syncade 0.6.2__py3-none-any.whl

syncade/orchestrator/loop_resume.py

@@ -0,0 +1,91 @@
+"""Resume-state rehydration for the multi-round loop.
+
+Split out of ``loop.py`` to keep that module under the LOC gate. The
+rebound ``run_review`` calls :func:`_rehydrate_resume_state` exactly once,
+before the round loop, when resuming an aborted/interrupted run.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from syncade.config import SyncadeConfig
+from syncade.worktree import WorktreeError
+
+from .results import RoundArtifacts, RoundResult
+from .resume import ResumePlan, load_completed_round
+
+
+def _rehydrate_resume_state(
+    resume_plan: ResumePlan,
+    run_dir: Path,
+    run_id: str,
+    config: SyncadeConfig,
+) -> tuple[list[RoundResult], list[RoundArtifacts], int, bool, SyncadeConfig]:
+    """Rehydrate a resumed run's completed rounds and derive its loop bounds.
+
+    Returns ``(round_results, round_artifacts_list, resumed_round_start,
+    branch_advanced_during_run, config)``.
+
+    When resuming, pre-populate ``round_results`` with each completed
+    round's RoundResult so downstream consumers (loop-summary rendering,
+    handoff rendering, cross-round context disk reads) see a
+    consistent picture. ``branch_advanced_during_run`` is set to True if
+    ANY rehydrated round had a committed producer — that's a load-bearing
+    signal for the post-loop "your branch has been advanced" warning.
+    """
+    round_results: list[RoundResult] = []
+    round_artifacts_list: list[RoundArtifacts] = []
+    branch_advanced_during_run = False
+    for r_idx in resume_plan.completed_rounds:
+        rehydrated = load_completed_round(run_dir / f"round-{r_idx}")
+        if rehydrated is None:
+            # plan_resume admitted this round; its manifest
+            # disappearing between plan_resume and here is a
+            # caller-induced race. Surface as WorktreeError so
+            # the CLI exits 60 with a useful message.
+            raise WorktreeError(
+                f"resumed run {run_id}: completed round {r_idx} "
+                f"lost its manifest.json between plan_resume and "
+                f"orchestrator entry — race condition or operator "
+                f"interference. Cannot proceed."
+            )
+        round_results.append(rehydrated)
+        round_artifacts_list.append(rehydrated.artifacts)
+        if (
+            rehydrated.producer_result is not None
+            and rehydrated.producer_result.outcome == "committed"
+        ):
+            branch_advanced_during_run = True
+    resumed_round_start = resume_plan.resumed_round
+
+    # --- Loop-bound consistency with the resume planner ---------
+    # INVARIANT: a resume must run >= 1 round (never zero rounds +
+    # a silent exit-0 SHIP). ``plan_resume`` derives ``resumed_round``
+    # against ``effective_max_rounds = max(original_max_rounds,
+    # --max-rounds override)``, so ``resumed_round`` is always < that
+    # effective cap. But the round loop AND the terminator's "final
+    # round" check (``round_idx == config.loop.max_rounds - 1`` in
+    # ``_run_round_step``) BOTH read ``config.loop.max_rounds`` — the
+    # RAW override. When the operator resumes with ``--max-rounds N`` <=
+    # ``resumed_round`` (e.g. a 3-round run aborted at round 2 resumed
+    # with ``--max-rounds 1``), ``range(resumed_round, N)`` is empty: no
+    # round runs, ``final_exit_code`` stays SUCCESS, ``termination_reason``
+    # stays None, and ``_finalize_run`` returns a false exit-0 SHIP
+    # pointing at a rehydrated NO-SHIP round. Bump ``max_rounds`` to the
+    # SAME effective cap the planner used so both the loop bound and the
+    # terminator cover ``resumed_round`` (model_copy leaves the caller's
+    # config object untouched).
+    effective_max_rounds = max(config.loop.max_rounds, resume_plan.max_rounds)
+    if effective_max_rounds != config.loop.max_rounds:
+        config = config.model_copy(
+            update={"loop": config.loop.model_copy(update={"max_rounds": effective_max_rounds})}
+        )
+
+    return (
+        round_results,
+        round_artifacts_list,
+        resumed_round_start,
+        branch_advanced_during_run,
+        config,
+    )

syncade/orchestrator/loop_rmtree.py

@@ -0,0 +1,70 @@
+"""Guarded removal of resumed-run leftovers.
+
+Split out of :mod:`syncade.orchestrator.loop` to keep that module under the
+file-length cap. ``loop`` re-imports :func:`_safe_resume_rmtree` so
+``run_review``'s call site — and the tests that monkeypatch it on the ``loop``
+module — are unchanged. Its GC imports stay function-local for the same
+import-cycle reason documented on ``loop._autoprune_old_transcripts``.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+
+def _safe_resume_rmtree(target: Path, base: Path, repo_root: Path, *, reap: bool = False) -> None:
+    """Remove a resumed-run leftover dir, but only after proving it is a
+    real (non-symlink) directory strictly under ``base`` and not an
+    ancestor of ``repo_root``.
+
+    Mirrors the containment + ``(st_dev, st_ino)`` identity guards GC
+    applies in :mod:`syncade.gc_execute`, reusing
+    :func:`~syncade.gc_worktrees.tree_identity` and
+    :func:`~syncade.gc_worktrees.tree_contains_repo_root`, so a swapped
+    symlink or an out-of-base path can never redirect the delete. Any
+    failed guard — including a missing target — is a safe no-op.
+
+    When ``reap`` is true the proven-safe tree also has any in-cwd process
+    reaped (:func:`~syncade.gc_execute.reap_processes_in_tree`) before the
+    ``rmtree``, so the dir is never removed out from under a live subprocess
+    — mirroring GC's worktree-tree removal. This is for EXTERNAL worktrees
+    only (throwaway trees under the worktree base, where an orphaned
+    subprocess is syncade's own). Persisted run-artifact dirs under
+    ``.syncade/runs/`` are removed with ``reap=False``: GC never SIGKILLs
+    inside ``.syncade/runs/``, and an operator may be inspecting them, so
+    SIGKILL would over-reach (M2).
+    """
+    from syncade.gc_worktrees import tree_contains_repo_root, tree_identity
+
+    identity = tree_identity(target)
+    if identity is None:
+        # Missing, a symlink, or unstatable → refuse.
+        return
+    try:
+        resolved = target.resolve()
+        base_resolved = base.resolve()
+    except OSError:
+        return
+    if resolved == base_resolved:
+        return
+    try:
+        resolved.relative_to(base_resolved)
+    except ValueError:
+        # Escapes the base (e.g. via a parent symlink) → refuse.
+        return
+    if tree_contains_repo_root(resolved, repo_root):
+        return
+    if tree_identity(resolved) != identity:
+        # Identity changed between stat and removal → refuse (TOCTOU guard).
+        return
+    # Tree is proven safe. For external worktrees (reap=True) kill any in-cwd
+    # process first, so we never delete out from under a live subprocess —
+    # GC-equivalent. Run-artifact dirs pass reap=False: a plain guarded
+    # rmtree, never SIGKILL (M2). Reap is reached
+    # ONLY past every guard above, so a refused/out-of-base tree is untouched.
+    if reap:
+        from syncade.gc_execute import reap_processes_in_tree
+
+        reap_processes_in_tree(resolved)
+    shutil.rmtree(resolved, ignore_errors=True)