return sum(size for _, size in self.removed)
 
 
+def layout_supported(
+    hub_for: "Callable[[str, str], Path]", workspace_root: "Path | str"
+) -> bool:
+    """Whether `hub_for` (`Config.hub_for`) places every hub at
+    `<root>/<repo>` with the session cwd at `<hub>/main` -- the one layout
+    `discover_hubs` and `scan_hub` read, and the one in which a hub's
+    directory name is the repo slug the `Guard` keys on.
+
+    Probed with two distinct owners and one repo name: both must resolve to
+    `workspace_root / repo / "main"`. A template that cannot be formatted is
+    unsupported. Pure: nothing is read off the disk."""
+    expected = Path(os.fspath(workspace_root)).expanduser() / _PROBE_REPO / "main"
+    try:
+        return all(
+            Path(hub_for(owner, _PROBE_REPO)) == expected for owner in _PROBE_OWNERS
+        )
+    except (KeyError, IndexError, ValueError, AttributeError, TypeError):
+        return False
+
+
 def discover_hubs(workspace_root: "Path | str") -> "list[Path]":
     """Every worktree hub directly under the workspace root: a non-symlink
     directory holding a `.source` directory. Read off the disk rather than the
@@ -323,13 +369,25 @@ def sweep(
     now: float,
     dry_run: bool = False,
     runner: Runner = run,
+    max_removals: int = MAX_REMOVALS,
+    max_seconds: float = MAX_SWEEP_SECONDS,
+    clock: "Callable[[], float]" = time.monotonic,
 ) -> SweepResult:
     """Remove every candidate under `hubs` older than `grace_seconds` that
     `guard` does not hold, then prune each hub's worktree records.
 
+    Bounded (issue #175): before each removal, a sweep that has already
+    removed `max_removals` folders, or has run `max_seconds` by `clock`,
+    stops removing. Every unheld stale candidate past that point is counted
+    in `deferred` and left for the next interval; every hub is still scanned
+    and pruned.
+
     Dry-run removes nothing and prunes nothing: it logs each folder it WOULD
-    remove (with its size) and reports them in `would_remove`."""
+    remove (with its size) and reports them in `would_remove`, under the
+    same bound -- so it reports what one live sweep would do."""
     result = SweepResult()
+    started = clock()
+    bounded = False
     for hub in hubs:
         result.hubs += 1
         for candidate in scan_hub(hub):
@@ -344,6 +402,12 @@ def sweep(
                 log.debug("janitor: keeping %s — %s", candidate.path, why)
                 result.held.append((candidate.path, why))
                 continue
+            if not bounded:
+                taken = len(result.would_remove if dry_run else result.removed)
+                bounded = taken >= max_removals or clock() - started >= max_seconds
+            if bounded:
+                result.deferred += 1
+                continue
             if not _contained(candidate):
                 result.failed.append((candidate.path, "not contained in its hub"))
                 continue

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19}/src/main/alissa/tools/github/revloop/loop.py

@@ -2619,6 +2619,9 @@ class ReviewWatcher:
         # When the workspace janitor last swept (monotonic), or None before the
         # first sweep -- which therefore runs at the end of the first pass.
         self._janitor_last: "float | None" = None
+        # Whether the janitor has said, once for this process, that it will
+        # not sweep under this `hub_template` (issue #175).
+        self._janitor_layout_warned = False
         # The (repo, number, round) whose alive session the stale-round probe
         # just killed as `wedged:first-run-dialog` (issue #136), so the
         # respawn site logs its re-enqueue at INFO instead of a second
@@ -6302,20 +6305,49 @@ class ReviewWatcher:
         #157): claim the spawn of this round's session against the drain
         flag, run `spawn` under the claim, and drop the claim however it ends.
 
-        The gate sits ABOVE every side effect of the spawn -- the hub add,
-        the `alissa tmux queue add`, the census bump, the ledger row, the
-        activity line -- so a drained seat touches nothing, and the round
-        stays owed: a QUEUED `drained` decision writes no spawn row, burns no
-        round number and spends no attempt, exactly like the slot gate. The
-        claim and the flag are read and written in one immediate transaction
-        on each side (`State.claim_spawn` / `State.set_drain`): a drain that
+        The gate sits ABOVE every side effect of the spawn but one -- the
+        `alissa tmux queue add`, the census bump, the ledger row and the
+        activity line all come after it -- and a round it stands down stays
+        owed: a QUEUED `drained` decision writes no spawn row, burns no round
+        number and spends no attempt, exactly like the slot gate. The claim
+        and the flag are read and written in one immediate transaction on
+        each side (`State.claim_spawn` / `State.set_drain`): a drain that
         lands while this spawn is between its gate and its ledger write sees
-        the claim and refuses itself, so a park can never race a spawn. A
-        ledger that cannot answer stands the spawn down too -- a spawn that
-        cannot prove the seat is not drained does not happen.
+        the claim and refuses itself. A ledger that cannot answer stands the
+        spawn down too -- a spawn that cannot prove the seat is not drained
+        does not happen.
+
+        The claim only counts for `parking.SPAWN_CLAIM_TTL`, and the hub add
+        (`_ensure_hub`, a clone on a PR's first round) can outlast it. So
+        `_spawn_claimed` re-takes the claim (`_claim_spawn` again, issue
+        #173) between the hub add and the enqueue, which refreshes it and
+        re-reads the flag: a drain that held while the hub was provisioned
+        stands the round down there, the same QUEUED `drained` way. That late
+        re-check is the one stand-down that happens AFTER a side effect --
+        the hub is provisioned and stays -- which is harmless, because the
+        hub is a reusable cache the round's next spawn finds in place.
+        Together the two claims mean a park can never race a spawn, whatever
+        the drain's freshness rule allows.
 
         Dry-run READS the flag and claims nothing: it shares the production
         state path, and a dry pass must write no durable row."""
+        refused = self._claim_spawn(pr, round_, name)
+        if refused is not None:
+            return refused
+        try:
+            return spawn()
+        finally:
+            if not self.config.dry_run:
+                self.state.release_spawn(name)
+
+    def _claim_spawn(
+        self, pr: PullRequest, round_: int, name: str, *, late: bool = False,
+    ) -> "Decision | None":
+        """Claim (or, `late`, re-claim) the spawn of `name` against the drain
+        flag: None when the spawn may proceed, else the QUEUED `drained`
+        decision that stands the round down. Dry-run reads the flag and
+        claims nothing. See `_drain_gated`."""
+        where = " after its hub was provisioned" if late else ""
         try:
             if self.config.dry_run:
                 drain = self.state.drain()
@@ -6323,36 +6355,32 @@ class ReviewWatcher:
                 drain = self.state.claim_spawn(name)
         except sqlite3.Error as exc:
             log.warning(
-                "%s round %d: could not claim the spawn against the drain flag "
-                "(%s) — standing it down this pass", pr.slug, round_, exc,
+                "%s round %d: could not claim the spawn against the drain flag%s "
+                "(%s) — standing it down this pass", pr.slug, round_, where, exc,
             )
             return Decision(
                 Action.QUEUED,
-                f"round {round_} stood down — the state ledger could not prove "
-                f"the seat is not drained ({exc}); retrying next poll",
+                f"round {round_} stood down{where} — the state ledger could not "
+                f"prove the seat is not drained ({exc}); retrying next poll",
                 round_,
                 drained=True,
             )
-        if drain is not None:
-            since = parking_mod.iso(drain["drained_at"])
-            until = parking_mod.iso(drain["expires_at"])
-            log.info(
-                "%s round %d: not spawning — the seat is drained for parking "
-                "since %s (until %s)", pr.slug, round_, since, until,
-            )
-            return Decision(
-                Action.QUEUED,
-                f"round {round_} held — the seat is drained for parking since "
-                f"{since} (until {until}: {drain['reason'] or 'no reason given'}); "
-                f"retrying once it is undrained",
-                round_,
-                drained=True,
-            )
-        try:
-            return spawn()
-        finally:
-            if not self.config.dry_run:
-                self.state.release_spawn(name)
+        if drain is None:
+            return None
+        since = parking_mod.iso(drain["drained_at"])
+        until = parking_mod.iso(drain["expires_at"])
+        log.info(
+            "%s round %d: not spawning%s — the seat is drained for parking "
+            "since %s (until %s)", pr.slug, round_, where, since, until,
+        )
+        return Decision(
+            Action.QUEUED,
+            f"round {round_} held{where} — the seat is drained for parking since "
+            f"{since} (until {until}: {drain['reason'] or 'no reason given'}); "
+            f"retrying once it is undrained",
+            round_,
+            drained=True,
+        )
 
     def _spawn_claimed(
         self,
@@ -6427,6 +6455,14 @@ class ReviewWatcher:
             # provisioned -- unknown, never settled.
             return Decision(Action.SKIPPED, problem, round_, owed=True)
 
+        # The hub add can outlast the gate's claim (a clone on a PR's first
+        # round): re-take it, refreshing it and re-reading the drain flag, so
+        # a drain that landed meanwhile stands the round down here (issue
+        # #173). The claim is still released in `_drain_gated`'s finally.
+        refused = self._claim_spawn(pr, round_, name, late=True)
+        if refused is not None:
+            return refused
+
         self.alissa.enqueue_reviewer(
             session=name,
             directive=directive,
@@ -7913,8 +7949,9 @@ class ReviewWatcher:
         One INFO line per sweep (folders removed and bytes freed, or what a
         dry run WOULD remove), and one WARNING when the workspace volume is
         at or above `janitor_warn_pct`. The disk read runs even when the
-        roster cannot be listed and the removal half is skipped: a full
-        volume is worth saying whatever else went wrong."""
+        roster cannot be listed, or the hub layout is not the one the janitor
+        reads, and the removal half is skipped: a full volume is worth saying
+        whatever else went wrong."""
         if not self.config.janitor_enabled:
             return None
         mono = time.monotonic()
@@ -7936,6 +7973,22 @@ class ReviewWatcher:
         return result
 
     def _sweep_workspace(self, now: float) -> "janitor_mod.SweepResult | None":
+        if not janitor_mod.layout_supported(
+            self.config.hub_for, self.config.workspace_root
+        ):
+            # Fail closed (issue #175): under another layout the hubs on disk
+            # are not keyed by the slug the Guard holds (or are not found at
+            # all), so a sweep could remove a live round's folders. Nothing is
+            # removed or pruned; said once per process, not once per interval.
+            if not self._janitor_layout_warned:
+                self._janitor_layout_warned = True
+                log.warning(
+                    "janitor: hub_template %r is not supported — the janitor "
+                    "supports only %s, so it removes and prunes nothing in "
+                    "this process",
+                    self.config.hub_template, janitor_mod.SUPPORTED_TEMPLATE,
+                )
+            return None
         guard = self._janitor_guard(now)
         if guard is None:
             log.warning(
@@ -7953,17 +8006,20 @@ class ReviewWatcher:
         if self.config.dry_run:
             log.info(
                 "[dry-run] janitor: would remove %d folder(s) (%s) across %d "
-                "hub(s); %d held by a live round, %d inside the grace",
+                "hub(s); %d held by a live round, %d inside the grace, %d "
+                "deferred to the next interval",
                 len(result.would_remove),
                 janitor_mod.human(sum(size for _, size in result.would_remove)),
-                result.hubs, len(result.held), result.fresh,
+                result.hubs, len(result.held), result.fresh, result.deferred,
             )
         else:
             log.info(
                 "janitor: removed %d folder(s), freed %s across %d hub(s); "
-                "%d held by a live round, %d inside the grace, %d failed",
+                "%d held by a live round, %d inside the grace, %d failed, %d "
+                "deferred to the next interval",
                 len(result.removed), janitor_mod.human(result.freed),
                 result.hubs, len(result.held), result.fresh, len(result.failed),
+                result.deferred,
             )
         return result
 

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19}/src/main/alissa/tools/github/revloop/parking.py

@@ -26,7 +26,9 @@ handshake):
   reads every null as a refusal.
 * **The drain.** A flag with a TTL in `state.db` (`State.set_drain`), cleared
   when the daemon boots. While it holds, the round spawn stands down before
-  its first side effect (`ReviewWatcher._drain_gated`).
+  its first side effect (`ReviewWatcher._drain_gated`), or, when the drain
+  lands while the hub is provisioned, after the hub add and before the
+  enqueue (the post-hub re-claim).
 """
 
 from __future__ import annotations

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19}/src/main/alissa/tools/github/revloop/state.py

@@ -39,6 +39,8 @@ from collections.abc import Callable, Iterable
 from dataclasses import dataclass
 from pathlib import Path
 
+from .parking import SPAWN_CLAIM_TTL
+
 log = logging.getLogger(__name__)
 
 # Poll-snapshot retention: the newest N rows are kept, older ones pruned on
@@ -2067,11 +2069,12 @@ class State:
 
     def set_drain(
         self, ttl: int, reason: str, now: "float | None" = None,
-        claim_ttl: int = 600,
+        claim_ttl: int = SPAWN_CLAIM_TTL,
     ) -> "tuple[dict, list[dict]]":
         """Raise the drain flag for `ttl` seconds and return it with the spawn
-        claims standing at that instant (younger than `claim_ttl` -- an older
-        one is a spawn whose process died mid-way, cleared at the next boot).
+        claims standing at that instant (younger than `claim_ttl`, by default
+        `parking.SPAWN_CLAIM_TTL` -- an older one is a spawn whose process
+        died mid-way, cleared at the next boot).
         ONE immediate transaction, so a spawn either claimed before this (and
         is in the list) or claims after it (and sees the flag). A drain that
         is already up is replaced: a re-drain restarts the TTL. Raises

alissa_tools_github_revloop-0.31.19/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.31.19

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19}/src/main/alissa/tools/github/revloop/webui/server.py

@@ -332,7 +332,9 @@ class App:
             cleared = self.sources.clear_drain()
         except sqlite3.Error as exc:
             self._audit("undrain", {"ok": False, "error": str(exc)})
-            return 503, {"drained": True, "error": "state_unavailable"}
+            # The flag's state is unknown here, and unknown is never a value
+            # (D2): the 503 already says the undrain did not land.
+            return 503, {"drained": None, "error": "state_unavailable"}
         self._audit("undrain", {"ok": True, "cleared": cleared})
         return 200, {"drained": False, "cleared": cleared}
 

{alissa_tools_github_revloop-0.31.17 → alissa_tools_github_revloop-0.31.19/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.17
+Version: 0.31.19
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

alissa_tools_github_revloop-0.31.17/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.31.17