From 80422940bbaa20bcd088547196a030aabcccb839 Mon Sep 17 00:00:00 2001 From: lex Date: Tue, 11 Aug 2026 12:08:17 +0800 Subject: [PATCH 01/34] feat(dag): unify workflow authoring and blocks Introduce one validated source-to-graph boundary, internalize composable block capabilities, and gate config/release packaging with compatible provenance. --- .github/workflows/release-fork.yml | 41 +- CONTEXT-MAP.md | 3 +- NOTICE | 13 + packages/core/src/plugin/command/dag-flow.txt | 15 +- .../plugin/command/dag-template-update.txt | 26 +- .../src/plugin/command/workflow-blocks.md | 77 +- .../src/plugin/command/workflow-routing.md | 135 +- packages/core/src/plugin/skill.ts | 16 - .../src/plugin/skill/orchestration-router.md | 92 - packages/core/test/plugin/command.test.ts | 37 +- packages/core/test/plugin/skill.test.ts | 15 +- .../opencode/script/dag-template-files.ts | 40 + .../script/dag-template-validation.ts | 60 + .../script/evidence-schema-capture.ts | 64 + packages/opencode/script/generate.ts | 16 +- .../opencode/script/package-cli-artifact.ts | 69 + .../opencode/script/package-dag-templates.ts | 103 + .../opencode/script/validate-dag-templates.ts | 64 + packages/opencode/src/dag/CONTEXT.md | 44 + packages/opencode/src/dag/authoring.ts | 338 ++++ packages/opencode/src/dag/blocks.ts | 31 +- packages/opencode/src/dag/dag.ts | 215 +- .../docs/adr/0001-workflow-authoring-check.md | 33 + .../opencode/src/dag/templates/resolve.ts | 13 +- packages/opencode/src/dag/validation.ts | 943 +++++++++ packages/opencode/src/skill/index.ts | 13 - packages/opencode/src/tool/tool.ts | 13 +- packages/opencode/src/tool/workflow.ts | 717 +++---- .../opencode/test/command/command.test.ts | 2 +- packages/opencode/test/dag/blocks.test.ts | 49 +- .../test/dag/dag-create-validation.test.ts | 10 +- .../test/dag/dag-templates-generation.test.ts | 144 ++ .../test/dag/dag-validation-parity.test.ts | 199 ++ .../opencode/test/dag/dag-validation.test.ts | 542 ++++++ .../config-templates-pre-fix/dag-review.yaml | 166 ++ .../prototype-decision-route.yaml | 53 + .../test/dag/release-packaging-smoke.test.ts | 338 ++++ .../test/dag/workflow-authoring.test.ts | 211 ++ .../opencode/test/dag/workflow-tool.test.ts | 952 +++++++-- packages/opencode/test/skill/skill.test.ts | 7 +- .../__snapshots__/parameters.test.ts.snap | 1726 +++++++++++++++++ ...flow-block-skills-pre-internalization.json | 15 + .../workflow-parameters-post-change.json | 126 ++ .../workflow-parameters-pre-change.json | 32 + .../opencode/test/tool/parameters.test.ts | 16 + .../test/tool/workflow-authoring.test.ts | 209 ++ .../tool/workflow-provider-schema.test.ts | 159 ++ third_party/mattpocock-skills/LICENSE | 21 + third_party/mattpocock-skills/SOURCE.md | 12 + 49 files changed, 7206 insertions(+), 1029 deletions(-) delete mode 100644 packages/core/src/plugin/skill/orchestration-router.md create mode 100644 packages/opencode/script/dag-template-files.ts create mode 100644 packages/opencode/script/dag-template-validation.ts create mode 100644 packages/opencode/script/evidence-schema-capture.ts create mode 100644 packages/opencode/script/package-cli-artifact.ts create mode 100644 packages/opencode/script/package-dag-templates.ts create mode 100644 packages/opencode/script/validate-dag-templates.ts create mode 100644 packages/opencode/src/dag/CONTEXT.md create mode 100644 packages/opencode/src/dag/authoring.ts create mode 100644 packages/opencode/src/dag/docs/adr/0001-workflow-authoring-check.md create mode 100644 packages/opencode/src/dag/validation.ts create mode 100644 packages/opencode/test/dag/dag-templates-generation.test.ts create mode 100644 packages/opencode/test/dag/dag-validation-parity.test.ts create mode 100644 packages/opencode/test/dag/dag-validation.test.ts create mode 100644 packages/opencode/test/dag/fixtures/config-templates-pre-fix/dag-review.yaml create mode 100644 packages/opencode/test/dag/fixtures/config-templates-pre-fix/prototype-decision-route.yaml create mode 100644 packages/opencode/test/dag/release-packaging-smoke.test.ts create mode 100644 packages/opencode/test/dag/workflow-authoring.test.ts create mode 100644 packages/opencode/test/tool/fixtures/workflow-block-skills-pre-internalization.json create mode 100644 packages/opencode/test/tool/fixtures/workflow-parameters-post-change.json create mode 100644 packages/opencode/test/tool/fixtures/workflow-parameters-pre-change.json create mode 100644 packages/opencode/test/tool/workflow-authoring.test.ts create mode 100644 packages/opencode/test/tool/workflow-provider-schema.test.ts create mode 100644 third_party/mattpocock-skills/LICENSE create mode 100644 third_party/mattpocock-skills/SOURCE.md diff --git a/.github/workflows/release-fork.yml b/.github/workflows/release-fork.yml index 49381ddbd0..03f58b43de 100644 --- a/.github/workflows/release-fork.yml +++ b/.github/workflows/release-fork.yml @@ -89,6 +89,11 @@ jobs: # (LeXwDeX/opencode-dag-config) into a release asset. dev/main do not manage # these templates anymore — the config repo is the single source of truth. # Read-only: no commits, no pushes, so branch protection never blocks it. + # + # Validate-before-package: the releasing runtime commit runs its directory + # validator against the config repo HEAD BEFORE any copy/package step. Any + # invalid template — or an unavailable validator — fails the job (fail + # closed), so an unchecked archive can never be uploaded or embedded. package-templates: name: Package Reference Templates if: github.event_name == 'workflow_dispatch' @@ -96,24 +101,28 @@ jobs: permissions: contents: read steps: + - name: Checkout Runtime (releasing commit) + uses: actions/checkout@v4 + - name: Clone Config Repo uses: actions/checkout@v4 with: repository: LeXwDeX/opencode-dag-config path: dag-config - - name: Package Templates + - name: Setup Bun + uses: ./.github/actions/setup-bun + with: + save-cache: false + + - name: Install Runtime Dependencies + run: bun install + + - name: Validate and Package Templates (fail closed) + working-directory: packages/opencode run: | - mkdir -p dist - shopt -s nullglob - files=(dag-config/*.yaml) - if [ ${#files[@]} -gt 0 ]; then - cp "${files[@]}" dist/ - else - echo "::warning::No templates found in opencode-dag-config root; packaging empty archive" - fi - tar -czf dag-templates.tar.gz -C dist . - echo "Templates packaged: $(ls dist | wc -l) files" + echo "Packaging config commit $(git -C "$GITHUB_WORKSPACE/dag-config" rev-parse HEAD) with runtime commit $(git rev-parse HEAD)" + bun run script/package-dag-templates.ts "$GITHUB_WORKSPACE/dag-config" "$GITHUB_WORKSPACE/dag-templates.tar.gz" - name: Upload Templates Artifact uses: actions/upload-artifact@v4 @@ -224,15 +233,9 @@ jobs: for dir in opencode-*/; do base="${dir%/}" if [[ "$base" == *linux* ]]; then - tar -czf "${base}.tar.gz" -C "${base}/bin" . + bun run ../script/package-cli-artifact.ts "$base" "${base}.tar.gz" else - cd "${base}/bin" - if command -v zip &>/dev/null; then - zip -r "../../${base}.zip" . - else - pwsh -Command "Compress-Archive -Path '*' -DestinationPath '../../${base}.zip'" 2>/dev/null || 7z a "../../${base}.zip" . || true - fi - cd ../.. + bun run ../script/package-cli-artifact.ts "$base" "${base}.zip" fi done diff --git a/CONTEXT-MAP.md b/CONTEXT-MAP.md index 7de0a6c619..d9e39d5cb2 100644 --- a/CONTEXT-MAP.md +++ b/CONTEXT-MAP.md @@ -5,7 +5,8 @@ Read the context documents relevant to the code or decision under review. Do not | Context | Domain document | Primary areas | | --- | --- | --- | | Session Runtime and Client Contract | [`CONTEXT.md`](CONTEXT.md) | `packages/opencode/src/session`, `packages/opencode/src/system-context`, `packages/protocol`, `packages/client`, `packages/sdk` | +| Workflow Orchestration | [`packages/opencode/src/dag/CONTEXT.md`](packages/opencode/src/dag/CONTEXT.md) | `packages/opencode/src/dag`, workflow tool, DAG template validation and packaging | ## Contexts created lazily -DAG orchestration does not yet have a dedicated `CONTEXT.md`. The full DAG review must establish terminology from implementation, tests, existing specifications, and accepted decisions before `/domain-modeling` creates one. Add future contexts to this map only when they have a stable document to reference. +Add future contexts to this map only when they have a stable document to reference. diff --git a/NOTICE b/NOTICE index 0f346d30fd..1d067dbb89 100644 --- a/NOTICE +++ b/NOTICE @@ -51,3 +51,16 @@ License boundaries When a file under an AGPL-covered directory imports MIT-licensed upstream modules, the upstream modules remain MIT; only the AGPL-covered files and their derivatives carry AGPL obligations. + +3. Engineering workflow methodologies + + Source: https://github.com/mattpocock/skills + Revision: 84fdeffd12f2ee307994d1eb6feb48173b6e0502 + License: MIT + Text: ./third_party/mattpocock-skills/LICENSE + Copyright (c) 2026 Matt Pocock + + Selected decision, evidence, debugging, test-first delivery, codebase + design, review, and synthesis methodologies are adapted into product-owned + workflow routing and block contracts. Source metadata and adaptation scope + are recorded in ./third_party/mattpocock-skills/SOURCE.md. diff --git a/packages/core/src/plugin/command/dag-flow.txt b/packages/core/src/plugin/command/dag-flow.txt index dbc4e08d6b..7de158df1f 100644 --- a/packages/core/src/plugin/command/dag-flow.txt +++ b/packages/core/src/plugin/command/dag-flow.txt @@ -4,17 +4,10 @@ $ARGUMENTS -If the task is empty or contains only whitespace, ask for it and do not start a workflow. Otherwise load -the `orchestration-router` skill and route the request through one consolidated -graph. `/dag-flow` explicitly selects DAG execution, but it does not waive a -material user decision. - -When the route requires a decision checkpoint or GRILL qualification, inspect -discoverable facts first, proactively write recommended answers, surface the -compact brief in the main conversation, and ask for one combined confirmation. -Do not call `workflow(action="start")` until that confirmation arrives. Do not -put the checkpoint in a child node. If the request is already bounded and -confirmed, start without manufacturing another question. +If the task is empty or contains only whitespace, ask for it; do not start a workflow. +Otherwise apply the resident Orchestration Router and route the +request through one consolidated graph. `/dag-flow` explicitly selects DAG +execution; the router still owns any material Decision Checkpoint. Prefer composable blocks for a fresh flow. Load `workflow(action="guide", topic="blocks")` only if the block contract is not diff --git a/packages/core/src/plugin/command/dag-template-update.txt b/packages/core/src/plugin/command/dag-template-update.txt index 2619f06659..87d1fc985d 100644 --- a/packages/core/src/plugin/command/dag-template-update.txt +++ b/packages/core/src/plugin/command/dag-template-update.txt @@ -33,7 +33,7 @@ https://codeload.github.com/LeXwDeX/opencode-dag-config/zip/refs/heads/main ``` Extract it into a temporary directory. The archive contains a top-level folder -(typically `opencode-dag-config-main/`) whose root holds the `*.yaml` +(typically `opencode-dag-config-main/`) whose root holds the `*.yaml` and `*.yml` templates. ## Dry-run preview (always show before applying) @@ -48,6 +48,28 @@ Compare the extracted templates against the current Show the user the three lists, or report that nothing needs updating. +## Validate downloaded templates (fail closed, before any replacement) + +Before any copy or overwrite, discover and validate EVERY extracted `*.yaml` and `*.yml` template with +the same validation authority `start` and `list` use — the workflow tool's +`validate` action. For each extracted template call: + +``` +workflow(action: "validate", spec_path: "", profile: "portable") +``` + +- Every template must come back `valid: true`. +- If both `.yaml` and `.yml` exist, abort before applying anything; + one logical workflow name cannot have two source files. +- If ANY template is invalid: keep the current global library exactly as it + is — copy nothing, overwrite nothing. Report a per-file diagnostic list + (code, path, message, hint) for every failing template plus the names that + passed, and stop. Treat validation failure like a download failure: never + partially apply. +- Use the portable profile: the global library doubles as the distributable + builtin source, so a template that only works inside one specific project + does not belong here. + ## Merge - If there are no `UPDATE` entries: merge directly — copy `NEW` templates in, @@ -94,6 +116,8 @@ not just the workflow library listing: - Download failure (network, 404, rate limit): report the actual error verbatim and stop — never invent success. - Extraction failure (corrupt archive): report and stop. +- Validation failure (any template invalid): report per-file diagnostics and + stop; the existing library stays untouched. - If `/workflows` does not exist, create it before applying. ## Notes diff --git a/packages/core/src/plugin/command/workflow-blocks.md b/packages/core/src/plugin/command/workflow-blocks.md index cb6ea49c3f..95feef7e21 100644 --- a/packages/core/src/plugin/command/workflow-blocks.md +++ b/packages/core/src/plugin/command/workflow-blocks.md @@ -17,31 +17,26 @@ config: - id: map kind: explore instruction: Locate the ownership and persistence seams. - - id: design + - id: codebase-design kind: plan depends_on: [map] - - id: implement + instruction: Define the owning seam, deep interface, migration path, and acceptance evidence. + - id: coding kind: coding - depends_on: [design] - skills: [tdd] - - id: checks + depends_on: [codebase-design] + instruction: Deliver the bounded design through observable tests and focused checks. + - id: verify kind: verify - depends_on: [implement] - - id: decision + depends_on: [coding] + - id: global-review kind: review - depends_on: [checks] - skills: [code-review] + depends_on: [verify] ``` -Each block accepts: - -- `id`: unique dependency address and the ID of its compiled exit node. -- `kind`: `explore`, `plan`, `prototype`, `debug`, `coding`, `verify`, - `review`, or `synthesize`. -- `depends_on`: upstream block IDs; omitted means a root block. -- `instruction`: target-specific text added to the built-in block contract. -- `skills`: relevant skill names the child loads lazily when available. -- `worker_type`, `required`, `report_to_parent`: optional overrides. +The parameter schema owns the exact block field shapes; the tool rejects +unknown or missing fields by name, and `workflow(action="validate")` reports +each field error with its path. This guide covers semantics and constraints +only — compose blocks against the schema, not against prose. `objective` is required and is injected into every generated node. Use blocks or nodes, never both. Block IDs use letters, numbers, underscores, and hyphens. @@ -51,7 +46,8 @@ or existing durable node IDs during **extend** and replan. ## Block contracts - `explore`: read-only repository mapping and evidence collection. -- `plan`: implementation-ready decomposition, seams, checks, and risks. +- `plan`: decision- or implementation-ready options/work packages, checks, + falsifiers, and risks. - `prototype`: the smallest throwaway experiment that resolves a runnable uncertainty; it does not silently become production code. It still publishes its changed-file list and fingerprint so later verification or review cannot @@ -65,6 +61,10 @@ or existing durable node IDs during **extend** and replan. fingerprint through both reviews into an `ACCEPT | REJECT` decision. - `synthesize`: resolves dependency outputs into the parent-facing result. +Block contracts are self-contained. `instruction` specializes a lifecycle kind +into a capability such as `codebase-design`, `domain-modeling`, or +`global-review`; it never delegates the method to an external Skill. + Judgment and acceptance gates (`plan`, debug diagnosis, `verify`, review decision, and `synthesize`) are required by default. Volume lanes (`explore`, `prototype`, `coding`, debug evidence, and independent review lanes) are @@ -74,41 +74,10 @@ stay quiet. A block immediately after a review gate is conditioned on its accepted verdict. Because the condition language handles one verdict reference, fan multiple review lanes into one review block before continuing. -## Composition routes - -Choose only blocks justified by current evidence: - -- Product or architecture decision: parallel `explore` lanes → `plan` options - → `review` or `synthesize`. -- Project feature: optional parallel `explore` or proposal lanes → `plan` → - ordered `coding`/assembly → `verify` → `review`. -- Hard bug: `debug` → `coding` → `verify` → `review`. -- Runnable design uncertainty: `prototype` → `plan`; keep the prototype - disposable unless the confirmed scope explicitly promotes it. -- Existing implementation review: `explore` scope lanes → `review`; add a - separate verification block first when test evidence is required. - -Do not add a phase merely because it exists. Skip exploration when repository -facts are already known and skip a prototype when ordinary inspection resolves -the question. All block workers share one workspace: the compiler serializes -otherwise-unordered `coding` and `prototype` writers, while read-only discovery -and proposal lanes remain parallel. Use `synthesize` only when multiple outputs -need reconciliation. - -## Parent decision checkpoint - -User qualification is not a DAG block. Before executable blocks start, the -parent gathers facts it can discover, creates recommended answers for every -material open decision, displays one compact decision brief, and asks for one -combined confirmation. The brief contains the recommended route, alternatives -only where they change the result, assumptions, risks, scope, and acceptance -evidence. A correction from the user updates the brief; unchanged confirmed -facts are not asked again. - -After confirmation, encode the decision in `objective` and block instructions. -If the request is already fully bounded and confirmed, do not manufacture a -redundant checkpoint. Child nodes never ask the user to make product or scope -decisions. +All block workers share one workspace. The compiler serializes +otherwise-unordered `coding` and `prototype` writers, while read-only lanes may +remain parallel. The resident Orchestration Router owns route selection and +phase pruning; this guide owns block fields, contracts, and graph mechanics. ## When to use low-level nodes diff --git a/packages/core/src/plugin/command/workflow-routing.md b/packages/core/src/plugin/command/workflow-routing.md index dc027c2567..92394309a4 100644 --- a/packages/core/src/plugin/command/workflow-routing.md +++ b/packages/core/src/plugin/command/workflow-routing.md @@ -1,63 +1,78 @@ -# Workflow Orchestration - -In the user-facing parent session, use this tool proactively when one user -objective needs staged, parallel, quality-gated, or adaptive execution. A slash -command is not required. A DAG child session executes its assigned block and -must not recursively route that assignment into another workflow. - -## Execution Mode Selection - -- Use direct execution for conversation, a small read-only lookup, or one or - two isolated utility scripts outside a project-level change. -- Use one `task` subagent for one independent non-trivial leaf assignment. -- Use one `workflow` DAG for project-level source or test changes (even when - only one project file is expected), work that crosses module boundaries, - product/architecture planning that needs repository exploration, or any - staged/parallel/gated/adaptive objective. - -Related work for one objective belongs in one live workflow. The parent -conversation owns user decisions, scope, checkpoints, workflow control, and -the final synthesis. Child nodes own executable leaf work. Explicit requests -for “single agent”, “do not use DAG”, or direct work disable proactive DAG -selection. Read-only scope changes what nodes may do; it does not by itself -disable a useful exploration or review DAG. - -For a project-level route, load the `orchestration-router` skill before -constructing the graph. It selects the smallest useful sequence of composable -blocks and defines the one-confirmation decision checkpoint. Do not place user -questioning inside a child node. +# Orchestration Router + +The user-facing parent owns workflow qualification and block composition. A +slash command or external Skill is not required. A DAG child executes its +assigned block directly and never creates a nested workflow. + +Do not discover, load, or apply an external Skill to select the workflow route +or compose its blocks. Installed routing Skills do not override this product +contract and must not change the selected graph or generated block prompts. + +## Execution mode + +- Direct execution: conversation, a small read-only lookup, or one or two + isolated utility scripts outside a project-level change. +- One `task` child: one independent non-trivial leaf assignment. +- One `workflow` DAG: project-level source or test changes, even one project + file; cross-module work; repository-backed product or architecture work; or + staged, parallel, quality-gated, or adaptive execution. + +An explicit request for one agent, direct work, or no DAG selects direct work. +Related work for one objective stays under one workflow ID; extend or replan +that workflow when evidence adds work. + +## Qualify before composing + +Inspect repository instructions, code, tests, history, and runtime evidence +before asking. Classify what remains as confirmed facts, safe inferences, +runnable uncertainties, user-owned decisions, and executable work. + +When a user-owned choice materially changes behavior, scope, acceptance, or an +irreversible boundary, present one **Decision Checkpoint** before executable +blocks start. Its **Workflow Brief** contains the recommended answer and why, +scope, acceptance evidence, assumptions, risks, and only materially different +alternatives. Ask for one combined confirmation. A request that already +contains an equivalent confirmed brief needs no checkpoint. Child nodes never +ask the user to make product or scope decisions. + +## Compose the smallest justified graph + +Use `workflow(action="guide", topic="blocks")` when block fields are not in +context. Choose blocks from evidence, not from a fixed all-phases pipeline: + +- feature: optional evidence → plan/design → coding packages → verify → review; +- bug without a proven cause: debug → coding → verify → review; +- runnable uncertainty: prototype → update the plan; +- product or architecture decision: evidence lanes → plan options → review or + synthesize; +- existing implementation review: scope evidence → verify when required → + review. + +Omit exploration when facts are already sufficient, omit prototype when +inspection resolves the question, and add synthesize only when outputs need +reconciliation. High-level block contracts are self-contained; block +instructions specialize the task and never name external Skills. + +When a saved route matches the topology, read it, retarget its objective and +block instructions, and prune or add justified blocks before starting the +edited inline spec. Start `spec_path` directly only when its target already +matches exactly. Use low-level nodes only for bindings, conditions, output +schemas, or lifecycle metadata blocks cannot express. + +Validate the composed or edited spec before start. Fix every diagnostic and +validate again; validation creates no workflow. A successful start returns the +exact workflow ID. The parent owns the brief, graph, user interaction, +checkpoints, controls, and final report; children own bounded executable work. +End after start and let the workflow wake the parent. Do not poll merely to +wait, and never claim an unstarted graph is running. ## Progressive guidance -Load details only when needed: - -- **guide** without `topic`: compact topic index. -- **guide** `topic=blocks`: composable block schema and examples. -- **guide** `topic=interface`: low-level node fields and tool semantics. -- **guide** `topic=policy`: admission, gates, recovery, and bounded repair. -- **guide** `topic=patterns`: larger domain playbooks. - -## Actions - -- **start** creates one workflow from exactly one inline `spec` or saved - `spec_path`. -- **extend** adds nodes or blocks to the same objective. -- **status** reads durable state when the user asks or before a control - decision; it is not a waiting mechanism. -- **result** reads one node's complete durable output in bounded pages when a - wake preview reports `truncated=true`. -- **control** pauses, resumes, cancels, replans, steps, or completes a workflow. -- **list** shows saved workflow specs and their resolution scope. -- **read** returns one saved spec so the parent can retarget it before start. - -Prefer high-level `blocks` for a fresh one-off flow. Use low-level `nodes` when -the task needs custom bindings, conditions, output schemas, or review metadata. -Never provide both. Reusable saved YAML remains valid and may use either form. -When a saved route is generic, call **read**, replace its objective and -block-specific instructions with the confirmed request, then pass the result -as an inline **start** spec. Start by `spec_path` only when the saved target -already matches exactly. - -The workflow runs asynchronously and wakes the parent at actionable reporting -nodes or terminal state. Do not poll, sleep, or loop merely to wait. Never -claim a workflow started unless **start** returned its exact workflow ID. +- `guide` without `topic`: compact index. +- `guide(topic="blocks")`: block shape and composition semantics. +- `guide(topic="interface")`: low-level node and tool fields. +- `guide(topic="policy")`: gates, recovery, and bounded repair. +- `guide(topic="patterns")`: larger domain playbooks. + +The tool parameter schema owns required fields and exclusivity; author calls +from that schema rather than reconstructed prose. diff --git a/packages/core/src/plugin/skill.ts b/packages/core/src/plugin/skill.ts index c027b73302..b2fdc51b4a 100644 --- a/packages/core/src/plugin/skill.ts +++ b/packages/core/src/plugin/skill.ts @@ -9,12 +9,10 @@ import { SkillV2 } from "../skill" import customizeOpencodeContent from "./skill/customize-opencode.md" with { type: "text" } import configureHooksContent from "./skill/configure-hooks.md" with { type: "text" } import createDagWorkflowContent from "./skill/create-dag-workflow.md" with { type: "text" } -import orchestrationRouterContent from "./skill/orchestration-router.md" with { type: "text" } export const CustomizeOpencodeContent = customizeOpencodeContent export const ConfigureHooksContent = configureHooksContent export const CreateDagWorkflowContent = createDagWorkflowContent -export const OrchestrationRouterContent = orchestrationRouterContent export const CustomizeOpencodeDescription = "Use ONLY when the user is editing or creating opencode's own configuration: opencode.json, opencode.jsonc, files under .opencode/, or files under ~/.config/opencode/. Also use when creating or fixing opencode agents, subagents, commands, skills, plugins, MCP servers, or permission rules. Do not use for the user's own application code, or for any project that is not configuring opencode itself." @@ -25,9 +23,6 @@ export const ConfigureHooksDescription = export const CreateDagWorkflowDescription = "Use when the user wants to create, save, or edit a reusable DAG workflow — a named multi-agent graph they can start again later — or asks where workflow specs live, how to make a workflow available in every project, or why a saved workflow name does not resolve. Covers project/global scopes, composable blocks, low-level nodes, and verification. Do not use to run an existing workflow or to design a one-off graph for the current task; the workflow tool handles those." -export const OrchestrationRouterDescription = - "Use proactively in the user-facing parent session, without waiting for /dag-flow, whenever one objective changes project source or tests (even one project file), crosses module boundaries, needs repository-backed product/architecture planning, or has staged, parallel, quality-gated, or adaptive execution. Routes work through a parent-owned decision checkpoint and composable DAG blocks. Do not use inside a DAG child session, for one or two isolated utility scripts, simple lookup/conversation, or when the user explicitly requests direct work, one agent, or no DAG." - export const Plugin = define({ id: "skill", effect: Effect.fn(function* (ctx) { @@ -65,17 +60,6 @@ export const Plugin = define({ }), }), ) - draft.source( - SkillV2.EmbeddedSource.make({ - type: "embedded", - skill: SkillV2.Info.make({ - name: "orchestration-router", - description: OrchestrationRouterDescription, - location: AbsolutePath.make("/builtin/orchestration-router.md"), - content: OrchestrationRouterContent, - }), - }), - ) }) }), }) diff --git a/packages/core/src/plugin/skill/orchestration-router.md b/packages/core/src/plugin/skill/orchestration-router.md deleted file mode 100644 index 9d264918a5..0000000000 --- a/packages/core/src/plugin/skill/orchestration-router.md +++ /dev/null @@ -1,92 +0,0 @@ - - -# Orchestration Router - -Turn one user objective into the smallest execution route that preserves user -control and produces verifiable evidence. The router decides; workflow blocks -execute. Do not copy the whole playbook into the parent response. - -This skill belongs to the user-facing parent session. If the current prompt -identifies this session as a DAG child or assigns one bounded block, execute -that assignment directly and do not create a nested workflow. - -## 1. Establish facts before asking - -Read repository instructions and inspect enough code, tests, history, or -runtime evidence to answer discoverable questions yourself. Separate: - -- confirmed facts; -- decisions only the user can make; -- runnable uncertainties best answered by a disposable prototype; -- implementation work suitable for child sessions. - -Do not ask the user for file locations, conventions, or current behavior that -the repository can reveal. - -## 2. Select the execution lane - -Use direct work for conversation, a bounded lookup, or one or two isolated -utility scripts outside a project-level change. Use one task child for one -independent non-trivial leaf. Use one workflow without waiting for `/dag-flow` -whenever the objective changes project source or tests—even when only one -project file is expected—spans modules, requires repository-backed product or -architecture planning, or has staged, parallel, gated, or adaptive work. - -Honor explicit “single agent”, “do not use DAG”, and direct-execution requests. -Keep all related work for one objective under one workflow ID; adapt it with -extend/replan rather than creating disconnected graphs. - -## 3. Run one parent-owned decision checkpoint when needed - -Use a decision checkpoint for material product choices, conflicting -constraints, high-blast-radius architecture, or an explicit GRILL request. It -must happen in the parent conversation before executable DAG blocks start. - -Generate recommended answers proactively. Present one compact brief containing: - -1. recommended route and why; -2. scope in/out and acceptance evidence; -3. assumptions and risks; -4. alternatives only where the choice materially changes the result; -5. one combined confirmation request. - -Wait for that confirmation. Do not hide the recommendation inside tool output, -start speculative implementation, or delegate the questions to a child. If the -user changes an answer, revise only affected fields and ask one new combined -confirmation. If the request already supplies an equivalent confirmed brief, -do not repeat the checkpoint. - -## 4. Compose blocks from the route - -Call `workflow(action="guide", topic="blocks")` when the block interface is -not already in context. Select only justified blocks: - -- product/design: evidence lanes → competing plans when useful → synthesis or - review decision; -- feature: optional explore → plan → independent coding packages → verify → - review; -- bug: debug → coding → verify → review; -- runnable uncertainty: prototype detour → update the plan; -- review-only: scope exploration → independent review and arbitration. - -When a reusable route matches the topology, call -`workflow(action="read", spec_path="")`, retarget the objective and -block instructions to the confirmed request, prune unjustified blocks, and -start the edited result as an inline spec. Start the saved `spec_path` directly -only when its target already matches exactly. - -Use a skill name on a block only when it appears in the available skill -catalog. Test-first implementation and standards/spec review belong in their -respective coding and review blocks, not in the always-on router prompt. - -## 5. Preserve ownership boundaries - -The parent owns the confirmed brief, graph shape, user interaction, workflow -controls, checkpoint disposal, and final report. Children own repository -exploration, implementation, checks, and bounded review artifacts. Do not have -the parent perform executable leaf work after choosing a workflow. - -Start only after required confirmation. Report the returned workflow ID and -end the turn; the runtime wakes the parent later. On wake, dispose of a -non-ACCEPT verdict by targeted extension/replan or a reasoned stop. Never poll -merely to wait, and never describe an unstarted graph as running. diff --git a/packages/core/test/plugin/command.test.ts b/packages/core/test/plugin/command.test.ts index e4213fce3d..264fe05098 100644 --- a/packages/core/test/plugin/command.test.ts +++ b/packages/core/test/plugin/command.test.ts @@ -49,25 +49,25 @@ describe("CommandPlugin.Plugin", () => { template: CommandPlugin.DagFlowContent, }) expect(CommandPlugin.DagFlowContent).toContain("$ARGUMENTS") - expect(CommandPlugin.DagFlowContent).toContain('workflow(action="start")') + expect(CommandPlugin.DagFlowContent).toContain("`action=start`") expect(CommandPlugin.DagFlowContent).toContain("exact Workflow ID") expect(CommandPlugin.DagFlowContent).toContain("run `/dag`") - expect(CommandPlugin.DagFlowContent).toContain("orchestration-router") - expect(CommandPlugin.DagFlowContent).toContain("one combined confirmation") + expect(CommandPlugin.DagFlowContent).toContain("resident Orchestration Router") + expect(CommandPlugin.DagFlowContent).toContain("Decision Checkpoint") }), ) it.effect("documents the smallest child execution mode", () => Effect.sync(() => { - expect(CommandPlugin.WorkflowContent).toContain("## Execution Mode Selection") - expect(CommandPlugin.WorkflowContent).toContain("Use direct execution for") - expect(CommandPlugin.WorkflowContent).toContain("one `task` subagent") + expect(CommandPlugin.WorkflowContent).toContain("## Execution mode") + expect(CommandPlugin.WorkflowContent).toContain("Direct execution:") + expect(CommandPlugin.WorkflowContent).toContain("One `task` child") expect(CommandPlugin.WorkflowContent).toContain("Related work for one objective") expect(CommandPlugin.WorkflowFactsContent).toContain("project-level source or test changes") expect(CommandPlugin.WorkflowFactsContent).toMatch(/even when only\s+one project file/) expect(CommandPlugin.WorkflowFactsContent).not.toContain("when ANY") expect(CommandPlugin.WorkflowFactsContent).not.toContain("- **Multi-model**:") - expect(CommandPlugin.DagFlowContent).toContain('workflow(action="start")') + expect(CommandPlugin.DagFlowContent).toContain("`action=start`") }), ) @@ -75,13 +75,22 @@ describe("CommandPlugin.Plugin", () => { Effect.sync(() => { expect(CommandPlugin.WorkflowContent.length).toBeLessThan(5_000) expect(CommandPlugin.WorkflowContent).toContain("project-level source or test changes") - expect(CommandPlugin.WorkflowContent).toContain("only one project file") + expect(CommandPlugin.WorkflowContent).toMatch(/even one project\s+file/) expect(CommandPlugin.WorkflowContent).toContain("isolated utility scripts") - expect(CommandPlugin.WorkflowContent).toContain("orchestration-router") - expect(CommandPlugin.WorkflowContent).toContain("**guide**") + expect(CommandPlugin.WorkflowContent).toContain("# Orchestration Router") + expect(CommandPlugin.WorkflowContent).toContain("Workflow Brief") + expect(CommandPlugin.WorkflowContent).toContain("smallest justified graph") + expect(CommandPlugin.WorkflowContent).not.toMatch(/load (?:the )?[`"']?orchestration-router/i) + expect(CommandPlugin.WorkflowContent).toContain( + "Do not discover, load, or apply an external Skill to select the workflow route", + ) + expect(CommandPlugin.WorkflowContent).toContain('guide(topic="blocks")') expect(CommandPlugin.WorkflowContent).not.toContain("# Orchestration Domains") expect(CommandPlugin.WorkflowBlocksContent).toContain("# Composable Workflow Blocks") - expect(CommandPlugin.WorkflowBlocksContent).toContain("combined confirmation") + expect(CommandPlugin.WorkflowContent).toContain("combined confirmation") + expect(CommandPlugin.WorkflowBlocksContent).not.toContain("combined confirmation") + expect(CommandPlugin.WorkflowContent).toContain("product or architecture decision") + expect(CommandPlugin.WorkflowBlocksContent).not.toContain("product or architecture decision") expect(CommandPlugin.WorkflowFactsContent.length).toBeGreaterThan(CommandPlugin.WorkflowContent.length) }), ) @@ -102,7 +111,11 @@ describe("CommandPlugin.Plugin", () => { Effect.sync(() => { expect(CommandPlugin.WorkflowFactsContent).toContain("For a one-off graph, pass `spec` inline") expect(CommandPlugin.WorkflowFactsContent).toContain("Use `spec_path` only") - expect(CommandPlugin.WorkflowContent).toContain("**read**") + // The resident description keeps tool selection and the progressive + // guide index only; per-action field semantics live in the parameter + // schema (change repair-workflow-authoring-validation). + expect(CommandPlugin.WorkflowContent).not.toContain("## Actions") + expect(CommandPlugin.WorkflowContent).toContain("parameter schema") expect(CommandPlugin.WorkflowFactsContent).toContain('{ action: "read", spec_path: "code-review" }') expect(CommandPlugin.WorkflowFactsContent).toContain("retarget its objective and block instructions") expect(CommandPlugin.WorkflowFactsContent).not.toContain("Never inline graph nodes") diff --git a/packages/core/test/plugin/skill.test.ts b/packages/core/test/plugin/skill.test.ts index c032e70dc3..d50a089422 100644 --- a/packages/core/test/plugin/skill.test.ts +++ b/packages/core/test/plugin/skill.test.ts @@ -60,23 +60,12 @@ describe("SkillPlugin.Plugin", () => { }), ) - it.effect("registers the proactive orchestration router as a lazy built-in skill", () => + it.effect("keeps workflow orchestration out of the Skill catalog", () => Effect.gen(function* () { const skill = yield* SkillV2.Service yield* SkillPlugin.Plugin.effect(host({ skill: { ...skill, reload: skill.reload } })) - expect(yield* skill.list()).toContainEqual( - expect.objectContaining({ - name: "orchestration-router", - description: expect.stringContaining("without waiting for /dag-flow"), - content: expect.stringContaining("one combined confirmation"), - }), - ) - const router = (yield* skill.list()).find((item) => item.name === "orchestration-router") - expect(router?.description).toContain("even one project file") - expect(router?.description).toContain("isolated utility scripts") - expect(router?.content).toContain('workflow(action="read"') - expect(router?.content).toContain("retarget the objective") + expect((yield* skill.list()).some((item) => item.name === "orchestration-router")).toBe(false) }), ) diff --git a/packages/opencode/script/dag-template-files.ts b/packages/opencode/script/dag-template-files.ts new file mode 100644 index 0000000000..36a4bd0c84 --- /dev/null +++ b/packages/opencode/script/dag-template-files.ts @@ -0,0 +1,40 @@ +import path from "node:path" +import { Schema } from "effect" + +const RuntimeCompat = Schema.Struct({ + runtime_repo: Schema.String, + runtime_commit: Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/)), +}) + +const decodeRuntimeCompat = Schema.decodeUnknownSync(RuntimeCompat) + +/** One root-only discovery contract shared by validation, generation, and packaging. */ +export async function discoverDagTemplateFiles(directory: string) { + const files = await Promise.all( + ["*.yaml", "*.yml"].map((pattern) => Array.fromAsync(new Bun.Glob(pattern).scan(directory))), + ) + const discovered = [...new Set(files.flat())].sort() + const names = new Map() + for (const file of discovered) { + const name = path.basename(file, path.extname(file)) + const previous = names.get(name) + if (previous) { + throw new Error(`DAG template name is duplicated across .yaml/.yml files: ${name} (${previous}, ${file})`) + } + names.set(name, file) + } + return discovered +} + +/** A template directory is releasable only when it pins one exact runtime. */ +export async function readRuntimeCompat(directory: string) { + const filepath = path.join(directory, "runtime-compat.json") + if (!(await Bun.file(filepath).exists())) { + throw new Error(`runtime compatibility file is missing: ${filepath}`) + } + try { + return decodeRuntimeCompat(await Bun.file(filepath).json()) + } catch (error) { + throw new Error(`runtime compatibility file is invalid: ${filepath}: ${String(error)}`, { cause: error }) + } +} diff --git a/packages/opencode/script/dag-template-validation.ts b/packages/opencode/script/dag-template-validation.ts new file mode 100644 index 0000000000..df1b5b7e68 --- /dev/null +++ b/packages/opencode/script/dag-template-validation.ts @@ -0,0 +1,60 @@ +import path from "node:path" +import { Effect } from "effect" +import { WorkflowAuthoring } from "../src/dag/authoring" +import { discoverDagTemplateFiles, readRuntimeCompat } from "./dag-template-files" + +/** One directory-to-validation-result boundary shared by CI and generation. */ +export async function validateDagTemplateDirectory(directory: string) { + const compat = await readRuntimeCompat(directory).then( + (value) => ({ value, error: undefined }), + (error: unknown) => ({ + value: undefined, + error: error instanceof Error ? error.message : String(error), + }), + ) + const discovery = await discoverDagTemplateFiles(directory).then( + (files) => ({ files, error: undefined }), + (error: unknown) => ({ + files: [], + error: error instanceof Error ? error.message : String(error), + }), + ) + const authoring = WorkflowAuthoring.make() + const results = await Promise.all( + discovery.files.map(async (file) => { + const content = await Bun.file(path.join(directory, file)).text() + const result = await Effect.runPromise( + authoring.prepare({ + action: "start", + source: { kind: "yaml", source: file, content }, + profile: "portable", + }), + ) + return { name: file, content, valid: result.valid, errors: result.errors, warnings: result.warnings } + }), + ) + return { + compat: compat.value, + compat_error: compat.error, + discovery_error: discovery.error, + results, + } +} + +export function dagTemplateDirectoryFailure(result: Awaited>) { + if (result.compat_error) return result.compat_error + if (result.discovery_error) return result.discovery_error + const invalid = result.results.filter((entry) => !entry.valid) + if (invalid.length > 0) { + return `DAG template validation failed:\n${invalid + .flatMap((entry) => + entry.errors.map( + (diagnostic) => + `- ${entry.name} [${diagnostic.code}] ${diagnostic.path}: ${diagnostic.message}`, + ), + ) + .join("\n")}` + } + if (result.results.length === 0) return "no templates found in directory" + return undefined +} diff --git a/packages/opencode/script/evidence-schema-capture.ts b/packages/opencode/script/evidence-schema-capture.ts new file mode 100644 index 0000000000..4895d14a0e --- /dev/null +++ b/packages/opencode/script/evidence-schema-capture.ts @@ -0,0 +1,64 @@ +/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- This one-shot evidence script intentionally traverses provider-transformed recursive JSON Schema values. */ +// One-shot evidence capture for change repair-workflow-authoring-validation +// (task 1.4, recaptured after the review-remediation admission change): +// records the POST-change provider-facing workflow schema so provider-shape +// regressions surface as fixture diffs. The PRE-change fixture +// (workflow-parameters-pre-change.json) is immutable red evidence — never +// regenerate it; it documents the failure mode the switch fixed. +import path from "node:path" +import { Parameters } from "../src/tool/workflow" +import { ToolJsonSchema } from "../src/tool/json-schema" +import { ProviderTransform } from "../src/provider/transform" + +const schema = ToolJsonSchema.fromSchema(Parameters as never) as JsonSchemaNode +const flat = JSON.stringify(schema) + +const providers: Record = { + openai: { providerID: "openai", api: { id: "gpt-4.1", npm: "@ai-sdk/openai" } }, + azure: { providerID: "azure", api: { id: "gpt-4.1", npm: "@ai-sdk/azure" } }, + gemini: { providerID: "google", api: { id: "gemini-3-pro", npm: "@ai-sdk/google" } }, +} + +type JsonSchemaNode = { + anyOf?: JsonSchemaNode[] + required?: string[] + properties?: Record + items?: JsonSchemaNode + [key: string]: unknown +} + +const evidence: Record = { + captured_from: "packages/opencode/src/tool/workflow.ts (discriminated-union Parameters)", + schema_bytes: Buffer.byteLength(flat, "utf8"), + branch_count: (schema.anyOf ?? []).length, + session_id_exposed: flat.includes('"session_id"'), + project_id_exposed: flat.includes('"project_id"'), + transformed: {} as Record, +} + +for (const [name, model] of Object.entries(providers)) { + const transformed = ProviderTransform.schema(model as never, JSON.parse(flat)) as JsonSchemaNode + const branches = transformed.anyOf ?? [] + const startInline = branches.find( + (branch) => { + const actions = branch.properties?.action?.enum + return Array.isArray(actions) && actions.includes("start") && branch.properties?.["spec"] !== undefined + }, + ) + const config = startInline?.properties?.["spec"]?.properties?.["config"] + const configBranches = config?.anyOf ?? [] + const blocksBranch = configBranches.find((branch) => branch.properties?.["blocks"] !== undefined) + const nodesBranch = configBranches.find((branch) => branch.properties?.["nodes"] !== undefined) + ;(evidence.transformed as Record)[name] = { + bytes: Buffer.byteLength(JSON.stringify(transformed), "utf8"), + branch_count: branches.length, + start_inline_spec_config_present: config !== undefined, + blocks_branch_fields: Object.keys(blocksBranch?.properties ?? {}), + block_item_fields: Object.keys(blocksBranch?.properties?.["blocks"]?.items?.properties ?? {}), + node_item_fields: Object.keys(nodesBranch?.properties?.["nodes"]?.items?.properties ?? {}), + } +} + +const out = path.join(import.meta.dir, "..", "test", "tool", "fixtures", "workflow-parameters-post-change.json") +await Bun.file(out).write(JSON.stringify(evidence, null, 2) + "\n") +console.log(JSON.stringify(evidence, null, 2)) diff --git a/packages/opencode/script/generate.ts b/packages/opencode/script/generate.ts index aa4ffdd976..c6b938b150 100644 --- a/packages/opencode/script/generate.ts +++ b/packages/opencode/script/generate.ts @@ -1,6 +1,7 @@ import { existsSync } from "fs" import path from "path" import { fileURLToPath } from "url" +import { dagTemplateDirectoryFailure, validateDagTemplateDirectory } from "./dag-template-validation" const __filename = fileURLToPath(import.meta.url) const __dirname = path.dirname(__filename) @@ -57,12 +58,15 @@ async function loadDagTemplatesData() { `DAG_TEMPLATES_DIR points to a missing directory: ${templatesDir} — check the release workflow's Extract Templates step path conversion`, ) } - const templates: Record = {} - for (const file of await Array.fromAsync(new Bun.Glob("*.yaml").scan({ cwd: templatesDir }))) { - const name = file.replace(/\.ya?ml$/, "") - templates[name] = await Bun.file(path.join(templatesDir, file)).text() - } - console.log(`Loaded dag templates snapshot from ${templatesDir}: ${Object.keys(templates).length} templates`) + const validation = await validateDagTemplateDirectory(templatesDir) + const failure = dagTemplateDirectoryFailure(validation) + if (failure) throw new Error(failure) + const templates = Object.fromEntries( + validation.results.map((entry) => [entry.name.replace(/\.ya?ml$/, ""), entry.content]), + ) + console.log( + `Loaded dag templates snapshot from ${templatesDir}: ${Object.keys(templates).length} templates (all validated)`, + ) return JSON.stringify(templates) } diff --git a/packages/opencode/script/package-cli-artifact.ts b/packages/opencode/script/package-cli-artifact.ts new file mode 100644 index 0000000000..4bfc59b053 --- /dev/null +++ b/packages/opencode/script/package-cli-artifact.ts @@ -0,0 +1,69 @@ +import fs from "node:fs/promises" +import path from "node:path" + +const distDir = process.argv[2] +const outArchive = process.argv[3] +if (!distDir || !outArchive) { + console.error("usage: package-cli-artifact.ts ") + process.exit(2) +} + +const resolvedDist = path.resolve(distDir) +const resolvedArchive = path.resolve(outArchive) +const binDir = path.join(resolvedDist, "bin") +const repoRoot = path.resolve(import.meta.dir, "..", "..", "..") +const distributionFiles = [ + "NOTICE", + "LICENSE", + "packages/core/src/dag/LICENSE", + "packages/opencode/src/dag/LICENSE", + "third_party/mattpocock-skills/LICENSE", + "third_party/mattpocock-skills/SOURCE.md", +] as const + +for (const name of distributionFiles) { + await fs.mkdir(path.dirname(path.join(binDir, name)), { recursive: true }) + await fs.copyFile(path.join(repoRoot, name), path.join(binDir, name)) +} + +const archive = resolvedArchive.endsWith(".tar.gz") + ? Bun.spawnSync({ + cmd: ["tar", "-czf", resolvedArchive, "-C", binDir, "."], + stdout: "pipe", + stderr: "pipe", + }) + : packageZip(binDir, resolvedArchive) + +if (archive.exitCode !== 0) { + process.stderr.write(archive.stderr.toString()) + console.error(`CLI packaging failed: ${resolvedArchive}`) + process.exit(1) +} + +console.log( + JSON.stringify({ + packager: "opencode cli packager v1", + archive: resolvedArchive, + distribution_files: distributionFiles, + }), +) + +function packageZip(directory: string, archive: string) { + const zip = Bun.which("zip") + if (zip) { + return Bun.spawnSync({ cmd: [zip, "-r", archive, "."], cwd: directory, stdout: "pipe", stderr: "pipe" }) + } + const sevenZip = Bun.which("7z") + if (sevenZip) { + return Bun.spawnSync({ cmd: [sevenZip, "a", archive, "."], cwd: directory, stdout: "pipe", stderr: "pipe" }) + } + const powershell = Bun.which("pwsh") ?? Bun.which("powershell") + if (!powershell) throw new Error("CLI packaging requires zip, 7z, pwsh, or powershell") + const destination = archive.replaceAll("'", "''") + return Bun.spawnSync({ + cmd: [powershell, "-NoProfile", "-Command", `Compress-Archive -Path * -DestinationPath '${destination}' -Force`], + cwd: directory, + stdout: "pipe", + stderr: "pipe", + }) +} diff --git a/packages/opencode/script/package-dag-templates.ts b/packages/opencode/script/package-dag-templates.ts new file mode 100644 index 0000000000..a2264f7bf7 --- /dev/null +++ b/packages/opencode/script/package-dag-templates.ts @@ -0,0 +1,103 @@ +/** + * Release packaging gate (change repair-workflow-authoring-validation, §6). + * + * One executable shape for the release-fork package-templates job: validate + * (fail closed) → copy validated root YAML plus provenance/license files → + * tar.gz → manifest JSON on + * stdout. release-fork.yml and the packaging smoke test invoke this same + * script, so CI and the test can never drift apart on the copy/tar contract. + * + * Usage: bun run script/package-dag-templates.ts + */ + +import fs from "node:fs/promises" +import os from "node:os" +import path from "node:path" +import { Schema } from "effect" + +const templatesDir = process.argv[2] +const outArchive = process.argv[3] +if (!templatesDir || !outArchive) { + console.error("usage: package-dag-templates.ts ") + process.exit(2) +} + +const resolvedDir = path.resolve(templatesDir) +const resolvedArchive = path.resolve(outArchive) +const distributionFiles = [ + "THIRD_PARTY_NOTICES.md", + "third_party/mattpocock-skills/LICENSE", + "third_party/mattpocock-skills/SOURCE.md", +] as const + +const PackagingReport = Schema.Struct({ + results: Schema.Array(Schema.Struct({ name: Schema.String, valid: Schema.Boolean })), + runtime_commit: Schema.optional(Schema.String), + template_commit: Schema.optional(Schema.String), + compat_runtime_sha: Schema.optional(Schema.String), +}) + +const validation = Bun.spawnSync({ + cmd: ["bun", path.join(import.meta.dir, "validate-dag-templates.ts"), resolvedDir], + cwd: path.resolve(import.meta.dir, ".."), + stdout: "pipe", + stderr: "pipe", +}) +process.stderr.write(validation.stderr.toString()) +if (validation.exitCode !== 0) { + console.error("Packaging aborted: template validation failed (nothing was archived).") + process.exit(validation.exitCode === 0 ? 1 : validation.exitCode) +} + +const report = Schema.decodeUnknownSync(PackagingReport)(JSON.parse(validation.stdout.toString())) +const files = report.results + .filter((entry) => entry.valid) + .map((entry) => entry.name) + .sort() +if (files.length === 0) { + console.error("Packaging aborted: no valid templates to archive.") + process.exit(1) +} + +const staging = await fs.mkdtemp(path.join(os.tmpdir(), "dag-template-dist-")) +try { + for (const name of files) { + await fs.copyFile(path.join(resolvedDir, name), path.join(staging, name)) + } + await fs.copyFile(path.join(resolvedDir, "runtime-compat.json"), path.join(staging, "runtime-compat.json")) + for (const name of distributionFiles) { + await fs.mkdir(path.dirname(path.join(staging, name)), { recursive: true }) + await fs.copyFile(path.join(resolvedDir, name), path.join(staging, name)) + } + const tar = Bun.spawnSync({ + cmd: ["tar", "-czf", resolvedArchive, "-C", staging, "."], + stdout: "pipe", + stderr: "pipe", + }) + if (tar.exitCode !== 0) { + process.stderr.write(tar.stderr.toString()) + console.error("Packaging aborted: tar failed.") + process.exit(1) + } +} finally { + await fs.rm(staging, { recursive: true, force: true }) +} + +console.log( + JSON.stringify( + { + packager: "opencode dag-template-packager v1", + archive: resolvedArchive, + files: [...files, "runtime-compat.json", ...distributionFiles].sort(), + template_files: files, + file_count: files.length + distributionFiles.length + 1, + template_count: files.length, + runtime_commit: report.runtime_commit, + template_commit: report.template_commit, + compat_runtime_sha: report.compat_runtime_sha, + }, + null, + 2, + ), +) +console.error(`Templates packaged: ${files.length} files (all validated) → ${resolvedArchive}`) diff --git a/packages/opencode/script/validate-dag-templates.ts b/packages/opencode/script/validate-dag-templates.ts new file mode 100644 index 0000000000..4eec643946 --- /dev/null +++ b/packages/opencode/script/validate-dag-templates.ts @@ -0,0 +1,64 @@ +/** + * Directory-level template validator (change repair-workflow-authoring-validation, §4.3). + * + * Reuses the runtime source-to-graph authority (WorkflowAuthoring) so + * config-repo CI, release packaging, and /dag-template-update all enforce the + * same portable contract. Emits machine-readable diagnostics plus the runtime, + * template, and compatibility commit identifiers, and exits non-zero when any + * template is invalid. + * + * Usage: bun run script/validate-dag-templates.ts + */ + +import path from "node:path" +import { dagTemplateDirectoryFailure, validateDagTemplateDirectory } from "./dag-template-validation" + +const templatesDir = process.argv[2] +if (!templatesDir) { + console.error("usage: validate-dag-templates.ts ") + process.exit(2) +} + +const resolvedDir = path.resolve(templatesDir) + +async function gitHead(cwd: string): Promise { + try { + const result = await Bun.$`git rev-parse HEAD`.cwd(cwd).quiet() + return result.text().trim() || undefined + } catch { + return undefined + } +} + +const validation = await validateDagTemplateDirectory(resolvedDir) +const invalid = validation.results.filter((entry) => !entry.valid) +const report = { + validator: "opencode WorkflowAuthoring.portable v1", + templates_dir: resolvedDir, + runtime_commit: await gitHead(path.resolve(import.meta.dir, "..", "..", "..")), + template_commit: await gitHead(resolvedDir), + compat_runtime_sha: validation.compat?.runtime_commit, + compat_error: validation.compat_error, + discovery_error: validation.discovery_error, + template_count: validation.results.length, + valid_count: validation.results.length - invalid.length, + invalid_count: invalid.length, + results: validation.results.map((entry) => ({ + name: entry.name, + valid: entry.valid, + errors: entry.errors, + warnings: entry.warnings, + })), +} + +// Machine-readable report goes to stdout; human summaries go to stderr so +// callers can `JSON.parse(stdout)` without stripping trailers. +console.log(JSON.stringify(report, null, 2)) +const failure = dagTemplateDirectoryFailure(validation) +if (failure) { + console.error(`Template validation failed: ${failure}`) + process.exit(1) +} +console.error( + `Template validation passed: ${validation.results.length} of ${validation.results.length} templates valid`, +) diff --git a/packages/opencode/src/dag/CONTEXT.md b/packages/opencode/src/dag/CONTEXT.md new file mode 100644 index 0000000000..063b7ade16 --- /dev/null +++ b/packages/opencode/src/dag/CONTEXT.md @@ -0,0 +1,44 @@ +# Workflow Orchestration Context + +Workflow Orchestration turns one user objective into one durable DAG. It supports saved or inline custom workflows and recommends heuristic composition from reusable Blocks. Low-level Nodes remain available when a Block route cannot express the objective. + +## Glossary + +| Term | Meaning | +| --- | --- | +| Workflow Source | An inline object or YAML document supplied to start, extend, replan, read, validate, or release tooling. | +| Workflow Authoring Check | The side-effect-free source-to-graph boundary that parses, normalizes file compatibility, decodes the action shape, compiles Blocks, applies the selected validation profile, and returns diagnostics or a Prepared Workflow Graph. | +| Prepared Workflow Graph | A strictly decoded and compiled graph that passed the requested authoring checks and is ready for a runtime mutation. | +| Workflow Route | A complete Block or Node composition selected for one objective. It may be custom, saved, or assembled heuristically. | +| Orchestration Router | The product-owned parent guidance that qualifies an objective and selects one Workflow Route without external Skill discovery. | +| Block Composer | The Orchestration Router decision that selects the smallest Block graph justified by current evidence. | +| Decision Checkpoint | One parent-owned confirmation for unresolved user choices that materially change behavior, scope, acceptance, or an irreversible boundary. | +| Workflow Brief | The recommended route, scope, acceptance evidence, assumptions, risks, and material alternatives presented at a Decision Checkpoint. | +| Block | A reusable high-level orchestration capability such as explore, plan, debug, coding, verify, or review. Blocks compile into Nodes. | +| Node | A low-level durable unit of child-agent work with dependencies, prompt input, policy, and output contract. | +| Validation Profile | `portable` checks source-contained structure without user environment state; `environment` additionally resolves live agents, prompt assets, and models. | +| Runtime Admission | The READY/WAIVED gate for a deep workflow. It is a lifecycle policy after authoring, not another name for Workflow Authoring Check. | + +## Invariants + +- One user objective has at most one live DAG; route expansion stays inside that DAG. +- Block composition is the recommended authoring path and is selected heuristically from the objective; custom Blocks/Nodes remain supported. +- Workflow Authoring Check is the only raw source-to-Prepared Workflow Graph authority used by tool actions, CLI, generation, and packaging. +- Parsing, file-only compatibility, strict action decoding, Block compilation, and profile diagnostics are not reimplemented by callers. +- `portable` validation does not load user environment catalogs. `environment` validation reads current catalogs and verifies actual model availability. +- No workflow event or durable mutation occurs before a valid Prepared Workflow Graph exists. +- The model-facing schema contains fields the model owns. Session/Project identity, admission audit state, model assignment, and other runtime-derived fields remain hidden. +- Legacy YAML may be adapted at the file boundary without making legacy fields valid inline input. +- Runtime Admission and Workflow Authoring Check have separate names, state, and responsibilities. + +## Boundaries + +- `WorkflowAuthoring` owns source interpretation and authoring diagnostics. +- `DagWorkflows` owns saved-source discovery, scope precedence, and presentation metadata; it does not decide startability. +- `Dag` owns durable lifecycle invariants, event publication, and runtime transitions for already prepared graphs. +- Provider/Agent/Skill/prompt catalogs own environment facts; the authoring boundary consumes current snapshots without becoming their source of truth. +- Release/config tooling invokes the same portable authoring boundary and adds repository compatibility and packaging gates. + +## Decisions + +- [ADR-0001: One Workflow Authoring Check authority](docs/adr/0001-workflow-authoring-check.md) diff --git a/packages/opencode/src/dag/authoring.ts b/packages/opencode/src/dag/authoring.ts new file mode 100644 index 0000000000..18fcceee85 --- /dev/null +++ b/packages/opencode/src/dag/authoring.ts @@ -0,0 +1,338 @@ +/** + * The only source-to-prepared-graph seam for workflow authoring. + * + * Callers authorize and read a source; this module owns every interpretation + * step after that boundary: YAML parsing, file-only legacy normalization, + * strict action decode, block compilation, profile validation, diagnostics, + * and content-addressed result caching. + */ +export * as WorkflowAuthoring from "./authoring" + +import { Effect, Schema } from "effect" +import type { NodeConfig, NodeDefaults, WorkflowConfig } from "./dag" +import type { AdmissionInput } from "./admission" +import { DagValidation } from "./validation" + +type Action = "start" | "extend" | "replan" + +type Source = { kind: "inline"; value: unknown; source?: string } | { kind: "yaml"; content: string; source: string } + +interface EnvironmentContext { + directory?: string + parent?: { id: string; providerID: string } +} + +type PreparedGraph = + | { + action: "start" + nodes: NodeConfig[] + title: string + config: Omit + admission?: AdmissionInput + } + | { action: "extend"; nodes: NodeConfig[] } + | { action: "replan"; nodes: NodeConfig[] } + +interface Result extends DagValidation.ValidationResult { + /** Strict decoded document. Boundary-owned legacy fields are not exposed. */ + document?: unknown + prepared?: PreparedGraph +} + +interface PrepareInput { + action: Action + source: Source + profile?: DagValidation.Profile + environment?: EnvironmentContext + known_dependencies?: string[] + node_defaults?: NodeDefaults +} + +interface Options { + loadEnvironment?: (context: EnvironmentContext) => Effect.Effect +} + +type DecodedAction = + | { action: "start"; spec: DagValidation.StartSpec } + | { action: "extend"; spec: DagValidation.ExtendGraph } + | { action: "replan"; spec: { fragment: DagValidation.StartGraph } } + +const VALIDATOR_VERSION = 1 +const ModelRef = Schema.Struct({ providerID: Schema.String, modelID: Schema.String }) +const decodeModelRef = Schema.decodeUnknownOption(ModelRef, DagValidation.STRICT_PARSE_OPTIONS) + +export function make(options: Options = {}) { + const cache = new Map() + + const prepare = (input: PrepareInput): Effect.Effect => + Effect.gen(function* () { + const profile = input.profile ?? "portable" + const sourceName = input.source.kind === "yaml" ? input.source.source : (input.source.source ?? "") + const key = cacheKey(input, profile) + // Environment catalogs are live state (models and agents may + // change during the tool instance), so only portable results are safe + // to cache by source content. + const cached = profile === "portable" ? cache.get(key) : undefined + if (cached) return cached + + const parsed = parseSource(input.source, input.action, profile) + if (!parsed.value) { + if (profile === "portable") cache.set(key, parsed.result) + return parsed.result + } + const decoded = decodeAction(input.action, parsed.value.value, sourceName, profile) + if (!decoded.value) { + const result = { ...decoded.result, document: parsed.value.value } + if (profile === "portable") cache.set(key, result) + return result + } + const compiled = compileAction(decoded.value, input.known_dependencies) + if (!compiled.nodes) { + const result = { ...invalidResult(sourceName, profile, compiled.diagnostics), document: decoded.value.spec } + if (profile === "portable") cache.set(key, result) + return result + } + if (profile === "environment" && !options.loadEnvironment) { + return { + ...invalidResult(sourceName, profile, [ + DagValidation.diagnostic({ + code: DagValidation.DIAGNOSTIC_CODES.environmentUnavailable, + path: "$environment", + message: "environment validation requires a live catalog loader", + hint: "Provide agents, prompt assets, and model resolution for environment validation", + }), + ]), + document: decoded.value.spec, + } + } + + const modeledNodes = applyNodeModels(compiled.nodes, parsed.value.nodes) + const nodes = + input.action === "replan" && parsed.value.defaultModel + ? modeledNodes.map((node) => (node.model ? node : { ...node, model: parsed.value.defaultModel })) + : modeledNodes + const baseDefaults = input.action === "start" ? compiled.node_defaults : input.node_defaults + const nodeDefaults = parsed.value.defaultModel + ? { ...baseDefaults, model: parsed.value.defaultModel } + : baseDefaults + const catalogs = + profile === "environment" && options.loadEnvironment + ? yield* options.loadEnvironment(input.environment ?? {}) + : undefined + const validation = yield* DagValidation.validatePostCompile({ + source: sourceName, + profile, + config: { + ...compiled.config, + ...(nodeDefaults ? { node_defaults: nodeDefaults } : {}), + }, + nodes, + blocks: compiled.blocks, + directory: input.environment?.directory, + catalogs, + structural: input.action === "start", + }) + const prepared = validation.valid ? prepareGraph(decoded.value, nodes, nodeDefaults) : undefined + const result = { + ...validation, + document: decoded.value.spec, + ...(prepared ? { prepared } : {}), + } satisfies Result + if (profile === "portable") cache.set(key, result) + return result + }) + + return { prepare } +} + +function prepareGraph(decoded: DecodedAction, nodes: NodeConfig[], nodeDefaults?: NodeDefaults): PreparedGraph { + if (decoded.action !== "start") return { action: decoded.action, nodes } + const spec = decoded.spec + return { + action: decoded.action, + nodes, + title: spec.title ?? spec.config.name, + config: { + name: spec.config.name, + mode: spec.mode ?? "standard", + ...(spec.config.max_concurrency !== undefined ? { max_concurrency: spec.config.max_concurrency } : {}), + ...(spec.config.max_node_replan_attempts !== undefined + ? { max_node_replan_attempts: spec.config.max_node_replan_attempts } + : {}), + ...(spec.config.max_total_nodes !== undefined ? { max_total_nodes: spec.config.max_total_nodes } : {}), + ...(nodeDefaults ? { node_defaults: nodeDefaults } : {}), + nodes, + }, + ...(spec.admission ? { admission: spec.admission } : {}), + } +} + +interface LegacyModels { + nodes: ReadonlyMap + defaultModel?: { modelID: string; providerID: string } +} + +interface ParsedValue extends LegacyModels { + value: unknown +} + +function parseSource( + source: Source, + action: Action, + profile: DagValidation.Profile, +): { value: ParsedValue; result?: never } | { value?: never; result: Result } { + if (source.kind === "inline") { + return { value: { value: source.value, nodes: new Map() } } + } + const parsed = DagValidation.parseYaml(source.content) + if (!parsed.parsed) { + return { result: invalidResult(source.source, profile, [parsed.diagnostic]) } + } + return { value: normalizeLegacyFile(action, parsed.value) } +} + +function decodeAction(action: Action, value: unknown, source: string, profile: DagValidation.Profile) { + const options = { + ...DagValidation.STRICT_PARSE_OPTIONS, + errors: "all", + } as const + if (action === "start") { + const decoded = Schema.decodeUnknownResult(DagValidation.StartSpec, options)(value) + if (decoded._tag === "Success") return { value: { action, spec: decoded.success } } as const + return { result: invalidResult(source, profile, DagValidation.schemaDiagnostics(decoded.failure)) } + } + if (action === "extend") { + const decoded = Schema.decodeUnknownResult(DagValidation.ExtendSpec, options)(value) + if (decoded._tag === "Success") return { value: { action, spec: decoded.success } } as const + return { result: invalidResult(source, profile, DagValidation.schemaDiagnostics(decoded.failure)) } + } + const decoded = Schema.decodeUnknownResult(DagValidation.ReplanSpec, options)(value) + if (decoded._tag === "Success") return { value: { action, spec: decoded.success } } as const + return { result: invalidResult(source, profile, DagValidation.schemaDiagnostics(decoded.failure)) } +} + +function compileAction( + decoded: DecodedAction, + knownDependencies?: string[], +): { + nodes?: NodeConfig[] + diagnostics: DagValidation.Diagnostic[] + blocks?: readonly import("./blocks").DagBlocks.WorkflowBlock[] + node_defaults?: NodeDefaults + config: { mode?: "standard" | "deep"; max_total_nodes?: number } +} { + if (decoded.action === "extend") { + const extend = decoded.spec + const compiled = DagValidation.compileBlockSource(extend, { known_dependencies: knownDependencies }) + return { + ...compiled, + blocks: "blocks" in extend ? extend.blocks : undefined, + config: {}, + } + } + const graph = decoded.action === "start" ? decoded.spec.config : decoded.spec.fragment + const compiled = DagValidation.compileGraphSource(graph, { known_dependencies: knownDependencies }) + return { + ...compiled, + blocks: "blocks" in graph ? graph.blocks : undefined, + node_defaults: graph.node_defaults, + config: decoded.action === "start" ? { ...graph, mode: decoded.spec.mode } : graph, + } +} + +function invalidResult( + source: string, + profile: DagValidation.Profile, + diagnostics: DagValidation.Diagnostic[], +): Result { + const errors = DagValidation.sortDiagnostics(diagnostics.filter((diagnostic) => diagnostic.severity === "error")) + return { + source, + profile, + valid: errors.length === 0, + errors, + warnings: DagValidation.sortDiagnostics(diagnostics.filter((diagnostic) => diagnostic.severity === "warning")), + nodes: [], + } +} + +function normalizeLegacyFile(action: Action, value: unknown): ParsedValue { + const stripped = action === "start" ? stripPersistedWorkflowFields(value) : value + if (!isRecord(stripped)) return { value: stripped, nodes: new Map() } + const graphKey = action === "start" ? "config" : action === "replan" ? "fragment" : undefined + const graph = graphKey ? stripped[graphKey] : stripped + const normalized = normalizeLegacyGraph(graph) + return { + value: graphKey ? { ...stripped, [graphKey]: normalized.graph } : normalized.graph, + nodes: normalized.nodes, + ...(normalized.defaultModel ? { defaultModel: normalized.defaultModel } : {}), + } +} + +function normalizeLegacyGraph(value: unknown): { + graph: unknown + nodes: Map + defaultModel?: { modelID: string; providerID: string } +} { + if (!isRecord(value)) return { graph: value, nodes: new Map() } + const nodeModels = new Map() + const nodes = Array.isArray(value.nodes) + ? value.nodes.map((node) => { + if (!isRecord(node)) return node + const model = decodeModelRef(node.model) + if (model._tag === "None" || typeof node.id !== "string") return node + nodeModels.set(node.id, model.value) + const normalized = { ...node } + delete normalized.model + return normalized + }) + : value.nodes + const defaults = isRecord(value.node_defaults) ? { ...value.node_defaults } : value.node_defaults + const defaultModel = isRecord(defaults) ? decodeModelRef(defaults.model) : undefined + if (isRecord(defaults) && defaultModel?._tag === "Some") delete defaults.model + return { + graph: { + ...value, + ...(nodes ? { nodes } : {}), + ...(defaults ? { node_defaults: defaults } : {}), + }, + nodes: nodeModels, + ...(defaultModel?._tag === "Some" ? { defaultModel: defaultModel.value } : {}), + } +} + +function stripPersistedWorkflowFields(value: unknown) { + if (!isRecord(value) || !isRecord(value.admission)) return value + const admission = { ...value.admission } + delete admission.protocol_version + delete admission.state + delete admission.fingerprint + return { ...value, admission } +} + +function applyNodeModels(nodes: NodeConfig[], models: LegacyModels["nodes"]) { + return nodes.map((node) => { + const model = models.get(node.id) + return model ? { ...node, model } : node + }) +} + +function cacheKey(input: PrepareInput, profile: DagValidation.Profile) { + const content = + input.source.kind === "yaml" ? input.source.content : (JSON.stringify(input.source.value) ?? "undefined") + const context = JSON.stringify({ + version: VALIDATOR_VERSION, + action: input.action, + profile, + source: input.source.kind === "yaml" ? input.source.source : (input.source.source ?? ""), + directory: input.environment?.directory, + parent: input.environment?.parent, + known_dependencies: input.known_dependencies, + node_defaults: input.node_defaults, + }) + return new Bun.CryptoHasher("sha256").update(`${context}\0${content}`).digest("hex") +} + +function isRecord(value: unknown): value is Record { + return value !== null && typeof value === "object" && !Array.isArray(value) +} diff --git a/packages/opencode/src/dag/blocks.ts b/packages/opencode/src/dag/blocks.ts index b88415b434..ecc66d0775 100644 --- a/packages/opencode/src/dag/blocks.ts +++ b/packages/opencode/src/dag/blocks.ts @@ -25,9 +25,6 @@ export class WorkflowBlock extends Schema.Class("WorkflowBlock")( instruction: Schema.optional(Schema.String).annotate({ description: "Task-specific instruction added to the block's built-in execution contract", }), - skills: Schema.optional(Schema.Array(Schema.String)).annotate({ - description: "Relevant skills the child should load lazily before working", - }), worker_type: Schema.optional(Schema.String).annotate({ description: "Optional configured agent override; defaults from the block kind", }), @@ -99,20 +96,20 @@ const WRITER_KINDS = new Set(["coding", "prototype"]) const BLOCK_CONTRACTS: Record = { explore: - "Inspect the target read-only. Map relevant modules, constraints, existing conventions, and evidence with file references. Do not implement.", - plan: "Produce an implementation-ready plan from repository evidence and dependency outputs. Name seams, work packages, acceptance checks, and unresolved risks. Do not implement.", + "Inspect the target read-only and prefer primary repository or runtime evidence. Separate confirmed facts, inferences, and unknowns; map ownership, constraints, conventions, and file references. Return an evidence map that downstream blocks can cite. Do not implement or hide unresolved uncertainty.", + plan: "Produce a decision- or implementation-ready plan from repository evidence and dependency outputs. State the selected boundary, ordered options or work packages, dependencies, acceptance checks, falsifiers, and unresolved risks. Stop rather than inventing a user-owned product decision. Do not implement.", prototype: - "Build only the smallest throwaway experiment needed to answer the stated uncertainty. Separate observations from production recommendations and do not integrate it unless explicitly instructed. Submit its changed-file list and a stable fingerprint so downstream verification and review can bind to the exact experiment.", + "Answer one falsifiable uncertainty with the smallest disposable experiment. State the hypothesis and success signal first, separate observations from inference, and do not integrate prototype code unless explicitly promoted by confirmed scope. Submit its changed-file list and a stable fingerprint so downstream verification and review bind to the exact experiment.", debug: - "Diagnose the smallest falsifiable root-cause hypothesis from reproduced evidence. Distinguish cause from symptom and identify the narrowest safe repair plus a regression check.", + "Minimize the reproduced failure, rank falsifiable hypotheses, instrument the discriminating boundary, and identify the smallest causal explanation. Distinguish cause from symptom and correlated damage. Return the narrowest safe repair boundary and a regression check that would fail without that repair; stop if evidence does not establish a cause.", coding: - "Implement the bounded production change. Follow repository instructions, preserve unrelated work, add or update focused tests, and run relevant checks. Submit the aggregate changed-file list and a stable fingerprint of the actual implementation state so downstream verification and review can detect stale evidence.", + "Implement only the bounded production change and preserve unrelated work. When an observable automated seam exists, establish a failing check, make the smallest change that passes it, then refactor without breaking the check; otherwise record the evidence-backed reason before implementation. Run focused checks and stop on ownership or interface drift. Submit the aggregate changed-file list and a stable fingerprint of the actual implementation state.", verify: - "Verify the supplied work against acceptance criteria using deterministic checks where available. Submit commands and evidence with an explicit PASS or FAIL verdict. Do not hide failures.", + "Verify the supplied work against every acceptance criterion using deterministic checks where available. Bind evidence to the supplied implementation fingerprint and submit exact commands, results, and an explicit PASS or FAIL verdict. Missing evidence or any failed required check is FAIL; do not repair or hide failures in this block.", review: - "Review independently against repository standards and the confirmed intent. Cite concrete evidence, separate blockers from suggestions, and identify claims that still need verification.", + "Review independently against repository standards and the confirmed intent. Bind findings to the supplied implementation fingerprint, cite concrete evidence, separate required actions from suggestions, and reject stale, duplicated, or unsupported claims. Do not implement fixes inside the review lane.", synthesize: - "Combine dependency outputs into one decision-ready result. Resolve conflicts using evidence, preserve material uncertainty, and state the outcome, rationale, residual risks, and next action.", + "Combine dependency outputs into one decision-ready result. Resolve conflicts by evidence strength, preserve material uncertainty, and state the outcome, rationale, acceptance evidence, residual risks, and next action. Do not invent consensus or new facts absent from dependency evidence.", } export function compileWorkflowBlocks( @@ -150,7 +147,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies, objective, instruction: block.instruction, - skills: block.skills, contract: "Reproduce or characterize the failure read-only where possible. Capture exact symptoms, commands, logs, boundaries, and the smallest falsifiable observations. Do not patch the code.", required: false, @@ -164,7 +160,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies: [evidenceID], objective, instruction: block.instruction, - skills: block.skills, contract: BLOCK_CONTRACTS.debug, required: block.required ?? true, reportToParent: block.report_to_parent ?? false, @@ -192,7 +187,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies, objective, instruction: block.instruction, - skills: block.skills, contract: `${BLOCK_CONTRACTS.review} Focus on documented repository standards, architecture constraints, correctness, and verification evidence.`, required: false, reportToParent: false, @@ -206,7 +200,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies, objective, instruction: block.instruction, - skills: block.skills, contract: `${BLOCK_CONTRACTS.review} Focus on the confirmed goal, scope, acceptance criteria, and user-visible behavior.`, required: false, reportToParent: false, @@ -220,7 +213,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies: [standardsID, intentID, ...(route ? [route.verification.id] : [])], objective, instruction: block.instruction, - skills: block.skills, contract: [ "Arbitrate the two independent reviews finding by finding.", route @@ -258,7 +250,6 @@ function compileBlock(objective: string, block: WorkflowBlock, blocks: WorkflowB dependencies, objective, instruction: block.instruction, - skills: block.skills, contract: BLOCK_CONTRACTS[block.kind], required, reportToParent: block.report_to_parent ?? block.kind === "synthesize", @@ -279,7 +270,6 @@ function node(input: { dependencies: readonly string[] objective: string instruction?: string - skills?: readonly string[] contract: string required: boolean reportToParent: boolean @@ -288,9 +278,6 @@ function node(input: { review?: NodeConfig["review"] outputSchema?: Record }): NodeConfig { - const skillInstruction = input.skills?.length - ? `Before working, load these relevant skills with the skill tool when available: ${input.skills.join(", ")}. If one is unavailable, state that limitation and continue from repository evidence.` - : "" const instruction = input.instruction?.trim() ? "Block-specific instruction:\n{{instruction}}" : "" return { id: input.id, @@ -303,7 +290,6 @@ function node(input: { inline: [ "Workflow objective:\n{{objective}}", instruction, - skillInstruction, input.contract, "Use dependency outputs as evidence and return a concise artifact that downstream blocks can consume. Do not ask the user questions from this child session.", ] @@ -374,7 +360,6 @@ function serializeWorkspaceWriters(blocks: WorkflowBlock[]) { kind: block.kind, depends_on: [...(block.depends_on ?? []), previous], instruction: block.instruction, - skills: block.skills, worker_type: block.worker_type, required: block.required, report_to_parent: block.report_to_parent, diff --git a/packages/opencode/src/dag/dag.ts b/packages/opencode/src/dag/dag.ts index 1545a2d5bc..ab03a1915d 100644 --- a/packages/opencode/src/dag/dag.ts +++ b/packages/opencode/src/dag/dag.ts @@ -9,9 +9,7 @@ import { EventV2Bridge } from "@/event-v2-bridge" import { Database } from "@opencode-ai/core/database/database" import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" import { isRecord } from "@/util/record" -import { validateRequiredNodes } from "@opencode-ai/core/dag/core/required-validator" -import { buildGraph, WorkflowRuntime, toSchedulingNodes } from "@opencode-ai/core/dag/core/scheduling" -import { CycleError } from "@opencode-ai/core/dag/core/graph" +import { WorkflowRuntime, toSchedulingNodes } from "@opencode-ai/core/dag/core/scheduling" import { planReplan } from "@opencode-ai/core/dag/core/replan" import { getValidNextWorkflowStatuses, @@ -29,10 +27,10 @@ import { transitionAdmission, validateAdmission, } from "./admission" -import { unresolvedReviewOutcomes, validateReviewLifecycle } from "./review-lifecycle" -import { conditionReference } from "./runtime/eval" -import { unsupportedSchemaKeywords } from "./runtime/capture" -import { placeholderKeys } from "./templates/resolve" +import { unresolvedReviewOutcomes } from "./review-lifecycle" +import { DagValidation, StructuralValidationError } from "./validation" + +export { StructuralValidationError } from "./validation" // Re-export domain types export const ID = DagEvent.DagID @@ -63,7 +61,7 @@ export interface NodeConfig { name: string worker_type: string depends_on: string[] - required: boolean + required?: boolean prompt_template: { id?: string; inline?: string; input?: Record } worker_config?: { timeout_ms?: number } input_mapping?: Record @@ -87,6 +85,10 @@ export interface NodeDefaults { model?: { modelID: string; providerID: string } } +interface NormalizedNodeConfig extends NodeConfig { + required: boolean +} + export interface WorkflowConfig { name: string mode?: ExecutionMode @@ -142,7 +144,7 @@ function normalizeNodeDefaults(defaults: NodeDefaults | undefined): NodeDefaults } } -function normalizeNodeConfig(node: NodeConfig, defaults: NodeDefaults): NodeConfig { +function normalizeNodeConfig(node: NodeConfig, defaults: NodeDefaults): NormalizedNodeConfig { const model = normalizeModel(node.model ?? defaults.model) return { ...node, @@ -162,13 +164,17 @@ function normalizeNodeConfig(node: NodeConfig, defaults: NodeDefaults): NodeConf // back to 10min — implicit budget shortening). The replace bucket (definition // replaced, execution kept) preserves the existing node's timeout for the // merged config and the deadline recompute. -function normalizeFragmentNode(node: NodeConfig, existingTimeoutMs: number | undefined, defaults: NodeDefaults): NodeConfig { +function normalizeFragmentNode( + node: NodeConfig, + existingTimeoutMs: number | undefined, + defaults: NodeDefaults, +): NormalizedNodeConfig { const timeoutMs = node.worker_config?.timeout_ms ?? existingTimeoutMs const withTimeout = timeoutMs == null ? node : { ...node, worker_config: { ...node.worker_config, timeout_ms: timeoutMs } } return normalizeNodeConfig(withTimeout, defaults) } -function normalizeWorkflowConfig(config: WorkflowConfig): WorkflowConfig { +function normalizeWorkflowConfig(config: WorkflowConfig): WorkflowConfig & { nodes: NormalizedNodeConfig[] } { const defaults = normalizeNodeDefaults(config.node_defaults) return { ...config, @@ -232,62 +238,11 @@ export function parseWorkflowConfig(raw: string): WorkflowConfig | undefined { return parsed.value as WorkflowConfig } -/** - * A parseable condition may only reference the node's direct dependencies — - * anything else silently resolves to undefined and evaluates false at spawn - * time. Shared by create (all nodes) and replan (fragment nodes). - */ -function conditionReferenceErrors(nodes: readonly NodeConfig[]): string[] { - return nodes.flatMap((node) => { - const ref = conditionReference(node.condition) - if (!ref || node.depends_on.includes(ref)) return [] - return [ - `node "${node.id}" condition references "${ref}" which is not in its depends_on (condition inputs come from direct dependencies only; this would silently evaluate false)`, - ] - }) -} - -/** - * An inline prompt_template may only reference variables that have a binding - * source: static prompt_template.input keys, input_mapping target names, or — - * when input_mapping is omitted — the direct depends_on ids that feed the - * spawn-time input. Anything else is guaranteed to die at spawn (verdict_fail: - * Unresolved template placeholders), so rejecting at acceptance removes the - * "Added, then spawn-dead" silent window. `id` templates are read lazily from - * disk and cannot be binding-checked here; spawn-time enforcement still - * covers them. - */ -function templateBindingErrors(nodes: readonly NodeConfig[]): string[] { - return nodes.flatMap((node) => { - const template = node.prompt_template.inline - if (template === undefined) return [] - const bound = new Set([ - ...Object.keys(node.prompt_template.input ?? {}), - ...Object.keys(node.input_mapping ?? Object.fromEntries(node.depends_on.map((dep) => [dep, dep]))), - ]) - return placeholderKeys(template) - .filter((key) => !bound.has(key)) - .map((key) => - `node "${node.id}" prompt_template references unbound variable "{{${key}}}" (bind it via prompt_template.input, input_mapping, or depends_on)`, - ) - }) -} - -// The runtime validator enforces a JSON Schema subset; anything outside it is -// inert. Warn (not reject) at create/replan so authors learn their constraint -// won't fire before a payload silently sails past it. -function warnUnsupportedSchemaKeywords(nodes: readonly NodeConfig[]) { - return Effect.forEach( - nodes.flatMap((node) => { - if (!node.output_schema) return [] - const keywords = unsupportedSchemaKeywords(node.output_schema) - return keywords.length > 0 ? [{ nodeID: node.id, keywords }] : [] - }), - (hit) => - Effect.logWarning("output_schema uses keywords the subset validator does not enforce — they will be ignored at runtime", hit), - { discard: true }, - ) -} +// Structural validation (duplicate ids, dangling/condition references, +// template bindings, ceilings, review lifecycle, required-node and full-graph +// cycles) lives in the shared validation authority so create, replan, and the +// workflow validate action all enforce the same invariants with the same +// codes and field paths. export interface Interface { readonly create: (input: { @@ -383,37 +338,23 @@ export const layer = Layer.effect( config: WorkflowConfig }) { const config = normalizeWorkflowConfig(input.config) - // Structural validation first (mirrors planReplan's fragment checks so - // create and replan reject the same malformed shapes): duplicate ids - // would silently merge via the projector's upsert, and a dangling - // depends_on reference would silently drop the edge in buildGraph — - // turning a typo'd dependency into an immediately-runnable root node. - const ids = config.nodes.map((n) => n.id) - const idSet = new Set(ids) - if (idSet.size !== ids.length) { - const duplicates = [...new Set(ids.filter((id, index) => ids.indexOf(id) !== index))] - return yield* Effect.fail(new Error(`Invalid workflow config: duplicate node ids: ${duplicates.join(", ")}`)) - } - const danglingDeps = config.nodes.flatMap((n) => - n.depends_on.filter((dep) => !idSet.has(dep)).map((dep) => `node "${n.id}" depends on unknown node "${dep}"`), - ) - if (danglingDeps.length > 0) { - return yield* Effect.fail(new Error(`Invalid workflow config: ${danglingDeps.join("; ")}`)) - } - const conditionErrors = conditionReferenceErrors(config.nodes) - if (conditionErrors.length > 0) { - return yield* Effect.fail(new Error(`Invalid workflow config: ${conditionErrors.join("; ")}`)) - } - const bindingErrors = templateBindingErrors(config.nodes) - if (bindingErrors.length > 0) { - return yield* Effect.fail(new Error(`Invalid workflow config: ${bindingErrors.join("; ")}`)) + // Structural validation first, via the shared authority (the same one + // the workflow validate action runs): duplicate ids would silently + // merge via the projector's upsert, and a dangling depends_on reference + // would silently drop the edge in buildGraph — turning a typo'd + // dependency into an immediately-runnable root node. Rejection happens + // before any event publication. + const structural = DagValidation.structuralDiagnostics({ + nodes: config.nodes, + mode: config.mode, + max_total_nodes: config.max_total_nodes, + }) + const structuralErrors = DagValidation.sortLegacyStructural(structural.filter((d) => d.severity === "error")) + for (const warning of structural.filter((d) => d.severity === "warning")) { + yield* Effect.logWarning("DAG structural validation diagnostic", { diagnostic: warning }) } - yield* warnUnsupportedSchemaKeywords(config.nodes) - // Enforce the total node ceiling at creation, not only on replan — the - // ceiling is a lifetime cap and the initial graph counts toward it. - const maxTotalNodes = config.max_total_nodes ?? DEFAULT_WORKFLOW_CONFIG.maxTotalNodes - if (config.nodes.length > maxTotalNodes) { - return yield* Effect.fail(new Error(`Total node ceiling exceeded: ${config.nodes.length} nodes > ${maxTotalNodes} max`)) + if (structuralErrors.length > 0) { + return yield* Effect.fail(new StructuralValidationError({ diagnostics: structuralErrors })) } if (config.mode === "deep") { if (!config.admission) { @@ -445,37 +386,6 @@ export const layer = Layer.effect( }, } : config - const reviewLifecycle = validateReviewLifecycle(durableConfig) - if (!reviewLifecycle.valid) { - return yield* Effect.fail(new Error( - `Invalid review lifecycle: ${reviewLifecycle.errors.join("; ")}`, - )) - } - for (const warning of reviewLifecycle.warnings) { - yield* Effect.logWarning("DAG review lifecycle diagnostic", { warning }) - } - const validation = validateRequiredNodes({ - nodes: durableConfig.nodes.map((n) => ({ id: n.id, depends_on: n.depends_on, required: n.required })), - }) - if (!validation.valid) return yield* Effect.fail(new Error(`Invalid workflow config: ${validation.errors.join("; ")}`)) - - // Full-graph cycle detection — validates ALL nodes (not just required), - // so a cycle among optional nodes cannot silently create a zombie graph. - // buildGraph throws CycleError via addEdge's wouldCreateCycle pre-check. - const cyclePath: string[] | null = yield* Effect.sync(() => { - try { - const graph = buildGraph( - durableConfig.nodes.map((n) => ({ id: n.id, dependsOn: n.depends_on, status: "pending" as const, required: n.required })), - ) - return graph.hasCycle() ? (graph.findCycles()[0] ?? null) : null - } catch (e) { - if (e instanceof CycleError) return e.cycle - throw e - } - }) - if (cyclePath) { - return yield* Effect.fail(new Error(`Workflow config contains a dependency cycle: ${cyclePath.join(" -> ")}`)) - } const dagID = DagEvent.DagID.create() const ts = yield* DateTime.now @@ -627,38 +537,29 @@ export const layer = Layer.effect( const status = nodeStatusById.get(n.id) return status === undefined || !isNodeTerminalStatus(status as NodeStatus) }) - const conditionErrors = conditionReferenceErrors(rerunNodes) - if (conditionErrors.length > 0) { - return yield* Effect.fail(new Error(`Replan rejected: ${conditionErrors.join("; ")}`)) - } - const bindingErrors = templateBindingErrors(rerunNodes) - if (bindingErrors.length > 0) { - return yield* Effect.fail(new Error(`Replan rejected: ${bindingErrors.join("; ")}`)) - } - yield* warnUnsupportedSchemaKeywords(normalizedFragment.nodes) + // Structural validation through the SAME authority as create — condition, + // binding, dangling-dep, ceiling, review-lifecycle, and topology checks + // all run through DagValidation.replanStructuralDiagnostics (which reuses + // the exact same helper functions as structuralDiagnostics). This is the + // create/replan parity the spec requires: one authority, two entry points + // that differ only in scoping (fragment + rerun-only vs whole-graph). const maxReplanAttempts = wfConfig?.max_node_replan_attempts ?? DEFAULT_WORKFLOW_CONFIG.maxNodeReplanAttempts - const maxTotalNodes = wfConfig?.max_total_nodes ?? DEFAULT_WORKFLOW_CONFIG.maxTotalNodes - - // Enforce total node ceiling BEFORE any event publication so a rejected - // replan leaves no durable side effects. Count ALL nodes ever registered - // (cumulative lifetime) — terminal nodes still count toward the cap. - if (nodes.length + plan.add.length > maxTotalNodes) { - return yield* Effect.fail(new Error(`Total node ceiling exceeded: ${nodes.length} existing + ${plan.add.length} new > ${maxTotalNodes} max`)) + const replanDiagnostics = DagValidation.replanStructuralDiagnostics({ + fragmentNodes: normalizedFragment.nodes, + rerunNodes, + existingNodeIds: new Set(nodes.map((n) => n.id)), + existingNodeCount: nodes.length, + addCount: plan.add.length, + merged: wfConfig ? computeMergedConfig(wfConfig, normalizedFragment, plan) : { nodes: normalizedFragment.nodes }, + config: { mode: wfConfig?.mode, max_total_nodes: wfConfig?.max_total_nodes }, + }) + const replanErrors = DagValidation.sortLegacyStructural(replanDiagnostics.filter((d) => d.severity === "error")) + for (const warning of replanDiagnostics.filter((d) => d.severity === "warning")) { + yield* Effect.logWarning("DAG structural validation diagnostic", { diagnostic: warning }) } - - if (wfConfig) { - const reviewLifecycle = validateReviewLifecycle( - computeMergedConfig(wfConfig, normalizedFragment, plan), - ) - if (!reviewLifecycle.valid) { - return yield* Effect.fail(new Error( - `Invalid review lifecycle: ${reviewLifecycle.errors.join("; ")}`, - )) - } - for (const warning of reviewLifecycle.warnings) { - yield* Effect.logWarning("DAG review lifecycle diagnostic", { warning }) - } + if (replanErrors.length > 0) { + return yield* Effect.fail(new StructuralValidationError({ diagnostics: replanErrors })) } const nodeById = new Map(nodes.map((n) => [n.id, n])) diff --git a/packages/opencode/src/dag/docs/adr/0001-workflow-authoring-check.md b/packages/opencode/src/dag/docs/adr/0001-workflow-authoring-check.md new file mode 100644 index 0000000000..5c1779590b --- /dev/null +++ b/packages/opencode/src/dag/docs/adr/0001-workflow-authoring-check.md @@ -0,0 +1,33 @@ +# ADR-0001: One Workflow Authoring Check authority + +- Status: Accepted +- Date: 2026-08-11 + +## Context + +Workflow input was interpreted independently by the provider-facing tool schema, start, validate, list/read, replan, CLI, generation, and packaging. Hidden YAML authoring removed the model's accidental examples while leaving it unable to infer required fields. Later patches added validators at individual callers, so accepted shapes and diagnostics drifted and some paths reached durable DAG operations before equivalent checks had run. + +The product supports a single custom workflow, saved workflows, and heuristic Block composition. Those are source choices for one orchestration product, not separate validation systems. + +## Decision + +`WorkflowAuthoring` is the only raw Workflow Source to Prepared Workflow Graph boundary. It owns YAML parsing, file-only legacy normalization, action-specific strict decoding, Block compilation, portable/environment validation, stable diagnostics, and safe result caching. + +All tool graph actions and offline config/release consumers call this boundary. Callers may authorize and read files or perform durable DAG mutations, but they do not reinterpret source shape or decide graph validity. + +The provider schema exposes only author-owned fields. Runtime identity, model assignment, and persisted admission audit fields are derived or adapted behind the boundary. Portable checks are environment-free; environment checks resolve live catalogs and are not cached as content-only facts. + +## Consequences + +- A valid source has one compiled meaning across validate, start, extend, replan, read/list diagnostics, CI, generation, and packaging. +- Provider schema is sufficient for model authoring without exposing runtime-owned fields. +- Legacy YAML remains readable while new inline input stays strict. +- Environment changes are observed on the next environment check. +- Durable DAG methods retain lifecycle validation as defense in depth, but do not become a second raw-source validator. + +## Alternatives Considered + +- Keep validators per caller: rejected because fixes and diagnostics drift across runtime and release paths. +- Publish the persisted YAML shape directly to the model: rejected because compatibility/audit/runtime fields are discoverable but not model-owned. +- Make every check environment-aware: rejected because config CI and portable assets must not depend on user-global agents, skills, prompts, or models. +- Remove low-level custom Nodes: rejected because Blocks are the recommended composition interface, not the only expressible workflow form. diff --git a/packages/opencode/src/dag/templates/resolve.ts b/packages/opencode/src/dag/templates/resolve.ts index b0fb31c936..fc0b1c3fd4 100644 --- a/packages/opencode/src/dag/templates/resolve.ts +++ b/packages/opencode/src/dag/templates/resolve.ts @@ -50,13 +50,19 @@ export function resolveTemplate(ref: TemplateRef, projectDir: string): Effect.Ef return renderTemplate(ref, projectDir).pipe(Effect.map((result) => result.text)) } +/** Read a template asset by id without interpolation — validation needs the + * raw source to check placeholder bindings before any node spawn. */ +export function templateSourceById(id: string, projectDir: string): Effect.Effect { + return readById(id, projectDir) +} + export function renderTemplate( ref: TemplateRef, projectDir: string, dynamicInput: Record = {}, ) { return Effect.gen(function* () { - const input = sanitizeInput({ ...dynamicInput, ...(ref.input ?? {}) }) + const input = sanitizeInput({ ...dynamicInput, ...ref.input }) const raw = yield* readTemplateSource(ref, projectDir) return interpolate(raw, input) }) @@ -106,7 +112,10 @@ function interpolate(template: string, input: Record) { const text = template.replace(INTERPOLATION_RE, (match, key: string) => { const value = input[key] if (value !== null && value !== undefined) { - return typeof value === "object" ? JSON.stringify(value, null, 2) : String(value) + if (typeof value === "object") return JSON.stringify(value, null, 2) + if (typeof value === "symbol") return value.description ?? "" + if (typeof value === "function") return value.name + return value.toString() } unresolvedPlaceholders.push(key) return match diff --git a/packages/opencode/src/dag/validation.ts b/packages/opencode/src/dag/validation.ts new file mode 100644 index 0000000000..ace5701901 --- /dev/null +++ b/packages/opencode/src/dag/validation.ts @@ -0,0 +1,943 @@ +/** + * Workflow spec validation authority. + * + * Side-effect-free rule core shared by WorkflowAuthoring and Dag.create / + * Dag.replan. Raw source orchestration belongs exclusively to + * WorkflowAuthoring; this module never chooses or reads a source. + * + * Profiles: + * - portable — proves a spec can be distributed on its own (no dependency on + * one user's project prompts, models, or agents); + * - environment — portable plus resolution against the current project/global + * prompt directories and the agent/skill/model catalogs. + * + * Validation never creates workflows, publishes DAG events, registers nodes, + * spawns child sessions, or writes files. + */ + +export * as DagValidation from "./validation" + +import { Effect, Option, Schema } from "effect" +import { buildGraph } from "@opencode-ai/core/dag/core/scheduling" +import { CycleError } from "@opencode-ai/core/dag/core/graph" +import { validateRequiredNodes } from "@opencode-ai/core/dag/core/required-validator" +import type { NodeConfig } from "./dag" +import { DEFAULT_WORKFLOW_CONFIG } from "./dag" +import { DagBlocks } from "./blocks" +import { AdmissionInput, ExecutionMode } from "./admission" +import { validateReviewLifecycle } from "./review-lifecycle" +import { conditionReference } from "./runtime/eval" +import { unsupportedSchemaKeywords } from "./runtime/capture" +import { placeholderKeys, templateSourceById } from "./templates/resolve" + +// ============================================================================ +// Diagnostic contract +// ============================================================================ + +export const DIAGNOSTIC_CODES = { + schemaInvalid: "schema.invalid", + // Reserved vocabulary from the design: source exclusivity is enforced by the + // discriminated parameter schema before any diagnostic path runs. + graphSourceConflict: "graph.source_conflict", + blockCompileFailed: "block.compile_failed", + dagInvalid: "dag.invalid", + promptUnboundVariable: "prompt.unbound_variable", + promptMissingAsset: "prompt.missing_asset", + promptNonportableAsset: "prompt.nonportable_asset", + workerUnknown: "worker.unknown", + modelUnavailable: "model.unavailable", + environmentUnavailable: "environment.unavailable", + schemaKeywordWarning: "schema.keyword_warning", +} as const + +export type DiagnosticCode = (typeof DIAGNOSTIC_CODES)[keyof typeof DIAGNOSTIC_CODES] + +export const DiagnosticCodeSchema = Schema.Literals(Object.values(DIAGNOSTIC_CODES)) + +export const DiagnosticSchema = Schema.Struct({ + severity: Schema.Literals(["error", "warning"]), + code: DiagnosticCodeSchema, + /** Field or asset path, e.g. `config.blocks` or `nodes[verify].prompt_template.id`. */ + path: Schema.String, + message: Schema.String, + hint: Schema.String, +}) +export type Diagnostic = typeof DiagnosticSchema.Type + +/** Structural validation errors carry the shared diagnostics so callers can + * compare validate/start/replan rejections code by code (spec: one authority). */ +export class StructuralValidationError extends Schema.TaggedErrorClass()( + "StructuralValidationError", + { diagnostics: Schema.mutable(Schema.Array(DiagnosticSchema)) }, +) { + /** The message text tools and tests have always seen, derived from the + * shared diagnostic messages. The legacy render format is decided at + * construction time via the legacy-class tag — never by re-parsing + * message text. */ + override get message() { + return this.diagnostics.map((d) => legacyValidationMessage(d)).join("; ") + } +} + +export type Profile = "portable" | "environment" + +export interface CompiledNodeSummary { + id: string + name: string + worker_type: string + depends_on: string[] + required: boolean + report_to_parent: boolean + has_output_schema: boolean + review_phase?: "design" | "diff" +} + +export interface ValidationResult { + source: string + profile: Profile + valid: boolean + errors: Diagnostic[] + warnings: Diagnostic[] + nodes: CompiledNodeSummary[] +} + +export function diagnostic(input: { + severity?: "error" | "warning" + code: DiagnosticCode + path: string + message: string + hint?: string +}): Diagnostic { + return { + severity: input.severity ?? "error", + code: input.code, + path: input.path, + message: input.message, + hint: input.hint ?? "", + } +} + +/** Stable ordering: field path, then code, then message. Same input always + * yields the same diagnostic order, so validate output is diffable. */ +export function sortDiagnostics(diagnostics: Diagnostic[]): Diagnostic[] { + return [...diagnostics].sort( + (a, b) => a.path.localeCompare(b.path) || a.code.localeCompare(b.code) || a.message.localeCompare(b.message), + ) +} + +export type YamlParseResult = { parsed: true; value: unknown } | { parsed: false; diagnostic: Diagnostic } + +/** YAML parsing belongs to the validation authority so the workflow tool, + * config CI, generation, and release packaging cannot drift on parse-error + * codes or paths. */ +export function parseYaml(content: string): YamlParseResult { + try { + return { parsed: true, value: Bun.YAML.parse(content) } + } catch { + return { + parsed: false, + diagnostic: diagnostic({ + code: DIAGNOSTIC_CODES.schemaInvalid, + path: "$", + message: "file is not parseable YAML", + hint: "Fix the YAML syntax before validation can run", + }), + } + } +} + +function summarizeNodes(nodes: readonly NodeConfig[]): CompiledNodeSummary[] { + return nodes.map((node) => ({ + id: node.id, + name: node.name, + worker_type: node.worker_type, + depends_on: [...node.depends_on], + required: node.required ?? false, + report_to_parent: node.report_to_parent ?? false, + has_output_schema: node.output_schema !== undefined, + ...(node.review ? { review_phase: node.review.phase } : {}), + })) +} + +// ============================================================================ +// Spec schemas — the single decode authority for inline and file-backed input +// ============================================================================ + +const PromptInput = Schema.optional(Schema.Record(Schema.String, Schema.Unknown)) +/** A prompt template selects exactly one source: inline text or an asset id. + * Both present is ambiguous; neither is a spawn-time guarantee the runtime + * cannot keep. */ +export const PromptTemplateSource = Schema.Union([ + Schema.Struct({ + inline: Schema.String.annotate({ + description: "Inline prompt text; bind {{placeholders}} via input or input_mapping", + }), + input: PromptInput, + }), + Schema.Struct({ + id: Schema.String.annotate({ + description: "Prompt asset id resolved from .opencode/dag-prompts (project, then global)", + }), + input: PromptInput, + }), +]) + +export const NodeSchema = Schema.Struct({ + id: Schema.String.annotate({ description: "Unique node identifier, used in depends_on" }), + name: Schema.String.annotate({ description: "Human-readable node name" }), + worker_type: Schema.String.annotate({ description: "Agent type (explore, build, general, plan, or custom)" }), + depends_on: Schema.Array(Schema.String).annotate({ description: "Node IDs this node waits for ([] for root)" }), + required: Schema.optional(Schema.Boolean).annotate({ + description: + "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", + }), + prompt_template: PromptTemplateSource.annotate({ + description: + 'Template: exactly one of { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default', + }), + worker_config: Schema.optional( + Schema.Struct({ + timeout_ms: Schema.optional(Schema.Number), + }), + ).annotate({ description: "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config" }), + input_mapping: Schema.optional(Schema.Record(Schema.String, Schema.String)).annotate({ + description: + 'Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID', + }), + report_to_parent: Schema.optional(Schema.Boolean).annotate({ + description: + "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", + }), + condition: Schema.optional(Schema.String).annotate({ + description: "Expression evaluated before spawn; node is skipped if false", + }), + restart: Schema.optional(Schema.Boolean).annotate({ + description: + "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", + }), + cancel: Schema.optional(Schema.Boolean).annotate({ description: "(replan only) Cancel this node" }), + output_schema: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)).annotate({ + description: "JSON Schema; child agent must call submit_result to submit structured output", + }), + review: Schema.optional( + Schema.Struct({ + phase: Schema.Literals(["design", "diff"]), + implementation_node_id: Schema.optional(Schema.String), + verification_node_id: Schema.optional(Schema.String), + }), + ).annotate({ + description: + "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", + }), +}) + +const NodeDefaults = Schema.Struct({ + required: Schema.optional(Schema.Boolean), + worker_config: Schema.optional( + Schema.Struct({ + timeout_ms: Schema.optional(Schema.Number), + }), + ), + report_to_parent: Schema.optional(Schema.Boolean), +}) + +const GraphBudgetFields = { + max_concurrency: Schema.optional(Schema.Number).annotate({ description: "Max parallel nodes. Default: 5" }), + max_node_replan_attempts: Schema.optional(Schema.Number).annotate({ + description: "Max replan restarts per node ID. Default: 5", + }), + max_total_nodes: Schema.optional(Schema.Number).annotate({ + description: "Cumulative node cap across the workflow lifetime. Default: 100", + }), +} as const + +/** High-level graph: objective + composable blocks compiled into nodes. */ +export const BlocksGraphSchema = Schema.Struct({ + name: Schema.String.annotate({ description: "Workflow name" }), + objective: Schema.String.annotate({ + description: "Injected into every generated child prompt; required for blocks", + }), + blocks: Schema.Array(DagBlocks.WorkflowBlock).annotate({ + description: "Composable blocks compiled into nodes by the runtime", + }), + node_defaults: Schema.optional(NodeDefaults).annotate({ + description: "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + }), + ...GraphBudgetFields, +}) + +/** Low-level graph: explicit node declarations. */ +export const NodesGraphSchema = Schema.Struct({ + name: Schema.String.annotate({ description: "Workflow name" }), + nodes: Schema.Array(NodeSchema).annotate({ description: "Low-level node declarations" }), + node_defaults: Schema.optional(NodeDefaults).annotate({ + description: "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + }), + ...GraphBudgetFields, +}) + +/** A start/replan graph carries exactly one source shape: blocks or nodes. */ +export const WorkflowGraphSchema = Schema.Union([BlocksGraphSchema, NodesGraphSchema]) + +export const StartSpec = Schema.Struct({ + title: Schema.optional(Schema.String), + mode: Schema.optional(ExecutionMode), + admission: Schema.optional(AdmissionInput), + config: WorkflowGraphSchema, +}) + +/** Extend adds exactly one graph source: objective+blocks or nodes. */ +export const ExtendSpec = Schema.Union([ + Schema.Struct({ + objective: Schema.String.annotate({ description: "Injected into every generated child prompt" }), + blocks: Schema.Array(DagBlocks.WorkflowBlock), + }), + Schema.Struct({ + nodes: Schema.Array(NodeSchema), + }), +]) + +export const ReplanSpec = Schema.Struct({ + fragment: WorkflowGraphSchema, +}) + +export type StartSpec = typeof StartSpec.Type +export type StartGraph = typeof WorkflowGraphSchema.Type +export type ExtendGraph = typeof ExtendSpec.Type +export type NodeSpec = typeof NodeSchema.Type + +/** The validator decodes untrusted model/YAML input; unknown keys are + * rejected so a foreign field can never be silently dropped or defaulted. */ +export const STRICT_PARSE_OPTIONS = { onExcessProperty: "error" as const } + +// ============================================================================ +// Schema-error → diagnostics +// ============================================================================ + +interface LeafIssue { + path: string + message: string +} + +function issuePathSegment(segment: unknown): string { + return typeof segment === "number" ? `[${segment}]` : `[${JSON.stringify(String(segment))}]` +} + +function collectLeafIssues(issue: unknown, path: readonly string[], out: LeafIssue[]) { + if (!isRecord(issue)) return + const nextPath = Array.isArray(issue.path) ? [...path, ...issue.path.map(issuePathSegment)] : path + const children: unknown[] = [] + if (Array.isArray(issue.issues)) children.push(...issue.issues) + if (issue.issue !== undefined) children.push(issue.issue) + const tag = typeof issue._tag === "string" ? issue._tag : "" + if (tag === "AnyOf" || tag === "UnionMember") { + for (const value of Object.values(issue)) { + if (value !== null && typeof value === "object" && "_tag" in value) children.push(value) + } + } + if (children.length > 0) { + for (const child of children) collectLeafIssues(child, nextPath, out) + return + } + const message = typeof issue.message === "string" ? issue.message : tag + if (message) out.push({ path: nextPath.join("") || "$", message }) +} + +export function schemaDiagnostics(error: unknown, basePath = ""): Diagnostic[] { + const leaves: LeafIssue[] = [] + collectLeafIssues(isRecord(error) && error.issue !== undefined ? error.issue : error, basePath ? [basePath] : [], leaves) + if (leaves.length === 0) { + return [diagnostic({ code: DIAGNOSTIC_CODES.schemaInvalid, path: basePath || "$", message: String(error) })] + } + return sortDiagnostics( + leaves.map((leaf) => + diagnostic({ + code: DIAGNOSTIC_CODES.schemaInvalid, + path: leaf.path, + message: leaf.message, + hint: "Fix the field shape; blocks graphs need name+objective+blocks, nodes graphs need name+nodes", + }), + ), + ) +} + +// ============================================================================ +// Graph compilation (blocks → nodes) as diagnostics +// ============================================================================ + +export type BlockSource = + | { objective: string; blocks: readonly DagBlocks.WorkflowBlock[] } + | { nodes: readonly NodeSpec[] } + +export function compileBlockSource( + source: BlockSource, + options: { known_dependencies?: string[] } = {}, +): { nodes?: NodeConfig[]; diagnostics: Diagnostic[] } { + if ("blocks" in source) { + try { + const nodes = DagBlocks.compileWorkflowBlocks( + { objective: source.objective, blocks: [...source.blocks] }, + { known_dependencies: options.known_dependencies }, + ) + return { nodes, diagnostics: [] } + } catch (error) { + return { + diagnostics: [ + diagnostic({ + code: DIAGNOSTIC_CODES.blockCompileFailed, + path: "config.blocks", + message: error instanceof Error ? error.message : String(error), + hint: "Blocks must satisfy the writer-serialization and review-route contracts; inline compiled nodes if you need a shape blocks cannot express", + }), + ], + } + } + } + return { nodes: source.nodes.map(materializeNode), diagnostics: [] } +} + +function materializeNode(node: NodeSpec): NodeConfig { + return { + ...node, + depends_on: [...node.depends_on], + prompt_template: { + ...node.prompt_template, + ...(node.prompt_template.input ? { input: { ...node.prompt_template.input } } : {}), + }, + ...(node.worker_config ? { worker_config: { ...node.worker_config } } : {}), + ...(node.input_mapping ? { input_mapping: { ...node.input_mapping } } : {}), + ...(node.output_schema ? { output_schema: { ...node.output_schema } } : {}), + ...(node.review ? { review: { ...node.review } } : {}), + } +} + +export function compileGraphSource( + graph: StartGraph, + options: { known_dependencies?: string[] } = {}, +): { nodes?: NodeConfig[]; diagnostics: Diagnostic[] } { + if ("blocks" in graph) { + return compileBlockSource({ objective: graph.objective, blocks: graph.blocks }, options) + } + return compileBlockSource({ nodes: graph.nodes }, options) +} + +// ============================================================================ +// Structural diagnostics — shared by validate, create, and replan +// ============================================================================ + +/** A parseable condition may only reference the node's direct dependencies — + * anything else silently resolves to undefined and evaluates false at spawn. */ +export function conditionReferenceErrors(nodes: readonly NodeConfig[]): string[] { + return nodes.flatMap((node) => { + const ref = conditionReference(node.condition) + if (!ref || node.depends_on.includes(ref)) return [] + return [ + `node "${node.id}" condition references "${ref}" which is not in its depends_on (condition inputs come from direct dependencies only; this would silently evaluate false)`, + ] + }) +} + +/** Inline prompt templates may only reference bound variables: static + * prompt_template.input keys, input_mapping target names, or (without + * input_mapping) the direct depends_on ids. Id templates are resolved from + * disk and are binding-checked by the environment profile. */ +export function templateBindingErrors(nodes: readonly NodeConfig[]): string[] { + return nodes.flatMap((node) => { + const template = node.prompt_template.inline + if (template === undefined) return [] + const bound = new Set([ + ...Object.keys(node.prompt_template.input ?? {}), + ...Object.keys(node.input_mapping ?? Object.fromEntries(node.depends_on.map((dep) => [dep, dep]))), + ]) + return placeholderKeys(template) + .filter((key) => !bound.has(key)) + .map( + (key) => + `node "${node.id}" prompt_template references unbound variable "{{${key}}}" (bind it via prompt_template.input, input_mapping, or depends_on)`, + ) + }) +} + +export interface StructuralInput { + nodes: readonly NodeConfig[] + mode?: ExecutionMode + max_total_nodes?: number + /** Nodes already registered in a live workflow; counts toward the ceiling. */ + existing_node_count?: number + /** Node ids already present in a live workflow; valid dependency targets for + * replan/extend fragments whose depends_on may reference them. */ + known_node_ids?: ReadonlySet +} + +// Legacy byte-compat: Dag.create has always reported one structural class at +// a time in a fixed sequence. Each helper tags its diagnostics with that +// class index so callers can restore the historical ordering without +// re-parsing message text — the ordering lives with the message authors. +const legacyClassByDiagnostic = new WeakMap() + +// Classes whose messages pass through as-is in the legacy render; every +// other structural class is prefixed with "Invalid workflow config:". +const RAW_LEGACY_CLASSES = new Set([4, 5, 7]) + +function tagLegacyClass(diagnostics: Diagnostic[], classIndex: number): Diagnostic[] { + for (const d of diagnostics) legacyClassByDiagnostic.set(d, classIndex) + return diagnostics +} + +export function sortLegacyStructural(diagnostics: readonly Diagnostic[]): Diagnostic[] { + return sortDiagnostics([...diagnostics]).sort( + (a, b) => (legacyClassByDiagnostic.get(a) ?? 8) - (legacyClassByDiagnostic.get(b) ?? 8), + ) +} + +/** Legacy message render driven by the structural class tag, never by + * re-parsing message text. Schema-decode diagnostics (untagged) render with + * the historical "Invalid workflow config:" wrapper. */ +function legacyValidationMessage(d: Diagnostic): string { + const cls = legacyClassByDiagnostic.get(d) + if (cls !== undefined && RAW_LEGACY_CLASSES.has(cls)) return d.message + return `Invalid workflow config: ${d.message}` +} + +function duplicateNodeIds(nodes: readonly NodeConfig[]): string[] { + const ids = nodes.map((node) => node.id) + return [...new Set(ids.filter((id, index) => ids.indexOf(id) !== index))] +} + +function duplicateIdDiagnostics(duplicates: string[]): Diagnostic[] { + if (duplicates.length === 0) return [] + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: `duplicate node ids: ${duplicates.join(", ")}`, + hint: "Every node id must be unique; rename the colliding node", + }), + ] +} + +function danglingDependencyDiagnostics(nodes: readonly NodeConfig[], knownNodeIds?: ReadonlySet): Diagnostic[] { + const idSet = new Set(nodes.map((node) => node.id)) + if (knownNodeIds) for (const id of knownNodeIds) idSet.add(id) + const dangling = nodes.flatMap((node) => + node.depends_on.filter((dep) => !idSet.has(dep)).map((dep) => ({ node, dep })), + ) + if (dangling.length === 0) return [] + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: dangling.map(({ node, dep }) => `node "${node.id}" depends on unknown node "${dep}"`).join("; "), + hint: "depends_on may only reference node ids declared in this graph", + }), + ] +} + +function conditionDiagnostics(nodes: readonly NodeConfig[]): Diagnostic[] { + const errors = conditionReferenceErrors(nodes) + if (errors.length === 0) return [] + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: errors.join("; "), + hint: "A condition may only read outputs of the node's direct depends_on", + }), + ] +} + +function bindingDiagnostics(nodes: readonly NodeConfig[]): Diagnostic[] { + return templateBindingErrors(nodes).map((error) => + diagnostic({ + code: DIAGNOSTIC_CODES.promptUnboundVariable, + path: "nodes", + message: error, + hint: "Bind the variable via prompt_template.input, input_mapping, or depends_on", + }), + ) +} + +export function effectiveMaxTotalNodes(maxTotalNodes: number | undefined) { + return maxTotalNodes ?? DEFAULT_WORKFLOW_CONFIG.maxTotalNodes +} + +/** Reusable ceiling check: produces the historical diagnostic when the + * cumulative node count exceeds the configured maximum. Shared by create + * (existing_node_count + nodes.length) and replan (existing + add count). */ +function ceilingExceeded(totalNodes: number, maxTotalNodes: number | undefined): Diagnostic[] { + const max = effectiveMaxTotalNodes(maxTotalNodes) + if (totalNodes <= max) return [] + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "config.max_total_nodes", + message: `Total node ceiling exceeded: ${totalNodes} nodes > ${max} max`, + hint: "Reduce the graph or raise max_total_nodes deliberately", + }), + ] +} + +function ceilingDiagnostics(input: StructuralInput): Diagnostic[] { + return ceilingExceeded((input.existing_node_count ?? 0) + input.nodes.length, input.max_total_nodes) +} + +/** Review-lifecycle diagnostics for one config. Shared by the structural + * validator and Dag.replan's merged-config check. */ +export function reviewLifecycleDiagnostics(input: { + name?: string + mode?: ExecutionMode + nodes: readonly NodeConfig[] +}) { + const reviewLifecycle = validateReviewLifecycle({ + name: input.name ?? "validation", + mode: input.mode, + nodes: [...input.nodes], + }) + return { + errors: reviewLifecycle.errors.map((error) => + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: `Invalid review lifecycle: ${error}`, + hint: "Diff reviews need implementation + verification wiring; deep review workers must declare review.phase", + }), + ), + warnings: reviewLifecycle.warnings.map((warning) => + diagnostic({ + severity: "warning", + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: `Review lifecycle diagnostic: ${warning}`, + hint: "Standard mode records this without failing the workflow", + }), + ), + } +} + +function isRecord(value: unknown): value is Record { + return value !== null && typeof value === "object" && !Array.isArray(value) +} + +// Duplicate ids make topology checks ambiguous (projector would silently +// merge the rows), so callers run these only on id-unique graphs. +function topologyDiagnostics(nodes: readonly NodeConfig[]): Diagnostic[] { + const diagnostics: Diagnostic[] = [] + const required = validateRequiredNodes({ + nodes: nodes.map((node) => ({ + id: node.id, + depends_on: node.depends_on, + required: node.required ?? false, + })), + }) + if (!required.valid) { + diagnostics.push( + ...tagLegacyClass( + required.errors.map((error) => + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: error, + hint: "Required nodes must be reachable without depending on optional work", + }), + ), + 6, + ), + ) + } + const cyclePath = findCycle(nodes) + if (cyclePath) { + diagnostics.push( + ...tagLegacyClass( + [ + diagnostic({ + code: DIAGNOSTIC_CODES.dagInvalid, + path: "nodes", + message: `Workflow config contains a dependency cycle: ${cyclePath.join(" -> ")}`, + hint: "Break the cycle by removing one depends_on edge", + }), + ], + 7, + ), + ) + } + return diagnostics +} + +function outputSchemaKeywordDiagnostics(nodes: readonly NodeConfig[]): Diagnostic[] { + return nodes.flatMap((node) => { + if (!node.output_schema) return [] + const keywords = unsupportedSchemaKeywords(node.output_schema) + if (keywords.length === 0) return [] + return [ + diagnostic({ + severity: "warning", + code: DIAGNOSTIC_CODES.schemaKeywordWarning, + path: `nodes[${node.id}].output_schema`, + message: `output_schema uses keywords the subset validator does not enforce: ${keywords.join(", ")}`, + hint: "They will be ignored at runtime; simplify the schema or accept the gap", + }), + ] + }) +} + +/** Pure structural validation. No events, no store, no logging — callers + * decide how to surface the diagnostics (tool output vs. create rejection). */ +export function structuralDiagnostics(input: StructuralInput): Diagnostic[] { + const duplicates = duplicateNodeIds(input.nodes) + const review = reviewLifecycleDiagnostics({ mode: input.mode, nodes: input.nodes }) + return sortDiagnostics([ + ...tagLegacyClass(duplicateIdDiagnostics(duplicates), 0), + ...tagLegacyClass(danglingDependencyDiagnostics(input.nodes, input.known_node_ids), 1), + ...tagLegacyClass(conditionDiagnostics(input.nodes), 2), + ...tagLegacyClass(bindingDiagnostics(input.nodes), 3), + ...tagLegacyClass(ceilingDiagnostics(input), 4), + ...tagLegacyClass(review.errors, 5), + ...tagLegacyClass(review.warnings, 5), + ...(duplicates.length === 0 ? topologyDiagnostics(input.nodes) : []), + ...tagLegacyClass(outputSchemaKeywordDiagnostics(input.nodes), 8), + ]) +} + +export interface ReplanStructuralInput { + /** Full fragment nodes — checked for duplicate ids within the fragment. */ + fragmentNodes: readonly NodeConfig[] + /** Fragment nodes that will actually (re)run (excludes cancel + terminal). + * Condition, binding, dangling-dep, topology, and output-schema checks + * run on these — a cancelled or terminal node never evaluates them. */ + rerunNodes: readonly NodeConfig[] + /** Existing workflow node ids — valid dependency targets and ceiling baseline. */ + existingNodeIds: ReadonlySet + existingNodeCount: number + /** New node ids being added by this replan (toward the lifetime ceiling). */ + addCount: number + /** Merged config (existing + fragment) for review-lifecycle validation. */ + merged: { name?: string; mode?: ExecutionMode; nodes: readonly NodeConfig[] } + config: { mode?: ExecutionMode; max_total_nodes?: number } +} + +/** Replan structural validation through the same helper functions as create — + * the authority lives here, not in Dag.replan. The scoping differs (fragment + * vs whole-graph, rerun-only condition/binding, merged-config review), but + * every check reuses the same underlying helper. */ +export function replanStructuralDiagnostics(input: ReplanStructuralInput): Diagnostic[] { + const knownIds = new Set([...input.existingNodeIds, ...input.fragmentNodes.map((n) => n.id)]) + const duplicates = duplicateNodeIds(input.fragmentNodes) + const review = reviewLifecycleDiagnostics({ + name: input.merged.name, + mode: input.merged.mode, + nodes: input.merged.nodes, + }) + return sortDiagnostics([ + ...tagLegacyClass(duplicateIdDiagnostics(duplicates), 0), + ...tagLegacyClass(danglingDependencyDiagnostics(input.rerunNodes, knownIds), 1), + ...tagLegacyClass(conditionDiagnostics(input.rerunNodes), 2), + ...tagLegacyClass(bindingDiagnostics(input.rerunNodes), 3), + ...tagLegacyClass(ceilingExceeded(input.existingNodeCount + input.addCount, input.config.max_total_nodes), 4), + ...tagLegacyClass(review.errors, 5), + ...tagLegacyClass(review.warnings, 5), + ...(duplicates.length === 0 ? topologyDiagnostics(input.rerunNodes) : []), + ...tagLegacyClass(outputSchemaKeywordDiagnostics(input.rerunNodes), 8), + ]) +} + +function findCycle(nodes: readonly NodeConfig[]): string[] | null { + try { + const graph = buildGraph( + nodes.map((node) => ({ + id: node.id, + dependsOn: node.depends_on, + status: "pending" as const, + required: node.required ?? false, + })), + ) + return graph.hasCycle() ? (graph.findCycles()[0] ?? null) : null + } catch (error) { + if (error instanceof CycleError) return error.cycle + throw error + } +} + +// ============================================================================ +// Portable + environment validation +// ============================================================================ + +export interface EnvironmentCatalogs { + /** Known worker types from the Agent catalog; undefined skips the check. */ + worker_types?: ReadonlySet + /** Resolves a node's model against this environment (dag.jsonc tiers, + * worker agent model, parent session). undefined skips the check. */ + resolveModel?: ( + node: { + id: string + worker_type: string + required: boolean + model?: { modelID: string; providerID: string } + }, + defaults?: { + required?: boolean + model?: { modelID: string; providerID: string } + }, + ) => Effect.Effect +} + +/** Environment-only diagnostics for an already-compiled node list: prompt-id + * resolution and bindings, worker catalog, and model + * resolution. Used by start/extend/replan before any durable side effect. */ +export function environmentDiagnostics(input: { + nodes: readonly NodeConfig[] + directory?: string + catalogs?: EnvironmentCatalogs + /** Graph-level required default, applied when a node does not declare one. */ + defaults?: { required?: boolean } +}): Effect.Effect { + return Effect.gen(function* () { + const diagnostics: Diagnostic[] = [] + for (const node of input.nodes) { + diagnostics.push(...(yield* promptIdDiagnostics(node, input.directory))) + if (input.catalogs?.worker_types && !input.catalogs.worker_types.has(node.worker_type)) { + diagnostics.push( + diagnostic({ + code: DIAGNOSTIC_CODES.workerUnknown, + path: `nodes[${node.id}].worker_type`, + message: `worker type "${node.worker_type}" is not in the current agent catalog`, + hint: "Use a builtin agent type or register the custom agent before start", + }), + ) + } + if (input.catalogs?.resolveModel) { + const required = node.required ?? input.defaults?.required ?? DEFAULT_WORKFLOW_CONFIG.nodeRequired + const resolves = yield* input.catalogs.resolveModel( + { id: node.id, worker_type: node.worker_type, required, model: node.model }, + input.defaults, + ) + if (!resolves) { + diagnostics.push( + diagnostic({ + code: DIAGNOSTIC_CODES.modelUnavailable, + path: `nodes[${node.id}]`, + message: `no model resolves for node "${node.id}"`, + hint: "Configure dag.jsonc tiers, the worker agent model, or a parent-session model", + }), + ) + } + } + } + return sortDiagnostics(diagnostics) + }) +} + +function nodeBoundVariables(node: NodeConfig): Set { + return new Set([ + ...Object.keys(node.prompt_template.input ?? {}), + ...Object.keys(node.input_mapping ?? Object.fromEntries(node.depends_on.map((dep) => [dep, dep]))), + ]) +} + +function nonportablePromptDiagnostics(nodes: readonly NodeConfig[]): Diagnostic[] { + return nodes.flatMap((node) => { + const prompt = node.prompt_template + if (prompt.id === undefined) return [] + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.promptNonportableAsset, + path: `nodes[${node.id}].prompt_template.id`, + message: `prompt id "${prompt.id}" is not shipped with the template`, + hint: "Inline the prompt content or ship the asset with the distributable package", + }), + ] + }) +} + +function promptIdDiagnostics(node: NodeConfig, directory: string | undefined): Effect.Effect { + return Effect.gen(function* () { + const prompt = node.prompt_template + if (prompt.id === undefined) return [] + if (!directory) { + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.promptMissingAsset, + path: `nodes[${node.id}].prompt_template.id`, + message: `prompt id "${prompt.id}" cannot be resolved without a project directory`, + hint: "Inline the prompt content or validate from a project with dag-prompts", + }), + ] + } + // readById rejects via a thrown error (defect channel) — sandbox it into + // a failure so a missing asset becomes a diagnostic, not a die. + const source = yield* templateSourceById(prompt.id, directory).pipe(Effect.sandbox, Effect.option) + if (Option.isNone(source)) { + return [ + diagnostic({ + code: DIAGNOSTIC_CODES.promptMissingAsset, + path: `nodes[${node.id}].prompt_template.id`, + message: `prompt id "${prompt.id}" does not resolve in project or global dag-prompts`, + hint: "Add .md to .opencode/dag-prompts (project or global) or switch to an inline template", + }), + ] + } + const bound = nodeBoundVariables(node) + return placeholderKeys(source.value) + .filter((key) => !bound.has(key)) + .map((key) => + diagnostic({ + code: DIAGNOSTIC_CODES.promptUnboundVariable, + path: `nodes[${node.id}].prompt_template.id`, + message: `prompt asset "${prompt.id}" references unbound variable "{{${key}}}"`, + hint: "Bind it via prompt_template.input, input_mapping, or depends_on", + }), + ) + }) +} + +/** Validate a decoded + compiled spec under the chosen profile. Shared by + * the raw-entry validateSpec and the workflow start path. */ +export function validatePostCompile(input: { + source: string + profile: Profile + config: { + mode?: ExecutionMode + max_total_nodes?: number + node_defaults?: { required?: boolean; model?: { modelID: string; providerID: string } } + } + nodes: readonly NodeConfig[] + /** The original blocks when the graph used the high-level interface. */ + blocks?: readonly DagBlocks.WorkflowBlock[] + directory?: string + catalogs?: EnvironmentCatalogs + /** Fragment actions are structurally validated by Dag.replan after merge; + * authoring still owns profile checks without pretending a fragment is a + * standalone graph. */ + structural?: boolean +}): Effect.Effect { + return Effect.gen(function* () { + const diagnostics = + input.structural === false + ? [] + : structuralDiagnostics({ + nodes: input.nodes, + mode: input.config.mode, + max_total_nodes: input.config.max_total_nodes, + }) + if (input.profile === "portable") diagnostics.push(...nonportablePromptDiagnostics(input.nodes)) + if (input.profile === "environment") { + diagnostics.push( + ...(yield* environmentDiagnostics({ + nodes: input.nodes, + directory: input.directory, + catalogs: input.catalogs, + defaults: input.config.node_defaults, + })), + ) + } + const errors = sortDiagnostics(diagnostics.filter((d) => d.severity === "error")) + const warnings = sortDiagnostics(diagnostics.filter((d) => d.severity === "warning")) + return { + source: input.source, + profile: input.profile, + valid: errors.length === 0, + errors, + warnings, + nodes: summarizeNodes(input.nodes), + } + }) +} diff --git a/packages/opencode/src/skill/index.ts b/packages/opencode/src/skill/index.ts index 4a6803a961..06999e4556 100644 --- a/packages/opencode/src/skill/index.ts +++ b/packages/opencode/src/skill/index.ts @@ -50,13 +50,6 @@ const CREATE_DAG_WORKFLOW_SKILL_NAME = "create-dag-workflow" const CREATE_DAG_WORKFLOW_SKILL_DESCRIPTION = SkillPlugin.CreateDagWorkflowDescription const CREATE_DAG_WORKFLOW_SKILL_BODY = SkillPlugin.CreateDagWorkflowContent -// Built-in routing skill. Its compact catalog description makes project-level -// orchestration proactive; the full decision and block-composition playbook is -// loaded only when the model invokes the skill. -const ORCHESTRATION_ROUTER_SKILL_NAME = "orchestration-router" -const ORCHESTRATION_ROUTER_SKILL_DESCRIPTION = SkillPlugin.OrchestrationRouterDescription -const ORCHESTRATION_ROUTER_SKILL_BODY = SkillPlugin.OrchestrationRouterContent - export const Info = Schema.Struct({ name: Schema.String, description: Schema.optional(Schema.String), @@ -316,12 +309,6 @@ export const layer = Layer.effect( location: "", content: CREATE_DAG_WORKFLOW_SKILL_BODY, } - s.skills[ORCHESTRATION_ROUTER_SKILL_NAME] = { - name: ORCHESTRATION_ROUTER_SKILL_NAME, - description: ORCHESTRATION_ROUTER_SKILL_DESCRIPTION, - location: "", - content: ORCHESTRATION_ROUTER_SKILL_BODY, - } yield* loadSkills(s, yield* InstanceState.get(discovered), events) return s }), diff --git a/packages/opencode/src/tool/tool.ts b/packages/opencode/src/tool/tool.ts index ed2b64bc98..e0beb31913 100644 --- a/packages/opencode/src/tool/tool.ts +++ b/packages/opencode/src/tool/tool.ts @@ -2,8 +2,6 @@ import { PermissionV1 } from "@opencode-ai/core/v1/permission" import { Effect, Schema } from "effect" import { SessionV1 } from "@opencode-ai/core/v1/session" import type { JSONSchema7 } from "@ai-sdk/provider" -import type { MessageV2 } from "../session/message-v2" -import type { Permission } from "../permission" import type { SessionID, MessageID } from "../session/schema" import * as Truncate from "./truncate" import { Agent } from "@/agent/agent" @@ -60,6 +58,15 @@ export interface Def< description: string parameters: Parameters jsonSchema?: JSONSchema7 + /** Parse options applied when decoding LLM-supplied arguments. Tools whose + * parameters are a discriminated union use `onExcessProperty: "error"` so a + * call carrying another action's fields is rejected instead of silently + * dropping them. */ + parseOptions?: { + errors?: "first" | "all" + onExcessProperty?: "ignore" | "error" | "preserve" + propertyOrder?: "none" | "original" + } execute(args: Schema.Schema.Type, ctx: Context): Effect.Effect> formatValidationError?(error: unknown): string } @@ -108,7 +115,7 @@ function wrap, Result extends Metadat // Compile the parser closure once per tool init; `decodeUnknownEffect` // allocates a new closure per call, so hoisting avoids re-closing it for // every LLM tool invocation. - const decode = Schema.decodeUnknownEffect(toolInfo.parameters) + const decode = Schema.decodeUnknownEffect(toolInfo.parameters, toolInfo.parseOptions) const execute = toolInfo.execute toolInfo.execute = (args, ctx) => { const attrs = { diff --git a/packages/opencode/src/tool/workflow.ts b/packages/opencode/src/tool/workflow.ts index 31cc5b15d2..f1a87358b0 100644 --- a/packages/opencode/src/tool/workflow.ts +++ b/packages/opencode/src/tool/workflow.ts @@ -5,13 +5,14 @@ import { Dag } from "@/dag/dag" import { DagConfig } from "@/dag/config" import { DagWorkflows } from "@/dag/workflows" import { DagModel } from "@/dag/model" -import { DagBlocks } from "@/dag/blocks" +import { DagValidation, type Diagnostic } from "@/dag/validation" +import { WorkflowAuthoring } from "@/dag/authoring" import { Agent } from "@/agent/agent" import { Question } from "@/question" +import { Provider } from "@/provider/provider" import { Session } from "@/session/session" import { SessionID } from "@/session/schema" -import type { NodeConfig, WorkflowConfig } from "@/dag/dag" -import { AdmissionInput, createAdmissionRecord, ExecutionMode } from "@/dag/admission" +import { createAdmissionRecord } from "@/dag/admission" import { TerminalViolationError } from "@opencode-ai/core/dag/core/types" import { FSUtil } from "@opencode-ai/core/fs-util" import { assertExternalDirectoryEffect } from "./external-directory" @@ -34,156 +35,126 @@ const ResultCursorToken = Schema.String.pipe(Schema.brand("WorkflowResultCursorT type ResultCursorToken = typeof ResultCursorToken.Type const decodeResultCursor = Schema.decodeUnknownOption(ResultCursorJSON) +// Exported so the committed workflow library can be validated in tests. +export const StartSpec = DagValidation.StartSpec +// Distinct re-export for test files that import multiple tools' Parameters +// without aliasing (the repo forbids import aliases). +export { Parameters as WorkflowParameters } + // ============================================================================ -// Action schemas remain the single validation authority for file and inline input. +// Parameters: one discriminated union, action-owned fields only. +// Runtime-derived identity (session/project) is never model-authored — start +// derives ownership from the calling session. // ============================================================================ -const NodeSchema = Schema.Struct({ - id: Schema.String.annotate({ description: "Unique node identifier, used in depends_on" }), - name: Schema.String.annotate({ description: "Human-readable node name" }), - worker_type: Schema.String.annotate({ description: "Agent type (explore, build, general, plan, or custom)" }), - depends_on: Schema.Array(Schema.String).annotate({ description: "Node IDs this node waits for ([] for root)" }), - required: Schema.optional(Schema.Boolean).annotate({ - description: - "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", - }), - prompt_template: Schema.Struct({ - id: Schema.optional(Schema.String), - inline: Schema.optional(Schema.String), - input: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)), - }).annotate({ - description: - 'Template: { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default', - }), - worker_config: Schema.optional( - Schema.Struct({ - timeout_ms: Schema.optional(Schema.Number), - }), - ).annotate({ description: "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config" }), - input_mapping: Schema.optional(Schema.Record(Schema.String, Schema.String)).annotate({ - description: - 'Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID', - }), - report_to_parent: Schema.optional(Schema.Boolean).annotate({ - description: - "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", - }), - condition: Schema.optional(Schema.String).annotate({ - description: "Expression evaluated before spawn; node is skipped if false", - }), - restart: Schema.optional(Schema.Boolean).annotate({ - description: - "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", - }), - cancel: Schema.optional(Schema.Boolean).annotate({ description: "(replan only) Cancel this node" }), - output_schema: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)).annotate({ - description: "JSON Schema; child agent must call submit_result to submit structured output", - }), - review: Schema.optional( - Schema.Struct({ - phase: Schema.Literals(["design", "diff"]), - implementation_node_id: Schema.optional(Schema.String), - verification_node_id: Schema.optional(Schema.String), - }), - ).annotate({ - description: - "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", - }), -}) +const specDescription = "Inline structured spec for a one-off graph. Use this or spec_path, never both" +const specPathDescription = + '(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory' -const WorkflowGraphSchema = Schema.Struct({ - name: Schema.String.annotate({ description: "Workflow name" }), - node_defaults: Schema.optional( - Schema.Struct({ - required: Schema.optional(Schema.Boolean), - worker_config: Schema.optional( - Schema.Struct({ - timeout_ms: Schema.optional(Schema.Number), - }), - ), - report_to_parent: Schema.optional(Schema.Boolean), - }), - ).annotate({ - description: "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", - }), - max_concurrency: Schema.optional(Schema.Number).annotate({ description: "Max parallel nodes. Default: 5" }), - max_node_replan_attempts: Schema.optional(Schema.Number).annotate({ - description: "Max replan restarts per node ID. Default: 5", - }), - max_total_nodes: Schema.optional(Schema.Number).annotate({ - description: "Cumulative node cap across the workflow lifetime. Default: 100", - }), - objective: Schema.optional(Schema.String).annotate({ - description: "Required when using blocks; injected into every generated child prompt", - }), - blocks: Schema.optional(Schema.Array(DagBlocks.WorkflowBlock)).annotate({ - description: "High-level graph compiled into nodes. Use blocks or nodes, never both", - }), - nodes: Schema.optional(Schema.Array(NodeSchema)).annotate({ - description: "Low-level node declarations. Use nodes or blocks, never both", - }), +const StartInline = Schema.Struct({ + action: Schema.Literal("start").annotate({ description: "Create a workflow" }), + spec: DagValidation.StartSpec.annotate({ description: specDescription }), }) - -// Exported so the committed workflow library can be validated in tests. -export const StartSpec = Schema.Struct({ - title: Schema.optional(Schema.String), - mode: Schema.optional(ExecutionMode), - admission: Schema.optional(AdmissionInput), - config: WorkflowGraphSchema, +const StartPath = Schema.Struct({ + action: Schema.Literal("start").annotate({ description: "Create a workflow" }), + spec_path: Schema.String.annotate({ description: specPathDescription }), }) - -const ExtendSpec = Schema.Struct({ - objective: Schema.optional(Schema.String), - blocks: Schema.optional(Schema.Array(DagBlocks.WorkflowBlock)), - nodes: Schema.optional(Schema.Array(NodeSchema)), +const ExtendInline = Schema.Struct({ + action: Schema.Literal("extend").annotate({ description: "Add nodes or blocks to a live workflow" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), + spec: DagValidation.ExtendSpec.annotate({ description: specDescription }), }) - -const ReplanSpec = Schema.Struct({ - fragment: WorkflowGraphSchema, +const ExtendPath = Schema.Struct({ + action: Schema.Literal("extend").annotate({ description: "Add nodes or blocks to a live workflow" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), + spec_path: Schema.String.annotate({ description: specPathDescription }), }) - -const decodeStartSpec = Schema.decodeUnknownEffect(StartSpec) -const decodeExtendSpec = Schema.decodeUnknownEffect(ExtendSpec) -const decodeReplanSpec = Schema.decodeUnknownEffect(ReplanSpec) - -export const Parameters = Schema.Struct({ - action: Schema.Literals(["start", "extend", "control", "status", "result", "list", "read", "guide"]).annotate({ - description: - "start: create workflow; extend: add nodes or blocks; control: pause/resume/cancel/replan/step/complete; status: inspect durable state; result: read one durable node output in bounded pages; list: show saved specs; read: inspect one saved spec before retargeting it; guide: load detailed guidance only when needed", - }), - topic: Schema.optional(Schema.Literals(["blocks", "interface", "policy", "patterns"])).annotate({ - description: - "(guide) blocks: composable block schema; interface: low-level workflow API; policy: gates/admission/recovery; patterns: domain playbooks. Omit for the compact index", - }), - spec: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)).annotate({ - description: - "(start/extend/control replan) Inline structured spec for a one-off graph. Use this or spec_path, never both", - }), - spec_path: Schema.optional(Schema.String).annotate({ - description: - '(start/extend/control replan/read) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory', +const ControlReplanInline = Schema.Struct({ + action: Schema.Literal("control").annotate({ description: "Control a live workflow" }), + operation: Schema.Literal("replan").annotate({ description: "Apply a node fragment (add/cancel/restart/replace)" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), + spec: DagValidation.ReplanSpec.annotate({ description: specDescription }), +}) +const ControlReplanPath = Schema.Struct({ + action: Schema.Literal("control").annotate({ description: "Control a live workflow" }), + operation: Schema.Literal("replan").annotate({ description: "Apply a node fragment (add/cancel/restart/replace)" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), + spec_path: Schema.String.annotate({ description: specPathDescription }), +}) +const ControlOther = Schema.Struct({ + action: Schema.Literal("control").annotate({ description: "Control a live workflow" }), + operation: Schema.Literals(["pause", "resume", "cancel", "step", "complete"]).annotate({ + description: "pause/resume/cancel/step/complete", }), - session_id: Schema.optional(Schema.String).annotate({ - description: "(start) Parent session ID; when provided, it must match the calling session", + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), +}) +const Status = Schema.Struct({ + action: Schema.Literal("status").annotate({ description: "Inspect durable workflow and node state" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), +}) +const Result = Schema.Struct({ + action: Schema.Literal("result").annotate({ description: "Read one durable node output in bounded pages" }), + workflow_id: Dag.ID.annotate({ description: "Target workflow ID" }), + node_id: Dag.NodeID.annotate({ description: "Target durable node ID" }), + cursor: Schema.optional(ResultCursorToken).annotate({ + description: "Opaque continuation cursor returned by the previous page", }), - project_id: Schema.optional(Schema.String).annotate({ - description: "(start) Optional Project ID; must match the parent session project", + limit: Schema.optional(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: MAX_RESULT_PAGE_CHARS }))).annotate({ + description: `Maximum page characters; defaults to ${DEFAULT_RESULT_PAGE_CHARS}, max ${MAX_RESULT_PAGE_CHARS}`, }), - workflow_id: Schema.optional(Dag.ID).annotate({ - description: "(extend/control/status/result) Target workflow ID", +}) +const List = Schema.Struct({ + action: Schema.Literal("list").annotate({ + description: "Show saved workflow specs in the library with their validation status", }), - node_id: Schema.optional(Dag.NodeID).annotate({ description: "(result) Target durable node ID" }), - cursor: Schema.optional(ResultCursorToken).annotate({ - description: "(result) Opaque continuation cursor returned by the previous page", +}) +const Read = Schema.Struct({ + action: Schema.Literal("read").annotate({ description: "Inspect one saved spec before retargeting it" }), + spec_path: Schema.String.annotate({ description: specPathDescription }), +}) +const Guide = Schema.Struct({ + action: Schema.Literal("guide").annotate({ description: "Load detailed guidance only when needed" }), + topic: Schema.optional(Schema.Literals(["blocks", "interface", "policy", "patterns"])).annotate({ + description: + "blocks: composable block schema; interface: low-level workflow API; policy: gates/admission/recovery; patterns: domain playbooks. Omit for the compact index", }), - limit: Schema.optional(Schema.Int.check(Schema.isBetween({ minimum: 1, maximum: MAX_RESULT_PAGE_CHARS }))).annotate({ - description: `(result) Maximum page characters; defaults to ${DEFAULT_RESULT_PAGE_CHARS}, max ${MAX_RESULT_PAGE_CHARS}`, +}) +const ValidationProfile = Schema.optional(Schema.Literals(["portable", "environment"])).annotate({ + description: + "portable: distributable-template checks; environment: additionally resolves prompts, workers, and models in this project. Defaults: builtin specs portable, inline and project/global specs environment", +}) +const ValidateInline = Schema.Struct({ + action: Schema.Literal("validate").annotate({ + description: "Pre-flight a custom spec without creating a workflow; returns diagnostics, never a workflow ID", }), - operation: Schema.optional(Schema.Literals(["pause", "resume", "cancel", "replan", "step", "complete"])).annotate({ - description: "(control) Operation to perform", + spec: DagValidation.StartSpec.annotate({ description: specDescription }), + profile: ValidationProfile, +}) +const ValidatePath = Schema.Struct({ + action: Schema.Literal("validate").annotate({ + description: "Pre-flight a custom spec without creating a workflow; returns diagnostics, never a workflow ID", }), + spec_path: Schema.String.annotate({ description: specPathDescription }), + profile: ValidationProfile, }) +export const Parameters = Schema.Union([ + StartInline, + StartPath, + ExtendInline, + ExtendPath, + ControlReplanInline, + ControlReplanPath, + ControlOther, + Status, + Result, + List, + Read, + Guide, + ValidateInline, + ValidatePath, +]) + // ============================================================================ // Tool definition // ============================================================================ @@ -199,10 +170,12 @@ type Metadata = { replace?: string[] } +type AuthoringSource = Parameters["prepare"]>[0]["source"] + export const WorkflowTool = Tool.define< typeof Parameters, Metadata, - Dag.Service | Session.Service | Agent.Service | Question.Service + Dag.Service | Session.Service | Agent.Service | Question.Service | Provider.Service >( id, Effect.gen(function* () { @@ -210,6 +183,7 @@ export const WorkflowTool = Tool.define< const sessions = yield* Session.Service const agents = yield* Agent.Service const question = yield* Question.Service + const provider = yield* Provider.Service const requireOwnedWorkflow = Effect.fn("WorkflowTool.requireOwnedWorkflow")(function* ( workflowID: Dag.ID, @@ -222,9 +196,79 @@ export const WorkflowTool = Tool.define< return workflow }) + const rejectDiagnostics = (diagnostics: Diagnostic[], context: string) => + Effect.die( + new Error( + `${context} rejected by workflow validation:\n${diagnostics + .map((d) => `- [${d.code}] ${d.path}: ${d.message}${d.hint ? ` (${d.hint})` : ""}`) + .join("\n")}`, + ), + ) + + const authoring = WorkflowAuthoring.make({ + loadEnvironment: (context) => + Effect.gen(function* () { + if (!context.directory) return {} + const agentCatalog = yield* agents.list().pipe(Effect.orDie) + const providerCatalog = yield* provider.list() + const config = yield* DagConfig.load(context.directory) + const agentsByName = new Map(agentCatalog.map((agent) => [agent.name, agent])) + const availableModels = new Set( + Object.values(providerCatalog).flatMap((info) => + Object.values(info.models).map((model) => `${model.providerID}/${model.id}`), + ), + ) + const resolveModel: NonNullable = (node, defaults) => + Effect.sync(() => { + const resolved = DagModel.resolve({ + node: node.model ?? defaults?.model, + tier: DagConfig.tierModel(config, { + required: node.required ?? defaults?.required ?? Dag.DEFAULT_WORKFLOW_CONFIG.nodeRequired, + workerType: node.worker_type, + }), + agent: agentsByName.get(node.worker_type)?.model, + parent: context.parent + ? { modelID: context.parent.id, providerID: context.parent.providerID } + : undefined, + }) + return Boolean(resolved && availableModels.has(`${resolved.providerID}/${resolved.modelID}`)) + }) + return { + worker_types: new Set(agentCatalog.map((agent) => agent.name)), + resolveModel, + } + }), + }) + + const portableEntryCheck = (entry: DagWorkflows.Entry) => + Effect.gen(function* () { + const content = yield* Effect.promise(() => entryContent(entry)) + if (content === undefined) { + return { valid: false, summary: "[schema.invalid] spec content is unreadable" } + } + const result = yield* authoring.prepare({ + action: "start", + source: { kind: "yaml", source: entry.path, content }, + profile: "portable", + }) + const summary = result.valid + ? "" + : result.errors + .slice(0, 3) + .map((d) => `[${d.code}] ${d.path}: ${d.message}`) + .join("; ") + return { valid: result.valid, summary } + }) + return { description: CommandPlugin.WorkflowContent, parameters: Parameters, + parseOptions: { onExcessProperty: "error" }, + formatValidationError: (error) => + [ + `Workflow call rejected by the action schema: ${error instanceof Error ? error.message : String(error)}`, + "Each action owns only its own fields: start {spec | spec_path}; extend {workflow_id, spec | spec_path}; control {workflow_id, operation} plus spec/spec_path for replan; status {workflow_id}; result {workflow_id, node_id, cursor?, limit?}; list {}; read {spec_path}; guide {topic?}; validate {spec | spec_path, profile?}. Graph-carrying actions take exactly one source (spec or spec_path), and session/project identity is never a parameter.", + ].join("\n"), execute: (params: Schema.Schema.Type, ctx: Tool.Context) => Effect.gen(function* () { const callingSession = yield* sessions.get(SessionID.make(ctx.sessionID)).pipe(Effect.orDie) @@ -239,9 +283,9 @@ export const WorkflowTool = Tool.define< always: ["*"], metadata: { action: params.action, - ...(params.workflow_id ? { workflow_id: params.workflow_id } : {}), - ...(params.node_id ? { node_id: params.node_id } : {}), - ...(params.operation ? { operation: params.operation } : {}), + ...("workflow_id" in params ? { workflow_id: params.workflow_id } : {}), + ...("node_id" in params ? { node_id: params.node_id } : {}), + ...("operation" in params ? { operation: params.operation } : {}), }, }) switch (params.action) { @@ -272,52 +316,108 @@ export const WorkflowTool = Tool.define< } } case "list": { - const session = yield* sessions.get(SessionID.make(ctx.sessionID)).pipe(Effect.orDie) - const entries = yield* DagWorkflows.list(session.directory) + const entries = yield* DagWorkflows.list(callingSession.directory) if (entries.length === 0) { return { title: "No saved workflows", - output: `The workflow library is empty. Searched ${searchedScopes(session.directory)}. Save a spec as .yaml in one of those directories to start it later by name.`, + output: `The workflow library is empty. Searched ${searchedScopes(callingSession.directory)}. Save a spec as .yaml in one of those directories to start it later by name.`, metadata: {}, } } + const rows: string[] = [] + for (const entry of entries) { + const check = yield* portableEntryCheck(entry) + rows.push( + [ + `${entry.name} [${entry.scope}]${check.valid ? "" : " [invalid — not startable]"}`, + entry.title ? ` — ${entry.title}` : "", + entry.nodes !== undefined + ? ` (${entry.nodes} nodes)` + : entry.blocks !== undefined + ? ` (${entry.blocks} blocks)` + : "", + `\n ${entry.path}`, + check.valid ? "" : `\n ${check.summary}`, + ].join(""), + ) + } return { title: `${entries.length} saved workflow${entries.length > 1 ? "s" : ""}`, - output: entries - .map((entry) => - [ - `${entry.name} [${entry.scope}]`, - entry.title ? ` — ${entry.title}` : "", - entry.nodes !== undefined - ? ` (${entry.nodes} nodes)` - : entry.blocks !== undefined - ? ` (${entry.blocks} blocks)` - : "", - `\n ${entry.path}`, - ].join(""), - ) - .join("\n"), + output: rows.join("\n"), metadata: {}, } } case "read": { - if (!params.spec_path || params.spec) { - return yield* Effect.die( - new Error("read requires exactly one 'spec_path' and does not accept inline 'spec'"), - ) - } - const session = yield* sessions.get(SessionID.make(ctx.sessionID)).pipe(Effect.orDie) - const specFile = yield* readWorkflowSpec(undefined, params.spec_path, session.directory, ctx).pipe( - Effect.orDie, - ) + const specFile = yield* loadSpecFile(params.spec_path, callingSession.directory, ctx).pipe(Effect.orDie) + const validation = yield* authoring.prepare({ + action: "start", + source: { kind: "yaml", source: specFile.path, content: specFile.content }, + profile: "portable", + }) return { title: `Workflow spec: ${params.spec_path}`, - output: JSON.stringify(specFile.value, null, 2), + output: JSON.stringify( + { + spec: validation.document, + validation: { + valid: validation.valid, + errors: validation.errors, + warnings: validation.warnings, + }, + }, + null, + 2, + ), + metadata: {}, + } + } + case "validate": { + const loaded = + "spec" in params + ? { path: "", source: { kind: "inline" as const, value: params.spec } } + : yield* loadSpecFile(params.spec_path, callingSession.directory, ctx).pipe( + Effect.map((file) => ({ + path: file.path, + source: { kind: "yaml" as const, source: file.path, content: file.content }, + })), + Effect.catch((error: unknown) => + Effect.succeed({ + path: params.spec_path, + loadError: error instanceof Error ? error.message : String(error), + }), + ), + ) + const profile = params.profile ?? (DagWorkflows.isBuiltinPath(loaded.path) ? "portable" : "environment") + const result = + "loadError" in loaded + ? { + source: loaded.path, + profile, + valid: false, + errors: [ + DagValidation.diagnostic({ + code: DagValidation.DIAGNOSTIC_CODES.schemaInvalid, + path: loaded.path, + message: loaded.loadError, + hint: "Verify the workflow name or YAML file path", + }), + ], + warnings: [], + nodes: [], + } + : yield* authoring.prepare({ + action: "start", + source: loaded.source, + profile, + environment: { directory: callingSession.directory, parent: callingSession.model }, + }) + return { + title: `Workflow validation ${result.valid ? "passed" : "failed"}: ${loaded.path} (${profile})`, + output: JSON.stringify(validationOutput(result), null, 2), metadata: {}, } } case "status": { - if (!params.workflow_id) return yield* Effect.die(new Error("status requires 'workflow_id'")) const workflow = yield* requireOwnedWorkflow(params.workflow_id, ctx.sessionID) const nodes = yield* dag.store.getNodes(params.workflow_id).pipe(Effect.orDie) const config = Dag.parseWorkflowConfig(workflow.config) @@ -365,9 +465,6 @@ export const WorkflowTool = Tool.define< } } case "result": { - if (!params.workflow_id || !params.node_id) { - return yield* Effect.die(new Error("result requires 'workflow_id' and 'node_id'")) - } yield* requireOwnedWorkflow(params.workflow_id, ctx.sessionID) const node = yield* dag.store.getNode(params.workflow_id, params.node_id).pipe(Effect.orDie) if (!node) { @@ -439,29 +536,26 @@ export const WorkflowTool = Tool.define< } } case "start": { - if (params.session_id && params.session_id !== ctx.sessionID) { - return yield* Effect.die(new Error("session_id must match the calling session")) - } const sessionID = SessionID.make(ctx.sessionID) - const session = yield* sessions.get(sessionID).pipe(Effect.orDie) - if (params.project_id && params.project_id !== session.projectID) { - return yield* Effect.die(new Error("project_id must match the parent session project")) - } - const specFile = yield* readWorkflowSpec(params.spec, params.spec_path, session.directory, ctx).pipe( - Effect.orDie, - ) - const spec = yield* decodeStartSpec(specFile.value).pipe( - Effect.mapError((error) => new Error(`Invalid workflow spec ${specFile.path}: ${String(error)}`)), - Effect.orDie, - ) - const config = compileGraph(spec.config, specFile.path) - const missingModels = yield* findNodesWithoutModel({ - nodes: config.nodes, - defaults: config.node_defaults, - directory: session.directory, - parent: session.model, - agents, + const source = yield* loadAuthoringSource( + "spec" in params ? { inline: params.spec } : { specPath: params.spec_path }, + callingSession.directory, + ctx, + ).pipe(Effect.orDie) + const result = yield* authoring.prepare({ + action: "start", + source, + profile: "environment", + environment: { directory: callingSession.directory, parent: callingSession.model }, }) + const blocking = result.errors.filter( + (diagnostic) => diagnostic.code !== DagValidation.DIAGNOSTIC_CODES.modelUnavailable, + ) + if (blocking.length > 0) return yield* rejectDiagnostics(blocking, "Workflow start") + const missingModels = result.errors + .filter((diagnostic) => diagnostic.code === DagValidation.DIAGNOSTIC_CODES.modelUnavailable) + .map((diagnostic) => /^nodes\[([^\]]+)\]$/.exec(diagnostic.path)?.[1]) + .filter((node): node is string => node !== undefined) if (missingModels.length > 0) { yield* question .ask({ @@ -492,42 +586,48 @@ export const WorkflowTool = Tool.define< metadata: {}, } } + if (result.prepared?.action !== "start") return yield* rejectDiagnostics(result.errors, "Workflow start") + const prepared = result.prepared const dagID = yield* dag .create({ - projectID: session.projectID, + projectID: callingSession.projectID, sessionID, - title: spec.title ?? config.name, + title: prepared.title, config: { - ...config, - mode: spec.mode ?? "standard", - ...(spec.admission ? { admission: createAdmissionRecord(spec.admission) } : {}), - } as WorkflowConfig, + ...prepared.config, + ...(prepared.admission ? { admission: createAdmissionRecord(prepared.admission) } : {}), + }, }) .pipe(Effect.orDie) - const mode = spec.mode ?? "standard" + const mode = prepared.config.mode ?? "standard" return { - title: `Workflow started: ${config.name}`, - output: `\n${config.nodes.length} nodes registered.\nDo not poll this workflow. It runs asynchronously and will wake the parent session when attention is required.\n`, + title: `Workflow started: ${prepared.config.name}`, + output: `\n${result.prepared.nodes.length} nodes registered.\nDo not poll this workflow. It runs asynchronously and will wake the parent session when attention is required.\n`, metadata: { workflowId: dagID } as Metadata, } } case "extend": { - if (!params.workflow_id) return yield* Effect.die(new Error("extend requires 'workflow_id'")) - yield* requireOwnedWorkflow(params.workflow_id, ctx.sessionID) - const session = yield* sessions.get(SessionID.make(ctx.sessionID)).pipe(Effect.orDie) - const specFile = yield* readWorkflowSpec(params.spec, params.spec_path, session.directory, ctx).pipe( - Effect.orDie, - ) - const spec = yield* decodeExtendSpec(specFile.value).pipe( - Effect.mapError((error) => new Error(`Invalid workflow spec ${specFile.path}: ${String(error)}`)), - Effect.orDie, - ) + const workflow = yield* requireOwnedWorkflow(params.workflow_id, ctx.sessionID) + const workflowDefaults = Dag.parseWorkflowConfig(workflow.config)?.node_defaults const knownDependencies = (yield* dag.store.getNodes(params.workflow_id).pipe(Effect.orDie)).map( (node) => node.id, ) - const nodes = compileNodeSource(spec, specFile.path, knownDependencies) + const source = yield* loadAuthoringSource( + "spec" in params ? { inline: params.spec } : { specPath: params.spec_path }, + callingSession.directory, + ctx, + ).pipe(Effect.orDie) + const result = yield* authoring.prepare({ + action: "extend", + source, + profile: "environment", + environment: { directory: callingSession.directory, parent: callingSession.model }, + known_dependencies: knownDependencies, + node_defaults: workflowDefaults, + }) + if (!result.valid || !result.prepared) return yield* rejectDiagnostics(result.errors, "Workflow extend") const r = yield* withTerminalRecovery( - dag.extend(params.workflow_id, nodes), + dag.extend(params.workflow_id, result.prepared.nodes), "Terminal workflows are immutable except for the additive-extend reopen, which requires the workflow to have completed naturally at a wake-eligible reporting checkpoint (fragment adds new node ids; no early control(complete); no executed node beyond the checkpoint — condition-skipped dependents are fine). When the reopen does not apply, recover by starting a NEW workflow spec that reuses this workflow's completed outputs as static input.", ).pipe(Effect.orDie) return { @@ -537,15 +637,42 @@ export const WorkflowTool = Tool.define< } } case "control": { - if (!params.workflow_id || !params.operation) { - return yield* Effect.die( - new Error( - `control requires 'workflow_id' and 'operation' (got workflow_id=${params.workflow_id ?? ""}, operation=${params.operation ?? ""}). Example: { action: "control", workflow_id: "dag_...", operation: "pause" }. On a cancel/replan intent, issue pause FIRST — it needs no spec and freezes scheduling instantly while you compose the replan.`, - ), - ) - } const wfId = params.workflow_id - yield* requireOwnedWorkflow(wfId, ctx.sessionID) + const workflow = yield* requireOwnedWorkflow(wfId, ctx.sessionID) + if (params.operation === "replan") { + const workflowDefaults = Dag.parseWorkflowConfig(workflow.config)?.node_defaults + const knownDependencies = (yield* dag.store.getNodes(wfId).pipe(Effect.orDie)).map((node) => node.id) + const source = yield* loadAuthoringSource( + "spec" in params ? { inline: params.spec } : { specPath: params.spec_path }, + callingSession.directory, + ctx, + ).pipe(Effect.orDie) + const result = yield* authoring.prepare({ + action: "replan", + source, + profile: "environment", + environment: { directory: callingSession.directory, parent: callingSession.model }, + known_dependencies: knownDependencies, + node_defaults: workflowDefaults, + }) + if (!result.valid || !result.prepared) return yield* rejectDiagnostics(result.errors, "Workflow replan") + // The graph raced to terminal while the fragment was being + // composed (the pause-first protocol was skipped). Surface + // the recovery options instead of a bare iron-law rejection. + const r = yield* withTerminalRecovery( + dag.replan(wfId, { nodes: result.prepared.nodes }), + "The workflow reached a terminal status before the replan arrived — terminal workflows are immutable. Recover by starting a new workflow with the updated node definitions, or extend if a reporting leaf checkpoint naturally completed the graph. Next time issue control(pause) BEFORE composing the spec.", + ).pipe(Effect.orDie) + const ignored = + r.ignore.length > 0 + ? `\nIgnored (terminal, immutable — add replacements under new ids to retry): ${r.ignore.join(", ")}` + : "" + return { + title: `Workflow replanned: +${r.add.length} -${r.cancel.length} ↻${r.restart.length}`, + output: `\nAdded: ${r.add.join(", ")}\nCancelled: ${r.cancel.join(", ")}\nRestarted: ${r.restart.join(", ")}\nReplaced: ${r.replace.join(", ")}${ignored}\n`, + metadata: { workflowId: wfId, ...r } as Metadata, + } + } switch (params.operation) { case "pause": yield* dag.pause(wfId).pipe(Effect.orDie) @@ -575,34 +702,6 @@ export const WorkflowTool = Tool.define< output: ``, metadata: { workflowId: wfId } as Metadata, } - case "replan": { - const session = yield* sessions.get(SessionID.make(ctx.sessionID)).pipe(Effect.orDie) - const specFile = yield* readWorkflowSpec(params.spec, params.spec_path, session.directory, ctx).pipe( - Effect.orDie, - ) - const spec = yield* decodeReplanSpec(specFile.value).pipe( - Effect.mapError((error) => new Error(`Invalid workflow spec ${specFile.path}: ${String(error)}`)), - Effect.orDie, - ) - const knownDependencies = (yield* dag.store.getNodes(wfId).pipe(Effect.orDie)).map((node) => node.id) - const fragment = compileGraph(spec.fragment, specFile.path, knownDependencies) - // The graph raced to terminal while the fragment was being - // composed (the pause-first protocol was skipped). Surface - // the recovery options instead of a bare iron-law rejection. - const r = yield* withTerminalRecovery( - dag.replan(wfId, { nodes: fragment.nodes }), - "The workflow reached a terminal status before the replan arrived — terminal workflows are immutable. Recover by starting a new workflow with the updated node definitions, or extend if a reporting leaf checkpoint naturally completed the graph. Next time issue control(pause) BEFORE composing the spec.", - ).pipe(Effect.orDie) - const ignored = - r.ignore.length > 0 - ? `\nIgnored (terminal, immutable — add replacements under new ids to retry): ${r.ignore.join(", ")}` - : "" - return { - title: `Workflow replanned: +${r.add.length} -${r.cancel.length} ↻${r.restart.length}`, - output: `\nAdded: ${r.add.join(", ")}\nCancelled: ${r.cancel.join(", ")}\nRestarted: ${r.restart.join(", ")}\nReplaced: ${r.replace.join(", ")}${ignored}\n`, - metadata: { workflowId: wfId, ...r } as Metadata, - } - } case "step": { const r = yield* dag.step(wfId).pipe(Effect.orDie) if (r.status === "no_ready_nodes") { @@ -626,6 +725,10 @@ export const WorkflowTool = Tool.define< }), ) +// ============================================================================ +// Helpers +// ============================================================================ + function resultPageEnd(content: string, offset: number, limit: number) { const end = Math.min(content.length, offset + limit) if (end >= content.length) return end @@ -638,53 +741,19 @@ function resultPageEnd(content: string, offset: number, limit: number) { return end - offset === 1 ? end + 1 : end - 1 } -type WorkflowGraphInput = Schema.Schema.Type -type NodeSource = Pick - -function compileGraph(graph: WorkflowGraphInput, source: string, knownDependencies?: string[]) { - const nodes = compileNodeSource(graph, source, knownDependencies) - const { objective: _objective, blocks: _blocks, nodes: _nodes, ...config } = graph +function validationOutput(result: DagValidation.ValidationResult) { return { - ...config, - nodes, - } as WorkflowConfig + source: result.source, + profile: result.profile, + valid: result.valid, + errors: result.errors, + warnings: result.warnings, + nodes: result.nodes, + } } -function compileNodeSource(source: NodeSource, path: string, knownDependencies?: string[]) { - const hasNodes = source.nodes !== undefined - const hasBlocks = source.blocks !== undefined - if (hasNodes === hasBlocks) throw new Error(`Invalid workflow graph ${path}: use exactly one of nodes or blocks`) - if (source.nodes) return source.nodes as NodeConfig[] - if (!source.objective) throw new Error(`Invalid workflow graph ${path}: blocks require objective`) - return DagBlocks.compileWorkflowBlocks( - { - objective: source.objective, - blocks: source.blocks as DagBlocks.WorkflowBlock[], - }, - { known_dependencies: knownDependencies }, - ) -} - -function readWorkflowSpec( - spec: Record | undefined, - specPath: string | undefined, - directory: string, - ctx: Tool.Context, -) { +function loadSpecFile(specPath: string, directory: string, ctx: Tool.Context) { return Effect.gen(function* () { - if (spec && specPath) { - return yield* Effect.fail( - new Error("Workflow configuration accepts exactly one source: remove either 'spec' or 'spec_path'."), - ) - } - if (spec) return { path: "", value: spec } - if (!specPath) { - return yield* Effect.fail( - new Error( - `Workflow configuration requires exactly one of 'spec' or 'spec_path'. Pass an inline structured spec for a one-off graph, or a saved workflow name/path through 'spec_path'.`, - ), - ) - } const filepath = yield* resolveSpecPath(specPath, directory, ctx) // Builtin templates are compiled into the binary (no backing file). @@ -693,11 +762,7 @@ function readWorkflowSpec( if (content === undefined) { return yield* Effect.fail(new Error(`Workflow spec not found: ${filepath}`)) } - const value = yield* Effect.try({ - try: () => Bun.YAML.parse(content), - catch: (error) => workflowSpecParseError(filepath, error), - }) - return { path: filepath, value } + return { path: filepath, content } } const file = Bun.file(filepath) @@ -713,14 +778,21 @@ function readWorkflowSpec( try: () => file.text(), catch: (error) => new Error(`Failed to read workflow spec ${filepath}: ${String(error)}`), }) - const value = yield* Effect.try({ - try: () => Bun.YAML.parse(content), - catch: (error) => workflowSpecParseError(filepath, error), - }) - return { path: filepath, value } + return { path: filepath, content } }) } +function loadAuthoringSource( + input: { inline: unknown; specPath?: never } | { inline?: never; specPath: string }, + directory: string, + ctx: Tool.Context, +): Effect.Effect { + if ("inline" in input) return Effect.succeed({ kind: "inline" as const, value: input.inline }) + return loadSpecFile(input.specPath, directory, ctx).pipe( + Effect.map((file) => ({ kind: "yaml" as const, source: file.path, content: file.content })), + ) +} + /** Directories (and the builtin fallback, when the release ships templates) a * bare workflow name may resolve from — for "not found" / empty-library hints. */ function searchedScopes(directory: string) { @@ -758,10 +830,6 @@ function resolveSpecPath(specPath: string, directory: string, ctx: Tool.Context) }) } -function workflowSpecParseError(filepath: string, error: unknown) { - return new Error(`Invalid workflow YAML ${filepath}: ${error instanceof Error ? error.message : String(error)}`) -} - /** Terminal-workflow rejections surface as defects carrying recovery * guidance, not bare iron-law errors. Shared by the replan and extend paths. */ function withTerminalRecovery(effect: Effect.Effect, guidance: string) { @@ -773,36 +841,9 @@ function withTerminalRecovery(effect: Effect.Effect, guidance: stri ) } -function findNodesWithoutModel(input: { - nodes: ReadonlyArray> - defaults?: Schema.Schema.Type["node_defaults"] - directory: string - parent?: Session.Info["model"] - agents: Agent.Interface -}) { - if (input.nodes.length === 0) return Effect.succeed([]) - return Effect.gen(function* () { - const config = yield* DagConfig.load(input.directory) - return yield* Effect.filter( - input.nodes, - (node) => - Effect.gen(function* () { - const agent = yield* input.agents.get(node.worker_type).pipe( - Effect.map((info) => info as Agent.Info | undefined), - Effect.catchCause(() => Effect.succeed(undefined)), - ) - return ( - DagModel.resolve({ - tier: DagConfig.tierModel(config, { - required: node.required ?? input.defaults?.required ?? Dag.DEFAULT_WORKFLOW_CONFIG.nodeRequired, - workerType: node.worker_type, - }), - agent: agent?.model, - parent: input.parent ? { modelID: input.parent.id, providerID: input.parent.providerID } : undefined, - }) === undefined - ) - }), - { concurrency: "unbounded" }, - ).pipe(Effect.map((nodes) => nodes.map((node) => node.id))) - }) +async function entryContent(entry: DagWorkflows.Entry): Promise { + if (entry.content !== undefined) return entry.content + return Bun.file(entry.path) + .text() + .catch(() => undefined) } diff --git a/packages/opencode/test/command/command.test.ts b/packages/opencode/test/command/command.test.ts index 160937d0ac..958ee3129d 100644 --- a/packages/opencode/test/command/command.test.ts +++ b/packages/opencode/test/command/command.test.ts @@ -108,7 +108,7 @@ describe("legacy command registry", () => { "Use @security-reviewer to review this project. Do not modify files.", ) - expect(expanded).toContain("orchestration-router") + expect(expanded).toContain("resident Orchestration Router") expect(expanded).toMatch(/Preserve\s+the task, user constraints/) expect(expanded).toContain("worker types or model IDs") expect(expanded).toContain("configured capability or model") diff --git a/packages/opencode/test/dag/blocks.test.ts b/packages/opencode/test/dag/blocks.test.ts index 773b72605e..038ccc4217 100644 --- a/packages/opencode/test/dag/blocks.test.ts +++ b/packages/opencode/test/dag/blocks.test.ts @@ -3,7 +3,7 @@ import { DagBlocks } from "@/dag/blocks" import { DagConfig } from "@/dag/config" describe("workflow blocks", () => { - it("compiles a staged route and carries objective, instructions, skills, and dependencies", () => { + it("compiles a staged route and carries objective, instructions, and dependencies", () => { const nodes = DagBlocks.compileWorkflowBlocks({ objective: "Add durable session recovery", blocks: [ @@ -16,7 +16,6 @@ describe("workflow blocks", () => { id: "build", kind: "coding", depends_on: ["map"], - skills: ["tdd"], }, { id: "verify", @@ -35,8 +34,8 @@ describe("workflow blocks", () => { objective: "Add durable session recovery", instruction: "Locate persistence ownership", }) - expect(nodes[1]?.prompt_template.inline).toContain("load these relevant skills") - expect(nodes[1]?.prompt_template.inline).toContain("tdd") + expect(nodes[1]?.prompt_template.inline).toContain("failing check") + expect(nodes[1]?.prompt_template.inline).not.toContain("Skill") expect(nodes.map((node) => ({ id: node.id, required: node.required }))).toEqual([ { id: "map", required: false }, { id: "build", required: false }, @@ -44,6 +43,48 @@ describe("workflow blocks", () => { ]) }) + it("composes configured design delivery capabilities without new lifecycle kinds", () => { + const nodes = DagBlocks.compileWorkflowBlocks({ + objective: "Design, implement, and review project-owned memory", + blocks: [ + { + id: "codebase-design", + kind: "plan", + instruction: "Define the project identity seam and migration boundary.", + }, + { id: "coding", kind: "coding", depends_on: ["codebase-design"] }, + { id: "verify", kind: "verify", depends_on: ["coding"] }, + { id: "global-review", kind: "review", depends_on: ["verify"] }, + ], + }) + + expect(nodes.map((node) => node.id)).toEqual([ + "codebase-design", + "coding", + "verify", + "global-review--standards", + "global-review--intent", + "global-review", + ]) + expect(nodes[0]?.prompt_template.input).toMatchObject({ + instruction: "Define the project identity seam and migration boundary.", + }) + }) + + it("keeps a pruned design delivery route valid when evidence is already supplied", () => { + const nodes = DagBlocks.compileWorkflowBlocks({ + objective: "Implement the confirmed design from supplied file-level evidence", + blocks: [ + { id: "coding", kind: "coding" }, + { id: "verify", kind: "verify", depends_on: ["coding"] }, + { id: "global-review", kind: "review", depends_on: ["verify"] }, + ], + }) + + expect(nodes.some((node) => node.worker_type === "explore")).toBe(false) + expect(nodes.find((node) => node.id === "global-review")?.required).toBe(true) + }) + it("expands debug into evidence and diagnosis nodes", () => { const nodes = DagBlocks.compileWorkflowBlocks({ objective: "Find the source of a timeout", diff --git a/packages/opencode/test/dag/dag-create-validation.test.ts b/packages/opencode/test/dag/dag-create-validation.test.ts index 2ab11022de..61b65d7102 100644 --- a/packages/opencode/test/dag/dag-create-validation.test.ts +++ b/packages/opencode/test/dag/dag-create-validation.test.ts @@ -235,10 +235,14 @@ describe("Dag prompt_template binding validation", () => { title: "binding-extend", config: { name: "binding-extend", nodes: [node("explore")] }, }).pipe(Effect.orDie) - const errorMessage = yield* dag.extend(dagID, [ + // extend internally routes through _replan, which now uses the same + // StructuralValidationError as create (shared authority). + const error = yield* dag.extend(dagID, [ { ...node("repair", ["explore"]), prompt_template: { inline: "Use {{path}}" } }, - ]).pipe(Effect.catch((e: Error) => Effect.succeed(e.message))) - expect(errorMessage).toContain('Replan rejected: node "repair" prompt_template references unbound variable "{{path}}"') + ]).pipe(Effect.catch((e: unknown) => Effect.succeed(e))) + expect(error).toBeInstanceOf(Dag.StructuralValidationError) + if (!(error instanceof Error)) throw error + expect(error.message).toContain('node "repair" prompt_template references unbound variable "{{path}}"') }).pipe(Effect.scoped, Effect.provide(dagLayer)), ) }) diff --git a/packages/opencode/test/dag/dag-templates-generation.test.ts b/packages/opencode/test/dag/dag-templates-generation.test.ts new file mode 100644 index 0000000000..f65ba88a36 --- /dev/null +++ b/packages/opencode/test/dag/dag-templates-generation.test.ts @@ -0,0 +1,144 @@ +import { describe, expect, it } from "bun:test" +import fs from "node:fs/promises" +import path from "node:path" +import { tmpdir } from "../fixture/fixture" + +// Generation embeds DAG_TEMPLATES_DIR content into the binary (script/generate.ts). +// Validate-before-embed: an invalid or unparseable template must abort +// generation instead of shipping a builtin template that fails at start/read +// time. Runs generate.ts as a subprocess to exercise the real build path. + +const pkgRoot = path.resolve(import.meta.dir, "..", "..") + +const VALID_TEMPLATE = `config: + name: valid-route + objective: Ship the bounded change + blocks: + - id: plan + kind: plan +` + +// Review fed by prototype writers without verification — the exact shape the +// block compiler rejects (and the pre-fix prototype-decision-route pinned). +const INVALID_TEMPLATE = `config: + name: invalid-route + objective: Ship the bounded change + blocks: + - id: proto + kind: prototype + - id: review + kind: review + depends_on: [proto] +` + +async function runGenerate(templatesDir: string, modelsSnapshot: string) { + const result = Bun.spawnSync({ + cmd: ["bun", path.join("script", "generate.ts")], + cwd: pkgRoot, + env: { ...process.env, DAG_TEMPLATES_DIR: templatesDir, MODELS_DEV_API_JSON: modelsSnapshot }, + stdout: "pipe", + stderr: "pipe", + }) + return { + exitCode: result.exitCode, + output: `${result.stdout.toString()}\n${result.stderr.toString()}`, + } +} + +// modelsSnapshot lives inside the scoped tmpdir so cleanup is guaranteed even +// when the test body throws — no separate rm that could leak on an exception path. +async function withTemplatesDir( + files: Record, + fn: (dir: string, modelsSnapshot: string) => Promise, +) { + await using tmp = await tmpdir({ + init: async (dir) => { + const templates = path.join(dir, "templates") + await fs.mkdir(templates, { recursive: true }) + for (const [name, content] of Object.entries(files)) { + await fs.writeFile(path.join(templates, name), content) + } + await fs.writeFile( + path.join(templates, "runtime-compat.json"), + JSON.stringify({ runtime_repo: "LeXwDeX/OpenCode-GraphAgent", runtime_commit: "0".repeat(40) }), + ) + await fs.writeFile(path.join(dir, "models-snapshot.json"), "{}") + }, + }) + await fn(path.join(tmp.path, "templates"), path.join(tmp.path, "models-snapshot.json")) +} + +describe("dag template generation validates before embedding", () => { + it( + "embeds a directory whose templates all pass portable validation", + async () => { + await withTemplatesDir({ "valid-route.yml": VALID_TEMPLATE }, async (dir, modelsSnapshot) => { + const result = await runGenerate(dir, modelsSnapshot) + expect(result.exitCode).toBe(0) + expect(result.output).toContain("1 templates (all validated)") + }) + }, + { timeout: 60_000 }, + ) + + it( + "aborts when a template fails portable validation", + async () => { + await withTemplatesDir( + { "valid-route.yaml": VALID_TEMPLATE, "invalid-route.yaml": INVALID_TEMPLATE }, + async (dir, modelsSnapshot) => { + const result = await runGenerate(dir, modelsSnapshot) + expect(result.exitCode).not.toBe(0) + expect(result.output).toContain("invalid-route.yaml [block.compile_failed]") + expect(result.output).toContain("block.compile_failed") + }, + ) + }, + { timeout: 60_000 }, + ) + + it( + "aborts when a template is not parseable YAML", + async () => { + await withTemplatesDir( + { "broken.yaml": "key: [unclosed", "valid-route.yaml": VALID_TEMPLATE }, + async (dir, modelsSnapshot) => { + const result = await runGenerate(dir, modelsSnapshot) + expect(result.exitCode).not.toBe(0) + }, + ) + }, + { timeout: 60_000 }, + ) + + it( + "aborts when runtime compatibility metadata is missing", + async () => { + await using tmp = await tmpdir({ + init: async (dir) => { + await fs.writeFile(path.join(dir, "valid-route.yml"), VALID_TEMPLATE) + await fs.writeFile(path.join(dir, "models-snapshot.json"), "{}") + }, + }) + const result = await runGenerate(tmp.path, path.join(tmp.path, "models-snapshot.json")) + expect(result.exitCode).not.toBe(0) + expect(result.output).toContain("runtime compatibility file is missing") + }, + { timeout: 60_000 }, + ) + + it( + "rejects duplicate logical names across yaml extensions", + async () => { + await withTemplatesDir( + { "duplicate.yaml": VALID_TEMPLATE, "duplicate.yml": VALID_TEMPLATE }, + async (dir, modelsSnapshot) => { + const result = await runGenerate(dir, modelsSnapshot) + expect(result.exitCode).not.toBe(0) + expect(result.output).toContain("duplicated across .yaml/.yml") + }, + ) + }, + { timeout: 60_000 }, + ) +}) diff --git a/packages/opencode/test/dag/dag-validation-parity.test.ts b/packages/opencode/test/dag/dag-validation-parity.test.ts new file mode 100644 index 0000000000..bba3378dc6 --- /dev/null +++ b/packages/opencode/test/dag/dag-validation-parity.test.ts @@ -0,0 +1,199 @@ +import { describe, expect } from "bun:test" +import { Effect, Layer } from "effect" +import { Database } from "@opencode-ai/core/database/database" +import { EventV2 } from "@opencode-ai/core/event" +import { DagProjector } from "@opencode-ai/core/dag/projector" +import { DagStore } from "@opencode-ai/core/dag/store" +import { Project } from "@opencode-ai/core/project" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { SessionTable } from "@opencode-ai/core/session/sql" +import { AbsolutePath } from "@opencode-ai/core/schema" +import { EventV2Bridge } from "@/event-v2-bridge" +import { Dag, type NodeConfig } from "@/dag/dag" +import { DagValidation } from "@/dag/validation" +import { WorkflowAuthoring } from "@/dag/authoring" +import { testEffect } from "../lib/effect" + +const testLayer = Layer.mergeAll( + Database.defaultLayer, + EventV2.defaultLayer, + DagProjector.defaultLayer, + DagStore.defaultLayer, + EventV2Bridge.defaultLayer, +) + +const dagLayer = Layer.provideMerge(Dag.layer, testLayer) + +const it = testEffect(dagLayer) + +const validate = (value: unknown) => + WorkflowAuthoring.make().prepare({ + action: "start", + source: { kind: "inline", value }, + profile: "portable", + }) + +// The same bad spec must be rejected with the same diagnostic codes and +// field paths by the validate action (pure validator) and by start +// (Dag.create reusing the shared structural core) — before any event is +// published in either case. + +const badNodes = [ + { + id: "a", + name: "a", + worker_type: "general", + depends_on: ["missing"], + prompt_template: { inline: "Use {{gone}}" }, + }, + { + id: "b", + name: "b", + worker_type: "general", + depends_on: ["b"], + prompt_template: { inline: "Self loop" }, + }, +] + +describe("validate/start parity through the shared validator", () => { + it.effect("the same bad spec yields the same structural codes and paths", () => + Effect.gen(function* () { + const dag = yield* Dag.Service + const validation = yield* validate({ config: { name: "parity", nodes: badNodes } }) + expect(validation.valid).toBe(false) + + const error = yield* dag + .create({ + projectID: "project-1", + sessionID: "ses_parity", + title: "parity", + config: { name: "parity", nodes: badNodes as NodeConfig[] }, + }) + .pipe(Effect.catch((e: Error) => Effect.succeed(e))) + expect(error).toBeInstanceOf(Dag.StructuralValidationError) + const createErrors = (error as Dag.StructuralValidationError).diagnostics.filter( + (d) => d.severity === "error", + ) + const key = (d: { code: string; path: string; message: string }) => `${d.code}|${d.path}|${d.message}` + // Same authority ⇒ same codes and paths for the structural rules + // (order differs: create reports in legacy class order). + expect(createErrors.map(key).sort()).toEqual( + validation.errors + .filter( + (d) => + d.code === DagValidation.DIAGNOSTIC_CODES.dagInvalid || + d.code === DagValidation.DIAGNOSTIC_CODES.promptUnboundVariable, + ) + .map(key) + .sort(), + ) + }), + ) + + it.effect("create rejection publishes no events", () => + Effect.gen(function* () { + const dag = yield* Dag.Service + const store = dag.store + const error = yield* dag + .create({ + projectID: "project-1", + sessionID: "ses_parity_no_events", + title: "parity-no-events", + config: { name: "parity", nodes: badNodes as NodeConfig[] }, + }) + .pipe(Effect.catch((e: Error) => Effect.succeed(e))) + expect(error).toBeInstanceOf(Error) + expect(yield* store.getNodes("anything").pipe(Effect.orDie)).toEqual([]) + }), + ) + + it.effect("the same uncompilable block graph fails validate and start identically", () => + Effect.gen(function* () { + // prototype writers feeding a review without verification — the exact + // shape pinned from the pre-fix prototype-decision-route template. + const value = { + config: { + name: "review-without-verify", + objective: "Ship it", + blocks: [ + { id: "proto", kind: "prototype" }, + { id: "plan", kind: "plan", depends_on: ["proto"] }, + { id: "review", kind: "review", depends_on: ["plan"] }, + ], + }, + } as const + const validation = yield* validate(value) + expect(validation.valid).toBe(false) + expect(validation.errors[0]?.code).toBe(DagValidation.DIAGNOSTIC_CODES.blockCompileFailed) + // The start path compiles through the same shared function. + const compiled = DagValidation.compileGraphSource(value.config) + expect(compiled.nodes).toBeUndefined() + expect(compiled.diagnostics.map((d) => [d.code, d.path, d.message])).toEqual( + validation.errors.map((d) => [d.code, d.path, d.message]), + ) + }), + ) + + it.effect("replan rejects the same structural errors through the shared authority", () => + Effect.gen(function* () { + // FK setup so the valid workflow we replan against can persist events. + const { db } = yield* Database.Service + yield* db.insert(ProjectTable).values({ id: Project.ID.global, worktree: AbsolutePath.make("/project"), sandboxes: [] }).run().pipe(Effect.orDie) + yield* db.insert(SessionTable).values({ id: "ses_replan_parity" as never, project_id: Project.ID.global, slug: "replan", directory: "/project", title: "replan", version: "test" }).run().pipe(Effect.orDie) + + const dag = yield* Dag.Service + const goodNode: NodeConfig = { + id: "good", + name: "good", + worker_type: "general", + depends_on: [], + required: true, + prompt_template: { inline: "Work" }, + } + const dagID = yield* dag.create({ + projectID: Project.ID.global, + sessionID: "ses_replan_parity", + title: "replan-parity", + config: { name: "replan-parity", nodes: [goodNode] }, + }).pipe(Effect.orDie) + + // Structural errors that planReplan does NOT pre-filter: a condition + // referencing a node outside depends_on, and an unbound prompt + // placeholder. Both are enforced only by the shared structural authority, + // so create and replan must produce the same diagnostic codes. + const badReplanFragment: NodeConfig[] = [ + { + id: "cond", + name: "cond", + worker_type: "general", + depends_on: [], + required: true, + condition: 'gate.output.verdict == "ACCEPT"', + prompt_template: { inline: "Work {{missing}}" }, + }, + ] + + const error = yield* dag.replan(dagID, { nodes: badReplanFragment }).pipe( + Effect.catch((e: unknown) => Effect.succeed(e)), + ) + expect(error).toBeInstanceOf(Dag.StructuralValidationError) + const replanErrors = (error as Dag.StructuralValidationError).diagnostics.filter( + (d) => d.severity === "error", + ) + + // Cross-check against the pure validator for the same fragment nodes. + const validation = yield* validate({ config: { name: "replan-parity", nodes: badReplanFragment } }) + const key = (d: { code: string; path: string; message: string }) => `${d.code}|${d.path}|${d.message}` + expect(replanErrors.map(key).sort()).toEqual( + validation.errors + .filter( + (d) => + d.code === DagValidation.DIAGNOSTIC_CODES.dagInvalid || + d.code === DagValidation.DIAGNOSTIC_CODES.promptUnboundVariable, + ) + .map(key) + .sort(), + ) + }), + ) +}) diff --git a/packages/opencode/test/dag/dag-validation.test.ts b/packages/opencode/test/dag/dag-validation.test.ts new file mode 100644 index 0000000000..7fa0184ac4 --- /dev/null +++ b/packages/opencode/test/dag/dag-validation.test.ts @@ -0,0 +1,542 @@ +import { describe, expect } from "bun:test" +import { Effect } from "effect" +import fs from "node:fs/promises" +import path from "node:path" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { DagValidation } from "../../src/dag/validation" +import { WorkflowAuthoring } from "../../src/dag/authoring" +import { tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +const it = testEffect(CrossSpawnSpawner.defaultLayer) + +function validateSpec(input: { + value: unknown + source: string + profile?: DagValidation.Profile + directory?: string + catalogs?: DagValidation.EnvironmentCatalogs +}) { + return WorkflowAuthoring.make({ loadEnvironment: () => Effect.succeed(input.catalogs ?? {}) }).prepare({ + action: "start", + source: { kind: "inline", value: input.value, source: input.source }, + profile: input.profile, + environment: { directory: input.directory }, + }) +} + +function validateYaml(input: { content: string; source: string; profile?: DagValidation.Profile }) { + return WorkflowAuthoring.make().prepare({ + action: "start", + source: { kind: "yaml", content: input.content, source: input.source }, + profile: input.profile, + }) +} + +const validNodesSpec = { + title: "Two node chain", + config: { + name: "two-node-chain", + nodes: [ + { + id: "explore", + name: "explore", + worker_type: "explore", + depends_on: [], + prompt_template: { inline: "Inspect {{target}}", input: { target: "dag module" } }, + required: true, + }, + { + id: "summarize", + name: "summarize", + worker_type: "general", + depends_on: ["explore"], + prompt_template: { inline: "Summarize {{explore}}." }, + report_to_parent: true, + }, + ], + }, +} + +const validBlocksSpec = { + config: { + name: "plan-verify-review", + objective: "Ship the bounded change with evidence", + blocks: [ + { id: "plan", kind: "plan" }, + { id: "code", kind: "coding", depends_on: ["plan"] }, + { id: "verify", kind: "verify", depends_on: ["code"] }, + { id: "review", kind: "review", depends_on: ["verify"] }, + ], + }, +} + +function projectDir(files: Record) { + return tmpdirScoped({ + init: (directory) => + Effect.promise(async () => { + for (const [file, content] of Object.entries(files)) { + const target = path.join(directory, file) + await fs.mkdir(path.dirname(target), { recursive: true }) + await fs.writeFile(target, content, "utf-8") + } + }), + }) +} + +describe("workflow spec validator", () => { + describe("diagnostic contract", () => { + it.effect("returns stable machine-readable diagnostics with severity, code, path, message, hint", () => + Effect.gen(function* () { + const result = yield* validateSpec({ value: { config: {} }, source: "" }) + expect(result.valid).toBe(false) + expect(result.errors.length).toBeGreaterThan(0) + for (const diagnostic of result.errors) { + expect(diagnostic.severity).toBe("error") + expect(typeof diagnostic.code).toBe("string") + expect(typeof diagnostic.path).toBe("string") + expect(typeof diagnostic.message).toBe("string") + expect(typeof diagnostic.hint).toBe("string") + } + }), + ) + + it.effect("collects several independent errors instead of only the first", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "multi-error", + nodes: [ + { + id: "a", + name: "a", + worker_type: "general", + depends_on: ["missing"], + prompt_template: { inline: "Use {{gone}}" }, + }, + { + id: "a", + name: "dup", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "ok" }, + }, + ], + }, + }, + source: "", + }) + const codes = result.errors.map((d) => d.code) + expect(codes).toContain(DagValidation.DIAGNOSTIC_CODES.dagInvalid) + expect(codes).toContain(DagValidation.DIAGNOSTIC_CODES.promptUnboundVariable) + expect(result.errors.length).toBeGreaterThanOrEqual(3) + }), + ) + + it.effect("orders diagnostics stably for identical input", () => + Effect.gen(function* () { + const input = { + value: { + config: { + name: "ordering", + nodes: [ + { + id: "z", + name: "z", + worker_type: "general", + depends_on: ["missing"], + prompt_template: { inline: "{{gone}}" }, + }, + { + id: "a", + name: "a", + worker_type: "general", + depends_on: ["missing"], + prompt_template: { inline: "{{gone}}" }, + }, + ], + }, + }, + source: "", + } + const first = yield* validateSpec(input) + const second = yield* validateSpec(input) + expect(second.errors).toEqual(first.errors) + }), + ) + + it.effect("returns schema.invalid for malformed YAML through the shared parser", () => + Effect.gen(function* () { + const result = yield* validateYaml({ + content: "config: [unclosed", + source: "broken.yaml", + }) + expect(result).toMatchObject({ + source: "broken.yaml", + profile: "portable", + valid: false, + warnings: [], + nodes: [], + errors: [ + { + severity: "error", + code: DagValidation.DIAGNOSTIC_CODES.schemaInvalid, + path: "$", + message: "file is not parseable YAML", + }, + ], + }) + }), + ) + + it.effect("warning-only validation stays valid", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "warning-only", + nodes: [ + { + id: "gate", + name: "gate", + worker_type: "general", + depends_on: [], + required: true, + output_schema: { type: "object", format: "custom" }, + prompt_template: { inline: "Rule." }, + }, + ], + }, + }, + source: "", + }) + expect(result.valid).toBe(true) + expect(result.errors).toEqual([]) + expect(result.warnings.some((d) => d.code === DagValidation.DIAGNOSTIC_CODES.schemaKeywordWarning)).toBe(true) + }), + ) + + it.effect("validation has no side effects: no services, no files, no workflow id", () => + Effect.gen(function* () { + const tmp = yield* projectDir({}) + const before = yield* Effect.promise(() => fs.readdir(tmp)) + const result = yield* validateSpec({ + value: validNodesSpec, + source: "", + directory: tmp, + }) + expect(result.valid).toBe(true) + expect(JSON.stringify(result)).not.toContain("workflow_id") + expect(yield* Effect.promise(() => fs.readdir(tmp))).toEqual(before) + }), + ) + }) + + describe("portable profile", () => { + it.effect("valid block YAML passes without reading user directories", () => + Effect.gen(function* () { + const result = yield* validateSpec({ value: validBlocksSpec, source: "builtin://test" }) + expect(result.valid).toBe(true) + expect(result.nodes.map((node) => node.id)).toEqual( + expect.arrayContaining(["plan", "code", "verify", "review--standards", "review"]), + ) + expect(result.nodes.find((node) => node.id === "review")?.review_phase).toBe("diff") + }), + ) + + it.effect("valid low-level node YAML passes with compiled-node summary", () => + Effect.gen(function* () { + const result = yield* validateSpec({ value: validNodesSpec, source: "" }) + expect(result.valid).toBe(true) + expect(result.nodes.map((node) => node.id)).toEqual(["explore", "summarize"]) + expect(result.nodes[1]?.depends_on).toEqual(["explore"]) + }), + ) + + it.effect("rejects a spec carrying both graph sources", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "both-sources", + objective: "x", + blocks: [{ id: "plan", kind: "plan" }], + nodes: [{ id: "a", name: "a", worker_type: "general", depends_on: [], prompt_template: { inline: "x" } }], + }, + }, + source: "", + }) + expect(result.valid).toBe(false) + expect(result.errors[0]?.code).toBe(DagValidation.DIAGNOSTIC_CODES.schemaInvalid) + }), + ) + + it.effect("rejects a prompt template selecting both inline and id", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "ambiguous-source", + nodes: [ + { + id: "a", + name: "a", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "x", id: "code-explore" }, + }, + ], + }, + }, + source: "", + }) + expect(result.valid).toBe(false) + }), + ) + + it.effect("rejects a prompt template with no source", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "no-source", + nodes: [ + { + id: "a", + name: "a", + worker_type: "general", + depends_on: [], + prompt_template: { input: { target: "x" } }, + }, + ], + }, + }, + source: "", + }) + expect(result.valid).toBe(false) + }), + ) + + it.effect("flags id prompts as nonportable even when the project happens to own them", () => + Effect.gen(function* () { + const tmp = yield* projectDir({ ".opencode/dag-prompts/code-explore.md": "Explore {{target}}" }) + const result = yield* validateSpec({ + value: { + config: { + name: "id-prompt", + nodes: [ + { + id: "explore", + name: "explore", + worker_type: "explore", + depends_on: [], + prompt_template: { id: "code-explore", input: { target: "x" } }, + }, + ], + }, + }, + source: "builtin://dag-review", + profile: "portable", + directory: tmp, + }) + expect(result.errors.some((d) => d.code === DagValidation.DIAGNOSTIC_CODES.promptNonportableAsset)).toBe(true) + }), + ) + + it.effect("inline prompt with an unbound placeholder fails with node id and path", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: { + config: { + name: "unbound", + nodes: [ + { + id: "a", + name: "a", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "Use {{gone}}" }, + }, + ], + }, + }, + source: "", + }) + const diagnostic = result.errors.find((d) => d.code === DagValidation.DIAGNOSTIC_CODES.promptUnboundVariable) + expect(diagnostic).toBeDefined() + expect(diagnostic?.message).toContain("{{gone}}") + }), + ) + }) + + describe("environment profile", () => { + it.effect("resolves a project prompt and validates its bindings", () => + Effect.gen(function* () { + const tmp = yield* projectDir({ + ".opencode/dag-prompts/code-explore.md": "Explore {{target}} and {{missing}}", + }) + const result = yield* validateSpec({ + value: { + config: { + name: "env-binding", + nodes: [ + { + id: "explore", + name: "explore", + worker_type: "explore", + depends_on: [], + prompt_template: { id: "code-explore", input: { target: "dag" } }, + }, + ], + }, + }, + source: "env.yaml", + profile: "environment", + directory: tmp, + }) + const diagnostic = result.errors.find((d) => d.code === DagValidation.DIAGNOSTIC_CODES.promptUnboundVariable) + expect(diagnostic?.message).toContain('prompt asset "code-explore"') + expect(diagnostic?.message).toContain("{{missing}}") + }), + ) + + it.effect("reports prompt.missing_asset when the id does not resolve", () => + Effect.gen(function* () { + const tmp = yield* projectDir({}) + const result = yield* validateSpec({ + value: { + config: { + name: "missing-asset", + nodes: [ + { + id: "explore", + name: "explore", + worker_type: "explore", + depends_on: [], + prompt_template: { id: "does-not-exist" }, + }, + ], + }, + }, + source: "env.yaml", + profile: "environment", + directory: tmp, + }) + expect(result.errors.some((d) => d.code === DagValidation.DIAGNOSTIC_CODES.promptMissingAsset)).toBe(true) + }), + ) + + it.effect("worker.unknown is an error and block validation is Skill-catalog independent", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: validBlocksSpec, + source: "", + profile: "environment", + catalogs: { + worker_types: new Set(["plan", "general"]), + }, + }) + const unknown = result.errors.filter((d) => d.code === DagValidation.DIAGNOSTIC_CODES.workerUnknown) + expect(unknown.map((d) => d.message)).toEqual(expect.arrayContaining([expect.stringContaining('"build"')])) + expect(result.warnings).toEqual([]) + + const legacy = yield* validateSpec({ + value: { + config: { + ...validBlocksSpec.config, + blocks: [{ id: "plan", kind: "plan", skills: ["ghost-skill"] }], + }, + }, + source: "", + profile: "environment", + catalogs: { worker_types: new Set(["plan", "build", "general"]) }, + }) + expect(legacy.valid).toBe(false) + expect(legacy.errors).toContainEqual( + expect.objectContaining({ + code: DagValidation.DIAGNOSTIC_CODES.schemaInvalid, + path: expect.stringContaining("skills"), + }), + ) + }), + ) + + it.effect("model.unavailable is reported per unresolved node", () => + Effect.gen(function* () { + const result = yield* validateSpec({ + value: validNodesSpec, + source: "", + profile: "environment", + catalogs: { + resolveModel: (node) => Effect.succeed(node.id !== "summarize"), + }, + }) + const diagnostic = result.errors.find((d) => d.code === DagValidation.DIAGNOSTIC_CODES.modelUnavailable) + expect(diagnostic?.path).toBe("nodes[summarize]") + }), + ) + }) + + describe("config repository evidence", () => { + it.effect("pre-fix prototype-decision-route.yaml fails block compilation (pinned fixture)", () => + Effect.gen(function* () { + const source = yield* Effect.promise(() => + Bun.file( + new URL("./fixtures/config-templates-pre-fix/prototype-decision-route.yaml", import.meta.url), + ).text(), + ) + const result = yield* validateSpec({ + value: Bun.YAML.parse(source), + source: "prototype-decision-route.yaml", + }) + expect(result.valid).toBe(false) + const diagnostic = result.errors.find((d) => d.code === DagValidation.DIAGNOSTIC_CODES.blockCompileFailed) + expect(diagnostic).toBeDefined() + expect(diagnostic?.message).toContain("verification") + }), + ) + + it.effect("pre-fix dag-review.yaml prompts are not portable (pinned fixture)", () => + Effect.gen(function* () { + const source = yield* Effect.promise(() => + Bun.file(new URL("./fixtures/config-templates-pre-fix/dag-review.yaml", import.meta.url)).text(), + ) + const result = yield* validateSpec({ + value: Bun.YAML.parse(source), + source: "dag-review.yaml", + }) + expect(result.valid).toBe(false) + const nonportable = result.errors.filter( + (d) => d.code === DagValidation.DIAGNOSTIC_CODES.promptNonportableAsset, + ) + const ids = nonportable.map((d) => d.message) + for (const prompt of ["code-explore", "review-arch", "review-logic", "review-style"]) { + expect(ids.join("\n")).toContain(prompt) + } + }), + ) + + it.effect("every root YAML in the config repository passes portable validation", () => + Effect.gen(function* () { + // Live cross-repo gate: runs where an opencode-dag-config checkout sits + // next to the runtime repo (or OPENCODAG_CONFIG_REPO points at one). + const repoDir = + process.env.OPENCODAG_CONFIG_REPO ?? + path.resolve(import.meta.dir, "..", "..", "..", "..", "opencode-dag-config") + const yamlFiles = (yield* Effect.promise(() => fs.readdir(repoDir).catch(() => [] as string[]))).filter( + (name) => name.endsWith(".yaml") || name.endsWith(".yml"), + ) + // checkout not available — CI pins the evidence above instead + if (yamlFiles.length === 0) return + const failures: Array<{ name: string; errors: DagValidation.Diagnostic[] }> = [] + for (const file of yamlFiles.sort()) { + const text = yield* Effect.promise(() => Bun.file(path.join(repoDir, file)).text()) + const result = yield* validateYaml({ content: text, source: file }) + if (!result.valid) failures.push({ name: file, errors: result.errors }) + } + expect(failures).toEqual([]) + }), + ) + }) +}) diff --git a/packages/opencode/test/dag/fixtures/config-templates-pre-fix/dag-review.yaml b/packages/opencode/test/dag/fixtures/config-templates-pre-fix/dag-review.yaml new file mode 100644 index 0000000000..06c186c92d --- /dev/null +++ b/packages/opencode/test/dag/fixtures/config-templates-pre-fix/dag-review.yaml @@ -0,0 +1,166 @@ +title: "DAG Module Deep Review" +config: + name: dag-module-review + max_concurrency: 5 + max_node_replan_attempts: 3 + max_total_nodes: 20 + node_defaults: + required: false + report_to_parent: false + worker_config: + timeout_ms: 1800000 + nodes: + - id: explore-core + name: explore-core + worker_type: explore + depends_on: [] + prompt_template: + id: code-explore + input: + target: "packages/opencode/src/dag core lifecycle files: dag.ts, config.ts, model.ts, admission.ts, review-lifecycle.ts. Map workflow state machine transitions, locking strategy (withWorkflowLock), node lifecycle (spawn/complete/fail/cancel/pause/resume/step), config normalization, model resolution, and admission QA protocol. Identify state ownership, concurrency guards, and cross-module contracts." + + - id: explore-runtime + name: explore-runtime + worker_type: explore + depends_on: [] + prompt_template: + id: code-explore + input: + target: "packages/opencode/src/dag/runtime execution engine: loop.ts (scheduling loop, layer computation, concurrency control), spawn.ts (child session creation), recovery.ts (crash recovery, reconciliation), eval.ts (condition evaluation, input mapping), capture.ts (output schema validation, submit_result), summary-publisher.ts (event emission). Map the scheduling algorithm, session lifecycle, error propagation, and recovery invariants." + + - id: explore-templates + name: explore-templates + worker_type: explore + depends_on: [] + prompt_template: + id: code-explore + input: + target: "packages/opencode/src/dag/templates template system: resolve.ts (template resolution, rendering, interpolation) and sanitize.ts (input sanitization, injection prevention). Map template loading (by ID from .opencode/dag-prompts, inline), variable interpolation mechanics, and the sanitization boundary. Identify trust assumptions and injection vectors." + + - id: review-arch + name: review-arch + worker_type: review + depends_on: [explore-core, explore-runtime, explore-templates] + prompt_template: + id: review-arch + + - id: review-logic + name: review-logic + worker_type: review + depends_on: [explore-core, explore-runtime, explore-templates] + prompt_template: + id: review-logic + + - id: review-style + name: review-style + worker_type: review + depends_on: [explore-core, explore-runtime, explore-templates] + prompt_template: + id: review-style + + - id: verify-claims + name: verify-claims + worker_type: general + depends_on: [review-arch, review-logic, review-style] + required: true + prompt_template: + inline: | + You are a claim verifier. Three reviewers produced findings and unverified_claims about the DAG module (packages/opencode/src/dag/). + + Your job: take EVERY item listed under `unverified_claims` from all three reviews and check it against the actual source code. For each claim: + 1. Open the cited file(s) and read the relevant code. + 2. Determine: CONFIRMED (the claim is true, cite evidence), REFUTED (the claim is false, cite counter-evidence), or INCONCLUSIVE (cannot determine from code alone, state why). + 3. Also spot-check any finding marked CRITICAL/P0 that lacks a clear file:line citation. + + Output a structured verdict per claim. Never modify any file. + + ## Reviewer outputs to verify: + + ### Architecture Review + {{review-arch}} + + ### Logic Review + {{review-logic}} + + ### Style Review + {{review-style}} + + - id: arbitrate + name: arbitrate + worker_type: review + depends_on: [verify-claims] + required: true + report_to_parent: true + output_schema: + type: object + required: [verdict, summary, findings, required_actions, next_action] + properties: + verdict: + type: string + enum: [ACCEPT, REVISE, REJECT, BLOCKED] + summary: + type: string + findings: + type: array + items: + type: object + properties: + severity: { type: string } + title: { type: string } + evidence: { type: string } + status: { type: string, enum: [confirmed, refuted, inconclusive] } + required_actions: + type: array + items: { type: string } + next_action: + type: object + required: [operation, targets] + properties: + operation: + type: string + enum: [continue, extend, replan, complete, stop] + targets: + type: array + items: { type: string } + prompt_template: + inline: | + You are the arbiter for a deep review of the DAG workflow engine (packages/opencode/src/dag/). + + Three reviewers (architecture, logic, style) produced findings. A verification node then checked all unverified_claims against the actual code. + + Your task: + 1. Rule finding-by-finding: accept only findings with CONFIRMED evidence. Discard REFUTED claims. Flag INCONCLUSIVE items as residual risk. + 2. Deduplicate overlapping findings across reviewers. + 3. Rank confirmed findings by severity and blast radius. + 4. Emit a structured verdict: + - ACCEPT: no CRITICAL/P0 confirmed findings, module is sound. + - REVISE: confirmed findings exist but are addressable without redesign. + - REJECT: confirmed CRITICAL/P0 findings require structural rework. + - BLOCKED: verification was insufficient to rule. + 5. Provide required_actions (concrete, file-scoped) and next_action for the orchestrator. + + Never modify any file. Base your ruling ONLY on verified evidence from the verification node. + + ## Verification Results + {{verify-claims}} + + - id: deep-dive + name: deep-dive + worker_type: general + depends_on: [arbitrate] + condition: 'arbitrate.output.verdict != "ACCEPT"' + report_to_parent: true + prompt_template: + inline: | + The arbiter did not ACCEPT the DAG module review. Its findings and required actions are below. + + For each required_action: + 1. Open the cited file(s) and verify the problem still exists at the stated location. + 2. Produce a corrected, evidence-backed remediation plan: exact file, function, what to change, and why. + 3. Identify any dependencies between actions (ordering constraints). + 4. Flag any action that is infeasible or would cause a regression. + + Output a prioritized remediation plan. Never modify any file. + + ## Arbiter Verdict + {{arbitrate}} diff --git a/packages/opencode/test/dag/fixtures/config-templates-pre-fix/prototype-decision-route.yaml b/packages/opencode/test/dag/fixtures/config-templates-pre-fix/prototype-decision-route.yaml new file mode 100644 index 0000000000..6095253c94 --- /dev/null +++ b/packages/opencode/test/dag/fixtures/config-templates-pre-fix/prototype-decision-route.yaml @@ -0,0 +1,53 @@ +title: "Prototype detour: evidence → experiments → production plan" +config: + name: prototype-decision-route + max_concurrency: 3 + max_node_replan_attempts: 2 + max_total_nodes: 16 + node_defaults: + worker_config: + timeout_ms: 1800000 + objective: >- + Resolve a confirmed runnable design uncertainty with disposable experiments, + then convert only supported observations into a reviewed production plan. + blocks: + - id: uncertainty-map + kind: explore + instruction: >- + Define the exact unknown, current evidence, falsifiable success signal, + constraints, and what the experiment must not attempt to prove. + + - id: simplest-experiment + kind: prototype + depends_on: [uncertainty-map] + instruction: >- + Build the shortest disposable path that can falsify the leading design. + Keep it isolated from production wiring and record reproducible observations. + + - id: contrast-experiment + kind: prototype + depends_on: [uncertainty-map] + instruction: >- + Test the strongest contrasting mechanism or failure mode. Optimize for + information gained, not polish, and keep all artifacts disposable. + + - id: production-plan + kind: plan + depends_on: [simplest-experiment, contrast-experiment] + instruction: >- + Separate observations from inference, discard prototype shortcuts, and + propose production boundaries, migration steps, tests, and stop criteria. + + - id: plan-decision + kind: review + depends_on: [production-plan] + instruction: >- + Verify that the plan follows from experiment evidence, does not promote + throwaway code implicitly, and exposes unresolved risks and falsifiers. + + - id: decision-record + kind: synthesize + depends_on: [plan-decision] + instruction: >- + Record what was learned, what was disproven, the reviewed production path, + acceptance checks, and remaining uncertainty. diff --git a/packages/opencode/test/dag/release-packaging-smoke.test.ts b/packages/opencode/test/dag/release-packaging-smoke.test.ts new file mode 100644 index 0000000000..c9898cdcf9 --- /dev/null +++ b/packages/opencode/test/dag/release-packaging-smoke.test.ts @@ -0,0 +1,338 @@ +import { describe, expect } from "bun:test" +import { Effect } from "effect" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import fs from "node:fs/promises" +import path from "node:path" +import { DagValidation } from "@/dag/validation" +import { WorkflowAuthoring } from "@/dag/authoring" +import { tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +// Release packaging smoke test (change repair-workflow-authoring-validation, +// §6.4): the package-templates job's contract is validate-before-copy, fail +// closed. This simulates the job locally: run the runtime validator CLI, +// package only when it passes, then prove the archive holds exactly the +// validated YAML, compatibility manifest, and required provenance/license +// files, and that all three commit identifiers are recorded. + +const it = testEffect(CrossSpawnSpawner.defaultLayer) + +const pkgRoot = path.resolve(import.meta.dir, "..", "..") + +const VALID_TEMPLATE_A = `config: + name: route-a + objective: Ship the bounded change + blocks: + - id: plan + kind: plan +` + +const VALID_TEMPLATE_B = `config: + name: route-b + nodes: + - id: work + name: work + worker_type: build + depends_on: [] + prompt_template: + inline: Do the work. +` + +const INVALID_TEMPLATE = `config: + name: route-broken + objective: Ship + blocks: + - id: proto + kind: prototype + - id: review + kind: review + depends_on: [proto] +` + +function runValidator(configDir: string) { + const result = Bun.spawnSync({ + cmd: ["bun", path.join("script", "validate-dag-templates.ts"), configDir], + cwd: pkgRoot, + env: { ...process.env }, + stdout: "pipe", + stderr: "pipe", + }) + return { + exitCode: result.exitCode, + stdout: result.stdout.toString(), + stderr: result.stderr.toString(), + } +} + +// The release job and this smoke test run the exact same script, so the +// copy/tar contract cannot drift between CI and the test. +function runPackager(configDir: string, archive: string) { + const result = Bun.spawnSync({ + cmd: ["bun", path.join("script", "package-dag-templates.ts"), configDir, archive], + cwd: pkgRoot, + env: { ...process.env }, + stdout: "pipe", + stderr: "pipe", + }) + return { + exitCode: result.exitCode, + stdout: result.stdout.toString(), + stderr: result.stderr.toString(), + } +} + +function runCliPackager(distDir: string, archive: string) { + const result = Bun.spawnSync({ + cmd: ["bun", path.join("script", "package-cli-artifact.ts"), distDir, archive], + cwd: pkgRoot, + env: { ...process.env }, + stdout: "pipe", + stderr: "pipe", + }) + return { + exitCode: result.exitCode, + stdout: result.stdout.toString(), + stderr: result.stderr.toString(), + } +} + +function configRepoScoped(templates: Record) { + return Effect.gen(function* () { + return yield* tmpdirScoped({ + init: (directory) => + Effect.promise(async () => { + for (const [name, content] of Object.entries(templates)) { + await fs.writeFile(path.join(directory, name), content) + } + // runtime-compat.json travels with the config repo and is read by the CLI. + await fs.writeFile( + path.join(directory, "runtime-compat.json"), + JSON.stringify({ runtime_repo: "LeXwDeX/OpenCode-GraphAgent", runtime_commit: "0".repeat(40) }), + ) + await fs.mkdir(path.join(directory, "third_party", "mattpocock-skills"), { recursive: true }) + await fs.writeFile(path.join(directory, "THIRD_PARTY_NOTICES.md"), "# Third-party notices\n") + await fs.writeFile(path.join(directory, "third_party", "mattpocock-skills", "LICENSE"), "MIT License\n") + await fs.writeFile( + path.join(directory, "third_party", "mattpocock-skills", "SOURCE.md"), + "# Source\n", + ) + for (const command of [ + ["git", "init", "-q"], + ["git", "config", "user.email", "test@example.com"], + ["git", "config", "user.name", "Test"], + ["git", "add", "."], + ["git", "commit", "-qm", "test templates"], + ]) { + const result = Bun.spawnSync({ cmd: command, cwd: directory, stdout: "pipe", stderr: "pipe" }) + if (result.exitCode !== 0) throw new Error(result.stderr.toString()) + } + }), + }) + }) +} + +describe("release packaging smoke test", () => { + it.effect("packages every license referenced by NOTICE into the real CLI archive", () => + Effect.gen(function* () { + const directory = yield* tmpdirScoped() + const dist = path.join(directory, "opencode-test") + yield* Effect.promise(() => fs.mkdir(path.join(dist, "bin"), { recursive: true })) + yield* Effect.promise(() => fs.writeFile(path.join(dist, "bin", "opencode"), "test binary")) + const archive = path.join(directory, "opencode-test.tar.gz") + const packaged = runCliPackager(dist, archive) + expect(packaged.exitCode).toBe(0) + + const unpack = path.join(directory, "unpack") + yield* Effect.promise(() => fs.mkdir(unpack)) + const untar = Bun.spawnSync({ cmd: ["tar", "-xzf", archive, "-C", unpack], stdout: "pipe", stderr: "pipe" }) + expect(untar.exitCode).toBe(0) + const repoRoot = path.resolve(pkgRoot, "..", "..") + for (const name of [ + "NOTICE", + "LICENSE", + "packages/core/src/dag/LICENSE", + "packages/opencode/src/dag/LICENSE", + "third_party/mattpocock-skills/LICENSE", + "third_party/mattpocock-skills/SOURCE.md", + ]) { + expect(yield* Effect.promise(() => fs.readFile(path.join(unpack, name), "utf-8"))).toBe( + yield* Effect.promise(() => fs.readFile(path.join(repoRoot, name), "utf-8")), + ) + } + }), + ) + + it.effect( + "packages exactly the validated YAML through the release packager and records all SHAs", + () => + Effect.gen(function* () { + const configDir = yield* configRepoScoped({ + "route-a.yaml": VALID_TEMPLATE_A, + "route-b.yml": VALID_TEMPLATE_B, + }) + const archive = path.join(configDir, "dag-templates.tar.gz") + const packaged = runPackager(configDir, archive) + expect(packaged.exitCode).toBe(0) + + const manifest = JSON.parse(packaged.stdout) + expect(manifest.files).toEqual([ + "THIRD_PARTY_NOTICES.md", + "route-a.yaml", + "route-b.yml", + "runtime-compat.json", + "third_party/mattpocock-skills/LICENSE", + "third_party/mattpocock-skills/SOURCE.md", + ]) + expect(manifest.template_files).toEqual(["route-a.yaml", "route-b.yml"]) + expect(manifest.file_count).toBe(6) + expect(manifest.template_count).toBe(2) + // Runtime SHA comes from the releasing runtime checkout; compat SHA + // from the config repo's pinned runtime commit. + expect(manifest.runtime_commit).toMatch(/^[0-9a-f]{7,40}$/) + expect(manifest.compat_runtime_sha).toBe("0".repeat(40)) + expect(manifest.template_commit).toMatch(/^[0-9a-f]{40}$/) + + // Unpack the produced artifact and assert it holds exactly the + // validated YAML plus compatibility and provenance metadata, + // byte-identical and usable by the real generation path. + const unpack = path.join(configDir, "unpack") + yield* Effect.promise(() => fs.mkdir(unpack)) + const untar = Bun.spawnSync({ cmd: ["tar", "-xzf", archive, "-C", unpack], stdout: "pipe", stderr: "pipe" }) + expect(untar.exitCode).toBe(0) + + const archived = (yield* Effect.promise(() => fs.readdir(unpack))) + .filter((name) => name.endsWith(".yaml") || name.endsWith(".yml")) + .sort() + expect(archived).toEqual(["route-a.yaml", "route-b.yml"]) + expect((yield* Effect.promise(() => fs.readdir(unpack))).sort()).toEqual([ + "THIRD_PARTY_NOTICES.md", + "route-a.yaml", + "route-b.yml", + "runtime-compat.json", + "third_party", + ]) + expect(yield* Effect.promise(() => fs.readFile(path.join(unpack, "runtime-compat.json"), "utf-8"))).toBe( + yield* Effect.promise(() => fs.readFile(path.join(configDir, "runtime-compat.json"), "utf-8")), + ) + for (const name of archived) { + const content = yield* Effect.promise(() => fs.readFile(path.join(unpack, name), "utf-8")) + expect(content).toBe(yield* Effect.promise(() => fs.readFile(path.join(configDir, name), "utf-8"))) + const result = yield* WorkflowAuthoring.make().prepare({ + action: "start", + source: { kind: "yaml", content, source: name }, + profile: "portable", + }) + expect(result.valid).toBe(true) + } + for (const name of [ + "THIRD_PARTY_NOTICES.md", + "third_party/mattpocock-skills/LICENSE", + "third_party/mattpocock-skills/SOURCE.md", + ]) { + expect(yield* Effect.promise(() => fs.readFile(path.join(unpack, name), "utf-8"))).toBe( + yield* Effect.promise(() => fs.readFile(path.join(configDir, name), "utf-8")), + ) + } + + const modelsSnapshot = path.join(configDir, "models-snapshot.json") + yield* Effect.promise(() => fs.writeFile(modelsSnapshot, "{}")) + const generated = Bun.spawnSync({ + cmd: ["bun", path.join("script", "generate.ts")], + cwd: pkgRoot, + env: { ...process.env, DAG_TEMPLATES_DIR: unpack, MODELS_DEV_API_JSON: modelsSnapshot }, + stdout: "pipe", + stderr: "pipe", + }) + expect(`${generated.stdout.toString()}\n${generated.stderr.toString()}`).not.toContain( + "runtime compatibility file is missing", + ) + expect(generated.exitCode).toBe(0) + }), + { timeout: 60_000 }, + ) + + it.effect( + "fails closed on duplicate logical names before packaging", + () => + Effect.gen(function* () { + const configDir = yield* configRepoScoped({ + "duplicate.yaml": VALID_TEMPLATE_A, + "duplicate.yml": VALID_TEMPLATE_B, + }) + const archive = path.join(configDir, "dag-templates.tar.gz") + const packaged = runPackager(configDir, archive) + + expect(packaged.exitCode).toBe(1) + expect(packaged.stderr).toContain("duplicated across .yaml/.yml") + expect(yield* Effect.promise(() => Bun.file(archive).exists())).toBe(false) + const validation = runValidator(configDir) + expect(validation.exitCode).toBe(1) + expect(JSON.parse(validation.stdout).discovery_error).toContain("duplicated across .yaml/.yml") + }), + { timeout: 60_000 }, + ) + + it.effect( + "fails closed: an invalid template blocks packaging entirely", + () => + Effect.gen(function* () { + const configDir = yield* configRepoScoped({ + "route-a.yaml": VALID_TEMPLATE_A, + "route-broken.yaml": INVALID_TEMPLATE, + }) + const archive = path.join(configDir, "dag-templates.tar.gz") + const packaged = runPackager(configDir, archive) + expect(packaged.exitCode).toBe(1) + expect(packaged.stderr).toContain("Template validation failed") + expect(packaged.stderr).toContain("Packaging aborted") + // Nothing was archived — the release job aborts at the gate. + expect(yield* Effect.promise(() => Bun.file(archive).exists())).toBe(false) + + const gate = runValidator(configDir) + expect(gate.exitCode).toBe(1) + const report = JSON.parse(gate.stdout) + expect(report.invalid_count).toBe(1) + const broken = report.results.find((entry: { name: string }) => entry.name === "route-broken.yaml") + expect(broken.errors[0].code).toBe(DagValidation.DIAGNOSTIC_CODES.blockCompileFailed) + }), + { timeout: 60_000 }, + ) + + it.effect( + "reports an unparseable template inside the machine-readable JSON", + () => + Effect.gen(function* () { + const configDir = yield* configRepoScoped({ + "route-a.yaml": VALID_TEMPLATE_A, + "route-unparseable.yaml": "key: [unclosed", + }) + const gate = runValidator(configDir) + expect(gate.exitCode).toBe(1) + // stdout stays parseable JSON even when a file cannot be parsed. + const report = JSON.parse(gate.stdout) + const broken = report.results.find((entry: { name: string }) => entry.name === "route-unparseable.yaml") + expect(broken.valid).toBe(false) + expect(broken.errors[0].code).toBe(DagValidation.DIAGNOSTIC_CODES.schemaInvalid) + expect(broken.errors[0].message).toContain("not parseable YAML") + }), + { timeout: 60_000 }, + ) + + it.effect( + "fails closed when runtime compatibility metadata is missing or invalid", + () => + Effect.gen(function* () { + const configDir = yield* configRepoScoped({ "route-a.yaml": VALID_TEMPLATE_A }) + yield* Effect.promise(() => fs.writeFile(path.join(configDir, "runtime-compat.json"), "{broken")) + const invalid = runValidator(configDir) + expect(invalid.exitCode).toBe(1) + expect(JSON.parse(invalid.stdout).compat_error).toContain("runtime compatibility file is invalid") + + yield* Effect.promise(() => fs.rm(path.join(configDir, "runtime-compat.json"))) + const missing = runValidator(configDir) + expect(missing.exitCode).toBe(1) + expect(JSON.parse(missing.stdout).compat_error).toContain("runtime compatibility file is missing") + }), + { timeout: 60_000 }, + ) +}) diff --git a/packages/opencode/test/dag/workflow-authoring.test.ts b/packages/opencode/test/dag/workflow-authoring.test.ts new file mode 100644 index 0000000000..1df8901e03 --- /dev/null +++ b/packages/opencode/test/dag/workflow-authoring.test.ts @@ -0,0 +1,211 @@ +import { describe, expect } from "bun:test" +import { Effect } from "effect" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { WorkflowAuthoring } from "../../src/dag/authoring" +import { DagValidation } from "../../src/dag/validation" +import { testEffect } from "../lib/effect" + +const it = testEffect(CrossSpawnSpawner.defaultLayer) + +const node = { + id: "work", + name: "work", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "Do the work" }, +} + +const start = { + config: { + name: "one-node", + nodes: [node], + }, +} + +describe("WorkflowAuthoring source-to-graph seam", () => { + it.effect("prepares start, extend, and replan through one action-aware interface", () => + Effect.gen(function* () { + const authoring = WorkflowAuthoring.make() + const inputs = [ + { action: "start" as const, value: start }, + { action: "extend" as const, value: { nodes: [{ ...node, id: "extend" }] } }, + { + action: "replan" as const, + value: { fragment: { name: "replacement", nodes: [{ ...node, id: "replacement" }] } }, + }, + ] + + for (const input of inputs) { + const result = yield* authoring.prepare({ + action: input.action, + source: { kind: "inline", value: input.value }, + profile: "portable", + }) + expect(result.valid).toBe(true) + expect(result.prepared?.action).toBe(input.action) + expect(result.prepared?.nodes).toHaveLength(1) + if (input.action === "start") { + expect(result.prepared).toMatchObject({ + action: "start", + title: "one-node", + config: { name: "one-node", mode: "standard", nodes: [{ id: "work" }] }, + }) + } + } + }), + ) + + it.effect("treats inline values strictly but adapts legacy model hints only at the YAML boundary", () => + Effect.gen(function* () { + const authoring = WorkflowAuthoring.make() + const inline = yield* authoring.prepare({ + action: "start", + source: { + kind: "inline", + value: { + config: { + name: "inline-model", + node_defaults: { model: { providerID: "openai", modelID: "gpt-4.1" } }, + nodes: [{ ...node, model: { providerID: "openai", modelID: "gpt-4.1" } }], + }, + }, + }, + profile: "portable", + }) + expect(inline.valid).toBe(false) + expect(inline.errors.map((error) => error.code)).toContain(DagValidation.DIAGNOSTIC_CODES.schemaInvalid) + + const yaml = yield* authoring.prepare({ + action: "start", + source: { + kind: "yaml", + source: "legacy.yaml", + content: [ + "config:", + " name: legacy-model", + " node_defaults:", + " model: { providerID: openai, modelID: gpt-4.1 }", + " nodes:", + " - id: work", + " name: work", + " worker_type: general", + " depends_on: []", + " model: { providerID: openai, modelID: gpt-4.1 }", + " prompt_template: { inline: Do the work }", + ].join("\n"), + }, + profile: "portable", + }) + expect(yaml.valid).toBe(true) + expect(yaml.prepared?.nodes[0]?.model).toEqual({ providerID: "openai", modelID: "gpt-4.1" }) + expect(yaml.prepared?.action === "start" ? yaml.prepared.config.node_defaults?.model : undefined).toEqual({ + providerID: "openai", + modelID: "gpt-4.1", + }) + + const replan = yield* authoring.prepare({ + action: "replan", + source: { + kind: "yaml", + source: "legacy-replan.yaml", + content: [ + "fragment:", + " name: legacy-replan", + " node_defaults:", + " model: { providerID: openai, modelID: gpt-4.1 }", + " nodes:", + " - id: work", + " name: work", + " worker_type: general", + " depends_on: []", + " prompt_template: { inline: Do the work }", + ].join("\n"), + }, + profile: "portable", + }) + expect(replan.prepared?.nodes[0]?.model).toEqual({ providerID: "openai", modelID: "gpt-4.1" }) + }), + ) + + it.effect("reports malformed YAML as stable diagnostics instead of throwing", () => + Effect.gen(function* () { + const result = yield* WorkflowAuthoring.make().prepare({ + action: "start", + source: { kind: "yaml", source: "broken.yaml", content: "config: [unclosed" }, + profile: "portable", + }) + expect(result).toMatchObject({ + source: "broken.yaml", + profile: "portable", + valid: false, + errors: [{ code: DagValidation.DIAGNOSTIC_CODES.schemaInvalid, path: "$" }], + warnings: [], + }) + expect(result.prepared).toBeUndefined() + }), + ) + + it.effect("keeps portable caching but refreshes live environment catalogs", () => + Effect.gen(function* () { + let loads = 0 + const authoring = WorkflowAuthoring.make({ + loadEnvironment: () => { + loads += 1 + return Effect.succeed({ + worker_types: new Set(loads === 1 ? ["general"] : []), + }) + }, + }) + const input = { + action: "start" as const, + source: { kind: "inline" as const, value: start }, + } + const portable = yield* authoring.prepare({ ...input, profile: "portable" }) + expect(portable.valid).toBe(true) + expect(loads).toBe(0) + + const first = yield* authoring.prepare({ ...input, profile: "environment" }) + const second = yield* authoring.prepare({ ...input, profile: "environment" }) + expect(first.valid).toBe(true) + expect(second.valid).toBe(false) + expect(second.prepared).toBeUndefined() + expect(loads).toBe(2) + }), + ) + + it.effect("fails closed when environment validation has no catalog loader", () => + Effect.gen(function* () { + const result = yield* WorkflowAuthoring.make().prepare({ + action: "start", + source: { kind: "inline", value: start }, + profile: "environment", + }) + + expect(result.valid).toBe(false) + expect(result.errors).toContainEqual( + expect.objectContaining({ + code: DagValidation.DIAGNOSTIC_CODES.environmentUnavailable, + path: "$environment", + }), + ) + expect(result.prepared).toBeUndefined() + }), + ) + + it.effect("keeps source identity distinct when equal content is cached", () => + Effect.gen(function* () { + const authoring = WorkflowAuthoring.make() + const content = Bun.YAML.stringify(start) + const first = yield* authoring.prepare({ + action: "start", + source: { kind: "yaml", source: "first.yaml", content }, + }) + const second = yield* authoring.prepare({ + action: "start", + source: { kind: "yaml", source: "second.yaml", content }, + }) + expect(first.source).toBe("first.yaml") + expect(second.source).toBe("second.yaml") + }), + ) +}) diff --git a/packages/opencode/test/dag/workflow-tool.test.ts b/packages/opencode/test/dag/workflow-tool.test.ts index 3dbbd948d1..c00efb1d2e 100644 --- a/packages/opencode/test/dag/workflow-tool.test.ts +++ b/packages/opencode/test/dag/workflow-tool.test.ts @@ -4,7 +4,10 @@ import fs from "node:fs/promises" import os from "node:os" import path from "node:path" import { Dag } from "@/dag/dag" +import { DagValidation } from "@/dag/validation" import { Agent } from "@/agent/agent" +import { Skill } from "@/skill" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { DagStore } from "@opencode-ai/core/dag/store" import { DagEvent } from "@opencode-ai/schema/dag-event" import { EventV2Bridge } from "@/event-v2-bridge" @@ -19,7 +22,10 @@ import { fingerprintBrief, type State } from "@/dag/admission" import { ModelV2 } from "@opencode-ai/core/model" import { ProjectV2 } from "@opencode-ai/core/project" import { ProviderV2 } from "@opencode-ai/core/provider" +import { Provider } from "@/provider/provider" +import { ProviderTest } from "../fake/provider" import { makeNodeRow } from "./fixtures" +import { tmpdirScoped } from "../fixture/fixture" const projectID = ProjectV2.ID.make("project_test") let workflowSpecDirectory = "" @@ -48,16 +54,14 @@ const admissionBrief = { blocking_questions: [], } -function admissionFor( - verdict: "READY" | "NOT_READY" | "WAIVED", - state: State = verdict, -) { - const brief = verdict === "READY" - ? admissionBrief - : { - ...admissionBrief, - blocking_questions: ["Confirm the production rollout target"], - } +function admissionFor(verdict: "READY" | "NOT_READY" | "WAIVED", state: State = verdict) { + const brief = + verdict === "READY" + ? admissionBrief + : { + ...admissionBrief, + blocking_questions: ["Confirm the production rollout target"], + } return { protocol_version: 1, brief_revision: 1, @@ -309,10 +313,39 @@ const events = Layer.mock(EventV2Bridge.Service, { return { id: "event_test", type: definition.type, data } as never }), }) -const dag = Dag.layer.pipe( - Layer.provide(store), - Layer.provide(events), -) +const dag = Dag.layer.pipe(Layer.provide(store), Layer.provide(events)) +const testModel = ProviderTest.model({ + providerID: ProviderV2.ID.make("test"), + id: ModelV2.ID.make("test-model"), +}) +const localModel = ProviderTest.model({ + providerID: ProviderV2.ID.make("local-proxy-compatible"), + id: ModelV2.ID.make("local-proxy-compatible/glm-5.2"), +}) +const providerRows = { + [testModel.providerID]: ProviderTest.info({}, testModel), + [localModel.providerID]: ProviderTest.info({}, localModel), +} +let environmentProviderListCalls = 0 +let environmentProviderGetModelCalls = 0 +const providerCatalog = Layer.mock(Provider.Service, { + list: () => + Effect.sync(() => { + environmentProviderListCalls++ + return providerRows + }), + getModel: (providerID, modelID) => + Effect.gen(function* () { + yield* Effect.sync(() => { + environmentProviderGetModelCalls++ + }) + if (providerID === testModel.providerID && modelID === testModel.id) return testModel + if (providerID === localModel.providerID && modelID === localModel.id) return localModel + return yield* new Provider.ModelNotFoundError({ providerID, modelID }) + }), +}) +let environmentAgentListCalls = 0 +let environmentSkillListCalls = 0 const runtime = testEffect( Layer.mergeAll( Layer.mock(Agent.Service, { @@ -327,6 +360,18 @@ const runtime = testEffect( tools: {}, hooks: {}, }), + list: () => + Effect.sync(() => { + environmentAgentListCalls++ + return builtinAgentCatalog + }), + }), + Layer.mock(Skill.Service, { + all: () => + Effect.sync(() => { + environmentSkillListCalls++ + return [] + }), }), Layer.mock(Truncate.Service, { output: (content) => Effect.succeed({ content, truncated: false }), @@ -334,6 +379,7 @@ const runtime = testEffect( Layer.mock(Question.Service, { ask: () => Effect.succeed([["Configure first"]]), }), + providerCatalog, dag, Layer.mock(Session.Service, { get: (id: Parameters[0]) => @@ -342,8 +388,7 @@ const runtime = testEffect( slug: "workflow-test", projectID, directory: workflowSpecDirectory, - parentID: - id === SessionID.make("ses_workflow_child") ? SessionID.make("ses_workflow_parent") : undefined, + parentID: id === SessionID.make("ses_workflow_child") ? SessionID.make("ses_workflow_parent") : undefined, title: "Workflow test", version: "test", time: { created: 0, updated: 0 }, @@ -360,6 +405,7 @@ let missingModelDirectory = "" const questionsAsked: Question.Info[] = [] const missingModelRuntime = testEffect( Layer.mergeAll( + CrossSpawnSpawner.defaultLayer, Layer.mock(Agent.Service, { get: () => Effect.succeed({ @@ -368,6 +414,10 @@ const missingModelRuntime = testEffect( permission: [], options: {}, }), + list: () => Effect.succeed(builtinAgentCatalog), + }), + Layer.mock(Skill.Service, { + all: () => Effect.succeed([]), }), Layer.mock(Truncate.Service, { output: (content) => Effect.succeed({ content, truncated: false }), @@ -379,6 +429,7 @@ const missingModelRuntime = testEffect( return [["Configure first"]] }), }), + providerCatalog, dag, Layer.mock(Session.Service, { get: (id: Parameters[0]) => @@ -395,11 +446,18 @@ const missingModelRuntime = testEffect( ), ) +// The builtin agent catalog the environment validation checks worker types +// against — mirrors the real build/plan/general/explore builtins. +const builtinAgentCatalog = ["build", "plan", "general", "explore"].map((name) => ({ + name, + mode: "all" as const, + permission: [], + options: {}, +})) as Agent.Info[] + function writeWorkflowSpec(name: string, value: unknown) { const filepath = path.join(workflowSpecDirectory, `${name}.yaml`) - return Effect.promise(() => Bun.write(filepath, JSON.stringify(value, null, 2))).pipe( - Effect.as(filepath), - ) + return Effect.promise(() => Bun.write(filepath, JSON.stringify(value, null, 2))).pipe(Effect.as(filepath)) } function toolContext() { @@ -414,6 +472,60 @@ function toolContext() { } satisfies Tool.Context } +function missingModelProject() { + return tmpdirScoped({ + init: (directory) => + Effect.promise(async () => { + await fs.mkdir(path.join(directory, ".opencode"), { recursive: true }) + await Bun.write(path.join(directory, ".opencode", "dag.jsonc"), '{ "model": {} }\n') + await Bun.write( + path.join(directory, "missing-model.yaml"), + JSON.stringify({ + config: { + name: "missing-model", + nodes: [ + { + id: "worker", + name: "Worker", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "work" }, + }, + ], + }, + }), + ) + }), + }) +} + +function missingCatalogModelProject() { + return tmpdirScoped({ + init: (directory) => + Effect.promise(async () => { + await fs.mkdir(path.join(directory, ".opencode"), { recursive: true }) + await Bun.write(path.join(directory, ".opencode", "dag.jsonc"), '{ "model": { "advanced": "ghost/ghost" } }\n') + await Bun.write( + path.join(directory, "missing-catalog-model.yaml"), + JSON.stringify({ + config: { + name: "missing-catalog-model", + nodes: [ + { + id: "worker", + name: "Worker", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "work" }, + }, + ], + }, + }), + ) + }), + }) +} + describe("workflow tool schema (negative tests)", () => { it("action field accepts start/extend/control/status/result/list/read/guide", () => { const decode = Schema.decodeUnknownSync(Parameters) @@ -466,13 +578,29 @@ describe("workflow tool schema (negative tests)", () => { expect(() => decode({ action: "logs" })).toThrow() }) - it("control operation accepts pause/resume/cancel/replan/step/complete", () => { + it("control operation accepts pause/resume/cancel/step/complete", () => { const decode = Schema.decodeUnknownSync(Parameters) - for (const op of ["pause", "resume", "cancel", "replan", "step", "complete"]) { + for (const op of ["pause", "resume", "cancel", "step", "complete"]) { expect(() => decode({ action: "control", workflow_id: "dag_wf_1", operation: op })).not.toThrow() } }) + it("control replan requires exactly one graph source", () => { + const decode = Schema.decodeUnknownSync(Parameters, { onExcessProperty: "error" }) + expect(() => + decode({ action: "control", workflow_id: "dag_wf_1", operation: "replan", spec_path: "fragment.yaml" }), + ).not.toThrow() + expect(() => + decode({ + action: "control", + workflow_id: "dag_wf_1", + operation: "replan", + spec: { fragment: { name: "fragment", nodes: [] } }, + }), + ).not.toThrow() + expect(() => decode({ action: "control", workflow_id: "dag_wf_1", operation: "replan" })).toThrow() + }) + it("control operation rejects unknown operations", () => { const decode = Schema.decodeUnknownSync(Parameters) expect(() => decode({ action: "control", workflow_id: "dag_wf_1", operation: "delete" })).toThrow() @@ -505,10 +633,9 @@ describe("workflow tool execution", () => { published.length = 0 const info = yield* WorkflowTool const workflow = yield* info.init() - const exit = yield* workflow.execute( - { action: "list" }, - { ...toolContext(), sessionID: SessionID.make("ses_workflow_child") }, - ).pipe(Effect.exit) + const exit = yield* workflow + .execute({ action: "list" }, { ...toolContext(), sessionID: SessionID.make("ses_workflow_child") }) + .pipe(Effect.exit) expect(Exit.isFailure(exit)).toBe(true) if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain("main conversation") @@ -516,14 +643,18 @@ describe("workflow tool execution", () => { }), ) - runtime.effect("description retains the workflow action reference after guidance migration", () => + runtime.effect("description keeps tool selection and the guide index; action fields live in the schema", () => Effect.gen(function* () { const info = yield* WorkflowTool const workflow = yield* info.init() - for (const action of ["guide", "start", "extend", "status", "result", "control", "list", "read"]) { - expect(workflow.description).toContain(`**${action}**`) - } + // The resident description no longer carries the per-action field + // manual — the discriminated parameter schema owns those fields + // (change repair-workflow-authoring-validation, §7.1). + expect(workflow.description).toContain('guide(topic="blocks")') + expect(workflow.description).not.toContain("**start** creates") + expect(workflow.description).not.toContain("**result** reads") + expect(workflow.description).toContain("parameter schema") expect(workflow.description).toContain("Do not poll") expect(workflow.description).not.toContain("$ARGUMENTS") }), @@ -814,7 +945,7 @@ describe("workflow tool execution", () => { name: "block-start", objective: "Implement and review session recovery", blocks: [ - { id: "build", kind: "coding", skills: ["tdd"] }, + { id: "build", kind: "coding" }, { id: "verify", kind: "verify", depends_on: ["build"] }, { id: "review", kind: "review", depends_on: ["verify"] }, ], @@ -852,13 +983,15 @@ describe("workflow tool execution", () => { action: "extend", workflow_id: "dag_defaults", spec: { - nodes: [{ - id: "inline-added", - name: "Inline added", - worker_type: "general", - depends_on: [], - prompt_template: { inline: "work" }, - }], + nodes: [ + { + id: "inline-added", + name: "Inline added", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "work" }, + }, + ], }, }), toolContext(), @@ -908,13 +1041,15 @@ describe("workflow tool execution", () => { spec: { fragment: { name: "inline-replan", - nodes: [{ - id: "inline-replanned", - name: "Inline replanned", - worker_type: "general", - depends_on: [], - prompt_template: { inline: "work" }, - }], + nodes: [ + { + id: "inline-replanned", + name: "Inline replanned", + worker_type: "general", + depends_on: [], + prompt_template: { inline: "work" }, + }, + ], }, }, }), @@ -939,25 +1074,29 @@ describe("workflow tool execution", () => { spec: { config: { name: "ambiguous", nodes: [] } }, spec_path: "saved-workflow", }, - message: "accepts exactly one source", }, { params: { action: "start" }, - message: "requires exactly one of 'spec' or 'spec_path'", }, ] for (const item of cases) { published.length = 0 - const exit = yield* workflow.execute( - Schema.decodeUnknownSync(Parameters)(item.params), - toolContext(), + // Source exclusivity is owned by the parameter schema: the real tool + // path strict-decodes before execute, so neither shape can reach the + // DAG service or publish an event. + const exit = yield* Effect.sync(() => + Schema.decodeUnknownSync(Parameters, { onExcessProperty: "error" })(item.params), ).pipe(Effect.exit) expect(Exit.isFailure(exit)).toBe(true) - if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain(item.message) expect(published).toHaveLength(0) } + + // The recovery guidance names both valid source variants. + const guidance = workflow.formatValidationError?.(new Error("no branch matched")) ?? "" + expect(guidance).toContain("exactly one source") + expect(guidance).toContain("spec or spec_path") }), ) @@ -982,18 +1121,20 @@ describe("workflow tool execution", () => { ) const output = JSON.parse(result.output) - expect(output).toEqual(expect.objectContaining({ - mode: "deep", - admission: { - verdict: "WAIVED", - state: "CONSUMED", - qa_mode: "STANDARD", - brief_revision: 1, - fingerprint: admissionFor("WAIVED").fingerprint, - waiver_reason: "Preview release only", - acknowledged_risks: ["Production rollout is unresolved"], - }, - })) + expect(output).toEqual( + expect.objectContaining({ + mode: "deep", + admission: { + verdict: "WAIVED", + state: "CONSUMED", + qa_mode: "STANDARD", + brief_revision: 1, + fingerprint: admissionFor("WAIVED").fingerprint, + waiver_reason: "Preview release only", + acknowledged_risks: ["Production rollout is unresolved"], + }, + }), + ) expect(output.admission).not.toHaveProperty("qa_transcript") }), ) @@ -1029,13 +1170,15 @@ config: metadata: () => Effect.void, ask: () => Effect.void, } satisfies Tool.Context - const invalid = yield* workflow.execute( - { - action: "start", - spec_path: "deep.yaml", - }, - context, - ).pipe(Effect.exit) + const invalid = yield* workflow + .execute( + { + action: "start", + spec_path: "deep.yaml", + }, + context, + ) + .pipe(Effect.exit) expect(Exit.isFailure(invalid)).toBe(true) if (Exit.isFailure(invalid)) { @@ -1087,15 +1230,17 @@ config: const created = published.find((event) => event.type === DagEvent.WorkflowCreated.type)?.data as { config?: string } - expect(JSON.parse(created.config ?? "{}")).toEqual(expect.objectContaining({ - mode: "deep", - admission: expect.objectContaining({ - protocol_version: 1, - verdict: "READY", - state: "CONSUMED", - fingerprint: fingerprintBrief(admissionBrief), + expect(JSON.parse(created.config ?? "{}")).toEqual( + expect.objectContaining({ + mode: "deep", + admission: expect.objectContaining({ + protocol_version: 1, + verdict: "READY", + state: "CONSUMED", + fingerprint: fingerprintBrief(admissionBrief), + }), }), - })) + ) }), ) @@ -1106,25 +1251,27 @@ config: yield* Effect.promise(() => Bun.write(specPath, "config:\n nodes: [\n")) const info = yield* WorkflowTool const workflow = yield* info.init() - const exit = yield* workflow.execute( - { - action: "start", - spec_path: specPath, - }, - { - sessionID: SessionID.make("ses_workflow_parent"), - messageID: MessageID.ascending(), - agent: "build", - abort: new AbortController().signal, - messages: [], - metadata: () => Effect.void, - ask: () => Effect.void, - } satisfies Tool.Context, - ).pipe(Effect.exit) + const exit = yield* workflow + .execute( + { + action: "start", + spec_path: specPath, + }, + { + sessionID: SessionID.make("ses_workflow_parent"), + messageID: MessageID.ascending(), + agent: "build", + abort: new AbortController().signal, + messages: [], + metadata: () => Effect.void, + ask: () => Effect.void, + } satisfies Tool.Context, + ) + .pipe(Effect.exit) expect(Exit.isFailure(exit)).toBe(true) if (Exit.isFailure(exit)) { - expect(Cause.pretty(exit.cause)).toContain(`Invalid workflow YAML ${specPath}:`) + expect(Cause.pretty(exit.cause)).toContain("[schema.invalid] $: file is not parseable YAML") } expect(published).toHaveLength(0) }), @@ -1176,34 +1323,7 @@ config: Effect.gen(function* () { published.length = 0 questionsAsked.length = 0 - missingModelDirectory = yield* Effect.acquireRelease( - Effect.promise(() => fs.mkdtemp(path.join(os.tmpdir(), "workflow-model-"))), - (directory) => Effect.promise(() => fs.rm(directory, { recursive: true, force: true })), - ) - yield* Effect.promise(() => fs.mkdir(path.join(missingModelDirectory, ".opencode"), { recursive: true })) - yield* Effect.promise(() => - Bun.write( - path.join(missingModelDirectory, ".opencode", "dag.jsonc"), - '{ "model": {} }\n', - ) - ) - yield* Effect.promise(() => - Bun.write( - path.join(missingModelDirectory, "missing-model.yaml"), - JSON.stringify({ - config: { - name: "missing-model", - nodes: [{ - id: "worker", - name: "Worker", - worker_type: "build", - depends_on: [], - prompt_template: { inline: "work" }, - }], - }, - }), - ) - ) + missingModelDirectory = yield* missingModelProject() const info = yield* WorkflowTool const workflow = yield* info.init() @@ -1231,6 +1351,149 @@ config: }), ) + missingModelRuntime.effect("validate(environment) reports the same missing model before start", () => + Effect.gen(function* () { + missingModelDirectory = yield* missingModelProject() + + const info = yield* WorkflowTool + const workflow = yield* info.init() + const result = yield* workflow.execute( + { + action: "validate", + spec_path: "missing-model.yaml", + profile: "environment", + }, + toolContext(), + ) + + const report = JSON.parse(result.output) + expect(report.valid).toBe(false) + expect(report.profile).toBe("environment") + const diagnostic = report.errors.find((d: { code: string }) => d.code === "model.unavailable") + expect(diagnostic?.path).toBe("nodes[worker]") + expect(result.title).toContain("failed") + }), + ) + + missingModelRuntime.effect("validate(environment) rejects a configured model absent from the provider catalog", () => + Effect.gen(function* () { + missingModelDirectory = yield* missingCatalogModelProject() + published.length = 0 + + const info = yield* WorkflowTool + const workflow = yield* info.init() + const result = yield* workflow.execute( + { + action: "validate", + spec_path: "missing-catalog-model.yaml", + profile: "environment", + }, + toolContext(), + ) + + const report = JSON.parse(result.output) + expect(report.valid).toBe(false) + expect(report.errors).toContainEqual( + expect.objectContaining({ code: "model.unavailable", path: "nodes[worker]" }), + ) + const started = yield* workflow.execute( + { action: "start", spec_path: "missing-catalog-model.yaml" }, + toolContext(), + ) + expect(started.title).toBe("Workflow not started: model required") + expect(started.metadata.workflowId).toBeUndefined() + expect(published).toHaveLength(0) + }), + ) + + missingModelRuntime.effect("extend and replan reject unresolved models before durable events", () => + Effect.gen(function* () { + missingModelDirectory = yield* missingModelProject() + published.length = 0 + const info = yield* WorkflowTool + const workflow = yield* info.init() + const node = { + id: "unresolved", + name: "Unresolved", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "work" }, + } + + const extendExit = yield* workflow + .execute({ action: "extend", workflow_id: Dag.ID.make("dag_paused"), spec: { nodes: [node] } }, toolContext()) + .pipe(Effect.exit) + const replanExit = yield* workflow + .execute( + { + action: "control", + operation: "replan", + workflow_id: Dag.ID.make("dag_paused"), + spec: { fragment: { name: "unresolved-replan", nodes: [node] } }, + }, + toolContext(), + ) + .pipe(Effect.exit) + + expect(Exit.isFailure(extendExit)).toBe(true) + expect(Exit.isFailure(replanExit)).toBe(true) + if (Exit.isFailure(extendExit)) expect(Cause.pretty(extendExit.cause)).toContain("model.unavailable") + if (Exit.isFailure(replanExit)) expect(Cause.pretty(replanExit.cause)).toContain("model.unavailable") + expect(published).toHaveLength(0) + }), + ) + + missingModelRuntime.effect("extend and replan honor persisted or explicit node models", () => + Effect.gen(function* () { + missingModelDirectory = yield* missingModelProject() + published.length = 0 + const info = yield* WorkflowTool + const workflow = yield* info.init() + const node = { + id: "modeled", + name: "Modeled", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "work" }, + } + + const extended = yield* workflow.execute( + { action: "extend", workflow_id: Dag.ID.make("dag_defaults"), spec: { nodes: [node] } }, + toolContext(), + ) + const replanned = yield* workflow.execute( + { + action: "control", + operation: "replan", + workflow_id: Dag.ID.make("dag_paused"), + spec_path: yield* Effect.promise(() => + Bun.write( + path.join(missingModelDirectory, "modeled-replan.yaml"), + JSON.stringify({ + fragment: { + name: "modeled-replan", + nodes: [ + { + ...node, + model: { + providerID: "local-proxy-compatible", + modelID: "local-proxy-compatible/glm-5.2", + }, + }, + ], + }, + }), + ).then(() => path.join(missingModelDirectory, "modeled-replan.yaml")), + ), + }, + toolContext(), + ) + + expect(extended.title).toContain("Workflow extended") + expect(replanned.title).toContain("Workflow replanned") + }), + ) + runtime.effect("deep start consumes and retains an informed WAIVED admission", () => Effect.gen(function* () { published.length = 0 @@ -1263,12 +1526,62 @@ config: const created = published.find((event) => event.type === DagEvent.WorkflowCreated.type)?.data as { config?: string } - expect(JSON.parse(created.config ?? "{}").admission).toEqual(expect.objectContaining({ - verdict: "WAIVED", - state: "CONSUMED", - waiver_reason: "Preview release only", - acknowledged_risks: ["Production rollout is unresolved"], - })) + expect(JSON.parse(created.config ?? "{}").admission).toEqual( + expect.objectContaining({ + verdict: "WAIVED", + state: "CONSUMED", + waiver_reason: "Preview release only", + acknowledged_risks: ["Production rollout is unresolved"], + }), + ) + }), + ) + + runtime.effect("start strips persisted admission audit fields read from disk and regenerates them", () => + Effect.gen(function* () { + published.length = 0 + const info = yield* WorkflowTool + const workflow = yield* info.init() + // Legacy saved specs may embed the persisted record shape. The audit + // fields are boundary-owned: stripped at the file-read boundary and + // regenerated by createAdmissionRecord. + const specPath = yield* writeWorkflowSpec("deep-legacy-admission", { + mode: "deep", + admission: { + ...admissionInputFor("WAIVED"), + protocol_version: 9, + state: "CONSUMED", + fingerprint: "stale-fingerprint", + }, + config: { + name: "deep-legacy-admission", + nodes: [], + }, + }) + yield* workflow.execute( + { + action: "start", + spec_path: specPath, + }, + { + sessionID: SessionID.make("ses_workflow_parent"), + messageID: MessageID.ascending(), + agent: "build", + abort: new AbortController().signal, + messages: [], + metadata: () => Effect.void, + ask: () => Effect.void, + } satisfies Tool.Context, + ) + + const created = published.find((event) => event.type === DagEvent.WorkflowCreated.type)?.data + if (!created || typeof created !== "object" || !("config" in created) || typeof created.config !== "string") { + throw new Error("workflow.created event did not include serialized config") + } + const admission = JSON.parse(created.config).admission + expect(admission).toEqual(expect.objectContaining({ protocol_version: 1, verdict: "WAIVED", state: "CONSUMED" })) + expect(admission.fingerprint).not.toBe("stale-fingerprint") + expect(admission.fingerprint).toBe(fingerprintBrief(admission.brief)) }), ) @@ -1318,21 +1631,23 @@ config: for (const item of cases) { published.length = 0 const specPath = yield* writeWorkflowSpec(`blocked-${item.name}`, item.value) - const exit = yield* workflow.execute( - { - action: "start", - spec_path: specPath, - }, - { - sessionID: SessionID.make("ses_workflow_parent"), - messageID: MessageID.ascending(), - agent: "build", - abort: new AbortController().signal, - messages: [], - metadata: () => Effect.void, - ask: () => Effect.void, - } satisfies Tool.Context, - ).pipe(Effect.exit) + const exit = yield* workflow + .execute( + { + action: "start", + spec_path: specPath, + }, + { + sessionID: SessionID.make("ses_workflow_parent"), + messageID: MessageID.ascending(), + agent: "build", + abort: new AbortController().signal, + messages: [], + metadata: () => Effect.void, + ask: () => Effect.void, + } satisfies Tool.Context, + ) + .pipe(Effect.exit) expect(Exit.isFailure(exit)).toBe(true) expect(published).toHaveLength(0) @@ -1577,59 +1892,45 @@ config: }), ) - runtime.effect("start rejects a project ID outside the parent session project", () => + runtime.effect("start does not accept a model-authored project identity", () => Effect.gen(function* () { - published.length = 0 - const parentID = SessionID.make("ses_workflow_parent") - const info = yield* WorkflowTool - const workflow = yield* info.init() - const exit = yield* workflow - .execute( - { - action: "start", - project_id: "project_other", - spec_path: "project-id-mismatch.yaml", - }, - { - sessionID: parentID, - messageID: MessageID.ascending(), - agent: "build", - abort: new AbortController().signal, - messages: [], - metadata: () => Effect.void, - ask: () => Effect.void, - } satisfies Tool.Context, - ) - .pipe(Effect.exit) - - expect(Exit.isFailure(exit)).toBe(true) - expect(published).toHaveLength(0) + // Runtime identity fields are derived from the authenticated tool + // context and the loaded session, never authored by the model: the + // strict parameter decode rejects a project_id supplied by the caller. + const decode = Schema.decodeUnknownSync(Parameters, { onExcessProperty: "error" }) + expect(() => + decode({ + action: "start", + project_id: "project_other", + spec_path: "project-id-mismatch.yaml", + }), + ).toThrow() }), ) - runtime.effect("start rejects a parent session other than the calling session", () => + runtime.effect("start does not accept a model-authored session identity", () => Effect.gen(function* () { - published.length = 0 - const info = yield* WorkflowTool - const workflow = yield* info.init() - const exit = yield* workflow - .execute( - { - action: "start", - session_id: "ses_other_parent", - spec: { - config: { - name: "foreign-parent", - nodes: [], - }, + const decode = Schema.decodeUnknownSync(Parameters, { onExcessProperty: "error" }) + expect(() => + decode({ + action: "start", + session_id: "ses_other_parent", + spec: { + config: { + name: "foreign-parent", + nodes: [ + { + id: "work", + name: "work", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "work" }, + }, + ], }, }, - toolContext(), - ) - .pipe(Effect.exit) - - expect(Exit.isFailure(exit)).toBe(true) - expect(published).toHaveLength(0) + }), + ).toThrow() }), ) }) @@ -1654,8 +1955,7 @@ describe("workflow tool saved workflows", () => { }), ) - const savedSpec = (name: string) => - `title: ${name} title\nconfig:\n name: ${name}\n nodes: []\n` + const savedSpec = (name: string) => `title: ${name} title\nconfig:\n name: ${name}\n nodes: []\n` const contextWith = (asked: unknown[]) => ({ @@ -1694,19 +1994,18 @@ describe("workflow tool saved workflows", () => { const workflow = yield* info.init() const asked: unknown[] = [] - const result = yield* workflow.execute( - { action: "read", spec_path: "saved-readable" }, - contextWith(asked), - ) + const result = yield* workflow.execute({ action: "read", spec_path: "saved-readable" }, contextWith(asked)) expect(result.title).toBe("Workflow spec: saved-readable") - expect(JSON.parse(result.output)).toMatchObject({ + const payload = JSON.parse(result.output) + expect(payload.spec).toMatchObject({ title: "Saved readable route", config: { objective: "Replace this generic objective", blocks: [{ id: "map", kind: "explore" }], }, }) + expect(payload.validation.valid).toBe(true) expect(asked).toEqual([expect.objectContaining({ permission: "workflow", patterns: ["read"] })]) expect(published).toHaveLength(0) }), @@ -1827,4 +2126,267 @@ describe("workflow tool saved workflows", () => { }), ), ) + + runtime.effect("validate(portable) does not load agent or skill catalogs", () => + Effect.gen(function* () { + environmentAgentListCalls = 0 + environmentSkillListCalls = 0 + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute( + { + action: "validate", + profile: "portable", + spec: { config: { name: "portable-inline", nodes: [] } }, + }, + toolContext(), + ) + + expect(JSON.parse(result.output).valid).toBe(true) + expect(environmentAgentListCalls).toBe(0) + expect(environmentSkillListCalls).toBe(0) + }), + ) + + runtime.effect("validate(environment) snapshots required catalogs once and never reads Skills", () => + Effect.gen(function* () { + environmentAgentListCalls = 0 + environmentSkillListCalls = 0 + environmentProviderListCalls = 0 + environmentProviderGetModelCalls = 0 + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute( + { + action: "validate", + profile: "environment", + spec: { + config: { + name: "catalog-snapshot", + nodes: [ + { + id: "first", + name: "First", + worker_type: "build", + depends_on: [], + prompt_template: { inline: "First" }, + }, + { + id: "second", + name: "Second", + worker_type: "build", + depends_on: ["first"], + prompt_template: { inline: "Second" }, + }, + ], + }, + }, + }, + toolContext(), + ) + + expect(JSON.parse(result.output).valid).toBe(true) + expect(environmentAgentListCalls).toBe(1) + expect(environmentSkillListCalls).toBe(0) + expect(environmentProviderListCalls).toBe(1) + expect(environmentProviderGetModelCalls).toBe(0) + }), + ) + + runtime.effect("validate and start resolve the same source content across all four sources", () => + withGlobalConfigDir((globalDir) => + Effect.gen(function* () { + published.length = 0 + // project scope shadows global for the same name; builtin fills the + // gap a file scope does not own; inline stays session-local. + const routeSpec = (name: string) => + `title: ${name} title\nconfig:\n name: ${name}\n objective: Route objective\n blocks:\n - id: plan\n kind: plan\n` + yield* Effect.promise(() => + Promise.all([ + Bun.write(path.join(globalDir, "workflows", "shared-route.yaml"), routeSpec("global-route")), + Bun.write(path.join(globalDir, "workflows", "builtin-shadowed.yaml"), routeSpec("file-route")), + Bun.write( + path.join(workflowSpecDirectory, ".opencode", "workflows", "shared-route.yaml"), + routeSpec("project-route"), + ), + ]), + ) + const previousBuiltin = (globalThis as Record).OPENCODE_DAG_TEMPLATES + ;(globalThis as Record).OPENCODE_DAG_TEMPLATES = { + "builtin-only-route": routeSpec("builtin-route"), + "builtin-shadowed": routeSpec("stale-builtin-route"), + } + try { + const info = yield* WorkflowTool + const workflow = yield* info.init() + + // project beats global + const projectRead = yield* workflow.execute({ action: "read", spec_path: "shared-route" }, contextWith([])) + expect(JSON.parse(projectRead.output).spec.title).toContain("project-route") + + // global fills names the project scope does not own + const globalRead = yield* workflow.execute({ action: "read", spec_path: "builtin-shadowed" }, contextWith([])) + expect(JSON.parse(globalRead.output).spec.title).toContain("file-route") + + // builtin fills names no file scope owns + const builtinValidate = yield* workflow.execute( + { action: "validate", spec_path: "builtin-only-route" }, + contextWith([]), + ) + const builtinResult = JSON.parse(builtinValidate.output) + expect(builtinResult.source).toBe("builtin://builtin-only-route") + expect(builtinResult.profile).toBe("portable") + expect(builtinResult.valid).toBe(true) + + // inline source validates under the environment profile by default + const inlineValidate = yield* workflow.execute( + { + action: "validate", + spec: { + config: { + name: "inline-route", + objective: "Inline objective", + blocks: [{ id: "plan", kind: "plan" }], + }, + }, + }, + contextWith([]), + ) + const inlineResult = JSON.parse(inlineValidate.output) + expect(inlineResult.source).toBe("") + expect(inlineResult.profile).toBe("environment") + expect(inlineResult.valid).toBe(true) + + // validate and start see the same resolved content: validate passes, + // start succeeds from the same name, and mutating the file changes + // both views consistently. + const beforeStart = yield* workflow.execute( + { action: "validate", spec_path: "shared-route" }, + contextWith([]), + ) + expect(JSON.parse(beforeStart.output).valid).toBe(true) + const started = yield* workflow.execute({ action: "start", spec_path: "shared-route" }, contextWith([])) + expect(started.title).toBe("Workflow started: project-route") + expect(published.some((event) => event.type === DagEvent.WorkflowCreated.type)).toBe(true) + } finally { + if (previousBuiltin === undefined) delete (globalThis as Record).OPENCODE_DAG_TEMPLATES + else (globalThis as Record).OPENCODE_DAG_TEMPLATES = previousBuiltin + } + }), + ), + ) + + runtime.effect("list marks invalid templates without hiding them", () => + withGlobalConfigDir((globalDir) => + Effect.gen(function* () { + yield* Effect.promise(() => + Promise.all([ + Bun.write( + path.join(globalDir, "workflows", "broken-route.yaml"), + "config:\n name: broken-route\n objective: Ship\n blocks:\n - id: proto\n kind: prototype\n - id: review\n kind: review\n depends_on: [proto]\n", + ), + Bun.write(path.join(globalDir, "workflows", "fine-route.yaml"), savedSpec("fine-route")), + ]), + ) + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute({ action: "list" }, contextWith([])) + + expect(result.output).toContain("broken-route [global] [invalid — not startable]") + expect(result.output).toContain("block.compile_failed") + expect(result.output).toContain("fine-route [global]") + expect(result.output).not.toContain("fine-route [global] [invalid") + }), + ), + ) + + runtime.effect("read keeps the editable raw spec for an invalid graph and reports diagnostics", () => + withGlobalConfigDir((globalDir) => + Effect.gen(function* () { + published.length = 0 + yield* Effect.promise(() => + Bun.write( + path.join(globalDir, "workflows", "uncompilable-route.yaml"), + "config:\n name: uncompilable-route\n objective: Ship\n blocks:\n - id: proto\n kind: prototype\n - id: review\n kind: review\n depends_on: [proto]\n", + ), + ) + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute({ action: "read", spec_path: "uncompilable-route" }, contextWith([])) + + const payload = JSON.parse(result.output) + // The editable source survives untouched so the parent can repair it. + expect(payload.spec.config.blocks.map((block: { id: string }) => block.id)).toEqual(["proto", "review"]) + expect(payload.validation.valid).toBe(false) + expect(payload.validation.errors.some((d: { code: string }) => d.code === "block.compile_failed")).toBe(true) + // Read never claims the route can be started. + expect(result.title).toBe("Workflow spec: uncompilable-route") + expect(published).toHaveLength(0) + }), + ), + ) + + runtime.effect("list keeps a syntax-broken template visible with a stable diagnostic", () => + withGlobalConfigDir((globalDir) => + Effect.gen(function* () { + published.length = 0 + yield* Effect.promise(() => + Bun.write(path.join(globalDir, "workflows", "broken-syntax.yaml"), "key: [unclosed"), + ) + yield* Effect.promise(() => + Bun.write( + path.join(globalDir, "workflows", "fine-route.yaml"), + "config:\n name: fine-route\n objective: Ship\n blocks:\n - id: plan\n kind: plan\n", + ), + ) + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute({ action: "list" }, contextWith([])) + + expect(result.output).toContain("broken-syntax [global] [invalid — not startable]") + expect(result.output).toContain("[schema.invalid]") + expect(result.output).toContain("fine-route [global]") + }), + ), + ) + + runtime.effect("validate returns structured diagnostics for syntax-broken YAML", () => + withGlobalConfigDir((globalDir) => + Effect.gen(function* () { + published.length = 0 + const filepath = path.join(globalDir, "workflows", "broken-validate.yaml") + yield* Effect.promise(() => Bun.write(filepath, "config: [unclosed")) + const info = yield* WorkflowTool + const workflow = yield* info.init() + + const result = yield* workflow.execute( + { action: "validate", spec_path: "broken-validate", profile: "portable" }, + contextWith([]), + ) + + const report = JSON.parse(result.output) + expect(report).toMatchObject({ + source: filepath, + profile: "portable", + valid: false, + errors: [ + { + code: DagValidation.DIAGNOSTIC_CODES.schemaInvalid, + path: "$", + message: "file is not parseable YAML", + }, + ], + warnings: [], + nodes: [], + }) + expect(result.metadata.workflowId).toBeUndefined() + expect(published).toHaveLength(0) + }), + ), + ) }) diff --git a/packages/opencode/test/skill/skill.test.ts b/packages/opencode/test/skill/skill.test.ts index 755ebfefeb..38636e9ea3 100644 --- a/packages/opencode/test/skill/skill.test.ts +++ b/packages/opencode/test/skill/skill.test.ts @@ -85,11 +85,8 @@ describe("skill", () => { expect(yield* skill.get("workflow")).toBeUndefined() expect( (yield* skill.all()).filter((item) => item.location === "").map((item) => item.name), - ).toEqual(["customize-opencode", "configure-hooks", "create-dag-workflow", "orchestration-router"]) - expect(yield* skill.get("orchestration-router")).toMatchObject({ - description: expect.stringContaining("without waiting for /dag-flow"), - location: "", - }) + ).toEqual(["customize-opencode", "configure-hooks", "create-dag-workflow"]) + expect(yield* skill.get("orchestration-router")).toBeUndefined() }), { git: true }, ), diff --git a/packages/opencode/test/tool/__snapshots__/parameters.test.ts.snap b/packages/opencode/test/tool/__snapshots__/parameters.test.ts.snap index 51ff867ea4..772564d18e 100644 --- a/packages/opencode/test/tool/__snapshots__/parameters.test.ts.snap +++ b/packages/opencode/test/tool/__snapshots__/parameters.test.ts.snap @@ -444,6 +444,1732 @@ exports[`tool parameters JSON Schema (wire shape) websearch 1`] = ` } `; +exports[`tool parameters JSON Schema (wire shape) workflow 1`] = ` +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "anyOf": [ + { + "properties": { + "action": { + "description": "Create a workflow", + "enum": [ + "start", + ], + "type": "string", + }, + "spec": { + "description": "Inline structured spec for a one-off graph. Use this or spec_path, never both", + "properties": { + "admission": { + "properties": { + "acknowledged_risks": { + "items": { + "type": "string", + }, + "type": "array", + }, + "brief": { + "properties": { + "acceptance_criteria": { + "items": { + "type": "string", + }, + "type": "array", + }, + "assumptions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "blocking_questions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "constraints": { + "items": { + "type": "string", + }, + "type": "array", + }, + "evidence_required": { + "items": { + "type": "string", + }, + "type": "array", + }, + "goal": { + "type": "string", + }, + "open_questions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "review_plan": { + "items": { + "type": "string", + }, + "type": "array", + }, + "risks": { + "items": { + "type": "string", + }, + "type": "array", + }, + "scope": { + "properties": { + "in": { + "items": { + "type": "string", + }, + "type": "array", + }, + "out": { + "items": { + "type": "string", + }, + "type": "array", + }, + }, + "required": [ + "in", + "out", + ], + "type": "object", + }, + }, + "required": [ + "goal", + "scope", + "constraints", + "assumptions", + "acceptance_criteria", + "evidence_required", + "risks", + "review_plan", + "open_questions", + "blocking_questions", + ], + "type": "object", + }, + "brief_revision": { + "type": "number", + }, + "qa_mode": { + "enum": [ + "LIGHT", + "STANDARD", + "GRILL", + ], + "type": "string", + }, + "verdict": { + "enum": [ + "READY", + "NOT_READY", + "WAIVED", + ], + "type": "string", + }, + "waiver_reason": { + "type": "string", + }, + }, + "required": [ + "brief_revision", + "qa_mode", + "verdict", + "brief", + ], + "type": "object", + }, + "config": { + "anyOf": [ + { + "properties": { + "blocks": { + "description": "Composable blocks compiled into nodes by the runtime", + "items": { + "properties": { + "depends_on": { + "description": "Block IDs this block waits for. Defaults to []", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique block identifier; dependencies target block IDs", + "type": "string", + }, + "instruction": { + "description": "Task-specific instruction added to the block's built-in execution contract", + "type": "string", + }, + "kind": { + "description": "Composable workflow block; debug and review expand into evidence-gathering subgraphs", + "enum": [ + "explore", + "plan", + "prototype", + "debug", + "coding", + "verify", + "review", + "synthesize", + ], + "type": "string", + }, + "report_to_parent": { + "description": "Override wake behavior. Review decisions and synthesis report by default", + "type": "boolean", + }, + "required": { + "description": "Whether failure is terminal. Decision and verification blocks default to true; volume blocks to false", + "type": "boolean", + }, + "worker_type": { + "description": "Optional configured agent override; defaults from the block kind", + "type": "string", + }, + }, + "required": [ + "id", + "kind", + ], + "type": "object", + }, + "type": "array", + }, + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "objective": { + "description": "Injected into every generated child prompt; required for blocks", + "type": "string", + }, + }, + "required": [ + "name", + "objective", + "blocks", + ], + "type": "object", + }, + { + "properties": { + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "nodes": { + "description": "Low-level node declarations", + "items": { + "properties": { + "cancel": { + "description": "(replan only) Cancel this node", + "type": "boolean", + }, + "condition": { + "description": "Expression evaluated before spawn; node is skipped if false", + "type": "string", + }, + "depends_on": { + "description": "Node IDs this node waits for ([] for root)", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique node identifier, used in depends_on", + "type": "string", + }, + "input_mapping": { + "additionalProperties": { + "type": "string", + }, + "description": "Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID", + "type": "object", + }, + "name": { + "description": "Human-readable node name", + "type": "string", + }, + "output_schema": { + "description": "JSON Schema; child agent must call submit_result to submit structured output", + "type": "object", + }, + "prompt_template": { + "anyOf": [ + { + "properties": { + "inline": { + "description": "Inline prompt text; bind {{placeholders}} via input or input_mapping", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "inline", + ], + "type": "object", + }, + { + "properties": { + "id": { + "description": "Prompt asset id resolved from .opencode/dag-prompts (project, then global)", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "id", + ], + "type": "object", + }, + ], + "description": "Template: exactly one of { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default", + }, + "report_to_parent": { + "description": "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", + "type": "boolean", + }, + "required": { + "description": "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", + "type": "boolean", + }, + "restart": { + "description": "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", + "type": "boolean", + }, + "review": { + "description": "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", + "properties": { + "implementation_node_id": { + "type": "string", + }, + "phase": { + "enum": [ + "design", + "diff", + ], + "type": "string", + }, + "verification_node_id": { + "type": "string", + }, + }, + "required": [ + "phase", + ], + "type": "object", + }, + "worker_config": { + "description": "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config", + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + "worker_type": { + "description": "Agent type (explore, build, general, plan, or custom)", + "type": "string", + }, + }, + "required": [ + "id", + "name", + "worker_type", + "depends_on", + "prompt_template", + ], + "type": "object", + }, + "type": "array", + }, + }, + "required": [ + "name", + "nodes", + ], + "type": "object", + }, + ], + }, + "mode": { + "enum": [ + "standard", + "deep", + ], + "type": "string", + }, + "title": { + "type": "string", + }, + }, + "required": [ + "config", + ], + "type": "object", + }, + }, + "required": [ + "action", + "spec", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Create a workflow", + "enum": [ + "start", + ], + "type": "string", + }, + "spec_path": { + "description": "(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory", + "type": "string", + }, + }, + "required": [ + "action", + "spec_path", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Add nodes or blocks to a live workflow", + "enum": [ + "extend", + ], + "type": "string", + }, + "spec": { + "anyOf": [ + { + "properties": { + "blocks": { + "items": { + "properties": { + "depends_on": { + "description": "Block IDs this block waits for. Defaults to []", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique block identifier; dependencies target block IDs", + "type": "string", + }, + "instruction": { + "description": "Task-specific instruction added to the block's built-in execution contract", + "type": "string", + }, + "kind": { + "description": "Composable workflow block; debug and review expand into evidence-gathering subgraphs", + "enum": [ + "explore", + "plan", + "prototype", + "debug", + "coding", + "verify", + "review", + "synthesize", + ], + "type": "string", + }, + "report_to_parent": { + "description": "Override wake behavior. Review decisions and synthesis report by default", + "type": "boolean", + }, + "required": { + "description": "Whether failure is terminal. Decision and verification blocks default to true; volume blocks to false", + "type": "boolean", + }, + "worker_type": { + "description": "Optional configured agent override; defaults from the block kind", + "type": "string", + }, + }, + "required": [ + "id", + "kind", + ], + "type": "object", + }, + "type": "array", + }, + "objective": { + "description": "Injected into every generated child prompt", + "type": "string", + }, + }, + "required": [ + "objective", + "blocks", + ], + "type": "object", + }, + { + "properties": { + "nodes": { + "items": { + "properties": { + "cancel": { + "description": "(replan only) Cancel this node", + "type": "boolean", + }, + "condition": { + "description": "Expression evaluated before spawn; node is skipped if false", + "type": "string", + }, + "depends_on": { + "description": "Node IDs this node waits for ([] for root)", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique node identifier, used in depends_on", + "type": "string", + }, + "input_mapping": { + "additionalProperties": { + "type": "string", + }, + "description": "Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID", + "type": "object", + }, + "name": { + "description": "Human-readable node name", + "type": "string", + }, + "output_schema": { + "description": "JSON Schema; child agent must call submit_result to submit structured output", + "type": "object", + }, + "prompt_template": { + "anyOf": [ + { + "properties": { + "inline": { + "description": "Inline prompt text; bind {{placeholders}} via input or input_mapping", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "inline", + ], + "type": "object", + }, + { + "properties": { + "id": { + "description": "Prompt asset id resolved from .opencode/dag-prompts (project, then global)", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "id", + ], + "type": "object", + }, + ], + "description": "Template: exactly one of { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default", + }, + "report_to_parent": { + "description": "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", + "type": "boolean", + }, + "required": { + "description": "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", + "type": "boolean", + }, + "restart": { + "description": "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", + "type": "boolean", + }, + "review": { + "description": "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", + "properties": { + "implementation_node_id": { + "type": "string", + }, + "phase": { + "enum": [ + "design", + "diff", + ], + "type": "string", + }, + "verification_node_id": { + "type": "string", + }, + }, + "required": [ + "phase", + ], + "type": "object", + }, + "worker_config": { + "description": "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config", + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + "worker_type": { + "description": "Agent type (explore, build, general, plan, or custom)", + "type": "string", + }, + }, + "required": [ + "id", + "name", + "worker_type", + "depends_on", + "prompt_template", + ], + "type": "object", + }, + "type": "array", + }, + }, + "required": [ + "nodes", + ], + "type": "object", + }, + ], + "description": "Inline structured spec for a one-off graph. Use this or spec_path, never both", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "workflow_id", + "spec", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Add nodes or blocks to a live workflow", + "enum": [ + "extend", + ], + "type": "string", + }, + "spec_path": { + "description": "(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory", + "type": "string", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "workflow_id", + "spec_path", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Control a live workflow", + "enum": [ + "control", + ], + "type": "string", + }, + "operation": { + "description": "Apply a node fragment (add/cancel/restart/replace)", + "enum": [ + "replan", + ], + "type": "string", + }, + "spec": { + "description": "Inline structured spec for a one-off graph. Use this or spec_path, never both", + "properties": { + "fragment": { + "anyOf": [ + { + "properties": { + "blocks": { + "description": "Composable blocks compiled into nodes by the runtime", + "items": { + "properties": { + "depends_on": { + "description": "Block IDs this block waits for. Defaults to []", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique block identifier; dependencies target block IDs", + "type": "string", + }, + "instruction": { + "description": "Task-specific instruction added to the block's built-in execution contract", + "type": "string", + }, + "kind": { + "description": "Composable workflow block; debug and review expand into evidence-gathering subgraphs", + "enum": [ + "explore", + "plan", + "prototype", + "debug", + "coding", + "verify", + "review", + "synthesize", + ], + "type": "string", + }, + "report_to_parent": { + "description": "Override wake behavior. Review decisions and synthesis report by default", + "type": "boolean", + }, + "required": { + "description": "Whether failure is terminal. Decision and verification blocks default to true; volume blocks to false", + "type": "boolean", + }, + "worker_type": { + "description": "Optional configured agent override; defaults from the block kind", + "type": "string", + }, + }, + "required": [ + "id", + "kind", + ], + "type": "object", + }, + "type": "array", + }, + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "objective": { + "description": "Injected into every generated child prompt; required for blocks", + "type": "string", + }, + }, + "required": [ + "name", + "objective", + "blocks", + ], + "type": "object", + }, + { + "properties": { + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "nodes": { + "description": "Low-level node declarations", + "items": { + "properties": { + "cancel": { + "description": "(replan only) Cancel this node", + "type": "boolean", + }, + "condition": { + "description": "Expression evaluated before spawn; node is skipped if false", + "type": "string", + }, + "depends_on": { + "description": "Node IDs this node waits for ([] for root)", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique node identifier, used in depends_on", + "type": "string", + }, + "input_mapping": { + "additionalProperties": { + "type": "string", + }, + "description": "Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID", + "type": "object", + }, + "name": { + "description": "Human-readable node name", + "type": "string", + }, + "output_schema": { + "description": "JSON Schema; child agent must call submit_result to submit structured output", + "type": "object", + }, + "prompt_template": { + "anyOf": [ + { + "properties": { + "inline": { + "description": "Inline prompt text; bind {{placeholders}} via input or input_mapping", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "inline", + ], + "type": "object", + }, + { + "properties": { + "id": { + "description": "Prompt asset id resolved from .opencode/dag-prompts (project, then global)", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "id", + ], + "type": "object", + }, + ], + "description": "Template: exactly one of { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default", + }, + "report_to_parent": { + "description": "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", + "type": "boolean", + }, + "required": { + "description": "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", + "type": "boolean", + }, + "restart": { + "description": "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", + "type": "boolean", + }, + "review": { + "description": "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", + "properties": { + "implementation_node_id": { + "type": "string", + }, + "phase": { + "enum": [ + "design", + "diff", + ], + "type": "string", + }, + "verification_node_id": { + "type": "string", + }, + }, + "required": [ + "phase", + ], + "type": "object", + }, + "worker_config": { + "description": "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config", + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + "worker_type": { + "description": "Agent type (explore, build, general, plan, or custom)", + "type": "string", + }, + }, + "required": [ + "id", + "name", + "worker_type", + "depends_on", + "prompt_template", + ], + "type": "object", + }, + "type": "array", + }, + }, + "required": [ + "name", + "nodes", + ], + "type": "object", + }, + ], + }, + }, + "required": [ + "fragment", + ], + "type": "object", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "operation", + "workflow_id", + "spec", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Control a live workflow", + "enum": [ + "control", + ], + "type": "string", + }, + "operation": { + "description": "Apply a node fragment (add/cancel/restart/replace)", + "enum": [ + "replan", + ], + "type": "string", + }, + "spec_path": { + "description": "(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory", + "type": "string", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "operation", + "workflow_id", + "spec_path", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Control a live workflow", + "enum": [ + "control", + ], + "type": "string", + }, + "operation": { + "description": "pause/resume/cancel/step/complete", + "enum": [ + "pause", + "resume", + "cancel", + "step", + "complete", + ], + "type": "string", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "operation", + "workflow_id", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Inspect durable workflow and node state", + "enum": [ + "status", + ], + "type": "string", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "workflow_id", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Read one durable node output in bounded pages", + "enum": [ + "result", + ], + "type": "string", + }, + "cursor": { + "description": "Opaque continuation cursor returned by the previous page", + "type": "string", + }, + "limit": { + "description": "Maximum page characters; defaults to 8000, max 12000", + "maximum": 12000, + "minimum": 1, + "type": "integer", + }, + "node_id": { + "description": "Target durable node ID", + "type": "string", + }, + "workflow_id": { + "description": "Target workflow ID", + "pattern": "^dag", + "type": "string", + }, + }, + "required": [ + "action", + "workflow_id", + "node_id", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Show saved workflow specs in the library with their validation status", + "enum": [ + "list", + ], + "type": "string", + }, + }, + "required": [ + "action", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Inspect one saved spec before retargeting it", + "enum": [ + "read", + ], + "type": "string", + }, + "spec_path": { + "description": "(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory", + "type": "string", + }, + }, + "required": [ + "action", + "spec_path", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Load detailed guidance only when needed", + "enum": [ + "guide", + ], + "type": "string", + }, + "topic": { + "description": "blocks: composable block schema; interface: low-level workflow API; policy: gates/admission/recovery; patterns: domain playbooks. Omit for the compact index", + "enum": [ + "blocks", + "interface", + "policy", + "patterns", + ], + "type": "string", + }, + }, + "required": [ + "action", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Pre-flight a custom spec without creating a workflow; returns diagnostics, never a workflow ID", + "enum": [ + "validate", + ], + "type": "string", + }, + "profile": { + "description": "portable: distributable-template checks; environment: additionally resolves prompts, workers, and models in this project. Defaults: builtin specs portable, inline and project/global specs environment", + "enum": [ + "portable", + "environment", + ], + "type": "string", + }, + "spec": { + "description": "Inline structured spec for a one-off graph. Use this or spec_path, never both", + "properties": { + "admission": { + "properties": { + "acknowledged_risks": { + "items": { + "type": "string", + }, + "type": "array", + }, + "brief": { + "properties": { + "acceptance_criteria": { + "items": { + "type": "string", + }, + "type": "array", + }, + "assumptions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "blocking_questions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "constraints": { + "items": { + "type": "string", + }, + "type": "array", + }, + "evidence_required": { + "items": { + "type": "string", + }, + "type": "array", + }, + "goal": { + "type": "string", + }, + "open_questions": { + "items": { + "type": "string", + }, + "type": "array", + }, + "review_plan": { + "items": { + "type": "string", + }, + "type": "array", + }, + "risks": { + "items": { + "type": "string", + }, + "type": "array", + }, + "scope": { + "properties": { + "in": { + "items": { + "type": "string", + }, + "type": "array", + }, + "out": { + "items": { + "type": "string", + }, + "type": "array", + }, + }, + "required": [ + "in", + "out", + ], + "type": "object", + }, + }, + "required": [ + "goal", + "scope", + "constraints", + "assumptions", + "acceptance_criteria", + "evidence_required", + "risks", + "review_plan", + "open_questions", + "blocking_questions", + ], + "type": "object", + }, + "brief_revision": { + "type": "number", + }, + "qa_mode": { + "enum": [ + "LIGHT", + "STANDARD", + "GRILL", + ], + "type": "string", + }, + "verdict": { + "enum": [ + "READY", + "NOT_READY", + "WAIVED", + ], + "type": "string", + }, + "waiver_reason": { + "type": "string", + }, + }, + "required": [ + "brief_revision", + "qa_mode", + "verdict", + "brief", + ], + "type": "object", + }, + "config": { + "anyOf": [ + { + "properties": { + "blocks": { + "description": "Composable blocks compiled into nodes by the runtime", + "items": { + "properties": { + "depends_on": { + "description": "Block IDs this block waits for. Defaults to []", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique block identifier; dependencies target block IDs", + "type": "string", + }, + "instruction": { + "description": "Task-specific instruction added to the block's built-in execution contract", + "type": "string", + }, + "kind": { + "description": "Composable workflow block; debug and review expand into evidence-gathering subgraphs", + "enum": [ + "explore", + "plan", + "prototype", + "debug", + "coding", + "verify", + "review", + "synthesize", + ], + "type": "string", + }, + "report_to_parent": { + "description": "Override wake behavior. Review decisions and synthesis report by default", + "type": "boolean", + }, + "required": { + "description": "Whether failure is terminal. Decision and verification blocks default to true; volume blocks to false", + "type": "boolean", + }, + "worker_type": { + "description": "Optional configured agent override; defaults from the block kind", + "type": "string", + }, + }, + "required": [ + "id", + "kind", + ], + "type": "object", + }, + "type": "array", + }, + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "objective": { + "description": "Injected into every generated child prompt; required for blocks", + "type": "string", + }, + }, + "required": [ + "name", + "objective", + "blocks", + ], + "type": "object", + }, + { + "properties": { + "max_concurrency": { + "description": "Max parallel nodes. Default: 5", + "type": "number", + }, + "max_node_replan_attempts": { + "description": "Max replan restarts per node ID. Default: 5", + "type": "number", + }, + "max_total_nodes": { + "description": "Cumulative node cap across the workflow lifetime. Default: 100", + "type": "number", + }, + "name": { + "description": "Workflow name", + "type": "string", + }, + "node_defaults": { + "description": "Defaults inherited by nodes that omit required, worker_config, or report_to_parent", + "properties": { + "report_to_parent": { + "type": "boolean", + }, + "required": { + "type": "boolean", + }, + "worker_config": { + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + }, + "type": "object", + }, + "nodes": { + "description": "Low-level node declarations", + "items": { + "properties": { + "cancel": { + "description": "(replan only) Cancel this node", + "type": "boolean", + }, + "condition": { + "description": "Expression evaluated before spawn; node is skipped if false", + "type": "string", + }, + "depends_on": { + "description": "Node IDs this node waits for ([] for root)", + "items": { + "type": "string", + }, + "type": "array", + }, + "id": { + "description": "Unique node identifier, used in depends_on", + "type": "string", + }, + "input_mapping": { + "additionalProperties": { + "type": "string", + }, + "description": "Optional variable-to-source map, e.g. { resultA: "node-a", count: "node-b.output.count" }. Omit to expose each direct dependency under its node ID", + "type": "object", + }, + "name": { + "description": "Human-readable node name", + "type": "string", + }, + "output_schema": { + "description": "JSON Schema; child agent must call submit_result to submit structured output", + "type": "object", + }, + "prompt_template": { + "anyOf": [ + { + "properties": { + "inline": { + "description": "Inline prompt text; bind {{placeholders}} via input or input_mapping", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "inline", + ], + "type": "object", + }, + { + "properties": { + "id": { + "description": "Prompt asset id resolved from .opencode/dag-prompts (project, then global)", + "type": "string", + }, + "input": { + "type": "object", + }, + }, + "required": [ + "id", + ], + "type": "object", + }, + ], + "description": "Template: exactly one of { id: "..." } or { inline: "...", input: {...} }. Direct dependency outputs are available as {{node-id}} by default", + }, + "report_to_parent": { + "description": "If true, the parent agent is woken when this node completes or fails. Inherits config.node_defaults.report_to_parent", + "type": "boolean", + }, + "required": { + "description": "If true and this node fails, the workflow terminalizes as failed. Inherits config.node_defaults.required", + "type": "boolean", + }, + "restart": { + "description": "(replan only) Re-spawn this running node with new prompt. Running nodes only — terminal (completed/failed/skipped) nodes are immutable; to retry a failed node, add a replacement node under a new id", + "type": "boolean", + }, + "review": { + "description": "(deep review workers) design reviews pre-implementation artifacts; diff reviews require implementation_node_id and verification_node_id", + "properties": { + "implementation_node_id": { + "type": "string", + }, + "phase": { + "enum": [ + "design", + "diff", + ], + "type": "string", + }, + "verification_node_id": { + "type": "string", + }, + }, + "required": [ + "phase", + ], + "type": "object", + }, + "worker_config": { + "description": "{ timeout_ms } — bounds node execution. Inherits config.node_defaults.worker_config", + "properties": { + "timeout_ms": { + "type": "number", + }, + }, + "type": "object", + }, + "worker_type": { + "description": "Agent type (explore, build, general, plan, or custom)", + "type": "string", + }, + }, + "required": [ + "id", + "name", + "worker_type", + "depends_on", + "prompt_template", + ], + "type": "object", + }, + "type": "array", + }, + }, + "required": [ + "name", + "nodes", + ], + "type": "object", + }, + ], + }, + "mode": { + "enum": [ + "standard", + "deep", + ], + "type": "string", + }, + "title": { + "type": "string", + }, + }, + "required": [ + "config", + ], + "type": "object", + }, + }, + "required": [ + "action", + "spec", + ], + "type": "object", + }, + { + "properties": { + "action": { + "description": "Pre-flight a custom spec without creating a workflow; returns diagnostics, never a workflow ID", + "enum": [ + "validate", + ], + "type": "string", + }, + "profile": { + "description": "portable: distributable-template checks; environment: additionally resolves prompts, workers, and models in this project. Defaults: builtin specs portable, inline and project/global specs environment", + "enum": [ + "portable", + "environment", + ], + "type": "string", + }, + "spec_path": { + "description": "(start/extend/control replan/read/validate) A saved workflow name from the library (e.g. "code-review"), or a path to a YAML workflow spec. Relative paths resolve from the session directory", + "type": "string", + }, + }, + "required": [ + "action", + "spec_path", + ], + "type": "object", + }, + ], +} +`; + exports[`tool parameters JSON Schema (wire shape) write 1`] = ` { "$schema": "https://json-schema.org/draft/2020-12/schema", diff --git a/packages/opencode/test/tool/fixtures/workflow-block-skills-pre-internalization.json b/packages/opencode/test/tool/fixtures/workflow-block-skills-pre-internalization.json new file mode 100644 index 0000000000..c957950dff --- /dev/null +++ b/packages/opencode/test/tool/fixtures/workflow-block-skills-pre-internalization.json @@ -0,0 +1,15 @@ +{ + "captured_from": "workflow-parameters-post-change.json before internalize-dag-block-capabilities", + "schema_bytes": 29768, + "provider_block_item_fields": [ + "id", + "kind", + "depends_on", + "instruction", + "skills", + "worker_type", + "required", + "report_to_parent" + ], + "compiled_prompt_fragment": "Before working, load these relevant skills with the skill tool when available" +} diff --git a/packages/opencode/test/tool/fixtures/workflow-parameters-post-change.json b/packages/opencode/test/tool/fixtures/workflow-parameters-post-change.json new file mode 100644 index 0000000000..7a73cf124e --- /dev/null +++ b/packages/opencode/test/tool/fixtures/workflow-parameters-post-change.json @@ -0,0 +1,126 @@ +{ + "captured_from": "packages/opencode/src/tool/workflow.ts (discriminated-union Parameters)", + "schema_bytes": 29254, + "branch_count": 14, + "session_id_exposed": false, + "project_id_exposed": false, + "transformed": { + "openai": { + "bytes": 29306, + "branch_count": 14, + "start_inline_spec_config_present": true, + "blocks_branch_fields": [ + "name", + "objective", + "blocks", + "node_defaults", + "max_concurrency", + "max_node_replan_attempts", + "max_total_nodes" + ], + "block_item_fields": [ + "id", + "kind", + "depends_on", + "instruction", + "worker_type", + "required", + "report_to_parent" + ], + "node_item_fields": [ + "id", + "name", + "worker_type", + "depends_on", + "required", + "prompt_template", + "worker_config", + "input_mapping", + "report_to_parent", + "condition", + "restart", + "cancel", + "output_schema", + "review" + ] + }, + "azure": { + "bytes": 29306, + "branch_count": 14, + "start_inline_spec_config_present": true, + "blocks_branch_fields": [ + "name", + "objective", + "blocks", + "node_defaults", + "max_concurrency", + "max_node_replan_attempts", + "max_total_nodes" + ], + "block_item_fields": [ + "id", + "kind", + "depends_on", + "instruction", + "worker_type", + "required", + "report_to_parent" + ], + "node_item_fields": [ + "id", + "name", + "worker_type", + "depends_on", + "required", + "prompt_template", + "worker_config", + "input_mapping", + "report_to_parent", + "condition", + "restart", + "cancel", + "output_schema", + "review" + ] + }, + "gemini": { + "bytes": 29254, + "branch_count": 14, + "start_inline_spec_config_present": true, + "blocks_branch_fields": [ + "name", + "objective", + "blocks", + "node_defaults", + "max_concurrency", + "max_node_replan_attempts", + "max_total_nodes" + ], + "block_item_fields": [ + "id", + "kind", + "depends_on", + "instruction", + "worker_type", + "required", + "report_to_parent" + ], + "node_item_fields": [ + "id", + "name", + "worker_type", + "depends_on", + "required", + "prompt_template", + "worker_config", + "input_mapping", + "report_to_parent", + "condition", + "restart", + "cancel", + "output_schema", + "review" + ] + } + } +} diff --git a/packages/opencode/test/tool/fixtures/workflow-parameters-pre-change.json b/packages/opencode/test/tool/fixtures/workflow-parameters-pre-change.json new file mode 100644 index 0000000000..67d7c5a3b8 --- /dev/null +++ b/packages/opencode/test/tool/fixtures/workflow-parameters-pre-change.json @@ -0,0 +1,32 @@ +{ + "note": "Immutable red evidence captured before the discriminated-union switch (task 1.1). Never regenerate: the pre-change flat Parameters no longer exist.", + "captured_from": "packages/opencode/src/tool/workflow.ts (flat Parameters, 11 optional fields)", + "schema_bytes": 1987, + "spec_wire_shape": { + "type": "object", + "description": "(start/extend/control replan) Inline structured spec for a one-off graph. Use this or spec_path, never both" + }, + "session_id_exposed": true, + "project_id_exposed": true, + "field_count": 11, + "transformed": { + "openai": { + "bytes": 1901, + "spec_properties": {}, + "spec_property_keys": [], + "spec_description_present": true + }, + "azure": { + "bytes": 1901, + "spec_properties": {}, + "spec_property_keys": [], + "spec_description_present": true + }, + "gemini": { + "bytes": 1987, + "spec_properties": null, + "spec_property_keys": [], + "spec_description_present": true + } + } +} diff --git a/packages/opencode/test/tool/parameters.test.ts b/packages/opencode/test/tool/parameters.test.ts index 9c540daad0..ee47064544 100644 --- a/packages/opencode/test/tool/parameters.test.ts +++ b/packages/opencode/test/tool/parameters.test.ts @@ -24,6 +24,7 @@ import { Parameters as Task } from "../../src/tool/task" import { Parameters as Todo } from "../../src/tool/todo" import { Parameters as WebFetch } from "../../src/tool/webfetch" import { Parameters as WebSearch } from "../../src/tool/websearch" +import { WorkflowParameters } from "../../src/tool/workflow" import { Parameters as Write } from "../../src/tool/write" const parse = >(schema: S, input: unknown): S["Type"] => @@ -51,8 +52,23 @@ describe("tool parameters", () => { test("todo", () => expect(toJsonSchema(Todo)).toMatchSnapshot()) test("webfetch", () => expect(toJsonSchema(WebFetch)).toMatchSnapshot()) test("websearch", () => expect(toJsonSchema(WebSearch)).toMatchSnapshot()) + test("workflow", () => expect(toJsonSchema(WorkflowParameters)).toMatchSnapshot()) test("write", () => expect(toJsonSchema(Write)).toMatchSnapshot()) + // Regression fixture from change repair-workflow-authoring-validation: + // the pre-change flat Parameters left the inline spec opaque after + // provider transformation and exposed runtime-derived identity fields. + // The capture lives in fixtures/ so the red evidence survives the fix. + test("workflow pre-change evidence recorded the opaque inline spec", async () => { + const evidence = await Bun.file(new URL("./fixtures/workflow-parameters-pre-change.json", import.meta.url)).json() + expect(evidence.field_count).toBe(11) + expect(evidence.session_id_exposed).toBe(true) + expect(evidence.project_id_exposed).toBe(true) + expect(evidence.transformed.openai.spec_properties).toEqual({}) + expect(evidence.transformed.azure.spec_properties).toEqual({}) + expect(evidence.transformed.gemini.spec_property_keys).toEqual([]) + }) + test("inlines named child schemas for provider compatibility", () => { const schema = toJsonSchema(Question) expect(schema).not.toHaveProperty("$defs") diff --git a/packages/opencode/test/tool/workflow-authoring.test.ts b/packages/opencode/test/tool/workflow-authoring.test.ts new file mode 100644 index 0000000000..8330690420 --- /dev/null +++ b/packages/opencode/test/tool/workflow-authoring.test.ts @@ -0,0 +1,209 @@ +import { describe, expect, test } from "bun:test" +import { Result, Schema } from "effect" +import { Parameters } from "../../src/tool/workflow" +import { DagBlocks } from "../../src/dag/blocks" + +// Regression fixtures for change repair-workflow-authoring-validation. +// +// The worktree-lifecycle task had already produced a complete decision brief +// and correctly selected `plan → coding(2 packages) → verify → review` with +// an explicit explore skip. The route choice was right; every start call then +// failed at the tool boundary: +// +// 1. start carrying an empty workflow_id (Dag.ID entry validation), +// 2. start carrying other actions' fields (operation=complete, node_id, +// limit), +// 3. start whose inline spec stayed `{}` because the provider-facing +// schema declared no spec structure. +// +// These fixtures pin the decision brief's route and the two polluted call +// shapes so the discriminated-union schema is measured against them. + +const WORKTREE_LIFECYCLE_BRIEF = { + objective: + "Repair worktree lifecycle handling: fix bootstrap cleanup races and cover both tiers with regression tests", + route: ["plan", "coding(worktree-core)", "coding(callers-and-fixture)", "verify", "review"], + skips: ["explore — the confirmed brief already supplies file references, failure mechanism, package split, risks, and acceptance checks"], + packages: { + "worktree-core": "worktree bootstrap/cleanup ownership in the core lifecycle", + "callers-and-fixture": "call-site updates plus the isolated memory fixture in cli tests", + }, +} as const + +const block = (input: { + id: string + kind: (typeof DagBlocks.WORKFLOW_BLOCK_KINDS)[number] + depends_on?: string[] + instruction?: string +}) => new DagBlocks.WorkflowBlock(input) + +// The accepted start fixture: only start-owned fields, complete config.blocks. +const worktreeLifecycleStartInput = { + action: "start", + spec: { + title: "Worktree lifecycle repair", + config: { + name: "worktree-lifecycle-repair", + objective: WORKTREE_LIFECYCLE_BRIEF.objective, + blocks: [ + block({ + id: "plan", + kind: "plan", + instruction: "Use the confirmed brief; do not repeat discovery.", + }), + block({ + id: "coding-worktree-core", + kind: "coding", + depends_on: ["plan"], + instruction: WORKTREE_LIFECYCLE_BRIEF.packages["worktree-core"], + }), + block({ + id: "coding-callers-and-fixture", + kind: "coding", + depends_on: ["plan"], + instruction: WORKTREE_LIFECYCLE_BRIEF.packages["callers-and-fixture"], + }), + block({ + id: "verify", + kind: "verify", + depends_on: ["coding-worktree-core", "coding-callers-and-fixture"], + instruction: "Run the two packages' acceptance commands and record evidence", + }), + block({ + id: "review", + kind: "review", + depends_on: ["verify"], + }), + ], + }, + }, +} as const + +// The previously observed polluted calls: a start that carries another +// action's identifiers and control fields. The empty-workflow_id shape +// already fails the Dag.ID brand today; the plausible-id shape passes the +// flat schema and must be rejected once fields become action-owned. +const pollutedStartWithForeignFields = { + action: "start", + workflow_id: "dag_2x9k4m", + operation: "complete", + node_id: "verify", + cursor: "", + limit: 8000, + spec: worktreeLifecycleStartInput.spec, +} + +const pollutedStartWithEmptySpec = { + action: "start", + spec: {}, +} + +// The tool admits parameters with strict parsing (foreign fields are an +// error, not a silent drop), so the fixtures decode the same way. +const decode = (input: unknown) => + Result.isSuccess(Schema.decodeUnknownResult(Parameters, { onExcessProperty: "error" })(input)) + +describe("worktree-lifecycle regression fixtures", () => { + test("decision brief route compiles under the block compiler", () => { + const nodes = DagBlocks.compileWorkflowBlocks({ + objective: WORKTREE_LIFECYCLE_BRIEF.objective, + blocks: [...worktreeLifecycleStartInput.spec.config.blocks], + }) + const byID = new Map(nodes.map((node) => [node.id, node])) + // Workspace-writer serialization: the second coding writer waits for the + // first even though both only declared the plan dependency. + const writerOrder = nodes.filter((node) => node.worker_type === "build").map((node) => node.id) + expect(writerOrder).toEqual(["coding-worktree-core", "coding-callers-and-fixture"]) + expect(byID.get("coding-callers-and-fixture")?.depends_on).toContain("coding-worktree-core") + // Verification depends on every writer; the review binds to the + // canonical implementation fingerprint. + expect(byID.get("verify")?.depends_on).toEqual( + expect.arrayContaining(["coding-worktree-core", "coding-callers-and-fixture"]), + ) + const reviewDecision = byID.get("review") + expect(reviewDecision?.review?.phase).toBe("diff") + // Canonical writer is the serialized one that transitively depends on + // every other writer — the second package after serialization. + expect(reviewDecision?.review?.implementation_node_id).toBe("coding-callers-and-fixture") + expect(reviewDecision?.review?.verification_node_id).toBe("verify") + expect(reviewDecision?.input_mapping?.["implementation_fingerprint"]).toBe( + "coding-callers-and-fixture.output.fingerprint", + ) + }) + + test("accepted start fixture carries only start-owned fields and a complete config.blocks", () => { + expect(Object.keys(worktreeLifecycleStartInput)).toEqual(["action", "spec"]) + expect(worktreeLifecycleStartInput.spec.config.blocks.length).toBe(5) + expect(decode(worktreeLifecycleStartInput)).toBe(true) + }) + + test("replay: the complete audit adds no explore block and strict decode keeps a clean start", () => { + // The confirmed brief already supplies repository evidence, so the route + // starts at plan — no explore lane is added back. + const blockIDs = worktreeLifecycleStartInput.spec.config.blocks.map((block) => block.id) + expect(blockIDs.some((id) => id.includes("explore"))).toBe(false) + expect(blockIDs).toEqual(["plan", "coding-worktree-core", "coding-callers-and-fixture", "verify", "review"]) + // Strict decoding admits exactly the start-owned fields. + const decoded = Schema.decodeUnknownSync(Parameters, { onExcessProperty: "error" })(worktreeLifecycleStartInput) + expect(decoded.action).toBe("start") + expect("spec" in decoded).toBe(true) + expect("workflow_id" in decoded).toBe(false) + expect("operation" in decoded).toBe(false) + expect("node_id" in decoded).toBe(false) + }) + + test("start polluted with empty workflow/control/result fields is rejected", () => { + expect(decode(pollutedStartWithForeignFields)).toBe(false) + }) + + test("start with an empty inline spec is rejected", () => { + expect(decode(pollutedStartWithEmptySpec)).toBe(false) + }) + + test("start without any graph source is rejected", () => { + expect(decode({ action: "start" })).toBe(false) + }) + + test("validate rejects control and result fields it does not own", () => { + const spec = worktreeLifecycleStartInput.spec + expect(decode({ action: "validate", spec, workflow_id: "dag_2x9k4m" })).toBe(false) + expect(decode({ action: "validate", spec, node_id: "verify" })).toBe(false) + expect(decode({ action: "validate", spec, operation: "cancel" })).toBe(false) + expect(decode({ action: "validate", spec, cursor: "", limit: 500 })).toBe(false) + // The validate action itself stays clean with exactly one source. + expect(decode({ action: "validate", spec, profile: "portable" })).toBe(true) + expect(decode({ action: "validate", spec_path: "saved-route", profile: "environment" })).toBe(true) + }) + + test("inline admission rejects boundary-owned audit fields; file reads strip them instead", () => { + const brief = { + goal: "Ship the change", + scope: { in: ["dag"], out: [] }, + constraints: [], + assumptions: [], + acceptance_criteria: [], + evidence_required: [], + risks: ["unresolved rollout"], + review_plan: [], + open_questions: [], + blocking_questions: [], + } + const cleanAdmission = { + brief_revision: 1, + qa_mode: "STANDARD", + verdict: "WAIVED", + brief, + waiver_reason: "Preview release only", + acknowledged_risks: ["unresolved rollout"], + } + const spec = { ...worktreeLifecycleStartInput.spec, mode: "deep", admission: cleanAdmission } + expect(decode({ action: "start", spec })).toBe(true) + // System-generated fields never belong in the model-facing schema — the + // file-read boundary strips them for legacy YAML compatibility instead. + for (const field of ["protocol_version", "state", "fingerprint"]) { + expect(decode({ action: "start", spec: { ...spec, admission: { ...cleanAdmission, [field]: "x" } } })).toBe( + false, + ) + } + }) +}) diff --git a/packages/opencode/test/tool/workflow-provider-schema.test.ts b/packages/opencode/test/tool/workflow-provider-schema.test.ts new file mode 100644 index 0000000000..0aa59f8448 --- /dev/null +++ b/packages/opencode/test/tool/workflow-provider-schema.test.ts @@ -0,0 +1,159 @@ +/* oxlint-disable typescript-eslint/no-unsafe-type-assertion -- These wire-shape tests intentionally traverse provider-owned recursive JSON Schema values and pinned JSON evidence. */ +import { describe, expect, test } from "bun:test" +import { Parameters } from "../../src/tool/workflow" +import { ToolJsonSchema } from "../../src/tool/json-schema" +import { ProviderTransform } from "../../src/provider/transform" + +// Wire-shape regression for change repair-workflow-authoring-validation: +// the discriminated union must survive provider transformation — every action +// keeps its discriminator and required fields, and nested block/node fields +// stay visible to the model (the pre-change Record spec collapsed to +// `properties: {}` on OpenAI — see fixtures/workflow-parameters-pre-change.json). + +const openaiModel = { providerID: "openai", api: { id: "gpt-4.1", npm: "@ai-sdk/openai" } } as never +const azureModel = { providerID: "azure", api: { id: "gpt-4.1", npm: "@ai-sdk/azure" } } as never +const geminiModel = { providerID: "google", api: { id: "gemini-3-pro", npm: "@ai-sdk/google" } } as never + +type JsonSchemaNode = { + anyOf?: JsonSchemaNode[] + required?: string[] + properties?: Record + items?: JsonSchemaNode + enum?: unknown[] + [key: string]: unknown +} + +function branches(transformed: JsonSchemaNode): JsonSchemaNode[] { + expect(Array.isArray(transformed.anyOf)).toBe(true) + return transformed.anyOf ?? [] +} + +function branchByAction(transformed: JsonSchemaNode, action: string, withField?: string): JsonSchemaNode[] { + return branches(transformed).filter((branch) => { + const actionEnum = branch?.properties?.action?.enum + if (!Array.isArray(actionEnum) || !actionEnum.includes(action)) return false + return withField === undefined || branch?.properties?.[withField] !== undefined + }) +} + +// Asserts the node carries properties and returns them for traversal. +function record(node: JsonSchemaNode | undefined): Record { + expect(node?.properties).toBeDefined() + return node?.properties ?? {} +} + +describe("workflow provider-facing schema", () => { + test("base wire shape is the 14-branch discriminated union", async () => { + const schema = ToolJsonSchema.fromSchema(Parameters as never) as JsonSchemaNode + const evidence = (await Bun.file( + new URL("./fixtures/workflow-parameters-post-change.json", import.meta.url), + ).json()) as JsonSchemaNode + expect(schema.anyOf?.length).toBe(14) + const flat = JSON.stringify(schema) + expect(flat).not.toContain('"session_id"') + expect(flat).not.toContain('"project_id"') + expect(flat).not.toContain('"skills"') + expect(Buffer.byteLength(flat, "utf8")).toBe(evidence.schema_bytes as number) + }) + + test("every action stays representable after OpenAI transformation", () => { + const transformed = ProviderTransform.schema( + openaiModel, + ToolJsonSchema.fromSchema(Parameters as never), + ) as JsonSchemaNode + for (const action of ["start", "extend", "control", "status", "result", "list", "read", "guide", "validate"]) { + expect(branchByAction(transformed, action).length).toBeGreaterThan(0) + } + // Action fields do not bleed across branches: the status branch carries + // no spec/operation/cursor fields. + const status = branchByAction(transformed, "status")[0] + expect(status.required).toContain("workflow_id") + expect(Object.keys(status.properties ?? {})).toEqual(["action", "workflow_id"]) + }) + + test("OpenAI transformation exposes the nested blocks spec instead of properties: {}", () => { + const transformed = ProviderTransform.schema( + openaiModel, + ToolJsonSchema.fromSchema(Parameters as never), + ) as JsonSchemaNode + const startInline = branchByAction(transformed, "start", "spec")[0] + const config = record(startInline)["spec"] + expect(record(config)["config"]).toBeDefined() + const configUnion = record(config)["config"].anyOf ?? [] + const blocksBranch = configUnion.find((branch) => branch.properties?.blocks !== undefined) + const nodesBranch = configUnion.find((branch) => branch.properties?.nodes !== undefined) + expect(blocksBranch).toBeDefined() + expect(nodesBranch).toBeDefined() + expect(record(blocksBranch)["objective"]).toBeDefined() + expect(blocksBranch?.required).toEqual(expect.arrayContaining(["name", "objective", "blocks"])) + expect(nodesBranch?.required).toEqual(expect.arrayContaining(["name", "nodes"])) + const blockItem = record(blocksBranch)["blocks"]?.items + expect(Object.keys(record(blockItem))).toEqual(expect.arrayContaining(["id", "kind", "depends_on", "instruction"])) + expect(Object.keys(record(blockItem))).not.toContain("skills") + const nodeItem = record(nodesBranch)["nodes"]?.items + expect(Object.keys(record(nodeItem))).toEqual( + expect.arrayContaining(["id", "name", "worker_type", "depends_on", "prompt_template"]), + ) + expect(Object.keys(record(nodeItem))).not.toContain("model") + expect(Object.keys(record(record(nodesBranch)["node_defaults"]))).not.toContain("model") + // Exactly-one-source prompt_template: both variants declared. + const promptTemplate = record(nodeItem)["prompt_template"] + const promptVariants = promptTemplate?.anyOf ?? [] + expect(promptVariants.some((variant) => variant.properties?.inline !== undefined)).toBe(true) + expect(promptVariants.some((variant) => variant.properties?.id !== undefined)).toBe(true) + }) + + test("pins the removed Skill-dependent block surface as red evidence", async () => { + const before = (await Bun.file( + new URL("./fixtures/workflow-block-skills-pre-internalization.json", import.meta.url), + ).json()) as { provider_block_item_fields: string[]; compiled_prompt_fragment: string } + expect(before.provider_block_item_fields).toContain("skills") + expect(before.compiled_prompt_fragment).toContain("load these relevant skills") + + const schema = JSON.stringify(ToolJsonSchema.fromSchema(Parameters as never)) + expect(schema).not.toContain('"skills"') + }) + + test("Azure transformation keeps the same discriminated union", () => { + const transformed = ProviderTransform.schema( + azureModel, + ToolJsonSchema.fromSchema(Parameters as never), + ) as JsonSchemaNode + expect(transformed.anyOf?.length).toBe(14) + expect(branchByAction(transformed, "start", "spec").length).toBeGreaterThan(0) + expect(branchByAction(transformed, "validate", "spec_path").length).toBeGreaterThan(0) + }) + + test("Gemini transformation keeps every branch and nested fields", () => { + const transformed = ProviderTransform.schema( + geminiModel, + ToolJsonSchema.fromSchema(Parameters as never), + ) as JsonSchemaNode + expect(transformed.anyOf?.length).toBe(14) + const startInline = branchByAction(transformed, "start", "spec")[0] + expect(record(record(startInline)["spec"])["config"]).toBeDefined() + const resultBranch = branchByAction(transformed, "result")[0] + expect(resultBranch.required).toEqual(expect.arrayContaining(["workflow_id", "node_id"])) + expect(Object.keys(record(resultBranch))).toEqual(expect.arrayContaining(["cursor", "limit"])) + }) + + test("post-change byte sizes stay at the recorded evidence", async () => { + const evidence = (await Bun.file( + new URL("./fixtures/workflow-parameters-post-change.json", import.meta.url), + ).json()) as { + schema_bytes: number + transformed: { openai: { bytes: number }; azure: { bytes: number }; gemini: { bytes: number } } + } + const base = JSON.stringify(ToolJsonSchema.fromSchema(Parameters as never)) + expect(Buffer.byteLength(base, "utf8")).toBe(evidence.schema_bytes) + expect(Buffer.byteLength(JSON.stringify(ProviderTransform.schema(openaiModel, JSON.parse(base))), "utf8")).toBe( + evidence.transformed.openai.bytes, + ) + expect(Buffer.byteLength(JSON.stringify(ProviderTransform.schema(azureModel, JSON.parse(base))), "utf8")).toBe( + evidence.transformed.azure.bytes, + ) + expect(Buffer.byteLength(JSON.stringify(ProviderTransform.schema(geminiModel, JSON.parse(base))), "utf8")).toBe( + evidence.transformed.gemini.bytes, + ) + }) +}) diff --git a/third_party/mattpocock-skills/LICENSE b/third_party/mattpocock-skills/LICENSE new file mode 100644 index 0000000000..f1dd2c0910 --- /dev/null +++ b/third_party/mattpocock-skills/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Matt Pocock + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/third_party/mattpocock-skills/SOURCE.md b/third_party/mattpocock-skills/SOURCE.md new file mode 100644 index 0000000000..a928c2fd07 --- /dev/null +++ b/third_party/mattpocock-skills/SOURCE.md @@ -0,0 +1,12 @@ +# Adapted methodology source + +- Source: https://github.com/mattpocock/skills +- License: MIT +- Copyright: Matt Pocock +- Pinned revision: 84fdeffd12f2ee307994d1eb6feb48173b6e0502 +- Adaptation: engineering decision, evidence, debugging, test-first delivery, + codebase design, review, and synthesis disciplines were adapted into + product-owned workflow routing and block contracts. + +The upstream project and feature names are provenance only. They are not +runtime workflow fields, product labels, or required installed extensions. From 2cf7455c4cf0dc77319167f248ec8afd95b52cfe Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 11:13:00 +0800 Subject: [PATCH 02/34] fix(ci): pin ghostty-web to immutable SHA and freeze all CI installs (CI-LOCK-02) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A clean checkout could not reproduce dependencies: packages/app/package.json pinned ghostty-web to the mutable `#main` ref while bun.lock recorded a stale commit (513463a), so `bun install --frozen-lockfile` failed with 'lockfile had changes'. CI also ran non-frozen installs via the shared setup-bun action, so it could silently test a different dependency set than the lock declared. Fixes: - Pin ghostty-web to the reviewed immutable commit 83c0a07b8628b748aed073b232cb4b52a6ca11c1. - Sync bun.lock to that pin (manifest + lock entry). - Add `--frozen-lockfile` to both setup-bun installs (Linux + Windows) and to the release-fork package-templates install. - Add a static repository-policy gate (test/policy/repo-dependencies.test.ts) that fails closed if any git dependency is not pinned to a full 40-char SHA, or any `bun install` in CI (.github/**/*.yml) is not frozen. It validates config only — no second install flow. Mutation-proven: reverting the SHA to `#main`, or dropping `--frozen-lockfile` from any CI install, flips the gate Red. Clean checkout `bun install --frozen-lockfile` now passes with a stable lock. Co-Authored-By: Claude --- .github/actions/setup-bun/action.yml | 4 +- .github/workflows/release-fork.yml | 2 +- bun.lock | 4 +- packages/app/package.json | 2 +- .../test/policy/repo-dependencies.test.ts | 76 +++++++++++++++++++ 5 files changed, 82 insertions(+), 6 deletions(-) create mode 100644 packages/opencode/test/policy/repo-dependencies.test.ts diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml index ca07aa3dbd..e0ac9a8c0c 100644 --- a/.github/actions/setup-bun/action.yml +++ b/.github/actions/setup-bun/action.yml @@ -56,9 +56,9 @@ runs: # e.g. ./patches/ for standard-openapi # https://github.com/oven-sh/bun/issues/28147 if [ "$RUNNER_OS" = "Windows" ]; then - bun install --linker hoisted ${{ inputs.install-flags }} + bun install --frozen-lockfile --linker hoisted ${{ inputs.install-flags }} else - bun install ${{ inputs.install-flags }} + bun install --frozen-lockfile ${{ inputs.install-flags }} fi shell: bash diff --git a/.github/workflows/release-fork.yml b/.github/workflows/release-fork.yml index 03f58b43de..c6ad8e31f5 100644 --- a/.github/workflows/release-fork.yml +++ b/.github/workflows/release-fork.yml @@ -116,7 +116,7 @@ jobs: save-cache: false - name: Install Runtime Dependencies - run: bun install + run: bun install --frozen-lockfile - name: Validate and Package Templates (fail closed) working-directory: packages/opencode diff --git a/bun.lock b/bun.lock index 2a7e67fa31..2c045542f4 100644 --- a/bun.lock +++ b/bun.lock @@ -59,7 +59,7 @@ "diff": "catalog:", "effect": "catalog:", "fuzzysort": "catalog:", - "ghostty-web": "github:anomalyco/ghostty-web#main", + "ghostty-web": "github:anomalyco/ghostty-web#83c0a07b8628b748aed073b232cb4b52a6ca11c1", "luxon": "catalog:", "marked": "catalog:", "marked-shiki": "catalog:", @@ -3832,7 +3832,7 @@ "get-tsconfig": ["get-tsconfig@4.14.0", "", { "dependencies": { "resolve-pkg-maps": "^1.0.0" } }, "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA=="], - "ghostty-web": ["ghostty-web@github:anomalyco/ghostty-web#513463a", {}, "anomalyco-ghostty-web-513463a", "sha512-GZR8LSmgGzViWnBJrqRI8MpAZRCJxhcr1Hi9Tyeh7YRooHZQjK9J97FQRD3tbBaM2wjq05gzGY2UEsG+JtZeBw=="], + "ghostty-web": ["ghostty-web@github:anomalyco/ghostty-web#83c0a07", {}, "anomalyco-ghostty-web-83c0a07", "sha512-Lf2v1agHkVUpMpHBWWuCZrhOEmcwwin5/Hboc9rZwQ7/CKkIh5rU1r1CvfLlhkMoFv+ed8z52RZ8hkzGZZj3MQ=="], "giget": ["giget@2.0.0", "", { "dependencies": { "citty": "^0.1.6", "consola": "^3.4.0", "defu": "^6.1.4", "node-fetch-native": "^1.6.6", "nypm": "^0.6.0", "pathe": "^2.0.3" }, "bin": { "giget": "dist/cli.mjs" } }, "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA=="], diff --git a/packages/app/package.json b/packages/app/package.json index 53c01ea64e..a4773e4da2 100644 --- a/packages/app/package.json +++ b/packages/app/package.json @@ -72,7 +72,7 @@ "diff": "catalog:", "effect": "catalog:", "fuzzysort": "catalog:", - "ghostty-web": "github:anomalyco/ghostty-web#main", + "ghostty-web": "github:anomalyco/ghostty-web#83c0a07b8628b748aed073b232cb4b52a6ca11c1", "luxon": "catalog:", "marked": "catalog:", "marked-shiki": "catalog:", diff --git a/packages/opencode/test/policy/repo-dependencies.test.ts b/packages/opencode/test/policy/repo-dependencies.test.ts new file mode 100644 index 0000000000..2d26e38235 --- /dev/null +++ b/packages/opencode/test/policy/repo-dependencies.test.ts @@ -0,0 +1,76 @@ +import { describe, expect, it } from "bun:test" +import path from "node:path" + +// CI-LOCK-02 gate — the lockfile is authoritative. This test STATICALLY validates repository +// configuration only; it performs NO install (no second install flow). It fails closed when: +// 1. any git/github dependency is pinned to a mutable ref (branch/tag) instead of a full 40-char +// commit SHA; or +// 2. any `bun install` in CI (`.github/**/*.yml`) is not frozen. +// Mutations this gate must catch (turn Red): change a full SHA back to `#main`; drop +// `--frozen-lockfile` from any CI install command. + +async function findRepoRoot(): Promise { + let dir = import.meta.dir + for (let i = 0; i < 10; i++) { + if (await Bun.file(path.join(dir, ".github", "actions", "setup-bun", "action.yml")).exists()) return dir + dir = path.dirname(dir) + } + throw new Error("repo-policy gate: could not locate repo root (setup-bun action.yml not found walking up)") +} + +const GIT_SPEC = /^(github:|git\+|git:|https:\/\/[^\s"]+\.git)/i +const FULL_SHA = /^[0-9a-f]{40}$/i +const DEP_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"] as const + +describe("repository dependency + install policy (CI-LOCK-02)", () => { + it("every git dependency is pinned to a full immutable 40-char commit SHA", async () => { + const root = await findRepoRoot() + const manifests = await Array.fromAsync( + new Bun.Glob("**/package.json").scan({ cwd: root, onlyFiles: true, dot: false }), + ).then((files) => files.filter((rel) => !rel.includes("node_modules") && !rel.includes(".turbo") && !rel.includes("dist"))) + const offenders: string[] = [] + for (const rel of manifests) { + const pkg = (await Bun.file(path.join(root, rel)).json().catch(() => null)) as + | Record + | null + if (!pkg || typeof pkg !== "object") continue + for (const field of DEP_FIELDS) { + const deps = pkg[field] as Record | undefined + if (!deps || typeof deps !== "object") continue + for (const [name, raw] of Object.entries(deps)) { + if (typeof raw !== "string" || !GIT_SPEC.test(raw)) continue + const ref = raw.split("#")[1] + if (!ref || !FULL_SHA.test(ref)) + offenders.push(`${rel} :: ${field}.${name} = "${raw}" — git deps must use #, not a branch/tag`) + } + } + } + expect(offenders, offenders.join("\n")).toEqual([]) + }) + + it("every bun install in CI (.github/**/*.yml) is frozen", async () => { + const root = await findRepoRoot() + const ymls = await Array.fromAsync( + // `.github` is dot-prefixed, so `dot: true` is required to descend into it. + new Bun.Glob(".github/**/*.yml").scan({ cwd: root, onlyFiles: true, dot: true }), + ) + expect(ymls.length, "expected .github yml files").toBeGreaterThan(0) + let installCount = 0 + const offenders: string[] = [] + for (const rel of ymls) { + const text = await Bun.file(path.join(root, rel)).text() + for (const raw of text.split("\n")) { + const trimmed = raw.trim() + if (trimmed.startsWith("#")) continue // comment line, not an invocation + // Strip a leading `run:` key so both inline (`run: bun install ...`) and block + // (`run: |` + bare `bun install` on the next line) forms reduce to the command. + const cmd = trimmed.replace(/^run:\s*/, "").trim() + if (!/^bun\s+install\b/.test(cmd)) continue + installCount++ + if (!/--frozen-lockfile/.test(cmd)) offenders.push(`${rel}: "${cmd}"`) + } + } + expect(installCount, "expected at least one `bun install` under .github").toBeGreaterThan(0) + expect(offenders, `unfrozen CI installs:\n${offenders.join("\n")}`).toEqual([]) + }) +}) From 1263288db7666b6f1e36ace75bb7786f040fcad3 Mon Sep 17 00:00:00 2001 From: Lex Date: Tue, 11 Aug 2026 15:12:50 +0800 Subject: [PATCH 03/34] fix(opencode): make project memory process safe --- CONTEXT-MAP.md | 1 + packages/opencode/src/memory/CONTEXT.md | 40 ++ packages/opencode/src/memory/admission.ts | 350 ++++++++++ packages/opencode/src/memory/config.ts | 41 +- .../docs/adr/0001-project-owned-memory.md | 32 + .../0002-project-memory-commit-protocol.md | 29 + .../memory/docs/adr/0003-memory-admission.md | 34 + packages/opencode/src/memory/home.ts | 36 ++ .../opencode/src/memory/identity-migration.ts | 127 ++++ packages/opencode/src/memory/lock.ts | 21 + packages/opencode/src/memory/memory.ts | 98 +-- packages/opencode/src/memory/paths.ts | 19 + packages/opencode/src/memory/store.ts | 227 +++++-- .../src/project/identity-migration.ts | 26 + packages/opencode/src/project/project.ts | 6 + packages/opencode/src/worktree/index.ts | 183 ++++-- .../test/fixture/memory-store-worker.ts | 56 ++ .../test/memory/memory-admission.test.ts | 167 +++++ .../test/memory/memory-persistence.test.ts | 605 ++++++++++++++++++ packages/opencode/test/memory/memory.test.ts | 136 ++-- .../opencode/test/project/project.test.ts | 143 +++++ .../test/project/worktree-remove.test.ts | 6 +- .../opencode/test/project/worktree.test.ts | 257 +++++++- 23 files changed, 2443 insertions(+), 197 deletions(-) create mode 100644 packages/opencode/src/memory/CONTEXT.md create mode 100644 packages/opencode/src/memory/admission.ts create mode 100644 packages/opencode/src/memory/docs/adr/0001-project-owned-memory.md create mode 100644 packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md create mode 100644 packages/opencode/src/memory/docs/adr/0003-memory-admission.md create mode 100644 packages/opencode/src/memory/home.ts create mode 100644 packages/opencode/src/memory/identity-migration.ts create mode 100644 packages/opencode/src/memory/lock.ts create mode 100644 packages/opencode/src/memory/paths.ts create mode 100644 packages/opencode/src/project/identity-migration.ts create mode 100644 packages/opencode/test/fixture/memory-store-worker.ts create mode 100644 packages/opencode/test/memory/memory-admission.test.ts create mode 100644 packages/opencode/test/memory/memory-persistence.test.ts diff --git a/CONTEXT-MAP.md b/CONTEXT-MAP.md index d9e39d5cb2..5b85e346c5 100644 --- a/CONTEXT-MAP.md +++ b/CONTEXT-MAP.md @@ -6,6 +6,7 @@ Read the context documents relevant to the code or decision under review. Do not | --- | --- | --- | | Session Runtime and Client Contract | [`CONTEXT.md`](CONTEXT.md) | `packages/opencode/src/session`, `packages/opencode/src/system-context`, `packages/protocol`, `packages/client`, `packages/sdk` | | Workflow Orchestration | [`packages/opencode/src/dag/CONTEXT.md`](packages/opencode/src/dag/CONTEXT.md) | `packages/opencode/src/dag`, workflow tool, DAG template validation and packaging | +| Project Memory | [`packages/opencode/src/memory/CONTEXT.md`](packages/opencode/src/memory/CONTEXT.md) | `packages/opencode/src/memory`, Memory-owned worktree lifecycle integration | ## Contexts created lazily diff --git a/packages/opencode/src/memory/CONTEXT.md b/packages/opencode/src/memory/CONTEXT.md new file mode 100644 index 0000000000..8a112602e4 --- /dev/null +++ b/packages/opencode/src/memory/CONTEXT.md @@ -0,0 +1,40 @@ +# Project Memory Context + +Project Memory preserves user-confirmed, durable human context for one Project. It is not a code index, task tracker, instruction source, or general model-writable store. + +## Glossary + +| Term | Meaning | +| --- | --- | +| Project Memory | The authoritative durable Topic set owned by one Project identity and shared by all of that Project's worktrees. | +| Memory Home | The Project-scoped persistence boundary for Project Memory. Its identity follows the Project, not a checkout path. | +| Topic | A bounded structured collection of confirmed preferences, decisions, or terms with controller-owned metadata. | +| Legacy Worktree Memory | Memory files stored inside a checkout by an older runtime. They are migration inputs, never a second authoritative store. | +| Memory Conflict | A case where legacy and Project Memory claim the same logical identity with different valid content, or where legacy configuration differs from the Project configuration. | +| Project Configuration | The user-editable MEMORY policy owned by the Project and shared by its worktrees. | +| Memory Admission | The single legacy input seam that scans one Project snapshot, reconciles it once, and caches only conflict-free results. | + +## Invariants + +- One Project identity has one authoritative Project Memory. +- Two worktrees of the same Project cannot form independent Memory namespaces. +- Current user input and higher-priority instructions always override retrieved Memory. +- The controller owns persistence, metadata, migration, limits, and atomicity; models only propose bounded semantic actions. +- Migration writes a durable authoritative copy before removing a legacy copy. +- A Memory Conflict is explicit and fail-closed; no component silently chooses or overwrites conflicting durable context. +- Removing or resetting a worktree cannot imply deleting Project Memory. +- Removing Project Memory requires a separate Project retention decision. +- Runtime reads never perform ad-hoc legacy migration; they consume a Project snapshot admitted by `MemoryAdmission.ensure`. + +## Boundaries + +- Project identity and registered worktrees come from the Project context. +- Worktree lifecycle invalidates and reruns Memory admission before destructive operations, but it does not own Project Memory retention. +- Session runtime may retrieve and attach bounded Memory context, but it does not own Topic persistence. +- Codebase discovery belongs to codebase-memory facilities and is rejected from Project Memory. + +## Decisions + +- [ADR-0001: Project identity owns Memory](docs/adr/0001-project-owned-memory.md) +- [ADR-0002: Project Memory commits are versioned and process-safe](docs/adr/0002-project-memory-commit-protocol.md) +- [ADR-0003: Legacy Memory enters through Project admission](docs/adr/0003-memory-admission.md) diff --git a/packages/opencode/src/memory/admission.ts b/packages/opencode/src/memory/admission.ts new file mode 100644 index 0000000000..aed2e7b4b2 --- /dev/null +++ b/packages/opencode/src/memory/admission.ts @@ -0,0 +1,350 @@ +export * as MemoryAdmission from "./admission" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Context, Effect, Layer, Option, Schema } from "effect" +import { basename, join } from "node:path" +import { parse } from "yaml" +import { MemoryConfig } from "./config" +import { MemoryHome } from "./home" +import { MemoryPaths } from "./paths" +import { MemoryStore } from "./store" + +const Code = Schema.Literals([ + "topic.imported", + "topic.duplicate", + "topic.invalid", + "topic.conflict", + "config.promoted", + "config.duplicate", + "config.invalid", + "config.conflict", +]) +const Count = Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(0)) + +export class Diagnostic extends Schema.Class("MemoryAdmission.Diagnostic")({ + code: Code, + path: Schema.String, + topic_id: Schema.optional(Schema.String), + message: Schema.String, +}) {} + +export class Result extends Schema.Class("MemoryAdmission.Result")({ + diagnostics: Schema.Array(Diagnostic), + imported: Count, + duplicates: Count, + unresolved: Count, +}) {} + +export class ProjectSnapshot extends Schema.Class("MemoryAdmission.ProjectSnapshot")({ + projectID: ProjectV2.ID, + projectDirectory: Schema.String, + directories: Schema.Array(Schema.String), + updated: Schema.Number, +}) {} + +export interface Interface { + readonly ensure: ( + snapshot: ProjectSnapshot, + ) => Effect.Effect + readonly invalidate: (projectID: ProjectV2.ID) => Effect.Effect +} + +export class Service extends Context.Service()("@opencode/MemoryAdmission") {} + +type TopicCandidate = { + readonly file: string + readonly id: string + readonly topic?: MemoryStore.Snapshot["topics"][number] +} + +type ConfigCandidate = { + readonly file: string + readonly config: ReturnType | undefined +} + +export const layer = Layer.effect( + Service, + Effect.gen(function* () { + const fs = yield* FSUtil.Service + const flock = yield* EffectFlock.Service + const config = yield* MemoryConfig.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const cache = new Map() + + const readTopicCandidates = Effect.fnUntraced(function* (directories: ReadonlyArray) { + return yield* Effect.forEach( + directories, + (directory) => + Effect.gen(function* () { + const legacy = MemoryPaths.legacyTopics(directory) + if (!(yield* fs.existsSafe(legacy))) return [] + const files = (yield* fs.readDirectoryEntries(legacy)) + .filter((entry) => entry.type === "file" && entry.name.endsWith(".yaml")) + .map((entry) => join(legacy, entry.name)) + .sort() + return yield* Effect.forEach( + files, + (file) => + Effect.gen(function* () { + const id = basename(file, ".yaml") + const text = yield* fs.readFileString(file) + const parsed = yield* Effect.try({ + try: () => parse(text), + catch: () => new MemoryStore.StoreError({ message: "Legacy MEMORY topic YAML is invalid" }), + }).pipe(Effect.option) + return { + file, + id, + topic: Option.isSome(parsed) ? MemoryStore.decodeTopic(parsed.value, id) : undefined, + } satisfies TopicCandidate + }), + { concurrency: 8 }, + ) + }), + { concurrency: 4 }, + ).pipe(Effect.map((items) => items.flat().sort((left, right) => left.file.localeCompare(right.file)))) + }) + + const reconcileTopics = Effect.fnUntraced(function* (snapshot: ProjectSnapshot, candidates: TopicCandidate[]) { + const updated = yield* store.updateTopics(snapshot.projectID, (topics) => { + const next = [...topics] + const byID = new Map(next.map((topic) => [topic.id, topic])) + const changed: string[] = [] + const removable: string[] = [] + const diagnostics = candidates.map((candidate) => { + if (!candidate.topic) + return new Diagnostic({ + code: "topic.invalid", + path: candidate.file, + topic_id: candidate.id, + message: `Legacy MEMORY topic ${candidate.id} is invalid and was preserved`, + }) + const existing = byID.get(candidate.id) + if (!existing) { + next.push(candidate.topic) + byID.set(candidate.id, candidate.topic) + changed.push(candidate.id) + removable.push(candidate.file) + return new Diagnostic({ + code: "topic.imported", + path: candidate.file, + topic_id: candidate.id, + message: `Legacy MEMORY topic ${candidate.id} was imported into Project Memory`, + }) + } + if (same(existing, candidate.topic)) { + removable.push(candidate.file) + return new Diagnostic({ + code: "topic.duplicate", + path: candidate.file, + topic_id: candidate.id, + message: `Legacy MEMORY topic ${candidate.id} already exists in Project Memory`, + }) + } + return new Diagnostic({ + code: "topic.conflict", + path: candidate.file, + topic_id: candidate.id, + message: `Legacy MEMORY topic ${candidate.id} differs from Project Memory and was preserved`, + }) + }) + return { + applied: { topics: next, changed, deleted: [] }, + result: { diagnostics, removable }, + } + }) + yield* Effect.forEach(updated.result.removable, (file) => fs.remove(file, { force: true }), { + concurrency: 1, + discard: true, + }) + return updated.result.diagnostics + }) + + const readConfigCandidates = Effect.fnUntraced(function* (directories: ReadonlyArray) { + const files = directories.flatMap((directory) => + MemoryPaths.PROJECT_CONFIG_PATHS.map((relative) => join(directory, relative)), + ) + return yield* Effect.forEach( + files, + (file) => + Effect.gen(function* () { + const text = yield* fs.readFileStringSafe(file) + if (text === undefined) return undefined + const decoded = MemoryConfig.decodeConfig(text) + return { + file, + config: Option.isSome(decoded) ? MemoryConfig.normalizeConfig(decoded.value) : undefined, + } satisfies ConfigCandidate + }), + { concurrency: 4 }, + ).pipe( + Effect.map((items) => + items + .filter((item): item is ConfigCandidate => item !== undefined) + .sort((left, right) => left.file.localeCompare(right.file)), + ), + ) + }) + + const reconcileConfigs = Effect.fnUntraced(function* (snapshot: ProjectSnapshot) { + const project = yield* readConfigCandidates([snapshot.projectDirectory]) + const legacy = yield* readConfigCandidates( + snapshot.directories.filter((directory) => directory !== snapshot.projectDirectory), + ) + const explicit = project[0] + if (explicit) { + const projectDiagnostic = explicit.config + ? [] + : [ + new Diagnostic({ + code: "config.invalid", + path: explicit.file, + message: "Project MEMORY config is invalid and was preserved", + }), + ] + const diagnostics = yield* Effect.forEach( + legacy, + (candidate) => { + if (candidate.config && explicit.config && same(candidate.config, explicit.config)) + return fs.remove(candidate.file, { force: true }).pipe( + Effect.as( + new Diagnostic({ + code: "config.duplicate", + path: candidate.file, + message: "Legacy sandbox MEMORY config duplicates the Project config", + }), + ), + ) + return Effect.succeed( + new Diagnostic({ + code: candidate.config ? "config.conflict" : "config.invalid", + path: candidate.file, + message: candidate.config + ? "Legacy sandbox MEMORY config differs from the Project config and was preserved" + : "Legacy sandbox MEMORY config is invalid and was preserved", + }), + ) + }, + { concurrency: 1 }, + ) + return [...projectDiagnostic, ...diagnostics] + } + + const valid = legacy.filter( + (candidate): candidate is ConfigCandidate & { config: NonNullable } => + candidate.config !== undefined, + ) + const values = new Map(valid.map((candidate) => [JSON.stringify(candidate.config), candidate.config])) + if (values.size !== 1) + return legacy.map( + (candidate) => + new Diagnostic({ + code: candidate.config ? "config.conflict" : "config.invalid", + path: candidate.file, + message: candidate.config + ? "Legacy sandbox MEMORY configs disagree and were preserved" + : "Legacy sandbox MEMORY config is invalid and was preserved", + }), + ) + + const promoted = valid[0] + yield* config.writeProject(snapshot.projectDirectory, promoted.config) + yield* Effect.forEach(valid, (candidate) => fs.remove(candidate.file, { force: true }), { + concurrency: 1, + discard: true, + }) + return legacy.map( + (candidate) => + new Diagnostic({ + code: !candidate.config + ? "config.invalid" + : candidate.file === promoted.file + ? "config.promoted" + : "config.duplicate", + path: candidate.file, + message: !candidate.config + ? "Legacy sandbox MEMORY config is invalid and was preserved" + : candidate.file === promoted.file + ? "Legacy sandbox MEMORY config was promoted to the Project config" + : "Legacy sandbox MEMORY config duplicates the promoted Project config", + }), + ) + }) + + const cleanupLegacyDirectory = Effect.fnUntraced(function* (directory: string) { + const topics = MemoryPaths.legacyTopics(directory) + if ((yield* fs.existsSafe(topics)) && (yield* fs.readDirectoryEntries(topics)).length === 0) + yield* fs.remove(topics, { recursive: true }) + const legacy = join(directory, ".opencode", "memory") + if ((yield* fs.existsSafe(legacy)) && (yield* fs.readDirectoryEntries(legacy)).length === 0) + yield* fs.remove(legacy, { recursive: true }) + }) + + const ensureUnsafe = Effect.fnUntraced(function* (snapshot: ProjectSnapshot, key: string) { + const cached = cache.get(snapshot.projectID) + if (cached?.key === key) return cached.result + const candidates = yield* readTopicCandidates(snapshot.directories) + const diagnostics = [ + ...(yield* reconcileTopics(snapshot, candidates)), + ...(yield* reconcileConfigs(snapshot)), + ] + yield* Effect.forEach(snapshot.directories, cleanupLegacyDirectory, { concurrency: 1, discard: true }) + const result = new Result({ + diagnostics, + imported: diagnostics.filter((item) => item.code === "topic.imported").length, + duplicates: diagnostics.filter((item) => item.code.endsWith(".duplicate")).length, + unresolved: diagnostics.filter((item) => item.code.endsWith(".invalid") || item.code.endsWith(".conflict")).length, + }) + if (result.unresolved === 0) cache.set(snapshot.projectID, { key, result }) + return result + }) + + const ensure = Effect.fn("MemoryAdmission.ensure")(function* (snapshot: ProjectSnapshot) { + const directories = Array.from(new Set([snapshot.projectDirectory, ...snapshot.directories])).sort() + const normalized = new ProjectSnapshot({ + projectID: snapshot.projectID, + projectDirectory: snapshot.projectDirectory, + directories, + updated: snapshot.updated, + }) + const key = JSON.stringify([snapshot.projectID, directories, snapshot.updated]) + return yield* flock.withLock( + ensureUnsafe(normalized, key), + `memory-admission:${snapshot.projectID}`, + home.locks, + ) + }) + + const invalidate = Effect.fn("MemoryAdmission.invalidate")((projectID: ProjectV2.ID) => + Effect.sync(() => { + cache.delete(projectID) + }), + ) + + return Service.of({ ensure, invalidate }) + }), +) + +export const defaultLayer = layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryConfig.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), + Layer.provide(MemoryStore.defaultLayer), +) + +export const node = LayerNode.make(layer, [ + FSUtil.node, + EffectFlock.node, + MemoryConfig.node, + MemoryHome.node, + MemoryStore.node, +]) + +function same(left: unknown, right: unknown) { + return JSON.stringify(left) === JSON.stringify(right) +} diff --git a/packages/opencode/src/memory/config.ts b/packages/opencode/src/memory/config.ts index 4d46d8af56..31eaa35c5f 100644 --- a/packages/opencode/src/memory/config.ts +++ b/packages/opencode/src/memory/config.ts @@ -1,13 +1,16 @@ export * as MemoryConfig from "./config" import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { Flag } from "@opencode-ai/core/flag/flag" import { FSUtil } from "@opencode-ai/core/fs-util" import { Global } from "@opencode-ai/core/global" +import { Git } from "@/git" import { Context, Effect, Layer, Option, Schema } from "effect" -import { dirname, join } from "node:path" +import { dirname, isAbsolute, join, resolve } from "node:path" import { parse, type ParseError } from "jsonc-parser" import { MemoryFile } from "./file" +import { MemoryPaths } from "./paths" import { MemorySchema } from "./schema" export type Loaded = { @@ -33,6 +36,21 @@ export const layer = Layer.effect( Service, Effect.gen(function* () { const fs = yield* FSUtil.Service + const git = yield* Git.Service + + const ensureProjectExclude = Effect.fnUntraced(function* (projectDir: string) { + const result = yield* git.run(["rev-parse", "--git-path", "info/exclude"], { cwd: projectDir }) + if (result.exitCode !== 0) return + const raw = result.text().trim() + if (!raw) return + const file = isAbsolute(raw) ? raw : resolve(projectDir, raw) + const current = (yield* fs.readFileStringSafe(file)) ?? "" + const lines = new Set(current.split(/\r?\n/).map((line) => line.trim())) + const missing = MemoryPaths.PROJECT_CONFIG_PATHS.filter((rule) => !lines.has(rule)) + if (missing.length === 0) return + const prefix = current.length === 0 || current.endsWith("\n") ? current : current + "\n" + yield* MemoryFile.atomicWrite(fs, file, prefix + missing.join("\n") + "\n") + }) const readFirst = Effect.fnUntraced(function* (paths: string[]) { for (const path of paths) { @@ -43,13 +61,13 @@ export const layer = Layer.effect( }) const readConfig = Effect.fnUntraced(function* (found: { path: string; text: string }) { - const decoded = decode(found.text) + const decoded = decodeConfig(found.text) if (Option.isNone(decoded)) { yield* Effect.logWarning("memory config is invalid — ignoring", { path: found.path }) return undefined } if (decoded.value.topic_limit === decoded.value.topic_limit_floor) return decoded.value - const config = MemorySchema.updateConfig(decoded.value, { topic_limit_floor: decoded.value.topic_limit }) + const config = normalizeConfig(decoded.value) yield* MemoryFile.atomicWrite(fs, found.path, serialize(config)) return config }) @@ -78,6 +96,7 @@ export const layer = Layer.effect( config: MemorySchema.Config, existingPath?: string, ) { + yield* ensureProjectExclude(projectDir) yield* MemoryFile.atomicWrite(fs, existingPath ?? projectPath(projectDir), serialize(config)) }) @@ -107,9 +126,12 @@ export const layer = Layer.effect( }), ) -export const defaultLayer = layer.pipe(Layer.provide(FSUtil.defaultLayer)) +export const defaultLayer = layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(Git.defaultLayer.pipe(Layer.provide(CrossSpawnSpawner.defaultLayer))), +) -export const node = LayerNode.make(layer, [FSUtil.node]) +export const node = LayerNode.make(layer, [FSUtil.node, Git.node]) export function projectPath(projectDir: string) { return join(projectDir, ".opencode", "memory.jsonc") @@ -123,7 +145,7 @@ export function globalConfigDir() { return Flag.OPENCODE_CONFIG_DIR ?? Global.Path.config } -function projectCandidates(projectDir: string) { +export function projectCandidates(projectDir: string) { return [join(projectDir, ".opencode", "memory.jsonc"), join(projectDir, ".opencode", "memory.json")] } @@ -135,7 +157,7 @@ function serialize(config: MemorySchema.Config) { return JSON.stringify(config, null, 2) + "\n" } -function decode(text: string) { +export function decodeConfig(text: string) { const errors: ParseError[] = [] const value = parse(text, errors, { allowTrailingComma: true }) if (errors.length > 0) return Option.none() @@ -144,3 +166,8 @@ function decode(text: string) { return Option.none() return decoded } + +export function normalizeConfig(config: MemorySchema.Config) { + if (config.topic_limit === config.topic_limit_floor) return config + return MemorySchema.updateConfig(config, { topic_limit_floor: config.topic_limit }) +} diff --git a/packages/opencode/src/memory/docs/adr/0001-project-owned-memory.md b/packages/opencode/src/memory/docs/adr/0001-project-owned-memory.md new file mode 100644 index 0000000000..6b732a195c --- /dev/null +++ b/packages/opencode/src/memory/docs/adr/0001-project-owned-memory.md @@ -0,0 +1,32 @@ +# ADR-0001: Project identity owns Memory + +- Status: Accepted +- Date: 2026-08-11 + +## Context + +Durable Memory was stored beneath the active worktree. This made identical Projects acquire divergent Topic sets and allowed checkout reset/removal to destroy information whose intended lifetime exceeded that checkout. + +Project identity is stable across registered worktrees. Worktree paths are locations with shorter, independent lifecycles. + +## Decision + +Project Memory is owned and located by Project identity. All worktrees of that Project share one authoritative Topic set outside checkout directories. + +Project configuration is resolved from the Project's primary directory so it remains user-editable without creating sandbox-specific policy. Worktree-local Memory is compatibility input only. Valid non-conflicting data migrates to Project Memory; conflicting or invalid data remains in place and blocks destructive worktree removal. + +Deleting a worktree never deletes Project Memory. Retention or garbage collection of Project Memory requires a separate Project-level policy. + +## Consequences + +- Worktrees share durable preferences, decisions, and terms immediately. +- Reset and remove no longer own the lifetime of authoritative Topic data. +- Migration and conflict diagnostics become part of the persistence boundary. +- Central data can outlive the last checkout until a separate retention policy exists. +- Cross-process write serialization is defined by [ADR-0002](0002-project-memory-commit-protocol.md). + +## Alternatives Considered + +- Use the primary worktree as the shared store: rejected because moving, resetting, or deleting that checkout still controls Project Memory lifetime. +- Keep per-worktree stores and merge during retrieval: rejected because it creates multiple authorities and makes conflicts part of every read. +- Resolve conflicts by revision number: rejected because revision alone cannot prove which durable user-confirmed content should win. diff --git a/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md b/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md new file mode 100644 index 0000000000..55a52c04bc --- /dev/null +++ b/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md @@ -0,0 +1,29 @@ +# ADR-0002: Project Memory commits are versioned and process-safe + +- Status: Accepted +- Date: 2026-08-11 + +## Context + +Project Memory is shared by every worktree of one Project. Separate OpenCode processes can therefore read the same Topic revision and attempt conflicting updates. Per-process mutexes and per-file atomic writes do not prevent the last writer from silently replacing another process's confirmed content, nor do they make a multi-Topic update crash-atomic. + +## Decision + +Memory Store is the commit authority. Its public mutation surface is limited to: + +- `commit(projectID, expectedRevision, applied)`, which rejects a stale revision; +- `updateTopics(projectID, update)`, which acquires the existing cross-process `EffectFlock`, reads the latest snapshot inside the lock, applies one synchronous update, and commits it. + +Each successful mutation writes a complete Topic generation into a temporary directory, renames that directory into place, and atomically publishes a manifest containing the new revision and generation. Readers follow only the manifest. A crash before manifest publication leaves the previous generation authoritative; a crash after publication leaves the complete new generation authoritative. + +Legacy `topics/` data is revision zero and is promoted on the first commit. Previous and orphaned generations remain non-authoritative. Their garbage collection requires the separate Project Memory retention policy. + +Project identity migration holds the old Project's process lock while moving or merging its Memory Home. The Project database retires the old identity only after Memory migration succeeds. + +## Consequences + +- Concurrent worktrees cannot silently lose same-Topic updates when they use the Store mutation API. +- Stale callers receive an explicit revision conflict. +- Restart observes either the complete old generation or the complete new generation, never a partial batch. +- Store writes use more disk space until retention policy defines safe generation cleanup. +- Callers cannot persist an already-computed stale Topic set through an unversioned write API. diff --git a/packages/opencode/src/memory/docs/adr/0003-memory-admission.md b/packages/opencode/src/memory/docs/adr/0003-memory-admission.md new file mode 100644 index 0000000000..40c96ec6e9 --- /dev/null +++ b/packages/opencode/src/memory/docs/adr/0003-memory-admission.md @@ -0,0 +1,34 @@ +# ADR-0003: Legacy Memory enters through Project admission + +- Status: Accepted +- Date: 2026-08-11 + +## Context + +Memory configuration reads previously scanned every registered worktree and could import Topics or delete duplicate files. `prepare`, `context`, and `checkpoint` therefore hid cross-directory writes behind a read-shaped function. Each legacy Topic also reopened and rewrote the authoritative Topic set independently. When no explicit Project configuration existed, one consistent sandbox configuration was treated as an unresolvable conflict instead of becoming the Project configuration. + +## Decision + +`MemoryAdmission.ensure(projectSnapshot)` is the only legacy input seam. A snapshot contains the Project identity, primary directory, complete sorted directory set, and Project update revision. Admission holds a Project-scoped cross-process lock, reads all legacy candidates, applies all Topic imports in one Store update, resolves configuration, removes only committed imports or exact duplicates, and returns stable diagnostics. + +Successful conflict-free results are cached by Project identity, sorted directories, and Project update revision. Unresolved results are not cached so manual repair can be observed. Worktree reset and removal invalidate the Project before rerunning admission. + +Configuration resolution follows these rules: + +- An explicit valid Project configuration is authoritative; equal sandbox files are duplicates and differing files are conflicts. +- Without an explicit Project configuration, one normalized value across all valid sandbox files is promoted to the Project. +- Multiple normalized values conflict. Invalid files remain in place and are diagnosed. + +## Consequences + +- Memory reads no longer rescan or mutate every worktree on each call. +- Topic migration publishes at most one authoritative revision per admitted Project snapshot. +- A consistent sandbox policy can become the Project policy without manual copying. +- Worktree lifecycle owns cache invalidation, not migration rules. +- Conflict and invalid-file repair remains fail-closed and observable. + +## Alternatives Considered + +- Cache `Memory.configuration()`: rejected because migration rules and filesystem mutation would remain hidden in a read-shaped module. +- Keep one reconcile call per legacy file: rejected because it multiplies authoritative reads and commits and makes cross-process ordering harder to reason about. +- Treat the global fallback as an explicit Project configuration: rejected because global policy is not Project-owned and must not prevent promotion of a consistent Project-specific legacy value. diff --git a/packages/opencode/src/memory/home.ts b/packages/opencode/src/memory/home.ts new file mode 100644 index 0000000000..14e10fcc74 --- /dev/null +++ b/packages/opencode/src/memory/home.ts @@ -0,0 +1,36 @@ +export * as MemoryHome from "./home" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { Global } from "@opencode-ai/core/global" +import { ProjectV2 } from "@opencode-ai/core/project" +import { Hash } from "@opencode-ai/core/util/hash" +import { Context, Layer } from "effect" +import { join } from "node:path" + +export interface Interface { + readonly directory: (projectID: ProjectV2.ID) => string + readonly topics: (projectID: ProjectV2.ID) => string + readonly manifest: (projectID: ProjectV2.ID) => string + readonly generations: (projectID: ProjectV2.ID) => string + readonly locks: string +} + +export class Service extends Context.Service()("@opencode/MemoryHome") {} + +export function make(dataRoot: string): Interface { + const directory = (projectID: ProjectV2.ID) => + join(dataRoot, "memory", "projects", Hash.sha256(`memory-project:${projectID}`)) + return Service.of({ + directory, + topics: (projectID) => join(directory(projectID), "topics"), + manifest: (projectID) => join(directory(projectID), "manifest.json"), + generations: (projectID) => join(directory(projectID), "generations"), + locks: join(dataRoot, "memory", "locks"), + }) +} + +export const layer = Layer.succeed(Service, make(Global.Path.data)) + +export const defaultLayer = layer + +export const node = LayerNode.make(layer, []) diff --git a/packages/opencode/src/memory/identity-migration.ts b/packages/opencode/src/memory/identity-migration.ts new file mode 100644 index 0000000000..6d3f17b0bf --- /dev/null +++ b/packages/opencode/src/memory/identity-migration.ts @@ -0,0 +1,127 @@ +export * as MemoryIdentityMigration from "./identity-migration" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Context, Effect, Layer, Schema } from "effect" +import { dirname, join } from "node:path" +import { MemoryHome } from "./home" +import { MemoryStore } from "./store" + +export interface Interface { + readonly migrateHome: ( + oldID: ProjectV2.ID, + newID: ProjectV2.ID, + ) => Effect.Effect< + void, + FSUtil.Error | EffectFlock.LockError | MemoryStore.StoreError | ConflictError | InvalidHomeError + > +} + +export class Service extends Context.Service()("@opencode/MemoryIdentityMigration") {} + +export class ConflictError extends Schema.TaggedErrorClass()("MemoryIdentityMigration.Conflict", { + topic_ids: Schema.Array(Schema.String), +}) {} + +export class InvalidHomeError extends Schema.TaggedErrorClass()( + "MemoryIdentityMigration.InvalidHome", + { + paths: Schema.Array(Schema.String), + }, +) {} + +export const layer = Layer.effect( + Service, + Effect.gen(function* () { + const fs = yield* FSUtil.Service + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + + const inspectHome = Effect.fnUntraced(function* (directory: string) { + const unexpected = (yield* fs.readDirectoryEntries(directory)).filter( + (entry) => + !( + (entry.name === "topics" && entry.type === "directory") || + (entry.name === "generations" && entry.type === "directory") || + (entry.name === "manifest.json" && entry.type === "file") + ), + ) + if (unexpected.length === 0) return + yield* new InvalidHomeError({ paths: unexpected.map((entry) => join(directory, entry.name)) }) + }) + + const migrateHomeUnsafe = Effect.fnUntraced(function* ( + oldID: ProjectV2.ID, + newID: ProjectV2.ID, + ) { + const source = home.directory(oldID) + if (!(yield* fs.existsSafe(source))) return + const target = home.directory(newID) + yield* fs.makeDirectory(dirname(target), { recursive: true }) + if (!(yield* fs.existsSafe(target))) { + yield* fs.rename(source, target) + return + } + + yield* inspectHome(source) + yield* inspectHome(target) + const sourceTopics = yield* store.inspectTopics(oldID) + const targetTopics = yield* store.inspectTopics(newID) + const targetByID = new Map(targetTopics.map((topic) => [topic.id, topic])) + const conflicts = sourceTopics + .filter((topic) => { + const current = targetByID.get(topic.id) + return current && JSON.stringify(current) !== JSON.stringify(topic) + }) + .map((topic) => topic.id) + if (conflicts.length > 0) yield* new ConflictError({ topic_ids: conflicts }) + + const imported = sourceTopics.filter((topic) => !targetByID.has(topic.id)) + if (imported.length > 0) { + yield* store.updateTopics(newID, (topics) => { + const current = new Map(topics.map((topic) => [topic.id, topic])) + const conflicts = imported.filter((topic) => { + const existing = current.get(topic.id) + return existing && JSON.stringify(existing) !== JSON.stringify(topic) + }) + if (conflicts.length > 0) + throw new MemoryStore.StoreError({ + message: `Memory identity migration conflicted for Topics: ${conflicts.map((topic) => topic.id).join(", ")}`, + }) + const changed = imported.filter((topic) => !current.has(topic.id)) + changed.forEach((topic) => current.set(topic.id, topic)) + return { + applied: { + topics: Array.from(current.values()).sort((left, right) => left.id.localeCompare(right.id)), + changed: changed.map((topic) => topic.id), + deleted: [], + }, + result: undefined, + } + }) + } + yield* fs.remove(source, { recursive: true }) + }) + + const migrateHome: Interface["migrateHome"] = (oldID, newID) => { + if (oldID === newID) return Effect.void + return flock + .withLock(migrateHomeUnsafe(oldID, newID), `memory-project:${oldID}`, home.locks) + .pipe(Effect.asVoid, Effect.withSpan("MemoryIdentityMigration.migrateHome")) + } + + return Service.of({ migrateHome }) + }), +) + +export const defaultLayer = layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), + Layer.provide(MemoryStore.defaultLayer), +) + +export const node = LayerNode.make(layer, [FSUtil.node, EffectFlock.node, MemoryHome.node, MemoryStore.node]) diff --git a/packages/opencode/src/memory/lock.ts b/packages/opencode/src/memory/lock.ts new file mode 100644 index 0000000000..e51cb31595 --- /dev/null +++ b/packages/opencode/src/memory/lock.ts @@ -0,0 +1,21 @@ +export * as MemoryLock from "./lock" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" +import { ProjectV2 } from "@opencode-ai/core/project" +import { Context, Effect, Layer } from "effect" + +export interface Interface { + readonly withProject: (projectID: ProjectV2.ID) => (effect: Effect.Effect) => Effect.Effect +} + +export class Service extends Context.Service()("@opencode/MemoryLock") {} + +export const layer = Layer.sync(Service, () => { + const locks = KeyedMutex.makeUnsafe() + return Service.of({ withProject: (projectID) => locks.withLock(projectID) }) +}) + +export const defaultLayer = layer + +export const node = LayerNode.make(layer, []) diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index d5402dac62..7f4c03698f 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -1,7 +1,6 @@ export * as Memory from "./memory" import { LayerNode } from "@opencode-ai/core/effect/layer-node" -import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Context, Duration, Effect, Layer, Option, Ref, Schema, Semaphore } from "effect" import { stringify } from "yaml" @@ -11,7 +10,9 @@ import { Project } from "@/project/project" import { InstanceState } from "@/effect/instance-state" import { MessageID, SessionID } from "@/session/schema" import { Token } from "@/util/token" +import { MemoryAdmission } from "./admission" import { MemoryConfig } from "./config" +import { MemoryLock } from "./lock" import { MemoryModel } from "./model" import { MemoryPrompts } from "./prompts" import { MemorySchema } from "./schema" @@ -62,19 +63,27 @@ export class ControllerError extends Schema.TaggedErrorClass()( export const layer: Layer.Layer< Service, never, - Config.Service | Provider.Service | Project.Service | MemoryConfig.Service | MemoryModel.Service | MemoryStore.Service + | Config.Service + | Provider.Service + | Project.Service + | MemoryAdmission.Service + | MemoryConfig.Service + | MemoryLock.Service + | MemoryModel.Service + | MemoryStore.Service > = Layer.effect( Service, Effect.gen(function* () { const config = yield* Config.Service const provider = yield* Provider.Service const project = yield* Project.Service + const admission = yield* MemoryAdmission.Service const configStore = yield* MemoryConfig.Service + const lock = yield* MemoryLock.Service const modelCalls = yield* MemoryModel.Service const store = yield* MemoryStore.Service const globalStarted = yield* Ref.make(false) const initializationLock = Semaphore.makeUnsafe(1) - const locks = KeyedMutex.makeUnsafe() const state = yield* InstanceState.make(() => Effect.succeed({ sessions: new Map() })) const availableModels = Effect.fn("Memory.availableModels")(function* () { @@ -166,7 +175,22 @@ export const layer: Layer.Layer< const ctx = yield* InstanceState.context const current = (yield* project.get(ctx.project.id)) ?? ctx.project if (current.vcs !== "git" || !current.time.initialized) return undefined - return { ctx, loaded: yield* configStore.load(ctx.worktree) } + const migration = yield* admission.ensure({ + projectID: current.id, + projectDirectory: current.worktree, + directories: Array.from(new Set([current.worktree, ...current.sandboxes, ctx.worktree])), + updated: current.time.updated, + }) + if (migration.unresolved) { + yield* Effect.logWarning("Project MEMORY migration needs manual repair", { + projectID: current.id, + diagnostics: migration.diagnostics.filter( + (item) => item.code.endsWith(".invalid") || item.code.endsWith(".conflict"), + ), + }) + return undefined + } + return { ctx, project: current, loaded: yield* configStore.load(current.worktree) } }) const resolveModel = Effect.fn("Memory.resolveModel")(function* (config: MemorySchema.Config) { @@ -229,7 +253,7 @@ export const layer: Layer.Layer< config: MemorySchema.Config topics: MemorySchema.Topic[] messages: SessionV1.WithParts[] - worktree: string + projectID: Project.Info["id"] }) { const evidence = maintenanceEvidence(input.messages) if (!evidence) return input.topics @@ -259,22 +283,16 @@ export const layer: Layer.Layer< const decoded = Schema.decodeUnknownOption(MemorySchema.MaintenanceResponse)(output) if (Option.isNone(decoded)) return yield* new ControllerError({ message: "MEMORY maintenance returned invalid output" }) - const applied = yield* Effect.try({ - try: () => - MemoryStore.applyActions({ - topics: input.topics, + return yield* store + .updateTopics(input.projectID, (topics) => ({ + applied: MemoryStore.applyActions({ + topics, actions: decoded.value.actions, topicLimit: input.config.topic_limit, }), - catch: (cause) => - cause instanceof MemoryStore.StoreError - ? cause - : new MemoryStore.StoreError({ message: `MEMORY action validation failed: ${String(cause)}` }), - }) - if (applied.changed.length === 0 && applied.deleted.length === 0) return applied.topics - yield* store.ensureGitExclude(input.worktree) - yield* store.writeTopics(input.worktree, applied) - return applied.topics + result: undefined, + })) + .pipe(Effect.map((updated) => updated.topics)) }) const select = Effect.fn("Memory.select")(function* (input: { @@ -282,14 +300,13 @@ export const layer: Layer.Layer< config: MemorySchema.Config topics: MemorySchema.Topic[] text: string - worktree: string + projectID: Project.Info["id"] }) { const topicIDs = yield* match(input) - const matched = MemoryStore.markMatched(input.topics, topicIDs) - if (matched.changed.length > 0) { - yield* store.ensureGitExclude(input.worktree) - yield* store.writeTopics(input.worktree, matched) - } + const matched = yield* store.updateTopics(input.projectID, (topics) => ({ + applied: MemoryStore.markMatched(topics, topicIDs), + result: undefined, + })) const byID = new Map(matched.topics.map((topic) => [topic.id, topic])) const selected = topicIDs.flatMap((id) => { const topic = byID.get(id) @@ -329,16 +346,16 @@ export const layer: Layer.Layer< session.firstTurnAttempted = true if (!due && !shouldMatch) return - yield* locks.withLock(current.ctx.worktree)( + yield* lock.withProject(current.project.id)( Effect.gen(function* () { - const topics = yield* store.readTopics(current.ctx.worktree) + const topics = yield* store.readTopics(current.project.id) const maintained = due ? yield* maintain({ model: current.model, config: current.loaded.config, topics, messages: input.messages, - worktree: current.ctx.worktree, + projectID: current.project.id, }).pipe( Effect.catchCause((cause) => Effect.gen(function* () { @@ -354,7 +371,7 @@ export const layer: Layer.Layer< config: current.loaded.config, topics: maintained, text: user.text, - worktree: current.ctx.worktree, + projectID: current.project.id, })).rendered : (data.sessions.get(input.sessionID)?.turn.rendered ?? []) const entry = data.sessions.get(input.sessionID) @@ -423,7 +440,7 @@ export const layer: Layer.Layer< } const origin = user.info.id - return yield* locks.withLock(current.ctx.worktree)( + return yield* lock.withProject(current.project.id)( Effect.gen(function* () { const activeTurn = data.sessions.get(input.sessionID)?.turn if (activeTurn?.messageID !== origin) return { status: "stale" as const } @@ -436,13 +453,13 @@ export const layer: Layer.Layer< } if (activeTurn.queryCount >= 2) return { status: "limit" as const } activeTurn.queryCount++ - const topics = yield* store.readTopics(current.ctx.worktree) + const topics = yield* store.readTopics(current.project.id) const selected = yield* select({ model: current.model, config: current.loaded.config, topics, text: query, - worktree: current.ctx.worktree, + projectID: current.project.id, }) const latest = data.sessions.get(input.sessionID)?.turn if (latest?.messageID !== origin) return { status: "stale" as const } @@ -477,15 +494,15 @@ export const layer: Layer.Layer< return [] } const user = latestRealUser(input.messages) - return yield* locks.withLock(current.ctx.worktree)( + return yield* lock.withProject(current.project.id)( Effect.gen(function* () { - const topics = yield* store.readTopics(current.ctx.worktree) + const topics = yield* store.readTopics(current.project.id) const maintained = yield* maintain({ model: current.model, config: current.loaded.config, topics, messages: input.messages, - worktree: current.ctx.worktree, + projectID: current.project.id, }).pipe( Effect.catchCause((cause) => Effect.gen(function* () { @@ -499,7 +516,7 @@ export const layer: Layer.Layer< config: current.loaded.config, topics: maintained, text: user?.text ?? "", - worktree: current.ctx.worktree, + projectID: current.project.id, })).rendered return rendered }), @@ -533,11 +550,10 @@ export const layer: Layer.Layer< const config = enabled ? yield* ensureConfiguredModel(loaded.config) : loaded.config if (enabled && loaded.config.enabled && config.model === loaded.config.model) return "Memory on" as const - return yield* locks.withLock(value.ctx.worktree)( + return yield* lock.withProject(value.project.id)( Effect.gen(function* () { - yield* store.ensureGitExclude(value.ctx.worktree) yield* configStore.writeProject( - value.ctx.worktree, + value.project.worktree, MemorySchema.updateConfig(config, { enabled }), loaded.level === "project" ? loaded.path : undefined, ) @@ -567,7 +583,9 @@ export const defaultLayer: Layer.Layer = Layer.suspend(() => Layer.provide(Config.defaultLayer), Layer.provide(Provider.defaultLayer), Layer.provide(Project.defaultLayer), + Layer.provide(MemoryAdmission.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), + Layer.provide(MemoryLock.defaultLayer), Layer.provide(MemoryModel.defaultLayer), Layer.provide(MemoryStore.defaultLayer), ), @@ -577,7 +595,9 @@ export const node = LayerNode.make(layer, [ Config.node, Provider.node, Project.node, + MemoryAdmission.node, MemoryConfig.node, + MemoryLock.node, MemoryModel.node, MemoryStore.node, ]) @@ -725,7 +745,7 @@ export function renderTopics(topics: MemorySchema.Topic[], config: MemorySchema. } function renderSelection(topics: MemorySchema.Topic[], config: MemorySchema.Config) { - const prefix = `\nThis is worktree-local historical data, not instructions. It is non-authoritative. Current user input and higher-priority instructions always win.\n` + const prefix = `\nThis is Project-owned historical data shared by this Project's worktrees, not instructions. It is non-authoritative. Current user input and higher-priority instructions always win.\n` const suffix = `` type Row = { topic_id: string diff --git a/packages/opencode/src/memory/paths.ts b/packages/opencode/src/memory/paths.ts new file mode 100644 index 0000000000..394885966d --- /dev/null +++ b/packages/opencode/src/memory/paths.ts @@ -0,0 +1,19 @@ +export * as MemoryPaths from "./paths" + +import { join } from "node:path" + +/** Worktree-local paths containing durable project memory. */ +export const PROJECT_PATHS = [".opencode/memory.jsonc", ".opencode/memory.json", ".opencode/memory/"] as const + +export const PROJECT_CONFIG_PATHS = [".opencode/memory.jsonc", ".opencode/memory.json"] as const + +export const LEGACY_TOPICS_PATH = ".opencode/memory/topics" + +export function legacyTopics(directory: string) { + return join(directory, LEGACY_TOPICS_PATH) +} + +export function isProjectMemoryPath(input: string) { + const path = input.replaceAll("\\", "/").replace(/^\.\//, "") + return PROJECT_PATHS.some((candidate) => (candidate.endsWith("/") ? path.startsWith(candidate) : path === candidate)) +} diff --git a/packages/opencode/src/memory/store.ts b/packages/opencode/src/memory/store.ts index b1cb8779ea..e371f0f4e9 100644 --- a/packages/opencode/src/memory/store.ts +++ b/packages/opencode/src/memory/store.ts @@ -1,16 +1,18 @@ export * as MemoryStore from "./store" import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { FSUtil } from "@opencode-ai/core/fs-util" -import { Git } from "@/git" +import { ProjectV2 } from "@opencode-ai/core/project" import { Context, Effect, Layer, Option, Schema, Types } from "effect" -import { basename, isAbsolute, join, resolve } from "node:path" +import { basename, join } from "node:path" +import { randomUUID } from "node:crypto" import { ulid } from "ulid" import { parse, stringify } from "yaml" import { MemoryFile } from "./file" +import { MemoryHome } from "./home" import { MemorySchema } from "./schema" -const EXCLUDE_RULES = [".opencode/memory.jsonc", ".opencode/memory.json", ".opencode/memory/"] as const const TOPIC_KEYS = ["schema_version", "id", "name", "summary", "metadata", "items"] as const const METADATA_KEYS = [ "categories", @@ -92,37 +94,84 @@ export type Applied = { readonly deleted: string[] } +export type Update = { + readonly applied: Applied + readonly result: A +} + +export type Snapshot = { + readonly revision: number + readonly topics: MemorySchema.Topic[] +} + type MutableTopic = Types.DeepMutable export interface Interface { - readonly readTopics: (worktree: string) => Effect.Effect - readonly writeTopics: (worktree: string, applied: Applied) => Effect.Effect - readonly ensureGitExclude: (worktree: string) => Effect.Effect + readonly readTopics: (projectID: ProjectV2.ID) => Effect.Effect + readonly readSnapshot: ( + projectID: ProjectV2.ID, + ) => Effect.Effect + readonly commit: ( + projectID: ProjectV2.ID, + expectedRevision: number, + applied: Applied, + ) => Effect.Effect + readonly inspectTopics: ( + projectID: ProjectV2.ID, + ) => Effect.Effect + readonly updateTopics: ( + projectID: ProjectV2.ID, + update: (topics: MemorySchema.Topic[]) => Update, + ) => Effect.Effect< + Snapshot & { result: A }, + FSUtil.Error | StoreError | EffectFlock.LockError + > } export class StoreError extends Schema.TaggedErrorClass()("MemoryStore.Error", { message: Schema.String, }) {} +export class CommitConflictError extends Schema.TaggedErrorClass()("MemoryStore.CommitConflict", { + expected_revision: Schema.Number, + actual_revision: Schema.Number, +}) {} + export class Service extends Context.Service()("@opencode/MemoryStore") {} +const Manifest = Schema.Struct({ + schema_version: Schema.Literal(1), + revision: Schema.Number.check(Schema.isInt(), Schema.isGreaterThanOrEqualTo(1)), + generation: Schema.String, +}) +const ManifestJson = Schema.fromJsonString(Manifest) +const decodeManifest = Schema.decodeUnknownOption(ManifestJson) + export const layer = Layer.effect( Service, Effect.gen(function* () { const fs = yield* FSUtil.Service - const git = yield* Git.Service + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service - const readTopics = Effect.fn("MemoryStore.readTopics")(function* (worktree: string) { - const directory = topicsDir(worktree) + const readDirectoryTopics = Effect.fnUntraced(function* (directory: string, strict = false) { if (!(yield* fs.existsSafe(directory))) return [] - const names = (yield* fs.readDirectoryEntries(directory)) + const entries = yield* fs.readDirectoryEntries(directory) + if (strict) { + const unexpected = entries.filter((entry) => entry.type !== "file" || !entry.name.endsWith(".yaml")) + if (unexpected.length > 0) + return yield* new StoreError({ + message: `Memory topics directory contains unexpected entries: ${unexpected.map((entry) => entry.name).join(", ")}`, + }) + } + const names = entries .filter((entry) => entry.type === "file" && entry.name.endsWith(".yaml")) .map((entry) => entry.name) .sort() const topics = yield* Effect.forEach( names, - (name) => - Effect.gen(function* () { + (name) => { + const read = Effect.gen(function* () { const file = join(directory, name) const text = yield* fs.readFileString(file) const value = yield* Effect.try({ @@ -131,62 +180,162 @@ export const layer = Layer.effect( }) const decoded = decodeTopic(value, basename(name, ".yaml")) if (decoded) return decoded + if (strict) return yield* new StoreError({ message: `Memory topic is invalid: ${file}` }) yield* Effect.logWarning("memory topic is invalid — ignoring", { path: file }) return undefined - }).pipe( + }) + if (strict) return read + return read.pipe( Effect.catchCause((cause) => Effect.gen(function* () { yield* Effect.logWarning("memory topic read failed — ignoring", { path: name, cause }) return undefined }), ), - ), + ) + }, { concurrency: 8 }, ) return topics.filter((topic): topic is MemorySchema.Topic => topic !== undefined) }) - const writeTopics = Effect.fn("MemoryStore.writeTopics")(function* (worktree: string, applied: Applied) { - yield* fs.makeDirectory(topicsDir(worktree), { recursive: true }) + const writeDirectoryTopics = Effect.fnUntraced(function* (directory: string, applied: Applied) { + yield* fs.makeDirectory(directory, { recursive: true }) const byID = new Map(applied.topics.map((topic) => [topic.id, topic])) yield* Effect.forEach( applied.changed, (id) => { const topic = byID.get(id) if (!topic) return Effect.void - return MemoryFile.atomicWrite(fs, join(topicsDir(worktree), `${id}.yaml`), stringify(topic, { lineWidth: 0 })) + return MemoryFile.atomicWrite(fs, join(directory, `${id}.yaml`), stringify(topic, { lineWidth: 0 })) }, { concurrency: 1, discard: true }, ) - yield* Effect.forEach( - applied.deleted, - (id) => fs.remove(join(topicsDir(worktree), `${id}.yaml`), { force: true }), - { concurrency: 1, discard: true }, + yield* Effect.forEach(applied.deleted, (id) => fs.remove(join(directory, `${id}.yaml`), { force: true }), { + concurrency: 1, + discard: true, + }) + }) + + const readSnapshotUnsafe = Effect.fnUntraced(function* (projectID: ProjectV2.ID, strict: boolean) { + const text = yield* fs.readFileStringSafe(home.manifest(projectID)) + if (text === undefined) + return { + revision: 0, + topics: yield* readDirectoryTopics(home.topics(projectID), strict), + } satisfies Snapshot + const decoded = decodeManifest(text) + if (Option.isNone(decoded) || !/^[a-z0-9-]+$/.test(decoded.value.generation)) + return yield* new StoreError({ message: "Memory generation manifest is invalid" }) + const directory = join(home.generations(projectID), decoded.value.generation) + if (!(yield* fs.existsSafe(directory))) + return yield* new StoreError({ message: "Memory generation referenced by manifest is missing" }) + return { + revision: decoded.value.revision, + topics: yield* readDirectoryTopics(directory, strict), + } satisfies Snapshot + }) + + const writeSnapshot = Effect.fnUntraced(function* ( + projectID: ProjectV2.ID, + revision: number, + topics: MemorySchema.Topic[], + ) { + if ( + new Set(topics.map((topic) => topic.id)).size !== topics.length || + topics.some((topic) => !decodeTopic(topic, topic.id)) ) + yield* new StoreError({ message: "Memory update produced an invalid generation" }) + const generation = `${revision}-${randomUUID()}` + const generations = home.generations(projectID) + const staging = join(generations, `.${generation}.tmp`) + const directory = join(generations, generation) + yield* Effect.gen(function* () { + yield* fs.makeDirectory(generations, { recursive: true }) + yield* writeDirectoryTopics(staging, { + topics, + changed: topics.map((topic) => topic.id), + deleted: [], + }) + yield* fs.rename(staging, directory) + yield* MemoryFile.atomicWrite( + fs, + home.manifest(projectID), + JSON.stringify({ schema_version: 1, revision, generation }) + "\n", + ) + }).pipe(Effect.onError(() => fs.remove(staging, { force: true, recursive: true }).pipe(Effect.ignore))) + yield* fs.remove(home.topics(projectID), { force: true, recursive: true }).pipe(Effect.ignore) }) - const ensureGitExclude = Effect.fn("MemoryStore.ensureGitExclude")(function* (worktree: string) { - const result = yield* git.run(["rev-parse", "--git-path", "info/exclude"], { cwd: worktree }) - if (result.exitCode !== 0) return yield* new StoreError({ message: result.stderr.toString("utf8").trim() }) - const raw = result.text().trim() - if (!raw) return yield* new StoreError({ message: "Git did not resolve info/exclude" }) - const file = isAbsolute(raw) ? raw : resolve(worktree, raw) - const current = (yield* fs.readFileStringSafe(file)) ?? "" - const lines = new Set(current.split(/\r?\n/).map((line) => line.trim())) - const missing = EXCLUDE_RULES.filter((rule) => !lines.has(rule)) - if (missing.length === 0) return yield* Effect.void - const prefix = current.length === 0 || current.endsWith("\n") ? current : current + "\n" - yield* MemoryFile.atomicWrite(fs, file, prefix + missing.join("\n") + "\n") - return yield* Effect.logDebug("memory Git exclusions installed", { worktree, path: file }) + const readTopics = Effect.fn("MemoryStore.readTopics")((projectID: ProjectV2.ID) => + readSnapshotUnsafe(projectID, false).pipe( + Effect.map((snapshot) => snapshot.topics), + Effect.catchTag("MemoryStore.Error", () => Effect.succeed([])), + ), + ) + + const readSnapshot = Effect.fn("MemoryStore.readSnapshot")((projectID: ProjectV2.ID) => + readSnapshotUnsafe(projectID, true), + ) + + const inspectTopics = Effect.fn("MemoryStore.inspectTopics")((projectID: ProjectV2.ID) => + readSnapshot(projectID).pipe(Effect.map((snapshot) => snapshot.topics)), + ) + + const commitUnsafe = Effect.fnUntraced(function* ( + projectID: ProjectV2.ID, + expectedRevision: number, + applied: Applied, + ) { + const current = yield* readSnapshot(projectID) + if (current.revision !== expectedRevision) + return yield* new CommitConflictError({ + expected_revision: expectedRevision, + actual_revision: current.revision, + }) + if (applied.changed.length === 0 && applied.deleted.length === 0) return current + const revision = current.revision + 1 + yield* writeSnapshot(projectID, revision, applied.topics) + return { revision, topics: applied.topics } satisfies Snapshot }) - return Service.of({ readTopics, writeTopics, ensureGitExclude }) + const commit = Effect.fn("MemoryStore.commit")((projectID: ProjectV2.ID, expectedRevision: number, applied: Applied) => + flock.withLock(commitUnsafe(projectID, expectedRevision, applied), `memory-project:${projectID}`, home.locks), + ) + + const updateTopics: Interface["updateTopics"] = (projectID, update) => + flock.withLock( + Effect.gen(function* () { + const current = yield* readSnapshot(projectID) + const next = yield* Effect.try({ + try: () => update(current.topics), + catch: (cause) => + cause instanceof StoreError + ? cause + : new StoreError({ message: `Memory update failed: ${String(cause)}` }), + }) + const applied = next.applied + if (applied.changed.length === 0 && applied.deleted.length === 0) + return { revision: current.revision, topics: applied.topics, result: next.result } + const revision = current.revision + 1 + yield* writeSnapshot(projectID, revision, applied.topics) + return { revision, topics: applied.topics, result: next.result } + }), + `memory-project:${projectID}`, + home.locks, + ) + + return Service.of({ readTopics, readSnapshot, commit, inspectTopics, updateTopics }) }), ) -export const defaultLayer = layer.pipe(Layer.provide(FSUtil.defaultLayer), Layer.provide(Git.defaultLayer)) +export const defaultLayer = layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), +) -export const node = LayerNode.make(layer, [FSUtil.node, Git.node]) +export const node = LayerNode.make(layer, [FSUtil.node, EffectFlock.node, MemoryHome.node]) export function decodeTopic(value: unknown, expectedID?: string) { if (!hasExactKeys(value, TOPIC_KEYS)) return undefined @@ -376,10 +525,6 @@ export function indexes(topics: MemorySchema.Topic[]) { return topics.map(MemorySchema.topicIndex) } -export function topicsDir(worktree: string) { - return join(worktree, ".opencode", "memory", "topics") -} - function assertSemantic(...values: string[]) { if (values.some((value) => !isAllowedMemoryText(value))) throw new StoreError({ message: "Memory action contains prohibited content" }) diff --git a/packages/opencode/src/project/identity-migration.ts b/packages/opencode/src/project/identity-migration.ts new file mode 100644 index 0000000000..4afd08a62f --- /dev/null +++ b/packages/opencode/src/project/identity-migration.ts @@ -0,0 +1,26 @@ +export * as ProjectIdentityMigration from "./identity-migration" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { ProjectV2 } from "@opencode-ai/core/project" +import { Context, Effect, Layer } from "effect" +import { MemoryIdentityMigration } from "@/memory/identity-migration" + +export interface Interface { + readonly migrate: (oldID: ProjectV2.ID, newID: ProjectV2.ID) => Effect.Effect +} + +export class Service extends Context.Service()("@opencode/ProjectIdentityMigration") {} + +export const layer = Layer.effect( + Service, + Effect.gen(function* () { + const memory = yield* MemoryIdentityMigration.Service + return Service.of({ + migrate: (oldID, newID) => memory.migrateHome(oldID, newID).pipe(Effect.orDie), + }) + }), +) + +export const defaultLayer = layer.pipe(Layer.provide(MemoryIdentityMigration.defaultLayer)) + +export const node = LayerNode.make(layer, [MemoryIdentityMigration.node]) diff --git a/packages/opencode/src/project/project.ts b/packages/opencode/src/project/project.ts index 82ae979ba3..44e7013a3c 100644 --- a/packages/opencode/src/project/project.ts +++ b/packages/opencode/src/project/project.ts @@ -22,6 +22,7 @@ import { RuntimeFlags } from "@/effect/runtime-flags" import { EventV2Bridge } from "@/event-v2-bridge" import { EventV2 } from "@opencode-ai/core/event" import { Project } from "@opencode-ai/schema/project" +import { ProjectIdentityMigration } from "./identity-migration" export const Info = Project.Info export type Info = Types.DeepMutable> @@ -112,6 +113,7 @@ export const layer = Layer.effect( const projectDirectories = yield* ProjectDirectories.Service const events = yield* EventV2Bridge.Service const flags = yield* RuntimeFlags.Service + const identityMigration = yield* ProjectIdentityMigration.Service const { db } = yield* Database.Service const git = Effect.fnUntraced( @@ -151,6 +153,8 @@ export const layer = Layer.effect( if (oldID === ProjectV2.ID.global) return if (oldID === newID) return + yield* identityMigration.migrate(oldID, newID) + yield* db .transaction( (d) => @@ -472,6 +476,7 @@ export const defaultLayer = layer.pipe( Layer.provide(FSUtil.defaultLayer), Layer.provide(Database.defaultLayer), Layer.provide(RuntimeFlags.defaultLayer), + Layer.provide(ProjectIdentityMigration.defaultLayer), ) export const use = serviceUse(Service) @@ -484,6 +489,7 @@ export const node = LayerNode.make(layer, [ ProjectDirectories.node, EventV2Bridge.node, RuntimeFlags.node, + ProjectIdentityMigration.node, Database.node, ]) diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index 255e5fce8d..c15ce1dda3 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -21,6 +21,8 @@ import { AppProcess } from "@opencode-ai/core/process" import { InstanceState } from "@/effect/instance-state" import { WorktreeEvent } from "@opencode-ai/schema/worktree-event" import { SettingsHook } from "@/hook/settings" +import { MemoryAdmission } from "@/memory/admission" +import { MemoryPaths } from "@/memory/paths" import * as Option from "effect/Option" export const Event = WorktreeEvent @@ -156,6 +158,7 @@ export const layer: Layer.Layer< const gitSvc = yield* Git.Service const project = yield* Project.Service const store = yield* InstanceStore.Service + const memoryAdmission = Option.getOrUndefined(yield* Effect.serviceOption(MemoryAdmission.Service)) const settingsHook = Option.getOrUndefined(yield* Effect.serviceOption(SettingsHook.Service)) const git = Effect.fnUntraced( @@ -227,7 +230,7 @@ export const layer: Layer.Layer< { cwd: ctx.worktree }, ) if (created.code !== 0) { - return yield* new CreateFailedError({ + yield* new CreateFailedError({ message: created.stderr || created.text || "Failed to create git worktree", }) } @@ -341,11 +344,18 @@ export const layer: Layer.Layer< return process.platform === "win32" ? normalized.toLowerCase() : normalized }) + const registeredSandbox = Effect.fnUntraced(function* (sandboxes: string[], directory: string) { + const key = yield* canonical(directory) + return (yield* Effect.forEach(sandboxes, (sandbox) => + canonical(sandbox).pipe(Effect.map((candidate) => ({ candidate, sandbox }))), + )).find((sandbox) => sandbox.candidate === key)?.sandbox + }) + function parseWorktreeList(text: string) { return text .split("\n") .map((line) => line.trim()) - .reduce<{ path?: string; branch?: string }[]>((acc, line) => { + .reduce<{ path?: string; branch?: string; prunable?: boolean }[]>((acc, line) => { if (!line) return acc if (line.startsWith("worktree ")) { acc.push({ path: line.slice("worktree ".length).trim() }) @@ -356,12 +366,13 @@ export const layer: Layer.Layer< if (line.startsWith("branch ")) { current.branch = line.slice("branch ".length).trim() } + if (line.startsWith("prunable ")) current.prunable = true return acc }, []) } const locateWorktree = Effect.fnUntraced(function* ( - entries: { path?: string; branch?: string }[], + entries: { path?: string; branch?: string; prunable?: boolean }[], directory: string, ) { for (const item of entries) { @@ -383,11 +394,31 @@ export const layer: Layer.Layer< return yield* new ListFailedError({ message: result.stderr || result.text || "Failed to read git worktrees" }) } + const entries = parseWorktreeList(result.text) + const prunable = entries.flatMap((entry) => (entry.prunable && entry.path ? [entry.path] : [])) + if (prunable.length > 0) { + const pruned = yield* git(["worktree", "prune"], { cwd: ctx.worktree }) + if (pruned.code !== 0) + return yield* new ListFailedError({ + message: pruned.stderr || pruned.text || "Failed to prune stale git worktrees", + }) + const current = (yield* project.get(ctx.project.id)) ?? ctx.project + yield* Effect.forEach( + prunable, + (directory) => + Effect.gen(function* () { + const sandbox = yield* registeredSandbox(current.sandboxes, directory) + if (sandbox) yield* project.removeSandbox(ctx.project.id, sandbox) + }), + { concurrency: 1, discard: true }, + ) + } + const primary = yield* canonical(ctx.project.worktree) const primaryName = pathSvc.basename(primary).toLowerCase() - return yield* Effect.forEach(parseWorktreeList(result.text), (entry) => + return yield* Effect.forEach(entries, (entry) => Effect.gen(function* () { - if (!entry.path) return undefined + if (!entry.path || entry.prunable) return undefined const directory = yield* canonical(entry.path) if (directory === primary) return undefined const name = pathSvc.basename(directory).toLowerCase() @@ -427,42 +458,89 @@ export const layer: Layer.Layer< }) } + const hasUnresolvedLegacyMemory = Effect.fnUntraced(function* (directory: string) { + const found = yield* Effect.forEach( + MemoryPaths.PROJECT_PATHS, + (relative) => fs.exists(pathSvc.join(directory, relative)).pipe(Effect.orDie), + { concurrency: "unbounded" }, + ) + return found.some(Boolean) + }) + + const reconcileLegacyMemory = Effect.fnUntraced(function* (input: { + projectID: ProjectV2.ID + projectDirectory: string + directory: string + updated: number + }) { + if (memoryAdmission) { + yield* memoryAdmission.invalidate(input.projectID) + const memory = yield* memoryAdmission.ensure({ + projectID: input.projectID, + projectDirectory: input.projectDirectory, + directories: [input.directory], + updated: input.updated, + }) + if (memory.unresolved > 0) + return `Cannot continue with unresolved legacy project memory: ${memory.diagnostics + .filter((item) => item.code.endsWith(".invalid") || item.code.endsWith(".conflict")) + .map((item) => `${item.code} ${item.path}`) + .join(", ")}` + } + if (!(yield* hasUnresolvedLegacyMemory(input.directory))) return undefined + return "Cannot continue while unresolved legacy project memory remains. Move or back up .opencode/memory* outside this worktree, then retry." + }) + const removeLocked = Effect.fnUntraced(function* (input: RemoveInput, directory: string) { const ctx = yield* InstanceState.context if (ctx.project.vcs !== "git") { return yield* new NotGitError({ message: "Worktrees are only supported for git projects" }) } - yield* FiberMap.remove(bootFibers, directory) - - if (settingsHook) { - const wrResult = yield* settingsHook - .trigger( - { event: "WorktreeRemove", path: directory, branch: pathSvc.basename(directory) }, - { sessionID: "", transcriptPath: "" }, - ) - .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) - yield* SettingsHook.landSystemMessages(wrResult, { sessionID: "" }) + const primary = yield* canonical(ctx.project.worktree) + const current = yield* canonical(ctx.worktree) + if (directory === primary || directory === current) { + return yield* new RemoveFailedError({ message: "Cannot remove the primary or current worktree" }) } - // Preserve the loaded path casing for the store cache; `directory` is lowercased on Windows. - if (directory !== (yield* canonical(ctx.worktree))) yield* store.disposeDirectory(input.directory) + const currentProject = (yield* project.get(ctx.project.id)) ?? ctx.project + const registered = yield* registeredSandbox(currentProject.sandboxes, directory) + if (!registered) { + return yield* new RemoveFailedError({ message: "Worktree is not registered with this Project" }) + } const list = yield* git(["worktree", "list", "--porcelain"], { cwd: ctx.worktree }) if (list.code !== 0) { return yield* new RemoveFailedError({ message: list.stderr || list.text || "Failed to read git worktrees" }) } - const entries = parseWorktreeList(list.text) - const entry = yield* locateWorktree(entries, directory) - + const entry = yield* locateWorktree(parseWorktreeList(list.text), directory) if (!entry?.path) { - const directoryExists = yield* fs.exists(directory).pipe(Effect.orDie) - if (directoryExists) { - yield* stopFsmonitor(directory) - yield* cleanDirectory(directory) - } - return true + return yield* new RemoveFailedError({ message: "Worktree is not registered with this Project" }) + } + + const blocker = yield* reconcileLegacyMemory({ + projectID: ctx.project.id, + projectDirectory: ctx.project.worktree, + directory: entry.path, + updated: currentProject.time.updated, + }).pipe( + Effect.mapError( + (error) => new RemoveFailedError({ message: `Failed to migrate legacy project memory: ${error.message}` }), + ), + ) + if (blocker) return yield* new RemoveFailedError({ message: blocker }) + + yield* FiberMap.remove(bootFibers, directory) + + if (settingsHook) { + const wrResult = yield* settingsHook + .trigger( + { event: "WorktreeRemove", path: entry.path, branch: pathSvc.basename(entry.path) }, + { sessionID: "", transcriptPath: "" }, + ) + .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) + yield* SettingsHook.landSystemMessages(wrResult, { sessionID: "" }) } // Git may return the original casing when a caller supplied a normalized Windows path. @@ -491,12 +569,19 @@ export const layer: Layer.Layer< if (branch) { const deleted = yield* git(["branch", "-D", branch], { cwd: ctx.worktree }) if (deleted.code !== 0) { + const restored = yield* git(["worktree", "add", entry.path, branch], { cwd: ctx.worktree }) + if (restored.code !== 0) yield* project.removeSandbox(ctx.project.id, registered) + const recovery = + restored.code === 0 + ? "the worktree registration was restored" + : `the worktree could not be restored and its Project registration was removed: ${restored.stderr || restored.text}` return yield* new RemoveFailedError({ - message: deleted.stderr || deleted.text || "Failed to delete worktree branch", + message: `Failed to delete worktree branch: ${deleted.stderr || deleted.text}; ${recovery}`, }) } } + yield* project.removeSandbox(ctx.project.id, registered) return true }) @@ -519,7 +604,7 @@ export const layer: Layer.Layer< function* (directory: string, cmd: string) { const [shell, args] = process.platform === "win32" ? ["cmd", ["/c", cmd]] : ["bash", ["-lc", cmd]] const result = yield* appProcess.run( - ChildProcess.make(shell, args as string[], { cwd: directory, extendEnv: true, stdin: "ignore" }), + ChildProcess.make(shell, args, { cwd: directory, extendEnv: true, stdin: "ignore" }), ) return { code: result.exitCode, stderr: result.stderr.toString("utf8") } }, @@ -569,14 +654,15 @@ export const layer: Layer.Layer< }) const sweep = Effect.fnUntraced(function* (root: string) { - const first = yield* git(["clean", "-ffdx"], { cwd: root }) + const args = ["clean", "-ffdx", ...MemoryPaths.PROJECT_PATHS.flatMap((relative) => ["-e", relative])] + const first = yield* git(args, { cwd: root }) if (first.code === 0) return first const entries = failedRemoves(first.stderr, first.text) if (!entries.length) return first yield* prune(root, entries) - return yield* git(["clean", "-ffdx"], { cwd: root }) + return yield* git(args, { cwd: root }) }) const resetLocked = Effect.fnUntraced(function* (input: ResetInput, directory: string) { @@ -585,9 +671,15 @@ export const layer: Layer.Layer< return yield* new NotGitError({ message: "Worktrees are only supported for git projects" }) } - const primary = yield* canonical(ctx.worktree) - if (directory === primary) { - return yield* new ResetFailedError({ message: "Cannot reset the primary workspace" }) + const primary = yield* canonical(ctx.project.worktree) + const current = yield* canonical(ctx.worktree) + if (directory === primary || directory === current) { + return yield* new ResetFailedError({ message: "Cannot reset the primary or current worktree" }) + } + + const currentProject = (yield* project.get(ctx.project.id)) ?? ctx.project + if (!(yield* registeredSandbox(currentProject.sandboxes, directory))) { + return yield* new ResetFailedError({ message: "Worktree is not registered with this Project" }) } yield* FiberMap.remove(bootFibers, directory) @@ -603,6 +695,18 @@ export const layer: Layer.Layer< const worktreePath = entry.path + const blocker = yield* reconcileLegacyMemory({ + projectID: ctx.project.id, + projectDirectory: ctx.project.worktree, + directory: worktreePath, + updated: currentProject.time.updated, + }).pipe( + Effect.mapError( + (error) => new ResetFailedError({ message: `Failed to migrate legacy project memory: ${error.message}` }), + ), + ) + if (blocker) return yield* new ResetFailedError({ message: blocker }) + const base = yield* gitSvc.defaultBranch(ctx.worktree) if (!base) { return yield* new ResetFailedError({ message: "Default branch not found" }) @@ -650,13 +754,18 @@ export const layer: Layer.Layer< (r) => new ResetFailedError({ message: r.stderr || r.text || "Failed to clean submodules" }), ) - const status = yield* git(["-c", "core.fsmonitor=false", "status", "--porcelain=v1"], { cwd: worktreePath }) + const status = yield* git(["-c", "core.fsmonitor=false", "status", "--porcelain=v1", "--untracked-files=all"], { + cwd: worktreePath, + }) if (status.code !== 0) { return yield* new ResetFailedError({ message: status.stderr || status.text || "Failed to read git status" }) } - if (status.text.trim()) { - return yield* new ResetFailedError({ message: `Worktree reset left local changes:\n${status.text.trim()}` }) + const dirty = status.text + .split("\n") + .filter((line) => line && !(line.startsWith("?? ") && MemoryPaths.isProjectMemoryPath(line.slice(3)))) + if (dirty.length > 0) { + return yield* new ResetFailedError({ message: `Worktree reset left local changes:\n${dirty.join("\n")}` }) } yield* FiberMap.run( @@ -683,6 +792,7 @@ export const appLayer = layer.pipe( Layer.provide(Git.defaultLayer), Layer.provide(AppProcess.defaultLayer), Layer.provide(Project.defaultLayer), + Layer.provide(MemoryAdmission.defaultLayer), Layer.provide(Database.defaultLayer), Layer.provide(FSUtil.defaultLayer), Layer.provide(NodePath.layer), @@ -696,6 +806,7 @@ export const node = LayerNode.make(layer, [ AppProcess.node, Git.node, Project.node, + MemoryAdmission.node, InstanceStore.node, Database.node, SettingsHook.node, diff --git a/packages/opencode/test/fixture/memory-store-worker.ts b/packages/opencode/test/fixture/memory-store-worker.ts new file mode 100644 index 0000000000..7447160359 --- /dev/null +++ b/packages/opencode/test/fixture/memory-store-worker.ts @@ -0,0 +1,56 @@ +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Effect, Layer } from "effect" +import { MemoryHome } from "@/memory/home" +import { MemoryStore } from "@/memory/store" + +type Input = { + root: string + projectID: string + ready: string + go: string + itemID: string + content: string +} + +const input = JSON.parse(process.argv[2] ?? "") as Input +const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(input.root)) +const store = MemoryStore.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), +) + +await Effect.runPromise( + Effect.gen(function* () { + const memory = yield* MemoryStore.Service + const projectID = ProjectV2.ID.make(input.projectID) + yield* Effect.promise(() => Bun.write(input.ready, String(process.pid))) + while (!(yield* Effect.promise(() => Bun.file(input.go).exists()))) yield* Effect.sleep("5 millis") + yield* memory.updateTopics(projectID, (topics) => { + const current = topics[0] + if (!current) throw new Error("Missing base topic") + const items = [...current.items, { + id: input.itemID, + kind: "decision", + content: input.content, + rationale: "该决定由用户确认并长期适用", + confirmed_at: "2026-08-11T00:00:00Z", + } as const] + const updated = { + ...current, + metadata: { + ...current.metadata, + item_count: items.length, + revision: current.metadata.revision + 1, + }, + items, + } + return { + applied: { topics: [updated], changed: [updated.id], deleted: [] }, + result: undefined, + } + }) + }).pipe(Effect.provide(store)), +) diff --git a/packages/opencode/test/memory/memory-admission.test.ts b/packages/opencode/test/memory/memory-admission.test.ts new file mode 100644 index 0000000000..a0cc6b9130 --- /dev/null +++ b/packages/opencode/test/memory/memory-admission.test.ts @@ -0,0 +1,167 @@ +import { describe, expect } from "bun:test" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Effect, Layer } from "effect" +import path from "node:path" +import { MemoryAdmission } from "@/memory/admission" +import { MemoryConfig } from "@/memory/config" +import { MemoryHome } from "@/memory/home" +import { MemoryStore } from "@/memory/store" +import { tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +const it = testEffect(Layer.mergeAll(FSUtil.defaultLayer, CrossSpawnSpawner.defaultLayer)) +const projectID = ProjectV2.ID.make("project-memory-admission") +const config = { + schema_version: 1, + enabled: true, + model: "test/memory-small", + topic_limit: 10, + topic_limit_floor: 10, + turn_interval: 5, + injection: { max_topics: 3, max_tokens: 1_200 }, +} as const +const now = "2026-08-11T00:00:00Z" + +function topic(id: string, summary = `已确认的 ${id} 决策`) { + return { + schema_version: 1, + id, + name: `${id} 决策`, + summary, + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: [id], + related_topics: [], + created_at: now, + updated_at: now, + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: `${id}-item`, + kind: "decision", + content: `已确认决定：保留 ${id} 边界`, + rationale: "该边界由用户确认并长期适用", + confirmed_at: now, + }, + ], + } as const +} + +function layers(root: string) { + const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + const store = MemoryStore.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) + const admission = MemoryAdmission.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryConfig.defaultLayer), + Layer.provide(home), + Layer.provide(store), + ) + return Layer.mergeAll(admission, store, MemoryConfig.defaultLayer) +} + +describe("MemoryAdmission", () => { + it.live("promotes one normalized sandbox configuration when the Project has no explicit configuration", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const first = yield* tmpdirScoped() + const second = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const configStore = yield* MemoryConfig.Service + const files = [first, second].map((directory) => path.join(directory, ".opencode", "memory.jsonc")) + yield* Effect.forEach(files, (file) => fs.makeDirectory(path.dirname(file), { recursive: true }), { + concurrency: 1, + discard: true, + }) + yield* Effect.forEach(files, (file) => fs.writeFileString(file, JSON.stringify(config)), { + concurrency: 1, + discard: true, + }) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [primary, first, second], + updated: 1, + }) + + expect(result.diagnostics.map((item) => item.code)).toEqual(["config.promoted", "config.duplicate"]) + expect((yield* configStore.load(primary))?.config).toEqual(config) + expect(yield* Effect.forEach(files, (file) => fs.existsSafe(file))).toEqual([false, false]) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("caches one Project snapshot until worktree lifecycle invalidates it", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const snapshot = { projectID, projectDirectory: primary, directories: [primary, sandbox], updated: 1 } + + expect((yield* admission.ensure(snapshot)).diagnostics).toEqual([]) + const file = path.join(sandbox, ".opencode", "memory", "topics", "late.yaml") + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, "{ invalid") + + expect((yield* admission.ensure(snapshot)).diagnostics).toEqual([]) + yield* admission.invalidate(projectID) + expect((yield* admission.ensure(snapshot)).diagnostics.map((item) => item.code)).toEqual(["topic.invalid"]) + expect(yield* fs.existsSafe(file)).toBe(true) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("imports every worktree Topic in one Project revision", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const first = yield* tmpdirScoped() + const second = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const store = yield* MemoryStore.Service + const topics = [topic("architecture"), topic("product")] + const files = [first, second].map((directory, index) => + path.join(directory, ".opencode", "memory", "topics", `${topics[index].id}.yaml`), + ) + yield* Effect.forEach(files, (file, index) => + fs.makeDirectory(path.dirname(file), { recursive: true }).pipe( + Effect.andThen(fs.writeFileString(file, Bun.YAML.stringify(topics[index]))), + ), + ) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [primary, first, second], + updated: 1, + }) + + expect(result.diagnostics.map((item) => item.code)).toEqual(["topic.imported", "topic.imported"]) + expect(yield* store.readSnapshot(projectID)).toMatchObject({ revision: 1, topics }) + expect(yield* Effect.forEach(files, (file) => fs.existsSafe(file))).toEqual([false, false]) + }).pipe(Effect.provide(layers(root))) + }), + ) +}) diff --git a/packages/opencode/test/memory/memory-persistence.test.ts b/packages/opencode/test/memory/memory-persistence.test.ts new file mode 100644 index 0000000000..c9f91e3a5c --- /dev/null +++ b/packages/opencode/test/memory/memory-persistence.test.ts @@ -0,0 +1,605 @@ +import { describe, expect } from "bun:test" +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { Effect, Layer, Schema } from "effect" +import path from "node:path" +import { MemoryConfig } from "@/memory/config" +import { MemoryHome } from "@/memory/home" +import { MemoryIdentityMigration } from "@/memory/identity-migration" +import { MemoryAdmission } from "@/memory/admission" +import { MemoryPaths } from "@/memory/paths" +import { MemorySchema } from "@/memory/schema" +import { MemoryStore } from "@/memory/store" +import { tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +const it = testEffect(Layer.mergeAll(FSUtil.defaultLayer, CrossSpawnSpawner.defaultLayer)) +const projectID = ProjectV2.ID.make("project-memory-test") +const otherProjectID = ProjectV2.ID.make("project-memory-other") +const now = "2026-08-11T00:00:00Z" + +const config = { + schema_version: 1, + enabled: true, + model: "test/memory-small", + topic_limit: 10, + topic_limit_floor: 10, + turn_interval: 5, + injection: { max_topics: 3, max_tokens: 1_200 }, +} satisfies MemorySchema.Config + +function topic(summary = "已确认的核心架构边界") { + return { + schema_version: 1, + id: "project-architecture", + name: "架构边界", + summary, + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: now, + updated_at: now, + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "decision-01", + kind: "decision", + content: "已确认决定：核心模块之间使用稳定边界", + rationale: "该边界由用户确认并长期适用", + confirmed_at: now, + }, + ], + } satisfies MemorySchema.Topic +} + +function terminologyTopic() { + const value = topic("术语 Project Memory 指项目级持久化记忆") + return { + ...value, + id: "project-memory-term", + name: "Project Memory 术语", + metadata: { + ...value.metadata, + categories: ["term"], + keywords: ["Project Memory"], + }, + items: [ + { + id: "term-01", + kind: "term", + content: "术语 Project Memory 指项目级持久化记忆", + rationale: "该术语由用户确认并长期适用", + confirmed_at: now, + }, + ], + } satisfies MemorySchema.Topic +} + +function layers(root: string) { + const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + const store = MemoryStore.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) + const admission = MemoryAdmission.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryConfig.defaultLayer), + Layer.provide(home), + Layer.provide(store), + ) + return Layer.mergeAll(home, store, admission, MemoryConfig.defaultLayer) +} + +function replaceTopics(store: MemoryStore.Interface, id: ProjectV2.ID, topics: MemorySchema.Topic[]) { + return store + .updateTopics(id, () => ({ + applied: { topics, changed: topics.map((topic) => topic.id), deleted: [] }, + result: undefined, + })) + .pipe(Effect.asVoid) +} + +describe("Project-owned MEMORY persistence", () => { + it.live("derives a path-safe home from Project identity", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const home = MemoryHome.make(root) + const malicious = ProjectV2.ID.make("../../outside/project") + const directory = home.directory(malicious) + + expect(path.relative(root, directory)).not.toStartWith("..") + expect(path.dirname(directory)).toBe(path.join(root, "memory", "projects")) + expect(home.directory(malicious)).toBe(directory) + expect(home.directory(projectID)).not.toBe(home.directory(otherProjectID)) + }), + ) + + it.live("stores one authoritative Topic set per Project ID", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + + expect(yield* store.readTopics(projectID)).toEqual([value]) + expect(yield* store.readTopics(otherProjectID)).toEqual([]) + const manifest = Schema.decodeUnknownSync( + Schema.fromJsonString(Schema.Struct({ generation: Schema.String })), + )(yield* fs.readFileString(home.manifest(projectID))) + const yaml = yield* fs.readFileString(path.join(home.generations(projectID), manifest.generation, `${value.id}.yaml`)) + expect(yaml).toContain("schema_version: 1") + expect(yaml).toContain("metadata:") + expect(MemoryStore.decodeTopic(value, "wrong-file-id")).toBeUndefined() + expect(MemoryStore.decodeTopic({ ...value, extra: "not allowed" })).toBeUndefined() + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("moves the authoritative Topic set when Project identity changes", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + + yield* migration.migrateHome(projectID, otherProjectID) + + expect(yield* store.readTopics(otherProjectID)).toEqual([value]) + expect(yield* fs.exists(home.directory(projectID))).toBe(false) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live("merges non-conflicting Topic sets when the new identity already has Memory", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + const source = topic() + const target = terminologyTopic() + yield* replaceTopics(store, projectID, [source]) + yield* replaceTopics(store, otherProjectID, [target]) + + yield* migration.migrateHome(projectID, otherProjectID) + + expect(yield* store.readTopics(otherProjectID)).toEqual([source, target]) + expect(yield* fs.exists(home.directory(projectID))).toBe(false) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live("fails closed when either Memory Home contains an unreadable Topic", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + const target = terminologyTopic() + const invalid = path.join(home.topics(projectID), "broken.yaml") + yield* fs.makeDirectory(path.dirname(invalid), { recursive: true }) + yield* fs.writeFileString(invalid, "{ invalid") + yield* replaceTopics(store, otherProjectID, [target]) + + const exit = yield* Effect.exit(migration.migrateHome(projectID, otherProjectID)) + + expect(exit._tag).toBe("Failure") + expect(yield* fs.exists(invalid)).toBe(true) + expect(yield* store.readTopics(otherProjectID)).toEqual([target]) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live("preserves unknown Memory Home resources instead of deleting them during a merge", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + const source = topic() + const target = terminologyTopic() + const unknown = path.join(home.directory(projectID), "future-resource.json") + yield* replaceTopics(store, projectID, [source]) + yield* replaceTopics(store, otherProjectID, [target]) + yield* fs.writeFileString(unknown, "{}") + + const exit = yield* Effect.exit(migration.migrateHome(projectID, otherProjectID)) + + expect(exit._tag).toBe("Failure") + expect(yield* fs.exists(unknown)).toBe(true) + expect(yield* store.readTopics(otherProjectID)).toEqual([target]) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live("preserves both Memory Homes when the same Topic ID has different content", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + const source = topic("已确认的架构接口边界") + const target = topic("已确认的模块接口边界") + yield* replaceTopics(store, projectID, [source]) + yield* replaceTopics(store, otherProjectID, [target]) + + const exit = yield* Effect.exit(migration.migrateHome(projectID, otherProjectID)) + + expect(exit._tag).toBe("Failure") + expect(yield* store.readTopics(projectID)).toEqual([source]) + expect(yield* store.readTopics(otherProjectID)).toEqual([target]) + expect(yield* fs.exists(home.directory(projectID))).toBe(true) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live("imports, deduplicates, and preserves conflicting legacy Topics", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const admission = yield* MemoryAdmission.Service + const store = yield* MemoryStore.Service + const file = path.join(MemoryPaths.legacyTopics(sandbox), "project-architecture.yaml") + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, Bun.YAML.stringify(topic())) + + const imported = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [primary, sandbox], + updated: 1, + }) + expect(imported.diagnostics.map((item) => item.code)).toEqual(["topic.imported"]) + expect(yield* fs.exists(file)).toBe(false) + expect(yield* store.readTopics(projectID)).toEqual([topic()]) + expect(yield* fs.exists(home.manifest(projectID))).toBe(true) + + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, Bun.YAML.stringify(topic())) + const duplicate = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [sandbox], + updated: 2, + }) + expect(duplicate.diagnostics.map((item) => item.code)).toEqual(["topic.duplicate"]) + expect(yield* fs.exists(file)).toBe(false) + + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, Bun.YAML.stringify(topic("不同的已确认架构边界"))) + const conflict = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [sandbox], + updated: 3, + }) + expect(conflict.diagnostics.map((item) => item.code)).toEqual(["topic.conflict"]) + expect(conflict.unresolved).toBe(1) + expect(yield* fs.exists(file)).toBe(true) + expect(yield* store.readTopics(projectID)).toEqual([topic()]) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("serializes concurrent migration attempts by Project ID", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const first = yield* tmpdirScoped() + const second = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const store = yield* MemoryStore.Service + const firstFile = path.join(MemoryPaths.legacyTopics(first), "project-architecture.yaml") + const secondFile = path.join(MemoryPaths.legacyTopics(second), "project-architecture.yaml") + yield* fs.makeDirectory(path.dirname(firstFile), { recursive: true }) + yield* fs.makeDirectory(path.dirname(secondFile), { recursive: true }) + yield* fs.writeFileString(firstFile, Bun.YAML.stringify(topic("first"))) + yield* fs.writeFileString(secondFile, Bun.YAML.stringify(topic("second"))) + + const results = yield* Effect.all( + [ + admission.ensure({ projectID, projectDirectory: primary, directories: [first], updated: 1 }), + admission.ensure({ projectID, projectDirectory: primary, directories: [second], updated: 1 }), + ], + { concurrency: "unbounded" }, + ) + + expect(results.flatMap((result) => result.diagnostics.map((item) => item.code)).sort()).toEqual([ + "topic.conflict", + "topic.imported", + ]) + expect(yield* store.readTopics(projectID)).toHaveLength(1) + expect([yield* fs.exists(firstFile), yield* fs.exists(secondFile)].filter(Boolean)).toHaveLength(1) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("preserves concurrent updates from separate processes", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const coordination = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + const go = path.join(coordination, "go") + const workers = [ + { itemID: "decision-a", content: "已确认决定：保留并发更新甲" }, + { itemID: "decision-b", content: "已确认决定：保留并发更新乙" }, + ].map((worker) => { + const ready = path.join(coordination, `${worker.itemID}.ready`) + const child = Bun.spawn([ + process.execPath, + path.join(import.meta.dir, "../fixture/memory-store-worker.ts"), + JSON.stringify({ root, projectID, ready, go, ...worker }), + ]) + return { child, ready } + }) + while ( + !(yield* Effect.promise(() => + Promise.all(workers.map((worker) => Bun.file(worker.ready).exists())).then((ready) => ready.every(Boolean)), + )) + ) + yield* Effect.sleep("5 millis") + yield* Effect.promise(() => Bun.write(go, "go")) + + expect(yield* Effect.promise(() => Promise.all(workers.map((worker) => worker.child.exited)))).toEqual([0, 0]) + expect((yield* store.readTopics(projectID))[0]?.items.map((item) => item.id).sort()).toEqual([ + "decision-01", + "decision-a", + "decision-b", + ]) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("recovers the complete committed generation after Store restart", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const value = topic() + const committed = yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const initial = yield* store.readSnapshot(projectID) + expect(initial).toEqual({ revision: 0, topics: [] }) + return yield* store.updateTopics(projectID, () => ({ + applied: { topics: [value], changed: [value.id], deleted: [] }, + result: undefined, + })) + }).pipe(Effect.provide(layers(root))) + + const recovered = yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + return yield* store.readSnapshot(projectID) + }).pipe(Effect.provide(layers(root))) + + expect(committed.revision).toBe(1) + expect(recovered).toEqual({ revision: 1, topics: [value] }) + }), + ) + + it.live("rejects an invalid generation before publishing its manifest", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + const invalid = { ...value, summary: "目标状态不允许进入 Project Memory" } + + const exit = yield* Effect.exit( + store.updateTopics(projectID, () => ({ + applied: { topics: [invalid], changed: [invalid.id], deleted: [] }, + result: undefined, + })), + ) + + expect(exit._tag).toBe("Failure") + expect(yield* store.readSnapshot(projectID)).toEqual({ revision: 1, topics: [value] }) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("rejects a stale expected revision without replacing the committed generation", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const first = topic() + const stale = terminologyTopic() + + const committed = yield* store.commit(projectID, 0, { + topics: [first], + changed: [first.id], + deleted: [], + }) + const exit = yield* Effect.exit( + store.commit(projectID, 0, { + topics: [stale], + changed: [stale.id], + deleted: [], + }), + ) + + expect(committed).toEqual({ revision: 1, topics: [first] }) + expect(exit._tag).toBe("Failure") + expect(yield* store.readSnapshot(projectID)).toEqual(committed) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("keeps invalid Topics and conflicting sandbox config for repair", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const configStore = yield* MemoryConfig.Service + const admission = yield* MemoryAdmission.Service + const invalid = path.join(MemoryPaths.legacyTopics(sandbox), "broken.yaml") + const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") + yield* fs.makeDirectory(path.dirname(invalid), { recursive: true }) + yield* configStore.writeProject(primary, config) + yield* fs.writeFileString(invalid, "{ invalid") + yield* fs.writeFileString(sandboxConfig, JSON.stringify({ ...config, enabled: false })) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [primary, sandbox], + updated: 1, + }) + expect(result.diagnostics.map((item) => item.code)).toEqual(["topic.invalid", "config.conflict"]) + expect(result.unresolved).toBe(2) + expect(yield* fs.exists(invalid)).toBe(true) + expect(yield* fs.exists(sandboxConfig)).toBe(true) + + yield* fs.writeFileString(sandboxConfig, JSON.stringify(config)) + const duplicate = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [sandbox], + updated: 2, + }) + expect(duplicate.diagnostics.map((item) => item.code)).toEqual(["topic.invalid", "config.duplicate"]) + expect(yield* fs.exists(sandboxConfig)).toBe(false) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live("promotes a sandbox config even when it matches the global fallback", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + const global = yield* tmpdirScoped() + const previous = process.env.OPENCODE_CONFIG_DIR + + yield* Effect.acquireUseRelease( + Effect.sync(() => { + process.env.OPENCODE_CONFIG_DIR = global + }), + () => + Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") + yield* fs.writeFileString(path.join(global, "memory.jsonc"), JSON.stringify(config)) + yield* fs.makeDirectory(path.dirname(sandboxConfig), { recursive: true }) + yield* fs.writeFileString(sandboxConfig, JSON.stringify(config)) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [sandbox], + updated: 1, + }) + + expect(result.diagnostics.map((item) => item.code)).toEqual(["config.promoted"]) + expect(yield* fs.exists(sandboxConfig)).toBe(false) + expect((yield* (yield* MemoryConfig.Service).load(primary))?.level).toBe("project") + }).pipe(Effect.provide(layers(root))), + () => + Effect.sync(() => { + if (previous === undefined) delete process.env.OPENCODE_CONFIG_DIR + else process.env.OPENCODE_CONFIG_DIR = previous + }), + ) + }), + ) + + it.live("compares normalized project and sandbox configs", () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const configStore = yield* MemoryConfig.Service + const admission = yield* MemoryAdmission.Service + const value = { ...config, topic_limit: 50, topic_limit_floor: 10 } + const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") + yield* configStore.writeProject(primary, value) + yield* fs.makeDirectory(path.dirname(sandboxConfig), { recursive: true }) + yield* fs.writeFileString(sandboxConfig, JSON.stringify(value)) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [sandbox], + updated: 1, + }) + + expect(result.diagnostics.map((item) => item.code)).toEqual(["config.duplicate"]) + expect(yield* fs.exists(sandboxConfig)).toBe(false) + }).pipe(Effect.provide(layers(root))) + }), + ) +}) diff --git a/packages/opencode/test/memory/memory.test.ts b/packages/opencode/test/memory/memory.test.ts index 205a3d3fde..fb506cc2a8 100644 --- a/packages/opencode/test/memory/memory.test.ts +++ b/packages/opencode/test/memory/memory.test.ts @@ -6,7 +6,9 @@ import fs from "node:fs/promises" import path from "node:path" import { Config } from "@/config/config" import { Git } from "@/git" +import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" +import { MemoryLock } from "@/memory/lock" import { Memory } from "@/memory/memory" import { MemoryModel } from "@/memory/model" import { MemoryPrompts } from "@/memory/prompts" @@ -47,6 +49,13 @@ let writtenProjectConfig: MemorySchema.Config | undefined const emptyConfigLayer = Layer.mock(Config.Service, { get: () => Effect.succeed({}), }) +const readyAdmissionLayer = Layer.mock(MemoryAdmission.Service, { + ensure: () => + Effect.succeed(new MemoryAdmission.Result({ diagnostics: [], imported: 0, duplicates: 0, unresolved: 0 })), + invalidate: () => Effect.void, +}) +let loadedProjectDirectory: string | undefined +let migrationUnresolved = 0 function topic(id = "architecture-boundaries") { return { @@ -101,10 +110,13 @@ const unavailableModelIt = testEffect( }), Layer.mock(MemoryConfig.Service, { load: (directory) => - Effect.succeed({ - config: { ...config, enabled: false, model: "removed/model" }, - path: directory, - level: "project" as const, + Effect.sync(() => { + loadedProjectDirectory = directory + return { + config: { ...config, enabled: false, model: "removed/model" }, + path: directory, + level: "project" as const, + } }), loadGlobal: () => Effect.succeed({ @@ -122,12 +134,28 @@ const unavailableModelIt = testEffect( writtenProjectConfig = next }), }), + Layer.mock(MemoryAdmission.Service, { + ensure: () => + Effect.succeed( + new MemoryAdmission.Result({ + diagnostics: [], + imported: 0, + duplicates: 0, + unresolved: migrationUnresolved, + }), + ), + invalidate: () => Effect.void, + }), + MemoryLock.defaultLayer, Layer.mock(MemoryModel.Service, { generate: () => Effect.succeed({ model: "test/replacement", topic_limit: 10, turn_interval: 5 }), }), Layer.mock(MemoryStore.Service, { - ensureGitExclude: () => Effect.void, - writeTopics: () => Effect.void, + updateTopics: (_projectID, update) => + Effect.sync(() => { + const next = update([]) + return { revision: 1, topics: next.applied.topics, result: next.result } + }), }), ), ), @@ -237,10 +265,10 @@ function bootstrapFixture() { throw new Error("bootstrap must not call a model") }), }), + readyAdmissionLayer, + MemoryLock.defaultLayer, Layer.mock(MemoryStore.Service, { readTopics: () => Effect.succeed([]), - ensureGitExclude: () => Effect.void, - writeTopics: () => Effect.void, }), ), ), @@ -327,14 +355,20 @@ function recallFixture() { return { actions: [{ type: "no_change" }] } }), }), + readyAdmissionLayer, + MemoryLock.defaultLayer, Layer.mock(MemoryStore.Service, { readTopics: () => Effect.sync(() => { state.reads++ return state.topics }), - writeTopics: () => Effect.void, - ensureGitExclude: () => Effect.void, + updateTopics: (_projectID, update) => + Effect.sync(() => { + const next = update(state.topics) + state.topics = next.applied.topics + return { revision: 1, topics: state.topics, result: next.result } + }), }), ), ), @@ -456,54 +490,6 @@ describe("memory config and YAML store", () => { ) }), ) - - it.live("round-trips one fixed YAML document per topic and isolates worktrees", () => - Effect.gen(function* () { - const store = yield* MemoryStore.Service - const first = yield* tmpdirScoped({ git: true }) - const second = yield* tmpdirScoped() - const git = yield* Git.Service - yield* Effect.promise(() => fs.rm(second, { recursive: true, force: true })) - const added = yield* git.run(["worktree", "add", "-b", "memory-linked", second], { cwd: first }) - expect(added.exitCode).toBe(0) - const firstTopic = topic("first-worktree") - const secondTopic = topic("second-worktree") - - yield* store.writeTopics(first, { topics: [firstTopic], changed: [firstTopic.id], deleted: [] }) - yield* store.writeTopics(second, { - topics: [secondTopic], - changed: [secondTopic.id], - deleted: [], - }) - - expect(yield* store.readTopics(first)).toEqual([firstTopic]) - expect(yield* store.readTopics(second)).toEqual([secondTopic]) - expect(MemoryStore.topicsDir(first)).not.toBe(MemoryStore.topicsDir(second)) - - const yaml = yield* Effect.promise(() => - fs.readFile(path.join(MemoryStore.topicsDir(first), `${firstTopic.id}.yaml`), "utf-8"), - ) - expect(yaml).toContain("schema_version: 1") - expect(yaml).toContain("metadata:") - expect(yaml).toContain("items:") - expect(MemoryStore.decodeTopic(firstTopic, "wrong-file-id")).toBeUndefined() - expect(MemoryStore.decodeTopic({ ...firstTopic, extra: "not allowed" })).toBeUndefined() - expect( - MemoryStore.decodeTopic({ - ...firstTopic, - metadata: { ...firstTopic.metadata, item_count: 2 }, - }), - ).toBeUndefined() - - yield* Effect.promise(() => - fs.writeFile( - path.join(MemoryStore.topicsDir(first), "invalid-topic.yaml"), - "schema_version: 1\nid: invalid-topic\n", - ), - ) - expect(yield* store.readTopics(first)).toEqual([firstTopic]) - }), - ) }) describe("memory controller policy", () => { @@ -667,7 +653,7 @@ describe("memory controller policy", () => { apply("decision", "Confirmed decision: use stable boundaries", "User explicitly confirmed this durable decision"), ).not.toThrow() expect(() => - apply("term", "MEMORY means worktree-local durable preferences", "User explicitly confirmed this stable term"), + apply("term", "MEMORY means Project-owned durable preferences", "User explicitly confirmed this stable term"), ).not.toThrow() }) @@ -686,6 +672,7 @@ describe("memory controller policy", () => { expect(rendered).toHaveLength(1) expect(rendered[0]).toContain("first-topic") expect(rendered[0]).not.toContain("second-topic") + expect(rendered[0]).toContain("Project-owned historical data shared by this Project's worktrees") expect(rendered[0]).toContain("Current user input and higher-priority instructions always win") expect( [ @@ -1282,25 +1269,26 @@ describe("memory turn-scoped retrieval", () => { ) }) -describe("memory Git exclusions", () => { - it.live("installs exact local exclusions idempotently without touching .gitignore", () => +describe("memory project config Git exclusions", () => { + it.live("installs exact config exclusions idempotently without touching .gitignore", () => Effect.gen(function* () { const tmp = yield* tmpdirScoped({ git: true }) const git = yield* Git.Service - const store = yield* MemoryStore.Service + const configStore = yield* MemoryConfig.Service yield* Effect.promise(() => fs.writeFile(path.join(tmp, ".gitignore"), "keep-me\n")) - yield* store.ensureGitExclude(tmp) - yield* store.ensureGitExclude(tmp) + yield* configStore.writeProject(tmp, config) + yield* configStore.writeProject(tmp, config) const resolved = yield* git.run(["rev-parse", "--git-path", "info/exclude"], { cwd: tmp }) const raw = resolved.text().trim() const exclude = path.isAbsolute(raw) ? raw : path.resolve(tmp, raw) const lines = (yield* Effect.promise(() => fs.readFile(exclude, "utf-8"))).split(/\r?\n/) - for (const rule of [".opencode/memory.jsonc", ".opencode/memory.json", ".opencode/memory/"]) { + for (const rule of [".opencode/memory.jsonc", ".opencode/memory.json"]) { expect(lines.filter((line) => line === rule)).toHaveLength(1) } + expect(lines).not.toContain(".opencode/memory/") expect(yield* Effect.promise(() => fs.readFile(path.join(tmp, ".gitignore"), "utf-8"))).toBe("keep-me\n") }), ) @@ -1652,11 +1640,29 @@ describe("memory enablement", () => { Effect.gen(function* () { writtenGlobalConfig = undefined writtenProjectConfig = undefined + loadedProjectDirectory = undefined + migrationUnresolved = 0 const memory = yield* Memory.Service yield* memory.init() expect(writtenGlobalConfig).toMatchObject({ model: "test/replacement" }) expect(yield* memory.setEnabled(true)).toBe("Memory on") expect(writtenProjectConfig).toMatchObject({ enabled: true, model: "test/replacement" }) + expect(String(loadedProjectDirectory)).toBe("/unused") + }), + { git: true }, + ) + + unavailableModelIt.instance( + "keeps MEMORY inert until Project admission succeeds", + () => + Effect.gen(function* () { + loadedProjectDirectory = undefined + migrationUnresolved = 1 + const memory = yield* Memory.Service + + expect(yield* memory.context(SessionID.make("ses_memory_unresolved"))).toEqual([]) + expect(loadedProjectDirectory).toBeUndefined() + migrationUnresolved = 0 }), { git: true }, ) diff --git a/packages/opencode/test/project/project.test.ts b/packages/opencode/test/project/project.test.ts index 05e205cd87..8cea0b6426 100644 --- a/packages/opencode/test/project/project.test.ts +++ b/packages/opencode/test/project/project.test.ts @@ -21,8 +21,13 @@ import { AppProcess } from "@opencode-ai/core/process" import { ProjectV2 } from "@opencode-ai/core/project" import { ProjectDirectories } from "@opencode-ai/core/project/directories" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { testEffect } from "../lib/effect" import { RuntimeFlags } from "@/effect/runtime-flags" +import { MemoryHome } from "@/memory/home" +import { MemoryIdentityMigration } from "@/memory/identity-migration" +import { MemoryStore } from "@/memory/store" +import { ProjectIdentityMigration } from "@/project/identity-migration" const encoder = new TextEncoder() @@ -79,6 +84,7 @@ function projectLayerWithFailure(failArg: string) { Layer.provide(NodePath.layer), Layer.provide(Database.defaultLayer), Layer.provide(RuntimeFlags.defaultLayer), + Layer.provide(ProjectIdentityMigration.defaultLayer), ) } @@ -92,9 +98,40 @@ function projectLayerWithRuntimeFlags(flags: Parameters testEffect(Layer.mergeAll(projectLayerWithFailure(failArg), CrossSpawnSpawner.defaultLayer)) @@ -241,6 +278,112 @@ describe("Project.fromDirectory", () => { ).toBe(remoteID) }), ) + + it.live("migrates Project Memory before retiring the previous Project identity", () => + Effect.gen(function* () { + const dataRoot = yield* tmpdirScoped() + const tmp = yield* tmpdirScoped({ git: true }) + yield* Effect.gen(function* () { + const home = yield* MemoryHome.Service + const projects = yield* Project.Service + const store = yield* MemoryStore.Service + const rootProject = (yield* projects.fromDirectory(tmp)).project + const value = { + schema_version: 1, + id: "project-term", + name: "项目术语", + summary: "术语 Project Memory 指项目级持久化记忆", + metadata: { + categories: ["term"], + status: "active", + importance: "core", + keywords: ["Project Memory"], + related_topics: [], + created_at: "2026-08-11T00:00:00Z", + updated_at: "2026-08-11T00:00:00Z", + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "term-01", + kind: "term", + content: "术语 Project Memory 指项目级持久化记忆", + rationale: "该术语由用户确认并长期适用", + confirmed_at: "2026-08-11T00:00:00Z", + }, + ], + } as const + yield* store.commit(rootProject.id, 0, { topics: [value], changed: [value.id], deleted: [] }) + yield* Effect.promise(() => $`git remote add origin git@github.com:acme/memory-app.git`.cwd(tmp).quiet()) + + const migrated = yield* projects.fromDirectory(tmp) + + expect(yield* store.readTopics(migrated.project.id)).toEqual([value]) + expect(yield* Effect.promise(() => Bun.file(home.directory(rootProject.id)).exists())).toBe(false) + }).pipe(Effect.provide(projectLayerWithMemoryRoot(dataRoot))) + }), + ) + + it.live("keeps the previous Project identity when Memory migration conflicts", () => + Effect.gen(function* () { + const dataRoot = yield* tmpdirScoped() + const tmp = yield* tmpdirScoped({ git: true }) + yield* Effect.gen(function* () { + const { db } = yield* Database.Service + const projects = yield* Project.Service + const store = yield* MemoryStore.Service + const rootProject = (yield* projects.fromDirectory(tmp)).project + const remoteID = remoteProjectID("github.com/acme/conflicting-memory") + const base = { + schema_version: 1, + id: "project-term", + name: "项目术语", + summary: "术语 Project Memory 指项目级持久化记忆", + metadata: { + categories: ["term"], + status: "active", + importance: "core", + keywords: ["Project Memory"], + related_topics: [], + created_at: "2026-08-11T00:00:00Z", + updated_at: "2026-08-11T00:00:00Z", + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "term-01", + kind: "term", + content: "术语 Project Memory 指项目级持久化记忆", + rationale: "该术语由用户确认并长期适用", + confirmed_at: "2026-08-11T00:00:00Z", + }, + ], + } as const + const conflicting = { ...base, summary: "术语 Project Memory 指共享的持久化记忆" } + yield* store.commit(rootProject.id, 0, { topics: [base], changed: [base.id], deleted: [] }) + yield* store.commit(remoteID, 0, { topics: [conflicting], changed: [conflicting.id], deleted: [] }) + yield* Effect.promise(() => + $`git remote add origin git@github.com:acme/conflicting-memory.git`.cwd(tmp).quiet(), + ) + + const exit = yield* Effect.exit(projects.fromDirectory(tmp)) + + expect(exit._tag).toBe("Failure") + expect( + yield* db.select().from(ProjectTable).where(eq(ProjectTable.id, rootProject.id)).get().pipe(Effect.orDie), + ).toBeDefined() + expect(yield* db.select().from(ProjectTable).where(eq(ProjectTable.id, remoteID)).get().pipe(Effect.orDie)).toBeUndefined() + expect(yield* store.readTopics(rootProject.id)).toEqual([base]) + expect(yield* store.readTopics(remoteID)).toEqual([conflicting]) + }).pipe(Effect.provide(projectLayerWithMemoryRoot(dataRoot))) + }), + ) }) describe("Project.fromDirectory git failure paths", () => { diff --git a/packages/opencode/test/project/worktree-remove.test.ts b/packages/opencode/test/project/worktree-remove.test.ts index c717578024..e4e99f78b5 100644 --- a/packages/opencode/test/project/worktree-remove.test.ts +++ b/packages/opencode/test/project/worktree-remove.test.ts @@ -5,10 +5,11 @@ import path from "path" import { Effect, Layer } from "effect" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { Worktree } from "../../src/worktree" +import { Project } from "../../src/project/project" import { TestInstance } from "../fixture/fixture" import { testEffect } from "../lib/effect" -const it = testEffect(Layer.mergeAll(Worktree.defaultLayer, CrossSpawnSpawner.defaultLayer)) +const it = testEffect(Layer.mergeAll(Worktree.defaultLayer, Project.defaultLayer, CrossSpawnSpawner.defaultLayer)) const wintest = process.platform === "win32" ? it.instance : it.instance.skip describe("Worktree.remove", () => { @@ -17,6 +18,7 @@ describe("Worktree.remove", () => { () => Effect.gen(function* () { const root = (yield* TestInstance).directory + const project = yield* Project.Service const svc = yield* Worktree.Service const name = `remove-regression-${Date.now().toString(36)}` const branch = `opencode/${name}` @@ -24,6 +26,8 @@ describe("Worktree.remove", () => { yield* Effect.promise(() => $`git worktree add --no-checkout -b ${branch} ${dir}`.cwd(root).quiet()) yield* Effect.promise(() => $`git reset --hard`.cwd(dir).quiet()) + const current = yield* project.fromDirectory(root) + yield* project.addSandbox(current.project.id, dir) const real = (yield* Effect.promise(() => $`which git`.quiet().text())).trim() expect(real).toBeTruthy() diff --git a/packages/opencode/test/project/worktree.test.ts b/packages/opencode/test/project/worktree.test.ts index 1b30ade88c..20bc6b000c 100644 --- a/packages/opencode/test/project/worktree.test.ts +++ b/packages/opencode/test/project/worktree.test.ts @@ -6,17 +6,28 @@ import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { AppProcess } from "@opencode-ai/core/process" import { NodePath } from "@effect/platform-node" import { Cause, Context, Deferred, Effect, Exit, Fiber, Layer, Ref } from "effect" +import { Global } from "@opencode-ai/core/global" import { GlobalBus, type GlobalEvent } from "../../src/bus/global" import { Git } from "../../src/git" import { SettingsHook } from "../../src/hook/settings" import { InstanceLayer } from "../../src/project/instance-layer" +import { InstanceState } from "../../src/effect/instance-state" +import { MemoryHome } from "../../src/memory/home" +import { MemoryStore } from "../../src/memory/store" import { Project } from "../../src/project/project" import { Worktree } from "../../src/worktree" import { disposeAllInstances, provideInstance, TestInstance } from "../fixture/fixture" import { pollWithTimeout, testEffect } from "../lib/effect" const it = testEffect( - Layer.mergeAll(Worktree.defaultLayer, FSUtil.defaultLayer, CrossSpawnSpawner.defaultLayer, Git.defaultLayer), + Layer.mergeAll( + Worktree.defaultLayer, + Project.defaultLayer, + FSUtil.defaultLayer, + CrossSpawnSpawner.defaultLayer, + Git.defaultLayer, + MemoryStore.defaultLayer, + ), ) const wintest = process.platform !== "win32" ? it.instance : it.instance.skip @@ -181,9 +192,12 @@ function makeStartCommandProbe(directory: string, name: string) { const removeCreatedWorktree = (directory: string) => Effect.gen(function* () { - const svc = yield* Worktree.Service - const ok = yield* svc.remove({ directory }) - if (!ok) return yield* Effect.fail(new Error(`failed to remove worktree ${directory}`)) + const fs = yield* FSUtil.Service + if (yield* fs.exists(directory).pipe(Effect.orDie)) { + const svc = yield* Worktree.Service + const ok = yield* svc.remove({ directory }) + if (!ok) yield* Effect.fail(new Error(`failed to remove worktree ${directory}`)) + } }) const withCreatedWorktree = ( @@ -330,6 +344,58 @@ describe("Worktree", () => { { git: true }, ) + it.instance( + "refuses to remove a worktree while project memory would be destroyed", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const fs = yield* FSUtil.Service + const svc = yield* Worktree.Service + const memory = path.join(info.directory, ".opencode", "memory", "topics", "project.yaml") + yield* fs.makeDirectory(path.dirname(memory), { recursive: true }) + yield* fs.writeFileString(memory, "id: project\n") + + const exit = yield* svc.remove({ directory: info.directory }).pipe(Effect.exit) + const preserved = yield* fs.exists(memory).pipe(Effect.orDie) + + // Let the fixture's release remove the worktree after the assertion + // signal has been captured. + yield* fs.remove(path.join(info.directory, ".opencode"), { recursive: true }).pipe(Effect.ignore) + + expect(Exit.isFailure(exit)).toBe(true) + if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain("topic.invalid") + expect(preserved).toBe(true) + }), + ), + { git: true }, + ) + + it.instance( + "migrates valid legacy memory before removing a worktree", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const ctx = yield* InstanceState.context + const fs = yield* FSUtil.Service + const project = yield* Project.Service + const store = yield* MemoryStore.Service + const svc = yield* Worktree.Service + const home = MemoryHome.make(Global.Path.data) + const projectHome = home.directory(ctx.project.id) + const legacy = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") + yield* Effect.addFinalizer(() => fs.remove(projectHome, { recursive: true }).pipe(Effect.ignore)) + yield* fs.makeDirectory(path.dirname(legacy), { recursive: true }) + yield* fs.writeFileString(legacy, Bun.YAML.stringify(memoryTopic())) + + expect(yield* svc.remove({ directory: info.directory })).toBe(true) + expect(yield* fs.exists(info.directory).pipe(Effect.orDie)).toBe(false) + expect((yield* store.readTopics(ctx.project.id))[0]?.id).toBe("project-architecture") + expect((yield* project.get(ctx.project.id))?.sandboxes).not.toContain(info.directory) + }), + ), + { git: true }, + ) + it.instance( "create returns after setup and fires Event.Ready after bootstrap", () => @@ -462,13 +528,120 @@ describe("Worktree", () => { expect((yield* probe.overlap.pipe(Effect.timeoutOption("250 millis")))._tag).toBe("None") yield* probe.release expect(yield* Fiber.join(first)).toBe(true) - expect(yield* Fiber.join(second)).toBe(true) + const repeated = yield* Fiber.await(second) + expect(Exit.isFailure(repeated)).toBe(true) }), { git: true }, { timeout: 20_000 }, ) }) + describe("reset", () => { + it.instance( + "migrates project memory before removing other untracked files", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const fs = yield* FSUtil.Service + const ctx = yield* InstanceState.context + const svc = yield* Worktree.Service + const store = yield* MemoryStore.Service + const home = MemoryHome.make(Global.Path.data) + const projectHome = home.directory(ctx.project.id) + const topic = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") + const disposable = path.join(info.directory, ".opencode", "disposable.tmp") + yield* Effect.addFinalizer(() => fs.remove(projectHome, { recursive: true }).pipe(Effect.ignore)) + yield* fs.makeDirectory(path.dirname(topic), { recursive: true }) + yield* fs.writeFileString(topic, Bun.YAML.stringify(memoryTopic())) + yield* fs.writeFileString(disposable, "remove me\n") + + yield* svc.reset({ directory: info.directory }) + + const topicPreserved = (yield* store.readTopics(ctx.project.id)).length === 1 + const legacyPreserved = yield* fs.exists(topic).pipe(Effect.orDie) + const disposablePreserved = yield* fs.exists(disposable).pipe(Effect.orDie) + + expect(topicPreserved).toBe(true) + expect(legacyPreserved).toBe(false) + expect(disposablePreserved).toBe(false) + }), + ), + { git: true }, + ) + + it.instance( + "migrates modified tracked legacy memory before hard reset", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const ctx = yield* InstanceState.context + const fs = yield* FSUtil.Service + const svc = yield* Worktree.Service + const store = yield* MemoryStore.Service + const home = MemoryHome.make(Global.Path.data) + const projectHome = home.directory(ctx.project.id) + const legacy = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") + yield* Effect.addFinalizer(() => fs.remove(projectHome, { recursive: true }).pipe(Effect.ignore)) + yield* fs.makeDirectory(path.dirname(legacy), { recursive: true }) + yield* fs.writeFileString(legacy, Bun.YAML.stringify(memoryTopic("committed"))) + yield* git(info.directory, ["add", ".opencode/memory/topics/project-architecture.yaml"]) + yield* git(info.directory, ["commit", "-m", "test: add legacy memory"]) + yield* fs.writeFileString(legacy, Bun.YAML.stringify(memoryTopic("modified before reset"))) + + yield* svc.reset({ directory: info.directory }) + + expect((yield* store.readTopics(ctx.project.id))[0]?.summary).toBe("modified before reset") + }), + ), + { git: true }, + ) + + it.instance( + "rejects reset of the primary or current worktree", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const test = yield* TestInstance + const svc = yield* Worktree.Service + const primary = yield* svc.reset({ directory: test.directory }).pipe(Effect.exit) + const current = yield* svc + .reset({ directory: info.directory }) + .pipe(provideInstance(info.directory), Effect.exit) + + expect(Exit.isFailure(primary)).toBe(true) + expect(Exit.isFailure(current)).toBe(true) + if (Exit.isFailure(primary)) expect(Cause.pretty(primary.cause)).toContain("primary or current") + if (Exit.isFailure(current)) expect(Cause.pretty(current.cause)).toContain("primary or current") + }), + ), + { git: true }, + ) + + it.instance( + "rejects reset of an unregistered git worktree", + () => + Effect.gen(function* () { + const test = yield* TestInstance + const svc = yield* Worktree.Service + const target = path.join(path.dirname(test.directory), `unregistered-reset-${Date.now()}`) + const branch = `unregistered-reset-${Date.now()}` + yield* git(test.directory, ["worktree", "add", "-b", branch, target]) + yield* Effect.addFinalizer(() => + gitResult(test.directory, ["worktree", "remove", "--force", target]).pipe( + Effect.andThen(gitResult(test.directory, ["branch", "-D", branch])), + Effect.ignore, + ), + ) + + const exit = yield* svc.reset({ directory: target }).pipe(Effect.exit) + + expect(Exit.isFailure(exit)).toBe(true) + if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain("not registered") + }), + { git: true }, + ) + }) + describe("createFromInfo", () => { wintest( "creates git worktree and boots asynchronously", @@ -499,6 +672,8 @@ describe("Worktree", () => { Effect.gen(function* () { const test = yield* TestInstance const fs = yield* FSUtil.Service + const ctx = yield* InstanceState.context + const project = yield* Project.Service const svc = yield* Worktree.Service const parent = path.join(path.dirname(test.directory), `${path.basename(test.directory)}-parent`) const target = path.join(parent, path.basename(test.directory)) @@ -506,6 +681,7 @@ describe("Worktree", () => { yield* fs.ensureDir(parent) yield* git(test.directory, ["worktree", "add", "-b", branch, target]) + yield* project.addSandbox(ctx.project.id, target) const list = yield* svc.list() const directory = yield* fs.realPath(target).pipe(Effect.catch(() => Effect.succeed(target))) @@ -520,17 +696,51 @@ describe("Worktree", () => { }), { git: true }, ) + + it.instance( + "prunes missing worktrees and removes their Project registration", + () => + withCreatedWorktree(undefined, ({ info }) => + Effect.gen(function* () { + const ctx = yield* InstanceState.context + const fs = yield* FSUtil.Service + const project = yield* Project.Service + const svc = yield* Worktree.Service + yield* fs.remove(info.directory, { recursive: true }) + + expect((yield* svc.list()).map((item) => item.directory)).not.toContain(info.directory) + expect(yield* git(ctx.worktree, ["worktree", "list", "--porcelain"])).not.toContain(info.directory) + expect((yield* project.get(ctx.project.id))?.sandboxes).not.toContain(info.directory) + }), + ), + { git: true }, + ) }) describe("remove edge cases", () => { it.instance( - "remove non-existent directory succeeds silently", + "rejects a directory that is not a registered worktree", () => Effect.gen(function* () { const test = yield* TestInstance const svc = yield* Worktree.Service - const ok = yield* svc.remove({ directory: path.join(test.directory, "does-not-exist") }) - expect(ok).toBe(true) + const exit = yield* svc.remove({ directory: path.join(test.directory, "does-not-exist") }).pipe(Effect.exit) + expect(Exit.isFailure(exit)).toBe(true) + if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain("not registered") + }), + { git: true }, + ) + + it.instance( + "rejects removal of the primary or current worktree", + () => + Effect.gen(function* () { + const test = yield* TestInstance + const svc = yield* Worktree.Service + const exit = yield* svc.remove({ directory: test.directory }).pipe(Effect.exit) + + expect(Exit.isFailure(exit)).toBe(true) + if (Exit.isFailure(exit)) expect(Cause.pretty(exit.cause)).toContain("primary or current") }), { git: true }, ) @@ -551,3 +761,34 @@ describe("Worktree", () => { ) }) }) + +function memoryTopic(summary = "已确认的核心架构边界") { + return { + schema_version: 1, + id: "project-architecture", + name: "架构边界", + summary, + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: "2026-08-11T00:00:00Z", + updated_at: "2026-08-11T00:00:00Z", + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "decision-01", + kind: "decision", + content: "已确认决定：核心模块之间使用稳定边界", + rationale: "该边界由用户确认并长期适用", + confirmed_at: "2026-08-11T00:00:00Z", + }, + ], + } +} From 2494b45eaa0fdb9833f13b5703a3c0717883aa09 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 09:13:50 +0800 Subject: [PATCH 04/34] docs(memory): add ProjectMemoryAuthority redo plan from d7b011738 Phased reconstruction of the lost ProjectMemoryAuthority redesign on top of the d7b011738 process-safe baseline. 8 phases (P1-P8), each a commit. P1=identity+atomic store API, P6=fromDirectory cutover (1C), P7=crash harness (1A). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 123 ++++++++++++++++++ 1 file changed, 123 insertions(+) create mode 100644 docs/memory-authority-redo-plan-2026-08-12.md diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md new file mode 100644 index 0000000000..13bac859fb --- /dev/null +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -0,0 +1,123 @@ +# Memory Authority Redo Plan — from `d7b011738` + +Date: 2026-08-12. Worktree: `/private/tmp/oc-dag-wt-lifecycle` (branch `chore/worktree-lifecycle-audit`). +Status: PLANNING (awaiting user confirmation before any implementation/loop). + +## 0. Why this plan exists + +The prior ProjectMemoryAuthority redesign (~20 untracked files: `authority-*.ts`, `destruction-guard.ts`, `project/identity.ts`, `project/reference-adapter.ts`, ADR-0004, CONTEXT update, ~4 authority test files, crash-harness fixtures) plus the 1A keystone/harness fixes lived **only as uncommitted working-tree state** in a `/private/tmp` worktree. `/private/tmp` was cleaned; `git fsck` found no dangling objects and the branch was never pushed, so that work is **gone**. Recoverable: the committed baseline `d7b011738` ("fix(opencode): make project memory process safe") — the Iteration-1 process-safe memory foundation. This plan reconstructs the lost redesign **faithfully** (from the approved ADR-0004 / CONTEXT / redesign-decision spec, retained in design memory) on top of that baseline, phased so each stage is independently committable. + +## 1. Baseline at `d7b011738` (surveyed — what exists, all tests GREEN) + +**Modules** (`packages/opencode/src/memory/`): +- `home.ts` MemoryHome — paths only: `directory/topics/manifest/generations` + shared `locks` dir. No policy/retirements/aliases paths yet. +- `store.ts` MemoryStore — generation+manifest persistence. **Topics are versioned** (revision int, named generation, atomic temp→rename→manifest). **Policy is NOT in the Home** — it lives in worktree/global `.opencode/memory.jsonc|json` via MemoryConfig, no generation/revision/CAS. `commit(expectedRevision)` CAS exists but is **unused in src/**; `updateTopics` (hides revision bump) is the live writer. Strict `inspectTopics` vs lenient `readTopics`. +- `lock.ts` MemoryLock — **in-process `KeyedMutex` only**, surface is just `withProject(projectID)`. NO canonical/Held/FenceClosed. (Controller-only; 4 sites in `memory.ts`.) +- `admission.ts` MemoryAdmission — the legacy-input seam: `ensure`/`invalidate`, caches only conflict-free results, nests `memory-admission:` → `memory-project:` flock. +- `identity-migration.ts` MemoryIdentityMigration — **only `migrateHome(oldID,newID)`** (no prepareHome/migrateIdentity). Fast-path `fs.rename(source,target)`; merge-path merge-then-`fs.remove(source)`. **Both DELETE source.** Typed `ConflictError`/`InvalidHomeError` exist. +- `config.ts` MemoryConfig, `paths.ts`, `file.ts` (atomicWrite), `schema.ts`, `model.ts`, `prompts.ts`. + +**Two lock systems (non-overlapping):** MemoryLock (in-process KeyedMutex) vs `EffectFlock` (`core/util/effect-flock.ts`, cross-process mkdir-dir locks, `STALE_MS=60s`, heartbeat ~20s, breaker stale-takeover, witness = Scope lifetime). + +**Project identity upgrade** (`project/project.ts:217-314` `fromDirectory`; `migrateProjectId` `:148-197`): resolve → `identityMigration.migrate(old,new)` (FIRST durable; **`.orDie` collapses typed errors to defects**) → DB txn (copy Project row; `delete ProjectDirectory`; repoint `Session`+`Workspace` FK; `delete ProjectTable old`) → upsert new Project row → Session global→new → saveProjectDirectory → `emitUpdated` (in-memory) → `projectV2.commit` (writes `/opencode` cache, LAST durable). + +**5 Project-owned FK tables** (`ON DELETE CASCADE`): `session`✅repointed, `workspace`✅repointed, `project_directory`(deleted+reinserted), `workflow`❌**cascade-lost**, `permission`❌**cascade-lost**. ⇒ every root→remote upgrade today silently destroys all DAG workflows + saved permissions. + +**Worktree** reset/remove call only `memoryAdmission.invalidate`→`ensure` (gated by serviceOption), pure-FS `hasUnresolvedLegacyMemory` fallback; errors stringified into `Remove/ResetFailedError`. + +**3 tests encode "source Home deleted"** (`memory-persistence:166,194`; `project.test:325`) — backed by the single `fs.remove(source)` at `identity-migration.ts` tail. 4 tests encode "preserve on failure" (must stay green). `MemoryLock.withProject` is untested. + +## 2. The gap (what the redo must build) — Gap IDs + +| Gap | Baseline failure | Redo delivers | +|---|---|---| +| `MEM-ID-01` | ID change migrates Memory + only 3/5 FK; old ID can re-fork; source Home destroyed | One `retireIdentity` migrates Memory + **all 5** FK atomically; source Home **preserved** (non-authoritative); old ID routes to successor | +| `MEM-LOCK-02` | In-process lock only; migration `old→new` flock nesting not proven vs reverse; no canonical recheck | Cross-process sorted flock order (no ABBA); routine = one canonical project flock + recheck | +| `MEM-CRASH-06` | Migration crash (rename/remove mid-flight) unrecovered; no journal | Forward-only journal `Requested→TargetPrepared→IdentityPublished→ReferencesRetired→CleanupPending`; crash = forward recovery from durable evidence | +| `MEM-REF-07` | `workflow`+`permission` cascade-lost | `ProjectReferenceAdapter` migrates **all** FK in one immediate txn; new FK ⇒ contract test fails | +| `MEM-BOOT-09` | (mostly closed) Memory admission needs durable Project row | fail-closed `ProjectUnavailable` when no durable row | +| `MEM-ATOMIC-10` | Topics versioned, Policy not — half-commit window | Topics+Policy share **one generation + one manifest + one opaque revision** | +| `MEM-ID-AUTO-11` (1C) | `fromDirectory` uses legacy `.orDie` migrateHome bypass | `fromDirectory` → `authority.retireIdentity`, typed errors, retirement before successor upsert/cache commit/return | +| `MEM-ADMIT-03`/`RET-04` | Worktree reset/remove trusts process-local admission cache | `ProjectMemoryDestructionGuard` sealed intent; no-cache rescan of primary+all worktrees | + +## 3. Reconstructed design (the authority spec — faithful to ADR-0004) + +**Public seam** (application callers see ONLY this): +```ts +interface ProjectMemoryAuthority { + readMemory(projectID): Effect + changeMemory(revision, changes: NonEmpty): Effect + retireIdentity(request: IdentityRetirement): Effect +} +``` +- `Revision` opaque, one-shot, caller-unforgeable, binds canonical identity + Topics revision + Policy fingerprint + topology + admission fingerprint. +- `readMemory` performs runtime admission internally (no `admit→read` composition). +- `changeMemory` accepts data `Change`s (`replace_topics|mark_matched|set_policy`), not Effect callbacks. +- `retireIdentity` is the **only** identity-migration entry. + +**Atomic Topics+Policy**: extend `MemoryStore` with `readAuthoritySnapshotInFence`/`commitAuthorityInFence`/`writeAuthoritySnapshotInFence` — `writeSnapshot` writes `policy.jsonc` **into the same generation dir** as topic YAML; manifest rename is the single publish point; strict topic read tolerates the co-tenant `policy.jsonc`. + +**ProjectIdentity** (`project/identity.ts`): `canonical(id)` (resolve alias chain, cycle→error), `revision`, `recordAlias(old,new)` (immutable tombstone, rejects retarget/retired-successor/cycle). Alias file is a DB-external durable ledger. + +**IdentityLedgerAdapter** (`authority-journal.ts` + `authority-journal-store.ts`): journal keyed by `request_id`, unique `source_id` per in-flight; `save` rejects rebind + regression; phase enum `Requested→TargetPrepared→IdentityPublished→ReferencesRetired→CleanupPending→Completed`. + +**Retirement merge rules** (`authority-retirement-rules.ts`): empty/empty→empty gen; non-empty/empty→copy source; empty/non-empty→keep successor; both→deterministic union (Topics by id, Policy unique, `revision=max+1`); same-id-differing-content / Policy-differ / corrupt → `RetirementBlocked` zero-change. + +**ProjectMemoryAuthorityLock** (`authority-lock.ts`): wraps EffectFlock. `canonical(id,use)`: resolve→lock one `memory-project:`→recheck→retry-on-change. `retirement(source,successor,use)`: `sorted({source,successor})` project flocks. No dynamic extension; rolling-upgrade-compatible key order. + +**ProjectReferenceAdapter** (`project/reference-adapter.ts`): dynamically enumerate all `project_id` FK tables; migrate source→successor in ONE `immediate` txn; contract test fails if a new FK table appears. + +**ProjectMemoryDestructionGuard** (`destruction-guard.ts`): sealed durable intent `{request_id,requested_project,identity_revision,normalized_target,action,topology_fingerprint,candidate_fingerprint}`; execute/reconcile always join/recover retirement → re-resolve → no-cache rescan primary+all worktrees → publish valid candidates → one fixed action adapter; ambiguous postcondition = fail-closed. + +**Lock order**: retirement reads ledger unlocked → `sorted(source,successor)` project flocks → identity-ledger flock → revalidate. Routine: join/recover touched retirement → resolve → one project flock → resolve → retry. (Recovery before routine project lock; routine never project→ledger.) + +**Crash semantics**: commit point = immutable tombstone. Pre-tombstone: source authoritative. Post-tombstone: successor authoritative, old revision invalid. Each public command first joins/recovers touched journals. Source Home preserved; cleanup is retryable, `CleanupPending` allowed. + +**Layer wiring (BOTH systems)**: `defaultLayer` self-provides all sub-services (mirror `memory/memory.ts:581-603`); `.node` re-lists them; register in `app-runtime.ts` AppLayer **and** `server/routes/instance/httpapi/server.ts:210-287` app group (else HTTP path silently no-ops). + +## 4. Phased redo — each phase is one commit on the branch + +Order is dependency-driven; each phase has a Green proof + a mutation gate. + +- **P1 — Foundation: ProjectIdentity + atomic Topics+Policy store API.** + Files: `project/identity.ts`; extend `memory/store.ts` (authority snapshot read/commit/write, `policy.jsonc` co-tenant strict-read), `memory/home.ts` (add `policy`/`retirements`/`aliases` paths). + Green: new unit tests for identity canonical/alias + atomic Topics+Policy commit/read (crash-injection Red: no topics-new/policy-old). Mutation: revert `policy.jsonc` co-tenant allow ⇒ provenance Red. + +- **P2 — Authority skeleton + Lock + Repository.** + Files: `memory/authority.ts` (seam + typed errors + Revision), `authority-lock.ts`, `authority-repository.ts` (inspect/inspectIfDurable/inspectHome via authority store API), `authority-live.ts` (readMemory/changeMemory). + Green: repository+lock unit tests; CAS revision invalidation on Topics/Policy change. Mutation: changeMemory without atomic commit ⇒ half-commit Red. + +- **P3 — Retirement journal + rules + process (state machine).** + Files: `authority-journal.ts`, `authority-journal-store.ts`, `authority-retirement-rules.ts`, `authority-retirement.ts` (retireLocked: observe→prepare→publish→references→cleanup). + Green: monotonic phase transition; merge-rule table; idempotent same-request; same-source→other-successor = conflict; reverse/retarget/independent-project rejected zero-change. + +- **P4 — Reference adapter (all 5 FK).** + Files: `project/reference-adapter.ts`. + Green: migrate all 5 FK in one txn; source=0/target-no-dup post-migrate; **add a 6th temp FK in a test ⇒ contract test fails** (MEM-REF-07 mutation). + +- **P5 — Wire authority into both Layer systems.** + Files: `authority-live.ts` aggregator defaultLayer+node; `app-runtime.ts`; `server.ts` app group; add `.node` to consumers that need it. + Green: integration test that authority reaches the HTTP path (not just that layers build). Mutation: drop from server app group ⇒ HTTP no-op Red. + +- **P6 — `Project.fromDirectory` cutover + typed-error boundaries (this is "1C", `MEM-ID-AUTO-11`).** + Files: `project/project.ts` (replace `migrateProjectId`→`authority.retireIdentity`, retirement BEFORE successor upsert + cache commit + return; stable internal request identity); delete legacy `project/identity-migration.ts` application seam; `project/instance-store.ts` (thread retirement typed errors through Deferred); `server/routes/instance/httpapi/handlers/project.ts` (map `Failure|AdmissionConflict|RetirementConflict` at HTTP boundary); flip the 3 "source Home deleted" assertions → preserved. + Green: real `fromDirectory` root→remote produces durable journal ≥ CleanupPending; cache not switched before authority success; metadata conflict ⇒ stable typed error, zero side-write; retry = same request identity monotonic; defaultLayer + LayerNode both use authority; source Home exists but non-authoritative. Mutation gates (5): drop the call / move cache-commit early / randomize request identity / `orDie` the typed error / split fixture instances. + +- **P7 — Crash harness + forward-recovery + reverse-retirement (this is "1A", `MEM-CRASH-06`/`MEM-LOCK-02`).** + Files: `test/fixture/project-memory-authority-{launcher,worker,bunfig}.ts`, `test/memory/project-memory-authority.test.ts`, `memory-authority-journal/rules.test.ts`. + Green: harness contract (launcher-ready→go→worker-ready→phase-stopped→SIGKILL, file-per-state, self-stop inside worker, reclaim stale 60s flock after kill); per-phase crash→new-process recovery; reverse retirement no-ABBA (both exit ≤10s, exactly one success/one structured failure, full stdout/stderr captured). + +- **P8 — Destruction guard + worktree migration + remove parallel authorities (1B/1D scope).** + Files: `memory/destruction-guard.ts`; `worktree/index.ts` reset/remove → guard (drop direct `MemoryAdmission.ensure/invalidate`); downgrade `MemoryLock` public Service + `MemoryAdmission`/`MemoryIdentityMigration` to internal adapters; final `rg` bypass audit + call graph. + +## 5. Verification & discipline (every phase) +- From package dir only: `cd packages/opencode && bun test …`; `bun typecheck`; `packages/core && bun typecheck`; repo-root `git diff --check`. +- Real SQLite, real tmpdirs, real git worktrees, real subprocesses; no fixed-sleep timing; no deleted assertions / no `.skip`/`.todo` to go green. +- Each phase = one conventional commit (`feat(memory): …`) on the branch (mitigates /tmp loss). +- Introduced P1/P2 per phase must close before the phase commits. + +## 6. Open items for the user (decide before loop) +1. Confirm the 8-phase structure + that P6 = "1C" and P7 = "1A" (the original iteration labels). +2. Loop cadence/scope: drive P1→P8 in order (one phase per fire), commit each, pause after P6 (1C) for review as the original 1C task required — or different? +3. The 3 "source Home deleted" assertion flips (P6) and the source-preserve semantics are a product decision restated in ADR-0004 — confirm acceptable to re-apply. +4. Should P1 also recreate ADR-0004 + the CONTEXT authority-glossary update (lost) as the design-of-record before code? From baf8598966f9cc0239861cd0c6705d20524715a2 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 09:19:53 +0800 Subject: [PATCH 05/34] docs(memory): fold plan-review findings; add P0 spec phase + resume protocol Adversarial review (5 critics, ultracode) found the lost ADR-0004 is unrecoverable, so 'faithful reconstruction' is unverifiable. Add blocking product decisions D1-D4 (Policy-in-Home vs ADR-0001, source-Home preserve retention, retirement-as-merge/lineage, new journal/Revision/ChangeMemory surface) requiring user sign-off, a mandatory P0 (recreate ADR-0004 + CONTEXT for approval before P1), technical revisions (P4 before P3, FK per-table rules, mutation-gate fixes, ledger locations, phase enum), and a resume protocol for fresh sessions. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 44 +++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 13bac859fb..eedebf54b6 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -121,3 +121,47 @@ Order is dependency-driven; each phase has a Green proof + a mutation gate. 2. Loop cadence/scope: drive P1→P8 in order (one phase per fire), commit each, pause after P6 (1C) for review as the original 1C task required — or different? 3. The 3 "source Home deleted" assertion flips (P6) and the source-preserve semantics are a product decision restated in ADR-0004 — confirm acceptable to re-apply. 4. Should P1 also recreate ADR-0004 + the CONTEXT authority-glossary update (lost) as the design-of-record before code? + +--- + +## 7. Plan-review findings (ultracode adversarial workflow, 5 critics, 2026-08-12) — REVISES §3–§6 + +The adversarial review surfaced **blocking issues**. Per the task rule "spec-gap 必须暂停并记录所需产品决策", P1 does NOT start until §7.A is resolved + P0 is approved. + +### 7.A. BLOCKING product decisions (need user sign-off — these are NEW surface, not verifiable reconstruction) +The lost ADR-0004 is **unrecoverable** (repo's only ADR-0004 is an unrelated DAG lock-timeout ADR; `git fsck` empty; nothing pushed). "Reconstruct from design memory" is indistinguishable from "invent." The following core decisions are genuinely the user's: + +- **D1 — Policy source-of-truth (P1).** Moving Policy into the per-project Home generation as versioned/CAS'd **reverses ADR-0001's live decision** ("Project configuration is resolved from the Project's primary directory so it remains user-editable without creating sandbox-specific policy"). Decide: (a) Policy-in-Home + supersede ADR-0001 (controller-owned, atomic, not user-editable in place), or (b) keep Policy in `.opencode/memory.jsonc` (user-editable, NOT versioned/CAS'd) and P1 collapses to Topics-only atomicity. **Also**: how is GLOBAL Policy represented (it spans projects; no per-project Home)? +- **D2 — Source-Home preserve + retention (P3/P6/P7).** "Source Home preserved, non-authoritative" introduces a NEW class of non-authoritative artifact; ADR-0001/0002 require a "separate Project Memory retention policy" BEFORE any such artifact may exist. Decide: (a) define the retention/GC policy for retired-identity Homes in the recreated ADR-0004, or (b) revert to baseline migrate-then-remove (source deleted) — then the 3 "source Home deleted" assertions stay and P6/P7 preserve-assertions drop. +- **D3 — Retirement-as-merge / alias-lineage (P3).** "Old ID routes to successor" + immutable `recordAlias` tombstone + `canonical()` alias-chain + deterministic-union merge of two Projects' Memory+identity+FK is, in substance, the two **explicitly-forbidden** decisions (Project Merge, ProjectLineageID) relabeled. Decide: (a) approve a lineage/merge system with the exact merge rules + alias permanence, or (b) collapse to migrate-and-retire with conflict-fail-closed (closer to ADR-0001). +- **D4 — New public surface to confirm** (not in any recoverable spec): (i) the 6-phase forward-only journal machine `Requested→TargetPrepared→IdentityPublished→ReferencesRetired→CleanupPending→Completed` (ADR-0002 only states a single ordering invariant); (ii) the opaque Revision fingerprint composition ("canonical identity + Topics revision + Policy fingerprint + topology fingerprint + admission fingerprint" — topology/admission fingerprints are undefined); (iii) the `changeMemory` data-Change algebra (`replace_topics|mark_matched|set_policy`) replacing the baseline callback `updateTopics`. + +**⇒ NEW PHASE P0 (mandatory, before P1):** Recreate `packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md` + the CONTEXT authority-glossary update **as a written, committed design-of-record** that resolves D1–D4 explicitly. P0 Green = the user reviews + approves the recreated ADR-0004 line-by-line. No subsequent phase may claim a "faithful" Green until P0 is approved. (This demotes old open-item #4 from optional to blocking precondition.) + +### 7.B. Technical revisions (from completeness/phase-ordering/mutation/baseline critics) +- **Reorder: P4 before P3** (or inject `migrateReferences`/`cleanup` as Effect seams in P3, wired in P6). retireLocked's ReferencesRetired→CleanupPending transitions cannot call a ProjectReferenceAdapter that doesn't exist yet. +- **P4 per-table FK migration rules (MEM-REF-07):** `session`,`workspace` → `UPDATE project_id`; `permission` → has `uniqueIndex(project_id,action,resource)` (permission/sql.ts:19) ⇒ DELETE source rows whose `(action,resource)` already exists on successor, then UPDATE the rest (else SQLITE_CONSTRAINT_UNIQUE); `project_directory` → composite `primaryKey(project_id,directory)` ⇒ delete+reinsert preserving `type` (and `strategy`), with a test where successor already has an overlapping directory; `workflow` → `UPDATE project_id`. Add a P4 contract test: a 6th temp `project_id` FK table ⇒ test fails (MEM-REF-07 mutation). +- **P6 file scope:** add `test/project/project.test.ts` (imports `ProjectIdentityMigration` at :30; layer helpers at :87,:101,:119) and `test/memory/memory-persistence.test.ts` to scope, else P6 won't compile (module deleted) / won't be coherent. **P6 flips only `project.test:325`** (the fromDirectory path); the two direct-`migrateHome` assertions (`memory-persistence:166,:194`) are reachable only via `memory/identity-migration.ts` (downgraded in P8) — either leave them asserting `deleted` until P8, or rewrite those two cases to drive `authority.retireIdentity`. +- **Mutation gates (fix mismatches + gaps):** + - P1 needs TWO: read-side (`revert policy.jsonc co-tenant allow ⇒ strict-read Red`) AND write-side (`publish policy via a separate rename outside the manifest ⇒ crash-injection topics-new/policy-old Red`). + - P2: relabel to `changeMemory that doesn't bump revision on set_policy ⇒ stale-revision Red`, AND add a **changeMemory-level** crash-injection test (store-API atomicity alone doesn't prove the caller uses it atomically). + - P6 `orDie` gate only works if the conflict test asserts the error **type** (`Effect.catchTag("RetirementConflict")` / `Cause._tag==="Fail"` + schema `_tag`), NOT `Exit._tag==="Failure"` (baseline project.test:375-377 uses the weak form — copying it = a tautology gate). + - P3 mutation: `allow phase regression ⇒ monotonic-transition Red; rebind source_id ⇒ same-source-conflict Red`. + - P7 mutation: `drop sorted() lock order ⇒ reverse-retirement ABBA (both >10s) Red; skip joinRecovery on cold start ⇒ crash-recovery Red`. + - P6 `split fixture instances` is ambiguous — replace with `fromDirectory resolves MemoryHome/ledger from Global.Path.data instead of the wired Service ⇒ durable-journal-preserved Red`. +- **P8 add Green+Mutation:** `worktree reset/remove with a sibling's new legacy-memory input fails closed via guard (no source Home touched); ambiguous topology ⇒ fail-closed; no-cache rescan observes input added after invalidate. Mutation: re-trust process-local admission cache ⇒ wrong-destroy Red.` +- **inspectHome allow-list** (`identity-migration.ts:43-54`, invoked at :69-70): only accepts `topics/generations/manifest.json`. Once Homes carry `policy.jsonc` (+ ledger paths), any migrateHome MERGE over a modern Home fail-closes with `InvalidHomeError`. P1 must either extend the allow-list or mark inspectHome dead post-P6. +- **Pin ledger locations (global, not per-project):** journal at `home.retirements/.json`, aliases at `home.aliases` (= `/memory/project-aliases.json`), destructions at `home.destructions/...` — all GLOBAL under `/memory/`, reachable from any (retired) id. Add a test that a fresh process finds the journal/alias after source Home is non-authoritative. +- **Phase enum canonical = 6 phases** (add `Completed` terminal); reconcile §2 Gap table (5) with §3 (6) — use 6 everywhere. Clarify `CleanupPending` is a retryable-resting state; `Completed` reached only after cleanup (not required this redo since source-Home cleanup is deferred/excluded). +- **Path precision:** AppLayer is at `packages/opencode/src/effect/app-runtime.ts` (alias `@/effect/app-runtime`), `Memory.defaultLayer` at :87 — insert the Authority aggregator's defaultLayer there alongside it. +- **MEM-BOOT-09:** assign to P2 — `authority-live.readMemory` yields a typed `Failure` (ProjectUnavailable) when no durable ProjectV2 row; + test injecting a missing row. (Or cite exact baseline file:line that already fails closed.) + +### 7.C. Revised phase order +**P0** (spec, user-approved) → **P1** (identity + atomic store API) → **P2** (authority skeleton + lock + repository; MEM-BOOT-09) → **P4** (reference adapter, all 5 FK) → **P3** (retirement journal + rules + state machine, using P4's adapter or injected seams) → **P5** (dual Layer wiring) → **P6** (fromDirectory cutover = 1C) → **P7** (crash harness = 1A) → **P8** (destruction guard + worktree + remove parallel authorities). + +## 8. Resume protocol for a fresh session (read FIRST) +1. `cd /private/tmp/oc-dag-wt-lifecycle` (branch `chore/worktree-lifecycle-audit`). If missing, `git worktree add` it from the branch (it lives in /tmp and may be cleaned — each phase commits, so history is safe). +2. `git log --oneline -8` to see which phases are committed; read this plan doc fully (esp. §7). +3. If **P0 not approved yet**: recreate ADR-0004 + CONTEXT resolving §7.A D1–D4, present to user, **PAUSE**. Do not start P1. +4. Else advance the next un-committed phase (§7.C order). Per phase: re-read exact baseline → implement → `cd packages/opencode && bun typecheck` → targeted tests (package dir only) → mutation gate → `git commit` → update this doc's phase status. +5. Exclusions: no Goal/DAG/DAG-config/CI, no push/PR/dev→main, no source-Home GC. Tests never from repo root. From 16f1e1be9faf0124bb4bc3af9a18a6a5ede2c05a Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 09:45:55 +0800 Subject: [PATCH 06/34] docs(memory): recreate ADR-0004 + CONTEXT authority glossary (P0 proposed) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P0 design-of-record for the ProjectMemoryAuthority redo, reconstructing the lost ADR-0004 (uncommitted WIP, /tmp-cleaned). Resolves the §7.A product decisions D1-D4 and encodes the user principles confirmed 2026-08-12: one shared Memory per Project (worktrees share it, no per-worktree memory), Memory never forks, and identity upgrade is imperceptible. Status: Proposed (P0 gate) — P1 is blocked until the user approves this ADR. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 14 ++++ packages/opencode/src/memory/CONTEXT.md | 35 ++++++++-- .../docs/adr/0004-project-memory-authority.md | 70 +++++++++++++++++++ 3 files changed, 112 insertions(+), 7 deletions(-) create mode 100644 packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index eedebf54b6..3461b3e4ad 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -165,3 +165,17 @@ The lost ADR-0004 is **unrecoverable** (repo's only ADR-0004 is an unrelated DAG 3. If **P0 not approved yet**: recreate ADR-0004 + CONTEXT resolving §7.A D1–D4, present to user, **PAUSE**. Do not start P1. 4. Else advance the next un-committed phase (§7.C order). Per phase: re-read exact baseline → implement → `cd packages/opencode && bun typecheck` → targeted tests (package dir only) → mutation gate → `git commit` → update this doc's phase status. 5. Exclusions: no Goal/DAG/DAG-config/CI, no push/PR/dev→main, no source-Home GC. Tests never from repo root. + +## 9. Phase status (living tracker) + +| Phase | Status | Commit | Notes | +|---|---|---|---| +| P0 — recreate ADR-0004 + CONTEXT | **Proposed (awaiting user approval)** | (this commit) | ADR-0004 + CONTEXT.md written; resolves D1–D4; encodes user principles (shared/no-fork/imperceptible). User must approve before P1. | +| P1 — identity + atomic store API | pending | — | blocked on P0 approval | +| P2 — authority skeleton + lock + repository (MEM-BOOT-09) | pending | — | | +| P4 — reference adapter (all 5 FK) | pending | — | reorder before P3 | +| P3 — retirement journal + rules + state machine | pending | — | uses P4 adapter (or injected seams) | +| P5 — dual Layer wiring | pending | — | effect/app-runtime.ts + server.ts app group | +| P6 — fromDirectory cutover (1C, MEM-ID-AUTO-11) | pending | — | + project.test.ts/memory-persistence.test.ts scope; Spec/Standards review + pause | +| P7 — crash harness (1A, MEM-CRASH-06/LOCK-02) | pending | — | | +| P8 — destruction guard + worktree + remove parallel authorities | pending | — | + Green/mutation per §7.B | diff --git a/packages/opencode/src/memory/CONTEXT.md b/packages/opencode/src/memory/CONTEXT.md index 8a112602e4..3b104992a2 100644 --- a/packages/opencode/src/memory/CONTEXT.md +++ b/packages/opencode/src/memory/CONTEXT.md @@ -2,6 +2,12 @@ Project Memory preserves user-confirmed, durable human context for one Project. It is not a code index, task tracker, instruction source, or general model-writable store. +## User principles (confirmed 2026-08-12) + +- **One shared Memory per Project.** Worktrees hold no Memory of their own; they all share the Project's single Memory. +- **Memory never forks.** Memory is core, topic-typed content; worktrees (small PRs) must not branch it into per-worktree copies. +- **An identity upgrade is imperceptible.** When a repo gains its first remote (root → first-remote identity), the user's Memory endures seamlessly — nothing the user notices is lost, moved, or forked. + ## Glossary | Term | Meaning | @@ -11,30 +17,45 @@ Project Memory preserves user-confirmed, durable human context for one Project. | Topic | A bounded structured collection of confirmed preferences, decisions, or terms with controller-owned metadata. | | Legacy Worktree Memory | Memory files stored inside a checkout by an older runtime. They are migration inputs, never a second authoritative store. | | Memory Conflict | A case where legacy and Project Memory claim the same logical identity with different valid content, or where legacy configuration differs from the Project configuration. | -| Project Configuration | The user-editable MEMORY policy owned by the Project and shared by its worktrees. | +| Project Configuration | The MEMORY policy owned by the Project and shared by its worktrees. Under ADR-0004 it lives in the Memory Home, atomically versioned with Topics; worktree/global config files are admission candidates only. | | Memory Admission | The single legacy input seam that scans one Project snapshot, reconciles it once, and caches only conflict-free results. | +| Identity Alias | A durable old→new Project identity tombstone owned by `ProjectIdentity`. Every Memory read and mutation resolves it before choosing a Home or lock. | +| Requested Project ID | A Project ID held by a caller. It may already be retired and therefore is not an ownership key. | +| Canonical Project ID | The current terminal Project ID that owns Project Memory. Resolved inside the Project Memory authority and not supplied by callers. | +| Identity Retirement | A forward-only replacement of one Project ID by its successor while preserving one logical Project and all Project-owned state — merge into one Memory, not a fork. | +| Project Merge | A product operation that combines two independently owned Projects. Identity Retirement never performs an implicit Project Merge. | +| Project Memory Revision | An opaque version of one Project Memory snapshot, including Topics, Project Configuration, topology, and admission inputs. | ## Invariants - One Project identity has one authoritative Project Memory. -- Two worktrees of the same Project cannot form independent Memory namespaces. +- Two worktrees of the same Project cannot form independent Memory namespaces; Memory never forks per worktree. - Current user input and higher-priority instructions always override retrieved Memory. - The controller owns persistence, metadata, migration, limits, and atomicity; models only propose bounded semantic actions. -- Migration writes a durable authoritative copy before removing a legacy copy. +- Migration writes a durable authoritative copy before treating a legacy copy as consumed. - A Memory Conflict is explicit and fail-closed; no component silently chooses or overwrites conflicting durable context. - Removing or resetting a worktree cannot imply deleting Project Memory. - Removing Project Memory requires a separate Project retention decision. -- Runtime reads never perform ad-hoc legacy migration; they consume a Project snapshot admitted by `MemoryAdmission.ensure`. +- Runtime reads never perform ad-hoc legacy migration; they consume a Project snapshot admitted by the Project Memory authority. +- Project identity retirement validates the full transition before durable state changes, prepares the successor while preserving the source, publishes one identity commit point (the tombstone), and completes Project-owned reference migration by forward recovery. +- Routine Project Memory commands resolve identity, acquire one canonical Project commit right, and recheck identity before reading or writing. +- A missing Memory Home is empty; an existing corrupt Home is an error and is never projected as an empty Topic set. +- Project configuration and Topic mutations publish under one generation, one manifest, and one opaque Revision, in the same cross-process Project lock. +- Application callers never receive canonical IDs, Home paths, locks, cache keys, or migration callbacks. +- A revision issued before Identity Retirement cannot commit after the identity commit point. +- Destructive Memory Admission always observes current candidate files; it never trusts a process-local success cache. +- The retired source Home is preserved as a non-authoritative backup; its GC is a separate, deferred decision. ## Boundaries -- Project identity and registered worktrees come from the Project context. -- Worktree lifecycle invalidates and reruns Memory admission before destructive operations, but it does not own Project Memory retention. +- The Project Memory authority obtains identity, the primary checkout, and every registered worktree from durable Project state; callers provide only a requested Project ID. +- Worktree lifecycle requests destructive admission as one command through the internal destruction guard; it does not invalidate caches, assemble snapshots, or own Project Memory retention. - Session runtime may retrieve and attach bounded Memory context, but it does not own Topic persistence. - Codebase discovery belongs to codebase-memory facilities and is rejected from Project Memory. ## Decisions -- [ADR-0001: Project identity owns Memory](docs/adr/0001-project-owned-memory.md) +- [ADR-0001: Project identity owns Memory](docs/adr/0001-project-owned-memory.md) *(Policy-source clause superseded by ADR-0004)* - [ADR-0002: Project Memory commits are versioned and process-safe](docs/adr/0002-project-memory-commit-protocol.md) - [ADR-0003: Legacy Memory enters through Project admission](docs/adr/0003-memory-admission.md) +- [ADR-0004: Project Memory authority owns identity and commits](docs/adr/0004-project-memory-authority.md) — **Proposed (P0, awaiting approval)** diff --git a/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md new file mode 100644 index 0000000000..99d7c64b6d --- /dev/null +++ b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md @@ -0,0 +1,70 @@ +# ADR-0004: Project Memory authority owns identity and commits + +- Status: **Proposed** (awaiting user approval — P0 gate) +- Date: 2026-08-12 +- Supersedes: the Policy-source clause of [ADR-0001](./0001-project-owned-memory.md) and the lock/commit framing of [ADR-0002](./0002-project-memory-commit-protocol.md); adds Identity Retirement. Reconstructs the lost authority redesign (uncommitted WIP, /tmp-cleaned) from design memory, now written down so it is auditable. + +## Context + +Project identity resolution, cross-process locking, Memory Home selection, Project configuration, legacy admission, and Project ID retirement were composed by several public services (Store, Config, Admission, the controller, Migration). Three complete reviews found the same failure class in different call orders: a caller could resolve before locking, invalidate the wrong identity, move a Home before an alias preflight, or carry inherited "lock held" state beyond the real flock lifetime. Pushing more canonical IDs / paths / callbacks / lock state between those services would keep the persistence protocol in application callers. + +User product principles confirmed 2026-08-12 (governs this ADR): +1. **One shared Memory per Project.** Worktrees have no Memory of their own; they all share the Project's single Memory. +2. **Memory never forks.** Memory is core, topic-typed content; worktrees are small PRs and must not branch Memory into per-worktree copies. +3. **An identity upgrade is imperceptible.** When a repo gains its first remote (root-commit identity → first-remote identity), the user's Memory endures seamlessly — nothing the user notices is lost, moved, or forked. + +These reaffirm the baseline direction (ADR-0001/0002: Memory is the Project-owned, identity-keyed, worktree-external shared store) and raise the bar: the upgrade must be correct and seamless, not just "eventually consistent." + +## Decision + +One `ProjectMemoryAuthority` owns the application seam. Callers express three domain operations: read Memory, change Memory via an opaque revision, and retire a Project identity. Runtime admission is part of `readMemory` (no compose-your-own `admit → read`). Callers never receive canonical IDs, Home paths, lock capabilities, cache invalidation, or migration callbacks. + +```ts +interface ProjectMemoryAuthority { + readMemory(projectID): Effect + changeMemory(revision, changes: NonEmpty): Effect + retireIdentity(request: IdentityRetirement): Effect +} +``` + +- `Revision` is opaque, one-shot, caller-unforgeable, binding canonical identity + Topics revision + Policy fingerprint + Project topology fingerprint + admission-input fingerprint. **D4.** +- `Change = replace_topics | mark_matched | set_policy` — data, not Effect callbacks. **D4.** +- `retireIdentity` is the **only** identity-migration entry point. + +### Routine operations +Resolve the requested Project ID → acquire **one** canonical Project commit right → resolve again → retry if retirement changed the identity. Model work happens outside the commit right; a later change uses revision comparison rather than holding a lock across provider execution. A revision issued before Identity Retirement is rejected after the identity commit point. + +### Identity Retirement (forward-only; "merge into one", not a fork, not a Project Merge) +Validate source + successor before mutation → prepare a complete successor while **retaining** the source → publish **one** immutable identity tombstone (the commit point) → migrate every Project-owned database reference → treat source cleanup as retryable completion. State machine: `Requested → TargetPrepared → IdentityPublished → ReferencesRetired → CleanupPending → Completed`. **D4.** It rejects a successor that is itself retired or belongs to an independent Project. **It is Identity Retirement, not the explicitly-deferred Project Merge**: exactly one logical Project's old identity converges into its new identity, preserving one Memory (no fork). Distinct from combining two independently-owned Projects. + +### Internal transaction witness (not exported) +Runtime lifetime fence (`open → closing → closed`); never exposes persistence paths. Even an escaped fiber cannot use it after close; an operation that has entered is completed before the OS flock releases. Effect Context is **not** proof that an OS lock remains held. + +### Locking +- Routine: `join/recover touched retirement → resolve requested ID → one canonical Project flock → resolve again → retry on change`. Never extends a held set; never reaches the identity-ledger lock. +- Retirement: read ledger unlocked to derive expected keys → acquire the **complete sorted** `({source,successor})` Project flock set → acquire the identity-ledger flock → revalidate. Order preserves the rolling-upgrade key order used by supported older processes (no ABBA). Recovery completes before any routine Project lock; routine never goes Project → ledger. + +### Atomic Topics + Policy + revision (**D1**) +Project Memory Topics, Project configuration (Policy), topology, and admission inputs contribute to **one** opaque `Revision`. **Policy lives in the Memory Home** generation (`policy.jsonc` co-tenant with topic YAML); the Home generation is the single atomic publish point (temp-dir → rename → manifest). Worktree `.opencode/memory.jsonc|.json` and the global config are **admission candidates only**, not authorities. *(Supersedes ADR-0001's "Policy resolved from the primary directory so it stays user-editable": under this ADR the controller owns Policy, atomically versioned with Topics. Global config remains a fallback candidate admitted when no Home Policy exists.)* Reads are pure; normalization never writes. + +### Worktree lifecycle (integration via an internal guard) +Worktree reset/remove remain the Worktree authority's operations, integrated through an internal, non-exported `ProjectMemoryDestructionGuard` whose sealed durable intent binds `{request_id, requested_project, identity_revision, normalized_target, action, topology_fingerprint, candidate_fingerprint}`. Every execution/recovery first joins Identity Retirement and re-resolves the requested Project; an identity-revision change rebases the intent and rescans before publication. The guard publishes valid candidates into the authoritative generation before invoking the one fixed action adapter, so action failure leaves only safe legacy duplicates. Destructive admission **never** trusts a process-local success cache — it rescans the Project primary + every registered worktree each time. + +### Automatic Identity Retirement +Limited to **verifiable first identity convergence**: source = the observed repository's root commit; the repo-local cache names it `previous`; current resolution selects the successor from the remote identity; every existing successor directory re-resolves to that successor (different physical stores allowed — one remote Project may have several clones). A remote X→Y change, contradictory observation, or unavailable evidence **fails closed** and does not become an implicit Project Merge. + +### Crash semantics +Commit point = the immutable tombstone. Pre-tombstone: source authoritative. Post-tombstone: successor authoritative, old revisions invalid; recovery rebuilds target from the latest two-sided state if either side changed after `TargetPrepared`. Each public command first joins/recovers touched journals. Source Home is preserved (non-authoritative) and is never read as an authority after the tombstone. + +## Decisions D1–D4 (resolved) +- **D1 — Policy in Home generation**, atomic with Topics, one Revision; worktree/global config = admission candidates. *(Supersedes ADR-0001's primary-directory Policy.)* +- **D2 — Source Home preserved**, non-authoritative; old ID routes to successor via alias. GC/retention is **excluded** this round; retired Homes remain as backups indefinitely. *(ADR-0001/0002's retention precondition is satisfied by "retain indefinitely; GC deferred" — no non-authoritative artifact is ever silently collected.)* +- **D3 — Identity Retirement approved**: old ID retires into successor; immutable alias tombstone + canonical chain + deterministic-union into ONE Memory (no fork). Distinct from the forbidden Project Merge. +- **D4 — Surface confirmed**: 6-phase forward-only journal; opaque Revision fingerprint (identity + Topics revision + Policy + topology + admission); `changeMemory` Change algebra. + +## Consequences +- `MemoryLock` (public), alias mutation, manual admission invalidation, project-directory configuration writes, and callback-shaped identity migration are **removed from application callers**; they survive only as authority-private adapters. +- Crashes across filesystem and SQLite are recovered by **advancing** the recorded retirement state; no cross-store rollback is promised. +- The source Home may temporarily remain after identity publication; it is non-authoritative and cannot be recreated through the retired ID. +- An immutable `ProjectLineageID` could remove identity movement entirely but needs a new product identity, schema backfill, rolling-upgrade protocol, and explicit Project Merge semantics — **deferred** to a separate proposal. +- Per AGENTS §7 review: the legacy `inspectHome` allow-list (`memory/identity-migration.ts:43-54`) must either be extended to the new Home contents (policy.jsonc) or the legacy path is retired when the P6 cutover lands — it must not fail-closed on a modern Home. From 5704eeabd79118ea416218ace2c680b0b9c437a3 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 10:03:27 +0800 Subject: [PATCH 07/34] fix(project): repoint workflow+permission FK on identity upgrade (Occam Fix #1) migrateProjectId deleted the old ProjectTable row, which ON DELETE CASCADE silently destroyed every DAG workflow and every saved permission whenever a repo gained its first remote (root -> first-remote identity upgrade). Repoint both project_id FKs inside the existing immediate transaction before the old row is deleted. A (newID, action, resource) collision on permission fails the transaction closed (no data loss). Extended 'migrates cached root project data when origin becomes available' to seed a workflow + permission and assert both survive the upgrade. Mutation gate: removing the repointing flips the test Red (rows cascade-deleted). Co-Authored-By: Claude --- packages/opencode/src/project/project.ts | 14 +++++++++ .../opencode/test/project/project.test.ts | 31 +++++++++++++++++++ 2 files changed, 45 insertions(+) diff --git a/packages/opencode/src/project/project.ts b/packages/opencode/src/project/project.ts index 44e7013a3c..f2ee5ee496 100644 --- a/packages/opencode/src/project/project.ts +++ b/packages/opencode/src/project/project.ts @@ -5,6 +5,8 @@ import { ProjectDirectoryTable, ProjectTable } from "@opencode-ai/core/project/s import { ProjectDirectories } from "@opencode-ai/core/project/directories" import { SessionTable } from "@opencode-ai/core/session/sql" import { WorkspaceTable } from "@opencode-ai/core/control-plane/workspace.sql" +import { WorkflowTable } from "@opencode-ai/core/dag/sql" +import { PermissionTable } from "@opencode-ai/core/permission/sql" import { Flag } from "@opencode-ai/core/flag/flag" import { GlobalBus } from "@/bus/global" import { which } from "@opencode-ai/core/util/which" @@ -189,6 +191,18 @@ export const layer = Layer.effect( .where(eq(WorkspaceTable.project_id, oldID)) .run() + // Repoint the Project-owned references that the old row's deletion would otherwise + // cascade-destroy. Both workflow and permission carry ON DELETE CASCADE on project_id, + // so without this repointing, gaining a first remote would silently delete every DAG + // workflow and every saved permission for the project. A (newID, action, resource) + // collision on permission fails the immediate transaction closed (no data loss). + yield* d.update(WorkflowTable).set({ project_id: newID }).where(eq(WorkflowTable.project_id, oldID)).run() + yield* d + .update(PermissionTable) + .set({ project_id: newID }) + .where(eq(PermissionTable.project_id, oldID)) + .run() + if (oldProject) yield* d.delete(ProjectTable).where(eq(ProjectTable.id, oldID)).run() }), { behavior: "immediate" }, diff --git a/packages/opencode/test/project/project.test.ts b/packages/opencode/test/project/project.test.ts index 8cea0b6426..f0a8956e8d 100644 --- a/packages/opencode/test/project/project.test.ts +++ b/packages/opencode/test/project/project.test.ts @@ -9,6 +9,8 @@ import { Database } from "@opencode-ai/core/database/database" import { ProjectTable } from "@opencode-ai/core/project/sql" import { SessionTable } from "@opencode-ai/core/session/sql" import { WorkspaceTable } from "@opencode-ai/core/control-plane/workspace.sql" +import { WorkflowTable } from "@opencode-ai/core/dag/sql" +import { PermissionTable } from "@opencode-ai/core/permission/sql" import { eq } from "drizzle-orm" import { Hash } from "@opencode-ai/core/util/hash" import { SessionID } from "@/session/schema" @@ -260,6 +262,27 @@ describe("Project.fromDirectory", () => { .values({ id: workspaceID, type: "local", name: "test", project_id: rootProject.id }) .run() .pipe(Effect.orDie) + // A DAG workflow and a saved permission belong to the root identity. Both are + // ON DELETE CASCADE on project_id, so they must be repointed (not lost) on upgrade. + yield* db + .insert(WorkflowTable) + .values({ + id: "dag-app", + project_id: rootProject.id, + session_id: sessionID, + title: "App workflow", + status: "running", + config: "{}", + seq: 1, + wake_reported: false, + }) + .run() + .pipe(Effect.orDie) + yield* db + .insert(PermissionTable) + .values({ id: "perm-app" as never, project_id: rootProject.id, action: "allow", resource: "test" }) + .run() + .pipe(Effect.orDie) yield* Effect.promise(() => $`git remote add origin git@github.com:acme/app.git`.cwd(tmp).quiet()) const result = yield* projects.fromDirectory(tmp) @@ -276,6 +299,14 @@ describe("Project.fromDirectory", () => { (yield* db.select().from(WorkspaceTable).where(eq(WorkspaceTable.id, workspaceID)).get().pipe(Effect.orDie)) ?.project_id, ).toBe(remoteID) + expect( + (yield* db.select().from(WorkflowTable).where(eq(WorkflowTable.id, "dag-app")).get().pipe(Effect.orDie)) + ?.project_id, + ).toBe(remoteID) + expect( + (yield* db.select().from(PermissionTable).where(eq(PermissionTable.id, "perm-app" as never)).get().pipe(Effect.orDie)) + ?.project_id, + ).toBe(remoteID) }), ) From 4b1898994c47abc37648def866c96f1e8efa19b3 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 10:05:13 +0800 Subject: [PATCH 08/34] =?UTF-8?q?docs(memory):=20adopt=20Occam=20minimal?= =?UTF-8?q?=20path=20(=C2=A710);=20reject=20elaborate=20ADR-0004=20redesig?= =?UTF-8?q?n?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit User applied Occam's Razor: the 8-phase ProjectMemoryAuthority redesign is over-engineered for the real needs (shared/no-fork memory already in baseline; imperceptible upgrade + no data loss via small in-place fixes). ADR-0004 → Rejected. Plan §10 = 4 targeted fixes; Fix #1 already done. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 17 +++++++++++++++++ .../docs/adr/0004-project-memory-authority.md | 2 +- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 3461b3e4ad..9dfc18edea 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -179,3 +179,20 @@ The lost ADR-0004 is **unrecoverable** (repo's only ADR-0004 is an unrelated DAG | P6 — fromDirectory cutover (1C, MEM-ID-AUTO-11) | pending | — | + project.test.ts/memory-persistence.test.ts scope; Spec/Standards review + pause | | P7 — crash harness (1A, MEM-CRASH-06/LOCK-02) | pending | — | | | P8 — destruction guard + worktree + remove parallel authorities | pending | — | + Green/mutation per §7.B | + +> **§4/§7.C/§9 (the elaborate 8-phase redesign) are SUPERSEDED by §10 below.** Kept for history. + +## 10. Occam minimal path (ADOPTED 2026-08-12 — the actual work) + +After the survey + ultracode adversarial review, the user applied Occam's Razor ("一切从简"): the elaborate ProjectMemoryAuthority / retirement journal / alias tombstone / opaque Revision / destruction guard / 8-phase plan is over-engineered for the real needs. Confirmed user principles: **one shared Memory per Project (worktrees share it, hold none of their own); Memory never forks; identity upgrade is imperceptible; no data loss.** Shared + no-fork are already satisfied by the baseline d7b011738 (Home follows identity). So the work collapses to small in-place fixes on the existing seams. **ADR-0004 is Rejected.** + +| Fix | Gap | Status | Commit | +|---|---|---|---| +| **#1** Repoint `workflow`+`permission` FK on identity upgrade (was `ON DELETE CASCADE` silent data loss) | MEM-REF-07 | ✅ done (mutation-proven) | `ec6972b22` | +| **#2** Remove `.orDie` on the migration seam (`memory/identity-migration.ts` via `project/identity-migration.ts:19`); propagate `ConflictError`/`InvalidHomeError` as typed errors to the instance-store Deferred + HTTP project handler boundary | typed-error invariant (#5) | pending | — | +| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | pending | — | +| **#4** Destructive admission (worktree reset/remove) **force-rescans**, never trusts the process-local admission cache | MEM-ADMIT-03 / RET-04 | pending | — | + +**Explicitly cut by Occam** (do NOT build): MEM-ATOMIC-10 (Policy stays in `.opencode/memory.jsonc`; memory is topic content); the authority facade, 6-phase journal, alias tombstone, opaque Revision, destruction guard, crash harness; MEM-CRASH-06 as a forward-journal state machine (POSIX `rename` + the store's generation/manifest atomicity cover content; `migrateHome` can be made idempotent if a crash-retry need is shown). + +**Resume protocol (replaces §8 steps 3–4):** do the next pending Fix in order (#2 → #3 → #4). Per fix: re-read exact baseline → implement → `cd packages/opencode && bun typecheck` AND `cd packages/core && bun typecheck` → targeted test (package dir ONLY) → mutation gate (temp-revert ⇒ a real test flips Red, restore) → `git commit` (conventional) → update this §10 table. Exclusions unchanged: no Goal/DAG-config/CI/push/PR, no source-Home GC. diff --git a/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md index 99d7c64b6d..b1e9f6d766 100644 --- a/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md +++ b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md @@ -1,6 +1,6 @@ # ADR-0004: Project Memory authority owns identity and commits -- Status: **Proposed** (awaiting user approval — P0 gate) +- Status: **Rejected** (2026-08-12) — superseded by the Occam minimal path (redo plan §10). After survey + adversarial review the user applied Occam's Razor: this elaborate redesign (authority facade, 6-phase retirement journal, alias tombstone, opaque Revision, destruction guard, 8 phases) is over-engineered for the actual needs — one shared memory per project and no fork are already in the baseline; an imperceptible identity upgrade and no data loss are achievable with small in-place fixes. Kept as a record of the considered-and-rejected direction. - Date: 2026-08-12 - Supersedes: the Policy-source clause of [ADR-0001](./0001-project-owned-memory.md) and the lock/commit framing of [ADR-0002](./0002-project-memory-commit-protocol.md); adds Identity Retirement. Reconstructs the lost authority redesign (uncommitted WIP, /tmp-cleaned) from design memory, now written down so it is auditable. From 7b30af3143811aefb423c48a5f9b5c6c8a5cf2b2 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 10:19:30 +0800 Subject: [PATCH 09/34] =?UTF-8?q?docs(memory):=20close=20Occam=20#3/#4=20a?= =?UTF-8?q?s=20non-gaps;=20defer=20#2=20(cascade)=20=E2=80=94=20path=20com?= =?UTF-8?q?plete?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-assessed the remaining Occam fixes against the actual code: - #3 (ABBA): unreachable — migrateHome is one-way (root→remote), no reverse caller, so the two project flocks are never taken in opposite orders. - #4 (destructive rescan): already handled — worktree reconcileLegacyMemory invalidates the admission cache before ensure, forcing a fresh rescan. - #2 (typed errors): deferred — full propagation is a multi-file cascade for a marginal HTTP-status gain on a rare conflict (.orDie preserves the diagnostic in the Die cause). Awaits user decision (Occam cut vs invariant #5). Fix #1 (the real data-loss gap) stands; full regression green. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 9dfc18edea..898ec05649 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -189,9 +189,15 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor | Fix | Gap | Status | Commit | |---|---|---|---| | **#1** Repoint `workflow`+`permission` FK on identity upgrade (was `ON DELETE CASCADE` silent data loss) | MEM-REF-07 | ✅ done (mutation-proven) | `ec6972b22` | -| **#2** Remove `.orDie` on the migration seam (`memory/identity-migration.ts` via `project/identity-migration.ts:19`); propagate `ConflictError`/`InvalidHomeError` as typed errors to the instance-store Deferred + HTTP project handler boundary | typed-error invariant (#5) | pending | — | -| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | pending | — | -| **#4** Destructive admission (worktree reset/remove) **force-rescans**, never trusts the process-local admission cache | MEM-ADMIT-03 / RET-04 | pending | — | +| **#2** Remove `.orDie` on the migration seam (`memory/identity-migration.ts` via `project/identity-migration.ts:19`); propagate `ConflictError`/`InvalidHomeError` as typed errors to the instance-store Deferred + HTTP project handler boundary | typed-error invariant (#5) | ⏸ **deferred** — full typed-propagation is a multi-file cascade (seam→migrateProjectId→fromDirectory Interface→instance-store load/reload/Deferred→HTTP) for a marginal gain (HTTP 409 vs 500 on a rare migration conflict; `.orDie` already preserves `ConflictError` in the Die cause, so it stays diagnosable). Awaits user decision: Occam cut vs invariant #5. | — | +| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | ✅ **closed — not reachable** | — | +| **#4** Destructive admission (worktree reset/remove) **force-rescans**, never trusts the process-local admission cache | MEM-ADMIT-03 / RET-04 | ✅ **closed — already handled** | — | + +**#3 rationale:** `migrateHome` is called only via `migrateProjectId(previous=oldID, current=newID)`; identity retirement is one-way (root→remote), so there is no `migrateHome(B,A)` reverse caller — the two project flocks are never acquired in opposite orders. ABBA is unreachable; no code change warranted. + +**#4 rationale:** `worktree/index.ts reconcileLegacyMemory` already runs `memoryAdmission.invalidate(projectID)` **before** `ensure(...)`; invalidation clears the cache entry, so the destructive `ensure` always rescans fresh. The "no stale-cache trust" invariant already holds; no code change warranted. + +**Occam path outcome (2026-08-12):** the only *real* gap was **#1** (silent `workflow`+`permission` cascade-loss on identity upgrade) — fixed, tested, mutation-proven, no regressions (project 38, memory-persistence 16, memory 36, worktree 26 — all 0 fail; opencode+core typecheck clean; `git diff --check` 0). #3 and #4 verified as non-gaps; #2 deferred as a cascade awaiting the user's Occam-vs-invariant-#5 call. The driving loop is removed; nothing more to advance autonomously. **Explicitly cut by Occam** (do NOT build): MEM-ATOMIC-10 (Policy stays in `.opencode/memory.jsonc`; memory is topic content); the authority facade, 6-phase journal, alias tombstone, opaque Revision, destruction guard, crash harness; MEM-CRASH-06 as a forward-journal state machine (POSIX `rename` + the store's generation/manifest atomicity cover content; `migrateHome` can be made idempotent if a crash-retry need is shown). From 9f7885820f006a0230c0f340b3e7320719acef65 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 13:46:07 +0800 Subject: [PATCH 10/34] fix(memory): make Memory fail-closed inert under the shared global identity (MEM-PR01-00) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every commit-less repository resolves to the same ProjectV2.ID.global, and the branch keys Memory Home by project ID. Before this change an enabled global config activated Memory for all commit-less repos at once: one shared Home leaked topics across unrelated repositories, and the first commit moved the identity to root/remote while migrateProjectId never migrates away from global — silently orphaning everything written pre-commit. Fix with the minimal Occam seam: one fail-closed guard in Memory.configuration (the single activation gate behind active/prepare/search/checkpoint/setEnabled) returning undefined while the project identity is global. Memory activates normally once the repository gains a real identity; migrating the shared bucket is structurally infeasible (no per-repo provenance) and pre-existing orphans belong to the deferred retention/GC decision. - Red: search must report "unavailable" and /memory on must stay off for a commit-less repo even with an enabled global config and seeded topics - Green: single guard; identity-scoped (repos with a commit activate normally) - Mutation: removing the guard turns both Red tests red again - Domain regression: memory+project suites 162 pass / 0 fail; opencode+core typecheck clean - redo plan: record Fix #5 decision; reopen #3 (ABBA reachable via remote→remote identity change, MEM-PR01-R1-24) - remove leftover no-assertion diagnostic scaffold (repro-scope-finding); its scenario is captured in finding MEM-PR01-R1-06 for the M-C slice Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 5 +- packages/opencode/src/memory/memory.ts | 7 + .../memory/memory-global-identity.test.ts | 235 ++++++++++++++++++ 3 files changed, 246 insertions(+), 1 deletion(-) create mode 100644 packages/opencode/test/memory/memory-global-identity.test.ts diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 898ec05649..ab4277273f 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -190,8 +190,11 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor |---|---|---|---| | **#1** Repoint `workflow`+`permission` FK on identity upgrade (was `ON DELETE CASCADE` silent data loss) | MEM-REF-07 | ✅ done (mutation-proven) | `ec6972b22` | | **#2** Remove `.orDie` on the migration seam (`memory/identity-migration.ts` via `project/identity-migration.ts:19`); propagate `ConflictError`/`InvalidHomeError` as typed errors to the instance-store Deferred + HTTP project handler boundary | typed-error invariant (#5) | ⏸ **deferred** — full typed-propagation is a multi-file cascade (seam→migrateProjectId→fromDirectory Interface→instance-store load/reload/Deferred→HTTP) for a marginal gain (HTTP 409 vs 500 on a rare migration conflict; `.orDie` already preserves `ConflictError` in the Die cause, so it stays diagnosable). Awaits user decision: Occam cut vs invariant #5. | — | -| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | ✅ **closed — not reachable** | — | +| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | ⚠️ **reopened by two-round review (MEM-PR01-R1-24, P2)**: retirement is NOT one-way — a changed origin URL yields `previous=remote(A), current=remote(B)` (resolve: `remote ?? previous`), so a reverse-ordered `migrateHome` pair IS reachable across two repos sharing identities. Sorted-flock fix pending in the M-A slice. | — | | **#4** Destructive admission (worktree reset/remove) **force-rescans**, never trusts the process-local admission cache | MEM-ADMIT-03 / RET-04 | ✅ **closed — already handled** | — | +| **#5** Memory is **fail-closed inert under `ProjectV2.ID.global`**: `configuration()` returns undefined while the project has no identity of its own | MEM-PR01-00 (P1, two-round review 2026-08-12) | ✅ done (Red→Green→mutation) | this slice | + +**#5 rationale (product decision, Occam route):** every commit-less repository resolves to the SAME shared `global` identity (`core/project.ts` resolve: `id = remote ?? previous ?? root`, and `global` is never cached because `project.ts` skips the identity commit for it). With Home keyed by project ID, an active Memory under `global` would (a) share one Home across all commit-less repositories on the machine (cross-repo topic leakage) and (b) be permanently orphaned at the first commit — identity moves global→root/remote but `migrateProjectId` never migrates away from global (explicit guard; `previous` can never be global). The migration option is structurally infeasible (topics in the shared bucket carry no per-repository provenance), so the minimal correct behavior is **inertness**: memory activates once the repository gains a real identity. One guard at the single activation seam (`Memory.configuration`, which active/prepare/search/checkpoint/setEnabled all funnel through); no new authority, no new machinery. Pre-fix global-bucket contents remain orphans — recovery belongs to the deferred retention/GC decision. Note: this decision constrains the spec — the `lightweight-project-memory` spec has no identity-tier requirement today (review finding MEM-PR01-R1-14); when openspec changes land, add "memory is inert until the project resolves a non-global identity". **#3 rationale:** `migrateHome` is called only via `migrateProjectId(previous=oldID, current=newID)`; identity retirement is one-way (root→remote), so there is no `migrateHome(B,A)` reverse caller — the two project flocks are never acquired in opposite orders. ABBA is unreachable; no code change warranted. diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index 7f4c03698f..f5a05cfc08 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -1,6 +1,7 @@ export * as Memory from "./memory" import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { ProjectV2 } from "@opencode-ai/core/project" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Context, Duration, Effect, Layer, Option, Ref, Schema, Semaphore } from "effect" import { stringify } from "yaml" @@ -174,6 +175,12 @@ export const layer: Layer.Layer< const configuration = Effect.fn("Memory.configuration")(function* () { const ctx = yield* InstanceState.context const current = (yield* project.get(ctx.project.id)) ?? ctx.project + // Fail-closed inertness for the shared global identity: every commit-less + // repository resolves to the same ProjectV2.ID.global, so an active Memory + // would share one Home across unrelated repositories and be orphaned by the + // first commit (migrateProjectId never migrates away from global). Memory + // activates once the repository gains a real identity. + if (current.id === ProjectV2.ID.global) return undefined if (current.vcs !== "git" || !current.time.initialized) return undefined const migration = yield* admission.ensure({ projectID: current.id, diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts new file mode 100644 index 0000000000..2bb55cd9ed --- /dev/null +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -0,0 +1,235 @@ +import { describe, expect } from "bun:test" +import { Database } from "@opencode-ai/core/database/database" +import { ModelV2 } from "@opencode-ai/core/model" +import { ProjectV2 } from "@opencode-ai/core/project" +import { ProviderV2 } from "@opencode-ai/core/provider" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { SessionV1 } from "@opencode-ai/core/v1/session" +import { Effect, Layer } from "effect" +import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process" +import fs from "node:fs" +import path from "node:path" +import { Config } from "@/config/config" +import { Git } from "@/git" +import { MemoryAdmission } from "@/memory/admission" +import { MemoryConfig } from "@/memory/config" +import { MemoryLock } from "@/memory/lock" +import { Memory } from "@/memory/memory" +import { MemoryModel } from "@/memory/model" +import { MemorySchema } from "@/memory/schema" +import { MemoryStore } from "@/memory/store" +import { Project } from "@/project/project" +import { MessageID, PartID, SessionID } from "@/session/schema" +import { ProviderTest } from "../fake/provider" +import { provideInstance, testInstanceStoreLayer, tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +const now = "2026-08-12T12:00:00Z" +const providerID = ProviderV2.ID.make("test") +const enabledModel = ProviderTest.model({ providerID, id: ModelV2.ID.make("memory-on") }) + +const baseConfig = { + schema_version: 1, + enabled: true, + model: "test/memory-on", + topic_limit: 10, + topic_limit_floor: 10, + turn_interval: 5, + injection: { max_topics: 3, max_tokens: 1_200 }, +} satisfies MemorySchema.Config + +function topic() { + return { + schema_version: 1, + id: "project-architecture", + name: "架构边界", + summary: "已确认的核心架构边界", + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: now, + updated_at: now, + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "decision-01", + kind: "decision", + content: "已确认决定：核心模块之间使用稳定边界", + rationale: "该边界由用户确认并长期适用", + confirmed_at: now, + }, + ], + } satisfies MemorySchema.Topic +} + +function userMessage(sessionID: SessionID): SessionV1.WithParts { + const id = MessageID.ascending() + return { + info: { + id, + role: "user", + sessionID, + time: { created: 1 }, + agent: "build", + model: { providerID, modelID: ModelV2.ID.make("memory-on") }, + }, + parts: [ + { + id: PartID.ascending(), + messageID: id, + sessionID, + type: "text", + text: "架构边界是什么？", + }, + ], + } +} + +const emptyConfigLayer = Layer.mock(Config.Service, { + get: () => Effect.succeed({}), +}) + +const base = Layer.mergeAll( + emptyConfigLayer, + ProviderTest.fake({ model: enabledModel }).layer, + Project.defaultLayer, + Database.defaultLayer, + Git.defaultLayer, + MemoryAdmission.defaultLayer, + MemoryConfig.defaultLayer, + MemoryLock.defaultLayer, + MemoryStore.defaultLayer, + Layer.mock(MemoryModel.Service, { + generate: () => Effect.die(new Error("model calls are not expected in global-identity tests")), + }), +) + +// provideMerge builds `base` once, provides it to Memory.layer AND re-exposes its +// services (Project/MemoryConfig/MemoryStore/...) to the test body. CrossSpawnSpawner +// is merged at the top level so the body itself can spawn git for the fixtures. +const layer = Layer.mergeAll(Memory.layer.pipe(Layer.provideMerge(base)), CrossSpawnSpawner.defaultLayer) + +const it = testEffect(layer) + +// A git repository WITHOUT any commit: identity resolution finds no remote, no +// cached id and no root commit, so it falls back to the shared ProjectV2.ID.global. +function gitInitWithoutCommit(dir: string) { + return Effect.gen(function* () { + const spawner = yield* ChildProcessSpawner.ChildProcessSpawner + const git = (...args: string[]) => + spawner.spawn(ChildProcess.make("git", args, { cwd: dir })).pipe(Effect.flatMap((handle) => handle.exitCode)) + yield* git("init") + yield* git("config", "core.fsmonitor", "false") + yield* git("config", "commit.gpgsign", "false") + yield* git("config", "user.email", "test@opencode.test") + yield* git("config", "user.name", "Test") + }) +} + +describe("MEM-PR01-00: memory is inert under the shared global identity", () => { + it.live( + "search reports unavailable for a commit-less repository even when global config enables memory and the shared bucket holds topics", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped() + yield* gitInitWithoutCommit(dir) + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + const store = yield* MemoryStore.Service + + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).toBe(ProjectV2.ID.global) + yield* project.setInitialized(info.id) + + // An enabled global config must NOT activate memory for a project that + // has no identity of its own: every commit-less repository on the + // machine resolves to the same global bucket, so any read or write + // would leak across repositories and be orphaned by the first commit. + yield* configStore.writeGlobal(baseConfig) + // Simulate another commit-less repository having written into the + // shared bucket: memory must still refuse to serve it from here. + const seeded = topic() + yield* store.updateTopics(info.id, () => ({ + applied: { topics: [seeded], changed: [seeded.id], deleted: [] }, + result: undefined, + })) + + const sessionID = SessionID.make("ses_global_identity") + const result = yield* memory.search({ + sessionID, + messages: [userMessage(sessionID)], + query: "架构边界", + }) + expect(result.status).toBe("unavailable") + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) + + it.live( + "/memory on stays off for a commit-less repository and writes no project config", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped() + yield* gitInitWithoutCommit(dir) + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).toBe(ProjectV2.ID.global) + yield* project.setInitialized(info.id) + yield* configStore.writeGlobal(baseConfig) + + expect(yield* memory.setEnabled(true)).toBe("Memory remains off") + expect(fs.existsSync(path.join(dir, ".opencode", "memory.jsonc"))).toBe(false) + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) + + it.live( + "inertness is identity-scoped: a repository with a commit activates normally under its real identity", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped({ git: true }) + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).not.toBe(ProjectV2.ID.global) + yield* project.setInitialized(info.id) + yield* configStore.writeGlobal(baseConfig) + + const sessionID = SessionID.make("ses_real_identity") + const result = yield* memory.search({ + sessionID, + messages: [userMessage(sessionID)], + query: "架构边界", + }) + // Active (model calls are stubbed to fail, so search cannot succeed — + // but it must get PAST the activation gate, i.e. not "unavailable"). + expect(result.status).not.toBe("unavailable") + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) +}) From 419ac4551c565e747d8cd0962794f6beb0fa91a5 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 14:38:18 +0800 Subject: [PATCH 11/34] =?UTF-8?q?fix(memory):=20harden=20identity=20migrat?= =?UTF-8?q?ion=20=E2=80=94=20residue=20tolerance,=20content=20merge,=20FK?= =?UTF-8?q?=20collision,=20deadlock-freedom=20(MEM-PR01=20M-A)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two-round review confirmed four P2 defects in the identity-upgrade path; all fixed at the existing seams with Red→Green→mutation evidence per finding. R1-12 inspectHome wedged every upgrade after a crash: the store's own atomicWrite residue (manifest.json...tmp) was rejected as foreign state. Tolerate the store's own temp pattern; foreign files still fail closed (pinned). R1-15 The merge compared full topic JSON, so controller metadata drift from MemoryStore.markMatched (last_matched_at/match_count/revision/ updated_at) registered as a user-visible ConflictError and wedged the upgrade. Compare content only; the target's own copy stays authoritative; real content differences still conflict (pinned). R1-11 Permission FK repoint used a bulk UPDATE that violated the unique (project_id, action, resource) index whenever the successor identity already held the same (action, resource) — the immediate transaction died and the whole upgrade wedged on every retry. Repoint per row; on collision the successor row wins and the duplicate old row is dropped; disjoint rows still repoint. R1-24 The redo plan claimed ABBA unreachable because retirement was "one-way" — false: a changed origin URL yields remote→remote transitions, and the old lock structure (hold flock(old) across the merge while updateTopics locks flock(new) inside) deadlocks opposite-direction migrations (Red: 20 s test timeout on the legacy structure). Sorted pre-acquisition is impossible because the flock is non-reentrant, so fix by construction: a sorted pair lock serializes the two directions and the merge is restructured into three phases that never hold more than one memory-project:* lock at a time. A source that changed mid-merge now fails closed with retryable SourceChangedError instead of risking deletion of new data. Crash-retry convergence pinned (R1-13). - Domain regression: memory+project suites 169 pass / 0 fail; opencode+core typecheck clean; lint ratchet unchanged (0 new warnings). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 7 +- .../opencode/src/memory/identity-migration.ts | 106 +++++-- packages/opencode/src/project/project.ts | 24 +- .../memory/memory-identity-migration.test.ts | 269 ++++++++++++++++++ .../opencode/test/project/project.test.ts | 69 +++++ 5 files changed, 450 insertions(+), 25 deletions(-) create mode 100644 packages/opencode/test/memory/memory-identity-migration.test.ts diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index ab4277273f..6fc81308a6 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -190,9 +190,12 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor |---|---|---|---| | **#1** Repoint `workflow`+`permission` FK on identity upgrade (was `ON DELETE CASCADE` silent data loss) | MEM-REF-07 | ✅ done (mutation-proven) | `ec6972b22` | | **#2** Remove `.orDie` on the migration seam (`memory/identity-migration.ts` via `project/identity-migration.ts:19`); propagate `ConflictError`/`InvalidHomeError` as typed errors to the instance-store Deferred + HTTP project handler boundary | typed-error invariant (#5) | ⏸ **deferred** — full typed-propagation is a multi-file cascade (seam→migrateProjectId→fromDirectory Interface→instance-store load/reload/Deferred→HTTP) for a marginal gain (HTTP 409 vs 500 on a rare migration conflict; `.orDie` already preserves `ConflictError` in the Die cause, so it stays diagnosable). Awaits user decision: Occam cut vs invariant #5. | — | -| **#3** `migrateHome` acquires its two project flocks in **sorted** order (no reverse-retirement ABBA) | MEM-LOCK-02 | ⚠️ **reopened by two-round review (MEM-PR01-R1-24, P2)**: retirement is NOT one-way — a changed origin URL yields `previous=remote(A), current=remote(B)` (resolve: `remote ?? previous`), so a reverse-ordered `migrateHome` pair IS reachable across two repos sharing identities. Sorted-flock fix pending in the M-A slice. | — | +| **#3** `migrateHome` deadlock-freedom for opposite-direction migrations | MEM-LOCK-02 | ✅ **fixed (MEM-PR01-R1-24, P2; Red = 20 s deadlock timeout, Green = ms)**: the review falsified the one-way-retirement claim — a changed origin URL yields `previous=remote(A), current=remote(B)` (resolve: `remote ?? previous`), so opposite-direction pairs are reachable. Sorted pre-acquisition is impossible (the flock is non-reentrant; `updateTopics` re-locks the target inside). Fix by construction: a dedicated sorted **pair lock** serializes the two directions, and the merge is restructured into three phases that never hold more than one `memory-project:*` lock at a time (snapshot source → merge via target-locked `updateTopics` → verify-and-remove source; if the source changed meanwhile, fail closed with retryable `SourceChangedError`, nothing removed). Crash-retry convergence pinned by MEM-PR01-R1-13. | this slice | | **#4** Destructive admission (worktree reset/remove) **force-rescans**, never trusts the process-local admission cache | MEM-ADMIT-03 / RET-04 | ✅ **closed — already handled** | — | -| **#5** Memory is **fail-closed inert under `ProjectV2.ID.global`**: `configuration()` returns undefined while the project has no identity of its own | MEM-PR01-00 (P1, two-round review 2026-08-12) | ✅ done (Red→Green→mutation) | this slice | +| **#5** Memory is **fail-closed inert under `ProjectV2.ID.global`**: `configuration()` returns undefined while the project has no identity of its own | MEM-PR01-00 (P1, two-round review 2026-08-12) | ✅ done (Red→Green→mutation) | `d6abdf466` | +| **#6** `inspectHome` tolerates the store's own `atomicWrite` residue (`manifest.json...tmp`); foreign files still fail closed | MEM-PR01-R1-12 (P2) | ✅ done (Red→Green→mutation) | this slice | +| **#7** Identity-merge conflict check compares **content only** — controller metadata drift (`last_matched_at`/`match_count`/`revision`/`updated_at` from `markMatched`) is not a conflict; real content differences still are | MEM-PR01-R1-15 (P2) | ✅ done (Red→Green→mutation) | this slice | +| **#8** Permission FK repoint is **uniqueness-collision-safe**: on `(project_id, action, resource)` collision the successor row wins and the duplicate old row is dropped; disjoint rows still repoint. The previous bulk UPDATE violated the unique index and wedged the whole upgrade transaction | MEM-PR01-R1-11 (P2) | ✅ done (Red→Green→mutation) | this slice | **#5 rationale (product decision, Occam route):** every commit-less repository resolves to the SAME shared `global` identity (`core/project.ts` resolve: `id = remote ?? previous ?? root`, and `global` is never cached because `project.ts` skips the identity commit for it). With Home keyed by project ID, an active Memory under `global` would (a) share one Home across all commit-less repositories on the machine (cross-repo topic leakage) and (b) be permanently orphaned at the first commit — identity moves global→root/remote but `migrateProjectId` never migrates away from global (explicit guard; `previous` can never be global). The migration option is structurally infeasible (topics in the shared bucket carry no per-repository provenance), so the minimal correct behavior is **inertness**: memory activates once the repository gains a real identity. One guard at the single activation seam (`Memory.configuration`, which active/prepare/search/checkpoint/setEnabled all funnel through); no new authority, no new machinery. Pre-fix global-bucket contents remain orphans — recovery belongs to the deferred retention/GC decision. Note: this decision constrains the spec — the `lightweight-project-memory` spec has no identity-tier requirement today (review finding MEM-PR01-R1-14); when openspec changes land, add "memory is inert until the project resolves a non-global identity". diff --git a/packages/opencode/src/memory/identity-migration.ts b/packages/opencode/src/memory/identity-migration.ts index 6d3f17b0bf..f33794fdc0 100644 --- a/packages/opencode/src/memory/identity-migration.ts +++ b/packages/opencode/src/memory/identity-migration.ts @@ -7,6 +7,7 @@ import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { Context, Effect, Layer, Schema } from "effect" import { dirname, join } from "node:path" import { MemoryHome } from "./home" +import { MemorySchema } from "./schema" import { MemoryStore } from "./store" export interface Interface { @@ -15,7 +16,7 @@ export interface Interface { newID: ProjectV2.ID, ) => Effect.Effect< void, - FSUtil.Error | EffectFlock.LockError | MemoryStore.StoreError | ConflictError | InvalidHomeError + FSUtil.Error | EffectFlock.LockError | MemoryStore.StoreError | ConflictError | InvalidHomeError | SourceChangedError > } @@ -32,6 +33,43 @@ export class InvalidHomeError extends Schema.TaggedErrorClass( }, ) {} +/** + * The source Home changed while the migration was merging it into the target + * (a process still running under the old identity committed). Nothing was + * removed; the migration is safe to retry and converges. + */ +export class SourceChangedError extends Schema.TaggedErrorClass()( + "MemoryIdentityMigration.SourceChanged", + { + project_id: Schema.String, + }, +) {} + +// Content identity for the migration merge: everything except the metadata fields +// the match controller mutates on live topics (MemoryStore.markMatched bumps +// last_matched_at / match_count / revision / updated_at without touching content). +// Two topics that differ only in those must not register as a user-visible conflict. +function sameContent(left: MemorySchema.Topic, right: MemorySchema.Topic): boolean { + const content = (topic: MemorySchema.Topic) => + JSON.stringify({ + schema_version: topic.schema_version, + id: topic.id, + name: topic.name, + summary: topic.summary, + metadata: { + categories: topic.metadata.categories, + status: topic.metadata.status, + importance: topic.metadata.importance, + keywords: topic.metadata.keywords, + related_topics: topic.metadata.related_topics, + created_at: topic.metadata.created_at, + item_count: topic.metadata.item_count, + }, + items: topic.items, + }) + return content(left) === content(right) +} + export const layer = Layer.effect( Service, Effect.gen(function* () { @@ -46,46 +84,69 @@ export const layer = Layer.effect( !( (entry.name === "topics" && entry.type === "directory") || (entry.name === "generations" && entry.type === "directory") || - (entry.name === "manifest.json" && entry.type === "file") + (entry.name === "manifest.json" && entry.type === "file") || + // The store's own atomicWrite residue (`manifest.json...tmp`) + // is left behind if a process dies between the temp write and the rename. + // It is harmless garbage, not foreign state — rejecting it would wedge + // every identity upgrade after such a crash. + (entry.type === "file" && entry.name.startsWith("manifest.json.") && entry.name.endsWith(".tmp")) ), ) if (unexpected.length === 0) return yield* new InvalidHomeError({ paths: unexpected.map((entry) => join(directory, entry.name)) }) }) + // Three-phase merge. Locking rules that make opposite-direction migrations + // (remote→remote identity changes) deadlock-free: + // - a dedicated pair lock serializes the two directions of the same pair; + // - at most ONE `memory-project:*` lock is held at any moment (phases 1 and + // 3 hold the source lock, phase 2 holds none — the store locks the target + // itself inside updateTopics), so no hold-and-wait cycle can form between + // concurrent migrations or with writers on either identity. const migrateHomeUnsafe = Effect.fnUntraced(function* ( oldID: ProjectV2.ID, newID: ProjectV2.ID, ) { const source = home.directory(oldID) - if (!(yield* fs.existsSafe(source))) return const target = home.directory(newID) - yield* fs.makeDirectory(dirname(target), { recursive: true }) - if (!(yield* fs.existsSafe(target))) { - yield* fs.rename(source, target) - return - } - yield* inspectHome(source) + // Phase 1 — snapshot the source under the source lock. If the target does + // not exist yet the whole migration is a rename under the same lock. + const snapshot = yield* flock.withLock( + Effect.gen(function* () { + if (!(yield* fs.existsSafe(source))) return undefined + yield* fs.makeDirectory(dirname(target), { recursive: true }) + if (!(yield* fs.existsSafe(target))) { + yield* fs.rename(source, target) + return undefined + } + yield* inspectHome(source) + return yield* store.readSnapshot(oldID) + }), + `memory-project:${oldID}`, + home.locks, + ) + if (!snapshot) return + + // Phase 2 — merge into the target. updateTopics takes the target lock. yield* inspectHome(target) - const sourceTopics = yield* store.inspectTopics(oldID) const targetTopics = yield* store.inspectTopics(newID) const targetByID = new Map(targetTopics.map((topic) => [topic.id, topic])) - const conflicts = sourceTopics + const conflicts = snapshot.topics .filter((topic) => { const current = targetByID.get(topic.id) - return current && JSON.stringify(current) !== JSON.stringify(topic) + return current && !sameContent(current, topic) }) .map((topic) => topic.id) if (conflicts.length > 0) yield* new ConflictError({ topic_ids: conflicts }) - const imported = sourceTopics.filter((topic) => !targetByID.has(topic.id)) + const imported = snapshot.topics.filter((topic) => !targetByID.has(topic.id)) if (imported.length > 0) { yield* store.updateTopics(newID, (topics) => { const current = new Map(topics.map((topic) => [topic.id, topic])) const conflicts = imported.filter((topic) => { const existing = current.get(topic.id) - return existing && JSON.stringify(existing) !== JSON.stringify(topic) + return existing && !sameContent(existing, topic) }) if (conflicts.length > 0) throw new MemoryStore.StoreError({ @@ -103,13 +164,26 @@ export const layer = Layer.effect( } }) } - yield* fs.remove(source, { recursive: true }) + + // Phase 3 — remove the source only if it has not changed since the + // snapshot; otherwise leave everything in place for a converging retry. + yield* flock.withLock( + Effect.gen(function* () { + if (!(yield* fs.existsSafe(source))) return + const current = yield* store.readSnapshot(oldID) + if (current.revision !== snapshot.revision) yield* new SourceChangedError({ project_id: oldID }) + yield* fs.remove(source, { recursive: true }) + }), + `memory-project:${oldID}`, + home.locks, + ) }) const migrateHome: Interface["migrateHome"] = (oldID, newID) => { if (oldID === newID) return Effect.void + const pair = [oldID, newID].sort().join("|") return flock - .withLock(migrateHomeUnsafe(oldID, newID), `memory-project:${oldID}`, home.locks) + .withLock(migrateHomeUnsafe(oldID, newID), `memory-migrate:${pair}`, home.locks) .pipe(Effect.asVoid, Effect.withSpan("MemoryIdentityMigration.migrateHome")) } diff --git a/packages/opencode/src/project/project.ts b/packages/opencode/src/project/project.ts index f2ee5ee496..f63cf32126 100644 --- a/packages/opencode/src/project/project.ts +++ b/packages/opencode/src/project/project.ts @@ -194,14 +194,24 @@ export const layer = Layer.effect( // Repoint the Project-owned references that the old row's deletion would otherwise // cascade-destroy. Both workflow and permission carry ON DELETE CASCADE on project_id, // so without this repointing, gaining a first remote would silently delete every DAG - // workflow and every saved permission for the project. A (newID, action, resource) - // collision on permission fails the immediate transaction closed (no data loss). + // workflow and every saved permission for the project. yield* d.update(WorkflowTable).set({ project_id: newID }).where(eq(WorkflowTable.project_id, oldID)).run() - yield* d - .update(PermissionTable) - .set({ project_id: newID }) - .where(eq(PermissionTable.project_id, oldID)) - .run() + // (project_id, action, resource) is unique on permission. When the successor + // identity already holds a row with the same (action, resource), it already grants + // the identical permission: drop the old row instead of repointing it. A bulk + // UPDATE would violate the unique index and wedge the whole identity upgrade. + const successorPermissions = new Set( + (yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, newID)).all()).map( + (row) => JSON.stringify([row.action, row.resource]), + ), + ) + for (const row of yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, oldID)).all()) { + if (successorPermissions.has(JSON.stringify([row.action, row.resource]))) { + yield* d.delete(PermissionTable).where(eq(PermissionTable.id, row.id)).run() + } else { + yield* d.update(PermissionTable).set({ project_id: newID }).where(eq(PermissionTable.id, row.id)).run() + } + } if (oldProject) yield* d.delete(ProjectTable).where(eq(ProjectTable.id, oldID)).run() }), diff --git a/packages/opencode/test/memory/memory-identity-migration.test.ts b/packages/opencode/test/memory/memory-identity-migration.test.ts new file mode 100644 index 0000000000..71d119c0d3 --- /dev/null +++ b/packages/opencode/test/memory/memory-identity-migration.test.ts @@ -0,0 +1,269 @@ +import { describe, expect } from "bun:test" +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { Effect, Layer } from "effect" +import { MemoryHome } from "@/memory/home" +import { MemoryIdentityMigration } from "@/memory/identity-migration" +import { MemorySchema } from "@/memory/schema" +import { MemoryStore } from "@/memory/store" +import { tmpdirScoped } from "../fixture/fixture" +import { testEffect } from "../lib/effect" + +const it = testEffect(Layer.mergeAll(FSUtil.defaultLayer, CrossSpawnSpawner.defaultLayer)) + +const now = "2026-08-12T00:00:00Z" +const oldID = ProjectV2.ID.make("mig-old") +const newID = ProjectV2.ID.make("mig-new") + +function topic(id: string, summary: string): MemorySchema.Topic { + return { + schema_version: 1, + id, + name: `主题 ${id}`, + summary, + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: now, + updated_at: now, + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: `${id}-item`, + kind: "decision", + content: "已确认决定：核心模块之间使用稳定边界", + rationale: "该边界由用户确认并长期适用", + confirmed_at: now, + }, + ], + } satisfies MemorySchema.Topic +} + +function layers(root: string) { + const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + const store = MemoryStore.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) + const migration = MemoryIdentityMigration.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + Layer.provide(store), + ) + return Layer.mergeAll(home, store, migration) +} + +function seed(projectID: ProjectV2.ID, topics: MemorySchema.Topic[]) { + return Effect.gen(function* () { + const store = yield* MemoryStore.Service + yield* store.updateTopics(projectID, () => ({ + applied: { topics, changed: topics.map((value) => value.id), deleted: [] }, + result: undefined, + })) + }) +} + +describe("MEM-PR01-R1-12: identity upgrade survives the store's own crash residue", () => { + it.live( + "a leftover manifest temp file in the source Home does not wedge the merge", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const migration = yield* MemoryIdentityMigration.Service + + yield* seed(oldID, [topic("source-topic", "源仓库主题")]) + yield* seed(newID, [topic("target-topic", "另一仓库主题")]) + // Simulate a process killed between atomicWrite's temp write and rename: + // the store's own residue sits at the Home root next to manifest.json. + yield* fs.writeFileString(`${home.manifest(oldID)}.4242.deadbeef.tmp`, "partial") + + yield* migration.migrateHome(oldID, newID) + + const merged = yield* store.readSnapshot(newID) + expect(merged.topics.map((value) => value.id).sort()).toEqual(["source-topic", "target-topic"]) + expect(yield* fs.existsSafe(home.directory(oldID))).toBe(false) + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) + + it.live( + "a leftover manifest temp file in the target Home does not wedge the merge", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const migration = yield* MemoryIdentityMigration.Service + + yield* seed(oldID, [topic("source-topic", "源仓库主题")]) + yield* seed(newID, [topic("target-topic", "另一仓库主题")]) + yield* fs.writeFileString(`${home.manifest(newID)}.4242.deadbeef.tmp`, "partial") + + yield* migration.migrateHome(oldID, newID) + + const merged = yield* store.readSnapshot(newID) + expect(merged.topics.map((value) => value.id).sort()).toEqual(["source-topic", "target-topic"]) + expect(yield* fs.existsSafe(home.directory(oldID))).toBe(false) + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) + + it.live( + "foreign files at the Home root still fail closed", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + + yield* seed(oldID, [topic("source-topic", "源仓库主题")]) + yield* seed(newID, [topic("target-topic", "另一仓库主题")]) + yield* fs.writeFileString(`${home.directory(oldID)}/notes.txt`, "not ours") + + const error = yield* migration.migrateHome(oldID, newID).pipe(Effect.flip) + expect(error._tag).toBe("MemoryIdentityMigration.InvalidHome") + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) +}) + +describe("MEM-PR01-R1-24: opposite-direction migrations cannot deadlock", () => { + it.live( + "concurrent A→B and B→A migrations complete instead of wedging on nested flocks", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const migration = yield* MemoryIdentityMigration.Service + + // Both Homes exist, so both directions take the merge path (not the + // rename fast path). Under the legacy locking, A→B holds flock(A) and + // waits for flock(B) inside the target update while B→A holds flock(B) + // and waits for flock(A) — a deadlock broken only by the 5 minute lock + // timeout, which this test's timeout deliberately undercuts. + yield* seed(oldID, [topic("topic-old", "旧身份的主题")]) + yield* seed(newID, [topic("topic-new", "新身份的主题")]) + + yield* Effect.all( + [migration.migrateHome(oldID, newID), migration.migrateHome(newID, oldID)], + { concurrency: 2 }, + ) + + const oldExists = yield* fs.existsSafe(home.directory(oldID)) + const newExists = yield* fs.existsSafe(home.directory(newID)) + // Exactly one Home survives, holding the union of both topic sets. + expect(oldExists).not.toBe(newExists) + const survivor = oldExists ? oldID : newID + const merged = yield* store.readSnapshot(survivor) + expect(merged.topics.map((value) => value.id).sort()).toEqual(["topic-new", "topic-old"]) + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 20_000 }, + ) +}) + +describe("MEM-PR01-R1-13: interrupted migration retries to convergence", () => { + it.live( + "a crash after import but before source removal converges on retry", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const migration = yield* MemoryIdentityMigration.Service + + const shared = topic("carried-topic", "迁移中断后仍然保留的主题") + // State a crash would leave behind: the import already landed in the + // target, the source Home still exists with the same content. + yield* seed(oldID, [shared]) + yield* seed(newID, [shared]) + + yield* migration.migrateHome(oldID, newID) + + expect(yield* fs.existsSafe(home.directory(oldID))).toBe(false) + const merged = yield* store.readSnapshot(newID) + expect(merged.topics.map((value) => value.id)).toEqual(["carried-topic"]) + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) +}) + +describe("MEM-PR01-R1-15: identity merge compares content, not controller metadata", () => { + it.live( + "the same topic with drifted match metadata is not a conflict", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const migration = yield* MemoryIdentityMigration.Service + + const shared = topic("shared-topic", "两个仓库各自演化的同一主题") + // The target copy was matched live: controller metadata drifted while + // the content stayed identical. + const drifted = MemoryStore.markMatched([shared], ["shared-topic"]).topics[0] + expect(JSON.stringify(drifted)).not.toBe(JSON.stringify(shared)) + + yield* seed(oldID, [shared]) + yield* seed(newID, [drifted]) + + yield* migration.migrateHome(oldID, newID) + + const merged = yield* store.readSnapshot(newID) + expect(merged.topics.map((value) => value.id)).toEqual(["shared-topic"]) + // The target's own (newer) copy stays authoritative. + expect(merged.topics[0].metadata.match_count).toBe(drifted.metadata.match_count) + expect(yield* fs.existsSafe(home.directory(oldID))).toBe(false) + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) + + it.live( + "a real content difference is still a conflict", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const migration = yield* MemoryIdentityMigration.Service + + yield* seed(oldID, [topic("shared-topic", "源版本的内容")]) + yield* seed(newID, [topic("shared-topic", "新版本的内容完全不同")]) + + const error = yield* migration.migrateHome(oldID, newID).pipe(Effect.flip) + expect(error._tag).toBe("MemoryIdentityMigration.Conflict") + }).pipe(Effect.provide(layers(root))) + }), + { timeout: 30_000 }, + ) +}) diff --git a/packages/opencode/test/project/project.test.ts b/packages/opencode/test/project/project.test.ts index f0a8956e8d..07eae3474c 100644 --- a/packages/opencode/test/project/project.test.ts +++ b/packages/opencode/test/project/project.test.ts @@ -10,6 +10,7 @@ import { ProjectTable } from "@opencode-ai/core/project/sql" import { SessionTable } from "@opencode-ai/core/session/sql" import { WorkspaceTable } from "@opencode-ai/core/control-plane/workspace.sql" import { WorkflowTable } from "@opencode-ai/core/dag/sql" +import { PermissionSaved } from "@opencode-ai/core/permission/saved" import { PermissionTable } from "@opencode-ai/core/permission/sql" import { eq } from "drizzle-orm" import { Hash } from "@opencode-ai/core/util/hash" @@ -310,6 +311,74 @@ describe("Project.fromDirectory", () => { }), ) + it.live( + "identity upgrade survives a permission uniqueness collision with the successor identity (MEM-PR01-R1-11)", + () => + Effect.gen(function* () { + const { db } = yield* Database.Service + const tmp = yield* tmpdirScoped({ git: true }) + const projects = yield* Project.Service + const rootResult = yield* projects.fromDirectory(tmp) + const rootProject = rootResult.project + const remoteID = remoteProjectID("github.com/acme/collide") + + // The successor identity already exists (another checkout resolved it + // first) and owns a permission colliding with the root identity's on + // (project_id, action, resource). The upgrade must not wedge on the + // unique index: the successor row wins, the duplicate is dropped, and + // disjoint permissions still repoint. + const rootRow = yield* db + .select() + .from(ProjectTable) + .where(eq(ProjectTable.id, rootProject.id)) + .get() + .pipe(Effect.orDie) + yield* db + .insert(ProjectTable) + .values({ ...rootRow!, id: remoteID, time_updated: Date.now() }) + .run() + .pipe(Effect.orDie) + yield* db + .insert(PermissionTable) + .values({ id: PermissionSaved.ID.make("perm-successor"), project_id: remoteID, action: "allow", resource: "test" }) + .run() + .pipe(Effect.orDie) + yield* db + .insert(PermissionTable) + .values({ id: PermissionSaved.ID.make("perm-colliding"), project_id: rootProject.id, action: "allow", resource: "test" }) + .run() + .pipe(Effect.orDie) + yield* db + .insert(PermissionTable) + .values({ id: PermissionSaved.ID.make("perm-disjoint"), project_id: rootProject.id, action: "allow", resource: "other" }) + .run() + .pipe(Effect.orDie) + yield* Effect.promise(() => $`git remote add origin git@github.com:acme/collide.git`.cwd(tmp).quiet()) + + const result = yield* projects.fromDirectory(tmp) + + expect(result.project.id).toBe(remoteID) + const permissions = yield* db + .select() + .from(PermissionTable) + .where(eq(PermissionTable.project_id, remoteID)) + .all() + .pipe(Effect.orDie) + expect(permissions.map((row) => row.id).sort()).toEqual([ + PermissionSaved.ID.make("perm-disjoint"), + PermissionSaved.ID.make("perm-successor"), + ]) + expect( + yield* db + .select() + .from(PermissionTable) + .where(eq(PermissionTable.id, PermissionSaved.ID.make("perm-colliding"))) + .get() + .pipe(Effect.orDie), + ).toBeUndefined() + }), + ) + it.live("migrates Project Memory before retiring the previous Project identity", () => Effect.gen(function* () { const dataRoot = yield* tmpdirScoped() From 216f6494654d3f6683c8fb5ada2d930e06183e13 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 15:51:48 +0800 Subject: [PATCH 12/34] =?UTF-8?q?fix(memory):=20close=20admission/lifecycl?= =?UTF-8?q?e=20review=20findings=20=E2=80=94=20full-snapshot=20reconcile,?= =?UTF-8?q?=20TOCTOU=20revalidation,=20retired-identity=20inertness=20(MEM?= =?UTF-8?q?-PR01=20M-C)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1-06 (blocking): worktree remove/reset reconciled admission against a SINGLE directory, so a lone sandbox legacy config could be promoted to the project config past disagreeing siblings (order-dependent, silent effective-config flip). Both call sites now pass the complete snapshot (primary + every registered sandbox); disagreeing siblings fail closed with no promotion. R1-03: configuration() fell back to the stale instance context when the identity row was gone, letting a process holding a retired identity fork a Home under it. The fallback is removed: missing row = inert. R1-04: admission deleted scanned legacy topic/config files without re-reading them; a writer outside the admission flock (older runtime, hand edit) landing between scan and delete lost content. Each file is now re-read and compared immediately before removal; changed content is preserved and surfaced as a conflict. Deterministic TOCTOU test pins the scan→delete window via the store flock. R1-08: worktree remove/reset migration ran for uninitialized projects despite the memory path's inertness rule; reconcile is now gated on time.initialized (residue still fails closed). Existing migration tests stamp initialized. R1-10: admission's explicit-config choice used a localeCompare sort that put memory.json before memory.jsonc, disagreeing with MemoryConfig.load. The scan now keeps loader precedence and a jsonc/json fork in the project directory is diagnosed as config.conflict instead of silently picking a side; legacy configs equal only to the non-effective file are no longer deleted as duplicates. Pins: R1-07 (/memory writes the project config to the project worktree from a non-primary instance context) and R1-23 (runtime admission snapshot covers every registered sandbox). - Domain regression: memory+project suites 176 pass / 0 fail; opencode+core typecheck clean; lint ratchet unchanged (0 new warnings). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 12 ++ packages/opencode/src/memory/admission.ts | 182 ++++++++++++++---- packages/opencode/src/memory/memory.ts | 7 +- packages/opencode/src/worktree/index.ts | 14 +- .../test/memory/memory-admission.test.ts | 105 +++++++++- .../memory/memory-global-identity.test.ts | 140 ++++++++++++++ .../test/project/worktree-remove.test.ts | 110 ++++++++++- .../opencode/test/project/worktree.test.ts | 8 + 8 files changed, 535 insertions(+), 43 deletions(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 6fc81308a6..6aa08c883b 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -208,3 +208,15 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor **Explicitly cut by Occam** (do NOT build): MEM-ATOMIC-10 (Policy stays in `.opencode/memory.jsonc`; memory is topic content); the authority facade, 6-phase journal, alias tombstone, opaque Revision, destruction guard, crash harness; MEM-CRASH-06 as a forward-journal state machine (POSIX `rename` + the store's generation/manifest atomicity cover content; `migrateHome` can be made idempotent if a crash-retry need is shown). **Resume protocol (replaces §8 steps 3–4):** do the next pending Fix in order (#2 → #3 → #4). Per fix: re-read exact baseline → implement → `cd packages/opencode && bun typecheck` AND `cd packages/core && bun typecheck` → targeted test (package dir ONLY) → mutation gate (temp-revert ⇒ a real test flips Red, restore) → `git commit` (conventional) → update this §10 table. Exclusions unchanged: no Goal/DAG-config/CI/push/PR, no source-Home GC. + +### M-C additions (two-round review findings, 2026-08-12) + +| Fix | Finding | Status | +|---|---|---| +| **#9** Memory is inert when the identity row is gone: `configuration()` no longer falls back to the stale instance context (`?? ctx.project` removed). A process holding a retired identity can no longer fork a Home under it. | MEM-PR01-R1-03 (P2) | ✅ done (Red→Green→mutation) | +| **#10** Worktree remove/reset reconcile against the **complete** directory snapshot (primary + every registered sandbox), never a single directory: a lone sandbox config can no longer be promoted past disagreeing siblings. | MEM-PR01-R1-06 (P2, blocking) | ✅ done (Red→Green; Red captured on the legacy single-directory behavior) | +| **#11** Migration is gated on `time.initialized` (the memory path's own eligibility rule): uninitialized projects stay inert on worktree remove/reset; residue still fails closed. Existing migration tests stamp initialized accordingly. | MEM-PR01-R1-08 (P3) | ✅ done (Red→Green) | +| **#12** Legacy topic/config files are **re-read and compared immediately before deletion**; content that changed after the scan (older-version writer, hand edit) is preserved and surfaced as a conflict instead of destroyed. Deterministic TOCTOU test holds the store flock to pin the scan→delete window. | MEM-PR01-R1-04 (P2) | ✅ done (Red→Green→mutation) | +| **#13** Admission's explicit-config choice follows `MemoryConfig.load` precedence (memory.jsonc before memory.json); a jsonc/json fork inside the project directory is diagnosed as `config.conflict` instead of silently picking a side, and legacy configs equal only to the non-effective side are no longer deleted as duplicates. | MEM-PR01-R1-10 (P3) | ✅ done (Red→Green→mutation) | +| pin | `/memory on|off` creates/updates the config in the **project worktree** even when the instance context lives in another worktree (sandbox). | MEM-PR01-R1-07 (P2 test-gap) | ✅ pinned | +| pin | Runtime admission snapshot covers **every registered sandbox**: a legacy topic living only in a sandbox is imported on activation. | MEM-PR01-R1-23 (P3 test-gap) | ✅ pinned | diff --git a/packages/opencode/src/memory/admission.ts b/packages/opencode/src/memory/admission.ts index aed2e7b4b2..d12da3a0db 100644 --- a/packages/opencode/src/memory/admission.ts +++ b/packages/opencode/src/memory/admission.ts @@ -109,12 +109,28 @@ export const layer = Layer.effect( ).pipe(Effect.map((items) => items.flat().sort((left, right) => left.file.localeCompare(right.file)))) }) + // A legacy file may change between the scan and its removal (an older-version + // runtime still writing .opencode/memory, or a hand edit). Re-read each file + // right before deleting it; if the content no longer matches what was scanned, + // preserve the file and surface a conflict instead of destroying the new content. + const revalidateTopicFile = Effect.fnUntraced(function* (candidate: TopicCandidate) { + const text = yield* fs.readFileStringSafe(candidate.file) + if (text === undefined) return true + const parsed = yield* Effect.try({ + try: () => parse(text), + catch: () => undefined, + }).pipe(Effect.option) + if (Option.isNone(parsed) || parsed.value === undefined) return false + const decoded = MemoryStore.decodeTopic(parsed.value, candidate.id) + return decoded !== undefined && same(decoded, candidate.topic) + }) + const reconcileTopics = Effect.fnUntraced(function* (snapshot: ProjectSnapshot, candidates: TopicCandidate[]) { const updated = yield* store.updateTopics(snapshot.projectID, (topics) => { const next = [...topics] const byID = new Map(next.map((topic) => [topic.id, topic])) const changed: string[] = [] - const removable: string[] = [] + const removable: TopicCandidate[] = [] const diagnostics = candidates.map((candidate) => { if (!candidate.topic) return new Diagnostic({ @@ -128,7 +144,7 @@ export const layer = Layer.effect( next.push(candidate.topic) byID.set(candidate.id, candidate.topic) changed.push(candidate.id) - removable.push(candidate.file) + removable.push(candidate) return new Diagnostic({ code: "topic.imported", path: candidate.file, @@ -137,7 +153,7 @@ export const layer = Layer.effect( }) } if (same(existing, candidate.topic)) { - removable.push(candidate.file) + removable.push(candidate) return new Diagnostic({ code: "topic.duplicate", path: candidate.file, @@ -157,17 +173,40 @@ export const layer = Layer.effect( result: { diagnostics, removable }, } }) - yield* Effect.forEach(updated.result.removable, (file) => fs.remove(file, { force: true }), { - concurrency: 1, - discard: true, - }) - return updated.result.diagnostics + const preserved = new Set() + for (const candidate of updated.result.removable) { + if (!(yield* revalidateTopicFile(candidate))) preserved.add(candidate.file) + } + yield* Effect.forEach( + updated.result.removable.filter((candidate) => !preserved.has(candidate.file)), + (candidate) => fs.remove(candidate.file, { force: true }), + { + concurrency: 1, + discard: true, + }, + ) + return updated.result.diagnostics.map((diagnostic) => + preserved.has(diagnostic.path) + ? new Diagnostic({ + code: "topic.conflict", + path: diagnostic.path, + topic_id: diagnostic.topic_id, + message: `Legacy MEMORY topic ${diagnostic.topic_id} changed during migration and was preserved`, + }) + : diagnostic, + ) }) const readConfigCandidates = Effect.fnUntraced(function* (directories: ReadonlyArray) { const files = directories.flatMap((directory) => MemoryPaths.PROJECT_CONFIG_PATHS.map((relative) => join(directory, relative)), ) + // Keep the flatMap order (directory-major, and within one directory + // memory.jsonc BEFORE memory.json — exactly MemoryConfig.load's + // precedence). A localeCompare sort would flip jsonc/json and make + // admission disagree with the runtime loader about which file is + // authoritative. + const order = new Map(files.map((file, index) => [file, index])) return yield* Effect.forEach( files, (file) => @@ -185,11 +224,34 @@ export const layer = Layer.effect( Effect.map((items) => items .filter((item): item is ConfigCandidate => item !== undefined) - .sort((left, right) => left.file.localeCompare(right.file)), + .sort((left, right) => (order.get(left.file) ?? 0) - (order.get(right.file) ?? 0)), ), ) }) + // Same stale-scan protection as topics: a config file may change between the + // scan and its removal. Re-read and compare before deleting. + const revalidateConfigFile = Effect.fnUntraced(function* (candidate: ConfigCandidate) { + const text = yield* fs.readFileStringSafe(candidate.file) + if (text === undefined) return true + const decoded = MemoryConfig.decodeConfig(text) + if (Option.isNone(decoded)) return false + return same(MemoryConfig.normalizeConfig(decoded.value), candidate.config) + }) + + const removeValidated = Effect.fnUntraced(function* (candidates: ReadonlyArray) { + const preserved = new Set() + for (const candidate of candidates) { + if (!(yield* revalidateConfigFile(candidate))) preserved.add(candidate.file) + } + yield* Effect.forEach( + candidates.filter((candidate) => !preserved.has(candidate.file)), + (candidate) => fs.remove(candidate.file, { force: true }), + { concurrency: 1, discard: true }, + ) + return preserved + }) + const reconcileConfigs = Effect.fnUntraced(function* (snapshot: ProjectSnapshot) { const project = yield* readConfigCandidates([snapshot.projectDirectory]) const legacy = yield* readConfigCandidates( @@ -197,29 +259,73 @@ export const layer = Layer.effect( ) const explicit = project[0] if (explicit) { - const projectDiagnostic = explicit.config - ? [] - : [ + const diagnostics: Diagnostic[] = [] + if (!explicit.config) + diagnostics.push( + new Diagnostic({ + code: "config.invalid", + path: explicit.file, + message: "Project MEMORY config is invalid and was preserved", + }), + ) + // A project directory holding BOTH memory.jsonc and memory.json is a + // fork of the durable configuration: diagnose it explicitly instead of + // silently following one side. Equal copies collapse to a duplicate. + for (const extra of project.slice(1)) { + if (!extra.config || !explicit.config) { + diagnostics.push( new Diagnostic({ code: "config.invalid", - path: explicit.file, + path: extra.file, message: "Project MEMORY config is invalid and was preserved", }), - ] - const diagnostics = yield* Effect.forEach( - legacy, - (candidate) => { - if (candidate.config && explicit.config && same(candidate.config, explicit.config)) - return fs.remove(candidate.file, { force: true }).pipe( - Effect.as( - new Diagnostic({ + ) + } else if (same(extra.config, explicit.config)) { + const preserved = yield* removeValidated([extra]) + diagnostics.push( + preserved.has(extra.file) + ? new Diagnostic({ + code: "config.conflict", + path: extra.file, + message: "Project MEMORY config changed during migration and was preserved", + }) + : new Diagnostic({ + code: "config.duplicate", + path: extra.file, + message: "Project MEMORY config duplicates the authoritative config and was removed", + }), + ) + } else { + diagnostics.push( + new Diagnostic({ + code: "config.conflict", + path: extra.file, + message: "Project MEMORY config fork (jsonc/json) disagrees with the authoritative config and was preserved", + }), + ) + } + } + const duplicates = legacy.filter( + (candidate) => candidate.config && explicit.config && same(candidate.config, explicit.config), + ) + const preserved = yield* removeValidated(duplicates) + for (const candidate of legacy) { + if (duplicates.some((duplicate) => duplicate.file === candidate.file)) { + diagnostics.push( + preserved.has(candidate.file) + ? new Diagnostic({ + code: "config.conflict", + path: candidate.file, + message: "Legacy sandbox MEMORY config changed during migration and was preserved", + }) + : new Diagnostic({ code: "config.duplicate", path: candidate.file, message: "Legacy sandbox MEMORY config duplicates the Project config", }), - ), - ) - return Effect.succeed( + ) + } else { + diagnostics.push( new Diagnostic({ code: candidate.config ? "config.conflict" : "config.invalid", path: candidate.file, @@ -228,10 +334,9 @@ export const layer = Layer.effect( : "Legacy sandbox MEMORY config is invalid and was preserved", }), ) - }, - { concurrency: 1 }, - ) - return [...projectDiagnostic, ...diagnostics] + } + } + return diagnostics } const valid = legacy.filter( @@ -253,24 +358,25 @@ export const layer = Layer.effect( const promoted = valid[0] yield* config.writeProject(snapshot.projectDirectory, promoted.config) - yield* Effect.forEach(valid, (candidate) => fs.remove(candidate.file, { force: true }), { - concurrency: 1, - discard: true, - }) + const preserved = yield* removeValidated(valid) return legacy.map( (candidate) => new Diagnostic({ code: !candidate.config ? "config.invalid" - : candidate.file === promoted.file - ? "config.promoted" - : "config.duplicate", + : preserved.has(candidate.file) + ? "config.conflict" + : candidate.file === promoted.file + ? "config.promoted" + : "config.duplicate", path: candidate.file, message: !candidate.config ? "Legacy sandbox MEMORY config is invalid and was preserved" - : candidate.file === promoted.file - ? "Legacy sandbox MEMORY config was promoted to the Project config" - : "Legacy sandbox MEMORY config duplicates the promoted Project config", + : preserved.has(candidate.file) + ? "Legacy sandbox MEMORY config changed during migration and was preserved" + : candidate.file === promoted.file + ? "Legacy sandbox MEMORY config was promoted to the Project config" + : "Legacy sandbox MEMORY config duplicates the promoted Project config", }), ) }) diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index f5a05cfc08..b4de306c53 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -174,7 +174,12 @@ export const layer: Layer.Layer< const configuration = Effect.fn("Memory.configuration")(function* () { const ctx = yield* InstanceState.context - const current = (yield* project.get(ctx.project.id)) ?? ctx.project + // No fallback to the instance context: a missing row means the identity + // was retired by a concurrent upgrade (or never registered). Resurrecting + // the stale context identity would fork a Home under a retired Project — + // fail closed instead and stay inert. + const current = yield* project.get(ctx.project.id) + if (!current) return undefined // Fail-closed inertness for the shared global identity: every commit-less // repository resolves to the same ProjectV2.ID.global, so an active Memory // would share one Home across unrelated repositories and be orphaned by the diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index c15ce1dda3..16cdf0ce25 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -471,14 +471,20 @@ export const layer: Layer.Layer< projectID: ProjectV2.ID projectDirectory: string directory: string + directories: ReadonlyArray + initialized: boolean updated: number }) { - if (memoryAdmission) { + // Migration runs only for initialized projects (the memory path's own + // eligibility gate) and always against the COMPLETE directory snapshot: + // promoting a legacy config seen from a single directory could silently + // flip the project-wide effective config past disagreeing siblings. + if (memoryAdmission && input.initialized) { yield* memoryAdmission.invalidate(input.projectID) const memory = yield* memoryAdmission.ensure({ projectID: input.projectID, projectDirectory: input.projectDirectory, - directories: [input.directory], + directories: input.directories, updated: input.updated, }) if (memory.unresolved > 0) @@ -523,6 +529,8 @@ export const layer: Layer.Layer< projectID: ctx.project.id, projectDirectory: ctx.project.worktree, directory: entry.path, + directories: currentProject.sandboxes, + initialized: currentProject.time.initialized !== undefined, updated: currentProject.time.updated, }).pipe( Effect.mapError( @@ -699,6 +707,8 @@ export const layer: Layer.Layer< projectID: ctx.project.id, projectDirectory: ctx.project.worktree, directory: worktreePath, + directories: currentProject.sandboxes, + initialized: currentProject.time.initialized !== undefined, updated: currentProject.time.updated, }).pipe( Effect.mapError( diff --git a/packages/opencode/test/memory/memory-admission.test.ts b/packages/opencode/test/memory/memory-admission.test.ts index a0cc6b9130..0ab1ca8798 100644 --- a/packages/opencode/test/memory/memory-admission.test.ts +++ b/packages/opencode/test/memory/memory-admission.test.ts @@ -3,7 +3,7 @@ import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" -import { Effect, Layer } from "effect" +import { Duration, Effect, Fiber, Layer } from "effect" import path from "node:path" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" @@ -164,4 +164,107 @@ describe("MemoryAdmission", () => { }).pipe(Effect.provide(layers(root))) }), ) + + const fullLayers = (root: string) => { + const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + const flock = EffectFlock.defaultLayer + const base = Layer.mergeAll(FSUtil.defaultLayer, flock, home, MemoryConfig.defaultLayer) + const store = MemoryStore.layer.pipe(Layer.provide(base)) + const admission = MemoryAdmission.layer.pipe(Layer.provide(base), Layer.provide(store)) + return Layer.mergeAll(base, store, admission) + } + + it.live( + "preserves a legacy topic file whose content changes between the scan and the delete (MEM-PR01-R1-04)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service + const admission = yield* MemoryAdmission.Service + const store = yield* MemoryStore.Service + + const dir = path.join(primary, ".opencode", "memory", "topics") + const file = path.join(dir, "moving-topic.yaml") + yield* fs.makeDirectory(dir, { recursive: true }) + const original = topic("moving-topic") + yield* fs.writeFileString(file, Bun.YAML.stringify(original)) + + // Hold the store's project lock while ensure() runs: it scans first + // (reading the original), then blocks in updateTopics behind this lock. + // While it blocks, a concurrent writer that does not take the admission + // flock (older runtime, hand edit) replaces the file. When the lock is + // released the migration continues — the delete must then see the + // changed content and preserve the file instead of destroying it. + const ensureFiber = yield* flock.withLock( + Effect.gen(function* () { + const fiber = yield* admission + .ensure({ projectID, projectDirectory: primary, directories: [primary], updated: 1 }) + .pipe(Effect.forkDetach) + yield* Effect.sleep(Duration.millis(500)) + const modified = { ...original, summary: "迁移进行中被并发写入的新摘要" } + yield* fs.writeFileString(file, Bun.YAML.stringify(modified)) + return fiber + }), + `memory-project:${projectID}`, + home.locks, + ) + const result = yield* Fiber.join(ensureFiber) + + expect(yield* fs.existsSafe(file)).toBe(true) + expect(result.diagnostics.some((item) => item.code === "topic.conflict")).toBe(true) + // The scanned version still landed in Project Memory exactly once. + const snapshot = yield* store.readSnapshot(projectID) + expect(snapshot.topics.filter((value) => value.id === "moving-topic")).toHaveLength(1) + }).pipe(Effect.provide(fullLayers(root))) + }), + { timeout: 30_000 }, + ) + + it.live( + "follows the loader's jsonc-over-json precedence and diagnoses an in-project config fork (MEM-PR01-R1-10)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + + const configA = { ...config, model: "test/config-jsonc" } + const configB = { ...config, model: "test/config-json" } + const opencode = path.join(primary, ".opencode") + yield* fs.makeDirectory(opencode, { recursive: true }) + // The loader (MemoryConfig.load) prefers memory.jsonc; admission must + // agree, and the disagreeing memory.json must be diagnosed as a fork + // instead of silently becoming authoritative. + yield* fs.writeFileString(path.join(opencode, "memory.jsonc"), JSON.stringify(configA)) + yield* fs.writeFileString(path.join(opencode, "memory.json"), JSON.stringify(configB)) + // A sandbox legacy config equal to the NON-effective json content must + // not be deleted as a duplicate of the effective config. + const sandboxFile = path.join(sandbox, ".opencode", "memory.jsonc") + yield* fs.makeDirectory(path.dirname(sandboxFile), { recursive: true }) + yield* fs.writeFileString(sandboxFile, JSON.stringify(configB)) + + const result = yield* admission.ensure({ + projectID, + projectDirectory: primary, + directories: [primary, sandbox], + updated: 1, + }) + + const fork = result.diagnostics.filter((item) => item.path.endsWith("memory.json")) + expect(fork.length).toBe(1) + expect(fork[0].code).toBe("config.conflict") + expect(result.diagnostics.some((item) => item.path === sandboxFile && item.code === "config.conflict")).toBe(true) + expect(yield* fs.existsSafe(sandboxFile)).toBe(true) + expect(result.unresolved).toBeGreaterThan(0) + }).pipe(Effect.provide(fullLayers(root))) + }), + { timeout: 30_000 }, + ) }) diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index 2bb55cd9ed..99f007fdd8 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -1,11 +1,14 @@ import { describe, expect } from "bun:test" import { Database } from "@opencode-ai/core/database/database" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { eq } from "drizzle-orm" import { ModelV2 } from "@opencode-ai/core/model" import { ProjectV2 } from "@opencode-ai/core/project" import { ProviderV2 } from "@opencode-ai/core/provider" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Effect, Layer } from "effect" +import { stringify } from "yaml" import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process" import fs from "node:fs" import path from "node:path" @@ -21,6 +24,7 @@ import { MemoryStore } from "@/memory/store" import { Project } from "@/project/project" import { MessageID, PartID, SessionID } from "@/session/schema" import { ProviderTest } from "../fake/provider" +import { InstanceRef } from "@/effect/instance-ref" import { provideInstance, testInstanceStoreLayer, tmpdirScoped } from "../fixture/fixture" import { testEffect } from "../lib/effect" @@ -133,6 +137,142 @@ function gitInitWithoutCommit(dir: string) { }) } +describe("MEM-PR01-R1-03: memory is inert once the identity row is retired", () => { + it.live( + "a stale process whose project row was deleted by a concurrent upgrade does not fork a retired Home", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped({ git: true }) + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + const { db } = yield* Database.Service + + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).not.toBe(ProjectV2.ID.global) + yield* project.setInitialized(info.id) + yield* configStore.writeGlobal(baseConfig) + + const sessionID = SessionID.make("ses_retired_identity") + const active = yield* memory.search({ sessionID, messages: [userMessage(sessionID)], query: "任意查询" }) + expect(active.status).not.toBe("unavailable") + + // A long-running process holds a context stamped while the row + // existed. Read the stamped row, then let another process complete + // an identity upgrade: the old row is deleted. + const stamped = yield* project.get(info.id) + expect(stamped?.time.initialized).toBeDefined() + yield* db.delete(ProjectTable).where(eq(ProjectTable.id, info.id)).run().pipe(Effect.orDie) + + yield* Effect.provideService(InstanceRef, { directory: dir, worktree: info.worktree, project: stamped! })( + Effect.gen(function* () { + const retired = yield* memory.search({ sessionID, messages: [userMessage(sessionID)], query: "任意查询" }) + expect(retired.status).toBe("unavailable") + expect(yield* memory.setEnabled(true)).toBe("Memory remains off") + }), + ) + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) +}) + +describe("MEM-PR01-R1-23: the runtime admission snapshot covers every registered sandbox", () => { + it.live( + "a legacy topic living only in a registered sandbox is imported on activation", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + const store = yield* MemoryStore.Service + + const { project: info } = yield* project.fromDirectory(dir) + yield* project.setInitialized(info.id) + yield* project.addSandbox(info.id, sandbox) + yield* configStore.writeGlobal(baseConfig) + + // The only legacy topic lives in the sandbox, not the primary. + const legacyDir = path.join(sandbox, ".opencode", "memory", "topics") + fs.mkdirSync(legacyDir, { recursive: true }) + const seeded = topic() + fs.writeFileSync(path.join(legacyDir, `${seeded.id}.yaml`), stringify(seeded)) + + // Activation (any product surface) must admit the FULL snapshot — + // primary plus every registered sandbox. + const sessionID = SessionID.make("ses_sandbox_snapshot") + yield* memory.search({ sessionID, messages: [userMessage(sessionID)], query: "架构边界" }) + + const snapshot = yield* store.readSnapshot(info.id) + expect(snapshot.topics.map((value) => value.id)).toContain(seeded.id) + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) +}) + +describe("MEM-PR01-R1-07: /memory writes the Project config to the primary directory", () => { + it.live( + "enabling memory from a non-primary instance context still writes to the project worktree", + () => + Effect.gen(function* () { + const dir = yield* tmpdirScoped({ git: true }) + const elsewhere = yield* tmpdirScoped() + yield* provideInstance(dir)( + Effect.gen(function* () { + const project = yield* Project.Service + const memory = yield* Memory.Service + const configStore = yield* MemoryConfig.Service + + const { project: info } = yield* project.fromDirectory(dir) + yield* project.setInitialized(info.id) + const stamped = (yield* project.get(info.id))! + // Memory activates from a DISABLED global config (no project config + // yet): enabling must then CREATE the project config. Write the + // global file directly because writeGlobal is a no-op over an + // existing valid config. Clean it up afterwards so later tests see + // a fresh global state. + const globalFile = path.join(MemoryConfig.globalConfigDir(), "memory.jsonc") + fs.mkdirSync(path.dirname(globalFile), { recursive: true }) + fs.writeFileSync(globalFile, JSON.stringify({ ...baseConfig, enabled: false })) + yield* Effect.addFinalizer(() => + Effect.sync(() => { + fs.rmSync(globalFile, { force: true }) + }), + ) + + // The instance context lives in a different worktree than the + // project primary (a registered sandbox); the config must still + // land in the project worktree, not the context's worktree. + yield* Effect.provideService(InstanceRef, { + directory: elsewhere, + worktree: elsewhere, + project: stamped, + })( + Effect.gen(function* () { + expect(yield* memory.setEnabled(true)).toBe("Memory on") + }), + ) + + const written = yield* configStore.load(info.worktree) + expect(written?.config.enabled).toBe(true) + expect(written?.level).toBe("project") + expect(fs.existsSync(path.join(elsewhere, ".opencode", "memory.jsonc"))).toBe(false) + }), + ).pipe(Effect.provide(testInstanceStoreLayer)) + }), + { timeout: 30_000 }, + ) +}) + describe("MEM-PR01-00: memory is inert under the shared global identity", () => { it.live( "search reports unavailable for a commit-less repository even when global config enables memory and the shared bucket holds topics", diff --git a/packages/opencode/test/project/worktree-remove.test.ts b/packages/opencode/test/project/worktree-remove.test.ts index e4e99f78b5..b78dd610b8 100644 --- a/packages/opencode/test/project/worktree-remove.test.ts +++ b/packages/opencode/test/project/worktree-remove.test.ts @@ -2,7 +2,8 @@ import { $ } from "bun" import { describe, expect } from "bun:test" import * as fs from "fs/promises" import path from "path" -import { Effect, Layer } from "effect" +import { Effect, Exit, Layer } from "effect" +import { stringify } from "yaml" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { Worktree } from "../../src/worktree" import { Project } from "../../src/project/project" @@ -127,4 +128,111 @@ describe("Worktree.remove", () => { }), { git: true }, ) + + const exists = (file: string) => + Effect.promise(() => + fs + .stat(file) + .then(() => true) + .catch(() => false), + ) + + const legacyConfig = (model: string, enabled: boolean) => + JSON.stringify({ + schema_version: 1, + enabled, + model, + topic_limit: 10, + topic_limit_floor: 10, + turn_interval: 5, + injection: { max_topics: 3, max_tokens: 1_200 }, + }) + + it.instance( + "removing one worktree does not promote a lone sandbox config past disagreeing siblings (MEM-PR01-R1-06)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const current = yield* project.fromDirectory(root) + yield* project.setInitialized(current.project.id) + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `promote-a-${stamp}`) + const dirB = path.join(root, "..", `promote-b-${stamp}`) + yield* Effect.promise(() => $`git worktree add --no-checkout -b opencode/promote-a-${stamp} ${dirA}`.cwd(root).quiet()) + yield* Effect.promise(() => $`git worktree add --no-checkout -b opencode/promote-b-${stamp} ${dirB}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + yield* project.addSandbox(current.project.id, dirB) + + // Two sandboxes carry disagreeing legacy configs; the primary has none. + yield* Effect.promise(() => Bun.write(path.join(dirA, ".opencode", "memory.jsonc"), legacyConfig("test/config-a", false))) + yield* Effect.promise(() => Bun.write(path.join(dirB, ".opencode", "memory.jsonc"), legacyConfig("test/config-b", true))) + + // Removing A must reconcile against the FULL snapshot: A's lone config + // disagrees with B's, so nothing may be promoted and the removal fails + // closed instead of silently flipping the project-wide configuration. + const outcome = yield* Effect.exit(svc.remove({ directory: dirA })) + expect(Exit.isFailure(outcome)).toBe(true) + expect(yield* exists(path.join(root, ".opencode", "memory.jsonc"))).toBe(false) + expect(yield* exists(path.join(dirA, ".opencode", "memory.jsonc"))).toBe(true) + }), + { git: true }, + ) + + it.instance( + "worktree removal on an uninitialized project performs no memory migration (MEM-PR01-R1-08)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const current = yield* project.fromDirectory(root) + // Deliberately NOT initialized: the spec keeps uninitialized projects inert. + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `inert-${stamp}`) + yield* Effect.promise(() => $`git worktree add --no-checkout -b opencode/inert-${stamp} ${dirA}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + + const now = "2026-08-12T00:00:00Z" + const legacyTopic = stringify({ + schema_version: 1, + id: "legacy-topic", + name: "遗留主题", + summary: "工作树中遗留的合法主题", + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: now, + updated_at: now, + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "legacy-item", + kind: "decision", + content: "已确认决定：核心模块之间使用稳定边界", + rationale: "该边界由用户确认并长期适用", + confirmed_at: now, + }, + ], + }) + yield* Effect.promise(() => Bun.write(path.join(dirA, ".opencode", "memory", "topics", "legacy-topic.yaml"), legacyTopic)) + + // No migration may run for an uninitialized project: the legacy file + // stays put and the removal fails closed on the residue. + const outcome = yield* Effect.exit(svc.remove({ directory: dirA })) + expect(Exit.isFailure(outcome)).toBe(true) + expect(yield* exists(path.join(dirA, ".opencode", "memory", "topics", "legacy-topic.yaml"))).toBe(true) + }), + { git: true }, + ) }) diff --git a/packages/opencode/test/project/worktree.test.ts b/packages/opencode/test/project/worktree.test.ts index 20bc6b000c..f1a8c5e114 100644 --- a/packages/opencode/test/project/worktree.test.ts +++ b/packages/opencode/test/project/worktree.test.ts @@ -351,6 +351,9 @@ describe("Worktree", () => { Effect.gen(function* () { const fs = yield* FSUtil.Service const svc = yield* Worktree.Service + const ctx = yield* InstanceState.context + const project = yield* Project.Service + yield* project.setInitialized(ctx.project.id) const memory = path.join(info.directory, ".opencode", "memory", "topics", "project.yaml") yield* fs.makeDirectory(path.dirname(memory), { recursive: true }) yield* fs.writeFileString(memory, "id: project\n") @@ -380,6 +383,7 @@ describe("Worktree", () => { const project = yield* Project.Service const store = yield* MemoryStore.Service const svc = yield* Worktree.Service + yield* project.setInitialized(ctx.project.id) const home = MemoryHome.make(Global.Path.data) const projectHome = home.directory(ctx.project.id) const legacy = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") @@ -546,6 +550,8 @@ describe("Worktree", () => { const ctx = yield* InstanceState.context const svc = yield* Worktree.Service const store = yield* MemoryStore.Service + const project = yield* Project.Service + yield* project.setInitialized(ctx.project.id) const home = MemoryHome.make(Global.Path.data) const projectHome = home.directory(ctx.project.id) const topic = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") @@ -578,6 +584,8 @@ describe("Worktree", () => { const fs = yield* FSUtil.Service const svc = yield* Worktree.Service const store = yield* MemoryStore.Service + const project = yield* Project.Service + yield* project.setInitialized(ctx.project.id) const home = MemoryHome.make(Global.Path.data) const projectHome = home.directory(ctx.project.id) const legacy = path.join(info.directory, ".opencode", "memory", "topics", "project-architecture.yaml") From f6fc23e13128802d0d2e3c496593e6ce5eed0191 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 16:33:23 +0800 Subject: [PATCH 13/34] fix(worktree): make list() non-destructive and move worktree cleanup to remove (MEM-PR01 M-D) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1-16 (blocking): list() ran `git worktree prune` and deregistered sandboxes for every merely-prunable entry. "prunable" does not prove a worktree is gone — git also marks inaccessible directories (unmounted volume, locked parent) and broken gitdir links whose directories still exist, so a read call could destroy git admin data and live registrations. list() is now a pure observation path: prunable entries stay hidden from the listing but are otherwise untouched. The destructive cleanup moves to the action path, where each case can be proven: - remove() gains a prunable branch: reconcile legacy memory fail-closed, prune the admin data, remove the directory if it still exists, delete the branch, drop the registration. - remove() gains a git-unknown recovery branch (R1-18): a registered worktree with no git record previously failed forever with a false "not registered" error and no remediation; it now reconciles legacy memory fail-closed and drops the stale registration without ever deleting the directory. - Registration cleanup drops every canonically-equal entry, not just the first — symlinked paths (/var vs /private/var) could register the same worktree twice and leave a zombie entry that broke serialized removal. Pins (both mutation-proven): - R1-17: reset fails closed over invalid legacy memory and preserves it. - R1-19 (blocking): reset/remove invalidate the admission cache before the rescan; a reset-primed clean cache must never hide a legacy file that appears before a later destructive operation. - Updated the prune-era list test to the new semantics (list hides but does not touch; explicit remove cleans up). - Domain regression: memory+project suites 180 pass / 0 fail; opencode+core typecheck clean; lint ratchet unchanged (0 new warnings). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 9 + packages/opencode/src/worktree/index.ts | 101 ++++++++--- .../test/project/worktree-remove.test.ts | 161 +++++++++++++++++- .../opencode/test/project/worktree.test.ts | 13 +- 4 files changed, 257 insertions(+), 27 deletions(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 6aa08c883b..620163fd90 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -220,3 +220,12 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor | **#13** Admission's explicit-config choice follows `MemoryConfig.load` precedence (memory.jsonc before memory.json); a jsonc/json fork inside the project directory is diagnosed as `config.conflict` instead of silently picking a side, and legacy configs equal only to the non-effective side are no longer deleted as duplicates. | MEM-PR01-R1-10 (P3) | ✅ done (Red→Green→mutation) | | pin | `/memory on|off` creates/updates the config in the **project worktree** even when the instance context lives in another worktree (sandbox). | MEM-PR01-R1-07 (P2 test-gap) | ✅ pinned | | pin | Runtime admission snapshot covers **every registered sandbox**: a legacy topic living only in a sandbox is imported on activation. | MEM-PR01-R1-23 (P3 test-gap) | ✅ pinned | + +### M-D additions (worktree lifecycle findings, 2026-08-12) + +| Fix | Finding | Status | +|---|---|---| +| **#14** `list()` is a pure observation path: no more unconditional `git worktree prune` + deregistration on merely-prunable entries (git also marks inaccessible directories and broken gitdir links prunable while the directory still exists). Prunable entries stay hidden from the listing but otherwise untouched. | MEM-PR01-R1-16 (P2, blocking) | ✅ done (Red→Green→mutation) | +| **#15** Destructive cleanup moved to the action path: `remove()` gains a prunable branch (prune admin data + remove directory if present + branch cleanup + drop registrations) and a git-unknown recovery branch (registered but no git record: reconcile fail-closed, drop the stale registration, never delete the directory). Registration cleanup drops ALL canonically-equal entries (symlinked /var vs /private/var duplicates). | MEM-PR01-R1-18 (P3) + serialization regression | ✅ done (Red→Green→mutation) | +| pin | reset fails closed over invalid legacy memory and preserves it. | MEM-PR01-R1-17 (P2 test-gap) | ✅ pinned (mutation-proven) | +| pin | reset/remove invalidate the admission cache before the rescan (deterministic TOCTOU via reset-primed cache). | MEM-PR01-R1-19 (P2 test-gap, blocking) | ✅ pinned (mutation-proven) | diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index 16cdf0ce25..e8b362e2c5 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -351,6 +351,18 @@ export const layer: Layer.Layer< )).find((sandbox) => sandbox.candidate === key)?.sandbox }) + // All registrations canonically equal to `directory` — symlinked paths + // (/var vs /private/var) can register the same worktree twice; cleanup must + // drop every equivalent entry, not just the first match. + const registeredSandboxes = Effect.fnUntraced(function* (sandboxes: string[], directory: string) { + const key = yield* canonical(directory) + const matches: string[] = [] + for (const sandbox of sandboxes) { + if ((yield* canonical(sandbox)) === key) matches.push(sandbox) + } + return matches + }) + function parseWorktreeList(text: string) { return text .split("\n") @@ -395,25 +407,12 @@ export const layer: Layer.Layer< } const entries = parseWorktreeList(result.text) - const prunable = entries.flatMap((entry) => (entry.prunable && entry.path ? [entry.path] : [])) - if (prunable.length > 0) { - const pruned = yield* git(["worktree", "prune"], { cwd: ctx.worktree }) - if (pruned.code !== 0) - return yield* new ListFailedError({ - message: pruned.stderr || pruned.text || "Failed to prune stale git worktrees", - }) - const current = (yield* project.get(ctx.project.id)) ?? ctx.project - yield* Effect.forEach( - prunable, - (directory) => - Effect.gen(function* () { - const sandbox = yield* registeredSandbox(current.sandboxes, directory) - if (sandbox) yield* project.removeSandbox(ctx.project.id, sandbox) - }), - { concurrency: 1, discard: true }, - ) - } - + // list() is an observation path: it must never prune or deregister. + // "prunable" does not prove a worktree is gone — git also marks merely + // inaccessible directories (unmounted volume, locked parent) and broken + // gitdir links whose directories still exist. Pruning there destroys git + // admin data and live registrations. Cleanup belongs to remove/reset, + // which can prove each case. const primary = yield* canonical(ctx.project.worktree) const primaryName = pathSvc.basename(primary).toLowerCase() return yield* Effect.forEach(entries, (entry) => @@ -510,10 +509,15 @@ export const layer: Layer.Layer< } const currentProject = (yield* project.get(ctx.project.id)) ?? ctx.project - const registered = yield* registeredSandbox(currentProject.sandboxes, directory) - if (!registered) { + const matches = yield* registeredSandboxes(currentProject.sandboxes, directory) + if (matches.length === 0) { return yield* new RemoveFailedError({ message: "Worktree is not registered with this Project" }) } + const dropRegistrations = Effect.forEach( + matches, + (match) => project.removeSandbox(ctx.project.id, match), + { concurrency: 1, discard: true }, + ) const list = yield* git(["worktree", "list", "--porcelain"], { cwd: ctx.worktree }) if (list.code !== 0) { @@ -522,7 +526,28 @@ export const layer: Layer.Layer< const entry = yield* locateWorktree(parseWorktreeList(list.text), directory) if (!entry?.path) { - return yield* new RemoveFailedError({ message: "Worktree is not registered with this Project" }) + // Registered, but git has no record of the worktree (admin data lost or + // the git side was already removed). Recover deterministically instead + // of failing with a false "not registered": legacy memory is reconciled + // fail-closed against the directory when it still exists, then the stale + // registration is dropped. The directory itself is never deleted here. + const blocker = yield* reconcileLegacyMemory({ + projectID: ctx.project.id, + projectDirectory: ctx.project.worktree, + directory, + directories: currentProject.sandboxes, + initialized: currentProject.time.initialized !== undefined, + updated: currentProject.time.updated, + }).pipe( + Effect.mapError( + (error) => new RemoveFailedError({ message: `Failed to migrate legacy project memory: ${error.message}` }), + ), + ) + if (blocker) return yield* new RemoveFailedError({ message: blocker }) + yield* FiberMap.remove(bootFibers, directory) + yield* store.disposeDirectory(directory) + yield* dropRegistrations + return true } const blocker = yield* reconcileLegacyMemory({ @@ -539,6 +564,34 @@ export const layer: Layer.Layer< ) if (blocker) return yield* new RemoveFailedError({ message: blocker }) + if (entry.prunable) { + // git already considers this worktree gone (directory deleted, or a + // broken gitdir link). The destructive cleanup belongs on this action + // path — never on list(): prune the admin data, remove the directory if + // it still exists, then drop the registration(s). + yield* FiberMap.remove(bootFibers, directory) + yield* store.disposeDirectory(entry.path) + yield* git(["worktree", "prune"], { cwd: ctx.worktree }) + if (yield* fs.existsSafe(entry.path)) yield* cleanDirectory(entry.path) + const prunedBranch = entry.branch?.replace(/^refs\/heads\//, "") + if (prunedBranch) { + const deleted = yield* git(["branch", "-D", prunedBranch], { cwd: ctx.worktree }) + if (deleted.code !== 0) { + const restored = yield* git(["worktree", "add", entry.path, prunedBranch], { cwd: ctx.worktree }) + if (restored.code !== 0) yield* dropRegistrations + const recovery = + restored.code === 0 + ? "the worktree registration was restored" + : `the worktree could not be restored and its Project registration was removed: ${restored.stderr || restored.text}` + return yield* new RemoveFailedError({ + message: `Failed to delete worktree branch: ${deleted.stderr || deleted.text}; ${recovery}`, + }) + } + } + yield* dropRegistrations + return true + } + yield* FiberMap.remove(bootFibers, directory) if (settingsHook) { @@ -578,7 +631,7 @@ export const layer: Layer.Layer< const deleted = yield* git(["branch", "-D", branch], { cwd: ctx.worktree }) if (deleted.code !== 0) { const restored = yield* git(["worktree", "add", entry.path, branch], { cwd: ctx.worktree }) - if (restored.code !== 0) yield* project.removeSandbox(ctx.project.id, registered) + if (restored.code !== 0) yield* dropRegistrations const recovery = restored.code === 0 ? "the worktree registration was restored" @@ -589,7 +642,7 @@ export const layer: Layer.Layer< } } - yield* project.removeSandbox(ctx.project.id, registered) + yield* dropRegistrations return true }) diff --git a/packages/opencode/test/project/worktree-remove.test.ts b/packages/opencode/test/project/worktree-remove.test.ts index b78dd610b8..217920a725 100644 --- a/packages/opencode/test/project/worktree-remove.test.ts +++ b/packages/opencode/test/project/worktree-remove.test.ts @@ -5,12 +5,15 @@ import path from "path" import { Effect, Exit, Layer } from "effect" import { stringify } from "yaml" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { MemoryStore } from "@/memory/store" import { Worktree } from "../../src/worktree" import { Project } from "../../src/project/project" import { TestInstance } from "../fixture/fixture" import { testEffect } from "../lib/effect" -const it = testEffect(Layer.mergeAll(Worktree.defaultLayer, Project.defaultLayer, CrossSpawnSpawner.defaultLayer)) +const it = testEffect( + Layer.mergeAll(Worktree.defaultLayer, Project.defaultLayer, CrossSpawnSpawner.defaultLayer, MemoryStore.defaultLayer), +) const wintest = process.platform === "win32" ? it.instance : it.instance.skip describe("Worktree.remove", () => { @@ -235,4 +238,160 @@ describe("Worktree.remove", () => { }), { git: true }, ) + + const legacyTopicYaml = (id: string) => + stringify({ + schema_version: 1, + id, + name: "生命周期测试主题", + summary: "用于验证工作树生命周期行为的主题", + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["边界"], + related_topics: [], + created_at: "2026-08-12T00:00:00Z", + updated_at: "2026-08-12T00:00:00Z", + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: `${id}-item`, + kind: "decision", + content: `已确认决定：保留 ${id} 的稳定边界`, + rationale: "该边界由用户确认并长期适用", + confirmed_at: "2026-08-12T00:00:00Z", + }, + ], + }) + + it.instance( + "list never prunes or deregisters a merely-prunable worktree (MEM-PR01-R1-16)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const current = yield* project.fromDirectory(root) + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `prunable-${stamp}`) + yield* Effect.promise(() => $`git worktree add -b opencode/prunable-${stamp} ${dirA}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + + // Break the gitdir link: git now reports the entry as prunable even + // though the directory still exists. + const adminDir = path.join(root, ".git", "worktrees", `prunable-${stamp}`) + yield* Effect.promise(() => fs.writeFile(path.join(adminDir, "gitdir"), "/nonexistent/gitdir-link\n")) + const porcelain = yield* Effect.promise(() => $`git worktree list --porcelain`.cwd(root).quiet().text()) + expect(porcelain).toContain("prunable") + + yield* svc.list() + + // Observation must not destroy: git admin data and the registration + // both survive a list() that saw a prunable entry. + expect(yield* exists(path.join(adminDir, "gitdir"))).toBe(true) + const after = yield* project.get(current.project.id) + expect(after?.sandboxes.some((sandbox) => sandbox === dirA)).toBe(true) + }), + { git: true }, + ) + + it.instance( + "remove recovers a registered worktree whose git admin data is gone (MEM-PR01-R1-18)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const current = yield* project.fromDirectory(root) + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `zombie-${stamp}`) + yield* Effect.promise(() => $`git worktree add -b opencode/zombie-${stamp} ${dirA}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + + // Lose the git admin data while the directory survives. + yield* Effect.promise(() => + fs.rm(path.join(root, ".git", "worktrees", `zombie-${stamp}`), { recursive: true, force: true }), + ) + + expect(yield* svc.remove({ directory: dirA })).toBe(true) + const after = yield* project.get(current.project.id) + expect(after?.sandboxes.some((sandbox) => sandbox === dirA)).toBe(false) + // Registration cleanup must never delete the directory itself. + expect(yield* exists(dirA)).toBe(true) + }), + { git: true }, + ) + + it.instance( + "reset invalidates the admission cache before rescanning legacy memory (MEM-PR01-R1-19)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const store = yield* MemoryStore.Service + const current = yield* project.fromDirectory(root) + yield* project.setInitialized(current.project.id) + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `cache-a-${stamp}`) + const dirB = path.join(root, "..", `cache-b-${stamp}`) + yield* Effect.promise(() => $`git worktree add -b opencode/cache-a-${stamp} ${dirA}`.cwd(root).quiet()) + yield* Effect.promise(() => $`git worktree add -b opencode/cache-b-${stamp} ${dirB}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + yield* project.addSandbox(current.project.id, dirB) + + // Prime the admission cache with a clean full-snapshot scan. + yield* svc.reset({ directory: dirB }) + + // A legacy topic appears in A after the cached clean scan; the reset of + // A must invalidate the cache and rescan, importing it before the sweep. + const legacyDir = path.join(dirA, ".opencode", "memory", "topics") + yield* Effect.promise(() => fs.mkdir(legacyDir, { recursive: true })) + yield* Effect.promise(() => + fs.writeFile(path.join(legacyDir, "cache-topic.yaml"), legacyTopicYaml("cache-topic")), + ) + + const outcome = yield* Effect.exit(svc.reset({ directory: dirA })) + expect(Exit.isSuccess(outcome)).toBe(true) + const topics = yield* store.readTopics(current.project.id) + expect(topics.map((value) => value.id)).toContain("cache-topic") + }), + { git: true }, + ) + + it.instance( + "reset fails closed over invalid legacy memory and preserves it (MEM-PR01-R1-17)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const current = yield* project.fromDirectory(root) + yield* project.setInitialized(current.project.id) + + const stamp = Date.now().toString(36) + const dirA = path.join(root, "..", `resetblock-${stamp}`) + yield* Effect.promise(() => $`git worktree add -b opencode/resetblock-${stamp} ${dirA}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dirA) + + const legacyDir = path.join(dirA, ".opencode", "memory", "topics") + yield* Effect.promise(() => fs.mkdir(legacyDir, { recursive: true })) + const invalidFile = path.join(legacyDir, "broken.yaml") + yield* Effect.promise(() => fs.writeFile(invalidFile, "id: broken\n")) + + const outcome = yield* Effect.exit(svc.reset({ directory: dirA })) + expect(Exit.isFailure(outcome)).toBe(true) + if (Exit.isFailure(outcome)) expect(String(outcome.cause)).toContain("topic.invalid") + expect(yield* exists(invalidFile)).toBe(true) + }), + { git: true }, + ) }) diff --git a/packages/opencode/test/project/worktree.test.ts b/packages/opencode/test/project/worktree.test.ts index f1a8c5e114..b58a974fce 100644 --- a/packages/opencode/test/project/worktree.test.ts +++ b/packages/opencode/test/project/worktree.test.ts @@ -706,7 +706,7 @@ describe("Worktree", () => { ) it.instance( - "prunes missing worktrees and removes their Project registration", + "hides a missing worktree in list and cleans it up on explicit remove", () => withCreatedWorktree(undefined, ({ info }) => Effect.gen(function* () { @@ -716,9 +716,18 @@ describe("Worktree", () => { const svc = yield* Worktree.Service yield* fs.remove(info.directory, { recursive: true }) + // list() is non-destructive: the entry is hidden from the listing + // but the git admin data and registration stay untouched. expect((yield* svc.list()).map((item) => item.directory)).not.toContain(info.directory) + expect(yield* git(ctx.worktree, ["worktree", "list", "--porcelain"])).toContain(info.directory) + expect((yield* project.get(ctx.project.id))?.sandboxes.length).toBeGreaterThan(0) + + // Explicit remove does the cleanup: prune admin data, drop the + // registration. + expect(yield* svc.remove({ directory: info.directory })).toBe(true) expect(yield* git(ctx.worktree, ["worktree", "list", "--porcelain"])).not.toContain(info.directory) - expect((yield* project.get(ctx.project.id))?.sandboxes).not.toContain(info.directory) + const after = yield* project.get(ctx.project.id) + expect(after?.sandboxes.some((sandbox) => sandbox === info.directory)).toBe(false) }), ), { git: true }, From 5506755d971b00cbfad3e4fcea6db09348d74552 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 16:50:52 +0800 Subject: [PATCH 14/34] =?UTF-8?q?test(memory):=20pin=20store=20resilience?= =?UTF-8?q?=20=E2=80=94=20corrupt-manifest=20fail-closed,=20item=5Fcount,?= =?UTF-8?q?=20torn-commit=20(MEM-PR01=20M-E)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1-02 (P2 test-gap): the corrupt-manifest fail-closed guards had no test, so reverting them would let migrateHome delete an unread Memory Home. Now pinned: an invalid manifest and a manifest referencing a missing generation both fail readSnapshot, and migrateHome fails closed on the merge path with the source Home preserved. Both guards proven load-bearing by mutation (fail-open revert turns the test Red). R1-20 (P3 test-gap): decodeTopic item_count/items.length consistency was only covered by a since-deleted test. Re-pinned at both the decoder and the writeSnapshot generation gate (mutation-proven). R1-21 (P3 test-gap): a crash mid-writeSnapshot leaves an orphaned staging generation whose manifest was never published; pinned that it never shadows the committed generation and the store still commits cleanly (mutation-proven). Test-only change; no production code touched. - memory+project suites 183 pass / 0 fail; opencode+core typecheck clean; lint ratchet unchanged (0 new warnings). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 8 ++ .../test/memory/memory-persistence.test.ts | 89 ++++++++++++++++++- 2 files changed, 96 insertions(+), 1 deletion(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 620163fd90..4fa78da7c2 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -229,3 +229,11 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor | **#15** Destructive cleanup moved to the action path: `remove()` gains a prunable branch (prune admin data + remove directory if present + branch cleanup + drop registrations) and a git-unknown recovery branch (registered but no git record: reconcile fail-closed, drop the stale registration, never delete the directory). Registration cleanup drops ALL canonically-equal entries (symlinked /var vs /private/var duplicates). | MEM-PR01-R1-18 (P3) + serialization regression | ✅ done (Red→Green→mutation) | | pin | reset fails closed over invalid legacy memory and preserves it. | MEM-PR01-R1-17 (P2 test-gap) | ✅ pinned (mutation-proven) | | pin | reset/remove invalidate the admission cache before the rescan (deterministic TOCTOU via reset-primed cache). | MEM-PR01-R1-19 (P2 test-gap, blocking) | ✅ pinned (mutation-proven) | + +### M-E additions (store resilience pins, 2026-08-12) + +| Fix | Finding | Status | +|---|---|---| +| **#16** Corrupt-manifest fail-closed reads are now Red-tested: an invalid manifest and a manifest referencing a missing generation both fail `readSnapshot`, and `migrateHome` fails closed on the merge path without deleting the unread source Home. Both fail-closed guards proven load-bearing by mutation (fail-open revert → the test Red). | MEM-PR01-R1-02 (P2 test-gap) | ✅ pinned (mutation-proven) | +| pin | `decodeTopic` rejects Topics whose `item_count` disagrees with `items.length`; the store refuses to publish such a generation. | MEM-PR01-R1-20 (P3 test-gap) | ✅ pinned (mutation-proven) | +| pin | An orphaned staging generation (crash mid-`writeSnapshot`, manifest never published) never shadows the committed generation; the store still commits cleanly afterwards. | MEM-PR01-R1-21 (P3 test-gap) | ✅ pinned (mutation-proven) | diff --git a/packages/opencode/test/memory/memory-persistence.test.ts b/packages/opencode/test/memory/memory-persistence.test.ts index c9f91e3a5c..56fcd27539 100644 --- a/packages/opencode/test/memory/memory-persistence.test.ts +++ b/packages/opencode/test/memory/memory-persistence.test.ts @@ -3,7 +3,7 @@ import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" -import { Effect, Layer, Schema } from "effect" +import { Effect, Exit, Layer, Schema } from "effect" import path from "node:path" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" @@ -602,4 +602,91 @@ describe("Project-owned MEMORY persistence", () => { }).pipe(Effect.provide(layers(root))) }), ) + + it.live( + "fails closed on a corrupt manifest and never deletes the unread Home (MEM-PR01-R1-02)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + // Both identities hold Memory so the migration takes the merge path + // (the rename fast path never deletes anything). + yield* replaceTopics(store, projectID, [topic()]) + yield* replaceTopics(store, otherProjectID, [topic("新身份的主题")]) + + // (a) invalid manifest JSON + yield* fs.writeFileString(home.manifest(projectID), "{ not json") + expect(Exit.isFailure(yield* Effect.exit(store.readSnapshot(projectID)))).toBe(true) + const invalid = yield* Effect.exit(migration.migrateHome(projectID, otherProjectID)) + expect(Exit.isFailure(invalid)).toBe(true) + expect(yield* fs.exists(home.directory(projectID))).toBe(true) + + // (b) manifest referencing a generation that does not exist + yield* fs.writeFileString( + home.manifest(projectID), + JSON.stringify({ schema_version: 1, revision: 1, generation: "1-deadbeef" }) + "\n", + ) + expect(Exit.isFailure(yield* Effect.exit(store.readSnapshot(projectID)))).toBe(true) + const missing = yield* Effect.exit(migration.migrateHome(projectID, otherProjectID)) + expect(Exit.isFailure(missing)).toBe(true) + expect(yield* fs.exists(home.directory(projectID))).toBe(true) + }).pipe( + Effect.provide( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + ), + ) + }), + ) + + it.live( + "rejects Topics whose item_count disagrees with their items (MEM-PR01-R1-20)", + () => + Effect.gen(function* () { + const base = topic() + const drifted = { ...base, metadata: { ...base.metadata, item_count: base.items.length + 1 } } + expect(MemoryStore.decodeTopic(drifted, drifted.id)).toBeUndefined() + + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const exit = yield* Effect.exit(replaceTopics(store, projectID, [drifted])) + expect(Exit.isFailure(exit)).toBe(true) + expect(yield* store.readTopics(projectID)).toEqual([]) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live( + "an orphaned staging generation never shadows the committed generation (MEM-PR01-R1-21)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + + // Simulate a crash mid-writeSnapshot: a staging generation exists but + // its manifest was never published. + const staging = path.join(home.generations(projectID), ".2-orphaned.tmp") + yield* fs.makeDirectory(staging, { recursive: true }) + yield* fs.writeFileString(path.join(staging, "orphan.yaml"), "id: orphan\n") + + expect(yield* store.readTopics(projectID)).toEqual([value]) + // The store still commits cleanly afterwards. + const next = topic("第二版边界") + yield* replaceTopics(store, projectID, [next]) + expect(yield* store.readTopics(projectID)).toEqual([next]) + }).pipe(Effect.provide(layers(root))) + }), + ) }) From 8c91cbd0e356b8baee569b910570f21156006943 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 17:20:54 +0800 Subject: [PATCH 15/34] fix(memory): serialize MEMORY config file writers per file; pin cross-process commit conflict (MEM-PR01 M-F) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R2-02: the branch collapses MEMORY config onto one project-primary file, written by three paths under mutually disjoint locks — /memory on|off (in-process KeyedMutex), admission promotion (memory-admission flock), and readConfig's normalization rewrite (no lock). atomicWrite prevents torn bytes but not whole-document last-writer-wins across worktrees/processes. All config file writes now serialize on a per-file cross-process flock (memory-config:): writeProject, writeGlobal, and the normalization rewrite. Pinned by a blocking-observation test; mutation-proven (dropping the lock lets a concurrent writer complete while the lock is held). Residual, documented rather than fixed (Occam): decision-level read-modify-write across processes is not CAS-protected — only the write primitives are serialized. A full cross-process RMW protocol would be over-engineering for the exposure. R2-03: the cross-process commit protocol's explicit-conflict guarantee (ADR-0002) was only exercised within one process. A new spawned-worker test commits with a stale expectedRevision from a second OS process and observes CommitConflictError deterministically (the pre-existing updateTopics race test only overlaps probabilistically). - memory+project suites 185 pass / 0 fail; opencode+core typecheck clean; lint ratchet unchanged (0 new warnings). Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 7 ++ packages/opencode/src/memory/config.ts | 35 ++++++--- .../test/fixture/memory-commit-worker.ts | 75 ++++++++++++++++++ .../test/memory/memory-persistence.test.ts | 77 ++++++++++++++++++- 4 files changed, 184 insertions(+), 10 deletions(-) create mode 100644 packages/opencode/test/fixture/memory-commit-worker.ts diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 4fa78da7c2..3d69af22f1 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -237,3 +237,10 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor | **#16** Corrupt-manifest fail-closed reads are now Red-tested: an invalid manifest and a manifest referencing a missing generation both fail `readSnapshot`, and `migrateHome` fails closed on the merge path without deleting the unread source Home. Both fail-closed guards proven load-bearing by mutation (fail-open revert → the test Red). | MEM-PR01-R1-02 (P2 test-gap) | ✅ pinned (mutation-proven) | | pin | `decodeTopic` rejects Topics whose `item_count` disagrees with `items.length`; the store refuses to publish such a generation. | MEM-PR01-R1-20 (P3 test-gap) | ✅ pinned (mutation-proven) | | pin | An orphaned staging generation (crash mid-`writeSnapshot`, manifest never published) never shadows the committed generation; the store still commits cleanly afterwards. | MEM-PR01-R1-21 (P3 test-gap) | ✅ pinned (mutation-proven) | + +### M-F additions (config concurrency findings, 2026-08-12) + +| Fix | Finding | Status | +|---|---|---| +| **#17** All writers of a MEMORY config file now serialize on a per-file cross-process flock (`memory-config:`): `writeProject`, `writeGlobal`, and the normalization rewrite in `readConfig`. atomicWrite's byte-atomicity is no longer undermined by whole-document last-writer-wins between `/memory on|off`, admission promotion, and normalization rewrites across worktrees/processes. Pinned by a blocking-observation test (mutation-proven: dropping the lock lets the concurrent writer complete during the hold). Residual (documented, not fixed — Occam): decision-level read-modify-write across processes is not CAS-protected; only the write primitives are serialized. | MEM-PR01-R2-02 (P3, newly-exposed) | ✅ done (Red→Green→mutation) | +| **#18** Cross-process commit protocol now has a real second-process test: a spawned worker commits with a stale expectedRevision and must observe `MemoryStore.CommitConflictError` (ADR-0002's explicit-conflict guarantee), deterministic — unlike the timing-probabilistic updateTopics race test. | MEM-PR01-R2-03 (P3 test-gap) | ✅ pinned | diff --git a/packages/opencode/src/memory/config.ts b/packages/opencode/src/memory/config.ts index 31eaa35c5f..4d1b641edf 100644 --- a/packages/opencode/src/memory/config.ts +++ b/packages/opencode/src/memory/config.ts @@ -2,6 +2,7 @@ export * as MemoryConfig from "./config" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { Flag } from "@opencode-ai/core/flag/flag" import { FSUtil } from "@opencode-ai/core/fs-util" import { Global } from "@opencode-ai/core/global" @@ -20,14 +21,17 @@ export type Loaded = { } export interface Interface { - readonly load: (projectDir: string) => Effect.Effect - readonly loadGlobal: () => Effect.Effect + readonly load: (projectDir: string) => Effect.Effect + readonly loadGlobal: () => Effect.Effect readonly writeProject: ( projectDir: string, config: MemorySchema.Config, existingPath?: string, - ) => Effect.Effect - readonly writeGlobal: (config: MemorySchema.Config, existingPath?: string) => Effect.Effect + ) => Effect.Effect + readonly writeGlobal: ( + config: MemorySchema.Config, + existingPath?: string, + ) => Effect.Effect } export class Service extends Context.Service()("@opencode/MemoryConfig") {} @@ -37,6 +41,7 @@ export const layer = Layer.effect( Effect.gen(function* () { const fs = yield* FSUtil.Service const git = yield* Git.Service + const flock = yield* EffectFlock.Service const ensureProjectExclude = Effect.fnUntraced(function* (projectDir: string) { const result = yield* git.run(["rev-parse", "--git-path", "info/exclude"], { cwd: projectDir }) @@ -68,7 +73,7 @@ export const layer = Layer.effect( } if (decoded.value.topic_limit === decoded.value.topic_limit_floor) return decoded.value const config = normalizeConfig(decoded.value) - yield* MemoryFile.atomicWrite(fs, found.path, serialize(config)) + yield* flock.withLock(MemoryFile.atomicWrite(fs, found.path, serialize(config)), writeLockKey(found.path)) return config }) @@ -97,7 +102,13 @@ export const layer = Layer.effect( existingPath?: string, ) { yield* ensureProjectExclude(projectDir) - yield* MemoryFile.atomicWrite(fs, existingPath ?? projectPath(projectDir), serialize(config)) + // One Project = one shared policy file, written by several paths + // (/memory on|off, admission promotion, normalization rewrites) from + // multiple worktrees and processes. Serialize the writes on the target + // file so atomicWrite's byte-atomicity is not undermined by + // whole-document last-writer-wins. + const target = existingPath ?? projectPath(projectDir) + yield* flock.withLock(MemoryFile.atomicWrite(fs, target, serialize(config)), writeLockKey(target)) }) const writeGlobal = Effect.fn("MemoryConfig.writeGlobal")(function* ( @@ -105,14 +116,14 @@ export const layer = Layer.effect( existingPath?: string, ) { if (existingPath && globalCandidates().includes(existingPath)) { - yield* MemoryFile.atomicWrite(fs, existingPath, serialize(config)) + yield* flock.withLock(MemoryFile.atomicWrite(fs, existingPath, serialize(config)), writeLockKey(existingPath)) return true } const file = join(globalConfigDir(), "memory.jsonc") const found = yield* readFirst(globalCandidates()) if (found) { if (yield* readConfig(found)) return false - yield* MemoryFile.atomicWrite(fs, found.path, serialize(config)) + yield* flock.withLock(MemoryFile.atomicWrite(fs, found.path, serialize(config)), writeLockKey(found.path)) return true } yield* fs.makeDirectory(dirname(file), { recursive: true }) @@ -128,10 +139,16 @@ export const layer = Layer.effect( export const defaultLayer = layer.pipe( Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), Layer.provide(Git.defaultLayer.pipe(Layer.provide(CrossSpawnSpawner.defaultLayer))), ) -export const node = LayerNode.make(layer, [FSUtil.node, Git.node]) +export const node = LayerNode.make(layer, [FSUtil.node, EffectFlock.node, Git.node]) + +/** Cross-process serialization key for writes to one MEMORY config file. */ +export function writeLockKey(file: string) { + return `memory-config:${file}` +} export function projectPath(projectDir: string) { return join(projectDir, ".opencode", "memory.jsonc") diff --git a/packages/opencode/test/fixture/memory-commit-worker.ts b/packages/opencode/test/fixture/memory-commit-worker.ts new file mode 100644 index 0000000000..492dd43470 --- /dev/null +++ b/packages/opencode/test/fixture/memory-commit-worker.ts @@ -0,0 +1,75 @@ +import { FSUtil } from "@opencode-ai/core/fs-util" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Cause, Effect, Exit, Layer, Schema } from "effect" +import { MemoryHome } from "@/memory/home" +import { MemoryStore } from "@/memory/store" + +const Input = Schema.Struct({ + root: Schema.String, + projectID: Schema.String, + ready: Schema.String, + go: Schema.String, + expectedRevision: Schema.Number, + summary: Schema.String, +}) + +const input = Schema.decodeUnknownSync(Input)(JSON.parse(process.argv[2] ?? "{}")) +const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(input.root)) +const store = MemoryStore.layer.pipe( + Layer.provide(FSUtil.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), +) + +await Effect.runPromise( + Effect.gen(function* () { + const memory = yield* MemoryStore.Service + const projectID = ProjectV2.ID.make(input.projectID) + yield* Effect.promise(() => Bun.write(input.ready, String(process.pid))) + while (!(yield* Effect.promise(() => Bun.file(input.go).exists()))) yield* Effect.sleep("5 millis") + + const staleTopic = { + schema_version: 1, + id: "project-architecture", + name: "架构边界", + summary: input.summary, + metadata: { + categories: ["decision"], + status: "active", + importance: "core", + keywords: ["架构"], + related_topics: [], + created_at: "2026-08-11T00:00:00Z", + updated_at: "2026-08-11T00:00:00Z", + last_matched_at: null, + match_count: 0, + revision: 1, + item_count: 1, + }, + items: [ + { + id: "decision-stale", + kind: "decision", + content: "已确认决定：这是一次陈旧修订的提交", + rationale: "该决定由用户确认并长期适用", + confirmed_at: "2026-08-11T00:00:00Z", + }, + ], + } as const + + const exit = yield* Effect.exit( + memory.commit(projectID, input.expectedRevision, { + topics: [staleTopic], + changed: [staleTopic.id], + deleted: [], + }), + ) + // Exit 0 only when the commit failed with the explicit conflict error — + // anything else (success, other failure) reports a broken protocol. + if (Exit.isFailure(exit) && Cause.pretty(exit.cause).includes("MemoryStore.CommitConflict")) { + process.exit(0) + } + process.exit(1) + }).pipe(Effect.provide(store)), +) diff --git a/packages/opencode/test/memory/memory-persistence.test.ts b/packages/opencode/test/memory/memory-persistence.test.ts index 56fcd27539..d4141c2dab 100644 --- a/packages/opencode/test/memory/memory-persistence.test.ts +++ b/packages/opencode/test/memory/memory-persistence.test.ts @@ -3,7 +3,7 @@ import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" -import { Effect, Exit, Layer, Schema } from "effect" +import { Effect, Exit, Fiber, Layer, Ref, Schema } from "effect" import path from "node:path" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" @@ -663,6 +663,81 @@ describe("Project-owned MEMORY persistence", () => { }), ) + it.live( + "serializes project config writes on a per-file lock (MEM-PR01-R2-02)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + yield* Effect.gen(function* () { + const flock = yield* EffectFlock.Service + const fs = yield* FSUtil.Service + const configStore = yield* MemoryConfig.Service + const target = MemoryConfig.projectPath(primary) + + // Hold the file's write lock; a concurrent writeProject must queue + // behind it and may only complete after the release. + const done = yield* Ref.make(false) + const writerCell = yield* Ref.make | undefined>(undefined) + // Hold the file's write lock; a writer forked while the lock is held + // must stay blocked until the lock is released at the end of withLock. + yield* flock.withLock( + Effect.gen(function* () { + const writer = yield* Effect.gen(function* () { + yield* configStore.writeProject(primary, config) + yield* Ref.set(done, true) + }).pipe(Effect.forkDetach) + yield* Ref.set(writerCell, writer) + yield* Effect.sleep("300 millis") + expect(yield* Ref.get(done)).toBe(false) + }), + MemoryConfig.writeLockKey(target), + ) + const writer = (yield* Ref.get(writerCell))! + yield* Fiber.join(writer) + expect(yield* Ref.get(done)).toBe(true) + expect(yield* fs.existsSafe(target)).toBe(true) + }).pipe(Effect.provide(Layer.mergeAll(layers(root), EffectFlock.defaultLayer))) + }), + { timeout: 20_000 }, + ) + + it.live( + "a second process committing a stale revision observes the explicit conflict (MEM-PR01-R2-03)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const coordination = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const store = yield* MemoryStore.Service + const value = topic() + yield* replaceTopics(store, projectID, [value]) + + const go = path.join(coordination, "go") + const ready = path.join(coordination, "stale.ready") + const child = Bun.spawn([ + process.execPath, + path.join(import.meta.dir, "../fixture/memory-commit-worker.ts"), + JSON.stringify({ + root, + projectID, + ready, + go, + expectedRevision: 0, + summary: "跨进程的陈旧修订", + }), + ]) + while (!(yield* Effect.promise(() => Bun.file(ready).exists()))) yield* Effect.sleep("5 millis") + yield* Effect.promise(() => Bun.write(go, "go")) + + // Exit 0 means the worker observed CommitConflictError — the explicit + // cross-process conflict guarantee of the commit protocol. + expect(yield* Effect.promise(() => child.exited)).toBe(0) + expect(yield* store.readSnapshot(projectID)).toEqual({ revision: 1, topics: [value] }) + }).pipe(Effect.provide(layers(root))) + }), + ) + it.live( "an orphaned staging generation never shadows the committed generation (MEM-PR01-R1-21)", () => From 2382186f9c5168e707da10dec3488a630121379a Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 17:34:37 +0800 Subject: [PATCH 16/34] docs(memory): align CONTEXT.md and redo plan with the shipped Occam design (MEM-PR01 M-G) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1-01 (blocking): CONTEXT.md still shipped the rejected ADR-0004 authority design as the domain's governing self-doc. Rewritten to the actual authority structure (Store/Config/Admission/migrateHome/worktree guard + project identity migration): rejected-design glossary and invariants removed (Identity Alias, Canonical Project ID, tombstone retirement, opaque Revision, destruction guard); source Home described as migrate-then-remove with retention deferred; Project Configuration described as the unversioned .opencode/memory.jsonc; the read-leniency split stated (runtime read projects empty, strict reads and migration fail closed); ADR-0001's policy clause restored as live; ADR-0004 marked Rejected; the M-A…M-F behaviors reflected (global inertness, content-only conflicts, non-destructive list, fail-closed reset/remove, per-file config lock). R1-25: redo-plan internal consistency — header status no longer says PLANNING; the §10 resume protocol is marked superseded (no pending autonomous fix, only user decisions remain). R1-09 (spec-gap → decision): the git-exclusion narrowing to the two config candidates is intentional and now documented: preserved fail-closed legacy topic files stay visible in git status and committable; surfacing repair- pending files beats silently excluding user data. R1-14 (spec-gap → requirement): the openspec workspace is untracked, so this plan now carries the identity-upgrade requirement ("Identity upgrade preserves Project Memory and Project-owned references") with its scenarios, pinned by the M-A/M-B/M-C/M-E tests. Docs-only; no production code touched. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 13 ++++- packages/opencode/src/memory/CONTEXT.md | 54 ++++++++++--------- 2 files changed, 41 insertions(+), 26 deletions(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 3d69af22f1..6385dc5d37 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -1,7 +1,7 @@ # Memory Authority Redo Plan — from `d7b011738` Date: 2026-08-12. Worktree: `/private/tmp/oc-dag-wt-lifecycle` (branch `chore/worktree-lifecycle-audit`). -Status: PLANNING (awaiting user confirmation before any implementation/loop). +Status: ADR-0004 **Rejected**; Occam path (§10) **adopted and implemented** (#1 done; #2 deferred by user; #3/#4 closed as non-gaps). The two-round MEM-PR01 review then landed fixes/pins #5–#18 below. Nothing is left to implement autonomously; remaining items are user decisions (#2 typed-error cascade, source-Home retention/GC). ## 0. Why this plan exists @@ -207,7 +207,7 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor **Explicitly cut by Occam** (do NOT build): MEM-ATOMIC-10 (Policy stays in `.opencode/memory.jsonc`; memory is topic content); the authority facade, 6-phase journal, alias tombstone, opaque Revision, destruction guard, crash harness; MEM-CRASH-06 as a forward-journal state machine (POSIX `rename` + the store's generation/manifest atomicity cover content; `migrateHome` can be made idempotent if a crash-retry need is shown). -**Resume protocol (replaces §8 steps 3–4):** do the next pending Fix in order (#2 → #3 → #4). Per fix: re-read exact baseline → implement → `cd packages/opencode && bun typecheck` AND `cd packages/core && bun typecheck` → targeted test (package dir ONLY) → mutation gate (temp-revert ⇒ a real test flips Red, restore) → `git commit` (conventional) → update this §10 table. Exclusions unchanged: no Goal/DAG-config/CI/push/PR, no source-Home GC. +**Resume protocol (replaces §8 steps 3–4):** ~~do the next pending Fix in order (#2 → #3 → #4)~~ — SUPERSEDED: #1 done, #3/#4 closed (then #3 reopened by the MEM-PR01 review and fixed by construction), #5–#18 done/pinned by the MEM-PR01 slices. There is **no pending autonomous fix**. The only open items are user decisions: #2 (typed-error cascade — approved deferred as MEM-TYPED-02) and source-Home retention/GC. Per-slice discipline (kept for future work): re-read exact baseline → implement → `cd packages/opencode && bun typecheck` AND `cd packages/core && bun typecheck` → targeted test (package dir ONLY) → mutation gate (temp-revert ⇒ a real test flips Red, restore) → `git commit` (conventional) → update this plan. Exclusions unchanged: no Goal/DAG-config/CI, no source-Home GC, no dev→main/release. ### M-C additions (two-round review findings, 2026-08-12) @@ -244,3 +244,12 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor |---|---|---| | **#17** All writers of a MEMORY config file now serialize on a per-file cross-process flock (`memory-config:`): `writeProject`, `writeGlobal`, and the normalization rewrite in `readConfig`. atomicWrite's byte-atomicity is no longer undermined by whole-document last-writer-wins between `/memory on|off`, admission promotion, and normalization rewrites across worktrees/processes. Pinned by a blocking-observation test (mutation-proven: dropping the lock lets the concurrent writer complete during the hold). Residual (documented, not fixed — Occam): decision-level read-modify-write across processes is not CAS-protected; only the write primitives are serialized. | MEM-PR01-R2-02 (P3, newly-exposed) | ✅ done (Red→Green→mutation) | | **#18** Cross-process commit protocol now has a real second-process test: a spawned worker commits with a stale expectedRevision and must observe `MemoryStore.CommitConflictError` (ADR-0002's explicit-conflict guarantee), deterministic — unlike the timing-probabilistic updateTopics race test. | MEM-PR01-R2-03 (P3 test-gap) | ✅ pinned | + +### M-G additions (documentation alignment, 2026-08-12) + +| Item | Finding | Resolution | +|---|---|---| +| **#19** `packages/opencode/src/memory/CONTEXT.md` rewritten to the shipped Occam design: rejected-design glossary/invariants removed (Identity Alias, Canonical Project ID, tombstone retirement, opaque Revision, destruction guard); source Home described as migrate-then-remove (retention deferred); Project Configuration described as the unversioned `.opencode/memory.jsonc` (not Home-versioned); read-leniency split stated (runtime read projects empty; strict reads/migration fail closed); ADR-0001 policy clause restored as live; ADR-0004 marked Rejected; M-A…M-F behaviors reflected (global inertness, content-only conflicts, non-destructive list, fail-closed reset/remove, per-file config lock). | MEM-PR01-R1-01 (P3, blocking) | ✅ done | +| **#20** Redo-plan internal consistency: header status no longer says PLANNING; the §10 resume protocol is marked superseded (no pending autonomous fix; only user decisions remain). | MEM-PR01-R1-25 (P3) | ✅ done | +| **#21 (decision)** Git-exclusion narrowing is intentional and documented here: `ensureProjectExclude` installs only the two config candidates, not `.opencode/memory/`. Legacy topic files preserved fail-closed (topic.invalid/topic.conflict) are therefore visible in `git status` and committable. Trade-off accepted: surfacing repair-pending files beats silently git-excluding user data; the delta spec drops the old scenario and the test pins the narrowed behavior. | MEM-PR01-R1-09 (P3 spec-gap) | ✅ decision recorded | +| **#22 (requirement)** Identity-upgrade requirement recorded (the openspec workspace is untracked, so this plan carries it): **Identity upgrade preserves Project Memory and Project-owned references.** Scenarios: (a) root→first-remote migrates the Memory Home before the old Project row is deleted and repoints session/workspace/workflow/permission references; (b) a successor permission colliding on (project_id,action,resource) wins without wedging; (c) merge (not fork) when the successor already has Memory, content-conflicts fail closed; (d) crash mid-migration retries to convergence; (e) global identity is inert. Pinned by the M-A/M-B/M-C/M-E tests. | MEM-PR01-R1-14 (P3 spec-gap) | ✅ requirement recorded | diff --git a/packages/opencode/src/memory/CONTEXT.md b/packages/opencode/src/memory/CONTEXT.md index 3b104992a2..cc95f18b7b 100644 --- a/packages/opencode/src/memory/CONTEXT.md +++ b/packages/opencode/src/memory/CONTEXT.md @@ -8,23 +8,30 @@ Project Memory preserves user-confirmed, durable human context for one Project. - **Memory never forks.** Memory is core, topic-typed content; worktrees (small PRs) must not branch it into per-worktree copies. - **An identity upgrade is imperceptible.** When a repo gains its first remote (root → first-remote identity), the user's Memory endures seamlessly — nothing the user notices is lost, moved, or forked. +## Authority structure (Occam path, adopted 2026-08-12) + +The domain runs on the existing seams; the elaborate `ProjectMemoryAuthority` redesign (ADR-0004) was **Rejected**. The authoritative pieces are: + +- **MemoryStore** (`store.ts`) — generation+manifest persistence for Topics. Strict reads (`readSnapshot`/`inspectTopics`) fail closed on a corrupt or missing generation; the runtime read (`readTopics`) is lenient and projects empty. +- **MemoryConfig** (`config.ts`) — the unversioned `.opencode/memory.jsonc` policy. Writes serialize on a per-file cross-process flock (`memory-config:`). +- **MemoryAdmission** (`admission.ts`) — the single legacy-input seam: scans one Project snapshot, reconciles once, caches only conflict-free results. +- **MemoryIdentityMigration** (`identity-migration.ts`) — `migrateHome(oldID, newID)`: rename when the target is absent, merge-then-remove otherwise; fails closed on conflict or an unread source. +- **Worktree guard** (`worktree/index.ts`) — `list()` is a pure observation path; `remove`/`reset` reconcile legacy memory fail-closed against the full directory snapshot and always invalidate the admission cache first. +- **Project identity migration** (`project/project.ts` `migrateProjectId`) — memory first, then the DB transaction that repoints session/workspace/workflow/permission references before deleting the old row. + ## Glossary | Term | Meaning | | --- | --- | | Project Memory | The authoritative durable Topic set owned by one Project identity and shared by all of that Project's worktrees. | -| Memory Home | The Project-scoped persistence boundary for Project Memory. Its identity follows the Project, not a checkout path. | +| Memory Home | The Project-scoped persistence boundary for Project Memory, keyed by Project identity (`memory/projects/`). | | Topic | A bounded structured collection of confirmed preferences, decisions, or terms with controller-owned metadata. | | Legacy Worktree Memory | Memory files stored inside a checkout by an older runtime. They are migration inputs, never a second authoritative store. | -| Memory Conflict | A case where legacy and Project Memory claim the same logical identity with different valid content, or where legacy configuration differs from the Project configuration. | -| Project Configuration | The MEMORY policy owned by the Project and shared by its worktrees. Under ADR-0004 it lives in the Memory Home, atomically versioned with Topics; worktree/global config files are admission candidates only. | +| Memory Conflict | A case where legacy and Project Memory claim the same logical identity with different **content**, or where legacy configuration differs from the effective Project configuration. Controller metadata drift is not a conflict. | +| Project Configuration | The MEMORY policy owned by the Project's primary directory (`.opencode/memory.jsonc`). It is unversioned; writes are serialized per file, not atomic with Topics. | | Memory Admission | The single legacy input seam that scans one Project snapshot, reconciles it once, and caches only conflict-free results. | -| Identity Alias | A durable old→new Project identity tombstone owned by `ProjectIdentity`. Every Memory read and mutation resolves it before choosing a Home or lock. | -| Requested Project ID | A Project ID held by a caller. It may already be retired and therefore is not an ownership key. | -| Canonical Project ID | The current terminal Project ID that owns Project Memory. Resolved inside the Project Memory authority and not supplied by callers. | -| Identity Retirement | A forward-only replacement of one Project ID by its successor while preserving one logical Project and all Project-owned state — merge into one Memory, not a fork. | -| Project Merge | A product operation that combines two independently owned Projects. Identity Retirement never performs an implicit Project Merge. | -| Project Memory Revision | An opaque version of one Project Memory snapshot, including Topics, Project Configuration, topology, and admission inputs. | +| Identity upgrade | The one-way transition when a repo gains a durable identity (root → first-remote, or a changed remote). Memory is migrated before the old Project row is deleted; nothing is forked. | +| Global identity | The shared fallback identity of commit-less repositories. Memory is fail-closed **inert** under it: one Project = one Memory, and a shared bucket would leak across repos and orphan at the first commit. | ## Invariants @@ -33,29 +40,28 @@ Project Memory preserves user-confirmed, durable human context for one Project. - Current user input and higher-priority instructions always override retrieved Memory. - The controller owns persistence, metadata, migration, limits, and atomicity; models only propose bounded semantic actions. - Migration writes a durable authoritative copy before treating a legacy copy as consumed. -- A Memory Conflict is explicit and fail-closed; no component silently chooses or overwrites conflicting durable context. -- Removing or resetting a worktree cannot imply deleting Project Memory. +- A Memory Conflict is explicit and fail-closed; no component silently chooses or overwrites conflicting durable context. Content equality ignores controller-owned metadata (`last_matched_at`, `match_count`, `revision`, `updated_at`). +- Removing or resetting a worktree cannot imply deleting Project Memory, and never deletes the user's worktree directory as a side effect of registration cleanup. - Removing Project Memory requires a separate Project retention decision. -- Runtime reads never perform ad-hoc legacy migration; they consume a Project snapshot admitted by the Project Memory authority. -- Project identity retirement validates the full transition before durable state changes, prepares the successor while preserving the source, publishes one identity commit point (the tombstone), and completes Project-owned reference migration by forward recovery. -- Routine Project Memory commands resolve identity, acquire one canonical Project commit right, and recheck identity before reading or writing. -- A missing Memory Home is empty; an existing corrupt Home is an error and is never projected as an empty Topic set. -- Project configuration and Topic mutations publish under one generation, one manifest, and one opaque Revision, in the same cross-process Project lock. -- Application callers never receive canonical IDs, Home paths, locks, cache keys, or migration callbacks. -- A revision issued before Identity Retirement cannot commit after the identity commit point. -- Destructive Memory Admission always observes current candidate files; it never trusts a process-local success cache. -- The retired source Home is preserved as a non-authoritative backup; its GC is a separate, deferred decision. +- Runtime reads never perform ad-hoc legacy migration; they consume a Project snapshot admitted by Memory Admission. +- Memory is inert under the global identity and for uninitialized projects; activation requires a real, initialized identity. +- Identity upgrade migrates Memory first, repoints every Project-owned reference (session, workspace, workflow, permission), and only then retires the old row. A successor permission that collides on `(project_id, action, resource)` wins; the duplicate is dropped, never wedged. +- A missing Memory Home is empty. A corrupt or dangling Home fails closed on strict reads and migration (the source is never deleted unread); the lenient runtime read projects it as empty rather than erroring. +- Worktree `list()` observes and never mutates: it does not prune git admin data or drop registrations for merely-prunable entries. Destructive cleanup belongs to `remove`/`reset`, which prove each case first. +- Worktree `remove`/`reset` reconcile legacy memory fail-closed against the **complete** directory snapshot (primary + every registered sandbox) and always invalidate the admission cache before rescanning; they never trust a cached clean result. +- Legacy files are re-read and compared immediately before deletion; content that changed after the scan is preserved and surfaced as a conflict. +- Every writer of a MEMORY config file serializes on the file's cross-process lock; byte-atomicity is not undermined by whole-document last-writer-wins. ## Boundaries -- The Project Memory authority obtains identity, the primary checkout, and every registered worktree from durable Project state; callers provide only a requested Project ID. -- Worktree lifecycle requests destructive admission as one command through the internal destruction guard; it does not invalidate caches, assemble snapshots, or own Project Memory retention. +- Worktree lifecycle assembles the directory snapshot and invalidates the admission cache before reconciling; it does not own Topic persistence or Project retention. - Session runtime may retrieve and attach bounded Memory context, but it does not own Topic persistence. - Codebase discovery belongs to codebase-memory facilities and is rejected from Project Memory. +- Source-Home retention/GC after migration is a deferred product decision; the current behavior is migrate-then-remove. ## Decisions -- [ADR-0001: Project identity owns Memory](docs/adr/0001-project-owned-memory.md) *(Policy-source clause superseded by ADR-0004)* +- [ADR-0001: Project identity owns Memory](docs/adr/0001-project-owned-memory.md) - [ADR-0002: Project Memory commits are versioned and process-safe](docs/adr/0002-project-memory-commit-protocol.md) - [ADR-0003: Legacy Memory enters through Project admission](docs/adr/0003-memory-admission.md) -- [ADR-0004: Project Memory authority owns identity and commits](docs/adr/0004-project-memory-authority.md) — **Proposed (P0, awaiting approval)** +- [ADR-0004: Project Memory authority owns identity and commits](docs/adr/0004-project-memory-authority.md) — **Rejected (2026-08-12)** in favor of the Occam path recorded in `docs/memory-authority-redo-plan-2026-08-12.md` §10. From c5584bbb7d2d9b6fbd12087e159d309533d2e0bf Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 20:43:52 +0800 Subject: [PATCH 17/34] =?UTF-8?q?fix(memory):=20close=20Round=203/4=20P2?= =?UTF-8?q?=20findings=20=E2=80=94=20identity-lock=20protocol,=20scoped=20?= =?UTF-8?q?prune,=20proof-after-hook=20(MEM-PR01=20M-H)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R3-P2-a in-flight old-identity writer could recreate a retired Home: writers (prepare/search/checkpoint) now hold a cross-process memory-identity: flock around their whole read-modify-write and re-check identity liveness inside it; migrateHome takes the same identity lock inside the sorted pair lock, so it waits for in-flight writers and moves their writes with the Home. Lock order admission -> migrate(pair) -> identity -> project is cycle-free. R3-P2-d git worktree prune is repo-global; it now runs only when the removed entry is the sole prunable one (else stale admin data is left for explicit cleanup), so sibling worktrees' admin data is not destroyed. R3-P2-e the WorktreeRemove hook now fires BEFORE the reconcile proof on all remove paths, so the proof observes everything the hook produced. R3-P2-f remove/reset no longer fall back to the stale instance identity (?? ctx.project); they fail closed when the identity row is gone. R3-P2-b cleanupLegacyDirectory re-checks the listing immediately before removing each dir. Pins (mutation-proven): SourceChanged verify-before-delete guard (R3-P2-c); store write paths fail closed on a corrupt manifest (R4-P2-a); unresolved admission results are never cached (R4-P2-b). Docs: ADR-0002 updated to the three-phase merge + identity-lock protocol; rejected ADR-0004 no longer claims to supersede live clauses; redo-plan #3 ABBA narrative corrected. Also drops two no-op non-null assertions (session/summary.ts, format/index.ts) surfaced by type-aware churn from the identity-migration FK fix, returning the tree to the 4852 lint ratchet with no behavior change. Co-Authored-By: Claude --- docs/memory-authority-redo-plan-2026-08-12.md | 26 ++- packages/opencode/src/format/index.ts | 2 +- packages/opencode/src/memory/admission.ts | 18 +- .../0002-project-memory-commit-protocol.md | 2 +- .../docs/adr/0004-project-memory-authority.md | 2 +- .../opencode/src/memory/identity-migration.ts | 10 +- packages/opencode/src/memory/memory.ts | 200 +++++++++++------- packages/opencode/src/session/summary.ts | 2 +- packages/opencode/src/worktree/index.ts | 68 ++++-- .../memory/memory-global-identity.test.ts | 2 + .../test/memory/memory-persistence.test.ts | 104 +++++++++ packages/opencode/test/memory/memory.test.ts | 4 + 12 files changed, 330 insertions(+), 110 deletions(-) diff --git a/docs/memory-authority-redo-plan-2026-08-12.md b/docs/memory-authority-redo-plan-2026-08-12.md index 6385dc5d37..aa5fc070b6 100644 --- a/docs/memory-authority-redo-plan-2026-08-12.md +++ b/docs/memory-authority-redo-plan-2026-08-12.md @@ -1,7 +1,7 @@ # Memory Authority Redo Plan — from `d7b011738` Date: 2026-08-12. Worktree: `/private/tmp/oc-dag-wt-lifecycle` (branch `chore/worktree-lifecycle-audit`). -Status: ADR-0004 **Rejected**; Occam path (§10) **adopted and implemented** (#1 done; #2 deferred by user; #3/#4 closed as non-gaps). The two-round MEM-PR01 review then landed fixes/pins #5–#18 below. Nothing is left to implement autonomously; remaining items are user decisions (#2 typed-error cascade, source-Home retention/GC). +Status: ADR-0004 **Rejected**; Occam path (§10) **adopted and implemented** (#1 done; #2 deferred by user; #4 closed as non-gap; **#3 was later reopened by the MEM-PR01 review and fixed** — the "ABBA unreachable" claim was falsified, see the #3 row). The two-round MEM-PR01 review then landed fixes/pins #5–#18 below. Remaining items are user decisions (#2 typed-error cascade, source-Home retention/GC). ## 0. Why this plan exists @@ -199,11 +199,11 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor **#5 rationale (product decision, Occam route):** every commit-less repository resolves to the SAME shared `global` identity (`core/project.ts` resolve: `id = remote ?? previous ?? root`, and `global` is never cached because `project.ts` skips the identity commit for it). With Home keyed by project ID, an active Memory under `global` would (a) share one Home across all commit-less repositories on the machine (cross-repo topic leakage) and (b) be permanently orphaned at the first commit — identity moves global→root/remote but `migrateProjectId` never migrates away from global (explicit guard; `previous` can never be global). The migration option is structurally infeasible (topics in the shared bucket carry no per-repository provenance), so the minimal correct behavior is **inertness**: memory activates once the repository gains a real identity. One guard at the single activation seam (`Memory.configuration`, which active/prepare/search/checkpoint/setEnabled all funnel through); no new authority, no new machinery. Pre-fix global-bucket contents remain orphans — recovery belongs to the deferred retention/GC decision. Note: this decision constrains the spec — the `lightweight-project-memory` spec has no identity-tier requirement today (review finding MEM-PR01-R1-14); when openspec changes land, add "memory is inert until the project resolves a non-global identity". -**#3 rationale:** `migrateHome` is called only via `migrateProjectId(previous=oldID, current=newID)`; identity retirement is one-way (root→remote), so there is no `migrateHome(B,A)` reverse caller — the two project flocks are never acquired in opposite orders. ABBA is unreachable; no code change warranted. +**#3 rationale — FALSIFIED (kept for the record):** the original claim was that `migrateHome` is called only via `migrateProjectId(previous=oldID, current=newID)` and retirement is one-way (root→remote), so no reverse caller exists and ABBA is unreachable. The MEM-PR01 review disproved this: a changed origin URL yields `previous=remote(A), current=remote(B)` (resolve: `remote ?? previous`), so opposite-direction pairs ARE reachable. See the #3 row above for the fix (sorted pair lock + three-phase merge + `SourceChangedError` verify-before-delete). **#4 rationale:** `worktree/index.ts reconcileLegacyMemory` already runs `memoryAdmission.invalidate(projectID)` **before** `ensure(...)`; invalidation clears the cache entry, so the destructive `ensure` always rescans fresh. The "no stale-cache trust" invariant already holds; no code change warranted. -**Occam path outcome (2026-08-12):** the only *real* gap was **#1** (silent `workflow`+`permission` cascade-loss on identity upgrade) — fixed, tested, mutation-proven, no regressions (project 38, memory-persistence 16, memory 36, worktree 26 — all 0 fail; opencode+core typecheck clean; `git diff --check` 0). #3 and #4 verified as non-gaps; #2 deferred as a cascade awaiting the user's Occam-vs-invariant-#5 call. The driving loop is removed; nothing more to advance autonomously. +**Occam path outcome (2026-08-12):** the only *real* gap was **#1** (silent `workflow`+`permission` cascade-loss on identity upgrade) — fixed, tested, mutation-proven, no regressions (project 38, memory-persistence 16, memory 36, worktree 26 — all 0 fail; opencode+core typecheck clean; `git diff --check` 0). #4 verified as non-gap; #3 was initially closed as a non-gap but the MEM-PR01 review reopened and fixed it (see the #3 row); #2 deferred as a cascade awaiting the user's Occam-vs-invariant-#5 call. Subsequent fixes/pins #5–#18 are recorded in the tables below. **Explicitly cut by Occam** (do NOT build): MEM-ATOMIC-10 (Policy stays in `.opencode/memory.jsonc`; memory is topic content); the authority facade, 6-phase journal, alias tombstone, opaque Revision, destruction guard, crash harness; MEM-CRASH-06 as a forward-journal state machine (POSIX `rename` + the store's generation/manifest atomicity cover content; `migrateHome` can be made idempotent if a crash-retry need is shown). @@ -253,3 +253,23 @@ After the survey + ultracode adversarial review, the user applied Occam's Razor | **#20** Redo-plan internal consistency: header status no longer says PLANNING; the §10 resume protocol is marked superseded (no pending autonomous fix; only user decisions remain). | MEM-PR01-R1-25 (P3) | ✅ done | | **#21 (decision)** Git-exclusion narrowing is intentional and documented here: `ensureProjectExclude` installs only the two config candidates, not `.opencode/memory/`. Legacy topic files preserved fail-closed (topic.invalid/topic.conflict) are therefore visible in `git status` and committable. Trade-off accepted: surfacing repair-pending files beats silently git-excluding user data; the delta spec drops the old scenario and the test pins the narrowed behavior. | MEM-PR01-R1-09 (P3 spec-gap) | ✅ decision recorded | | **#22 (requirement)** Identity-upgrade requirement recorded (the openspec workspace is untracked, so this plan carries it): **Identity upgrade preserves Project Memory and Project-owned references.** Scenarios: (a) root→first-remote migrates the Memory Home before the old Project row is deleted and repoints session/workspace/workflow/permission references; (b) a successor permission colliding on (project_id,action,resource) wins without wedging; (c) merge (not fork) when the successor already has Memory, content-conflicts fail closed; (d) crash mid-migration retries to convergence; (e) global identity is inert. Pinned by the M-A/M-B/M-C/M-E tests. | MEM-PR01-R1-14 (P3 spec-gap) | ✅ requirement recorded | + +### M-H additions (Round 3/4 confirmed P2 fixes + pins + doc alignment, 2026-08-12) + +Round 3/4 re-review (post M-A…M-G) confirmed five new code P2s introduced by the earlier slices, plus test-gap pins and doc drift. All addressed here. + +| Item | Finding | Resolution | +|---|---|---| +| **#23** In-flight old-identity writer could recreate a retired Home after the rename/merge (R3-P2-a). | P2 introduced | Fixed by a lock protocol: writers (prepare/search/checkpoint) hold a cross-process `memory-identity:` flock around their whole read-modify-write and re-check identity liveness inside it; `migrateHome` takes the same identity lock (inside the sorted pair lock), so it waits for in-flight writers and moves their writes with the Home. Global lock order admission→migrate(pair)→identity→project is cycle-free. | +| **#24** `git worktree prune` in remove's prunable branch is repo-global and destroyed sibling worktrees' admin data (R3-P2-d). | P2 introduced | Scoped: prune runs only when the removed entry is the SOLE prunable one; otherwise the stale admin data is left for explicit later cleanup. | +| **#25** Remove's fail-closed memory proof was taken BEFORE the WorktreeRemove hook window; legacy memory written by the hook was destroyed un-migrated (R3-P2-e). | P2 introduced | Reordered: the WorktreeRemove hook fires before the reconcile proof on all remove paths (normal, prunable, git-unknown), so the proof observes everything the hook produced. | +| **#26** remove/reset fell back to the stale instance identity (`?? ctx.project`), letting them reconcile under a retired identity (R3-P2-f). | P2 introduced | Both now fail closed when the identity row is gone (no fallback). | +| **#27** `cleanupLegacyDirectory` removed legacy dirs on a stale empty listing without revalidation (R3-P2-b). | P2 introduced | Re-checks the listing immediately before removing each dir. | +| pin | SourceChanged verify-before-delete guard had no Red-capable test (R3-P2-c). | P2 test-gap | Pinned: a deterministic test holds the target store lock to block migrateHome in phase 2, bumps the source revision mid-merge, and asserts SourceChangedError + source survives. Mutation-proven. | +| pin | Store write paths fail closed on a corrupt manifest but had no Red-capable test (R4-P2-a). | P2 test-gap | Pinned: updateTopics on a corrupt manifest fails and leaves it untouched. Mutation-proven. | +| pin | "Unresolved admission results are never cached" (ADR-0003) had no Red-capable test (R4-P2-b). | P2 test-gap | Pinned: after repairing an invalid legacy file, a same-key ensure rescans fresh (unresolved 0) instead of returning a cached unresolved. | +| #28 | ADR-0002 still documented the superseded "hold the old lock while merging" mechanism. | P3 introduced | Updated to the three-phase merge + identity-lock protocol. | +| #29 | Rejected ADR-0004's header still claimed it "Supersedes" live ADR-0001/0002 clauses. | P3 introduced | Corrected: a Rejected ADR supersedes nothing; those clauses stay live. | +| #30 | Redo plan kept the falsified "#3 ABBA unreachable / non-gap" narrative in three places. | P3 introduced | Header status, #3 rationale, and Occam-outcome lines corrected to record the falsification + fix. | + +Verification: memory+project suites 188 pass / 0 fail; opencode+core typecheck clean; every code fix mutation-proven where a guard was added. diff --git a/packages/opencode/src/format/index.ts b/packages/opencode/src/format/index.ts index e323fcc243..3bd5fd30dc 100644 --- a/packages/opencode/src/format/index.ts +++ b/packages/opencode/src/format/index.ts @@ -83,7 +83,7 @@ export const layer = Layer.effect( const dir = yield* InstanceState.directory const result = yield* appProcess .run( - ChildProcess.make(replaced[0]!, replaced.slice(1), { + ChildProcess.make(replaced[0], replaced.slice(1), { cwd: dir, env: item.environment, extendEnv: true, diff --git a/packages/opencode/src/memory/admission.ts b/packages/opencode/src/memory/admission.ts index d12da3a0db..7e7fded009 100644 --- a/packages/opencode/src/memory/admission.ts +++ b/packages/opencode/src/memory/admission.ts @@ -383,11 +383,16 @@ export const layer = Layer.effect( const cleanupLegacyDirectory = Effect.fnUntraced(function* (directory: string) { const topics = MemoryPaths.legacyTopics(directory) - if ((yield* fs.existsSafe(topics)) && (yield* fs.readDirectoryEntries(topics)).length === 0) - yield* fs.remove(topics, { recursive: true }) + if ((yield* fs.existsSafe(topics)) && (yield* fs.readDirectoryEntries(topics)).length === 0) { + // Re-check immediately before removing: an older-version writer that + // does not take our locks may have created a file after the first + // listing. Removing on a stale empty listing would destroy it. + if ((yield* fs.readDirectoryEntries(topics)).length === 0) yield* fs.remove(topics, { recursive: true }) + } const legacy = join(directory, ".opencode", "memory") - if ((yield* fs.existsSafe(legacy)) && (yield* fs.readDirectoryEntries(legacy)).length === 0) - yield* fs.remove(legacy, { recursive: true }) + if ((yield* fs.existsSafe(legacy)) && (yield* fs.readDirectoryEntries(legacy)).length === 0) { + if ((yield* fs.readDirectoryEntries(legacy)).length === 0) yield* fs.remove(legacy, { recursive: true }) + } }) const ensureUnsafe = Effect.fnUntraced(function* (snapshot: ProjectSnapshot, key: string) { @@ -418,8 +423,11 @@ export const layer = Layer.effect( updated: snapshot.updated, }) const key = JSON.stringify([snapshot.projectID, directories, snapshot.updated]) + // Lock order (outermost→innermost): memory-admission → memory-identity → + // memory-project (inside updateTopics). The identity lock serializes the + // import against a concurrent identity retirement renaming the Home. return yield* flock.withLock( - ensureUnsafe(normalized, key), + flock.withLock(ensureUnsafe(normalized, key), `memory-identity:${snapshot.projectID}`, home.locks), `memory-admission:${snapshot.projectID}`, home.locks, ) diff --git a/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md b/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md index 55a52c04bc..958efd3fe6 100644 --- a/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md +++ b/packages/opencode/src/memory/docs/adr/0002-project-memory-commit-protocol.md @@ -18,7 +18,7 @@ Each successful mutation writes a complete Topic generation into a temporary dir Legacy `topics/` data is revision zero and is promoted on the first commit. Previous and orphaned generations remain non-authoritative. Their garbage collection requires the separate Project Memory retention policy. -Project identity migration holds the old Project's process lock while moving or merging its Memory Home. The Project database retires the old identity only after Memory migration succeeds. +Project identity migration serializes on a `memory-migrate:` flock and a `memory-identity:` flock, then runs a three-phase merge: snapshot the source under the source lock, merge into the target (the target update takes the target lock), and remove the source only after re-reading it and confirming its revision has not changed since the snapshot (`SourceChangedError` otherwise). In-flight writers still producing under the old identity hold `memory-identity:` for their whole read-modify-write, so the migration waits for them and moves their writes along with the Home. The Project database retires the old identity only after Memory migration succeeds. ## Consequences diff --git a/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md index b1e9f6d766..8fa9a0c94c 100644 --- a/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md +++ b/packages/opencode/src/memory/docs/adr/0004-project-memory-authority.md @@ -2,7 +2,7 @@ - Status: **Rejected** (2026-08-12) — superseded by the Occam minimal path (redo plan §10). After survey + adversarial review the user applied Occam's Razor: this elaborate redesign (authority facade, 6-phase retirement journal, alias tombstone, opaque Revision, destruction guard, 8 phases) is over-engineered for the actual needs — one shared memory per project and no fork are already in the baseline; an imperceptible identity upgrade and no data loss are achievable with small in-place fixes. Kept as a record of the considered-and-rejected direction. - Date: 2026-08-12 -- Supersedes: the Policy-source clause of [ADR-0001](./0001-project-owned-memory.md) and the lock/commit framing of [ADR-0002](./0002-project-memory-commit-protocol.md); adds Identity Retirement. Reconstructs the lost authority redesign (uncommitted WIP, /tmp-cleaned) from design memory, now written down so it is auditable. +- Supersedes: **nothing** — this ADR was Rejected before adoption, so it supersedes no live clause. The Policy-source clause of [ADR-0001](./0001-project-owned-memory.md) and the lock/commit framing of [ADR-0002](./0002-project-memory-commit-protocol.md) remain live and authoritative. Reconstructs the lost authority redesign (uncommitted WIP, /tmp-cleaned) from design memory, now written down so the considered-and-rejected direction stays auditable. ## Context diff --git a/packages/opencode/src/memory/identity-migration.ts b/packages/opencode/src/memory/identity-migration.ts index f33794fdc0..ef2f0b90c7 100644 --- a/packages/opencode/src/memory/identity-migration.ts +++ b/packages/opencode/src/memory/identity-migration.ts @@ -182,8 +182,16 @@ export const layer = Layer.effect( const migrateHome: Interface["migrateHome"] = (oldID, newID) => { if (oldID === newID) return Effect.void const pair = [oldID, newID].sort().join("|") + // Lock order (outermost→innermost): memory-migrate (pair) → memory-identity + // (oldID) → memory-project (inside migrateHomeUnsafe). The identity lock + // fences out in-flight writers still producing under oldID: they hold + // memory-identity:oldID for their whole read-modify-write, so the rename + // waits for them and moves their writes along with the Home instead of + // letting them recreate a retired Home afterwards. Writers take + // identity→project, the same relative order, so no ABBA. + const body = flock.withLock(migrateHomeUnsafe(oldID, newID), `memory-identity:${oldID}`, home.locks) return flock - .withLock(migrateHomeUnsafe(oldID, newID), `memory-migrate:${pair}`, home.locks) + .withLock(body, `memory-migrate:${pair}`, home.locks) .pipe(Effect.asVoid, Effect.withSpan("MemoryIdentityMigration.migrateHome")) } diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index b4de306c53..42e1a1f862 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -2,6 +2,7 @@ export * as Memory from "./memory" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Context, Duration, Effect, Layer, Option, Ref, Schema, Semaphore } from "effect" import { stringify } from "yaml" @@ -67,6 +68,7 @@ export const layer: Layer.Layer< | Config.Service | Provider.Service | Project.Service + | EffectFlock.Service | MemoryAdmission.Service | MemoryConfig.Service | MemoryLock.Service @@ -78,6 +80,7 @@ export const layer: Layer.Layer< const config = yield* Config.Service const provider = yield* Provider.Service const project = yield* Project.Service + const flock = yield* EffectFlock.Service const admission = yield* MemoryAdmission.Service const configStore = yield* MemoryConfig.Service const lock = yield* MemoryLock.Service @@ -358,38 +361,49 @@ export const layer: Layer.Layer< session.firstTurnAttempted = true if (!due && !shouldMatch) return - yield* lock.withProject(current.project.id)( + // Cross-process identity guard (see checkpointUnsafe): re-check identity + // liveness under the identity lock before writing. + yield* flock.withLock( Effect.gen(function* () { - const topics = yield* store.readTopics(current.project.id) - const maintained = due - ? yield* maintain({ - model: current.model, - config: current.loaded.config, - topics, - messages: input.messages, - projectID: current.project.id, - }).pipe( - Effect.catchCause((cause) => - Effect.gen(function* () { - yield* Effect.logWarning("periodic MEMORY maintenance failed", { cause }) - return topics - }), - ), - ) - : topics - const rendered = shouldMatch - ? (yield* select({ - model: current.model, - config: current.loaded.config, - topics: maintained, - text: user.text, - projectID: current.project.id, - })).rendered - : (data.sessions.get(input.sessionID)?.turn.rendered ?? []) - const entry = data.sessions.get(input.sessionID) - if (entry?.turn.messageID !== user.info.id) return - entry.turn = { ...entry.turn, completedTurns: turns, rendered } + if (!(yield* project.get(current.project.id))) { + yield* clearSession(input.sessionID) + return + } + yield* lock.withProject(current.project.id)( + Effect.gen(function* () { + const topics = yield* store.readTopics(current.project.id) + const maintained = due + ? yield* maintain({ + model: current.model, + config: current.loaded.config, + topics, + messages: input.messages, + projectID: current.project.id, + }).pipe( + Effect.catchCause((cause) => + Effect.gen(function* () { + yield* Effect.logWarning("periodic MEMORY maintenance failed", { cause }) + return topics + }), + ), + ) + : topics + const rendered = shouldMatch + ? (yield* select({ + model: current.model, + config: current.loaded.config, + topics: maintained, + text: user.text, + projectID: current.project.id, + })).rendered + : (data.sessions.get(input.sessionID)?.turn.rendered ?? []) + const entry = data.sessions.get(input.sessionID) + if (entry?.turn.messageID !== user.info.id) return + entry.turn = { ...entry.turn, completedTurns: turns, rendered } + }), + ) }), + `memory-identity:${current.project.id}`, ) }) @@ -452,35 +466,46 @@ export const layer: Layer.Layer< } const origin = user.info.id - return yield* lock.withProject(current.project.id)( + // Cross-process identity guard (see checkpointUnsafe): re-check identity + // liveness under the identity lock before matching/writing. + return yield* flock.withLock( Effect.gen(function* () { - const activeTurn = data.sessions.get(input.sessionID)?.turn - if (activeTurn?.messageID !== origin) return { status: "stale" as const } - const repeated = activeTurn.queries.get(key) - if (repeated) { - activeTurn.rendered = repeated.rendered - return repeated.count > 0 - ? { status: "attached" as const, count: repeated.count, reused: true } - : { status: "empty" as const, reused: true } + if (!(yield* project.get(current.project.id))) { + yield* clearSession(input.sessionID) + return { status: "unavailable" as const } } - if (activeTurn.queryCount >= 2) return { status: "limit" as const } - activeTurn.queryCount++ - const topics = yield* store.readTopics(current.project.id) - const selected = yield* select({ - model: current.model, - config: current.loaded.config, - topics, - text: query, - projectID: current.project.id, - }) - const latest = data.sessions.get(input.sessionID)?.turn - if (latest?.messageID !== origin) return { status: "stale" as const } - latest.queries.set(key, selected) - latest.rendered = selected.rendered - return selected.count > 0 - ? { status: "attached" as const, count: selected.count, reused: false } - : { status: "empty" as const, reused: false } + return yield* lock.withProject(current.project.id)( + Effect.gen(function* () { + const activeTurn = data.sessions.get(input.sessionID)?.turn + if (activeTurn?.messageID !== origin) return { status: "stale" as const } + const repeated = activeTurn.queries.get(key) + if (repeated) { + activeTurn.rendered = repeated.rendered + return repeated.count > 0 + ? { status: "attached" as const, count: repeated.count, reused: true } + : { status: "empty" as const, reused: true } + } + if (activeTurn.queryCount >= 2) return { status: "limit" as const } + activeTurn.queryCount++ + const topics = yield* store.readTopics(current.project.id) + const selected = yield* select({ + model: current.model, + config: current.loaded.config, + topics, + text: query, + projectID: current.project.id, + }) + const latest = data.sessions.get(input.sessionID)?.turn + if (latest?.messageID !== origin) return { status: "stale" as const } + latest.queries.set(key, selected) + latest.rendered = selected.rendered + return selected.count > 0 + ? { status: "attached" as const, count: selected.count, reused: false } + : { status: "empty" as const, reused: false } + }), + ) }), + `memory-identity:${current.project.id}`, ) }) @@ -506,32 +531,47 @@ export const layer: Layer.Layer< return [] } const user = latestRealUser(input.messages) - return yield* lock.withProject(current.project.id)( + // Cross-process identity guard: a concurrent upgrade may retire this + // identity (row deleted, Home renamed away) while this write is in + // flight. Serialize on the identity lock and re-check liveness inside it; + // writing after retirement would re-create the retired Home and orphan + // the new content permanently (the identity cache already points at the + // successor, so no migration would ever run for this pair again). + return yield* flock.withLock( Effect.gen(function* () { - const topics = yield* store.readTopics(current.project.id) - const maintained = yield* maintain({ - model: current.model, - config: current.loaded.config, - topics, - messages: input.messages, - projectID: current.project.id, - }).pipe( - Effect.catchCause((cause) => - Effect.gen(function* () { - yield* Effect.logWarning("pre-compaction MEMORY maintenance failed", { cause }) - return topics - }), - ), + if (!(yield* project.get(current.project.id))) { + yield* clearSession(input.sessionID) + return [] + } + return yield* lock.withProject(current.project.id)( + Effect.gen(function* () { + const topics = yield* store.readTopics(current.project.id) + const maintained = yield* maintain({ + model: current.model, + config: current.loaded.config, + topics, + messages: input.messages, + projectID: current.project.id, + }).pipe( + Effect.catchCause((cause) => + Effect.gen(function* () { + yield* Effect.logWarning("pre-compaction MEMORY maintenance failed", { cause }) + return topics + }), + ), + ) + const rendered = (yield* select({ + model: current.model, + config: current.loaded.config, + topics: maintained, + text: user?.text ?? "", + projectID: current.project.id, + })).rendered + return rendered + }), ) - const rendered = (yield* select({ - model: current.model, - config: current.loaded.config, - topics: maintained, - text: user?.text ?? "", - projectID: current.project.id, - })).rendered - return rendered }), + `memory-identity:${current.project.id}`, ) }) @@ -595,6 +635,7 @@ export const defaultLayer: Layer.Layer = Layer.suspend(() => Layer.provide(Config.defaultLayer), Layer.provide(Provider.defaultLayer), Layer.provide(Project.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), Layer.provide(MemoryAdmission.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), Layer.provide(MemoryLock.defaultLayer), @@ -607,6 +648,7 @@ export const node = LayerNode.make(layer, [ Config.node, Provider.node, Project.node, + EffectFlock.node, MemoryAdmission.node, MemoryConfig.node, MemoryLock.node, diff --git a/packages/opencode/src/session/summary.ts b/packages/opencode/src/session/summary.ts index 370870935a..3a5ddc3ce7 100644 --- a/packages/opencode/src/session/summary.ts +++ b/packages/opencode/src/session/summary.ts @@ -14,7 +14,7 @@ function unquoteGitPath(input: string) { const bytes: number[] = [] for (let i = 0; i < body.length; i++) { - const char = body[i]! + const char = body[i] if (char !== "\\") { bytes.push(char.charCodeAt(0)) continue diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index e8b362e2c5..1f3c05c1df 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -508,7 +508,14 @@ export const layer: Layer.Layer< return yield* new RemoveFailedError({ message: "Cannot remove the primary or current worktree" }) } - const currentProject = (yield* project.get(ctx.project.id)) ?? ctx.project + // Fail closed if the identity row is gone (retired by an upgrade): never + // reconcile, prune, or drop registrations under a stale instance identity. + const currentProject = yield* project.get(ctx.project.id) + if (!currentProject) { + return yield* new RemoveFailedError({ + message: "Project identity is no longer registered; reload the project before removing worktrees", + }) + } const matches = yield* registeredSandboxes(currentProject.sandboxes, directory) if (matches.length === 0) { return yield* new RemoveFailedError({ message: "Worktree is not registered with this Project" }) @@ -524,13 +531,24 @@ export const layer: Layer.Layer< return yield* new RemoveFailedError({ message: list.stderr || list.text || "Failed to read git worktrees" }) } - const entry = yield* locateWorktree(parseWorktreeList(list.text), directory) + const entries = parseWorktreeList(list.text) + const entry = yield* locateWorktree(entries, directory) if (!entry?.path) { // Registered, but git has no record of the worktree (admin data lost or // the git side was already removed). Recover deterministically instead // of failing with a false "not registered": legacy memory is reconciled // fail-closed against the directory when it still exists, then the stale // registration is dropped. The directory itself is never deleted here. + yield* FiberMap.remove(bootFibers, directory) + if (settingsHook) { + const wrResult = yield* settingsHook + .trigger( + { event: "WorktreeRemove", path: directory, branch: pathSvc.basename(directory) }, + { sessionID: "", transcriptPath: "" }, + ) + .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) + yield* SettingsHook.landSystemMessages(wrResult, { sessionID: "" }) + } const blocker = yield* reconcileLegacyMemory({ projectID: ctx.project.id, projectDirectory: ctx.project.worktree, @@ -544,12 +562,25 @@ export const layer: Layer.Layer< ), ) if (blocker) return yield* new RemoveFailedError({ message: blocker }) - yield* FiberMap.remove(bootFibers, directory) yield* store.disposeDirectory(directory) yield* dropRegistrations return true } + // The WorktreeRemove hook may run user scripts that still write legacy + // memory files; fire it BEFORE taking the fail-closed memory proof so the + // proof observes everything the hook produced. + yield* FiberMap.remove(bootFibers, directory) + if (settingsHook) { + const wrResult = yield* settingsHook + .trigger( + { event: "WorktreeRemove", path: entry.path, branch: pathSvc.basename(entry.path) }, + { sessionID: "", transcriptPath: "" }, + ) + .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) + yield* SettingsHook.landSystemMessages(wrResult, { sessionID: "" }) + } + const blocker = yield* reconcileLegacyMemory({ projectID: ctx.project.id, projectDirectory: ctx.project.worktree, @@ -569,9 +600,15 @@ export const layer: Layer.Layer< // broken gitdir link). The destructive cleanup belongs on this action // path — never on list(): prune the admin data, remove the directory if // it still exists, then drop the registration(s). - yield* FiberMap.remove(bootFibers, directory) yield* store.disposeDirectory(entry.path) - yield* git(["worktree", "prune"], { cwd: ctx.worktree }) + // `git worktree prune` is repo-global: it would also destroy the admin + // data of any OTHER merely-prunable worktree (e.g. an unmounted volume + // or locked parent — prunable does not mean gone). Only prune when this + // entry is the sole prunable one; otherwise leave the stale admin data + // for an explicit later cleanup. + if (entries.every((item) => !item.prunable || item === entry)) { + yield* git(["worktree", "prune"], { cwd: ctx.worktree }) + } if (yield* fs.existsSafe(entry.path)) yield* cleanDirectory(entry.path) const prunedBranch = entry.branch?.replace(/^refs\/heads\//, "") if (prunedBranch) { @@ -592,18 +629,6 @@ export const layer: Layer.Layer< return true } - yield* FiberMap.remove(bootFibers, directory) - - if (settingsHook) { - const wrResult = yield* settingsHook - .trigger( - { event: "WorktreeRemove", path: entry.path, branch: pathSvc.basename(entry.path) }, - { sessionID: "", transcriptPath: "" }, - ) - .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) - yield* SettingsHook.landSystemMessages(wrResult, { sessionID: "" }) - } - // Git may return the original casing when a caller supplied a normalized Windows path. yield* store.disposeDirectory(entry.path) yield* stopFsmonitor(entry.path) @@ -738,7 +763,14 @@ export const layer: Layer.Layer< return yield* new ResetFailedError({ message: "Cannot reset the primary or current worktree" }) } - const currentProject = (yield* project.get(ctx.project.id)) ?? ctx.project + // Fail closed if the identity row is gone (retired by an upgrade): never + // reconcile or mutate under a stale instance identity. + const currentProject = yield* project.get(ctx.project.id) + if (!currentProject) { + return yield* new ResetFailedError({ + message: "Project identity is no longer registered; reload the project before resetting worktrees", + }) + } if (!(yield* registeredSandbox(currentProject.sandboxes, directory))) { return yield* new ResetFailedError({ message: "Worktree is not registered with this Project" }) } diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index 99f007fdd8..85dcd7e19b 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -6,6 +6,7 @@ import { ModelV2 } from "@opencode-ai/core/model" import { ProjectV2 } from "@opencode-ai/core/project" import { ProviderV2 } from "@opencode-ai/core/provider" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Effect, Layer } from "effect" import { stringify } from "yaml" @@ -106,6 +107,7 @@ const base = Layer.mergeAll( Project.defaultLayer, Database.defaultLayer, Git.defaultLayer, + EffectFlock.defaultLayer, MemoryAdmission.defaultLayer, MemoryConfig.defaultLayer, MemoryLock.defaultLayer, diff --git a/packages/opencode/test/memory/memory-persistence.test.ts b/packages/opencode/test/memory/memory-persistence.test.ts index d4141c2dab..89635d1b75 100644 --- a/packages/opencode/test/memory/memory-persistence.test.ts +++ b/packages/opencode/test/memory/memory-persistence.test.ts @@ -764,4 +764,108 @@ describe("Project-owned MEMORY persistence", () => { }).pipe(Effect.provide(layers(root))) }), ) + + it.live( + "write paths fail closed on a corrupt manifest (pins the strict re-read before write)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const store = yield* MemoryStore.Service + yield* replaceTopics(store, projectID, [topic()]) + + yield* fs.writeFileString(home.manifest(projectID), "{ not json") + + const exit = yield* Effect.exit(replaceTopics(store, projectID, [topic("修订后的边界")])) + expect(Exit.isFailure(exit)).toBe(true) + // The corrupt manifest is left untouched (no silent re-init). + expect(yield* fs.readFileString(home.manifest(projectID))).toBe("{ not json") + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live( + "never caches unresolved admission results (pins the ADR-0003 cache rule)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + const sandbox = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const admission = yield* MemoryAdmission.Service + const file = path.join(sandbox, ".opencode", "memory", "topics", "broken.yaml") + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, "id: broken\n") + + const snapshot = { projectID, projectDirectory: primary, directories: [primary, sandbox], updated: 1 } + const first = yield* admission.ensure(snapshot) + expect(first.unresolved).toBeGreaterThan(0) + + // Repair the legacy file. A cached unresolved result would keep + // blocking; the cache rule requires a fresh scan. + yield* fs.remove(file) + const second = yield* admission.ensure(snapshot) + expect(second.unresolved).toBe(0) + }).pipe(Effect.provide(layers(root))) + }), + ) + + it.live( + "fails closed with SourceChanged when the source changes mid-merge (pins the verify-before-delete guard)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const flock = yield* EffectFlock.Service + const migration = yield* MemoryIdentityMigration.Service + const store = yield* MemoryStore.Service + + // Both Homes populated → merge path (not the rename fast path). + yield* replaceTopics(store, projectID, [topic()]) + yield* replaceTopics(store, otherProjectID, [terminologyTopic()]) + + // Hold the target's store lock in this flow; migrateHome blocks there + // in phase 2 AFTER snapshotting the source — a deterministic window in + // which the source may still change. Fork migrateHome detached so it + // survives the withLock scope closing, then bump the source while the + // target lock is still held; releasing the lock (withLock end) lets + // the migration proceed into the verify-before-delete check. + const migratingCell = yield* Ref.make | undefined>(undefined) + yield* flock.withLock( + Effect.gen(function* () { + const migrating = yield* migration.migrateHome(projectID, otherProjectID).pipe(Effect.forkDetach) + yield* Ref.set(migratingCell, migrating) + yield* Effect.sleep("500 millis") + // A concurrent writer bumps the source revision mid-merge. + yield* replaceTopics(store, projectID, [topic("迁移进行中被修订的边界")]) + }), + `memory-project:${otherProjectID}`, + home.locks, + ) + const migrating = (yield* Ref.get(migratingCell))! + const exit = yield* Fiber.join(migrating).pipe(Effect.exit) + + expect(Exit.isFailure(exit)).toBe(true) + if (Exit.isFailure(exit)) expect(String(exit.cause)).toContain("SourceChanged") + // The source Home survives (verify-before-delete refused to remove it). + expect(yield* fs.exists(home.directory(projectID))).toBe(true) + }).pipe( + Effect.provide( + Layer.mergeAll( + Layer.provideMerge( + MemoryIdentityMigration.layer.pipe(Layer.provide(EffectFlock.defaultLayer)), + layers(root), + ), + EffectFlock.defaultLayer, + ), + ), + ) + }), + { timeout: 20_000 }, + ) }) diff --git a/packages/opencode/test/memory/memory.test.ts b/packages/opencode/test/memory/memory.test.ts index fb506cc2a8..569dc5ca1d 100644 --- a/packages/opencode/test/memory/memory.test.ts +++ b/packages/opencode/test/memory/memory.test.ts @@ -1,6 +1,7 @@ import { describe, expect, test } from "bun:test" import { SessionV1 } from "@opencode-ai/core/v1/session" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { Deferred, Duration, Effect, Fiber, Layer } from "effect" import fs from "node:fs/promises" import path from "node:path" @@ -97,6 +98,7 @@ const unavailableModelIt = testEffect( Layer.provide( Layer.mergeAll( emptyConfigLayer, + EffectFlock.defaultLayer, replacementProvider.layer, Layer.mock(Project.Service, { get: (id) => @@ -191,6 +193,7 @@ function bootstrapFixture() { const layer = Memory.layer.pipe( Layer.provide( Layer.mergeAll( + EffectFlock.defaultLayer, Layer.mock(Config.Service, { get: () => Effect.succeed({ @@ -320,6 +323,7 @@ function recallFixture() { Layer.provide( Layer.mergeAll( emptyConfigLayer, + EffectFlock.defaultLayer, provider.layer, Layer.mock(Project.Service, { get: (id) => From 3dd5999779bc2c3d180c9f043fae9d70f1b4c1b7 Mon Sep 17 00:00:00 2001 From: Lex Date: Wed, 12 Aug 2026 23:25:31 +0800 Subject: [PATCH 18/34] fix(memory): hold identity fence across the full retirement seam (MEM-PR01 M-I) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the two Round 5+6 convergence findings: - P1-a (writer fence in the wrong lock dir): memory.ts's writer fence (prepare/search/checkpoint) now passes home.locks so it lives in the same lock namespace as identity migration. Previously it fell back to the default XDG-state lock dir, a DIFFERENT directory, so the writer fence and the migration fence never actually serialized. - flock-leak P2 (fence released before row deletion): ProjectIdentityMigration .migrate now holds memory-identity: for the WHOLE retirement — the Memory Home migration AND the caller's reference/row retirement — via a retireReferences callback. The fence is no longer released between the Home move and the old-row deletion, so an in-flight writer under oldID cannot slip into the gap. Callers pass their row retirement as the callback and no longer touch the fence themselves (single authority for the fence). Mutation check: removing retireReferences() from inside the fence turns the MEM-PR01-R1-11 permission-collision test Red (FK repoint no longer happens), confirming the seam wiring is load-bearing. Co-Authored-By: Claude --- .../opencode/src/memory/identity-migration.ts | 16 +++---- packages/opencode/src/memory/memory.ts | 8 ++++ .../src/project/identity-migration.ts | 43 +++++++++++++++++-- packages/opencode/src/project/project.ts | 26 ++++++----- .../memory/memory-global-identity.test.ts | 2 + packages/opencode/test/memory/memory.test.ts | 4 ++ .../opencode/test/project/project.test.ts | 6 ++- 7 files changed, 80 insertions(+), 25 deletions(-) diff --git a/packages/opencode/src/memory/identity-migration.ts b/packages/opencode/src/memory/identity-migration.ts index ef2f0b90c7..3ec1decc29 100644 --- a/packages/opencode/src/memory/identity-migration.ts +++ b/packages/opencode/src/memory/identity-migration.ts @@ -182,16 +182,14 @@ export const layer = Layer.effect( const migrateHome: Interface["migrateHome"] = (oldID, newID) => { if (oldID === newID) return Effect.void const pair = [oldID, newID].sort().join("|") - // Lock order (outermost→innermost): memory-migrate (pair) → memory-identity - // (oldID) → memory-project (inside migrateHomeUnsafe). The identity lock - // fences out in-flight writers still producing under oldID: they hold - // memory-identity:oldID for their whole read-modify-write, so the rename - // waits for them and moves their writes along with the Home instead of - // letting them recreate a retired Home afterwards. Writers take - // identity→project, the same relative order, so no ABBA. - const body = flock.withLock(migrateHomeUnsafe(oldID, newID), `memory-identity:${oldID}`, home.locks) + // The memory-identity: fence is held by the retirement seam + // (ProjectIdentityMigration.migrate), which wraps this call together with + // the reference/row retirement so the fence covers the whole retirement. + // Here we only serialize opposite-direction migrations via the pair lock. + // Lock order (outermost→innermost): memory-identity (held by caller) → + // memory-migrate (pair) → memory-project (inside migrateHomeUnsafe). return flock - .withLock(body, `memory-migrate:${pair}`, home.locks) + .withLock(migrateHomeUnsafe(oldID, newID), `memory-migrate:${pair}`, home.locks) .pipe(Effect.asVoid, Effect.withSpan("MemoryIdentityMigration.migrateHome")) } diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index 42e1a1f862..968b5cb008 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -14,6 +14,7 @@ import { MessageID, SessionID } from "@/session/schema" import { Token } from "@/util/token" import { MemoryAdmission } from "./admission" import { MemoryConfig } from "./config" +import { MemoryHome } from "./home" import { MemoryLock } from "./lock" import { MemoryModel } from "./model" import { MemoryPrompts } from "./prompts" @@ -71,6 +72,7 @@ export const layer: Layer.Layer< | EffectFlock.Service | MemoryAdmission.Service | MemoryConfig.Service + | MemoryHome.Service | MemoryLock.Service | MemoryModel.Service | MemoryStore.Service @@ -81,6 +83,7 @@ export const layer: Layer.Layer< const provider = yield* Provider.Service const project = yield* Project.Service const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service const admission = yield* MemoryAdmission.Service const configStore = yield* MemoryConfig.Service const lock = yield* MemoryLock.Service @@ -404,6 +407,7 @@ export const layer: Layer.Layer< ) }), `memory-identity:${current.project.id}`, + home.locks, ) }) @@ -506,6 +510,7 @@ export const layer: Layer.Layer< ) }), `memory-identity:${current.project.id}`, + home.locks, ) }) @@ -572,6 +577,7 @@ export const layer: Layer.Layer< ) }), `memory-identity:${current.project.id}`, + home.locks, ) }) @@ -638,6 +644,7 @@ export const defaultLayer: Layer.Layer = Layer.suspend(() => Layer.provide(EffectFlock.defaultLayer), Layer.provide(MemoryAdmission.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), Layer.provide(MemoryLock.defaultLayer), Layer.provide(MemoryModel.defaultLayer), Layer.provide(MemoryStore.defaultLayer), @@ -651,6 +658,7 @@ export const node = LayerNode.make(layer, [ EffectFlock.node, MemoryAdmission.node, MemoryConfig.node, + MemoryHome.node, MemoryLock.node, MemoryModel.node, MemoryStore.node, diff --git a/packages/opencode/src/project/identity-migration.ts b/packages/opencode/src/project/identity-migration.ts index 4afd08a62f..a56c0b5316 100644 --- a/packages/opencode/src/project/identity-migration.ts +++ b/packages/opencode/src/project/identity-migration.ts @@ -1,12 +1,27 @@ export * as ProjectIdentityMigration from "./identity-migration" import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { ProjectV2 } from "@opencode-ai/core/project" import { Context, Effect, Layer } from "effect" +import { MemoryHome } from "@/memory/home" import { MemoryIdentityMigration } from "@/memory/identity-migration" export interface Interface { - readonly migrate: (oldID: ProjectV2.ID, newID: ProjectV2.ID) => Effect.Effect + /** + * Retire `oldID` in favor of `newID` as ONE fenced retirement. Holds the + * cross-process `memory-identity:` fence for the whole retirement — + * the Memory Home migration AND the caller's reference/row retirement — so an + * in-flight writer still producing under oldID either completes before the + * retirement (its writes move with the Home) or sees the row gone on its + * in-fence liveness recheck and stops. Callers pass their reference/row + * retirement as `retireReferences` and do not touch the fence themselves. + */ + readonly migrate: ( + oldID: ProjectV2.ID, + newID: ProjectV2.ID, + retireReferences: () => Effect.Effect, + ) => Effect.Effect } export class Service extends Context.Service()("@opencode/ProjectIdentityMigration") {} @@ -15,12 +30,32 @@ export const layer = Layer.effect( Service, Effect.gen(function* () { const memory = yield* MemoryIdentityMigration.Service + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service return Service.of({ - migrate: (oldID, newID) => memory.migrateHome(oldID, newID).pipe(Effect.orDie), + migrate: (oldID, newID, retireReferences) => + flock + .withLock( + Effect.gen(function* () { + yield* memory.migrateHome(oldID, newID) + yield* retireReferences() + }), + `memory-identity:${oldID}`, + home.locks, + ) + .pipe(Effect.orDie, Effect.withSpan("ProjectIdentityMigration.migrate")), }) }), ) -export const defaultLayer = layer.pipe(Layer.provide(MemoryIdentityMigration.defaultLayer)) +export const defaultLayer = layer.pipe( + Layer.provide(MemoryIdentityMigration.defaultLayer), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), +) -export const node = LayerNode.make(layer, [MemoryIdentityMigration.node]) +export const node = LayerNode.make(layer, [ + MemoryIdentityMigration.node, + EffectFlock.node, + MemoryHome.node, +]) diff --git a/packages/opencode/src/project/project.ts b/packages/opencode/src/project/project.ts index f63cf32126..f114637bb1 100644 --- a/packages/opencode/src/project/project.ts +++ b/packages/opencode/src/project/project.ts @@ -155,12 +155,16 @@ export const layer = Layer.effect( if (oldID === ProjectV2.ID.global) return if (oldID === newID) return - yield* identityMigration.migrate(oldID, newID) - - yield* db - .transaction( - (d) => - Effect.gen(function* () { + // The retirement seam holds the memory-identity: fence across BOTH + // the Home migration and this reference/row retirement, so an in-flight + // writer under oldID cannot slip in between the Home move and the row + // deletion. This callback runs inside that fence; it does not touch the + // fence itself. + yield* identityMigration.migrate(oldID, newID, () => + db + .transaction( + (d) => + Effect.gen(function* () { const oldProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, oldID)).get() const newProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, newID)).get() if (oldProject && !newProject) { @@ -213,11 +217,11 @@ export const layer = Layer.effect( } } - if (oldProject) yield* d.delete(ProjectTable).where(eq(ProjectTable.id, oldID)).run() - }), - { behavior: "immediate" }, - ) - .pipe(Effect.orDie) + if (oldProject) yield* d.delete(ProjectTable).where(eq(ProjectTable.id, oldID)).run() + }), + { behavior: "immediate" }, + ).pipe(Effect.orDie), + ) }) const saveProjectDirectory = Effect.fn("Project.saveProjectDirectory")(function* (input: { diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index 85dcd7e19b..9fd429d1e5 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -17,6 +17,7 @@ import { Config } from "@/config/config" import { Git } from "@/git" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" +import { MemoryHome } from "@/memory/home" import { MemoryLock } from "@/memory/lock" import { Memory } from "@/memory/memory" import { MemoryModel } from "@/memory/model" @@ -110,6 +111,7 @@ const base = Layer.mergeAll( EffectFlock.defaultLayer, MemoryAdmission.defaultLayer, MemoryConfig.defaultLayer, + MemoryHome.defaultLayer, MemoryLock.defaultLayer, MemoryStore.defaultLayer, Layer.mock(MemoryModel.Service, { diff --git a/packages/opencode/test/memory/memory.test.ts b/packages/opencode/test/memory/memory.test.ts index 569dc5ca1d..34ea968234 100644 --- a/packages/opencode/test/memory/memory.test.ts +++ b/packages/opencode/test/memory/memory.test.ts @@ -9,6 +9,7 @@ import { Config } from "@/config/config" import { Git } from "@/git" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" +import { MemoryHome } from "@/memory/home" import { MemoryLock } from "@/memory/lock" import { Memory } from "@/memory/memory" import { MemoryModel } from "@/memory/model" @@ -99,6 +100,7 @@ const unavailableModelIt = testEffect( Layer.mergeAll( emptyConfigLayer, EffectFlock.defaultLayer, + MemoryHome.defaultLayer, replacementProvider.layer, Layer.mock(Project.Service, { get: (id) => @@ -194,6 +196,7 @@ function bootstrapFixture() { Layer.provide( Layer.mergeAll( EffectFlock.defaultLayer, + MemoryHome.defaultLayer, Layer.mock(Config.Service, { get: () => Effect.succeed({ @@ -324,6 +327,7 @@ function recallFixture() { Layer.mergeAll( emptyConfigLayer, EffectFlock.defaultLayer, + MemoryHome.defaultLayer, provider.layer, Layer.mock(Project.Service, { get: (id) => diff --git a/packages/opencode/test/project/project.test.ts b/packages/opencode/test/project/project.test.ts index 07eae3474c..5d6e291cbb 100644 --- a/packages/opencode/test/project/project.test.ts +++ b/packages/opencode/test/project/project.test.ts @@ -119,7 +119,11 @@ function projectLayerWithMemoryRoot(root: string) { Layer.provide(home), Layer.provide(store), ) - const identityMigration = ProjectIdentityMigration.layer.pipe(Layer.provide(memoryMigration)) + const identityMigration = ProjectIdentityMigration.layer.pipe( + Layer.provide(memoryMigration), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) const project = Project.layer.pipe( Layer.provide(EventV2Bridge.defaultLayer), Layer.provide(ProjectV2.defaultLayer), From 705593101328783af26060030131bbd0e3b8f95c Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 00:29:20 +0800 Subject: [PATCH 19/34] fix(memory): single authority for the memory-identity fence protocol (MEM-PR01 M-J) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 7 converged on one residual P1 (F1) and one P2 (F2), both pre-existing: - F1 (P1): admission.ensure took the memory-identity fence but never re-checked identity liveness inside it. A retirement could complete while admission waited on the fence, and admission would then import legacy topics into the re-created retired Home AND delete the legacy source files (permanent orphaning — the identity cache already points at the successor, so no migration would ever run for the pair again). - F2 (P2): the phase-1 Home rename raced a concurrent newID writer creating the target between existsSafe and rename (ENOTEMPTY), dying fromDirectory. Self-healing (next boot retries into the merge path), no data loss. The identity-race TOCTOU class has now been found in three consecutive review rounds, and the memory-identity protocol (key + lock dir + in-fence liveness recheck) was hand-duplicated at four sites across three modules — exactly why admission could diverge from the writer discipline. Per the redesign rule this is a seam redesign, not a patch: - New MemoryIdentityFence (memory/identity-fence.ts) is the single authority for the protocol: key() builds the lock key, withLiveIdentity() holds the fence on home.locks AND re-checks the identity row inside the fence (None = retired, callers fail closed). A future path cannot forget the recheck. - Writers (prepare/search/checkpoint) and admission route through it; the retirement seam (ProjectIdentityMigration) stays the only raw fence holder (it deletes the row inside the fence) and builds its key from key(). - admission.ensure now fails with a tagged IdentityRetired error when the row is gone; configuration() stays inert, the worktree guard proceeds (the migration is moot after a completed retirement). - F2: rename failure with a target that appeared falls through to the snapshot-merge path; genuine FS failures still rethrow. Verification: Red test MEM-PR01-R7-F1 (ensure after row retirement must not import nor delete the legacy files) confirmed Red before, Green after; mutation removing the in-fence recheck turns it Red again. memory+project 189 pass / 0 fail; typecheck clean; lint flat at 4852. F2's mutation is registered as a test-gap: the race window is between two file ops with no observable state between them, so no deterministic public-seam test exists (the fallback routes into the already-tested merge path). Co-Authored-By: Claude --- packages/opencode/src/memory/admission.ts | 30 +++++- .../opencode/src/memory/identity-fence.ts | 75 +++++++++++++++ .../opencode/src/memory/identity-migration.ts | 10 +- packages/opencode/src/memory/memory.ts | 81 ++++++++--------- .../src/project/identity-migration.ts | 3 +- packages/opencode/src/worktree/index.ts | 17 ++-- .../test/memory/memory-admission.test.ts | 91 ++++++++++++++++++- .../memory/memory-global-identity.test.ts | 2 + .../test/memory/memory-persistence.test.ts | 37 +++++++- packages/opencode/test/memory/memory.test.ts | 4 + 10 files changed, 290 insertions(+), 60 deletions(-) create mode 100644 packages/opencode/src/memory/identity-fence.ts diff --git a/packages/opencode/src/memory/admission.ts b/packages/opencode/src/memory/admission.ts index 7e7fded009..1dabe4ea8d 100644 --- a/packages/opencode/src/memory/admission.ts +++ b/packages/opencode/src/memory/admission.ts @@ -9,6 +9,7 @@ import { basename, join } from "node:path" import { parse } from "yaml" import { MemoryConfig } from "./config" import { MemoryHome } from "./home" +import { MemoryIdentityFence } from "./identity-fence" import { MemoryPaths } from "./paths" import { MemoryStore } from "./store" @@ -45,10 +46,20 @@ export class ProjectSnapshot extends Schema.Class("MemoryAdmiss updated: Schema.Number, }) {} +/** + * The identity was retired between the caller's snapshot and fence + * acquisition. The import is abandoned: writing would re-create the retired + * Home and destroy the only remaining copy of the legacy content. + */ +export class IdentityRetiredError extends Schema.TaggedErrorClass()( + "MemoryAdmission.IdentityRetired", + { project_id: Schema.String }, +) {} + export interface Interface { readonly ensure: ( snapshot: ProjectSnapshot, - ) => Effect.Effect + ) => Effect.Effect readonly invalidate: (projectID: ProjectV2.ID) => Effect.Effect } @@ -70,6 +81,7 @@ export const layer = Layer.effect( Effect.gen(function* () { const fs = yield* FSUtil.Service const flock = yield* EffectFlock.Service + const fence = yield* MemoryIdentityFence.Service const config = yield* MemoryConfig.Service const home = yield* MemoryHome.Service const store = yield* MemoryStore.Service @@ -424,10 +436,18 @@ export const layer = Layer.effect( }) const key = JSON.stringify([snapshot.projectID, directories, snapshot.updated]) // Lock order (outermost→innermost): memory-admission → memory-identity → - // memory-project (inside updateTopics). The identity lock serializes the - // import against a concurrent identity retirement renaming the Home. + // memory-project (inside updateTopics). The identity fence is owned by + // MemoryIdentityFence: it re-checks identity liveness inside the fence, + // so the import can never re-create a retired Home or delete the legacy + // source files after a concurrent retirement. return yield* flock.withLock( - flock.withLock(ensureUnsafe(normalized, key), `memory-identity:${snapshot.projectID}`, home.locks), + Effect.gen(function* () { + const imported = yield* fence.withLiveIdentity(snapshot.projectID, ensureUnsafe(normalized, key)) + if (Option.isNone(imported)) { + return yield* new IdentityRetiredError({ project_id: snapshot.projectID }) + } + return imported.value + }), `memory-admission:${snapshot.projectID}`, home.locks, ) @@ -449,6 +469,7 @@ export const defaultLayer = layer.pipe( Layer.provide(MemoryConfig.defaultLayer), Layer.provide(MemoryHome.defaultLayer), Layer.provide(MemoryStore.defaultLayer), + Layer.provide(MemoryIdentityFence.defaultLayer), ) export const node = LayerNode.make(layer, [ @@ -457,6 +478,7 @@ export const node = LayerNode.make(layer, [ MemoryConfig.node, MemoryHome.node, MemoryStore.node, + MemoryIdentityFence.node, ]) function same(left: unknown, right: unknown) { diff --git a/packages/opencode/src/memory/identity-fence.ts b/packages/opencode/src/memory/identity-fence.ts new file mode 100644 index 0000000000..fdcdb643b8 --- /dev/null +++ b/packages/opencode/src/memory/identity-fence.ts @@ -0,0 +1,75 @@ +export * as MemoryIdentityFence from "./identity-fence" + +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { Database } from "@opencode-ai/core/database/database" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { ProjectV2 } from "@opencode-ai/core/project" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { Context, Effect, Layer, Option } from "effect" +import { eq } from "drizzle-orm" +import { MemoryHome } from "./home" + +/** + * Single authority for the `memory-identity:` fence protocol. + * + * Every reader/writer that serializes against identity retirement goes through + * `withLiveIdentity`, which owns the whole protocol: the lock key, the lock + * directory, AND the in-fence identity-liveness recheck. Before this module + * the protocol was hand-duplicated at four sites across three files, which let + * the admission path diverge from the writer discipline (a retired identity + * could re-create its Home). With the protocol here, no new path can forget + * the recheck. + * + * The retirement seam (ProjectIdentityMigration.migrate) is the only raw + * holder: it deletes the identity row inside the fence, so it cannot recheck + * liveness. It builds its key from `MemoryIdentityFence.key` so the key + * convention still has exactly one source. + */ +export interface Interface { + /** + * Run `body` inside the cross-process `memory-identity:` fence, and only + * if the identity row still exists. Returns `Option.none()` when the row was + * retired between the caller's earlier check and fence acquisition — the + * caller must then fail closed instead of writing under a retired identity. + */ + readonly withLiveIdentity: ( + id: ProjectV2.ID, + body: Effect.Effect, + ) => Effect.Effect, E | EffectFlock.LockError, R> +} + +export const key = (id: ProjectV2.ID) => `memory-identity:${id}` + +export class Service extends Context.Service()("@opencode/MemoryIdentityFence") {} + +export const layer = Layer.effect( + Service, + Effect.gen(function* () { + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service + const { db } = yield* Database.Service + return Service.of({ + withLiveIdentity: (id, body) => + flock.withLock( + Effect.gen(function* () { + // Same fail-closed stance as Project.get: a query error here means + // the storage layer is unusable — die loudly rather than silently + // importing into a possibly-retired Home. + const row = yield* db.select().from(ProjectTable).where(eq(ProjectTable.id, id)).get().pipe(Effect.orDie) + if (!row) return Option.none() + return Option.some(yield* body) + }), + key(id), + home.locks, + ), + }) + }), +) + +export const defaultLayer = layer.pipe( + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(MemoryHome.defaultLayer), + Layer.provide(Database.defaultLayer), +) + +export const node = LayerNode.make(layer, [EffectFlock.node, MemoryHome.node, Database.node]) diff --git a/packages/opencode/src/memory/identity-migration.ts b/packages/opencode/src/memory/identity-migration.ts index 3ec1decc29..d63d1a0e4c 100644 --- a/packages/opencode/src/memory/identity-migration.ts +++ b/packages/opencode/src/memory/identity-migration.ts @@ -4,7 +4,7 @@ import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" -import { Context, Effect, Layer, Schema } from "effect" +import { Context, Effect, Exit, Layer, Schema } from "effect" import { dirname, join } from "node:path" import { MemoryHome } from "./home" import { MemorySchema } from "./schema" @@ -117,8 +117,12 @@ export const layer = Layer.effect( if (!(yield* fs.existsSafe(source))) return undefined yield* fs.makeDirectory(dirname(target), { recursive: true }) if (!(yield* fs.existsSafe(target))) { - yield* fs.rename(source, target) - return undefined + const renamed = yield* fs.rename(source, target).pipe(Effect.exit) + if (Exit.isSuccess(renamed)) return undefined + // A writer under newID created the target between existsSafe and + // rename (ENOTEMPTY/EEXIST race). Nothing was removed — fall + // through to the snapshot-merge path below, which converges. + if (!(yield* fs.existsSafe(target))) return yield* renamed } yield* inspectHome(source) return yield* store.readSnapshot(oldID) diff --git a/packages/opencode/src/memory/memory.ts b/packages/opencode/src/memory/memory.ts index 968b5cb008..a9a3fe0b3f 100644 --- a/packages/opencode/src/memory/memory.ts +++ b/packages/opencode/src/memory/memory.ts @@ -2,7 +2,6 @@ export * as Memory from "./memory" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { ProjectV2 } from "@opencode-ai/core/project" -import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { SessionV1 } from "@opencode-ai/core/v1/session" import { Context, Duration, Effect, Layer, Option, Ref, Schema, Semaphore } from "effect" import { stringify } from "yaml" @@ -14,7 +13,7 @@ import { MessageID, SessionID } from "@/session/schema" import { Token } from "@/util/token" import { MemoryAdmission } from "./admission" import { MemoryConfig } from "./config" -import { MemoryHome } from "./home" +import { MemoryIdentityFence } from "./identity-fence" import { MemoryLock } from "./lock" import { MemoryModel } from "./model" import { MemoryPrompts } from "./prompts" @@ -69,10 +68,9 @@ export const layer: Layer.Layer< | Config.Service | Provider.Service | Project.Service - | EffectFlock.Service | MemoryAdmission.Service | MemoryConfig.Service - | MemoryHome.Service + | MemoryIdentityFence.Service | MemoryLock.Service | MemoryModel.Service | MemoryStore.Service @@ -82,8 +80,7 @@ export const layer: Layer.Layer< const config = yield* Config.Service const provider = yield* Provider.Service const project = yield* Project.Service - const flock = yield* EffectFlock.Service - const home = yield* MemoryHome.Service + const fence = yield* MemoryIdentityFence.Service const admission = yield* MemoryAdmission.Service const configStore = yield* MemoryConfig.Service const lock = yield* MemoryLock.Service @@ -193,12 +190,17 @@ export const layer: Layer.Layer< // activates once the repository gains a real identity. if (current.id === ProjectV2.ID.global) return undefined if (current.vcs !== "git" || !current.time.initialized) return undefined - const migration = yield* admission.ensure({ - projectID: current.id, - projectDirectory: current.worktree, - directories: Array.from(new Set([current.worktree, ...current.sandboxes, ctx.worktree])), - updated: current.time.updated, - }) + const migration = yield* admission + .ensure({ + projectID: current.id, + projectDirectory: current.worktree, + directories: Array.from(new Set([current.worktree, ...current.sandboxes, ctx.worktree])), + updated: current.time.updated, + }) + .pipe(Effect.catchTag("MemoryAdmission.IdentityRetired", () => Effect.succeed(undefined))) + // The identity was retired between the row check above and the fence + // acquisition: fail closed and stay inert. + if (!migration) return undefined if (migration.unresolved) { yield* Effect.logWarning("Project MEMORY migration needs manual repair", { projectID: current.id, @@ -364,14 +366,11 @@ export const layer: Layer.Layer< session.firstTurnAttempted = true if (!due && !shouldMatch) return - // Cross-process identity guard (see checkpointUnsafe): re-check identity - // liveness under the identity lock before writing. - yield* flock.withLock( + // Cross-process identity guard (see checkpointUnsafe): MemoryIdentityFence + // re-checks identity liveness under the identity lock before writing. + const live = yield* fence.withLiveIdentity( + current.project.id, Effect.gen(function* () { - if (!(yield* project.get(current.project.id))) { - yield* clearSession(input.sessionID) - return - } yield* lock.withProject(current.project.id)( Effect.gen(function* () { const topics = yield* store.readTopics(current.project.id) @@ -406,9 +405,11 @@ export const layer: Layer.Layer< }), ) }), - `memory-identity:${current.project.id}`, - home.locks, ) + if (Option.isNone(live)) { + yield* clearSession(input.sessionID) + return + } }) const prepare: Interface["prepare"] = Effect.fn("Memory.prepare")((input) => @@ -470,14 +471,11 @@ export const layer: Layer.Layer< } const origin = user.info.id - // Cross-process identity guard (see checkpointUnsafe): re-check identity - // liveness under the identity lock before matching/writing. - return yield* flock.withLock( + // Cross-process identity guard (see checkpointUnsafe): MemoryIdentityFence + // re-checks identity liveness under the identity lock before matching/writing. + const live = yield* fence.withLiveIdentity( + current.project.id, Effect.gen(function* () { - if (!(yield* project.get(current.project.id))) { - yield* clearSession(input.sessionID) - return { status: "unavailable" as const } - } return yield* lock.withProject(current.project.id)( Effect.gen(function* () { const activeTurn = data.sessions.get(input.sessionID)?.turn @@ -509,9 +507,12 @@ export const layer: Layer.Layer< }), ) }), - `memory-identity:${current.project.id}`, - home.locks, ) + if (Option.isNone(live)) { + yield* clearSession(input.sessionID) + return { status: "unavailable" as const } + } + return live.value }) const search: Interface["search"] = Effect.fn("Memory.search")((input) => @@ -542,12 +543,9 @@ export const layer: Layer.Layer< // writing after retirement would re-create the retired Home and orphan // the new content permanently (the identity cache already points at the // successor, so no migration would ever run for this pair again). - return yield* flock.withLock( + const live = yield* fence.withLiveIdentity( + current.project.id, Effect.gen(function* () { - if (!(yield* project.get(current.project.id))) { - yield* clearSession(input.sessionID) - return [] - } return yield* lock.withProject(current.project.id)( Effect.gen(function* () { const topics = yield* store.readTopics(current.project.id) @@ -576,9 +574,12 @@ export const layer: Layer.Layer< }), ) }), - `memory-identity:${current.project.id}`, - home.locks, ) + if (Option.isNone(live)) { + yield* clearSession(input.sessionID) + return [] + } + return live.value }) const checkpoint: Interface["checkpoint"] = Effect.fn("Memory.checkpoint")((input) => @@ -641,10 +642,9 @@ export const defaultLayer: Layer.Layer = Layer.suspend(() => Layer.provide(Config.defaultLayer), Layer.provide(Provider.defaultLayer), Layer.provide(Project.defaultLayer), - Layer.provide(EffectFlock.defaultLayer), Layer.provide(MemoryAdmission.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), - Layer.provide(MemoryHome.defaultLayer), + Layer.provide(MemoryIdentityFence.defaultLayer), Layer.provide(MemoryLock.defaultLayer), Layer.provide(MemoryModel.defaultLayer), Layer.provide(MemoryStore.defaultLayer), @@ -655,10 +655,9 @@ export const node = LayerNode.make(layer, [ Config.node, Provider.node, Project.node, - EffectFlock.node, MemoryAdmission.node, MemoryConfig.node, - MemoryHome.node, + MemoryIdentityFence.node, MemoryLock.node, MemoryModel.node, MemoryStore.node, diff --git a/packages/opencode/src/project/identity-migration.ts b/packages/opencode/src/project/identity-migration.ts index a56c0b5316..244c40c9f0 100644 --- a/packages/opencode/src/project/identity-migration.ts +++ b/packages/opencode/src/project/identity-migration.ts @@ -5,6 +5,7 @@ import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { ProjectV2 } from "@opencode-ai/core/project" import { Context, Effect, Layer } from "effect" import { MemoryHome } from "@/memory/home" +import { MemoryIdentityFence } from "@/memory/identity-fence" import { MemoryIdentityMigration } from "@/memory/identity-migration" export interface Interface { @@ -40,7 +41,7 @@ export const layer = Layer.effect( yield* memory.migrateHome(oldID, newID) yield* retireReferences() }), - `memory-identity:${oldID}`, + MemoryIdentityFence.key(oldID), home.locks, ) .pipe(Effect.orDie, Effect.withSpan("ProjectIdentityMigration.migrate")), diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index 1f3c05c1df..1dd75653df 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -480,12 +480,17 @@ export const layer: Layer.Layer< // flip the project-wide effective config past disagreeing siblings. if (memoryAdmission && input.initialized) { yield* memoryAdmission.invalidate(input.projectID) - const memory = yield* memoryAdmission.ensure({ - projectID: input.projectID, - projectDirectory: input.projectDirectory, - directories: input.directories, - updated: input.updated, - }) + const memory = yield* memoryAdmission + .ensure({ + projectID: input.projectID, + projectDirectory: input.projectDirectory, + directories: input.directories, + updated: input.updated, + }) + .pipe(Effect.catchTag("MemoryAdmission.IdentityRetired", () => Effect.succeed(undefined))) + // The identity was retired concurrently: the legacy migration is moot + // (the Home moved to the successor) — do not block the operation. + if (!memory) return undefined if (memory.unresolved > 0) return `Cannot continue with unresolved legacy project memory: ${memory.diagnostics .filter((item) => item.code.endsWith(".invalid") || item.code.endsWith(".conflict")) diff --git a/packages/opencode/test/memory/memory-admission.test.ts b/packages/opencode/test/memory/memory-admission.test.ts index 0ab1ca8798..a514313c59 100644 --- a/packages/opencode/test/memory/memory-admission.test.ts +++ b/packages/opencode/test/memory/memory-admission.test.ts @@ -1,13 +1,17 @@ import { describe, expect } from "bun:test" +import { Database } from "@opencode-ai/core/database/database" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { AbsolutePath } from "@opencode-ai/core/schema" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" -import { Duration, Effect, Fiber, Layer } from "effect" +import { Cause, Duration, Effect, Exit, Fiber, Layer } from "effect" import path from "node:path" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" +import { MemoryIdentityFence } from "@/memory/identity-fence" import { MemoryStore } from "@/memory/store" import { tmpdirScoped } from "../fixture/fixture" import { testEffect } from "../lib/effect" @@ -58,19 +62,28 @@ function topic(id: string, summary = `已确认的 ${id} 决策`) { function layers(root: string) { const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + // One shared Database layer: the fence's liveness recheck and the test + // body's row setup must see the same rows. + const database = Database.defaultLayer const store = MemoryStore.layer.pipe( Layer.provide(FSUtil.defaultLayer), Layer.provide(EffectFlock.defaultLayer), Layer.provide(home), ) + const fence = MemoryIdentityFence.layer.pipe( + Layer.provide(database), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) const admission = MemoryAdmission.layer.pipe( Layer.provide(FSUtil.defaultLayer), Layer.provide(EffectFlock.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), Layer.provide(home), Layer.provide(store), + Layer.provide(fence), ) - return Layer.mergeAll(admission, store, MemoryConfig.defaultLayer) + return Layer.mergeAll(admission, store, MemoryConfig.defaultLayer, database) } describe("MemoryAdmission", () => { @@ -84,6 +97,13 @@ describe("MemoryAdmission", () => { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service const configStore = yield* MemoryConfig.Service + const { db } = yield* Database.Service + // ensure() runs for live identities; the fence re-checks the row. + yield* db + .insert(ProjectTable) + .values({ id: projectID, worktree: AbsolutePath.make(primary), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) const files = [first, second].map((directory) => path.join(directory, ".opencode", "memory.jsonc")) yield* Effect.forEach(files, (file) => fs.makeDirectory(path.dirname(file), { recursive: true }), { concurrency: 1, @@ -116,6 +136,12 @@ describe("MemoryAdmission", () => { yield* Effect.gen(function* () { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service + const { db } = yield* Database.Service + yield* db + .insert(ProjectTable) + .values({ id: projectID, worktree: AbsolutePath.make(primary), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) const snapshot = { projectID, projectDirectory: primary, directories: [primary, sandbox], updated: 1 } expect((yield* admission.ensure(snapshot)).diagnostics).toEqual([]) @@ -141,6 +167,12 @@ describe("MemoryAdmission", () => { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service const store = yield* MemoryStore.Service + const { db } = yield* Database.Service + yield* db + .insert(ProjectTable) + .values({ id: projectID, worktree: AbsolutePath.make(primary), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) const topics = [topic("architecture"), topic("product")] const files = [first, second].map((directory, index) => path.join(directory, ".opencode", "memory", "topics", `${topics[index].id}.yaml`), @@ -168,9 +200,15 @@ describe("MemoryAdmission", () => { const fullLayers = (root: string) => { const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) const flock = EffectFlock.defaultLayer - const base = Layer.mergeAll(FSUtil.defaultLayer, flock, home, MemoryConfig.defaultLayer) + const database = Database.defaultLayer + const fence = MemoryIdentityFence.layer.pipe( + Layer.provide(database), + Layer.provide(flock), + Layer.provide(home), + ) + const base = Layer.mergeAll(FSUtil.defaultLayer, flock, home, MemoryConfig.defaultLayer, database) const store = MemoryStore.layer.pipe(Layer.provide(base)) - const admission = MemoryAdmission.layer.pipe(Layer.provide(base), Layer.provide(store)) + const admission = MemoryAdmission.layer.pipe(Layer.provide(base), Layer.provide(store), Layer.provide(fence)) return Layer.mergeAll(base, store, admission) } @@ -186,6 +224,12 @@ describe("MemoryAdmission", () => { const home = yield* MemoryHome.Service const admission = yield* MemoryAdmission.Service const store = yield* MemoryStore.Service + const { db } = yield* Database.Service + yield* db + .insert(ProjectTable) + .values({ id: projectID, worktree: AbsolutePath.make(primary), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) const dir = path.join(primary, ".opencode", "memory", "topics") const file = path.join(dir, "moving-topic.yaml") @@ -234,6 +278,12 @@ describe("MemoryAdmission", () => { yield* Effect.gen(function* () { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service + const { db } = yield* Database.Service + yield* db + .insert(ProjectTable) + .values({ id: projectID, worktree: AbsolutePath.make(primary), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) const configA = { ...config, model: "test/config-jsonc" } const configB = { ...config, model: "test/config-json" } @@ -267,4 +317,37 @@ describe("MemoryAdmission", () => { }), { timeout: 30_000 }, ) + + it.live( + "does not import legacy topics for a retired identity nor delete the legacy files (MEM-PR01-R7-F1)", + () => + Effect.gen(function* () { + const root = yield* tmpdirScoped() + const primary = yield* tmpdirScoped({ git: true }) + yield* Effect.gen(function* () { + const fs = yield* FSUtil.Service + const home = yield* MemoryHome.Service + const admission = yield* MemoryAdmission.Service + + // A pre-upgrade writer left legacy topic files in the worktree. + const file = path.join(primary, ".opencode", "memory", "topics", "retired-import.yaml") + yield* fs.makeDirectory(path.dirname(file), { recursive: true }) + yield* fs.writeFileString(file, Bun.YAML.stringify(topic("retired-import"))) + + // The identity row was retired by a concurrent upgrade: the snapshot is + // still stamped under the old identity but the row no longer exists. + const result = yield* admission + .ensure({ projectID, projectDirectory: primary, directories: [primary], updated: 1 }) + .pipe(Effect.exit) + + // Fail-closed: the import must not re-create the retired Home and must + // not delete the only remaining copy of the legacy content. + expect(Exit.isFailure(result)).toBe(true) + const failReasons = Exit.isFailure(result) ? result.cause.reasons.filter(Cause.isFailReason) : [] + expect(failReasons.map((reason) => reason.error._tag)).toEqual(["MemoryAdmission.IdentityRetired"]) + expect(yield* fs.existsSafe(file)).toBe(true) + expect(yield* fs.existsSafe(home.directory(projectID))).toBe(false) + }).pipe(Effect.provide(fullLayers(root))) + }), + ) }) diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index 9fd429d1e5..2fa507113d 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -18,6 +18,7 @@ import { Git } from "@/git" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" +import { MemoryIdentityFence } from "@/memory/identity-fence" import { MemoryLock } from "@/memory/lock" import { Memory } from "@/memory/memory" import { MemoryModel } from "@/memory/model" @@ -112,6 +113,7 @@ const base = Layer.mergeAll( MemoryAdmission.defaultLayer, MemoryConfig.defaultLayer, MemoryHome.defaultLayer, + MemoryIdentityFence.defaultLayer, MemoryLock.defaultLayer, MemoryStore.defaultLayer, Layer.mock(MemoryModel.Service, { diff --git a/packages/opencode/test/memory/memory-persistence.test.ts b/packages/opencode/test/memory/memory-persistence.test.ts index 89635d1b75..33f1dc95e0 100644 --- a/packages/opencode/test/memory/memory-persistence.test.ts +++ b/packages/opencode/test/memory/memory-persistence.test.ts @@ -1,12 +1,16 @@ import { describe, expect } from "bun:test" +import { Database } from "@opencode-ai/core/database/database" import { FSUtil } from "@opencode-ai/core/fs-util" import { ProjectV2 } from "@opencode-ai/core/project" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { AbsolutePath } from "@opencode-ai/core/schema" import { EffectFlock } from "@opencode-ai/core/util/effect-flock" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" import { Effect, Exit, Fiber, Layer, Ref, Schema } from "effect" import path from "node:path" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" +import { MemoryIdentityFence } from "@/memory/identity-fence" import { MemoryIdentityMigration } from "@/memory/identity-migration" import { MemoryAdmission } from "@/memory/admission" import { MemoryPaths } from "@/memory/paths" @@ -86,19 +90,44 @@ function terminologyTopic() { function layers(root: string) { const home = Layer.succeed(MemoryHome.Service, MemoryHome.make(root)) + // One shared Database layer: the fence's liveness recheck and the test + // body's row setup must see the same rows. + const database = Database.defaultLayer const store = MemoryStore.layer.pipe( Layer.provide(FSUtil.defaultLayer), Layer.provide(EffectFlock.defaultLayer), Layer.provide(home), ) + const fence = MemoryIdentityFence.layer.pipe( + Layer.provide(database), + Layer.provide(EffectFlock.defaultLayer), + Layer.provide(home), + ) const admission = MemoryAdmission.layer.pipe( Layer.provide(FSUtil.defaultLayer), Layer.provide(EffectFlock.defaultLayer), Layer.provide(MemoryConfig.defaultLayer), Layer.provide(home), Layer.provide(store), + Layer.provide(fence), ) - return Layer.mergeAll(home, store, admission, MemoryConfig.defaultLayer) + return Layer.mergeAll(home, store, admission, MemoryConfig.defaultLayer, database) +} + +/** + * Inserts a live identity row. Production callers of ensure() always run with + * a live row (configuration() re-reads it, the worktree guard requires an + * initialized project); the fence's liveness recheck needs it in tests too. + */ +function insertLiveRow(id: ProjectV2.ID) { + return Effect.gen(function* () { + const { db } = yield* Database.Service + yield* db + .insert(ProjectTable) + .values({ id, worktree: AbsolutePath.make("/unused"), vcs: "git", sandboxes: [] }) + .run() + .pipe(Effect.orDie) + }) } function replaceTopics(store: MemoryStore.Interface, id: ProjectV2.ID, topics: MemorySchema.Topic[]) { @@ -304,6 +333,7 @@ describe("Project-owned MEMORY persistence", () => { const home = yield* MemoryHome.Service const admission = yield* MemoryAdmission.Service const store = yield* MemoryStore.Service + yield* insertLiveRow(projectID) const file = path.join(MemoryPaths.legacyTopics(sandbox), "project-architecture.yaml") yield* fs.makeDirectory(path.dirname(file), { recursive: true }) yield* fs.writeFileString(file, Bun.YAML.stringify(topic())) @@ -356,6 +386,7 @@ describe("Project-owned MEMORY persistence", () => { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service const store = yield* MemoryStore.Service + yield* insertLiveRow(projectID) const firstFile = path.join(MemoryPaths.legacyTopics(first), "project-architecture.yaml") const secondFile = path.join(MemoryPaths.legacyTopics(second), "project-architecture.yaml") yield* fs.makeDirectory(path.dirname(firstFile), { recursive: true }) @@ -503,6 +534,7 @@ describe("Project-owned MEMORY persistence", () => { const fs = yield* FSUtil.Service const configStore = yield* MemoryConfig.Service const admission = yield* MemoryAdmission.Service + yield* insertLiveRow(projectID) const invalid = path.join(MemoryPaths.legacyTopics(sandbox), "broken.yaml") const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") yield* fs.makeDirectory(path.dirname(invalid), { recursive: true }) @@ -550,6 +582,7 @@ describe("Project-owned MEMORY persistence", () => { Effect.gen(function* () { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service + yield* insertLiveRow(projectID) const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") yield* fs.writeFileString(path.join(global, "memory.jsonc"), JSON.stringify(config)) yield* fs.makeDirectory(path.dirname(sandboxConfig), { recursive: true }) @@ -584,6 +617,7 @@ describe("Project-owned MEMORY persistence", () => { const fs = yield* FSUtil.Service const configStore = yield* MemoryConfig.Service const admission = yield* MemoryAdmission.Service + yield* insertLiveRow(projectID) const value = { ...config, topic_limit: 50, topic_limit_floor: 10 } const sandboxConfig = path.join(sandbox, ".opencode", "memory.jsonc") yield* configStore.writeProject(primary, value) @@ -796,6 +830,7 @@ describe("Project-owned MEMORY persistence", () => { yield* Effect.gen(function* () { const fs = yield* FSUtil.Service const admission = yield* MemoryAdmission.Service + yield* insertLiveRow(projectID) const file = path.join(sandbox, ".opencode", "memory", "topics", "broken.yaml") yield* fs.makeDirectory(path.dirname(file), { recursive: true }) yield* fs.writeFileString(file, "id: broken\n") diff --git a/packages/opencode/test/memory/memory.test.ts b/packages/opencode/test/memory/memory.test.ts index 34ea968234..eaf2185b04 100644 --- a/packages/opencode/test/memory/memory.test.ts +++ b/packages/opencode/test/memory/memory.test.ts @@ -10,6 +10,7 @@ import { Git } from "@/git" import { MemoryAdmission } from "@/memory/admission" import { MemoryConfig } from "@/memory/config" import { MemoryHome } from "@/memory/home" +import { MemoryIdentityFence } from "@/memory/identity-fence" import { MemoryLock } from "@/memory/lock" import { Memory } from "@/memory/memory" import { MemoryModel } from "@/memory/model" @@ -101,6 +102,7 @@ const unavailableModelIt = testEffect( emptyConfigLayer, EffectFlock.defaultLayer, MemoryHome.defaultLayer, + MemoryIdentityFence.defaultLayer, replacementProvider.layer, Layer.mock(Project.Service, { get: (id) => @@ -197,6 +199,7 @@ function bootstrapFixture() { Layer.mergeAll( EffectFlock.defaultLayer, MemoryHome.defaultLayer, + MemoryIdentityFence.defaultLayer, Layer.mock(Config.Service, { get: () => Effect.succeed({ @@ -328,6 +331,7 @@ function recallFixture() { emptyConfigLayer, EffectFlock.defaultLayer, MemoryHome.defaultLayer, + MemoryIdentityFence.defaultLayer, provider.layer, Layer.mock(Project.Service, { get: (id) => From 580c62438b72e7572c5e9a6e29727ae5f71bbd4f Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 01:20:32 +0800 Subject: [PATCH 20/34] fix(worktree): fail removal closed when the identity retires mid-remove (MEM-PR01 M-K) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 9 product-invariant review found P2-A (introduced by M-J): the reconcileLegacyMemory guard returned undefined on IdentityRetired, so a worktree remove could proceed past the fence and `git worktree remove --force` would destroy legacy .opencode/memory content that was never admitted into any Home. The window sits between removeLocked's own row-liveness check and the admission fence recheck — widened by the WorktreeRemove hook (user scripts) that runs between the two. Fix: on IdentityRetired the guard now returns a blocker message (fail closed), matching the reset path's existing stance. A retry under the successor identity imports the legacy content first and then removes safely. Red-first + mutation evidence: - New test MEM-PR01-R9-P2A (worktree-remove.test.ts): holds the memory-admission flock so the remove blocks inside ensure after its own row check passed, retires the identity row, then releases — asserting the removal fails and the never-admitted legacy file survives. Red before the fix, Green after; reverting the blocker to undefined turns it Red again. Also fixes a standards-P2: reindents the retirement transaction body in project.ts (pure whitespace, no behavior change). Registered, not fixed here (out of PR scope): EffectFlock stale-break can silently lose a cross-process update (P2-B, pre-existing core infra, recorded as a residual for the final audit). Co-Authored-By: Claude --- packages/opencode/src/project/project.ts | 96 +++++++++---------- packages/opencode/src/worktree/index.ts | 9 +- .../test/project/worktree-remove.test.ts | 69 ++++++++++++- 3 files changed, 121 insertions(+), 53 deletions(-) diff --git a/packages/opencode/src/project/project.ts b/packages/opencode/src/project/project.ts index f114637bb1..e5ae665f94 100644 --- a/packages/opencode/src/project/project.ts +++ b/packages/opencode/src/project/project.ts @@ -165,57 +165,57 @@ export const layer = Layer.effect( .transaction( (d) => Effect.gen(function* () { - const oldProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, oldID)).get() - const newProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, newID)).get() - if (oldProject && !newProject) { + const oldProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, oldID)).get() + const newProject = yield* d.select().from(ProjectTable).where(eq(ProjectTable.id, newID)).get() + if (oldProject && !newProject) { + yield* d + .insert(ProjectTable) + .values({ + ...oldProject, + id: newID, + time_updated: Date.now(), + }) + .run() + } + + // Project directories may be shared across distinct + // checkouts which have diverged. Clear the directory + // list and rely on it being re-populated to ensure + // accuracy + yield* d.delete(ProjectDirectoryTable).where(eq(ProjectDirectoryTable.project_id, oldID)).run() + yield* d - .insert(ProjectTable) - .values({ - ...oldProject, - id: newID, - time_updated: Date.now(), - }) + .update(SessionTable) + .set({ project_id: newID, time_updated: sql`${SessionTable.time_updated}` }) + .where(eq(SessionTable.project_id, oldID)) .run() - } - - // Project directories may be shared across distinct - // checkouts which have diverged. Clear the directory - // list and rely on it being re-populated to ensure - // accuracy - yield* d.delete(ProjectDirectoryTable).where(eq(ProjectDirectoryTable.project_id, oldID)).run() - - yield* d - .update(SessionTable) - .set({ project_id: newID, time_updated: sql`${SessionTable.time_updated}` }) - .where(eq(SessionTable.project_id, oldID)) - .run() - yield* d - .update(WorkspaceTable) - .set({ project_id: newID }) - .where(eq(WorkspaceTable.project_id, oldID)) - .run() - - // Repoint the Project-owned references that the old row's deletion would otherwise - // cascade-destroy. Both workflow and permission carry ON DELETE CASCADE on project_id, - // so without this repointing, gaining a first remote would silently delete every DAG - // workflow and every saved permission for the project. - yield* d.update(WorkflowTable).set({ project_id: newID }).where(eq(WorkflowTable.project_id, oldID)).run() - // (project_id, action, resource) is unique on permission. When the successor - // identity already holds a row with the same (action, resource), it already grants - // the identical permission: drop the old row instead of repointing it. A bulk - // UPDATE would violate the unique index and wedge the whole identity upgrade. - const successorPermissions = new Set( - (yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, newID)).all()).map( - (row) => JSON.stringify([row.action, row.resource]), - ), - ) - for (const row of yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, oldID)).all()) { - if (successorPermissions.has(JSON.stringify([row.action, row.resource]))) { - yield* d.delete(PermissionTable).where(eq(PermissionTable.id, row.id)).run() - } else { - yield* d.update(PermissionTable).set({ project_id: newID }).where(eq(PermissionTable.id, row.id)).run() + yield* d + .update(WorkspaceTable) + .set({ project_id: newID }) + .where(eq(WorkspaceTable.project_id, oldID)) + .run() + + // Repoint the Project-owned references that the old row's deletion would otherwise + // cascade-destroy. Both workflow and permission carry ON DELETE CASCADE on project_id, + // so without this repointing, gaining a first remote would silently delete every DAG + // workflow and every saved permission for the project. + yield* d.update(WorkflowTable).set({ project_id: newID }).where(eq(WorkflowTable.project_id, oldID)).run() + // (project_id, action, resource) is unique on permission. When the successor + // identity already holds a row with the same (action, resource), it already grants + // the identical permission: drop the old row instead of repointing it. A bulk + // UPDATE would violate the unique index and wedge the whole identity upgrade. + const successorPermissions = new Set( + (yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, newID)).all()).map( + (row) => JSON.stringify([row.action, row.resource]), + ), + ) + for (const row of yield* d.select().from(PermissionTable).where(eq(PermissionTable.project_id, oldID)).all()) { + if (successorPermissions.has(JSON.stringify([row.action, row.resource]))) { + yield* d.delete(PermissionTable).where(eq(PermissionTable.id, row.id)).run() + } else { + yield* d.update(PermissionTable).set({ project_id: newID }).where(eq(PermissionTable.id, row.id)).run() + } } - } if (oldProject) yield* d.delete(ProjectTable).where(eq(ProjectTable.id, oldID)).run() }), diff --git a/packages/opencode/src/worktree/index.ts b/packages/opencode/src/worktree/index.ts index 1dd75653df..e50b0361de 100644 --- a/packages/opencode/src/worktree/index.ts +++ b/packages/opencode/src/worktree/index.ts @@ -488,9 +488,12 @@ export const layer: Layer.Layer< updated: input.updated, }) .pipe(Effect.catchTag("MemoryAdmission.IdentityRetired", () => Effect.succeed(undefined))) - // The identity was retired concurrently: the legacy migration is moot - // (the Home moved to the successor) — do not block the operation. - if (!memory) return undefined + // The identity was retired concurrently. Legacy sources may never have + // been admitted anywhere, so a destructive step (worktree remove) must + // fail closed instead of destroying them; a retry under the successor + // identity imports them first. + if (!memory) + return "Project identity is being upgraded. Retry once the upgrade completes." if (memory.unresolved > 0) return `Cannot continue with unresolved legacy project memory: ${memory.diagnostics .filter((item) => item.code.endsWith(".invalid") || item.code.endsWith(".conflict")) diff --git a/packages/opencode/test/project/worktree-remove.test.ts b/packages/opencode/test/project/worktree-remove.test.ts index 217920a725..503e6860aa 100644 --- a/packages/opencode/test/project/worktree-remove.test.ts +++ b/packages/opencode/test/project/worktree-remove.test.ts @@ -2,9 +2,14 @@ import { $ } from "bun" import { describe, expect } from "bun:test" import * as fs from "fs/promises" import path from "path" -import { Effect, Exit, Layer } from "effect" +import { Duration, Effect, Exit, Fiber, Layer } from "effect" import { stringify } from "yaml" +import { Database } from "@opencode-ai/core/database/database" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { EffectFlock } from "@opencode-ai/core/util/effect-flock" +import { eq } from "drizzle-orm" +import { MemoryHome } from "@/memory/home" import { MemoryStore } from "@/memory/store" import { Worktree } from "../../src/worktree" import { Project } from "../../src/project/project" @@ -12,7 +17,15 @@ import { TestInstance } from "../fixture/fixture" import { testEffect } from "../lib/effect" const it = testEffect( - Layer.mergeAll(Worktree.defaultLayer, Project.defaultLayer, CrossSpawnSpawner.defaultLayer, MemoryStore.defaultLayer), + Layer.mergeAll( + Worktree.defaultLayer, + Project.defaultLayer, + CrossSpawnSpawner.defaultLayer, + MemoryStore.defaultLayer, + Database.defaultLayer, + EffectFlock.defaultLayer, + MemoryHome.defaultLayer, + ), ) const wintest = process.platform === "win32" ? it.instance : it.instance.skip @@ -394,4 +407,56 @@ describe("Worktree.remove", () => { }), { git: true }, ) + + it.instance( + "blocks removal when the identity retires mid-remove with un-admitted legacy memory (MEM-PR01-R9-P2A)", + () => + Effect.gen(function* () { + const root = (yield* TestInstance).directory + const project = yield* Project.Service + const svc = yield* Worktree.Service + const flock = yield* EffectFlock.Service + const home = yield* MemoryHome.Service + const { db } = yield* Database.Service + const current = yield* project.fromDirectory(root) + yield* project.setInitialized(current.project.id) + + const stamp = Date.now().toString(36) + const dir = path.join(root, "..", `retired-remove-${stamp}`) + yield* Effect.promise(() => $`git worktree add -b opencode/retired-remove-${stamp} ${dir}`.cwd(root).quiet()) + yield* project.addSandbox(current.project.id, dir) + + // Legacy memory that was never admitted into any Home. + const legacyDir = path.join(dir, ".opencode", "memory", "topics") + yield* Effect.promise(() => fs.mkdir(legacyDir, { recursive: true })) + const legacyFile = path.join(legacyDir, "never-admitted.yaml") + yield* Effect.promise(() => fs.writeFile(legacyFile, "id: never-admitted\n")) + + // Hold the admission lock: the remove's reconcile blocks inside ensure + // AFTER its own row-liveness check passed. While it blocks, the + // identity row is retired by a concurrent upgrade. The in-fence + // liveness recheck must then fail the removal closed instead of + // destroying the never-admitted legacy content. + const fiber = yield* flock.withLock( + Effect.gen(function* () { + const fiber = yield* svc.remove({ directory: dir }).pipe(Effect.forkDetach) + yield* Effect.sleep(Duration.millis(500)) + yield* db + .delete(ProjectTable) + .where(eq(ProjectTable.id, current.project.id)) + .run() + .pipe(Effect.orDie) + return fiber + }), + `memory-admission:${current.project.id}`, + home.locks, + ) + const outcome = yield* Fiber.join(fiber).pipe(Effect.exit) + + expect(Exit.isFailure(outcome)).toBe(true) + if (Exit.isFailure(outcome)) expect(String(outcome.cause)).toContain("identity") + expect(yield* exists(legacyFile)).toBe(true) + }), + { git: true }, + ) }) From b1f9e48efb3b8f8cf69bb15de3845f12238aa070 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 06:40:37 +0800 Subject: [PATCH 21/34] test(memory): stamp the instance store with the already-resolved identity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The dev push CI (linux Unit Tests) failed in MEM-PR01-R1-03: the first search returned "unavailable" in isolation while the same file passes locally. Root cause (CI log analysis + code trace): the test's "active" pre-condition depends on the InstanceStore's BOOT-TIME project resolution, which runs in a separate Effect graph (its own :memory: Database) and silently degrades to the shared global identity when a git subprocess fails transiently on a loaded runner (every git failure collapses to "exit 1, empty output" in core git.ts run()). The test body's own resolution milliseconds later returns the real root-commit identity, so the identity assertions pass while memory fails closed against the stale global context. Fix: resolve the identity once in the test body and hand it to the instance store (provideInstance now accepts a full LoadInput; boot skips its own fromDirectory when project+worktree are given). Applied to the three identity-scoped tests (R1-03, R1-23, R1-00 third) that assert active memory. Registered separately (product hardening, out of this PR): identity resolution should not silently degrade to the global identity on transient git errors — discover/rootCommits should retry or propagate instead of collapsing to exit 1. Co-Authored-By: Claude --- packages/opencode/test/fixture/fixture.ts | 6 +++-- .../memory/memory-global-identity.test.ts | 24 ++++++++++++------- 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/packages/opencode/test/fixture/fixture.ts b/packages/opencode/test/fixture/fixture.ts index f9898ede0d..8d483a904d 100644 --- a/packages/opencode/test/fixture/fixture.ts +++ b/packages/opencode/test/fixture/fixture.ts @@ -162,9 +162,11 @@ export function tmpdirScoped(options?: { } export const provideInstance = - (directory: string) => + (input: string | InstanceStore.LoadInput) => (self: Effect.Effect): Effect.Effect => - InstanceStore.Service.use((store) => store.provide({ directory }, self)) + InstanceStore.Service.use((store) => + store.provide(typeof input === "string" ? { directory: input } : input, self), + ) export const provideInstanceEffect = (directory: string) => diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index 2fa507113d..e62e9fb650 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -149,15 +149,21 @@ describe("MEM-PR01-R1-03: memory is inert once the identity row is retired", () () => Effect.gen(function* () { const dir = yield* tmpdirScoped({ git: true }) - yield* provideInstance(dir)( + // Resolve the identity ONCE and hand it to the instance store: the + // boot-time resolution runs in a separate Effect graph (own Database) + // and can transiently degrade to the global identity on loaded CI + // runners (git failures are silently swallowed), which would make the + // stamped context and this body disagree — failing the search closed. + const project = yield* Project.Service + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).not.toBe(ProjectV2.ID.global) + yield* provideInstance({ directory: dir, worktree: info.worktree, project: info })( Effect.gen(function* () { const project = yield* Project.Service const memory = yield* Memory.Service const configStore = yield* MemoryConfig.Service const { db } = yield* Database.Service - const { project: info } = yield* project.fromDirectory(dir) - expect(info.id).not.toBe(ProjectV2.ID.global) yield* project.setInitialized(info.id) yield* configStore.writeGlobal(baseConfig) @@ -193,14 +199,15 @@ describe("MEM-PR01-R1-23: the runtime admission snapshot covers every registered Effect.gen(function* () { const dir = yield* tmpdirScoped({ git: true }) const sandbox = yield* tmpdirScoped() - yield* provideInstance(dir)( + const project = yield* Project.Service + const { project: info } = yield* project.fromDirectory(dir) + yield* provideInstance({ directory: dir, worktree: info.worktree, project: info })( Effect.gen(function* () { const project = yield* Project.Service const memory = yield* Memory.Service const configStore = yield* MemoryConfig.Service const store = yield* MemoryStore.Service - const { project: info } = yield* project.fromDirectory(dir) yield* project.setInitialized(info.id) yield* project.addSandbox(info.id, sandbox) yield* configStore.writeGlobal(baseConfig) @@ -353,14 +360,15 @@ describe("MEM-PR01-00: memory is inert under the shared global identity", () => () => Effect.gen(function* () { const dir = yield* tmpdirScoped({ git: true }) - yield* provideInstance(dir)( + const project = yield* Project.Service + const { project: info } = yield* project.fromDirectory(dir) + expect(info.id).not.toBe(ProjectV2.ID.global) + yield* provideInstance({ directory: dir, worktree: info.worktree, project: info })( Effect.gen(function* () { const project = yield* Project.Service const memory = yield* Memory.Service const configStore = yield* MemoryConfig.Service - const { project: info } = yield* project.fromDirectory(dir) - expect(info.id).not.toBe(ProjectV2.ID.global) yield* project.setInitialized(info.id) yield* configStore.writeGlobal(baseConfig) From 586d77a3599a0145a5e6628f9a7d8f0966197f6e Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 07:31:29 +0800 Subject: [PATCH 22/34] test(memory): isolate the global config dir per test file (CI fix) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Second dev-CI failure investigation (run 31648866555) with the identity-fixture fix in place: the same assertion still failed, still with no visible warning. Verified root cause: bun test runs all files in ONE process, sequentially, sharing one XDG_CONFIG_HOME. A file that runs before this one and triggers global-memory initialization (memory.test prepare, or instance boot via bootstrap.ts memory.init) leaves a VALID global memory.jsonc whose model this file's fake provider does not know. writeGlobal then silently no-ops over the valid file (config.ts returns false), configuration() loads the foreign model, resolveModel fails (the warning is captured by TestConsole and never reaches CI logs), and search fails closed with "unavailable". R1-00's identical flow passes because R1-07's finalizer removes the global file in between. CI-only because bun's file order is deterministic per filesystem state and the fresh CI checkout orders a contaminator before this file. Fix: pin a private OPENCODE_CONFIG_DIR per file (beforeAll/afterAll, live env getter — globalConfigDir reads it at call time) so the global file can never be contaminated by earlier files, plus a tripwire assertion after writeGlobal that the loaded global config carries the expected model. Registered separately (product hardening): writeGlobal should log when it declines to overwrite an existing valid config. Co-Authored-By: Claude --- .../memory/memory-global-identity.test.ts | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/packages/opencode/test/memory/memory-global-identity.test.ts b/packages/opencode/test/memory/memory-global-identity.test.ts index e62e9fb650..ad94ce4a24 100644 --- a/packages/opencode/test/memory/memory-global-identity.test.ts +++ b/packages/opencode/test/memory/memory-global-identity.test.ts @@ -1,4 +1,4 @@ -import { describe, expect } from "bun:test" +import { afterAll, beforeAll, describe, expect } from "bun:test" import { Database } from "@opencode-ai/core/database/database" import { ProjectTable } from "@opencode-ai/core/project/sql" import { eq } from "drizzle-orm" @@ -12,6 +12,7 @@ import { Effect, Layer } from "effect" import { stringify } from "yaml" import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process" import fs from "node:fs" +import os from "node:os" import path from "node:path" import { Config } from "@/config/config" import { Git } from "@/git" @@ -31,6 +32,24 @@ import { InstanceRef } from "@/effect/instance-ref" import { provideInstance, testInstanceStoreLayer, tmpdirScoped } from "../fixture/fixture" import { testEffect } from "../lib/effect" +// bun test runs all files in one process, sequentially, sharing one +// XDG_CONFIG_HOME — so a test file that runs before this one and triggers +// global-memory initialization leaves a VALID memory.jsonc whose model this +// file's fake provider does not know; writeGlobal then silently no-ops over +// it and search fails closed with "unavailable" (dev CI, deterministic). +// Pin a private config dir per file so the global file can never be +// contaminated by earlier files. +const pinnedConfigDir = path.join(os.tmpdir(), `opencode-memory-global-identity-${process.pid}`) +const previousConfigDir = process.env.OPENCODE_CONFIG_DIR +beforeAll(() => { + fs.mkdirSync(pinnedConfigDir, { recursive: true }) + process.env.OPENCODE_CONFIG_DIR = pinnedConfigDir +}) +afterAll(() => { + if (previousConfigDir === undefined) delete process.env.OPENCODE_CONFIG_DIR + else process.env.OPENCODE_CONFIG_DIR = previousConfigDir +}) + const now = "2026-08-12T12:00:00Z" const providerID = ProviderV2.ID.make("test") const enabledModel = ProviderTest.model({ providerID, id: ModelV2.ID.make("memory-on") }) @@ -166,6 +185,10 @@ describe("MEM-PR01-R1-03: memory is inert once the identity row is retired", () yield* project.setInitialized(info.id) yield* configStore.writeGlobal(baseConfig) + // Tripwire: writeGlobal silently no-ops over a pre-existing VALID + // config, so a contaminated global dir would leave a foreign model + // here and every search would fail closed. + expect((yield* configStore.loadGlobal())?.config.model).toBe("test/memory-on") const sessionID = SessionID.make("ses_retired_identity") const active = yield* memory.search({ sessionID, messages: [userMessage(sessionID)], query: "任意查询" }) From 349bd9c809ad0bb9c50d37bfc08b078cfdc13c9a Mon Sep 17 00:00:00 2001 From: Lex Date: Tue, 11 Aug 2026 15:07:28 +0800 Subject: [PATCH 23/34] fix(opencode): serialize goal automation state --- packages/core/src/database/migration.gen.ts | 1 + .../migration/20260811060000_goal_outcome.ts | 21 + packages/core/src/database/schema.gen.ts | 9 + packages/core/src/goal/sql.ts | 11 + packages/opencode/src/dag/runtime/loop.ts | 83 ++- packages/opencode/src/goal/CONTEXT.md | 37 ++ .../adr/0001-goal-transition-authority.md | 40 ++ packages/opencode/src/goal/goal.ts | 509 +++++++++--------- packages/opencode/src/goal/judge.ts | 12 +- packages/opencode/src/goal/loop.ts | 84 +-- packages/opencode/src/goal/prompts.ts | 11 +- packages/opencode/src/goal/state.ts | 29 +- .../opencode/src/session/automation-lease.ts | 124 +++++ packages/opencode/test/goal/e2e-loop.test.ts | 167 +++++- packages/opencode/test/goal/goal.test.ts | 141 ++++- packages/opencode/test/goal/judge.test.ts | 11 + .../test/session/automation-lease.test.ts | 45 ++ 17 files changed, 995 insertions(+), 340 deletions(-) create mode 100644 packages/core/src/database/migration/20260811060000_goal_outcome.ts create mode 100644 packages/opencode/src/goal/CONTEXT.md create mode 100644 packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md create mode 100644 packages/opencode/src/session/automation-lease.ts create mode 100644 packages/opencode/test/session/automation-lease.test.ts diff --git a/packages/core/src/database/migration.gen.ts b/packages/core/src/database/migration.gen.ts index 1c21bf23b1..aaf56d9868 100644 --- a/packages/core/src/database/migration.gen.ts +++ b/packages/core/src/database/migration.gen.ts @@ -51,5 +51,6 @@ export const migrations = ( import("./migration/20260803083938_restore_goal_state"), import("./migration/20260805094941_workflow_node_timeout_extensions"), import("./migration/20260805094942_workflow_node_escalation_pending"), + import("./migration/20260811060000_goal_outcome"), ]) ).map((module) => module.default) satisfies DatabaseMigration.Migration[] diff --git a/packages/core/src/database/migration/20260811060000_goal_outcome.ts b/packages/core/src/database/migration/20260811060000_goal_outcome.ts new file mode 100644 index 0000000000..6cc45b5b17 --- /dev/null +++ b/packages/core/src/database/migration/20260811060000_goal_outcome.ts @@ -0,0 +1,21 @@ +import { Effect } from "effect" +import type { DatabaseMigration } from "../migration" + +export default { + id: "20260811060000_goal_outcome", + up(tx) { + return Effect.gen(function* () { + yield* tx.run(` + CREATE TABLE goal_outcome ( + goal_id text PRIMARY KEY, + session_id text NOT NULL, + payload text NOT NULL, + completed_at integer NOT NULL + ); + `) + yield* tx.run( + `CREATE INDEX goal_outcome_session_completed_idx ON goal_outcome (session_id, completed_at);`, + ) + }) + }, +} satisfies DatabaseMigration.Migration diff --git a/packages/core/src/database/schema.gen.ts b/packages/core/src/database/schema.gen.ts index ac75ddb53a..224a2f04e8 100644 --- a/packages/core/src/database/schema.gen.ts +++ b/packages/core/src/database/schema.gen.ts @@ -156,6 +156,14 @@ export default { \`updated_at\` integer NOT NULL ); `) + yield* tx.run(` + CREATE TABLE \`goal_outcome\` ( + \`goal_id\` text PRIMARY KEY, + \`session_id\` text NOT NULL, + \`payload\` text NOT NULL, + \`completed_at\` integer NOT NULL + ); + `) yield* tx.run(` CREATE TABLE \`permission\` ( \`id\` text PRIMARY KEY, @@ -324,6 +332,7 @@ export default { yield* tx.run(`CREATE UNIQUE INDEX \`event_aggregate_seq_idx\` ON \`event\` (\`aggregate_id\`,\`seq\`);`) yield* tx.run(`CREATE INDEX \`event_aggregate_type_seq_idx\` ON \`event\` (\`aggregate_id\`,\`type\`,\`seq\`);`) yield* tx.run(`CREATE INDEX \`goal_state_updated_at_idx\` ON \`goal_state\` (\`updated_at\`);`) + yield* tx.run(`CREATE INDEX \`goal_outcome_session_completed_idx\` ON \`goal_outcome\` (\`session_id\`, \`completed_at\`);`) yield* tx.run( `CREATE UNIQUE INDEX \`permission_project_action_resource_idx\` ON \`permission\` (\`project_id\`,\`action\`,\`resource\`);`, ) diff --git a/packages/core/src/goal/sql.ts b/packages/core/src/goal/sql.ts index fb33057cb1..55b8a8962b 100644 --- a/packages/core/src/goal/sql.ts +++ b/packages/core/src/goal/sql.ts @@ -9,3 +9,14 @@ export const GoalStateTable = sqliteTable( }, (t) => [index("goal_state_updated_at_idx").on(t.updated_at)], ) + +export const GoalOutcomeTable = sqliteTable( + "goal_outcome", + { + goal_id: text().primaryKey(), + session_id: text().notNull(), + payload: text().notNull(), + completed_at: integer().notNull(), + }, + (t) => [index("goal_outcome_session_completed_idx").on(t.session_id, t.completed_at)], +) diff --git a/packages/opencode/src/dag/runtime/loop.ts b/packages/opencode/src/dag/runtime/loop.ts index c5bcdfd294..20def0c963 100644 --- a/packages/opencode/src/dag/runtime/loop.ts +++ b/packages/opencode/src/dag/runtime/loop.ts @@ -23,6 +23,7 @@ import { Session } from "@/session/session" import { SessionPrompt } from "@/session/prompt" import { SessionID } from "@/session/schema" import { SessionStatus } from "@/session/status" +import { SessionAutomationLease } from "@/session/automation-lease" import { renderTemplate } from "../templates/resolve" import { sanitizeInput } from "../templates/sanitize" import { DagConfig } from "../config" @@ -46,7 +47,7 @@ interface WorkflowEntry { watchers: Map> } -export const layer = Layer.effect( +const serviceLayer = Layer.effect( Service, Effect.gen(function* () { const events = yield* EventV2Bridge.Service @@ -56,6 +57,7 @@ export const layer = Layer.effect( const sessionSvc = yield* Session.Service const promptSvc = yield* SessionPrompt.Service const statusSvc = yield* SessionStatus.Service + const automation = yield* SessionAutomationLease.Service const state = yield* InstanceState.make( Effect.fn("DagLoop.state")(function* (ctx) { @@ -391,6 +393,7 @@ export const layer = Layer.effect( if (isStepping) runtime.setStepMode(true) const entry: WorkflowEntry = { runtime, semaphore, evalLock: Semaphore.makeUnsafe(1), parentSessionID: wf.sessionId, config, fibers: new Map(), watchers: new Map() } runtimes.set(dagID, entry) + yield* automation.register(SessionID.make(wf.sessionId), { kind: "dag", id: dagID }) // Reconciliation settles every persisted running attempt before the // runtime is rebuilt. Recovery never adopts or restarts provider work; // a new execution attempt must come from explicit workflow control. @@ -483,6 +486,7 @@ export const layer = Layer.effect( const semaphore = Semaphore.makeUnsafe(maxConcurrency) const entry: WorkflowEntry = { runtime, semaphore, evalLock: Semaphore.makeUnsafe(1), parentSessionID: wf.sessionId, config, fibers: new Map(), watchers: new Map() } runtimes.set(dagID, entry) + yield* automation.register(SessionID.make(wf.sessionId), { kind: "dag", id: dagID }) yield* entry.evalLock.withPermits(1)( Effect.gen(function* () { yield* spawnReady(dagID) @@ -1159,6 +1163,18 @@ export const layer = Layer.effect( : []), ].join("\n\n") + const wakeWorkflowIDs = new Set([ + ...batch.nodes.map((node) => node.workflowId), + ...batch.workflows.map((workflow) => workflow.id), + ]) + for (const workflowID of wakeWorkflowIDs) { + yield* automation.register(SessionID.make(sessionID), { kind: "dag", id: workflowID }) + } + const wakeLease = Option.getOrUndefined( + yield* automation.claim(SessionID.make(sessionID), { kind: "dag" }), + ) + if (!wakeLease) return + // Persist wake_reported AFTER successful delivery only. // A failure stays durable for a later idle event or restart scan; // it must not spin synchronously on the same row. @@ -1166,27 +1182,46 @@ export const layer = Layer.effect( // receives the node result and can act) but NOT rendered as a user // message in the TUI chat — DAG data surfaces via the sidebar panel // and Inspector, keeping the chat conversation clean. - const didDeliver = yield* promptSvc.promptIfIdle({ - sessionID: SessionID.make(sessionID), - parts: [{ type: "text", text: summary, synthetic: true }], - }).pipe( - Effect.flatMap(Option.match({ - onNone: () => Effect.succeed(false), - onSome: () => - store.markWakeBatchReported(batch).pipe( - Effect.tap(() => - Effect.sync(() => { - plan.unresponsiveDagIDs.forEach((workflowID) => - deliveredUnresponsiveDagIDs.add(workflowID), - ) - }), - ), - Effect.as(true), + const didDeliver = Option.getOrElse( + yield* automation.use( + wakeLease, + promptSvc.promptIfIdle({ + sessionID: SessionID.make(sessionID), + parts: [{ type: "text", text: summary, synthetic: true }], + }).pipe( + Effect.flatMap(Option.match({ + onNone: () => Effect.succeed(false), + onSome: () => + store.markWakeBatchReported(batch).pipe( + Effect.tap(() => + Effect.forEach( + batch.workflows.filter((workflow) => + isWorkflowTerminalStatus(workflow.status as never), + ), + (workflow) => + automation.unregister(SessionID.make(sessionID), { + kind: "dag", + id: workflow.id, + }), + { discard: true }, + ), + ), + Effect.tap(() => + Effect.sync(() => { + plan.unresponsiveDagIDs.forEach((workflowID) => + deliveredUnresponsiveDagIDs.add(workflowID), + ) + }), + ), + Effect.as(true), + ), + })), + Effect.catchCause(() => + Effect.logWarning("DAG wake delivery failed", { sessionID }).pipe(Effect.as(false)), ), - })), - Effect.catchCause(() => - Effect.logWarning("DAG wake delivery failed", { sessionID }).pipe(Effect.as(false)), + ), ), + () => false, ) if (!didDeliver) return } @@ -1260,6 +1295,12 @@ export const layer = Layer.effect( ), ) if (!snapshot.workflows.some((wf) => wf.projectId === ctx.project.id)) continue + yield* Effect.forEach( + snapshot.workflows, + (workflow) => + automation.register(SessionID.make(sessionID), { kind: "dag", id: workflow.id }), + { discard: true }, + ) yield* tryDeliverWake(sessionID).pipe(Effect.forkScoped) } @@ -1275,6 +1316,8 @@ export const layer = Layer.effect( }), ) +export const layer = serviceLayer.pipe(Layer.provide(SessionAutomationLease.defaultLayer)) + export const defaultLayer = layer.pipe( Layer.provide(EventV2Bridge.defaultLayer), Layer.provide(DagStore.defaultLayer), diff --git a/packages/opencode/src/goal/CONTEXT.md b/packages/opencode/src/goal/CONTEXT.md new file mode 100644 index 0000000000..449914813a --- /dev/null +++ b/packages/opencode/src/goal/CONTEXT.md @@ -0,0 +1,37 @@ +# Standing Goal Context + +Standing Goal keeps one durable autonomous objective for a Session and advances it only when that Session becomes idle. + +## Glossary + +| Term | Meaning | +| --- | --- | +| Goal Instance | One objective generation, identified by `goal_id`; clearing and creating a new objective creates a different instance. | +| Goal Revision | The monotonic version of one Goal Instance. Loop decisions carry the revision they observed. | +| Goal Transition | One serialized read, decision, and save/delete operation over a Goal row. | +| Goal Outcome | The durable terminal snapshot written in the same transaction that removes the current Goal row. | +| Judge Verdict | `done`, `continue`, or `blocked`; blocked is a recoverable pause, never successful completion. | +| Session Automation Lease | The process-local right to admit an autonomous prompt while a Session is idle. | + +## Invariants + +- `transition` in `goal.ts` is the only durable Goal mutation seam. +- A Goal transition reads and writes or deletes inside one immediate database transaction. +- A delayed loop decision applies only to the same `goal_id` and revision it observed. +- Terminal completion writes `goal_outcome` and deletes the current row in one transition; a durable `done` row is never an intermediate cleanup obligation. +- `blocked` pauses the Goal and remains distinguishable from `done` in state, events, transcript text, and judge prompts. +- `SessionAutomationLease` elects one automation owner per Session. DAG owns the Session while any registered workflow remains; Goal is eligible only after the final DAG owner releases it. +- Goal and DAG effects revalidate the claimed generation immediately before mutation or prompt admission. `SessionPrompt.promptIfIdle` remains the final idle-state guard. +- The current Session runner is process-local, so the automation lease is process-local. Clustered execution requires a separate durable lease design. + +## Boundaries + +- `Goal` owns durable state transitions and Goal lifecycle events. +- `GoalJudge` owns verdict parsing and transport-failure fallback. +- `GoalLoop` observes idle Sessions, asks the judge, submits version-bound transitions, and requests the shared Session automation lease. +- `SessionAutomationLease` owns Goal/DAG arbitration; `SessionPrompt` and `SessionRunState` own final prompt admission and runner idleness. +- `DagLoop` and `GoalLoop` may both observe one Session, but neither may mutate from an unverified automation claim or bypass `promptIfIdle` for autonomous driving. + +## Decisions + +- [ADR-0001: Serialized Goal transitions and shared Session automation admission](docs/adr/0001-goal-transition-authority.md) diff --git a/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md b/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md new file mode 100644 index 0000000000..6f29f22716 --- /dev/null +++ b/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md @@ -0,0 +1,40 @@ +# ADR-0001: Serialized Goal transitions and shared Session automation admission + +- Status: Accepted +- Date: 2026-08-11 + +## Context + +Goal commands and GoalLoop previously loaded a row and later performed an unconditional upsert. A legal `pause` or `clear` racing a delayed judge result could therefore be overwritten or resurrected. Judge completion also persisted `done` and deleted it in a second operation, so a process failure between them left a terminal row that no loop would process. + +GoalLoop admitted continuation with `SessionPrompt.prompt`, while DagLoop admitted parent wakes with `promptIfIdle`. Both could observe the same idle Session and independently start automation. + +The judge also encoded blocked or unachievable work as successful completion, so presentation reported an achieved Goal without a deliverable. + +## Decision + +All durable Goal mutations go through one `transition` function. It uses an immediate database transaction to read the current row, decide from that row, and save or delete before releasing the write lock. Goal instances carry `goal_id` and `revision`; delayed judge work supplies both values and becomes a no-op if either changed. + +A `done` verdict writes an immutable `goal_outcome` snapshot and deletes the current row in the same transaction. It returns that snapshot for the `goal.updated(done)` followed by `goal.cleared` presentation contract. No durable done cleanup phase remains, while completion remains queryable after a process failure. + +Judge output is tri-state: `done`, `continue`, or `blocked`. `blocked` writes a paused Goal with the blocker as its reason. + +`SessionAutomationLease` is the process-local authority for Goal/DAG ownership. Goal and DAG register their active identities; DAG has priority while any workflow is registered. A claim carries a generation that is revalidated immediately before a state transition or autonomous prompt. Registration changes invalidate older claims. After that ownership check, `SessionPrompt.promptIfIdle` remains the final atomic idle-state admission guard. Failure at either boundary admits no Goal prompt and leaves the durable Goal available for a later idle event. + +## Consequences + +- Pause and clear cannot be overwritten by a stale judge decision. +- A judge result from a cleared Goal cannot mutate a replacement Goal in the same Session. +- Completion cannot strand a durable done row. +- Completion leaves one durable terminal outcome even though the current Goal view is empty. +- Blocked work is visible and resumable without being reported as achieved. +- Goal and DAG automation cannot concurrently admit two turns into one process-local Session. +- Clustered Session execution will need a durable lease before Session drains stop being process-local. + +## Alternatives Considered + +- Compare timestamps before unconditional upsert: rejected because it leaves read/write split and depends on clock uniqueness. +- Add only an in-memory Goal mutex: rejected because separate processes can still update the same database. +- Keep boolean judge output and infer blocked from reason text: rejected because state semantics would depend on unstructured language. +- Rely on the prompt mutex alone: rejected because the judge can mutate Goal state before prompt admission and because prompt serialization does not elect a Goal/DAG owner. +- Add a second Goal-specific prompt mutex: rejected because it would not coordinate with DagLoop. diff --git a/packages/opencode/src/goal/goal.ts b/packages/opencode/src/goal/goal.ts index 36eda34c7a..6dd1b9bc36 100644 --- a/packages/opencode/src/goal/goal.ts +++ b/packages/opencode/src/goal/goal.ts @@ -1,19 +1,26 @@ export * as Goal from "./goal" import { Effect, Layer, Context, Schema, Fiber } from "effect" -import { eq } from "drizzle-orm" +import { desc, eq } from "drizzle-orm" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { Database } from "@opencode-ai/core/database/database" import { EventV2Bridge } from "@/event-v2-bridge" import { GoalState } from "./state" -import { GoalStateTable } from "@opencode-ai/core/goal/sql" +import { GoalOutcomeTable, GoalStateTable } from "@opencode-ai/core/goal/sql" import { GoalEvent } from "./events" import { GoalPrompts } from "./prompts" import { SessionID } from "@/session/schema" import { SessionStatus } from "@/session/status" +import { SessionAutomationLease } from "@/session/automation-lease" + +export type RemoveSubgoalResult = + | { tag: "ok"; removed: string; state: GoalState.Info } + | { tag: "noState" } + | { tag: "outOfBounds"; size: number } export interface Interface { readonly load: (sessionID: SessionID) => Effect.Effect + readonly lastOutcome: (sessionID: SessionID) => Effect.Effect readonly set: (sessionID: SessionID, goal: string, maxTurns?: number) => Effect.Effect readonly pause: (sessionID: SessionID, reason: string) => Effect.Effect readonly resume: (sessionID: SessionID) => Effect.Effect @@ -24,11 +31,7 @@ export interface Interface { sessionID: SessionID, /** 1-based index of the subgoal to remove (1 = first subgoal). */ index: number, - ) => Effect.Effect< - | { tag: "ok"; removed: string; state: GoalState.Info } - | { tag: "noState" } - | { tag: "outOfBounds"; size: number } - > + ) => Effect.Effect readonly clearSubgoals: (sessionID: SessionID) => Effect.Effect readonly statusLine: (sessionID: SessionID) => Effect.Effect readonly dispatch: (sessionID: SessionID, args: string) => Effect.Effect<{ @@ -42,9 +45,10 @@ export interface Interface { }> readonly updateAfterJudge: ( sessionID: SessionID, - verdict: "done" | "continue", + verdict: GoalState.Verdict, reason: string, parseFailed: boolean, + expected?: { readonly goalID: string; readonly revision: number }, ) => Effect.Effect< | { state: GoalState.Info @@ -99,12 +103,13 @@ export interface Interface { export class Service extends Context.Service()("@opencode/Goal") {} -export const layer = Layer.effect( +const serviceLayer = Layer.effect( Service, Effect.gen(function* () { const events = yield* EventV2Bridge.Service const { db } = yield* Database.Service const sessionStatus = yield* SessionStatus.Service + const automation = yield* SessionAutomationLease.Service // Unified event publisher — every state change publishes goal.updated // with the full snapshot, identical to Todo's todo.updated pattern. @@ -154,49 +159,6 @@ export const layer = Layer.effect( } }) - // Terminal cleanup for "done" transitions. Loads current state (if any), - // constructs a transient snapshot with status="done" + the given reason, - // emits goal.updated(done), deletes the row, then emits goal.cleared. - // - // Does NOT touch the fiber map. This is the key safety property: - // - markDone (user-initiated from slash command or goal.complete - // tool) calls clearFiber FIRST, then deleteAndPublishDone — the - // loop fiber is already stopped when this runs. - // - loop.ts done branch calls deleteAndPublishDone DIRECTLY from - // inside the loop fiber — so it must not self-interrupt. - // - // Without this separation, calling goal.clear() from within afterIdle - // would interrupt ourselves before goal.cleared was published (the - // event bus would miss the terminal event, and TUI/SSE consumers - // polling state would never see the transition). - // - // The whole terminal sequence (load → publish(done) → delete → - // publish(cleared)) runs inside Effect.uninterruptible. This is - // defense-in-depth (F1): even if a future caller arranges for the loop - // fiber to be interrupted mid-call, the terminal event contract still - // completes atomically — goal.cleared cannot be skipped by an interrupt - // landing between publish(done) and publish(cleared). The operations are - // short synchronous DB + event publishes, so there is no deadlock risk. - const deleteAndPublishDone = Effect.fnUntraced(function* (sessionID: SessionID, reason: string) { - return yield* Effect.uninterruptible( - Effect.gen(function* () { - const state = yield* loadState(sessionID) - if (state) { - const doneState = new GoalState.Info({ - ...state, - status: "done", - last_verdict: "done", - last_reason: reason, - }) - yield* publishGoal(sessionID, doneState) - } - yield* deleteState(sessionID) - yield* events.publish(GoalEvent.Cleared, { sessionID }) - return state - }), - ) - }) - function loadState(sessionID: SessionID) { return db .select() @@ -212,34 +174,135 @@ export const layer = Layer.effect( ) } - function saveState(sessionID: SessionID, state: GoalState.Info) { - const payload = JSON.stringify(Schema.encodeSync(GoalState.Info)(state)) - return db - .insert(GoalStateTable) - .values({ session_id: sessionID, payload, updated_at: Date.now() }) - .onConflictDoUpdate({ - target: GoalStateTable.session_id, - set: { payload, updated_at: Date.now() }, - }) - .run() - .pipe(Effect.orDie) - } + type Transition = + | { readonly tag: "noop"; readonly value: A } + | { readonly tag: "save"; readonly state: GoalState.Info; readonly value: A } + | { + readonly tag: "delete" + readonly terminal?: GoalState.Info + readonly value: A + } - function deleteState(sessionID: SessionID) { - return db - .delete(GoalStateTable) - .where(eq(GoalStateTable.session_id, sessionID)) - .run() - .pipe(Effect.orDie) - } + // The only durable Goal mutation seam. The immediate transaction makes the + // read + decision + write/delete one serializable state transition, so a + // stale loop result cannot overwrite a concurrent pause or resurrect a row + // deleted by clear. Events are emitted after commit but inside the same + // uninterruptible region; durable state always leads presentation state. + const transition = ( + sessionID: SessionID, + decide: (state: GoalState.Info | undefined) => Transition, + ) => + Effect.uninterruptible( + Effect.gen(function* () { + const result = yield* db + .transaction( + (tx) => + Effect.gen(function* () { + const row = yield* tx + .select() + .from(GoalStateTable) + .where(eq(GoalStateTable.session_id, sessionID)) + .get() + const current = row + ? Schema.decodeUnknownSync(GoalState.Info)(JSON.parse(row.payload)) + : undefined + const next = decide(current) + if (next.tag === "save") { + const payload = JSON.stringify(Schema.encodeSync(GoalState.Info)(next.state)) + if (row) { + yield* tx + .update(GoalStateTable) + .set({ payload, updated_at: Math.max(Date.now(), row.updated_at + 1) }) + .where(eq(GoalStateTable.session_id, sessionID)) + .run() + } else { + yield* tx + .insert(GoalStateTable) + .values({ session_id: sessionID, payload, updated_at: Date.now() }) + .run() + } + } + if (next.tag === "delete" && row) { + if (next.terminal) { + const payload = JSON.stringify(Schema.encodeSync(GoalState.Info)(next.terminal)) + const goalID = + next.terminal.goal_id && next.terminal.goal_id !== "legacy" + ? next.terminal.goal_id + : `${sessionID}:legacy:${next.terminal.created_at}` + yield* tx + .insert(GoalOutcomeTable) + .values({ + goal_id: goalID, + session_id: sessionID, + payload, + completed_at: Date.now(), + }) + .onConflictDoUpdate({ + target: GoalOutcomeTable.goal_id, + set: { payload, completed_at: Date.now() }, + }) + .run() + } + yield* tx + .delete(GoalStateTable) + .where(eq(GoalStateTable.session_id, sessionID)) + .run() + } + return next + }), + { behavior: "immediate" }, + ) + .pipe(Effect.orDie) + if (result.tag === "save") yield* publishGoal(sessionID, result.state) + if (result.tag === "delete") { + if (result.terminal) yield* publishGoal(sessionID, result.terminal) + yield* events.publish(GoalEvent.Cleared, { sessionID }) + } + return result.value + }), + ) + + const matchesExpected = ( + state: GoalState.Info, + expected?: { readonly goalID: string; readonly revision: number }, + ) => + !expected || + ((state.goal_id ?? "legacy") === expected.goalID && (state.revision ?? 0) === expected.revision) + + const deleteAndPublishDone = Effect.fnUntraced(function* (sessionID: SessionID, reason: string) { + return yield* transition(sessionID, (state) => { + if (!state) return { tag: "noop", value: undefined } + const doneState = GoalState.advance(state, { + status: "done", + last_verdict: "done", + last_reason: reason, + }) + return { tag: "delete", terminal: doneState, value: state } + }) + }) const load = Effect.fn("Goal.load")(function* (sessionID: SessionID) { return yield* loadState(sessionID) }) + const lastOutcome = Effect.fn("Goal.lastOutcome")(function* (sessionID: SessionID) { + const row = yield* db + .select() + .from(GoalOutcomeTable) + .where(eq(GoalOutcomeTable.session_id, sessionID)) + .orderBy(desc(GoalOutcomeTable.completed_at)) + .limit(1) + .get() + .pipe(Effect.orDie) + if (!row) return undefined + return Schema.decodeUnknownSync(GoalState.Info)(JSON.parse(row.payload)) + }) + const set = Effect.fn("Goal.set")(function* (sessionID: SessionID, goal: string, maxTurns?: number) { const now = Date.now() const state = new GoalState.Info({ + goal_id: Bun.randomUUIDv7(), + revision: GoalState.nni(0), goal, status: "active", turns_used: GoalState.nni(0), @@ -249,23 +312,24 @@ export const layer = Layer.effect( consecutive_parse_failures: GoalState.nni(0), subgoals: [], }) - yield* saveState(sessionID, state) - yield* publishGoal(sessionID, state) - return state + const result = yield* transition(sessionID, () => ({ tag: "save", state, value: state })) + yield* automation.register(sessionID, { kind: "goal", id: result.goal_id ?? "legacy" }) + return result }) const pause = Effect.fn("Goal.pause")(function* (sessionID: SessionID, reason: string) { - const state = yield* loadState(sessionID) - if (!state || state.status !== "active") return undefined - const updated = new GoalState.Info({ - ...state, - status: "paused", - paused_reason: reason, - last_turn_at: Date.now(), + const updated = yield* transition(sessionID, (state) => { + if (!state || state.status !== "active") return { tag: "noop", value: undefined } + const next = GoalState.advance(state, { + status: "paused", + paused_reason: reason, + last_turn_at: Date.now(), + }) + return { tag: "save", state: next, value: next } }) - yield* saveState(sessionID, updated) + if (!updated) return undefined + yield* automation.unregister(sessionID, { kind: "goal", id: updated.goal_id ?? "legacy" }) yield* clearFiber(sessionID) - yield* publishGoal(sessionID, updated) return updated }) @@ -279,47 +343,38 @@ export const layer = Layer.effect( // and publishing goal.updated(paused) can never leave a paused DB row // with no corresponding event on the bus. const pauseAndPublish = Effect.fnUntraced(function* (sessionID: SessionID, reason: string) { - return yield* Effect.uninterruptible( - Effect.gen(function* () { - const state = yield* loadState(sessionID) - if (!state || state.status !== "active") return undefined - const updated = new GoalState.Info({ - ...state, - status: "paused", - paused_reason: reason, - last_turn_at: Date.now(), - }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return updated - }), - ) + return yield* transition(sessionID, (state) => { + if (!state || state.status !== "active") return { tag: "noop", value: undefined } + const updated = GoalState.advance(state, { + status: "paused", + paused_reason: reason, + last_turn_at: Date.now(), + }) + return { tag: "save", state: updated, value: updated } + }) }) const resume = Effect.fn("Goal.resume")(function* (sessionID: SessionID) { - const state = yield* loadState(sessionID) - if (!state || state.status !== "paused") return undefined - // Preserve turns_used so the original max_turns budget is respected. - // Resetting to 0 would silently grant another full budget, defeating - // `max_turns` as a runaway guard — a paused goal that exhausted its - // budget would immediately re-exhaust the new budget on resume. - // Users wanting a fresh budget should /goal clear and /goal . - const updated = new GoalState.Info({ - ...state, - status: "active", - consecutive_parse_failures: GoalState.nni(0), - paused_reason: undefined, - last_turn_at: Date.now(), + const updated = yield* transition(sessionID, (state) => { + if (!state || state.status !== "paused") return { tag: "noop", value: undefined } + const updated = GoalState.advance(state, { + status: "active", + consecutive_parse_failures: GoalState.nni(0), + paused_reason: undefined, + last_turn_at: Date.now(), + }) + return { tag: "save", state: updated, value: updated } }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) + if (updated) + yield* automation.register(sessionID, { kind: "goal", id: updated.goal_id ?? "legacy" }) return updated }) const clear = Effect.fn("Goal.clear")(function* (sessionID: SessionID) { - yield* deleteState(sessionID) + const cleared = yield* transition(sessionID, (state) => ({ tag: "delete", value: state })) + if (cleared) + yield* automation.unregister(sessionID, { kind: "goal", id: cleared.goal_id ?? "legacy" }) yield* clearFiber(sessionID) - yield* events.publish(GoalEvent.Cleared, { sessionID }) }) const markDone = Effect.fn("Goal.markDone")(function* (sessionID: SessionID, reason: string) { @@ -331,50 +386,48 @@ export const layer = Layer.effect( // row (preserving whatever turns_used a prior continue dispatch set) and // re-renders the done snapshot from it. yield* clearFiber(sessionID) - return yield* deleteAndPublishDone(sessionID, reason) + const completed = yield* deleteAndPublishDone(sessionID, reason) + if (completed) + yield* automation.unregister(sessionID, { kind: "goal", id: completed.goal_id ?? "legacy" }) + return completed }) const addSubgoal = Effect.fn("Goal.addSubgoal")(function* (sessionID: SessionID, subgoal: string) { - const state = yield* loadState(sessionID) - if (!state) return undefined - const updated = new GoalState.Info({ - ...state, - subgoals: [...(state.subgoals ?? []), subgoal], - last_turn_at: Date.now(), + return yield* transition(sessionID, (state) => { + if (!state) return { tag: "noop", value: undefined } + const updated = GoalState.advance(state, { + subgoals: [...(state.subgoals ?? []), subgoal], + last_turn_at: Date.now(), + }) + return { tag: "save", state: updated, value: updated } }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return updated }) const removeSubgoal = Effect.fn("Goal.removeSubgoal")(function* (sessionID: SessionID, index: number) { - const state = yield* loadState(sessionID) - if (!state) return { tag: "noState" as const } - const subgoals = state.subgoals ?? [] - const idx = index - 1 - if (idx < 0 || idx >= subgoals.length) return { tag: "outOfBounds" as const, size: subgoals.length } - const removed = subgoals[idx] - const updated = new GoalState.Info({ - ...state, - subgoals: subgoals.filter((_, i) => i !== idx), - last_turn_at: Date.now(), + return yield* transition(sessionID, (state) => { + if (!state) return { tag: "noop", value: { tag: "noState" as const } } + const subgoals = state.subgoals ?? [] + const idx = index - 1 + if (idx < 0 || idx >= subgoals.length) + return { tag: "noop", value: { tag: "outOfBounds" as const, size: subgoals.length } } + const removed = subgoals[idx] + const updated = GoalState.advance(state, { + subgoals: subgoals.filter((_, i) => i !== idx), + last_turn_at: Date.now(), + }) + return { tag: "save", state: updated, value: { tag: "ok" as const, removed, state: updated } } }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return { tag: "ok" as const, removed, state: updated } }) const clearSubgoals = Effect.fn("Goal.clearSubgoals")(function* (sessionID: SessionID) { - const state = yield* loadState(sessionID) - if (!state) return undefined - const updated = new GoalState.Info({ - ...state, - subgoals: [], - last_turn_at: Date.now(), + return yield* transition(sessionID, (state) => { + if (!state) return { tag: "noop", value: undefined } + const updated = GoalState.advance(state, { + subgoals: [], + last_turn_at: Date.now(), + }) + return { tag: "save", state: updated, value: updated } }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return updated }) const statusLine = Effect.fn("Goal.statusLine")(function* (sessionID: SessionID) { @@ -395,82 +448,65 @@ export const layer = Layer.effect( const updateAfterJudge = Effect.fn("Goal.updateAfterJudge")(function* ( sessionID: SessionID, - verdict: "done" | "continue", + verdict: GoalState.Verdict, reason: string, parseFailed: boolean, + expected?: { readonly goalID: string; readonly revision: number }, ) { - const state = yield* loadState(sessionID) - if (!state || state.status !== "active") return undefined - - const now = Date.now() - const newParseFailures = parseFailed ? state.consecutive_parse_failures + 1 : 0 - - if (verdict === "done") { - const updated = new GoalState.Info({ - ...state, - status: "done", - // State transitions are budget-neutral — a `done` verdict drives no - // continuation dispatch, so it must NOT consume budget. turns_used - // reflects only continuation dispatches (see spec: - // turn-budget-counts-continuation-dispatches-only). - turns_used: state.turns_used, - last_turn_at: now, - last_verdict: "done", - last_reason: reason, - consecutive_parse_failures: GoalState.nni(newParseFailures), - }) - yield* saveState(sessionID, updated) - // Do NOT publish goal.updated here. deleteAndPublishDone is the SOLE - // owner of the terminal event sequence (goal.updated(done) → delete → - // goal.cleared); publishing here would double-fire goal.updated(done) - // on every judge-declared completion (see spec: - // terminal-event-contract-publishes-exactly-once). We still saveState - // so deleteAndPublishDone can load the done row and re-render the - // snapshot. loop.ts invokes deleteAndPublishDone after this returns. - return { - state: updated, - shouldContinue: false, - message: `✓ 目标已达成：${reason}`, + return yield* transition(sessionID, (state) => { + if (!state || state.status !== "active" || !matchesExpected(state, expected)) + return { tag: "noop", value: undefined } + + const now = Date.now() + const newParseFailures = parseFailed ? state.consecutive_parse_failures + 1 : 0 + if (verdict === "done") { + const updated = GoalState.advance(state, { + status: "done", + last_turn_at: now, + last_verdict: "done", + last_reason: reason, + consecutive_parse_failures: GoalState.nni(newParseFailures), + }) + return { + tag: "delete", + terminal: updated, + value: { + state: updated, + shouldContinue: false, + message: `✓ 目标已达成：${reason}`, + }, + } } - } - - const turnsUsed = GoalState.nni(state.turns_used + 1) - if (newParseFailures >= GoalPrompts.MAX_CONSECUTIVE_PARSE_FAILURES) { - const pauseReason = - "judge 模型未返回有效 JSON 判定。请检查模型配置或换用更可靠的模型，然后 /goal resume。" - const updated = new GoalState.Info({ - ...state, - status: "paused", - turns_used: turnsUsed, - last_turn_at: now, - last_verdict: "continue", - last_reason: reason, - paused_reason: pauseReason, - consecutive_parse_failures: GoalState.nni(newParseFailures), - }) - // Do NOT call clearFiber here. updateAfterJudge is inlined into - // GoalLoop.afterIdle (loop.ts:122), so the fiber running this code - // IS the one registered in the fibers map — clearFiber would - // self-interrupt before publishGoal reaches the event bus, leaving - // the pause invisible to SSE/TUI and aborting the rest of afterIdle. - // The fiber naturally terminates when afterIdle returns; no explicit - // interrupt is needed (same rationale as pauseAndPublish / - // deleteAndPublishDone). - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return { - state: updated, - shouldContinue: false, - message: `⏸ 目标已暂停 — ${pauseReason}`, + if (verdict === "blocked") { + const updated = GoalState.advance(state, { + status: "paused", + last_turn_at: now, + last_verdict: "blocked", + last_reason: reason, + paused_reason: reason, + consecutive_parse_failures: GoalState.nni(newParseFailures), + }) + return { + tag: "save", + state: updated, + value: { + state: updated, + shouldContinue: false, + message: `⏸ 目标已阻塞 — ${reason}`, + }, + } } - } - if (turnsUsed >= state.max_turns) { - const pauseReason = `已用 ${turnsUsed}/${state.max_turns} 轮。使用 /goal resume 继续，或 /goal clear 停止。` - const updated = new GoalState.Info({ - ...state, - status: "paused", + const turnsUsed = GoalState.nni(state.turns_used + 1) + const pauseReason = + newParseFailures >= GoalPrompts.MAX_CONSECUTIVE_PARSE_FAILURES + ? "judge 模型未返回有效 JSON 判定。请检查模型配置或换用更可靠的模型，然后 /goal resume。" + : turnsUsed >= state.max_turns + ? `已用 ${turnsUsed}/${state.max_turns} 轮。使用 /goal resume 继续，或 /goal clear 停止。` + : undefined + const updated = GoalState.advance(state, { + status: pauseReason ? "paused" : "active", turns_used: turnsUsed, last_turn_at: now, last_verdict: "continue", @@ -478,34 +514,18 @@ export const layer = Layer.effect( paused_reason: pauseReason, consecutive_parse_failures: GoalState.nni(newParseFailures), }) - // Same self-interrupt hazard as the parse-failure branch above: we - // are running inside the afterIdle loop fiber, so clearFiber would - // interrupt ourselves before publishGoal(paused) fires. - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) return { + tag: "save", state: updated, - shouldContinue: false, - message: `⏸ 目标已暂停 — ${pauseReason}`, + value: { + state: updated, + shouldContinue: !pauseReason, + message: pauseReason + ? `⏸ 目标已暂停 — ${pauseReason}` + : `↻ 继续推进目标（${updated.turns_used}/${updated.max_turns}）：${reason}`, + }, } - } - - const updated = new GoalState.Info({ - ...state, - status: "active", - turns_used: turnsUsed, - last_turn_at: now, - last_verdict: "continue", - last_reason: reason, - consecutive_parse_failures: GoalState.nni(newParseFailures), }) - yield* saveState(sessionID, updated) - yield* publishGoal(sessionID, updated) - return { - state: updated, - shouldContinue: true, - message: `↻ 继续推进目标（${updated.turns_used}/${updated.max_turns}）：${reason}`, - } }) const dispatch = Effect.fn("Goal.dispatch")(function* (sessionID: SessionID, args: string) { @@ -678,6 +698,7 @@ export const layer = Layer.effect( return Service.of({ load, + lastOutcome, set, pause, resume, @@ -699,10 +720,16 @@ export const layer = Layer.effect( }), ) +export const layer = serviceLayer.pipe(Layer.provide(SessionAutomationLease.defaultLayer)) + export const defaultLayer = layer.pipe( Layer.provide(SessionStatus.defaultLayer), Layer.provide(EventV2Bridge.defaultLayer), Layer.provide(Database.defaultLayer), ) -export const node = LayerNode.make(layer, [EventV2Bridge.node, Database.node, SessionStatus.node]) +export const node = LayerNode.make(layer, [ + EventV2Bridge.node, + Database.node, + SessionStatus.node, +]) diff --git a/packages/opencode/src/goal/judge.ts b/packages/opencode/src/goal/judge.ts index 0f2bedf712..16846e986d 100644 --- a/packages/opencode/src/goal/judge.ts +++ b/packages/opencode/src/goal/judge.ts @@ -4,7 +4,7 @@ import { Effect } from "effect" import { GoalPrompts } from "./prompts" export interface JudgeResult { - readonly verdict: "done" | "continue" + readonly verdict: "done" | "continue" | "blocked" readonly reason: string readonly parseFailed: boolean } @@ -16,6 +16,11 @@ export function parseJudgeResponse(raw: string): JudgeResult { // Step 2: try JSON.parse whole string try { const obj = JSON.parse(stripped) + if ( + (obj.verdict === "done" || obj.verdict === "continue" || obj.verdict === "blocked") && + typeof obj.reason === "string" + ) + return { verdict: obj.verdict, reason: obj.reason, parseFailed: false } if (typeof obj.done === "boolean" && typeof obj.reason === "string") return { verdict: obj.done ? "done" : "continue", reason: obj.reason, parseFailed: false } } catch {} @@ -25,6 +30,11 @@ export function parseJudgeResponse(raw: string): JudgeResult { if (match) { try { const obj = JSON.parse(match[0]) + if ( + (obj.verdict === "done" || obj.verdict === "continue" || obj.verdict === "blocked") && + typeof obj.reason === "string" + ) + return { verdict: obj.verdict, reason: obj.reason, parseFailed: false } if (typeof obj.done === "boolean" && typeof obj.reason === "string") return { verdict: obj.done ? "done" : "continue", reason: obj.reason, parseFailed: false } } catch {} diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index 31b748cb3c..122e824624 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -13,6 +13,7 @@ import { GoalJudge } from "./judge" import { GoalPrompts } from "./prompts" import { generateText } from "ai" import { SessionID } from "@/session/schema" +import { SessionAutomationLease } from "@/session/automation-lease" export interface Interface { readonly init: () => Effect.Effect @@ -97,7 +98,7 @@ export function isStaleZombie( ) } -export const layer = Layer.effect( +const serviceLayer = Layer.effect( Service, Effect.gen(function* () { const events = yield* EventV2Bridge.Service @@ -106,6 +107,14 @@ export const layer = Layer.effect( const provider = yield* Provider.Service const goal = yield* Goal.Service const status = yield* SessionStatus.Service + const automation = yield* SessionAutomationLease.Service + + const pauseGoal = Effect.fnUntraced(function* (sessionID: SessionID, reason: string) { + const paused = yield* goal.pauseAndPublish(sessionID, reason) + if (paused) + yield* automation.unregister(sessionID, { kind: "goal", id: paused.goal_id ?? "legacy" }) + return paused + }) const state = yield* InstanceState.make( Effect.fn("GoalLoop.state")(function* (_ctx) { @@ -150,6 +159,10 @@ export const layer = Layer.effect( const afterIdle = Effect.fn("GoalLoop.afterIdle")(function* (sessionID: SessionID) { const goalState = yield* goal.load(sessionID) if (!goalState || goalState.status !== "active") return + const goalOwner = { kind: "goal" as const, id: goalState.goal_id ?? "legacy" } + yield* automation.register(sessionID, goalOwner) + const observedLease = Option.getOrUndefined(yield* automation.claim(sessionID, goalOwner)) + if (!observedLease) return // Zombie-goal freshness guard (D6). If the goal is active but has run // zero continuations and is older than FRESHNESS_THRESHOLD, the initial @@ -172,12 +185,10 @@ export const layer = Layer.effect( const probeMsgs = yield* sessions.messages({ sessionID, limit: 1 }) const hasAssistant = probeMsgs.some((m) => m.info.role === "assistant") if (isStaleZombie(goalState, hasAssistant)) { - yield* goal - .pauseAndPublish( + yield* pauseGoal( sessionID, `initial kick produced no assistant response within ${GoalPrompts.FRESHNESS_THRESHOLD / 1000}s — likely provider error or model refusal. Use /goal resume to retry.`, - ) - .pipe(Effect.ignore) + ).pipe(Effect.ignore) return } } @@ -189,7 +200,7 @@ export const layer = Layer.effect( // been compacted or the initial kick failed after the stale-zombie // guard window. Pause visibly instead of silently stalling. const pauseMsg = "近期消息中无 assistant 回复，目标已暂停。使用 /goal resume 重试。" - yield* goal.pauseAndPublish(sessionID, pauseMsg).pipe(Effect.ignore) + yield* pauseGoal(sessionID, pauseMsg).pipe(Effect.ignore) yield* promptSvc.prompt({ sessionID, noReply: true, parts: [{ type: "text", text: `⏸ 目标已暂停 — ${pauseMsg}` }] }).pipe(Effect.ignore) return } @@ -240,30 +251,26 @@ export const layer = Layer.effect( ) : { verdict: "continue" as const, reason: "上一轮无文本输出（纯工具调用），跳过判定直接继续", parseFailed: false } - const updateResult = yield* goal.updateAfterJudge(sessionID, verdict.verdict, verdict.reason, verdict.parseFailed) + const updateResult = Option.getOrUndefined( + yield* automation.use( + observedLease, + goal.updateAfterJudge( + sessionID, + verdict.verdict, + verdict.reason, + verdict.parseFailed, + { + goalID: goalState.goal_id ?? "legacy", + revision: goalState.revision ?? 0, + }, + ), + ), + ) if (!updateResult) return if (!updateResult.shouldContinue) { - // Inject visible completion message when goal is achieved, then - // auto-clear the goal state. `updateAfterJudge` already persisted - // a done snapshot and published goal.updated — that snapshot is - // only kept long enough to emit the completion message, then the - // row is removed so done is a transient visual-only state (mirrors - // how /goal clear behaves). This is what makes goal completion - // not require a manual /goal clear afterwards. + yield* automation.unregister(sessionID, goalOwner) if (verdict.verdict === "done") { - // Run the terminal event sequence FIRST (F1): publish(done) → - // delete → publish(cleared) is the contract SSE/TUI consumers - // rely on, so it must complete before any other effect that could - // race the loop fiber. deleteAndPublishDone is uninterruptible and - // fiber-safe (no clearFiber), so this ordering is pure - // defense-in-depth — the completion message text is computed from - // updateResult.message (pre-deletion state) and is unaffected by - // running after the delete. The noReply path returns before any - // status transition today, but completing the terminal sequence - // first makes the contract structurally enforced rather than - // dependent on that noReply implementation detail. - yield* goal.deleteAndPublishDone(sessionID, verdict.reason).pipe(Effect.ignore) yield* promptSvc.prompt({ sessionID, noReply: true, @@ -295,7 +302,7 @@ export const layer = Layer.effect( // "active" with no continuation. Pause with a visible reason so the // user knows the loop was interrupted by a status change. const pauseMsg = `judge 期间会话状态变化（${currentStatus.type}），目标已暂停` - yield* goal.pauseAndPublish(sessionID, pauseMsg).pipe(Effect.ignore) + yield* pauseGoal(sessionID, pauseMsg).pipe(Effect.ignore) yield* promptSvc.prompt({ sessionID, noReply: true, parts: [{ type: "text", text: `⏸ 目标已暂停 — ${pauseMsg}` }] }).pipe(Effect.ignore) return } @@ -311,7 +318,7 @@ export const layer = Layer.effect( // publishGoal(paused) reaches the event bus. Use pauseAndPublish // which skips fiber management — the fiber naturally terminates // when this function returns. - yield* goal.pauseAndPublish(sessionID, "当前轮被中断").pipe(Effect.ignore) // user preempted + yield* pauseGoal(sessionID, "当前轮被中断").pipe(Effect.ignore) // user preempted return } @@ -345,12 +352,14 @@ export const layer = Layer.effect( // cause (recoverable failures + defects) and transition to a recoverable // paused state via the fiber-safe pauseAndPublish (goal.pause would // clearFiber — us — mid-publish; see the preempt branches above). - yield* promptSvc - .prompt({ + const continuationLease = Option.getOrUndefined(yield* automation.claim(sessionID, goalOwner)) + if (!continuationLease) return + yield* automation.use( + continuationLease, + promptSvc.promptIfIdle({ sessionID, parts: [{ type: "text", text: continuationText }], - }) - .pipe( + }).pipe( Effect.catchCause((cause) => Effect.gen(function* () { // F1: Only pause for non-interrupt causes. An interrupt (user @@ -372,15 +381,20 @@ export const layer = Layer.effect( // misclassified as a dispatch failure and spuriously paused here. if (Cause.hasInterrupts(cause)) { yield* Effect.logInfo("goal continuation interrupted (likely user ESC) — not pausing; shouldPreempt handles next cycle") - return + return Option.none() } const errMsg = `continuation dispatch failed: ${Cause.pretty(cause)}` yield* Effect.logWarning("goal continuation dispatch failed", { error: Cause.pretty(cause) }) yield* goal.pauseAndPublish(sessionID, errMsg).pipe(Effect.ignore) yield* promptSvc.prompt({ sessionID, noReply: true, parts: [{ type: "text", text: `⏸ 目标已暂停 — ${errMsg}` }] }).pipe(Effect.ignore) + return Option.none() }), ), - ) + ), + ) + const afterDispatch = yield* goal.load(sessionID) + if (!afterDispatch || afterDispatch.status !== "active") + yield* automation.unregister(sessionID, goalOwner) // NOTE: We deliberately DO NOT call goal.clearLoopFiber here. The // promptSvc.prompt above triggers a fresh agent loop, which when it @@ -400,6 +414,8 @@ export const layer = Layer.effect( }), ) +export const layer = serviceLayer.pipe(Layer.provide(SessionAutomationLease.defaultLayer)) + // GoalLoop.defaultLayer self-provides its construction deps. Because // Layer.provideMerge(self, layer) requires `layer` (GoalLoop) to be // self-contained — self's context is NOT fed into layer — every dep in the diff --git a/packages/opencode/src/goal/prompts.ts b/packages/opencode/src/goal/prompts.ts index 152e17fc7b..188d44b977 100644 --- a/packages/opencode/src/goal/prompts.ts +++ b/packages/opencode/src/goal/prompts.ts @@ -25,16 +25,17 @@ You will receive: 2. The agent's most recent response. Return ONLY a JSON object (no markdown, no explanation): -{"done": true/false, "reason": "one sentence explanation"} +{"verdict": "done" | "continue" | "blocked", "reason": "one sentence explanation"} -"done" = true means ONE of: +"verdict" = "done" means ONE of: - The agent explicitly confirmed the goal is complete with evidence. - The goal produced a clear, verifiable deliverable (file created, test passed, etc.). - - The goal is unachievable or blocked and the agent said so. -"done" = false means the agent is still making progress or has more steps. +"verdict" = "blocked" means the agent cannot make progress without user input or an external-state change. -Be conservative: if in doubt, return "done": false.` +"verdict" = "continue" means the agent is still making progress or has more steps. + +Be conservative: if in doubt, return "verdict": "continue".` export const JUDGE_USER_PROMPT_TEMPLATE = `Goal: {goal} diff --git a/packages/opencode/src/goal/state.ts b/packages/opencode/src/goal/state.ts index ce7fd42225..21326c2f07 100644 --- a/packages/opencode/src/goal/state.ts +++ b/packages/opencode/src/goal/state.ts @@ -7,10 +7,18 @@ export const Status = Schema.Literals(["active", "paused", "done"]) export type Status = Schema.Schema.Type // `skipped` was a dead enum value with no production write path — removed. -export const Verdict = Schema.Literals(["done", "continue"]) +export const Verdict = Schema.Literals(["done", "continue", "blocked"]) export type Verdict = Schema.Schema.Type export class Info extends Schema.Class("GoalState")({ + goal_id: Schema.String.pipe( + Schema.optional, + Schema.withDecodingDefault(Effect.succeed("legacy")), + ), + revision: NonNegativeInt.pipe( + Schema.optional, + Schema.withDecodingDefault(Effect.succeed(0 as Schema.Schema.Type)), + ), goal: Schema.String, status: Status, turns_used: NonNegativeInt, @@ -32,3 +40,22 @@ export class Info extends Schema.Class("GoalState")({ * site instead of `as any` scattered across goal.ts. */ export const nni = (value: number): Schema.Schema.Type => value + +export function advance(state: Info, patch: Partial>) { + return new Info({ + goal_id: state.goal_id, + revision: nni((state.revision ?? 0) + 1), + goal: state.goal, + status: state.status, + turns_used: state.turns_used, + max_turns: state.max_turns, + created_at: state.created_at, + last_turn_at: state.last_turn_at, + last_verdict: state.last_verdict, + last_reason: state.last_reason, + paused_reason: state.paused_reason, + consecutive_parse_failures: state.consecutive_parse_failures, + subgoals: state.subgoals, + ...patch, + }) +} diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts new file mode 100644 index 0000000000..138fddecbf --- /dev/null +++ b/packages/opencode/src/session/automation-lease.ts @@ -0,0 +1,124 @@ +export * as SessionAutomationLease from "./automation-lease" + +import { Context, Effect, Layer, Option } from "effect" +import { LayerNode } from "@opencode-ai/core/effect/layer-node" +import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" +import { SessionID } from "./schema" + +export type Owner = + | { readonly kind: "goal"; readonly id: string } + | { readonly kind: "dag"; readonly id: string } + +export interface Token { + readonly sessionID: SessionID + readonly owner: Owner + readonly generation: number +} + +type Request = + | { readonly kind: "goal"; readonly id: string } + | { readonly kind: "dag" } + +export interface Interface { + readonly register: (sessionID: SessionID, owner: Owner) => Effect.Effect + readonly unregister: (sessionID: SessionID, owner: Owner) => Effect.Effect + readonly claim: (sessionID: SessionID, request: Request) => Effect.Effect> + readonly use: (token: Token, effect: Effect.Effect) => Effect.Effect, E, R> +} + +export class Service extends Context.Service()("@opencode/SessionAutomationLease") {} + +export const layer = Layer.sync(Service, () => { + const locks = KeyedMutex.makeUnsafe() + const registrations = new Map< + SessionID, + { readonly goals: Set; readonly dags: Set; generation: number } + >() + + const entry = (sessionID: SessionID) => { + const current = registrations.get(sessionID) + if (current) return current + const created = { goals: new Set(), dags: new Set(), generation: 0 } + registrations.set(sessionID, created) + return created + } + + const owner = (sessionID: SessionID): Owner | undefined => { + const current = registrations.get(sessionID) + const dag = current?.dags.values().next().value + if (dag) return { kind: "dag", id: dag } + const goal = current?.goals.values().next().value + if (goal) return { kind: "goal", id: goal } + return undefined + } + + const register = Effect.fn("SessionAutomationLease.register")(function* ( + sessionID: SessionID, + value: Owner, + ) { + yield* locks.withLock(sessionID)( + Effect.sync(() => { + const current = entry(sessionID) + const values = value.kind === "dag" ? current.dags : current.goals + if (values.has(value.id)) return + values.add(value.id) + current.generation += 1 + }), + ) + }) + + const unregister = Effect.fn("SessionAutomationLease.unregister")(function* ( + sessionID: SessionID, + value: Owner, + ) { + yield* locks.withLock(sessionID)( + Effect.sync(() => { + const current = registrations.get(sessionID) + if (!current) return + const values = value.kind === "dag" ? current.dags : current.goals + if (!values.delete(value.id)) return + current.generation += 1 + if (current.goals.size === 0 && current.dags.size === 0) registrations.delete(sessionID) + }), + ) + }) + + const claim = Effect.fn("SessionAutomationLease.claim")(function* ( + sessionID: SessionID, + request: Request, + ) { + return yield* locks.withLock(sessionID)( + Effect.sync(() => { + const current = registrations.get(sessionID) + const selected = owner(sessionID) + if (!current || !selected) return Option.none() + if (request.kind === "goal" && (selected.kind !== "goal" || selected.id !== request.id)) + return Option.none() + if (request.kind === "dag" && selected.kind !== "dag") return Option.none() + return Option.some({ sessionID, owner: selected, generation: current.generation }) + }), + ) + }) + + const use: Interface["use"] = Effect.fn("SessionAutomationLease.use")(function* (token, effect) { + const valid = yield* locks.withLock(token.sessionID)( + Effect.sync(() => { + const current = registrations.get(token.sessionID) + const selected = owner(token.sessionID) + return !( + !current || + current.generation !== token.generation || + selected?.kind !== token.owner.kind || + selected.id !== token.owner.id + ) + }), + ) + if (!valid) return Option.none() + return Option.some(yield* effect) + }) + + return Service.of({ register, unregister, claim, use }) +}) + +export const defaultLayer = layer +export const node = LayerNode.make(layer, []) diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index 679c2e012b..4b37f00334 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -1,5 +1,5 @@ import { describe, expect } from "bun:test" -import { Cause, Effect, Layer } from "effect" +import { Cause, Effect, Layer, Option } from "effect" import { GoalLoop, GoalLoopJudgeLLM } from "@/goal/loop" import { Goal } from "@/goal/goal" import { GoalEvent } from "@/goal/events" @@ -9,6 +9,7 @@ import { Session } from "@/session/session" import { SessionPrompt } from "@/session/prompt" import { Provider } from "@/provider/provider" import { SessionID } from "@/session/schema" +import { SessionAutomationLease } from "@/session/automation-lease" import { testEffect, pollWithTimeout } from "../lib/effect" // P2b: full-cycle Goal regression (D5). Drives set → idle → judge(continue) → @@ -66,16 +67,21 @@ const mkAssistantTools = () => // assertions. Resolves void — these tests never drive a real agent turn from // the mock; the goal state and event captures are the observable contract. const recordingPrompt = (sink: { noReply?: boolean; text: string }[]) => - Layer.succeed(SessionPrompt.Service, { - prompt: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + Layer.succeed(SessionPrompt.Service, (() => { + const record = (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => Effect.sync(() => { sink.push({ noReply: input.noReply, text: input.parts?.map((p) => p.text).join("\n") ?? "", }) return undefined as never - }), - } as never) + }) + return { + prompt: record, + promptIfIdle: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + record(input).pipe(Effect.map(Option.some)), + } as never + })()) describe("GoalLoop end-to-end — continue → done lifecycle (P2b)", () => { // Per-test mutable mock state (each it.instance runs in its own scope, but @@ -92,16 +98,21 @@ describe("GoalLoop end-to-end — continue → done lifecycle (P2b)", () => { const sessionMock = Layer.succeed(Session.Service, { messages: () => Effect.succeed([mkAssistant()]), } as never) - const promptMock = Layer.succeed(SessionPrompt.Service, { - prompt: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + const promptMock = Layer.succeed(SessionPrompt.Service, (() => { + const record = (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => Effect.sync(() => { promptCalls.push({ noReply: input.noReply, text: input.parts?.map((p) => p.text).join("\n") ?? "", }) return undefined as never - }), - } as never) + }) + return { + prompt: record, + promptIfIdle: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + record(input).pipe(Effect.map(Option.some)), + } as never + })()) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, @@ -177,6 +188,142 @@ describe("GoalLoop end-to-end — continue → done lifecycle (P2b)", () => { ) }) +describe("GoalLoop — shared Session automation lease", () => { + let leaseAttempts = 0 + let directPromptAttempts = 0 + const sessionMock = Layer.succeed(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + } as never) + const promptMock = Layer.succeed(SessionPrompt.Service, { + prompt: () => + Effect.sync(() => { + directPromptAttempts += 1 + return undefined as never + }), + promptIfIdle: () => + Effect.sync(() => { + leaseAttempts += 1 + return Option.none() + }), + } as never) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => Effect.succeed(JSON.stringify({ verdict: "continue", reason: "more work" })), + }), + ) + const leaseLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.succeed(Provider.Service, {} as never)), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + Layer.provide(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + ) + const it = testEffect(leaseLayer) + + it.instance("a busy Session lease rejects Goal continuation without direct prompt admission", () => + Effect.gen(function* () { + leaseAttempts = 0 + directPromptAttempts = 0 + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const events = yield* EventV2Bridge.Service + yield* loop.init() + const sessionID = SessionID.descending() + yield* goal.set(sessionID, "ship the feature", 10) + yield* Effect.yieldNow + + yield* events.publish(SessionStatus.Event.Status, { + sessionID, + status: { type: "idle" }, + }) + yield* pollWithTimeout( + Effect.sync(() => (leaseAttempts > 0 ? true : undefined)), + "GoalLoop never attempted the shared Session automation lease", + "5 seconds", + ) + + expect(directPromptAttempts).toBe(0) + expect((yield* goal.load(sessionID))?.status).toBe("active") + }), + ) +}) + +describe("GoalLoop + DAG owner arbitration", () => { + let judgeCalls = 0 + let continuationCalls = 0 + const sessionMock = Layer.succeed(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + } as never) + const promptMock = Layer.succeed(SessionPrompt.Service, { + prompt: () => Effect.succeed(undefined as never), + promptIfIdle: () => + Effect.sync(() => { + continuationCalls += 1 + return Option.some(undefined as never) + }), + } as never) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => + Effect.sync(() => { + judgeCalls += 1 + return JSON.stringify({ verdict: "continue", reason: "more work" }) + }), + }), + ) + const arbitrationLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.succeed(Provider.Service, {} as never)), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + Layer.provide(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + ) + const it = testEffect(arbitrationLayer) + + it.instance("a live DAG owns the Session; Goal resumes after the DAG releases it", () => + Effect.gen(function* () { + judgeCalls = 0 + continuationCalls = 0 + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const events = yield* EventV2Bridge.Service + const automation = yield* SessionAutomationLease.Service + yield* loop.init() + const sessionID = SessionID.descending() + yield* goal.set(sessionID, "ship the feature", 10) + yield* automation.register(sessionID, { kind: "dag", id: "dag-executor" }) + yield* Effect.yieldNow + + yield* events.publish(SessionStatus.Event.Status, { + sessionID, + status: { type: "idle" }, + }) + yield* Effect.sleep("50 millis") + expect(judgeCalls).toBe(0) + expect(continuationCalls).toBe(0) + + yield* automation.unregister(sessionID, { kind: "dag", id: "dag-executor" }) + yield* events.publish(SessionStatus.Event.Status, { + sessionID, + status: { type: "idle" }, + }) + yield* pollWithTimeout( + Effect.sync(() => (continuationCalls === 1 ? true : undefined)), + "Goal did not resume after the DAG released the Session lease", + "5 seconds", + ) + expect(judgeCalls).toBe(1) + }), + ) +}) + // D1 (hooks-goal-completeness): a continuation dispatch failure must surface as a // recoverable paused state, not a silent stall. Reuses the e2e harness with a // prompt mock that always fails — the only prompt in this flow is the @@ -194,6 +341,7 @@ describe("GoalLoop — continuation dispatch failure → recoverable pause (D1)" // Always-failing prompt — simulates provider fault / session write error. const promptFailMock = Layer.succeed(SessionPrompt.Service, { prompt: () => Effect.fail(new Error("continuation provider down")), + promptIfIdle: () => Effect.fail(new Error("continuation provider down")), } as never) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( @@ -520,6 +668,7 @@ describe("GoalLoop — continuation interrupted → no pause, goal stays active let interruptCause: Cause.Cause = Cause.interrupt(0) const promptInterruptMock = Layer.succeed(SessionPrompt.Service, { prompt: () => Effect.failCause(interruptCause), + promptIfIdle: () => Effect.failCause(interruptCause), } as never) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( diff --git a/packages/opencode/test/goal/goal.test.ts b/packages/opencode/test/goal/goal.test.ts index 1b8aa9aeef..739f08e13b 100644 --- a/packages/opencode/test/goal/goal.test.ts +++ b/packages/opencode/test/goal/goal.test.ts @@ -117,7 +117,7 @@ describe("Goal.updateAfterJudge — continue branch", () => { ) }) -describe("Goal.updateAfterJudge — done branch (turn budget)", () => { +describe("Goal.updateAfterJudge — atomic done transition", () => { // §2.2 — done is a STATE TRANSITION, not a continuation dispatch, so it must // NOT consume budget. Pre-fix this fails (code does +1); post-§3 it passes. it.live("done verdict does not increment turns_used (state transitions are budget-neutral)", () => @@ -128,20 +128,20 @@ describe("Goal.updateAfterJudge — done branch (turn budget)", () => { const before = yield* goal.load(sessionID) const n = Number(before?.turns_used) - yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) + const result = yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) - const after = yield* goal.load(sessionID) - expect(after?.status).toBe("done") - expect(Number(after?.turns_used)).toBe(n) + expect(result?.state.status).toBe("done") + expect(Number(result?.state.turns_used)).toBe(n) + expect(yield* goal.load(sessionID)).toBeUndefined() + const outcome = yield* goal.lastOutcome(sessionID) + expect(outcome?.status).toBe("done") + expect(outcome?.last_reason).toBe("delivered") }), ) }) describe("Goal.updateAfterJudge — done branch (terminal event contract)", () => { - // §2.3 — updateAfterJudge's done branch must NOT publish goal.updated; only - // deleteAndPublishDone owns the terminal sequence. Pre-fix this fails (code - // publishes); post-§4 it passes. - it.live("done verdict does not publish goal.updated (single-owner: deleteAndPublishDone)", () => + it.live("done verdict atomically removes the row and publishes the terminal sequence", () => Effect.gen(function* () { const goal = yield* Goal.Service const events = yield* EventV2Bridge.Service @@ -153,36 +153,122 @@ describe("Goal.updateAfterJudge — done branch (terminal event contract)", () = yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) - const updates = seen.filter((e) => e.type === GoalEvent.Updated.type) - expect(updates.length).toBe(0) + const types = seen.map((e) => e.type) + expect(types).toEqual([GoalEvent.Updated.type, GoalEvent.Cleared.type]) + doneUpdated(seen) + const cleared = seen.filter((e) => e.type === GoalEvent.Cleared.type) + expect(cleared.length).toBe(1) + + // row is gone after the terminal sequence + const loaded = yield* goal.load(sessionID) + expect(loaded).toBeUndefined() }), ) +}) - // §4.3 — full judge-done flow: updateAfterJudge persists the done row WITHOUT - // publishing, then deleteAndPublishDone publishes the terminal sequence - // exactly once: goal.updated(done) → goal.cleared, no duplicate updated. - it.live("full judge-done flow publishes goal.updated(done) -> goal.cleared exactly once", () => +describe("Goal.updateAfterJudge — blocked branch", () => { + it.live("blocked pauses the goal and never emits a successful done state", () => Effect.gen(function* () { const goal = yield* Goal.Service const events = yield* EventV2Bridge.Service const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "ship feature X", 10) + yield* goal.set(sessionID, "deploy production", 10) seen.length = 0 - yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) - yield* goal.deleteAndPublishDone(sessionID, "delivered") + const result = yield* goal.updateAfterJudge( + sessionID, + "blocked", + "missing production credentials", + false, + ) - const types = seen.map((e) => e.type) - expect(types).toEqual([GoalEvent.Updated.type, GoalEvent.Cleared.type]) - doneUpdated(seen) - const cleared = seen.filter((e) => e.type === GoalEvent.Cleared.type) - expect(cleared.length).toBe(1) + expect(result?.state.status).toBe("paused") + expect(result?.state.last_verdict).toBe("blocked") + expect(result?.message).toContain("已阻塞") + expect(seen.some((event) => event.status === "done")).toBe(false) + }), + ) +}) - // row is gone after the terminal sequence - const loaded = yield* goal.load(sessionID) - expect(loaded).toBeUndefined() +describe("Goal transition authority — stale loop decisions", () => { + it.live("concurrent pause and judge update always settle paused", () => + Effect.gen(function* () { + const goal = yield* Goal.Service + const sessionID = SessionID.descending() + yield* goal.set(sessionID, "ship feature X", 10) + + yield* Effect.all( + [ + goal.pause(sessionID, "user-paused"), + goal.updateAfterJudge(sessionID, "continue", "racing judge result", false), + ], + { concurrency: 2 }, + ) + + expect((yield* goal.load(sessionID))?.status).toBe("paused") + }), + ) + + it.live("concurrent clear and judge update never leave a resurrected row", () => + Effect.gen(function* () { + const goal = yield* Goal.Service + const sessionID = SessionID.descending() + yield* goal.set(sessionID, "ship feature X", 10) + + yield* Effect.all( + [ + goal.clear(sessionID), + goal.updateAfterJudge(sessionID, "continue", "racing judge result", false), + ], + { concurrency: 2 }, + ) + + expect(yield* goal.load(sessionID)).toBeUndefined() + }), + ) + + it.live("a judge result read before pause cannot reactivate the paused goal", () => + Effect.gen(function* () { + const goal = yield* Goal.Service + const sessionID = SessionID.descending() + const before = yield* goal.set(sessionID, "ship feature X", 10) + + yield* goal.pause(sessionID, "user-paused") + const stale = yield* goal.updateAfterJudge( + sessionID, + "continue", + "stale judge result", + false, + { goalID: before.goal_id ?? "legacy", revision: before.revision ?? 0 }, + ) + + expect(stale).toBeUndefined() + expect((yield* goal.load(sessionID))?.status).toBe("paused") + }), + ) + + it.live("a judge result from a cleared goal cannot mutate its replacement", () => + Effect.gen(function* () { + const goal = yield* Goal.Service + const sessionID = SessionID.descending() + const before = yield* goal.set(sessionID, "old goal", 10) + + yield* goal.clear(sessionID) + const replacement = yield* goal.set(sessionID, "new goal", 10) + const stale = yield* goal.updateAfterJudge( + sessionID, + "continue", + "old result", + false, + { goalID: before.goal_id ?? "legacy", revision: before.revision ?? 0 }, + ) + + expect(stale).toBeUndefined() + const current = yield* goal.load(sessionID) + expect(current?.goal_id).toBe(replacement.goal_id) + expect(current?.turns_used).toBe(0) }), ) }) @@ -650,9 +736,6 @@ describe("Goal.deleteAndPublishDone — terminal sequence is uninterruptible (F1 const sessionID = SessionID.descending() yield* goal.set(sessionID, "ship feature X", 10) - // Persist a done row WITHOUT publishing — mirrors what loop.ts does - // (updateAfterJudge) before invoking deleteAndPublishDone. - yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) seen.length = 0 const fiber = yield* goal.deleteAndPublishDone(sessionID, "delivered").pipe(Effect.forkScoped) diff --git a/packages/opencode/test/goal/judge.test.ts b/packages/opencode/test/goal/judge.test.ts index 99b3b814bd..9a87432eb1 100644 --- a/packages/opencode/test/goal/judge.test.ts +++ b/packages/opencode/test/goal/judge.test.ts @@ -14,6 +14,17 @@ describe("parseJudgeResponse", () => { expect(result).toEqual({ verdict: "continue", reason: "still working", parseFailed: false }) }) + test("blocked verdict stays distinct from successful completion", () => { + const result = GoalJudge.parseJudgeResponse( + '{"verdict":"blocked","reason":"missing production credentials"}', + ) + expect(result).toEqual({ + verdict: "blocked", + reason: "missing production credentials", + parseFailed: false, + }) + }) + // §1.3 — markdown-fenced JSON strips fences (step 1) test("markdown-fenced JSON strips fences and parses", () => { const raw = "```json\n{\"done\": false, \"reason\": \"more steps remain\"}\n```" diff --git a/packages/opencode/test/session/automation-lease.test.ts b/packages/opencode/test/session/automation-lease.test.ts new file mode 100644 index 0000000000..59a080268c --- /dev/null +++ b/packages/opencode/test/session/automation-lease.test.ts @@ -0,0 +1,45 @@ +import { describe, expect } from "bun:test" +import { Effect, Option } from "effect" +import { SessionAutomationLease } from "@/session/automation-lease" +import { SessionID } from "@/session/schema" +import { testEffect } from "../lib/effect" + +const it = testEffect(SessionAutomationLease.defaultLayer) + +describe("SessionAutomationLease", () => { + it.instance("DAG registration preempts Goal and invalidates its generation", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const dag = { kind: "dag" as const, id: "dag-1" } + + yield* lease.register(sessionID, goal) + const goalToken = Option.getOrThrow(yield* lease.claim(sessionID, goal)) + yield* lease.register(sessionID, dag) + + expect(Option.isNone(yield* lease.use(goalToken, Effect.succeed("goal")))).toBe(true) + const dagToken = Option.getOrThrow(yield* lease.claim(sessionID, { kind: "dag" })) + expect(Option.getOrThrow(yield* lease.use(dagToken, Effect.succeed("dag")))).toBe("dag") + }), + ) + + it.instance("Goal becomes owner again after the final DAG unregisters", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const first = { kind: "dag" as const, id: "dag-1" } + const second = { kind: "dag" as const, id: "dag-2" } + + yield* lease.register(sessionID, goal) + yield* lease.register(sessionID, first) + yield* lease.register(sessionID, second) + yield* lease.unregister(sessionID, first) + expect(Option.isSome(yield* lease.claim(sessionID, { kind: "dag" }))).toBe(true) + + yield* lease.unregister(sessionID, second) + expect(Option.isSome(yield* lease.claim(sessionID, goal))).toBe(true) + }), + ) +}) From a05a8fa58e3416046c13a9f8f6f41a2754cb59b2 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 02:47:44 +0800 Subject: [PATCH 24/34] fix(goal): bind dag lease registration lifetime to workflow terminal state (GOAL-FP-01-01/-03) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The DAG automation-lease registration lifecycle was bound to WAKE DELIVERY instead of workflow state, leaking dag registrations that permanently block the session's goal (owner() prefers dag, so the goal can never claim). - Startup wake sweep registered every workflow in the wake snapshot, including terminal workflows with wake_reported=true, which are never in the wake batch and therefore never unregistered (-01). - Terminal event handlers (WorkflowCompleted/Failed/Cancelled) never unregistered, so a workflow terminalizing without a successful wake delivery kept its registration indefinitely (-03). Fix: - Sweep: register only non-terminal workflows. Verified safe for terminal-but-unreported workflows: tryDeliverWake registers every workflow in its batch itself right before claiming the wake lease, so redelivery does not depend on the sweep. - Terminal handlers: unregister the dag registration on workflow terminalization. Identity verified: the projector writes WorkflowTable.id = event dagID, so the unregister key { kind: "dag", id: evt.data.dagID } matches every registration key (adoption, recovery, sweep, delivery). TDD evidence (test/dag/dag-lease-lifecycle.test.ts, real DagLoop init over in-memory DB + real SessionAutomationLease + real Goal/store): - Red (current code): -01 "goal claimable after restart" failed with claim(goal) = none (dag leaked by the sweep); -03 "dag lease released on terminal event without wake delivery" timed out (registration persisted). - Green after fix: 2/2 pass. - Mutation 1 (revert sweep filter): -01 goes Red. Restored. - Mutation 2 (remove handler unregister): -03 goes Red. Restored. Verification: bun test test/goal test/session/automation-lease.test.ts test/dag → 564 pass / 0 fail; bun typecheck clean; bun lint → 4852 warnings (ratchet unchanged, 0 new). Co-Authored-By: Claude --- packages/opencode/src/dag/runtime/loop.ts | 20 +- .../test/dag/dag-lease-lifecycle.test.ts | 366 ++++++++++++++++++ 2 files changed, 385 insertions(+), 1 deletion(-) create mode 100644 packages/opencode/test/dag/dag-lease-lifecycle.test.ts diff --git a/packages/opencode/src/dag/runtime/loop.ts b/packages/opencode/src/dag/runtime/loop.ts index 20def0c963..d5c3b46c4e 100644 --- a/packages/opencode/src/dag/runtime/loop.ts +++ b/packages/opencode/src/dag/runtime/loop.ts @@ -949,6 +949,15 @@ const serviceLayer = Layer.effect( // P1-6: trigger wake on workflow terminal so the parent // learns the final outcome even if no idle event fires. if (parentSessionID) { + // GOAL-FP-01-03: the dag registration lifetime is bound to + // workflow state, not to wake delivery. A workflow that + // terminalizes without a successful wake delivery must not + // keep its registration (and the Session's ownership) + // indefinitely. The key matches the registration key + // (WorkflowTable.id === event dagID, per the projector); + // tryDeliverWake re-registers its batch itself before + // claiming the wake lease when a delivery is attempted. + yield* automation.unregister(SessionID.make(parentSessionID), { kind: "dag", id: dagID }) yield* tryDeliverWake(parentSessionID).pipe(Effect.ignore, Effect.forkScoped) } }).pipe(guarded("WorkflowTerminal")), @@ -1295,8 +1304,17 @@ const serviceLayer = Layer.effect( ), ) if (!snapshot.workflows.some((wf) => wf.projectId === ctx.project.id)) continue + // GOAL-FP-01-01: register only NON-terminal workflows. Terminal + // workflows with wake_reported=true would otherwise be re-registered + // on every restart and never unregistered (the only unregister for + // them lives in the wake-delivery SUCCESS path, whose batch only + // carries unreported workflows) — permanently leaking a dag + // registration and blocking the goal. Terminal-but-unreported + // workflows are safe to skip here too: tryDeliverWake registers + // every workflow in its batch itself right before claiming the wake + // lease, so wake redelivery does not depend on this sweep. yield* Effect.forEach( - snapshot.workflows, + snapshot.workflows.filter((workflow) => !isWorkflowTerminalStatus(workflow.status as never)), (workflow) => automation.register(SessionID.make(sessionID), { kind: "dag", id: workflow.id }), { discard: true }, diff --git a/packages/opencode/test/dag/dag-lease-lifecycle.test.ts b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts new file mode 100644 index 0000000000..f572290ab7 --- /dev/null +++ b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts @@ -0,0 +1,366 @@ +import { describe, expect, it } from "bun:test" +import { Deferred, Effect, Layer, Option, Queue } from "effect" +import type { SessionV1 } from "@opencode-ai/core/v1/session" +import { Database } from "@opencode-ai/core/database/database" +import { DagProjector } from "@opencode-ai/core/dag/projector" +import { WorkflowTable } from "@opencode-ai/core/dag/sql" +import { DagStore } from "@opencode-ai/core/dag/store" +import { EventV2 } from "@opencode-ai/core/event" +import { Project } from "@opencode-ai/core/project" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { AbsolutePath } from "@opencode-ai/core/schema" +import { SessionTable } from "@opencode-ai/core/session/sql" +import { Model } from "@opencode-ai/schema/model" +import { Provider } from "@opencode-ai/schema/provider" +import { Agent } from "@/agent/agent" +import { Dag, type NodeConfig } from "@/dag/dag" +import { DagLoop } from "@/dag/runtime/loop" +import { InstanceRef } from "@/effect/instance-ref" +import { EventV2Bridge } from "@/event-v2-bridge" +import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "@/session/automation-lease" +import { MessageID, PartID, SessionID } from "@/session/schema" +import { SessionPrompt } from "@/session/prompt" +import { Session } from "@/session/session" +import { SessionStatus } from "@/session/status" +import { pollWithTimeout } from "../lib/effect" + +// GOAL-FP-01-01 / GOAL-FP-01-03: the DAG automation-lease registration lifetime +// must be bound to WORKFLOW STATE, not to wake delivery. +// +// -01: after a restart, a session whose snapshot contains only terminal +// workflows (one already wake-reported) must not get a dag registration +// from the startup wake sweep — the active goal must remain claimable. +// -03: a workflow that terminalizes without a successful wake delivery must +// release its dag registration from the terminal event handler. +// +// Real DagLoop startup sweep + real SessionAutomationLease + real DagStore / +// Projector / EventV2 over an in-memory database; Session / SessionPrompt / +// Agent are mocked exactly like the wake-integration harness. + +interface ChildPromptGate { + readonly title: string + readonly release: Deferred.Deferred +} + +const PARENT_SESSION = "ses_parent" +const PROJECT_ID = "project-1" + +function node(id: string, dependsOn: string[] = []): NodeConfig { + return { + id, + name: id, + worker_type: "build", + depends_on: dependsOn, + required: true, + prompt_template: { inline: id }, + report_to_parent: true, + } +} + +function reply(sessionID: string, text: string): SessionV1.WithParts { + const id = MessageID.ascending() + return { + info: { + id, + role: "assistant", + parentID: MessageID.ascending(), + sessionID: SessionID.make(sessionID), + mode: "build", + agent: "build", + cost: 0, + path: { cwd: process.cwd(), root: process.cwd() }, + tokens: { input: 0, output: 0, reasoning: 0, cache: { read: 0, write: 0 } }, + modelID: Model.ID.make("test-model"), + providerID: Provider.ID.make("test"), + time: { created: Date.now() }, + finish: "stop", + }, + parts: text ? [{ id: PartID.ascending(), sessionID: SessionID.make(sessionID), messageID: id, type: "text", text }] : [], + } +} + +function takeWithin(queue: Queue.Queue, message: string) { + return Queue.take(queue).pipe( + Effect.timeoutOption("1 second"), + Effect.flatMap( + Option.match({ + onNone: () => Effect.fail(new Error(message)), + onSome: Effect.succeed, + }), + ), + ) +} + +function leaseLifecycleLayer(input: { childPrompts: Queue.Queue }) { + const database = Database.layerFromPath(":memory:") + const events = EventV2.layer.pipe(Layer.provide(database)) + const bridge = EventV2Bridge.layer.pipe(Layer.provide(events)) + const store = DagStore.layer.pipe(Layer.provide(database)) + const status = SessionStatus.layer.pipe(Layer.provide(bridge)) + const projector = DagProjector.layer.pipe( + Layer.provide(events), + Layer.provide(database), + ) + const dag = Dag.layer.pipe( + Layer.provide(bridge), + Layer.provide(store), + ) + const goal = Goal.layer.pipe( + Layer.provide(bridge), + Layer.provide(database), + Layer.provide(status), + ) + const base = Layer.mergeAll(database, events, bridge, store, projector, dag, goal, status) + const childTitles = new Map() + const created: string[] = [] + const session = Layer.mock(Session.Service, { + get: () => + Effect.succeed({ + id: SessionID.make(PARENT_SESSION), + slug: "parent", + projectID: Project.ID.make(PROJECT_ID), + directory: process.cwd(), + title: "Parent", + version: "test", + time: { created: 0, updated: 0 }, + permission: [], + agent: "build", + }), + create: (value) => + Effect.sync(() => { + const id = `ses_child_${created.length + 1}` + created.push(id) + childTitles.set(id, (value?.title ?? id).replace(" (DAG node)", "")) + return { + id: SessionID.make(id), + slug: "child", + projectID: Project.ID.make(PROJECT_ID), + directory: process.cwd(), + title: value?.title ?? id, + version: "test", + time: { created: 0, updated: 0 }, + } + }), + messages: () => Effect.succeed([]), + }) + const deliver = Effect.fn("test.dagLease.SessionPrompt.deliver")(function* (value: SessionPrompt.PromptInput) { + const sessionID = value.sessionID as string + if (sessionID === PARENT_SESSION) { + // Both scenarios require the parent wake delivery to FAIL (or never be + // attempted): the release path under test is workflow state, not + // delivery. Die loudly — if a parent wake is actually delivered here, + // the test premise is broken and the failure must not be silent. + return yield* Effect.die(new Error("parent wake delivery must not succeed in lease-lifecycle scenarios")) + } + const release = yield* Deferred.make() + yield* Queue.offer(input.childPrompts, { title: childTitles.get(sessionID) ?? sessionID, release }) + return reply(sessionID, yield* Deferred.await(release)) + }) + const prompt = Layer.mock(SessionPrompt.Service, { + cancel: () => Effect.void, + prompt: deliver, + promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), + }) + const agent = Layer.mock(Agent.Service, { + get: () => + Effect.succeed({ + name: "build", + mode: "all", + permission: [], + options: {}, + description: "", + prompt: "", + model: { providerID: Provider.ID.make("test"), modelID: Model.ID.make("test-model") }, + tools: {}, + hooks: {}, + }), + }) + const loop = DagLoop.layer.pipe( + Layer.provide(base), + Layer.provide(session), + Layer.provide(prompt), + Layer.provide(agent), + ) + // DagLoop.layer consumes the lease internally (its Layer.provide does not + // re-expose it). Merge the SAME module-level layer at the top so the test + // body can observe the lease; Layer.build memoization dedups the shared + // layer reference, so it is the very instance DagLoop and Goal use. + return Layer.mergeAll(base, loop, SessionAutomationLease.defaultLayer) +} + +function runLeaseTest( + test: (services: { + readonly dag: Dag.Interface + readonly loop: DagLoop.Interface + readonly store: DagStore.Interface + readonly goal: Goal.Interface + readonly status: SessionStatus.Interface + readonly automation: SessionAutomationLease.Interface + readonly database: Database.Interface + readonly childPrompts: Queue.Queue + }) => Effect.Effect, +) { + return Effect.gen(function* () { + const childPrompts = yield* Queue.unbounded() + return yield* Effect.gen(function* () { + const dag = yield* Dag.Service + const loop = yield* DagLoop.Service + const store = yield* DagStore.Service + const goal = yield* Goal.Service + const status = yield* SessionStatus.Service + const automation = yield* SessionAutomationLease.Service + const database = yield* Database.Service + yield* database.db + .insert(ProjectTable) + .values({ + id: Project.ID.make(PROJECT_ID), + worktree: AbsolutePath.make(process.cwd()), + sandboxes: [], + }) + .run() + .pipe(Effect.orDie) + yield* database.db + .insert(SessionTable) + .values({ + id: SessionID.make(PARENT_SESSION), + project_id: Project.ID.make(PROJECT_ID), + slug: "parent", + directory: AbsolutePath.make(process.cwd()), + title: "Parent", + version: "test", + }) + .run() + .pipe(Effect.orDie) + return yield* test({ dag, loop, store, goal, status, automation, database, childPrompts }) + }).pipe( + Effect.provide(leaseLifecycleLayer({ childPrompts })), + Effect.provideService(InstanceRef, { + directory: process.cwd(), + worktree: process.cwd(), + project: { + id: Project.ID.make(PROJECT_ID), + worktree: process.cwd(), + time: { created: 0, updated: 0 }, + sandboxes: [], + }, + }), + Effect.scoped, + ) + }) +} + +describe("DagLoop lease lifecycle — startup wake sweep (GOAL-FP-01-01)", () => { + it("a restarted session whose snapshot holds only terminal workflows leaves the goal claimable", async () => { + await Effect.runPromise( + runLeaseTest(({ loop, goal, status, automation, database }) => + Effect.gen(function* () { + const sid = SessionID.make(PARENT_SESSION) + + // Historical crash snapshot: two terminal workflows under the same + // session. dag-wf-done was already wake-reported before the crash; + // dag-wf-undone terminalized without a delivered wake (it is what + // makes the session visible to the startup wake sweep). + yield* database.db + .insert(WorkflowTable) + .values({ + id: "dag-wf-done", + project_id: Project.ID.make(PROJECT_ID), + session_id: SessionID.make(PARENT_SESSION), + title: "already reported", + status: "completed", + config: "", + seq: 1, + wake_reported: true, + }) + .run() + .pipe(Effect.orDie) + yield* database.db + .insert(WorkflowTable) + .values({ + id: "dag-wf-undone", + project_id: Project.ID.make(PROJECT_ID), + session_id: SessionID.make(PARENT_SESSION), + title: "terminal before delivery", + status: "failed", + config: "", + seq: 2, + wake_reported: false, + }) + .run() + .pipe(Effect.orDie) + + // An active goal survived the restart (Goal.set registers the goal + // owner with the shared Session automation lease, like GoalLoop). + const goalState = yield* goal.set(sid, "ship the feature", 10) + const goalOwner = { kind: "goal" as const, id: goalState.goal_id ?? "legacy" } + + // The session is NOT idle when DagLoop boots, so the forked wake + // redelivery aborts before it can register or deliver anything: + // the sweep's own registration decision is the only dag-lease input. + yield* status.set(sid, { type: "busy" }) + + // Restart: DagLoop.init runs the startup wake sweep synchronously. + yield* loop.init() + + // Public contract: the goal must be claimable (owner() is goal, not + // a leaked dag registration from a terminal workflow). + expect(Option.isSome(yield* automation.claim(sid, goalOwner))).toBe(true) + expect(Option.isNone(yield* automation.claim(sid, { kind: "dag" }))).toBe(true) + }), + ), + ) + }) +}) + +describe("DagLoop lease lifecycle — terminal event release (GOAL-FP-01-03)", () => { + it("a workflow that terminalizes without a successful wake delivery releases its dag lease", async () => { + await Effect.runPromise( + runLeaseTest(({ dag, loop, store, status, automation, childPrompts }) => + Effect.gen(function* () { + const sid = SessionID.make(PARENT_SESSION) + + // The parent never goes idle: the wake redelivery aborts before + // registering/delivering, so the terminal event handler is the only + // possible release path for the dag registration. + yield* status.set(sid, { type: "busy" }) + yield* loop.init() + + const dagID = yield* dag.create({ + projectID: PROJECT_ID, + sessionID: PARENT_SESSION, + title: "lease release", + config: { name: "lease-release", nodes: [node("implement")] }, + }) + + // Adoption (WorkflowStarted) registered the dag lease for the parent. + const child = yield* takeWithin(childPrompts, "implement did not start") + expect(Option.isSome(yield* automation.claim(sid, { kind: "dag" }))).toBe(true) + + // Complete the node → workflow terminalizes → terminal event handler. + yield* Deferred.succeed(child.release, "done") + yield* pollWithTimeout( + store.getWorkflow(dagID).pipe( + Effect.map((workflow) => (workflow?.status === "completed" ? workflow : undefined)), + ), + "workflow did not complete", + ) + + // Public contract: the terminal event handler must release the dag + // lease even though no wake delivery ever succeeded. + yield* pollWithTimeout( + automation.claim(sid, { kind: "dag" }).pipe( + Effect.map((token) => (Option.isNone(token) ? true : undefined)), + ), + "dag lease was not released after workflow terminalization without wake delivery", + ) + + // And the goal can now be admitted. + const goalOwner = { kind: "goal" as const, id: "goal-1" } + yield* automation.register(sid, goalOwner) + expect(Option.isSome(yield* automation.claim(sid, goalOwner))).toBe(true) + }), + ), + ) + }) +}) From 1cdc2fdf94f8ae3cdf73c002ebafe7f7f66cfad7 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 03:19:50 +0800 Subject: [PATCH 25/34] fix(goal): release dag lease on terminalization without a runtime entry (GOAL-FP-01-03 follow-up) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P2-A residual on the -01/-03 seam: the terminal-handler unregister was gated by Stream.filter(runtimes.has(dagID)), so a workflow registered by the startup wake sweep but never adopted into a runtime entry (recoverWorkflow aborted at startup, e.g. an unreadable persisted row) could only ever be unregistered by a successful wake delivery — a control-op terminalization left a permanent dag registration and the goal permanently blocked. Fix (same seam, loop.ts only): - Terminal handlers no longer filter on runtimes.has. The handler remains a no-op for events not concerning this instance: the evalLock cleanup and the wake fork stay gated on the runtime entry, and the new no-entry release is scoped by the durable row's project (the same cross-instance guard every adoption path uses). - When the terminal event has no runtime entry, the handler releases the registration from the durable row: store.getWorkflow(dagID) → WorkflowRow.sessionId (verified: DagStore.Interface.getWorkflow returns WorkflowRow with sessionId — no store changes needed), then automation.unregister(SessionID.make(wf.sessionId), { kind: "dag", id: dagID }) with the project guard. TDD evidence (test/dag/dag-lease-lifecycle.test.ts, same real-DagLoop harness): - Red: new test "releases a swept registration when a workflow with no runtime entry is terminalized by a control op" timed out — the dag lease survived WorkflowCancelled (the recovery failure is simulated as a session-store defect that aborts reconcileWorkflow, leaving a non-terminal row with no runtime entry; sweep registers it; dag.cancel terminalizes it). - Green after fix: 3/3 in the file. - Mutation (remove the no-entry unregister branch): the new test goes Red (timeout). Restored. Verification: bun test test/dag test/session/automation-lease.test.ts test/goal → 565 pass / 0 fail; bun typecheck clean; bun lint → 4852 warnings (ratchet unchanged, 0 new). Co-Authored-By: Claude --- packages/opencode/src/dag/runtime/loop.ts | 22 ++- .../test/dag/dag-lease-lifecycle.test.ts | 130 ++++++++++++++++-- 2 files changed, 138 insertions(+), 14 deletions(-) diff --git a/packages/opencode/src/dag/runtime/loop.ts b/packages/opencode/src/dag/runtime/loop.ts index d5c3b46c4e..6a62852fcc 100644 --- a/packages/opencode/src/dag/runtime/loop.ts +++ b/packages/opencode/src/dag/runtime/loop.ts @@ -923,8 +923,16 @@ const serviceLayer = Layer.effect( ) for (const def of [DagEvent.WorkflowCompleted, DagEvent.WorkflowFailed, DagEvent.WorkflowCancelled]) { + // Deliberately NO runtimes.has filter: a workflow terminalized by a + // control op after a failed startup recovery (e.g. recoverWorkflow + // aborted on an unreadable persisted row) has no runtime entry but + // may still hold a dag registration from the startup wake sweep. + // The handler stays a no-op for events not concerning this + // instance: the evalLock cleanup and wake fork remain gated on + // `entry`, and the no-entry release below is scoped by the durable + // row's project — the same cross-instance guard every adoption + // path uses. yield* events.subscribe(def).pipe( - Stream.filter((e) => runtimes.has(e.data.dagID as string)), Stream.runForEach((evt) => Effect.gen(function* () { const dagID = evt.data.dagID as string @@ -959,6 +967,18 @@ const serviceLayer = Layer.effect( // claiming the wake lease when a delivery is attempted. yield* automation.unregister(SessionID.make(parentSessionID), { kind: "dag", id: dagID }) yield* tryDeliverWake(parentSessionID).pipe(Effect.ignore, Effect.forkScoped) + } else { + // GOAL-FP-01-03 follow-up (P2-A): no runtime entry, but the + // startup wake sweep may have registered this non-terminal + // row before its recovery failed. Release from the durable + // row (session_id + project) so a control-op + // terminalization cannot leave a permanent registration + // with no runtime to ever clean it. Foreign-project events + // are a no-op here. + const wf = yield* store.getWorkflow(dagID) + if (wf && wf.projectId === ctx.project.id) { + yield* automation.unregister(SessionID.make(wf.sessionId), { kind: "dag", id: dagID }) + } } }).pipe(guarded("WorkflowTerminal")), ), diff --git a/packages/opencode/test/dag/dag-lease-lifecycle.test.ts b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts index f572290ab7..c8fc4e1aaf 100644 --- a/packages/opencode/test/dag/dag-lease-lifecycle.test.ts +++ b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts @@ -3,7 +3,7 @@ import { Deferred, Effect, Layer, Option, Queue } from "effect" import type { SessionV1 } from "@opencode-ai/core/v1/session" import { Database } from "@opencode-ai/core/database/database" import { DagProjector } from "@opencode-ai/core/dag/projector" -import { WorkflowTable } from "@opencode-ai/core/dag/sql" +import { WorkflowNodeTable, WorkflowTable } from "@opencode-ai/core/dag/sql" import { DagStore } from "@opencode-ai/core/dag/store" import { EventV2 } from "@opencode-ai/core/event" import { Project } from "@opencode-ai/core/project" @@ -115,18 +115,25 @@ function leaseLifecycleLayer(input: { childPrompts: Queue.Queue const childTitles = new Map() const created: string[] = [] const session = Layer.mock(Session.Service, { - get: () => - Effect.succeed({ - id: SessionID.make(PARENT_SESSION), - slug: "parent", - projectID: Project.ID.make(PROJECT_ID), - directory: process.cwd(), - title: "Parent", - version: "test", - time: { created: 0, updated: 0 }, - permission: [], - agent: "build", - }), + get: (sessionID) => + sessionID === "ses_child_ghost" + ? // Simulated session-store DEFECT: a die passes through the checker's + // catchTag("NotFoundError") (recovery.ts: "any other failure must + // propagate"), so reconcileWorkflow aborts recoverWorkflow for the + // ghost workflow — leaving its row non-terminal with NO runtime + // entry, the P2-A registration-leak precondition. + Effect.die("simulated session store defect (ghost child)") + : Effect.succeed({ + id: SessionID.make(PARENT_SESSION), + slug: "parent", + projectID: Project.ID.make(PROJECT_ID), + directory: process.cwd(), + title: "Parent", + version: "test", + time: { created: 0, updated: 0 }, + permission: [], + agent: "build", + }), create: (value) => Effect.sync(() => { const id = `ses_child_${created.length + 1}` @@ -364,3 +371,100 @@ describe("DagLoop lease lifecycle — terminal event release (GOAL-FP-01-03)", ( ) }) }) + +describe("DagLoop lease lifecycle — runtime-less terminal release (GOAL-FP-01-03 follow-up)", () => { + it("releases a swept registration when a workflow with no runtime entry is terminalized by a control op", async () => { + await Effect.runPromise( + runLeaseTest(({ loop, dag, store, status, automation, database }) => + Effect.gen(function* () { + const sid = SessionID.make(PARENT_SESSION) + + // A workflow whose recovery FAILS at startup: its running node + // references a child session the session store cannot read, so + // reconcileWorkflow's checker failure aborts recoverWorkflow + // BEFORE the runtime entry is created. The row stays non-terminal + // with no runtime entry — the P2-A precondition. + yield* database.db + .insert(WorkflowTable) + .values({ + id: "dag-wf-ghost", + project_id: Project.ID.make(PROJECT_ID), + session_id: SessionID.make(PARENT_SESSION), + title: "unrecoverable", + status: "running", + config: "", + seq: 1, + wake_reported: true, + }) + .run() + .pipe(Effect.orDie) + yield* database.db + .insert(WorkflowNodeTable) + .values({ + id: "n1", + workflow_id: "dag-wf-ghost", + name: "n1", + worker_type: "build", + status: "running", + required: true, + depends_on: [], + child_session_id: "ses_child_ghost", + seq: 1, + }) + .run() + .pipe(Effect.orDie) + + // An unreported terminal workflow makes the session visible to the + // startup wake sweep — which registers the non-terminal ghost. + yield* database.db + .insert(WorkflowTable) + .values({ + id: "dag-wf-undone", + project_id: Project.ID.make(PROJECT_ID), + session_id: SessionID.make(PARENT_SESSION), + title: "terminal before delivery", + status: "failed", + config: "", + seq: 2, + wake_reported: false, + }) + .run() + .pipe(Effect.orDie) + + // The session is NOT idle when DagLoop boots, so the forked wake + // redelivery aborts — no delivery-side register/unregister. + yield* status.set(sid, { type: "busy" }) + yield* loop.init() + + // The sweep registered the ghost (non-terminal) even though its + // recovery failed and no runtime entry exists. + expect(Option.isSome(yield* automation.claim(sid, { kind: "dag" }))).toBe(true) + expect((yield* store.getWorkflow("dag-wf-ghost"))?.status).toBe("running") + + // A control op terminalizes it — a real WorkflowCancelled event + // that no runtime entry backs. + yield* dag.cancel("dag-wf-ghost") + yield* pollWithTimeout( + store.getWorkflow("dag-wf-ghost").pipe( + Effect.map((wf) => (wf?.status === "cancelled" ? wf : undefined)), + ), + "runtime-less workflow did not cancel", + ) + + // Public contract: the terminal event must release the swept + // registration even though the workflow has no runtime entry. + yield* pollWithTimeout( + automation.claim(sid, { kind: "dag" }).pipe( + Effect.map((token) => (Option.isNone(token) ? true : undefined)), + ), + "dag lease was not released when a runtime-less workflow terminalized", + ) + + const goalOwner = { kind: "goal" as const, id: "goal-1" } + yield* automation.register(sid, goalOwner) + expect(Option.isSome(yield* automation.claim(sid, goalOwner))).toBe(true) + }), + ), + ) + }) +}) From 4ee892218056c7a7e446619385c474b026cc15c6 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 03:46:16 +0800 Subject: [PATCH 26/34] fix(goal): re-trigger goal evaluation when the dag owner releases (GOAL-FP-01-02) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The final DAG lease unregister (U2) lands AFTER the last wake turn's idle event: the runner emits the session idle status before completing its awaiter, so GoalLoop's idle-driven claim still sees the dag registration and yields; after U2 lands there is no second idle and the active goal silently stalls until the next external idle. SessionAutomationLease.unregister now detects the dag -> goal/none owner transition (before/after compare under the per-session KeyedMutex, generation bump semantics preserved) and re-triggers the goal evaluation by reusing the EXISTING idle status event mechanism (SessionStatus.set idle) — no new event or GoalLoop consumer. The publish runs after the lock (unconditional fire-and-forget enqueue, cannot lose or duplicate; Set.delete is idempotent and only the last dag removal flips the owner). A busy-session gate avoids spurious judge calls mid-turn: a busy turn always re-emits idle on completion, which re-drives the claim with the dag already released. This is also the GOAL-FP-01-11 mitigation surface: a claim that lost the ownership race gets another chance once the owner actually transfers. TDD evidence: - Red: test/dag/dag-goal-wake-retrigger.test.ts fails on pre-fix code with "goal was not re-evaluated after the dag lease release (GOAL-FP-01-02)" after the workflow completes and the wake is reported, no further idle events published (saved /tmp/red-goal-fp-01-02.txt). - Green: real DagLoop wake delivery end-to-end (U2 fires in the delivery tap) + real GoalLoop on the shared bus; goal claimed, judge runs, turns_used advances, continuation dispatched. - Mutation: reverting the unregister re-trigger makes the test Red again (saved /tmp/mutation-red-goal-fp-01-02.txt); restored to Green. - e2e-loop "DAG owner arbitration" updated to the new contract: the dag release alone re-drives the goal (manual second idle publish removed); its SessionStatus wiring switched to provideMerge so the lease re-trigger is visible from the test body context. Verification: bun test test/dag test/goal test/session/automation-lease.test.ts = 566 pass / 0 fail; bun typecheck (tsgo --noEmit) clean; bun lint = 4852 warnings (at the ratchet threshold, 0 errors). Co-Authored-By: Claude --- .../opencode/src/session/automation-lease.ts | 45 ++- .../test/dag/dag-goal-wake-retrigger.test.ts | 364 ++++++++++++++++++ packages/opencode/test/goal/e2e-loop.test.ts | 16 +- 3 files changed, 416 insertions(+), 9 deletions(-) create mode 100644 packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts index 138fddecbf..b44537cf93 100644 --- a/packages/opencode/src/session/automation-lease.ts +++ b/packages/opencode/src/session/automation-lease.ts @@ -4,6 +4,7 @@ import { Context, Effect, Layer, Option } from "effect" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" import { SessionID } from "./schema" +import { SessionStatus } from "./status" export type Owner = | { readonly kind: "goal"; readonly id: string } @@ -71,16 +72,54 @@ export const layer = Layer.sync(Service, () => { sessionID: SessionID, value: Owner, ) { - yield* locks.withLock(sessionID)( + // GOAL-FP-01-02: when the dag ownership actually disappears (owner + // transitions dag → goal/none), re-trigger the goal evaluation through + // the EXISTING idle status event mechanism so a goal that yielded to the + // dag on the last idle event gets a fresh evaluation. The final dag + // unregister of a wake delivery (U2 in dag/runtime/loop.ts) lands AFTER + // the wake turn's idle event — without this re-trigger the goal silently + // stalls until the next external idle. This is also the GOAL-FP-01-11 + // mitigation surface: a claim that lost the ownership race gets another + // chance once the owner actually transfers. + // + // The dag-release decision is computed atomically under the per-session + // lock (compare owner before/after the Set removal, accounting for the + // generation bump); the idle publish itself runs AFTER the lock. The + // publish is an unconditional fire-and-forget bus enqueue — no interleave + // can suppress it — and subscribers process it in their own fibers + // (GoalLoop / DagLoop fork their work before touching the lease lock), so + // no deadlock is possible. Set.delete is idempotent and only the removal + // of the LAST dag flips the owner, so the emit cannot duplicate. + const dagOwnershipReleased = yield* locks.withLock(sessionID)( Effect.sync(() => { const current = registrations.get(sessionID) - if (!current) return + if (!current) return false + const before = owner(sessionID) const values = value.kind === "dag" ? current.dags : current.goals - if (!values.delete(value.id)) return + if (!values.delete(value.id)) return false current.generation += 1 if (current.goals.size === 0 && current.dags.size === 0) registrations.delete(sessionID) + const after = owner(sessionID) + return before?.kind === "dag" && after?.kind !== "dag" }), ) + if (!dagOwnershipReleased) return + // SessionStatus is resolved optionally: automation-lease is deliberately + // dependency-free (consumers wire it standalone, e.g. + // test/session/automation-lease.test.ts), and every entry point that runs + // the lease (AppLayer, DagLoop, GoalLoop) provides SessionStatus. Without + // it the re-trigger degrades to the pre-fix behavior (the caller's next + // idle event still drives the goal — claim re-evaluation is never + // load-bearing for correctness of the lease itself). + const status = yield* Effect.serviceOption(SessionStatus.Service) + if (Option.isNone(status)) return + // Only re-trigger when the session is actually idle: a busy session's + // turn ALWAYS re-emits idle when it finishes (runner onIdle → + // SessionStatus.set), which re-drives the goal claim with the dag already + // released. Emitting here mid-turn would waste a judge call and transiently + // drop the busy entry from the status map. + if ((yield* status.value.get(sessionID)).type !== "idle") return + yield* status.value.set(sessionID, { type: "idle" }) }) const claim = Effect.fn("SessionAutomationLease.claim")(function* ( diff --git a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts new file mode 100644 index 0000000000..30e46087d3 --- /dev/null +++ b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts @@ -0,0 +1,364 @@ +import { describe, expect, it } from "bun:test" +import { Deferred, Effect, Layer, Option, Queue } from "effect" +import type { SessionV1 } from "@opencode-ai/core/v1/session" +import { Database } from "@opencode-ai/core/database/database" +import { DagProjector } from "@opencode-ai/core/dag/projector" +import { DagStore } from "@opencode-ai/core/dag/store" +import { EventV2 } from "@opencode-ai/core/event" +import { Project } from "@opencode-ai/core/project" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { AbsolutePath } from "@opencode-ai/core/schema" +import { SessionTable } from "@opencode-ai/core/session/sql" +import { Model } from "@opencode-ai/schema/model" +import { Provider as ProviderSchema } from "@opencode-ai/schema/provider" +import { Provider as ProviderService } from "@/provider/provider" +import { Agent } from "@/agent/agent" +import { Dag, type NodeConfig } from "@/dag/dag" +import { DagLoop } from "@/dag/runtime/loop" +import { InstanceRef } from "@/effect/instance-ref" +import { EventV2Bridge } from "@/event-v2-bridge" +import { Goal } from "@/goal/goal" +import { GoalLoop, GoalLoopJudgeLLM } from "@/goal/loop" +import { SessionAutomationLease } from "@/session/automation-lease" +import { MessageID, PartID, SessionID } from "@/session/schema" +import { SessionPrompt } from "@/session/prompt" +import { Session } from "@/session/session" +import { SessionStatus } from "@/session/status" +import { pollWithTimeout } from "../lib/effect" + +// GOAL-FP-01-02: the final DAG lease unregister (U2) lands AFTER the wake +// turn's idle event. GoalLoop's claim runs on idle while the dag registration +// still exists and yields; no further idle event follows, so an active goal +// silently stalls. Contract under test: when the dag owner disappears, +// unregister itself must re-trigger the goal evaluation through the existing +// idle status event mechanism — with NO further external idle events. +// +// Real DagLoop (adoption, terminal handler, wake delivery end-to-end so U2 +// fires inside the delivery tap) + real GoalLoop (idle subscription on the +// real event bus, judge scripted via GoalLoopJudgeLLM) + real +// SessionAutomationLease / SessionStatus / Goal / DagStore over one in-memory +// database. Session / SessionPrompt / Agent / Provider are mocked exactly +// like the wake-integration harness. + +interface ChildPromptGate { + readonly title: string + readonly release: Deferred.Deferred +} + +const PARENT_SESSION = "ses_parent" +const PROJECT_ID = "project-1" + +// Scripted assistant response — afterIdle extracts its text as the judge input. +const mkAssistant = (): SessionV1.WithParts => reply("ses_any", "I have made progress on the feature.") + +function node(id: string, dependsOn: string[] = []): NodeConfig { + return { + id, + name: id, + worker_type: "build", + depends_on: dependsOn, + required: true, + prompt_template: { inline: id }, + report_to_parent: true, + } +} + +function reply(sessionID: string, text: string): SessionV1.WithParts { + const id = MessageID.ascending() + return { + info: { + id, + role: "assistant", + parentID: MessageID.ascending(), + sessionID: SessionID.make(sessionID), + mode: "build", + agent: "build", + cost: 0, + path: { cwd: process.cwd(), root: process.cwd() }, + tokens: { input: 0, output: 0, reasoning: 0, cache: { read: 0, write: 0 } }, + modelID: Model.ID.make("test-model"), + providerID: ProviderSchema.ID.make("test"), + time: { created: Date.now() }, + finish: "stop", + }, + parts: text ? [{ id: PartID.ascending(), sessionID: SessionID.make(sessionID), messageID: id, type: "text", text }] : [], + } +} + +function takeWithin(queue: Queue.Queue, message: string) { + return Queue.take(queue).pipe( + Effect.timeoutOption("1 second"), + Effect.flatMap( + Option.match({ + onNone: () => Effect.fail(new Error(message)), + onSome: Effect.succeed, + }), + ), + ) +} + +// Mutable observation state shared by the layer mocks and the test body. +let judgeCalls = 0 +let promptCalls: { noReply?: boolean; text: string }[] = [] +const reset = () => { + judgeCalls = 0 + promptCalls = [] +} + +function goalWakeLayer(input: { childPrompts: Queue.Queue }) { + const database = Database.layerFromPath(":memory:") + const events = EventV2.layer.pipe(Layer.provide(database)) + const bridge = EventV2Bridge.layer.pipe(Layer.provide(events)) + const store = DagStore.layer.pipe(Layer.provide(database)) + const status = SessionStatus.layer.pipe(Layer.provide(bridge)) + const projector = DagProjector.layer.pipe( + Layer.provide(events), + Layer.provide(database), + ) + const dag = Dag.layer.pipe( + Layer.provide(bridge), + Layer.provide(store), + ) + const goal = Goal.layer.pipe( + Layer.provide(bridge), + Layer.provide(database), + Layer.provide(status), + ) + const base = Layer.mergeAll(database, events, bridge, store, projector, dag, goal, status) + const childTitles = new Map() + const created: string[] = [] + const session = Layer.mock(Session.Service, { + get: (_sessionID) => + Effect.succeed({ + id: SessionID.make(PARENT_SESSION), + slug: "parent", + projectID: Project.ID.make(PROJECT_ID), + directory: process.cwd(), + title: "Parent", + version: "test", + time: { created: 0, updated: 0 }, + }), + create: (value) => + Effect.sync(() => { + const id = `ses_child_${created.length + 1}` + created.push(id) + childTitles.set(id, (value?.title ?? id).replace(" (DAG node)", "")) + return { + id: SessionID.make(id), + slug: "child", + projectID: Project.ID.make(PROJECT_ID), + directory: process.cwd(), + title: value?.title ?? id, + version: "test", + time: { created: 0, updated: 0 }, + } + }), + // GoalLoop.afterIdle reads the last-20 message window: an assistant + // message must exist so the judge is reached (no stale-zombie / no-assistant + // early pauses). + messages: () => Effect.succeed([mkAssistant()]), + }) + const deliver = Effect.fn("test.goalWake.SessionPrompt.deliver")(function* (value: SessionPrompt.PromptInput) { + const sessionID = value.sessionID as string + if (sessionID === PARENT_SESSION) { + // Parent prompts: the dag wake delivery AND the goal continuation must + // both succeed. Record the call so the test can tell them apart. + yield* Effect.sync(() => { + promptCalls.push({ + noReply: value.noReply, + text: value.parts?.map((p) => (p.type === "text" ? p.text : "")).join("\n") ?? "", + }) + }) + return reply(sessionID, "parent turn") + } + const release = yield* Deferred.make() + yield* Queue.offer(input.childPrompts, { title: childTitles.get(sessionID) ?? sessionID, release }) + return reply(sessionID, yield* Deferred.await(release)) + }) + const prompt = Layer.mock(SessionPrompt.Service, { + cancel: () => Effect.void, + prompt: deliver, + promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), + }) + const agent = Layer.mock(Agent.Service, { + get: () => + Effect.succeed({ + name: "build", + mode: "all", + permission: [], + options: {}, + description: "", + prompt: "", + model: { providerID: ProviderSchema.ID.make("test"), modelID: Model.ID.make("test-model") }, + tools: {}, + hooks: {}, + }), + }) + const loop = DagLoop.layer.pipe( + Layer.provide(base), + Layer.provide(session), + Layer.provide(prompt), + Layer.provide(agent), + ) + // Real GoalLoop over the same shared bus/status/goal/lease instances. + const goalLoop = GoalLoop.layer.pipe( + Layer.provide(session), + Layer.provide(prompt), + Layer.provide(Layer.mock(ProviderService.Service, {})), + Layer.provide( + Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => + Effect.sync(() => { + judgeCalls += 1 + return JSON.stringify({ done: false, reason: "more steps needed" }) + }), + }), + ), + ), + Layer.provide(goal), + Layer.provide(status), + Layer.provide(bridge), + ) + // DagLoop.layer / GoalLoop.layer / Goal.layer consume the lease internally. + // Merge the SAME module-level layer at the top so the test body observes the + // very instance DagLoop and GoalLoop use (Layer.build memoization dedups the + // shared layer reference). + return Layer.mergeAll(base, loop, goalLoop, SessionAutomationLease.defaultLayer) +} + +function runGoalWakeTest( + test: (services: { + readonly dag: Dag.Interface + readonly loop: DagLoop.Interface + readonly goalLoop: GoalLoop.Interface + readonly store: DagStore.Interface + readonly goal: Goal.Interface + readonly automation: SessionAutomationLease.Interface + readonly database: Database.Interface + readonly childPrompts: Queue.Queue + }) => Effect.Effect, +) { + return Effect.gen(function* () { + const childPrompts = yield* Queue.unbounded() + return yield* Effect.gen(function* () { + const dag = yield* Dag.Service + const loop = yield* DagLoop.Service + const goalLoop = yield* GoalLoop.Service + const store = yield* DagStore.Service + const goal = yield* Goal.Service + const automation = yield* SessionAutomationLease.Service + const database = yield* Database.Service + yield* database.db + .insert(ProjectTable) + .values({ + id: Project.ID.make(PROJECT_ID), + worktree: AbsolutePath.make(process.cwd()), + sandboxes: [], + }) + .run() + .pipe(Effect.orDie) + yield* database.db + .insert(SessionTable) + .values({ + id: SessionID.make(PARENT_SESSION), + project_id: Project.ID.make(PROJECT_ID), + slug: "parent", + directory: AbsolutePath.make(process.cwd()), + title: "Parent", + version: "test", + }) + .run() + .pipe(Effect.orDie) + return yield* test({ dag, loop, goalLoop, store, goal, automation, database, childPrompts }) + }).pipe( + Effect.provide(goalWakeLayer({ childPrompts })), + Effect.provideService(InstanceRef, { + directory: process.cwd(), + worktree: process.cwd(), + project: { + id: Project.ID.make(PROJECT_ID), + worktree: process.cwd(), + time: { created: 0, updated: 0 }, + sandboxes: [], + }, + }), + Effect.scoped, + ) + }) +} + +describe("DagLoop final wake delivery re-triggers the goal (GOAL-FP-01-02)", () => { + it("an active goal is claimed and progresses after the dag lease release, with no further idle events", async () => { + await Effect.runPromise( + runGoalWakeTest(({ dag, loop, goalLoop, store, goal, automation, childPrompts }) => + Effect.gen(function* () { + reset() + const sid = SessionID.make(PARENT_SESSION) + + yield* loop.init() + yield* goalLoop.init() + // Give the forkScoped idle subscriptions one scheduler turn to + // acquire their PubSub subscriptions. + yield* Effect.yieldNow + + // An active goal in the same session. No idle event is ever + // published by the test body from here on. + const goalState = yield* goal.set(sid, "ship the feature", 10) + const goalOwner = { kind: "goal" as const, id: goalState.goal_id ?? "legacy" } + yield* Effect.yieldNow + + const dagID = yield* dag.create({ + projectID: PROJECT_ID, + sessionID: PARENT_SESSION, + title: "wake retrigger", + config: { name: "wake-retrigger", nodes: [node("implement")] }, + }) + + // Adoption (WorkflowStarted) registered the dag lease for the parent. + const child = yield* takeWithin(childPrompts, "implement did not start") + expect(Option.isSome(yield* automation.claim(sid, { kind: "dag" }))).toBe(true) + + // Complete the node → workflow terminalizes → the terminal handler + // releases the dag registration and forks the wake delivery. + yield* Deferred.succeed(child.release, "done") + yield* pollWithTimeout( + store.getWorkflow(dagID).pipe( + Effect.map((workflow) => (workflow?.status === "completed" ? workflow : undefined)), + ), + "workflow did not complete", + ) + + // The final wake delivery succeeded and reported (U2 unregistered the + // terminal workflow inside the delivery tap). + yield* pollWithTimeout( + store.getWorkflow(dagID).pipe( + Effect.map((workflow) => (workflow?.wakeReported ? workflow : undefined)), + ), + "wake was never reported", + ) + + // Public contract: with NO further idle events, the dag release must + // itself re-trigger the goal evaluation. judgeCalls > 0 proves + // GoalLoop.afterIdle ran a full cycle (lease claimed → judge → + // updateAfterJudge → continuation dispatch). + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "goal was not re-evaluated after the dag lease release (GOAL-FP-01-02)", + "5 seconds", + ) + + const g = yield* goal.load(sid) + expect(g?.status).toBe("active") + expect(Number(g?.turns_used)).toBeGreaterThanOrEqual(1) + // The continuation prompt (not a noReply pause line) carries the goal. + expect(promptCalls.some((p) => !p.noReply && p.text.includes("ship the feature"))).toBe(true) + // Ownership transferred: the dag lease is gone, the goal owns the session. + expect(Option.isNone(yield* automation.claim(sid, { kind: "dag" }))).toBe(true) + expect(Option.isSome(yield* automation.claim(sid, goalOwner))).toBe(true) + }), + ), + ) + }) +}) diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index 4b37f00334..e79a9990b4 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -281,13 +281,17 @@ describe("GoalLoop + DAG owner arbitration", () => { Layer.provide(Layer.succeed(Provider.Service, {} as never)), Layer.provide(judgeMock), Layer.provideMerge(Goal.defaultLayer), - Layer.provide(SessionStatus.defaultLayer), + // provideMerge (not provide): the lease's GOAL-FP-01-02 re-trigger runs + // in the test body's context when unregister is called from the body, so + // SessionStatus must be part of the output context (branch 3 documents + // the same pattern). + Layer.provideMerge(SessionStatus.defaultLayer), Layer.provideMerge(EventV2Bridge.defaultLayer), Layer.provideMerge(SessionAutomationLease.defaultLayer), ) const it = testEffect(arbitrationLayer) - it.instance("a live DAG owns the Session; Goal resumes after the DAG releases it", () => + it.instance("a live DAG owns the Session; Goal resumes when the DAG releases it", () => Effect.gen(function* () { judgeCalls = 0 continuationCalls = 0 @@ -309,11 +313,11 @@ describe("GoalLoop + DAG owner arbitration", () => { expect(judgeCalls).toBe(0) expect(continuationCalls).toBe(0) + // GOAL-FP-01-02: the dag release itself re-triggers the goal evaluation + // through the idle status event mechanism — no follow-up idle event is + // needed. This is exactly the stall that previously required the manual + // second idle publish below. yield* automation.unregister(sessionID, { kind: "dag", id: "dag-executor" }) - yield* events.publish(SessionStatus.Event.Status, { - sessionID, - status: { type: "idle" }, - }) yield* pollWithTimeout( Effect.sync(() => (continuationCalls === 1 ? true : undefined)), "Goal did not resume after the DAG released the Session lease", From e75d09996151f6c73ac7f8c4ce3672c4f6907748 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 04:45:20 +0800 Subject: [PATCH 27/34] fix(goal): serialize afterIdle evaluation across re-trigger races (GOAL-FP-01-02 follow-up) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1: the GOAL-FP-01-02 unregister re-trigger publishes a duplicate idle for every dag release, so the turn-idle fiber B (whose claim landed after U2) and the retry fiber D both hold valid same-generation goal tokens. The harmful interleavings on the synthetic no-text verdict path: 4a — B commits and is interrupted by D's registerLoopFiber between commit and continuation dispatch, D's stale-revision commit noops, goal silently stalls; 4b — D double-commits (turns inflation) or spurious-pauses on the busy status check. Candidate analysis: (a) per-session serialization of afterIdle alone still lets the second fiber commit again after the first dispatched (4b survives); (c) generation bump on goal re-register invalidates only the OTHER fiber's token — the revision guard still admits D's fresh-load commit (inflation) and does not stop the interrupt from killing B post-commit (4a survives); skip-if-alive on the fiber map races the fiber's unwinding window (branch-4 contract). Chosen fix (b): a per-session blocked-claim flag in the lease. Mechanism: claim records "a goal claim was rejected by the dag owner" (blockedGoalClaims); a successful (or non-dag-rejected) goal claim clears it; unregister CONSUMES it (Set.delete) inside the same per-session KeyedMutex critical section as the owner-transition decision, so the re-trigger fires exactly once per blocked claim, atomically with claim serialization. The blocked claim's evaluation fiber yields at the claim itself, so the retry it spawns is the only evaluation in flight. Unconstructibility arguments: - 4a: D is forked only if the flag was set, i.e. only after an evaluation's claim was rejected and that fiber yielded at the claim. B in flight post-commit implies B's claim succeeded, which cleared the flag under the same lock before U2's consume — no publish, no D, no interrupt. The commit→dispatch tail of the sole evaluation can no longer be raced. - 4b: D implies the flag was set and not cleared since, so no evaluation committed in between; D loads fresh state and commits once. A turn-boundary fiber whose claim succeeds clears the flag before any release decision, so one commit per boundary. The busy→pause path is unreachable for D (no turn is in flight when D runs). No loss: the retry obligation is only dropped by a successful claim (the evaluation then happened) or by the busy-gate consume — whose session re-emits idle on turn completion and re-drives the claim (runner onIdle → SessionStatus.set idle). TDD evidence: - Red: new e2e-loop test "an unblocked goal is evaluated exactly once when the dag releases before the boundary idle" fails deterministically on the unfixed re-trigger with turns_used 2 for one real boundary (Expected: 1, Received: 2), pinned by a second-dispatch gate — saved /tmp/red-goal-r1.txt. - Green: real GoalLoop + real lease + synthetic no-text verdict; the dag release stays silent when no claim was ever blocked, the boundary evaluation commits exactly once. - Mutation: reverting the blocked-claim gate to the unconditional publish makes the test Red again (Expected: 1, Received: 2) — saved /tmp/mutation-red-goal-r1.txt — then restored. - The GOAL-FP-01-02 dag wake test now reproduces the faithful production sequence: the prompt mock emits the wake turn's idle event (as the real runner does before its awaiter resolves), the blocked claim arms the re-trigger, and U2's retry drives the goal with no idle after U2. Verification: bun test test/dag test/goal test/session/automation-lease.test.ts = 567 pass / 0 fail; bun typecheck (tsgo --noEmit) clean; bun lint = 4852 warnings (at the ratchet threshold, 0 errors). Co-Authored-By: Claude --- .../opencode/src/session/automation-lease.ts | 32 ++++- .../test/dag/dag-goal-wake-retrigger.test.ts | 28 +++- packages/opencode/test/goal/e2e-loop.test.ts | 133 +++++++++++++++++- 3 files changed, 187 insertions(+), 6 deletions(-) diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts index b44537cf93..90762a102c 100644 --- a/packages/opencode/src/session/automation-lease.ts +++ b/packages/opencode/src/session/automation-lease.ts @@ -35,6 +35,12 @@ export const layer = Layer.sync(Service, () => { SessionID, { readonly goals: Set; readonly dags: Set; generation: number } >() + // Sessions whose goal claim was rejected because a dag owns the automation + // lease. Set by claim, cleared by a successful (or non-dag-rejected) goal + // claim, and CONSUMED by the unregister re-trigger below — all under the + // per-session lock, so the re-trigger decision is atomic with claim + // serialization (GOAL-FP-01-02 follow-up / R1). + const blockedGoalClaims = new Set() const entry = (sessionID: SessionID) => { const current = registrations.get(sessionID) @@ -90,7 +96,16 @@ export const layer = Layer.sync(Service, () => { // (GoalLoop / DagLoop fork their work before touching the lease lock), so // no deadlock is possible. Set.delete is idempotent and only the removal // of the LAST dag flips the owner, so the emit cannot duplicate. - const dagOwnershipReleased = yield* locks.withLock(sessionID)( + // + // R1 (GOAL-FP-01-02 follow-up): the re-trigger fires ONLY when a goal + // claim was actually rejected by the dag (blockedGoalClaims). A rejected + // claim's evaluation fiber yields at the claim itself, so the retry + // evaluation it spawns is the only evaluation in flight — the duplicate + // evaluation that raced the turn-idle fiber (double commit / interrupt + // between commit and dispatch) is unconstructible. A successful goal + // claim clears the flag (under the same lock), so a release that a + // boundary evaluation already picked up does not double-fire. + const goalRetryDue = yield* locks.withLock(sessionID)( Effect.sync(() => { const current = registrations.get(sessionID) if (!current) return false @@ -100,10 +115,13 @@ export const layer = Layer.sync(Service, () => { current.generation += 1 if (current.goals.size === 0 && current.dags.size === 0) registrations.delete(sessionID) const after = owner(sessionID) - return before?.kind === "dag" && after?.kind !== "dag" + if (before?.kind !== "dag" || after?.kind === "dag") return false + // Consume the retry obligation: exactly one re-trigger per blocked + // claim, even when several dags release back-to-back. + return blockedGoalClaims.delete(sessionID) }), ) - if (!dagOwnershipReleased) return + if (!goalRetryDue) return // SessionStatus is resolved optionally: automation-lease is deliberately // dependency-free (consumers wire it standalone, e.g. // test/session/automation-lease.test.ts), and every entry point that runs @@ -130,6 +148,14 @@ export const layer = Layer.sync(Service, () => { Effect.sync(() => { const current = registrations.get(sessionID) const selected = owner(sessionID) + if (request.kind === "goal") { + // Track dag-blocked goal claims: the unregister re-trigger only + // fires for sessions whose goal evaluation was actually rejected by + // a dag owner. Any other outcome (success, or a rejection that is + // not dag-blocking) clears the obligation. + if (selected?.kind === "dag") blockedGoalClaims.add(sessionID) + else blockedGoalClaims.delete(sessionID) + } if (!current || !selected) return Option.none() if (request.kind === "goal" && (selected.kind !== "goal" || selected.id !== request.id)) return Option.none() diff --git a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts index 30e46087d3..60fb088287 100644 --- a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts +++ b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts @@ -31,7 +31,9 @@ import { pollWithTimeout } from "../lib/effect" // still exists and yields; no further idle event follows, so an active goal // silently stalls. Contract under test: when the dag owner disappears, // unregister itself must re-trigger the goal evaluation through the existing -// idle status event mechanism — with NO further external idle events. +// idle status event mechanism — with NO idle events AFTER U2 (the wake turn's +// own idle, which the real runner emits and the prompt mock reproduces here, +// is what blocks the claim in the first place and arms the re-trigger). // // Real DagLoop (adoption, terminal handler, wake delivery end-to-end so U2 // fires inside the delivery tap) + real GoalLoop (idle subscription on the @@ -100,9 +102,11 @@ function takeWithin(queue: Queue.Queue, message: string) { // Mutable observation state shared by the layer mocks and the test body. let judgeCalls = 0 let promptCalls: { noReply?: boolean; text: string }[] = [] +let parentPromptCalls = 0 const reset = () => { judgeCalls = 0 promptCalls = [] + parentPromptCalls = 0 } function goalWakeLayer(input: { childPrompts: Queue.Queue }) { @@ -169,6 +173,26 @@ function goalWakeLayer(input: { childPrompts: Queue.Queue }) { text: value.parts?.map((p) => (p.type === "text" ? p.text : "")).join("\n") ?? "", }) }) + // The FIRST parent prompt is the wake delivery. Mirror the real runner: + // a completed wake turn emits the session idle event before its awaiter + // resolves — i.e., before the delivery tap's U2. That idle event drives + // GoalLoop's evaluation, whose claim is rejected by the still-registered + // dag — the blocked claim the unregister re-trigger exists to retry + // (GOAL-FP-01-02 / R1). Later parent prompts are goal continuations and + // must not re-emit (the mock has no real runner turn). + if (parentPromptCalls === 0) { + parentPromptCalls += 1 + yield* Effect.serviceOption(EventV2Bridge.Service).pipe( + Effect.flatMap((bridge) => + Option.isSome(bridge) + ? bridge.value.publish(SessionStatus.Event.Status, { + sessionID: SessionID.make(sessionID), + status: { type: "idle" }, + }) + : Effect.void, + ), + ) + } return reply(sessionID, "parent turn") } const release = yield* Deferred.make() @@ -178,7 +202,7 @@ function goalWakeLayer(input: { childPrompts: Queue.Queue }) { const prompt = Layer.mock(SessionPrompt.Service, { cancel: () => Effect.void, prompt: deliver, - promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), + promptIfIdle: (value: SessionPrompt.PromptInput) => deliver(value).pipe(Effect.map(Option.some)), }) const agent = Layer.mock(Agent.Service, { get: () => diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index e79a9990b4..75c37f68af 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -1,5 +1,5 @@ import { describe, expect } from "bun:test" -import { Cause, Effect, Layer, Option } from "effect" +import { Cause, Deferred, Effect, Exit, Layer, Option } from "effect" import { GoalLoop, GoalLoopJudgeLLM } from "@/goal/loop" import { Goal } from "@/goal/goal" import { GoalEvent } from "@/goal/events" @@ -328,6 +328,137 @@ describe("GoalLoop + DAG owner arbitration", () => { ) }) +// GOAL-FP-01-02 follow-up (R1): the dag-release re-trigger must NOT publish a +// duplicate idle when no goal evaluation was ever blocked by the dag. The +// unfixed re-trigger forks a full evaluation (D) whose commit consumes the +// turn boundary; the real turn-idle fiber (B) then commits AGAIN for the same +// boundary — turns inflation (and, with a live runner, the busy→pause path). +// +// Deterministic construction through the public seam: the dag releases while +// the session is idle, THEN the turn-boundary idle event is published. The +// re-trigger's evaluation (if any) completes before the boundary evaluation +// forks, so the boundary fiber always double-commits under the unfixed +// re-trigger. The second continuation dispatch is parked on a gate so the +// test observes the settled double-commit state instead of a transient. +// +// The judge is scripted out of the picture entirely: the assistant message +// carries no text, so afterIdle takes the synthetic "continue" verdict path +// (loop.ts branch 2) and the judge mock must never be reached. +describe("GoalLoop — dag release must not double-evaluate a boundary (GOAL-FP-01-02 follow-up)", () => { + let continuationCalls = 0 + let gateHit = false + let gateRelease = Deferred.makeUnsafe() + const reset = () => { + continuationCalls = 0 + gateHit = false + gateRelease = Deferred.makeUnsafe() + } + + const sessionMock = Layer.mock(Session.Service, { + messages: () => Effect.succeed([mkAssistantTools()]), + }) + // Second continuation dispatch parks on a gate: under the unfixed + // re-trigger the boundary fiber commits (turns 1 → 2) and reaches the gate; + // the test then observes the settled double-commit state. + const promptMock = Layer.mock(SessionPrompt.Service, { + prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), + promptIfIdle: () => + Effect.sync(() => { + continuationCalls += 1 + }).pipe( + Effect.flatMap(() => { + if (continuationCalls === 2) { + gateHit = true + return Deferred.await(gateRelease) + } + return Effect.void + }), + Effect.map(() => Option.none()), + ), + }) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => Effect.die("the synthetic no-text verdict path must never reach the judge"), + }), + ) + const raceLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.mock(Provider.Service, {})), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + // provideMerge (not provide): unregister runs in the test body context and + // the lease's re-trigger resolves SessionStatus from it (see the + // arbitration describe above). + Layer.provideMerge(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + ) + const it = testEffect(raceLayer) + + it.instance("an unblocked goal is evaluated exactly once when the dag releases before the boundary idle", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const events = yield* EventV2Bridge.Service + const automation = yield* SessionAutomationLease.Service + yield* loop.init() + const sessionID = SessionID.descending() + yield* goal.set(sessionID, "ship the feature", 10) + yield* automation.register(sessionID, { kind: "dag", id: "dag-executor" }) + yield* Effect.yieldNow + + // The dag releases while the session is idle and NO evaluation was ever + // blocked by it. The re-trigger must stay silent here. + yield* automation.unregister(sessionID, { kind: "dag", id: "dag-executor" }) + + // Under the unfixed re-trigger an evaluation (D) was already forked by + // the unregister's idle publish. Wait for it to settle so the boundary + // fiber below cannot interrupt it mid-flight. + const spuriousEvaluation = yield* pollWithTimeout( + Effect.sync(() => (continuationCalls >= 1 ? true : undefined)), + "unfixed re-trigger evaluation never dispatched", + "500 millis", + ) + .pipe(Effect.exit) + .pipe(Effect.map(Exit.isSuccess)) + + // The real turn-boundary idle event (the runner's idle emit). + yield* events.publish(SessionStatus.Event.Status, { + sessionID, + status: { type: "idle" }, + }) + + // Under the unfixed re-trigger the boundary fiber commits a SECOND time + // (turns inflation) and parks at the second-dispatch gate. + const doubleCommit = yield* pollWithTimeout( + Effect.sync(() => (gateHit ? true : undefined)), + "boundary fiber never reached the second dispatch (no double evaluation)", + "500 millis", + ) + .pipe(Effect.exit) + .pipe(Effect.map(Exit.isSuccess)) + + // Let the parked boundary fiber finish (no-op when it was never parked). + yield* Deferred.succeed(gateRelease, undefined) + yield* pollWithTimeout( + Effect.sync(() => (continuationCalls >= (spuriousEvaluation ? 2 : 1) ? true : undefined)), + "boundary evaluation never dispatched its continuation", + "5 seconds", + ) + + const g = yield* goal.load(sessionID) + expect(g?.status).toBe("active") + // The R1 harm: the boundary's single real evaluation must account for + // exactly one turn — not two. + expect(Number(g?.turns_used)).toBe(1) + expect(doubleCommit).toBe(false) + }), + ) +}) + // D1 (hooks-goal-completeness): a continuation dispatch failure must surface as a // recoverable paused state, not a silent stall. Reuses the e2e harness with a // prompt mock that always fails — the only prompt in this flow is the From 9cff41dde4f8b1c1a778c299860fd6842b07b6d4 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 05:26:16 +0800 Subject: [PATCH 28/34] fix(goal): clean up goal state, outcomes, and dag leases on session delete (GOAL-FP-01-05/-06/-16) TDD: red test first (test/session/session-remove-cleanup.test.ts, 3 fail on current code), minimal green, mutation (revert Session.defaultLayer cleanup provides -> 3 fail), restore -> green. Wiring diagnosis (-05): Session.remove resolved Goal via Effect.serviceOption(Goal.Service) captured at layer construction. In the production AppLayer (effect/app-runtime.ts) Goal.defaultLayer and Session.defaultLayer are Layer.mergeAll siblings; mergeAll builds members concurrently against the parent context only, so Goal was never in Session's build context and the cleanup silently no-op'd - `opencode session delete` orphaned the goal_state row. Fixed by making Goal, SessionAutomationLease and Dag hard requirements of Session.layer: Session.defaultLayer self-provides all three (each is self-contained, requirements=never), Session.node lists their nodes, and tsgo now enforces the wiring at every composition site (4 raw-layer test harnesses updated). No layer cycle: Goal -> SessionStatus/Lease, Dag -> DagStore/DagProjector, none depends on Session. Cleanup (-06): Session.remove now (1) purges goal rows via Goal.purgeSession, (2) cancels owned non-terminal workflows via the existing Dag.cancel authority (durable terminalization; the DagLoop terminal handler aborts child sessions and releases the dag lease - no second runtime authority), and (3) purges the session's lease registrations via the new SessionAutomationLease.purgeSession (under the per-session KeyedMutex). Each step catches its cause and logs a warning; deletion itself still cannot fail. Ordering + crash window: cleanup runs BEFORE the Deleted publish (the SessionProjector deletes the session row inside that transaction; FK cascade then wipes workflow rows). A crash mid-way leaves a live session with no goal/workflows (consistent, recoverable) - never orphan goal rows or re-adoptable workflows under a deleted session. No shared transaction exists (three separate aggregates: goal tables, workflow events, lease map); each step is individually atomic. -16: goal_outcome rows now deleted in the same durable transition transaction as the goal_state row (transition seam gained a deleteOutcomes flag; Goal.purgeSession sets it, Goal.clear keeps outcome history). Verification: bun test test/session test/goal test/dag -> 964 pass, 0 fail; bun typecheck clean; bun lint 4852 (ratchet). Co-Authored-By: Claude --- packages/opencode/src/goal/goal.ts | 27 +++ .../opencode/src/session/automation-lease.ts | 19 ++- packages/opencode/src/session/session.ts | 93 ++++++++++- .../opencode/test/hook/event-wiring.test.ts | 6 + .../opencode/test/server/session-list.test.ts | 6 + .../opencode/test/session/fork-batch.test.ts | 6 + .../session/session-remove-cleanup.test.ts | 156 ++++++++++++++++++ .../opencode/test/session/session.test.ts | 6 + 8 files changed, 309 insertions(+), 10 deletions(-) create mode 100644 packages/opencode/test/session/session-remove-cleanup.test.ts diff --git a/packages/opencode/src/goal/goal.ts b/packages/opencode/src/goal/goal.ts index 6dd1b9bc36..62ce376d01 100644 --- a/packages/opencode/src/goal/goal.ts +++ b/packages/opencode/src/goal/goal.ts @@ -25,6 +25,8 @@ export interface Interface { readonly pause: (sessionID: SessionID, reason: string) => Effect.Effect readonly resume: (sessionID: SessionID) => Effect.Effect readonly clear: (sessionID: SessionID) => Effect.Effect + /** Session-deletion cleanup: remove goal_state AND all goal_outcome rows. */ + readonly purgeSession: (sessionID: SessionID) => Effect.Effect readonly markDone: (sessionID: SessionID, reason: string) => Effect.Effect readonly addSubgoal: (sessionID: SessionID, subgoal: string) => Effect.Effect readonly removeSubgoal: ( @@ -180,6 +182,9 @@ const serviceLayer = Layer.effect( | { readonly tag: "delete" readonly terminal?: GoalState.Info + /** GOAL-FP-01-16: also delete every goal_outcome row for the session + * in the same transaction (session deletion, not a plain clear). */ + readonly deleteOutcomes?: boolean readonly value: A } @@ -248,6 +253,12 @@ const serviceLayer = Layer.effect( .where(eq(GoalStateTable.session_id, sessionID)) .run() } + if (next.tag === "delete" && next.deleteOutcomes) { + yield* tx + .delete(GoalOutcomeTable) + .where(eq(GoalOutcomeTable.session_id, sessionID)) + .run() + } return next }), { behavior: "immediate" }, @@ -377,6 +388,21 @@ const serviceLayer = Layer.effect( yield* clearFiber(sessionID) }) + // GOAL-FP-01-05/-16: session-deletion cleanup. `clear` keeps the + // goal_outcome history (lastOutcome readers), but a deleted session has no + // readers — its outcome rows are garbage and must go in the SAME durable + // transition as the goal_state row so the pair cannot be split by a crash. + const purgeSession = Effect.fn("Goal.purgeSession")(function* (sessionID: SessionID) { + const cleared = yield* transition(sessionID, (state) => ({ + tag: "delete", + deleteOutcomes: true, + value: state, + })) + if (cleared) + yield* automation.unregister(sessionID, { kind: "goal", id: cleared.goal_id ?? "legacy" }) + yield* clearFiber(sessionID) + }) + const markDone = Effect.fn("Goal.markDone")(function* (sessionID: SessionID, reason: string) { // User/tool-initiated completion: stop the running loop fiber, then // perform terminal cleanup (publish done-updated → delete → publish cleared). @@ -703,6 +729,7 @@ const serviceLayer = Layer.effect( pause, resume, clear, + purgeSession, markDone, addSubgoal, removeSubgoal, diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts index 90762a102c..ac0fd00012 100644 --- a/packages/opencode/src/session/automation-lease.ts +++ b/packages/opencode/src/session/automation-lease.ts @@ -25,6 +25,8 @@ export interface Interface { readonly unregister: (sessionID: SessionID, owner: Owner) => Effect.Effect readonly claim: (sessionID: SessionID, request: Request) => Effect.Effect> readonly use: (token: Token, effect: Effect.Effect) => Effect.Effect, E, R> + /** Drop every registration and retry obligation for a session (session deletion). */ + readonly purgeSession: (sessionID: SessionID) => Effect.Effect } export class Service extends Context.Service()("@opencode/SessionAutomationLease") {} @@ -182,7 +184,22 @@ export const layer = Layer.sync(Service, () => { return Option.some(yield* effect) }) - return Service.of({ register, unregister, claim, use }) + // GOAL-FP-01-06: session deletion must drop every registration the session + // holds (goal, dag, and any wake-sweep registration) so the automation + // ownership map cannot keep a deleted session's claim alive until process + // exit. Runs under the per-session lock, same as every other mutation, and + // deliberately does NOT emit the unregister goal re-trigger — the session is + // being deleted, so a goal re-evaluation would be work on a dead session. + const purgeSession = Effect.fn("SessionAutomationLease.purgeSession")(function* (sessionID: SessionID) { + yield* locks.withLock(sessionID)( + Effect.sync(() => { + registrations.delete(sessionID) + blockedGoalClaims.delete(sessionID) + }), + ) + }) + + return Service.of({ register, unregister, claim, use, purgeSession }) }) export const defaultLayer = layer diff --git a/packages/opencode/src/session/session.ts b/packages/opencode/src/session/session.ts index b3c65515f4..985a22e517 100644 --- a/packages/opencode/src/session/session.ts +++ b/packages/opencode/src/session/session.ts @@ -45,6 +45,9 @@ import { ProviderV2 } from "@opencode-ai/core/provider" import { ModelV2 } from "@opencode-ai/core/model" import { SessionMessageID } from "@opencode-ai/schema/session-message-id" import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "./automation-lease" +import { Dag } from "@/dag/dag" +import { isWorkflowTerminalStatus } from "@opencode-ai/core/dag/core/types" import { landSystemMessages } from "@/hook/trigger-result" const runtime = makeRuntime(Database.Service, Database.defaultLayer) @@ -486,7 +489,13 @@ export type Patch = Omit, "time" | "share" | "summary" | "revert" export const layer: Layer.Layer< Service, never, - BackgroundJob.Service | RuntimeFlags.Service | Database.Service | EventV2Bridge.Service + | BackgroundJob.Service + | RuntimeFlags.Service + | Database.Service + | EventV2Bridge.Service + | Goal.Service + | SessionAutomationLease.Service + | Dag.Service > = Layer.effect( Service, Effect.gen(function* () { @@ -507,10 +516,21 @@ export const layer: Layer.Layer< // deferred import resolves to the cached module instantly. const { SettingsHook } = yield* Effect.promise(() => import("@/hook/settings")) const settingsHook = Option.getOrUndefined(yield* Effect.serviceOption(SettingsHook.Service)) - // Goal cleanup is optional — Session must not require Goal at construction - // (that would force every Session.defaultLayer consumer to provide Goal's - // transitive deps). Resolved lazily via serviceOption. - const goalOpt = yield* Effect.serviceOption(Goal.Service) + // GOAL-FP-01-05: goal/dag/lease cleanup used to resolve via + // Effect.serviceOption(Goal.Service), which yields None in the production + // AppLayer — Goal.defaultLayer and Session.defaultLayer are + // Layer.mergeAll siblings (effect/app-runtime.ts) and mergeAll does not + // cross-provide, so Session's layer context never contained Goal and + // `opencode session delete` silently skipped the cleanup. The cleanup is + // NOT optional (delete integrity), so these are now hard layer + // requirements: typecheck enforces that every composition of Session's + // layer provides them (defaultLayer self-provides all three below; the + // node graph lists them in Session.node). No layer cycle exists — Goal, + // Dag and SessionAutomationLease defaultLayers are all self-contained and + // none of them depends on Session. + const goal = yield* Goal.Service + const dag = yield* Dag.Service + const automation = yield* SessionAutomationLease.Service const createNext = Effect.fn("Session.createNext")(function* (input: { id?: SessionID @@ -644,10 +664,48 @@ export const layer: Layer.Layer< .pipe(Effect.catch(() => Effect.succeed({ additionalContexts: [], systemMessages: [] }))) yield* landSystemMessages(seResult, { sessionID }) } - // Cleanup goal state (only when Goal service is available in context) - if (goalOpt._tag === "Some") { - yield* goalOpt.value.clear(sessionID).pipe(Effect.catchCause(() => Effect.void)) + // Cleanup durable automation state BEFORE the Deleted publish: the + // SessionProjector deletes the session row (and FK cascades wipe the + // workflow rows) inside the Deleted publish transaction, so running + // cleanup first means a crash mid-way can only leave a live session + // with no goal/workflows (consistent, recoverable) — never orphan + // goal rows or re-adoptable workflows under a deleted session. The + // three steps live in separate aggregates (goal_state/goal_outcome, + // workflow events, the lease map) so no shared transaction is + // available; each step is individually atomic. + yield* goal.purgeSession(sessionID).pipe( + Effect.catchCause((cause) => + Effect.logWarning("goal purge failed during session remove", { sessionID, cause }), + ), + ) + // GOAL-FP-01-06: cancel workflows owned by this session so the running + // DagLoop runtime stops (aborts child sessions, releases the dag + // lease) and a restart recovery scan can never re-adopt them. + // Terminal rows are already inert; pending rows are terminalized by + // the startup orphan-pending sweep (cancel is not a valid transition + // from pending). + const workflows = yield* dag.store.listBySession(sessionID).pipe(Effect.orDie) + for (const workflow of workflows) { + // oxlint-disable-next-line typescript-eslint/no-unsafe-type-assertion -- WorkflowRow.status is a plain string column whose values are the WorkflowStatus literals (only the projector writes it, via validated transitions). + if (isWorkflowTerminalStatus(workflow.status as never)) continue + yield* dag.cancel(workflow.id).pipe( + Effect.catchCause((cause) => + Effect.logWarning("workflow cancellation failed during session remove", { + dagID: workflow.id, + sessionID, + cause, + }), + ), + ) } + // Belt-and-braces lease sweep: drops goal registrations, wake-sweep + // registrations, and any dag registration whose workflow did not + // reach the terminalization handler above (e.g. cancel rejected). + yield* automation.purgeSession(sessionID).pipe( + Effect.catchCause((cause) => + Effect.logWarning("automation lease purge failed during session remove", { sessionID, cause }), + ), + ) yield* events.remove(sessionID) } catch (error) { yield* Effect.logError("failed to remove session", { sessionID, error }) @@ -973,6 +1031,15 @@ export const defaultLayer = layer.pipe( Layer.provide(SessionExecution.noopLayer), Layer.provide(SessionV2.defaultLayer), Layer.provide(RuntimeFlags.defaultLayer), + // GOAL-FP-01-05/-06: self-provide the remove() cleanup dependencies so the + // cleanup runs in EVERY composition of Session.defaultLayer (AppLayer + // mergeAll siblings, DagLoop, workspace, share, MoveSession, …). All three + // defaultLayers are self-contained (never requirements) and none depends on + // Session, so this cannot introduce a layer cycle; memoization shares the + // instances with the other group-1 siblings. + Layer.provide(Goal.defaultLayer), + Layer.provide(SessionAutomationLease.defaultLayer), + Layer.provide(Dag.defaultLayer), ) const cancelBackgroundJobs = Effect.fn("Session.cancelBackgroundJobs")(function* ( @@ -1117,6 +1184,14 @@ export function* listGlobal(input?: { } } -export const node = LayerNode.make(layer, [BackgroundJob.node, RuntimeFlags.node, Database.node, EventV2Bridge.node, Goal.node]) +export const node = LayerNode.make(layer, [ + BackgroundJob.node, + RuntimeFlags.node, + Database.node, + EventV2Bridge.node, + Goal.node, + SessionAutomationLease.node, + Dag.node, +]) export * as Session from "./session" diff --git a/packages/opencode/test/hook/event-wiring.test.ts b/packages/opencode/test/hook/event-wiring.test.ts index e823cc03c9..6447054472 100644 --- a/packages/opencode/test/hook/event-wiring.test.ts +++ b/packages/opencode/test/hook/event-wiring.test.ts @@ -8,6 +8,9 @@ import { BackgroundJob } from "@/background/job" import { EventV2Bridge } from "@/event-v2-bridge" import { RuntimeFlags } from "@/effect/runtime-flags" import { Session } from "@/session/session" +import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "@/session/automation-lease" +import { Dag } from "@/dag/dag" import { SessionID } from "@/session/schema" import { Permission } from "@/permission" import { Notification } from "@/notification" @@ -64,6 +67,9 @@ const sessionEnv = Layer.mergeAll( Layer.provide(SessionProjector.defaultLayer), Layer.provide(RuntimeFlags.defaultLayer), Layer.provide(BackgroundJob.defaultLayer), + Layer.provide(Goal.defaultLayer), + Layer.provide(SessionAutomationLease.defaultLayer), + Layer.provide(Dag.defaultLayer), ), Database.defaultLayer, ) diff --git a/packages/opencode/test/server/session-list.test.ts b/packages/opencode/test/server/session-list.test.ts index 213e3cdce3..cd275e3e90 100644 --- a/packages/opencode/test/server/session-list.test.ts +++ b/packages/opencode/test/server/session-list.test.ts @@ -3,6 +3,9 @@ import { Effect, Layer } from "effect" import { Database } from "@opencode-ai/core/database/database" import { SessionProjector } from "@opencode-ai/core/session/projector" import { Session as SessionNs } from "@/session/session" +import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "@/session/automation-lease" +import { Dag } from "@/dag/dag" import { disposeAllInstances, provideInstance, TestInstance } from "../fixture/fixture" import { mkdir } from "fs/promises" import path from "path" @@ -25,6 +28,9 @@ const layer = (experimentalWorkspaces: boolean) => Layer.provide(SessionProjector.defaultLayer), Layer.provide(RuntimeFlags.layer({ experimentalWorkspaces })), Layer.provide(BackgroundJob.defaultLayer), + Layer.provide(Goal.defaultLayer), + Layer.provide(SessionAutomationLease.defaultLayer), + Layer.provide(Dag.defaultLayer), ), ) const it = testEffect(layer(false)) diff --git a/packages/opencode/test/session/fork-batch.test.ts b/packages/opencode/test/session/fork-batch.test.ts index ab7225d4a9..52c7f19167 100644 --- a/packages/opencode/test/session/fork-batch.test.ts +++ b/packages/opencode/test/session/fork-batch.test.ts @@ -14,6 +14,9 @@ import * as Statement from "effect/unstable/sql/Statement" import * as Reactivity from "effect/unstable/reactivity/Reactivity" import { eq, sql } from "drizzle-orm" import { Session as SessionNs } from "@/session/session" +import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "@/session/automation-lease" +import { Dag } from "@/dag/dag" import { MessageID, PartID } from "../../src/session/schema" import { testInstanceStoreLayer } from "../fixture/fixture" import { testEffect } from "../lib/effect" @@ -148,6 +151,9 @@ const it = testEffect( Layer.provide(projectorLayer), Layer.provide(RuntimeFlags.layer({ experimentalWorkspaces: false })), Layer.provide(BackgroundJob.defaultLayer), + Layer.provide(Goal.defaultLayer), + Layer.provide(SessionAutomationLease.defaultLayer), + Layer.provide(Dag.defaultLayer), ), CrossSpawnSpawner.defaultLayer, testInstanceStoreLayer, diff --git a/packages/opencode/test/session/session-remove-cleanup.test.ts b/packages/opencode/test/session/session-remove-cleanup.test.ts new file mode 100644 index 0000000000..deea0486e6 --- /dev/null +++ b/packages/opencode/test/session/session-remove-cleanup.test.ts @@ -0,0 +1,156 @@ +import { describe, expect } from "bun:test" +import { Effect, Layer, Option } from "effect" +import { and, eq } from "drizzle-orm" +import { Database } from "@opencode-ai/core/database/database" +import { EventTable } from "@opencode-ai/core/event/sql" +import { EventV2 } from "@opencode-ai/core/event" +import { DagEvent } from "@opencode-ai/schema/dag-event" +import { GoalOutcomeTable, GoalStateTable } from "@opencode-ai/core/goal/sql" +import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" +import { Session as SessionNs } from "@/session/session" +import { SessionAutomationLease } from "@/session/automation-lease" +import { Goal } from "@/goal/goal" +import { Dag } from "@/dag/dag" +import { testEffect } from "../lib/effect" +import { testInstanceStoreLayer } from "../fixture/fixture" + +// GOAL-FP-01-05/-06/-16: `Session.remove` must be the single cleanup point for +// durable session-scoped state — goal_state + goal_outcome rows, the dag +// automation lease registrations, and owned workflows. +// +// The layer mirrors the production AppLayer (effect/app-runtime.ts) group-1 +// composition: Session, Goal and Dag are `Layer.mergeAll` SIBLINGS. mergeAll +// builds every member concurrently against the parent context only, so +// siblings cannot see each other's outputs. In production that made +// `Effect.serviceOption(Goal.Service)` inside Session's layer yield None and +// the cleanup silently no-op. This test builds the same sibling shape, so it +// fails against that wiring and passes once Session.defaultLayer self-provides +// its cleanup dependencies. +const testLayer = Layer.mergeAll( + SessionNs.defaultLayer, + Goal.defaultLayer, + Dag.defaultLayer, + SessionAutomationLease.defaultLayer, + Database.defaultLayer, + testInstanceStoreLayer, + CrossSpawnSpawner.defaultLayer, +) + +const it = testEffect(testLayer) + +describe("Session.remove goal cleanup (GOAL-FP-01-05/-16)", () => { + it.instance("deletes goal_state and goal_outcome rows for the removed session", () => + Effect.gen(function* () { + const session = yield* SessionNs.Service + const goal = yield* Goal.Service + const { db } = yield* Database.Service + + const info = yield* session.create({}) + const sessionID = info.id + // markDone terminalizes the active goal into a durable goal_outcome row. + yield* goal.set(sessionID, "first goal", 10) + yield* goal.markDone(sessionID, "done for cleanup test") + // A fresh active goal leaves a goal_state row behind at remove time. + yield* goal.set(sessionID, "second goal", 10) + + const outcomeBefore = yield* db + .select() + .from(GoalOutcomeTable) + .where(eq(GoalOutcomeTable.session_id, sessionID)) + .get() + .pipe(Effect.orDie) + expect(outcomeBefore).not.toBeNull() + + yield* session.remove(sessionID) + + const stateRow = yield* db + .select() + .from(GoalStateTable) + .where(eq(GoalStateTable.session_id, sessionID)) + .get() + .pipe(Effect.orDie) + expect(stateRow).toBeUndefined() + + const outcomeRow = yield* db + .select() + .from(GoalOutcomeTable) + .where(eq(GoalOutcomeTable.session_id, sessionID)) + .get() + .pipe(Effect.orDie) + expect(outcomeRow).toBeUndefined() + }), + ) +}) + +describe("Session.remove dag lease cleanup (GOAL-FP-01-06)", () => { + it.instance("purges dag automation lease registrations for the removed session", () => + Effect.gen(function* () { + const session = yield* SessionNs.Service + const lease = yield* SessionAutomationLease.Service + + const info = yield* session.create({}) + const sessionID = info.id + yield* lease.register(sessionID, { kind: "dag", id: "wf-lease-test" }) + expect(Option.isSome(yield* lease.claim(sessionID, { kind: "dag" }))).toBe(true) + + yield* session.remove(sessionID) + + expect(Option.isNone(yield* lease.claim(sessionID, { kind: "dag" }))).toBe(true) + }), + ) + + it.instance("cancels workflows owned by the removed session", () => + Effect.gen(function* () { + const session = yield* SessionNs.Service + const dag = yield* Dag.Service + const { db } = yield* Database.Service + + const info = yield* session.create({}) + const sessionID = info.id + const dagID = yield* dag.create({ + projectID: info.projectID, + sessionID, + title: "session-remove-cleanup-test", + config: { + name: "session-remove-cleanup-test", + nodes: [ + { + id: "n1", + name: "n1", + worker_type: "build", + depends_on: [], + required: true, + prompt_template: { inline: "do work" }, + }, + ], + }, + }) + expect((yield* dag.store.getWorkflow(dagID).pipe(Effect.orDie))?.status).toBe("running") + + yield* session.remove(sessionID) + + // The workflow READ row is FK-cascaded away with the session row, so + // the cancellation contract observable here is the durable + // dag.workflow.cancelled event — the terminalization that stops the + // running DagLoop runtime (aborting child sessions and releasing the + // dag lease) and keeps the workflow out of the restart recovery scan. + const cancelledEvent = yield* db + .select() + .from(EventTable) + .where( + and( + eq(EventTable.aggregate_id, dagID), + eq(EventTable.type, EventV2.versionedType(DagEvent.WorkflowCancelled.type, 1)), + ), + ) + .get() + .pipe(Effect.orDie) + expect(cancelledEvent).not.toBeNull() + + // Recovery scan contract (dag/runtime/loop.ts adopts only + // running/paused/stepping rows): the workflow must not be re-adoptable. + const adoptable = yield* dag.store.listByStatus("running").pipe(Effect.orDie) + expect(adoptable.map((wf) => wf.id)).not.toContain(dagID) + }), + ) +}) diff --git a/packages/opencode/test/session/session.test.ts b/packages/opencode/test/session/session.test.ts index c82f713d2b..4323703b07 100644 --- a/packages/opencode/test/session/session.test.ts +++ b/packages/opencode/test/session/session.test.ts @@ -5,6 +5,9 @@ import { EventV2 } from "@opencode-ai/core/event" import { SessionProjector } from "@opencode-ai/core/session/projector" import { Deferred, Effect, Exit, Layer } from "effect" import { Session as SessionNs } from "@/session/session" +import { Goal } from "@/goal/goal" +import { SessionAutomationLease } from "@/session/automation-lease" +import { Dag } from "@/dag/dag" import { MessageV2 } from "../../src/session/message-v2" import { MessageID, PartID, type SessionID } from "../../src/session/schema" import { CrossSpawnSpawner } from "@opencode-ai/core/cross-spawn-spawner" @@ -25,6 +28,9 @@ const it = testEffect( Layer.provide(SessionProjector.defaultLayer), Layer.provide(RuntimeFlags.layer({ experimentalWorkspaces: false })), Layer.provide(BackgroundJob.defaultLayer), + Layer.provide(Goal.defaultLayer), + Layer.provide(SessionAutomationLease.defaultLayer), + Layer.provide(Dag.defaultLayer), ), CrossSpawnSpawner.defaultLayer, testInstanceStoreLayer, From 0f59df4006a33f75e416d246c86f065bc5bb3678 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 06:11:35 +0800 Subject: [PATCH 29/34] fix(goal): publish session deletion after automation cleanup (GOAL-FP-01-05 follow-up) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit P2-A (ordering inversion): Session.remove published the Deleted event BEFORE the cleanup block, contradicting the block's own comment. Inside the publish transaction the SessionProjector deletes the session row and the workflow FK cascade wipes the workflow rows, so dag.store.listBySession in the cleanup always returned [] — the cancel loop was dead code, the WorkflowCancelled event never fired, the DagLoop terminal handler never aborted running DAG child sessions, and a crash between publish and cleanup orphaned goal_state/goal_outcome rows. Fix: reordered remove() to goal purge -> workflow cancel -> lease purge -> Deleted publish -> event-log removal. The SettingsHook SessionEnd trigger now runs BEFORE the destructive steps (its documented contract is to observe the session before removal; the event-wiring test asserts trigger contents only, no Deleted-vs-hook ordering, so no consumer conflict). P2-B (vacuous assertion): the cancellation test asserted expect(cancelledEvent).not.toBeNull(), which passes vacuously — drizzle .get() returns undefined for a missing row. Changed to toBeDefined(). TDD evidence: - Red (vacuity proof): toBeDefined() on the publish-first code fails with Received: undefined — the cancel event was indeed absent (2 pass / 1 fail). - Green: after the reorder, the event is actually present (3 pass / 0 fail). - Mutation: moved the publish back before the cleanup -> 1 fail (event absent). Restored -> green. Verification: bun test test/session test/goal test/dag -> 964 pass, 0 fail; bun typecheck clean; bun lint 4852 (ratchet). Co-Authored-By: Claude --- packages/opencode/src/session/session.ts | 21 +++++++++++++------ .../session/session-remove-cleanup.test.ts | 5 ++++- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/packages/opencode/src/session/session.ts b/packages/opencode/src/session/session.ts index 985a22e517..eeb747f578 100644 --- a/packages/opencode/src/session/session.ts +++ b/packages/opencode/src/session/session.ts @@ -655,9 +655,10 @@ export const layer: Layer.Layer< yield* remove(child.id) } - yield* events.publish(SessionV1.Event.Deleted, { sessionID, info: session }) // SettingsHook: SessionEnd fires before session-scoped hook state is cleared // (the trigger implementation clears seen-cache and session hooks after execution). + // It deliberately runs BEFORE the destructive steps below so the hook + // observes the session and its workflows while they still fully exist. if (settingsHook) { const seResult = yield* settingsHook .trigger({ event: "SessionEnd", reason: "delete" }, { sessionID, transcriptPath: "" }) @@ -666,11 +667,16 @@ export const layer: Layer.Layer< } // Cleanup durable automation state BEFORE the Deleted publish: the // SessionProjector deletes the session row (and FK cascades wipe the - // workflow rows) inside the Deleted publish transaction, so running - // cleanup first means a crash mid-way can only leave a live session - // with no goal/workflows (consistent, recoverable) — never orphan - // goal rows or re-adoptable workflows under a deleted session. The - // three steps live in separate aggregates (goal_state/goal_outcome, + // workflow rows) inside the Deleted publish transaction. Publishing + // first would make `dag.store.listBySession` below return [] (the + // cascade already removed the rows), turning the cancel loop into + // dead code — the WorkflowCancelled event would never fire, the + // DagLoop terminal handler would never abort running child sessions, + // and a crash between publish and cleanup would orphan goal rows. + // Running cleanup first means a crash mid-way can only leave a live + // session with no goal/workflows (consistent, recoverable) — never + // orphan goal rows or re-adoptable workflows under a deleted session. + // The three steps live in separate aggregates (goal_state/goal_outcome, // workflow events, the lease map) so no shared transaction is // available; each step is individually atomic. yield* goal.purgeSession(sessionID).pipe( @@ -706,6 +712,9 @@ export const layer: Layer.Layer< Effect.logWarning("automation lease purge failed during session remove", { sessionID, cause }), ), ) + // Session-row deletion (projector, inside this publish's transaction) + // comes LAST, after every cleanup step above. + yield* events.publish(SessionV1.Event.Deleted, { sessionID, info: session }) yield* events.remove(sessionID) } catch (error) { yield* Effect.logError("failed to remove session", { sessionID, error }) diff --git a/packages/opencode/test/session/session-remove-cleanup.test.ts b/packages/opencode/test/session/session-remove-cleanup.test.ts index deea0486e6..41e7488475 100644 --- a/packages/opencode/test/session/session-remove-cleanup.test.ts +++ b/packages/opencode/test/session/session-remove-cleanup.test.ts @@ -145,7 +145,10 @@ describe("Session.remove dag lease cleanup (GOAL-FP-01-06)", () => { ) .get() .pipe(Effect.orDie) - expect(cancelledEvent).not.toBeNull() + // P2-B: toBeNull() was vacuous — drizzle .get() returns undefined for a + // missing row and `expect(undefined).not.toBeNull()` always passes. + // toBeDefined() actually pins the durable dag.workflow.cancelled event. + expect(cancelledEvent).toBeDefined() // Recovery scan contract (dag/runtime/loop.ts adopts only // running/paused/stepping rows): the workflow must not be re-adoptable. From 9c68e5a25e8155b07aee4fdf0ca54a4fb60f6615 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 07:18:09 +0800 Subject: [PATCH 30/34] fix(goal): resume active goals after restart (GOAL-FP-01-04) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GoalLoop was purely event-driven: the idle-status subscription was the only driver, and no component emits idle for sessions that already existed at startup. An active goal that survived a crash slept until the next user interaction; with turns_used > 0 the D6 zombie guard also never fired (it runs inside afterIdle). The automation obligation — an active goal keeps advancing — was lost across restart. Add a startup scan to GoalLoop.init: - The durable snapshot is captured at instance boot inside the InstanceState builder (Goal.listActiveSessions — new accessor returning session ids whose goal_state row is "active", plus the goal revision), then the per-session triggers are forkScoped after the idle subscription is armed. Building from init's caller context would not work: evaluation fibers resolve services from their ambient runtime context, and the builder runs under the ScopedCache layer-build environment — the same context the idle subscription sees (this is why the test-injected GoalLoopJudgeLLM is visible). - The scan reuses the EXISTING evaluation path verbatim — the idle handler body was extracted into triggerEvaluation (active pre-check, fork afterIdle, registerLoopFiber, identity-scoped self-clean) and is now shared by both drivers. No new evaluation logic. - Mutual exclusion stays with the lease claim: a dag-owned session is rejected inside afterIdle exactly as on a real idle, and the GOAL-FP-01-02 blocked-claim re-trigger re-evaluates it once the dag releases (harmless + self-healing; covered by a test). - Busy sessions are gated via SessionStatus exactly like the idle path (the automation-lease re-trigger gate), plus afterIdle's post-judge status check and promptIfIdle; covered by a test. - Crash window between snapshot and trigger: terminal changes are absorbed by the active-status re-check; non-terminal changes (the scan fiber scheduled late, after the session's own idle event already evaluated the boundary) are absorbed by the expectedRevision gate — revision bumps on every durable transition, so a stale trigger cannot double-commit turns (the R1 turns-inflation harm, caught by the existing dag-release test before the gate existed). - The scan runs once, forkScoped; query and per-session failures are logged and swallowed, never fatal to init. TDD: Red — seeded a goal in the durable store before boot, published ZERO idle/status events, polled 5s for the judge/continuation: 3 tests failed with "startup scan never evaluated … (5s timeout)", goal stayed dormant. Green — added the scan; all 3 pass. Mutation — removed the scan trigger: same 3 tests go Red; restored → green. Verified: bun test test/goal test/dag test/session/automation-lease.test.ts (570 pass, 0 fail), bun typecheck (packages/opencode) clean, bun lint 4852 warnings (≤ 4852). Co-Authored-By: Claude --- packages/opencode/src/goal/goal.ts | 38 +++++ packages/opencode/src/goal/loop.ts | 162 ++++++++++++++---- packages/opencode/test/goal/e2e-loop.test.ts | 164 +++++++++++++++++++ 3 files changed, 334 insertions(+), 30 deletions(-) diff --git a/packages/opencode/src/goal/goal.ts b/packages/opencode/src/goal/goal.ts index 62ce376d01..7719c68afb 100644 --- a/packages/opencode/src/goal/goal.ts +++ b/packages/opencode/src/goal/goal.ts @@ -20,6 +20,17 @@ export type RemoveSubgoalResult = export interface Interface { readonly load: (sessionID: SessionID) => Effect.Effect + /** + * GOAL-FP-01-04: durable sessions whose goal_state row is still "active" — + * the startup-resume scan input for GoalLoop.init. Returns the session id + * plus the goal's current revision so the scan can detect goals that were + * touched after its boot-time snapshot (revision bumps on every durable + * transition). Best-effort: rows whose payload fails to decode are skipped, + * not fatal. + */ + readonly listActiveSessions: () => Effect.Effect< + ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }> + > readonly lastOutcome: (sessionID: SessionID) => Effect.Effect readonly set: (sessionID: SessionID, goal: string, maxTurns?: number) => Effect.Effect readonly pause: (sessionID: SessionID, reason: string) => Effect.Effect @@ -296,6 +307,32 @@ const serviceLayer = Layer.effect( return yield* loadState(sessionID) }) + // GOAL-FP-01-04: startup-resume scan accessor. GoalLoop is event-driven; + // after a restart nothing emits idle for sessions whose goal was active + // when the process died, so GoalLoop.init queries this durable set and + // re-triggers its existing idle evaluation path. Only "active" rows are + // returned — paused rows are user-visible and terminal rows are deleted + // by transition. Each entry carries the goal revision so the scan can + // skip goals that were touched after its boot-time snapshot. A row whose + // payload cannot be decoded is skipped defensively: the scan is + // best-effort, and the session's own idle event or /goal resume remains + // available as the recovery path. + const listActiveSessions = Effect.fn("Goal.listActiveSessions")(function* () { + const rows = yield* db.select().from(GoalStateTable).all().pipe(Effect.orDie) + const active: Array<{ sessionID: SessionID; revision: number }> = [] + for (const row of rows) { + let state: GoalState.Info + try { + state = Schema.decodeUnknownSync(GoalState.Info)(JSON.parse(row.payload)) + } catch { + continue + } + if (state.status === "active") + active.push({ sessionID: SessionID.make(row.session_id), revision: state.revision ?? 0 }) + } + return active + }) + const lastOutcome = Effect.fn("Goal.lastOutcome")(function* (sessionID: SessionID) { const row = yield* db .select() @@ -724,6 +761,7 @@ const serviceLayer = Layer.effect( return Service.of({ load, + listActiveSessions, lastOutcome, set, pause, diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index 122e824624..e7f33a58d6 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -117,38 +117,49 @@ const serviceLayer = Layer.effect( }) const state = yield* InstanceState.make( - Effect.fn("GoalLoop.state")(function* (_ctx) { - const scope = yield* Scope.Scope + Effect.fn("GoalLoop.state")(function* () { yield* events.subscribe(SessionStatus.Event.Status).pipe( Stream.filter((evt) => evt.data.status.type === "idle"), - Stream.runForEach((evt) => - Effect.gen(function* () { - const sid = evt.data.sessionID - // D4 (fiber lifecycle): do NOT fork or register a fiber for - // sessions without an active goal. Without this pre-check the - // fibers Map grows once per idle event for every session that - // ever went idle — including ones that never set a goal. afterIdle - // re-checks goal state internally too; that internal check stays - // as a TOCTOU guard (goal could be cleared between this load and - // the fork). v1.17.11: idle has no cause field; afterIdle handles - // abort detection via shouldPreempt (user message after cancel). - const goalState = yield* goal.load(sid) - if (!goalState || goalState.status !== "active") return - const fiber = yield* afterIdle(sid).pipe(Effect.ignore, Effect.forkIn(scope)) - yield* goal.registerLoopFiber(sid, fiber) - // D4 self-clean: when this afterIdle fiber completes naturally, - // remove it from the fibers Map IF it is still the registered one. - // A newer idle event may have already registered a fresh fiber - // (registerLoopFiber interrupts + overwrites the old one); - // clearLoopFiberIf's identity check avoids evicting the new fiber. - // The watcher never interrupts and completes right after its - // target, so it does not accumulate across idle events. - yield* Fiber.await(fiber).pipe( - Effect.flatMap(() => goal.clearLoopFiberIf(sid, fiber)), - Effect.ignore, - Effect.forkIn(scope), - ) - }).pipe(Effect.ignore), + // D4 (fiber lifecycle): triggerEvaluation below carries the full + // discipline (active-goal pre-check, fork, fiber registration, + // identity-scoped self-clean), shared verbatim with the + // GOAL-FP-01-04 startup scan so both drivers use one path. + Stream.runForEach((evt) => triggerEvaluation(evt.data.sessionID).pipe(Effect.ignore)), + Effect.forkScoped, + ) + // GOAL-FP-01-04: the startup resume scan. Its durable snapshot is + // captured HERE — at instance boot, inside the builder — not inside + // the forked scan fiber: a fiber delayed by scheduling could query + // AFTER this process already evaluated a goal (the session's own + // idle event), and re-evaluating that same turn boundary would + // double-commit turns (the R1 turns-inflation harm). Querying at + // boot means only goals that were active BEFORE this process started + // are ever scanned, and the per-session trigger re-checks the + // snapshot revision (bumped by every durable transition) to absorb + // the query→trigger window. + // + // The builder context matters too: service resolution inside the + // scan's evaluation fibers happens against the fiber's ambient + // runtime context, and the builder runs under the ScopedCache + // environment captured at layer build — the same context the + // idle-event subscription above sees. Forking the scan from init's + // caller context would inherit a context that lacks build-scope + // services (e.g. the test-injected GoalLoopJudgeLLM, or the + // Provider in slim callers) — the scan would silently no-op or + // crash. The per-session triggers are forked after the subscription + // is armed and into the same scope; failures are logged, never fatal + // to init. + const bootSnapshot = yield* goal.listActiveSessions().pipe( + Effect.tapError((error) => + Effect.logWarning("goal startup scan query failed", { error: String(error) }), + ), + Effect.orElseSucceed( + (): ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }> => [], + ), + ) + yield* scanForActiveGoals(bootSnapshot).pipe( + Effect.catchCause((cause) => + Effect.logWarning("goal startup scan failed", { cause: Cause.pretty(cause) }), ), Effect.forkScoped, ) @@ -406,6 +417,97 @@ const serviceLayer = Layer.effect( // stalling the goal loop. }) + // Shared evaluation trigger for BOTH the idle-event subscription above + // and the GOAL-FP-01-04 startup scan below — no second evaluation path. + // + // D4 (fiber lifecycle): do NOT fork or register a fiber for sessions + // without an active goal. Without this pre-check the fibers Map grows + // once per idle event for every session that ever went idle — including + // ones that never set a goal. afterIdle re-checks goal state internally + // too; that internal check stays as a TOCTOU guard (goal could be cleared + // between this load and the fork). v1.17.11: idle has no cause field; + // afterIdle handles abort detection via shouldPreempt (user message after + // cancel). + // + // D4 self-clean: when the afterIdle fiber completes naturally, remove it + // from the fibers Map IF it is still the registered one. A newer idle + // event may have already registered a fresh fiber (registerLoopFiber + // interrupts + overwrites the old one); clearLoopFiberIf's identity check + // avoids evicting the new fiber. The watcher never interrupts and + // completes right after its target, so it does not accumulate. + const triggerEvaluation = Effect.fnUntraced(function* ( + sessionID: SessionID, + scanExpected?: { readonly expectedRevision: number }, + ) { + const scope = yield* Scope.Scope + const goalState = yield* goal.load(sessionID) + if (!goalState || goalState.status !== "active") return + // GOAL-FP-01-04 crash window (query → trigger): the boot snapshot may + // go stale before the forked scan fiber triggers. A TERMINAL change is + // absorbed by the active-status re-check above (row deleted or paused + // → return). A NON-terminal change — the goal is still active but was + // touched by this process after the snapshot, e.g. the session's own + // idle event already evaluated this turn boundary — is absorbed here: + // revision bumps on EVERY durable transition (set, pause, resume, + // judge update, subgoal edits). Firing on a stale revision would + // double-commit turns for the same boundary (the R1 turns-inflation + // harm). The idle subscription never passes scanExpected, so this gate + // only narrows the scan. + if (scanExpected && (goalState.revision ?? 0) !== scanExpected.expectedRevision) return + const fiber = yield* afterIdle(sessionID).pipe(Effect.ignore, Effect.forkIn(scope)) + yield* goal.registerLoopFiber(sessionID, fiber) + yield* Fiber.await(fiber).pipe( + Effect.flatMap(() => goal.clearLoopFiberIf(sessionID, fiber)), + Effect.ignore, + Effect.forkIn(scope), + ) + }) + + // GOAL-FP-01-04: startup resume scan. GoalLoop is purely event-driven — + // the idle subscription above is the only driver, and no component emits + // idle for sessions that already existed at startup. An active goal that + // survived a crash therefore sleeps until the next user interaction (the + // D6 zombie guard also never fires: it runs inside afterIdle). The scan + // restores the automation obligation: after the subscription is armed, + // query the durable store for sessions with an active goal and trigger + // the EXISTING idle evaluation path for each. + // + // - Mutual exclusion: the lease claim is the sole authority. A session + // whose owner is dag is rejected by claim inside afterIdle exactly as + // on a real idle, and the blocked-claim re-trigger (GOAL-FP-01-02) + // re-evaluates it once the dag releases — the rejected trigger is + // harmless and self-healing. + // - Busy sessions: the SessionStatus gate below mirrors the + // automation-lease re-trigger gate; a session mid-turn is skipped and + // will be driven by its own turn-end idle event. At startup the status + // map is empty (get defaults to idle), so this only filters sessions + // that genuinely flipped busy between bootstrap and the scan. + // - Crash window (query → trigger): a goal may go terminal between the + // boot snapshot and triggerEvaluation. The existing guards absorb it — + // triggerEvaluation re-loads the goal and returns when it is no longer + // active, and updateAfterJudge re-checks goalID+revision under the + // lease token. The NON-terminal window (goal still active but touched + // by this process after the snapshot) is absorbed by the + // expectedRevision gate in triggerEvaluation (see there). + // - The scan runs once, forkScoped, and never fails init: per-session + // and query failures are logged and swallowed. + const scanForActiveGoals = Effect.fnUntraced(function* ( + snapshot: ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }>, + ) { + for (const { sessionID, revision } of snapshot) { + const current = yield* status.get(sessionID) + if (current.type !== "idle") continue + yield* triggerEvaluation(sessionID, { expectedRevision: revision }).pipe( + Effect.catchCause((cause) => + Effect.logWarning("goal startup scan failed for session", { + sessionID, + cause: Cause.pretty(cause), + }), + ), + ) + } + }) + const init = Effect.fn("GoalLoop.init")(function* () { yield* InstanceState.get(state) }) diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index 75c37f68af..92d0f97a83 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -910,3 +910,167 @@ describe("GoalLoop — continuation interrupted → no pause, goal stays active }), ) }) + +// GOAL-FP-01-04: GoalLoop is purely event-driven — the idle subscription is +// the only driver, and nothing re-emits idle for sessions that already +// existed at startup. An active goal that survived a crash therefore sleeps +// until the next user interaction (and the D6 zombie guard cannot fire +// without an idle event). The startup scan in GoalLoop.init must resume it: +// seed the goal in the durable store BEFORE boot, publish ZERO idle/status +// events, and the goal must still get evaluated (judge + continuation). +// +// The shared scanLayer mirrors the e2e harness: Goal / SessionStatus / +// EventV2Bridge / the lease are real; Session / SessionPrompt / Provider and +// the judge LLM are mocked. provideMerge exposes SessionStatus and the lease +// to the test body so pre-boot setup (busy / dag owner) shares the SAME +// instances the scan reads. +describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04)", () => { + let judgeCalls = 0 + let continuationCalls = 0 + const reset = () => { + judgeCalls = 0 + continuationCalls = 0 + } + + // Layer.mock (not Layer.succeed(… as never)) — the R1 describe above shows + // the warning-free pattern; `as never` would add lint-ratchet warnings. + const sessionMock = Layer.mock(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + }) + const promptMock = Layer.mock(SessionPrompt.Service, { + prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), + promptIfIdle: () => + Effect.sync(() => { + continuationCalls += 1 + return Option.none() + }), + }) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => + Effect.sync(() => { + judgeCalls += 1 + return JSON.stringify({ done: false, reason: "more steps needed" }) + }), + }), + ) + const scanLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.mock(Provider.Service, {})), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + // provideMerge (not provide): the test body seeds pre-boot busy / dag + // owner through SessionStatus and the lease, and the scan must read the + // SAME instances (see the arbitration describe above). + Layer.provideMerge(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + ) + const it = testEffect(scanLayer) + + it.instance("a goal active before boot is evaluated with ZERO idle events", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + // Seed the durable store BEFORE GoalLoop boots — models a goal_state + // row surviving a crash-restart. No idle/status event is published. + const sid = SessionID.descending() + yield* goal.set(sid, "ship the feature", 10) + yield* loop.init() + + // The only driver available is the startup scan: assert the full + // claim+judge+continuation flow ran within the poll window. + yield* pollWithTimeout( + Effect.sync(() => (continuationCalls >= 1 ? true : undefined)), + "startup scan never evaluated the pre-boot active goal", + "5 seconds", + ) + expect(judgeCalls).toBe(1) + const g = yield* goal.load(sid) + expect(g?.status).toBe("active") + expect(Number(g?.turns_used)).toBe(1) + }), + ) + + it.instance("a dag-owned session yields to the startup scan and resumes when the dag releases", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const automation = yield* SessionAutomationLease.Service + + // Session B is a plain active goal — its evaluation is the positive + // signal that the scan RAN (judgeCalls 0→1). Session A is dag-owned: + // the scan's claim must be rejected exactly like a real idle, so A + // contributes no judge call and stays untouched. + const sidA = SessionID.descending() + const sidB = SessionID.descending() + yield* goal.set(sidA, "goal owned by dag", 10) + yield* goal.set(sidB, "goal evaluated by scan", 10) + yield* automation.register(sidA, { kind: "dag", id: "dag-executor" }) + yield* loop.init() + + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "startup scan never evaluated the unblocked goal", + "5 seconds", + ) + const a = yield* goal.load(sidA) + expect(a?.status).toBe("active") + expect(Number(a?.turns_used)).toBe(0) // claim rejected — trigger harmless + expect(judgeCalls).toBe(1) // only B was evaluated + + // GOAL-FP-01-02: releasing the dag re-triggers the blocked goal + // evaluation through the idle mechanism — no manual idle event needed. + yield* automation.unregister(sidA, { kind: "dag", id: "dag-executor" }) + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 2 ? true : undefined)), + "goal did not resume after the dag released the session", + "5 seconds", + ) + const a2 = yield* goal.load(sidA) + expect(Number(a2?.turns_used)).toBe(1) + }), + ) + + it.instance("a busy session is not force-evaluated by the scan; its own idle event drives it", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const status = yield* SessionStatus.Service + + const sidA = SessionID.descending() + const sidB = SessionID.descending() + yield* goal.set(sidA, "goal on busy session", 10) + yield* goal.set(sidB, "goal on idle session", 10) + yield* status.set(sidA, { type: "busy" }) + yield* loop.init() + + // B's evaluation proves the scan ran; A must have been skipped by the + // SessionStatus gate — no force-evaluation mid-turn. + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "startup scan never evaluated the idle-session goal", + "5 seconds", + ) + expect(judgeCalls).toBe(1) + const a = yield* goal.load(sidA) + expect(a?.status).toBe("active") + expect(Number(a?.turns_used)).toBe(0) + + // When the busy session finishes, its own idle event drives the goal. + yield* status.set(sidA, { type: "idle" }) + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 2 ? true : undefined)), + "busy session's goal was not driven by its own idle event", + "5 seconds", + ) + const a2 = yield* goal.load(sidA) + expect(Number(a2?.turns_used)).toBe(1) + }), + ) +}) From ead30ca959b1abe1a391bc45561d43ec25fd9a66 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 08:17:07 +0800 Subject: [PATCH 31/34] fix(goal): scope the startup scan to the instance directory and harden failure handling (GOAL-FP-01-04 follow-up) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Domain review of the GOAL-FP-01-04 startup scan: one P1 (D-1) and three P2s (D-2/D-3/D-4), plus one registered residual. D-1 (P1): the scan was not scoped to the instance. goal_state has no directory column and the Database is the shared global opencode.db, so any instance boot evaluated/committed/paused/drove the active goals of EVERY project — judge budget burn, pause prompts injected into foreign sessions, cross-project agent turns with the wrong cwd. Fix: the scan query (Goal.listActiveSessions) now inner-joins goal_state.session_id → session.id and filters session.directory = the instance directory. The session table (core session sql, directory column) is the single directory authority; no schema change was needed. The directory is resolved in GoalLoop.init from the caller context (InstanceRef, which instance boot provides) and handed to the instance-state builder via a ref set before the first InstanceState.get — the builder runs under the ScopedCache layer-build environment, which does NOT include InstanceRef in production (reading InstanceState.directory there would die). D-2 (P2): "query failures logged and swallowed, never fatal" was false. tapError/orElseSucceed only handle Cause.Fail, so a boot-time DB defect killed the state builder, closing the ScopedCache entry scope and taking the idle subscription down with it until restart. Fix: the query is wrapped in Effect.catchCause, which in this effect version catches Fail AND Defect (there is no catchAllCause) — any failure degrades to no-scan + a log. Per-session triggers keep their catchCause guards. D-3 (P2): undecodable goal_state rows were skipped silently. The skip now logs a warning with the session id and the decode error, so the dormancy is visible (asserted via TestConsole). D-4 (P2): the boot-snapshot revision gate was not airtight: if an idle evaluation committed between the scan's gate load and its afterIdle entry load, the scan's evaluation would commit again (matchesExpected passes on the re-loaded revision) — double-commit of the same boundary. Fix: replaced the snapshot-revision comparison with a per-process evaluatedRevisions map — afterIdle records the committed revision on every successful updateAfterJudge; the scan path (triggerEvaluation gate + afterIdle entry gate, flagged by scanResume) skips when the recorded revision equals the current revision. The idle path never consults the gate, so it keeps re-evaluating the same revision across new turn boundaries. This also fixes the D-5 cross-process false negative: a revision bumped by a touch-without-evaluation (incl. by another process before this boot) no longer suppresses the resume. The map is overwritten by every commit and deleted at the same terminal points where afterIdle unregisters the goal automation. D-4 testability: the A-commits/B-scan interleaving is not deterministically constructible through the public seam — the scan's gate load and afterIdle's entry load are adjacent in the same fiber with no injectable pause between them, and the fiber map's interrupt-on-replace kills any earlier evaluation a test could park. The committed D-4 test instead deterministically parks the scan's evaluation at the judge (Deferred, not sleep), races an idle evaluation into the same boundary, and asserts exactly one commit — the tightest public-seam construction of the race. The record gate's exact interleaving is argued above rather than exercised. Registered residual (not fixable in-process): the cross-process mirror of D-4 — two live GoalLoop instances in the same process group could both evaluate the same boundary (each has its own record map). Trigger conditions: two instances booted against the same session/goal_state simultaneously. Rare; would need a cross-instance lease or a directory-level claim, out of scope for this slice. TDD: D-1 Red — a foreign-directory goal got evaluated (foreignJudgeCalls 1, turns 1, expected 0); D-2 Red — dropping goal_state killed init (test body died); D-3 Red — no skip log captured. D-4 regression guard green on HEAD. Green after the fix: all four pass. Mutations: removed the directory filter → D-1 Red; restored tapError/orElseSucceed + orDie (pre-fix defect channel) → D-2 Red. Restored → green. Verified: bun test test/goal test/dag test/session/automation-lease.test.ts (574 pass, 0 fail, 3x stable e2e-loop reruns), bun typecheck (packages/opencode) clean, bun lint 4852 warnings (≤ 4852). Co-Authored-By: Claude --- packages/opencode/src/goal/goal.ts | 58 +++-- packages/opencode/src/goal/loop.ts | 160 +++++++----- packages/opencode/test/goal/e2e-loop.test.ts | 246 ++++++++++++++++++- 3 files changed, 376 insertions(+), 88 deletions(-) diff --git a/packages/opencode/src/goal/goal.ts b/packages/opencode/src/goal/goal.ts index 7719c68afb..b3a0aadcd4 100644 --- a/packages/opencode/src/goal/goal.ts +++ b/packages/opencode/src/goal/goal.ts @@ -1,7 +1,8 @@ export * as Goal from "./goal" import { Effect, Layer, Context, Schema, Fiber } from "effect" -import { desc, eq } from "drizzle-orm" +import { desc, eq, sql } from "drizzle-orm" +import { SessionTable } from "@opencode-ai/core/session/sql" import { LayerNode } from "@opencode-ai/core/effect/layer-node" import { Database } from "@opencode-ai/core/database/database" import { EventV2Bridge } from "@/event-v2-bridge" @@ -21,16 +22,14 @@ export type RemoveSubgoalResult = export interface Interface { readonly load: (sessionID: SessionID) => Effect.Effect /** - * GOAL-FP-01-04: durable sessions whose goal_state row is still "active" — - * the startup-resume scan input for GoalLoop.init. Returns the session id - * plus the goal's current revision so the scan can detect goals that were - * touched after its boot-time snapshot (revision bumps on every durable - * transition). Best-effort: rows whose payload fails to decode are skipped, - * not fatal. + * GOAL-FP-01-04: durable session ids whose goal_state row is still "active" + * AND whose session belongs to `directory` — the startup-resume scan input + * for GoalLoop.init. The session table is the directory authority + * (goal_state has no directory column), so one instance's scan can never + * drive another instance's goals. Best-effort: rows whose payload fails to + * decode are skipped with a logged warning, not fatal. */ - readonly listActiveSessions: () => Effect.Effect< - ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }> - > + readonly listActiveSessions: (directory: string) => Effect.Effect, Error> readonly lastOutcome: (sessionID: SessionID) => Effect.Effect readonly set: (sessionID: SessionID, goal: string, maxTurns?: number) => Effect.Effect readonly pause: (sessionID: SessionID, reason: string) => Effect.Effect @@ -312,23 +311,40 @@ const serviceLayer = Layer.effect( // when the process died, so GoalLoop.init queries this durable set and // re-triggers its existing idle evaluation path. Only "active" rows are // returned — paused rows are user-visible and terminal rows are deleted - // by transition. Each entry carries the goal revision so the scan can - // skip goals that were touched after its boot-time snapshot. A row whose - // payload cannot be decoded is skipped defensively: the scan is - // best-effort, and the session's own idle event or /goal resume remains - // available as the recovery path. - const listActiveSessions = Effect.fn("Goal.listActiveSessions")(function* () { - const rows = yield* db.select().from(GoalStateTable).all().pipe(Effect.orDie) - const active: Array<{ sessionID: SessionID; revision: number }> = [] + // by transition. + // + // D-1: scoped to the instance's own directory. goal_state has no + // directory column; the session table is the directory authority, so the + // query joins goal_state.session_id → session.id and filters on + // session.directory — the scan can never evaluate, commit, pause, or + // drive another instance's sessions. Goal rows whose session row is + // missing are dropped by the inner join (invisible to the scan, same as + // other instances' rows). + // + // D-3: a row whose payload cannot be decoded is skipped defensively (the + // scan is best-effort; the session's own idle event or /goal resume + // remains available) but the skip is LOGGED with the session id and the + // decode error — a silently-dormant goal is not diagnosable. + const listActiveSessions = Effect.fn("Goal.listActiveSessions")(function* (directory: string) { + const rows = yield* db + .select({ session_id: GoalStateTable.session_id, payload: GoalStateTable.payload }) + .from(GoalStateTable) + .innerJoin(SessionTable, sql`${GoalStateTable.session_id} = ${SessionTable.id}`) + .where(eq(SessionTable.directory, directory)) + .all() + const active: SessionID[] = [] for (const row of rows) { let state: GoalState.Info try { state = Schema.decodeUnknownSync(GoalState.Info)(JSON.parse(row.payload)) - } catch { + } catch (error) { + yield* Effect.logWarning( + `goal startup scan skipped undecodable goal_state row for ${row.session_id}`, + { error: String(error) }, + ) continue } - if (state.status === "active") - active.push({ sessionID: SessionID.make(row.session_id), revision: state.revision ?? 0 }) + if (state.status === "active") active.push(SessionID.make(row.session_id)) } return active }) diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index e7f33a58d6..2306354bcf 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -116,6 +116,16 @@ const serviceLayer = Layer.effect( return paused }) + // GOAL-FP-01-04 (D-1): the instance directory the scan scopes to. The + // state builder runs under the ScopedCache layer-build environment, + // which does NOT include InstanceRef in production — resolving + // InstanceState.directory inside the builder would die with "InstanceRef + // not provided". init resolves it from its CALLER's context (instance + // boot provides InstanceRef) and hands it to the builder through this + // ref, set BEFORE the first InstanceState.get so the builder always + // reads a populated value. + const scanDirectoryRef: { current: string } = { current: "" } + const state = yield* InstanceState.make( Effect.fn("GoalLoop.state")(function* () { yield* events.subscribe(SessionStatus.Event.Status).pipe( @@ -127,37 +137,35 @@ const serviceLayer = Layer.effect( Stream.runForEach((evt) => triggerEvaluation(evt.data.sessionID).pipe(Effect.ignore)), Effect.forkScoped, ) - // GOAL-FP-01-04: the startup resume scan. Its durable snapshot is - // captured HERE — at instance boot, inside the builder — not inside - // the forked scan fiber: a fiber delayed by scheduling could query - // AFTER this process already evaluated a goal (the session's own - // idle event), and re-evaluating that same turn boundary would - // double-commit turns (the R1 turns-inflation harm). Querying at - // boot means only goals that were active BEFORE this process started - // are ever scanned, and the per-session trigger re-checks the - // snapshot revision (bumped by every durable transition) to absorb - // the query→trigger window. + // GOAL-FP-01-04: the startup resume scan. The durable snapshot is + // captured HERE — at instance boot (the builder runs at the first + // InstanceState.get, i.e. init), awaited — not inside the forked + // scan fiber: a fiber delayed by scheduling could query AFTER this + // process already evaluated a goal (the session's own idle event), + // and re-evaluating that same turn boundary would double-commit + // turns (the R1 turns-inflation harm). Querying at boot means only + // goals that were active BEFORE this process started are ever + // scanned. The builder context is also the layer-build context — the + // one the idle subscription above sees — so the scan's evaluation + // fibers resolve the same services. // - // The builder context matters too: service resolution inside the - // scan's evaluation fibers happens against the fiber's ambient - // runtime context, and the builder runs under the ScopedCache - // environment captured at layer build — the same context the - // idle-event subscription above sees. Forking the scan from init's - // caller context would inherit a context that lacks build-scope - // services (e.g. the test-injected GoalLoopJudgeLLM, or the - // Provider in slim callers) — the scan would silently no-op or - // crash. The per-session triggers are forked after the subscription - // is armed and into the same scope; failures are logged, never fatal - // to init. - const bootSnapshot = yield* goal.listActiveSessions().pipe( - Effect.tapError((error) => - Effect.logWarning("goal startup scan query failed", { error: String(error) }), - ), - Effect.orElseSucceed( - (): ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }> => [], - ), + // D-2: catchCause (unlike tapError/orElseSucceed) catches Fail AND + // Defect, so ANY query failure degrades to no-scan + a log and can + // never kill the builder — which would close the ScopedCache entry + // scope and take the idle subscription down with it. + const snapshot = yield* goal.listActiveSessions(scanDirectoryRef.current).pipe( + Effect.catchCause((cause) => { + const empty: ReadonlyArray = [] + return Effect.logWarning("goal startup scan query failed", { + directory: scanDirectoryRef.current, + cause: Cause.pretty(cause), + }).pipe(Effect.as(empty)) + }), ) - yield* scanForActiveGoals(bootSnapshot).pipe( + // The per-session triggers are forked after the subscription is + // armed and into the same scope; failures are logged, never fatal to + // init. + yield* scanForActiveGoals(snapshot).pipe( Effect.catchCause((cause) => Effect.logWarning("goal startup scan failed", { cause: Cause.pretty(cause) }), ), @@ -167,9 +175,27 @@ const serviceLayer = Layer.effect( }), ) - const afterIdle = Effect.fn("GoalLoop.afterIdle")(function* (sessionID: SessionID) { + // D-4 (GOAL-FP-01-04 follow-up): per-process record of which goal + // revision this process already evaluated. Written by afterIdle on every + // successful updateAfterJudge commit; consulted ONLY by the startup-scan + // path (scanResume) — the idle path must keep re-evaluating the same + // revision across new turn boundaries, so the gate never applies to it. + // Lifecycle mirrors the fibers map: overwritten by every commit, deleted + // at the same terminal points where afterIdle unregisters the goal + // automation. + const evaluatedRevisions = new Map() + + const afterIdle = Effect.fn("GoalLoop.afterIdle")(function* (sessionID: SessionID, scanResume?: boolean) { const goalState = yield* goal.load(sessionID) if (!goalState || goalState.status !== "active") return + // D-4 entry gate (scan path only): the boot snapshot may have gone + // stale between triggerEvaluation's load and this entry load — an idle + // evaluation could have committed a new revision in between, and this + // scan evaluation would then double-commit the SAME boundary + // (matchesExpected passes because this entry load already sees the + // newer revision). If this process already evaluated the CURRENT + // revision, the scan trigger is stale — skip. + if (scanResume && evaluatedRevisions.get(sessionID) === (goalState.revision ?? 0)) return const goalOwner = { kind: "goal" as const, id: goalState.goal_id ?? "legacy" } yield* automation.register(sessionID, goalOwner) const observedLease = Option.getOrUndefined(yield* automation.claim(sessionID, goalOwner)) @@ -279,8 +305,14 @@ const serviceLayer = Layer.effect( ) if (!updateResult) return + // D-4: record the committed revision as evaluated-by-this-process + // (every verdict — continue, done, blocked — is a completed + // evaluation of the pre-commit state). + evaluatedRevisions.set(sessionID, updateResult.state.revision ?? 0) + if (!updateResult.shouldContinue) { yield* automation.unregister(sessionID, goalOwner) + evaluatedRevisions.delete(sessionID) if (verdict.verdict === "done") { yield* promptSvc.prompt({ sessionID, @@ -404,8 +436,10 @@ const serviceLayer = Layer.effect( ), ) const afterDispatch = yield* goal.load(sessionID) - if (!afterDispatch || afterDispatch.status !== "active") + if (!afterDispatch || afterDispatch.status !== "active") { yield* automation.unregister(sessionID, goalOwner) + evaluatedRevisions.delete(sessionID) + } // NOTE: We deliberately DO NOT call goal.clearLoopFiber here. The // promptSvc.prompt above triggers a fresh agent loop, which when it @@ -435,26 +469,23 @@ const serviceLayer = Layer.effect( // interrupts + overwrites the old one); clearLoopFiberIf's identity check // avoids evicting the new fiber. The watcher never interrupts and // completes right after its target, so it does not accumulate. - const triggerEvaluation = Effect.fnUntraced(function* ( - sessionID: SessionID, - scanExpected?: { readonly expectedRevision: number }, - ) { + const triggerEvaluation = Effect.fnUntraced(function* (sessionID: SessionID, scanResume?: boolean) { const scope = yield* Scope.Scope const goalState = yield* goal.load(sessionID) if (!goalState || goalState.status !== "active") return - // GOAL-FP-01-04 crash window (query → trigger): the boot snapshot may - // go stale before the forked scan fiber triggers. A TERMINAL change is - // absorbed by the active-status re-check above (row deleted or paused - // → return). A NON-terminal change — the goal is still active but was - // touched by this process after the snapshot, e.g. the session's own - // idle event already evaluated this turn boundary — is absorbed here: - // revision bumps on EVERY durable transition (set, pause, resume, - // judge update, subgoal edits). Firing on a stale revision would - // double-commit turns for the same boundary (the R1 turns-inflation - // harm). The idle subscription never passes scanExpected, so this gate - // only narrows the scan. - if (scanExpected && (goalState.revision ?? 0) !== scanExpected.expectedRevision) return - const fiber = yield* afterIdle(sessionID).pipe(Effect.ignore, Effect.forkIn(scope)) + // D-4 gate (scan path only): skip when this process already evaluated + // the CURRENT revision — the boot snapshot went stale after a + // legitimate evaluation (e.g. the session's own idle event ran before + // the scan fiber). This replaces the boot-snapshot revision + // comparison: unlike that gate, a revision bumped by a non-evaluation + // touch (pause/resume/subgoal edit — including one made by another + // process before this boot) does NOT suppress the resume, which is + // correct — the goal still awaits its evaluation. The idle + // subscription never passes scanResume, so this only narrows the scan. + // afterIdle re-checks at its own entry load (see there) to close the + // window between this load and the fork. + if (scanResume && evaluatedRevisions.get(sessionID) === (goalState.revision ?? 0)) return + const fiber = yield* afterIdle(sessionID, scanResume).pipe(Effect.ignore, Effect.forkIn(scope)) yield* goal.registerLoopFiber(sessionID, fiber) yield* Fiber.await(fiber).pipe( Effect.flatMap(() => goal.clearLoopFiberIf(sessionID, fiber)), @@ -468,9 +499,8 @@ const serviceLayer = Layer.effect( // idle for sessions that already existed at startup. An active goal that // survived a crash therefore sleeps until the next user interaction (the // D6 zombie guard also never fires: it runs inside afterIdle). The scan - // restores the automation obligation: after the subscription is armed, - // query the durable store for sessions with an active goal and trigger - // the EXISTING idle evaluation path for each. + // restores the automation obligation: for each session in the boot + // snapshot, trigger the EXISTING idle evaluation path. // // - Mutual exclusion: the lease claim is the sole authority. A session // whose owner is dag is rejected by claim inside afterIdle exactly as @@ -482,22 +512,17 @@ const serviceLayer = Layer.effect( // will be driven by its own turn-end idle event. At startup the status // map is empty (get defaults to idle), so this only filters sessions // that genuinely flipped busy between bootstrap and the scan. - // - Crash window (query → trigger): a goal may go terminal between the - // boot snapshot and triggerEvaluation. The existing guards absorb it — - // triggerEvaluation re-loads the goal and returns when it is no longer - // active, and updateAfterJudge re-checks goalID+revision under the - // lease token. The NON-terminal window (goal still active but touched - // by this process after the snapshot) is absorbed by the - // expectedRevision gate in triggerEvaluation (see there). - // - The scan runs once, forkScoped, and never fails init: per-session - // and query failures are logged and swallowed. - const scanForActiveGoals = Effect.fnUntraced(function* ( - snapshot: ReadonlyArray<{ readonly sessionID: SessionID; readonly revision: number }>, - ) { - for (const { sessionID, revision } of snapshot) { + // - Crash window (query → trigger): terminal changes are absorbed by the + // active-status re-check; non-terminal changes (already evaluated in + // this process) by the D-4 record gate in triggerEvaluation/afterIdle. + // - Failures: per-session catchCause (covers Fail AND Defect) so one bad + // session never kills the rest of the scan; the whole scan is forked, + // so a failure can never kill init. + const scanForActiveGoals = Effect.fnUntraced(function* (snapshot: ReadonlyArray) { + for (const sessionID of snapshot) { const current = yield* status.get(sessionID) if (current.type !== "idle") continue - yield* triggerEvaluation(sessionID, { expectedRevision: revision }).pipe( + yield* triggerEvaluation(sessionID, true).pipe( Effect.catchCause((cause) => Effect.logWarning("goal startup scan failed for session", { sessionID, @@ -509,6 +534,11 @@ const serviceLayer = Layer.effect( }) const init = Effect.fn("GoalLoop.init")(function* () { + // Resolve the scan's directory scope BEFORE the first state get — the + // builder (which runs inside that get) reads it from the ref. This + // context carries InstanceRef (instance boot provides it); the + // builder's does not. + scanDirectoryRef.current = yield* InstanceState.directory yield* InstanceState.get(state) }) diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index 92d0f97a83..0b24da1b51 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -10,6 +10,14 @@ import { SessionPrompt } from "@/session/prompt" import { Provider } from "@/provider/provider" import { SessionID } from "@/session/schema" import { SessionAutomationLease } from "@/session/automation-lease" +import { Database } from "@opencode-ai/core/database/database" +import { SessionTable } from "@opencode-ai/core/session/sql" +import { GoalStateTable } from "@opencode-ai/core/goal/sql" +import { ProjectTable } from "@opencode-ai/core/project/sql" +import { ProjectSchema } from "@opencode-ai/core/project/schema" +import { AbsolutePath } from "@opencode-ai/core/schema" +import { TestInstance } from "../fixture/fixture" +import { logLines } from "effect/testing/TestConsole" import { testEffect, pollWithTimeout } from "../lib/effect" // P2b: full-cycle Goal regression (D5). Drives set → idle → judge(continue) → @@ -962,22 +970,48 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 Layer.provide(judgeMock), Layer.provideMerge(Goal.defaultLayer), // provideMerge (not provide): the test body seeds pre-boot busy / dag - // owner through SessionStatus and the lease, and the scan must read the - // SAME instances (see the arbitration describe above). + // owner through SessionStatus, the lease, and the DB, and the scan must + // read the SAME instances (see the arbitration describe above). Layer.provideMerge(SessionStatus.defaultLayer), Layer.provideMerge(EventV2Bridge.defaultLayer), Layer.provideMerge(SessionAutomationLease.defaultLayer), + Layer.provideMerge(Database.defaultLayer), ) const it = testEffect(scanLayer) + // Seeds a durable session row (+ its project row, FK-required) so the + // D-1 directory join can attribute the goal_state row to an instance. + const seedSessionRow = (sessionID: SessionID, directory: string) => + Effect.gen(function* () { + const { db } = yield* Database.Service + const projectID = ProjectSchema.ID.make(Bun.randomUUIDv7()) + yield* db.insert(ProjectTable).values({ + id: projectID, + worktree: AbsolutePath.make(directory), + sandboxes: [AbsolutePath.make(directory)], + }) + yield* db.insert(SessionTable).values({ + id: sessionID, + project_id: projectID, + slug: "test-session", + directory, + title: "test session", + version: "1", + time_created: Date.now(), + time_updated: Date.now(), + }) + }) + it.instance("a goal active before boot is evaluated with ZERO idle events", () => Effect.gen(function* () { reset() const loop = yield* GoalLoop.Service const goal = yield* Goal.Service + const directory = (yield* TestInstance).directory // Seed the durable store BEFORE GoalLoop boots — models a goal_state // row surviving a crash-restart. No idle/status event is published. const sid = SessionID.descending() + yield* seedSessionRow(sid, directory) yield* goal.set(sid, "ship the feature", 10) yield* loop.init() @@ -1001,6 +1035,7 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 const loop = yield* GoalLoop.Service const goal = yield* Goal.Service const automation = yield* SessionAutomationLease.Service + const directory = (yield* TestInstance).directory // Session B is a plain active goal — its evaluation is the positive // signal that the scan RAN (judgeCalls 0→1). Session A is dag-owned: @@ -1008,6 +1043,8 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 // contributes no judge call and stays untouched. const sidA = SessionID.descending() const sidB = SessionID.descending() + yield* seedSessionRow(sidA, directory) + yield* seedSessionRow(sidB, directory) yield* goal.set(sidA, "goal owned by dag", 10) yield* goal.set(sidB, "goal evaluated by scan", 10) yield* automation.register(sidA, { kind: "dag", id: "dag-executor" }) @@ -1042,9 +1079,12 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 const loop = yield* GoalLoop.Service const goal = yield* Goal.Service const status = yield* SessionStatus.Service + const directory = (yield* TestInstance).directory const sidA = SessionID.descending() const sidB = SessionID.descending() + yield* seedSessionRow(sidA, directory) + yield* seedSessionRow(sidB, directory) yield* goal.set(sidA, "goal on busy session", 10) yield* goal.set(sidB, "goal on idle session", 10) yield* status.set(sidA, { type: "busy" }) @@ -1074,3 +1114,205 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 }), ) }) + +// GOAL-FP-01-04 follow-up (D-1..D-4): scoping and hardening of the startup +// scan. D-1: the scan must be scoped to the instance's own directory (join +// goal_state → session.directory). D-2: a defective scan query must degrade +// to no-scan + a log, never kill init or the idle path. D-3: undecodable +// rows must be skipped with a visible log, not silently. D-4: a scan +// evaluation racing an idle evaluation must commit exactly once. +describe("GoalLoop — startup scan scoping and hardening (GOAL-FP-01-04 follow-up)", () => { + let judgeCalls = 0 + let foreignJudgeCalls = 0 + let parkFirstJudge = false + let judgeRelease = Deferred.makeUnsafe() + const reset = () => { + judgeCalls = 0 + foreignJudgeCalls = 0 + parkFirstJudge = false + judgeRelease = Deferred.makeUnsafe() + } + + // The judge LLM prompt carries the goal text verbatim, so the mock can + // attribute calls to the foreign-directory goal via a marker string. + const FOREIGN_GOAL = "FOREIGN-MARKER ship the feature" + + const sessionMock = Layer.mock(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + }) + const promptMock = Layer.mock(SessionPrompt.Service, { + prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), + promptIfIdle: () => Effect.sync(() => Option.none()), + }) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: (opts: { user: string }) => + Effect.gen(function* () { + judgeCalls += 1 + if (opts.user.includes("FOREIGN-MARKER")) foreignJudgeCalls += 1 + // D-4 hook: park the first judge call so the scan and idle + // evaluations race deterministically. + if (parkFirstJudge && judgeCalls === 1) yield* Deferred.await(judgeRelease) + return JSON.stringify({ done: false, reason: "more steps needed" }) + }), + }), + ) + const hardenLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.mock(Provider.Service, {})), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + Layer.provideMerge(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + Layer.provideMerge(Database.defaultLayer), + ) + const it = testEffect(hardenLayer) + + const seedSessionRow = (sessionID: SessionID, directory: string) => + Effect.gen(function* () { + const { db } = yield* Database.Service + const projectID = ProjectSchema.ID.make(Bun.randomUUIDv7()) + yield* db.insert(ProjectTable).values({ + id: projectID, + worktree: AbsolutePath.make(directory), + sandboxes: [AbsolutePath.make(directory)], + }) + yield* db.insert(SessionTable).values({ + id: sessionID, + project_id: projectID, + slug: "test-session", + directory, + title: "test session", + version: "1", + time_created: Date.now(), + time_updated: Date.now(), + }) + }) + + it.instance("D-1: a foreign-directory active goal is not evaluated; the same-directory goal is", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const directory = (yield* TestInstance).directory + + const sidForeign = SessionID.descending() + const sidSame = SessionID.descending() + yield* seedSessionRow(sidForeign, directory + "-foreign") + yield* seedSessionRow(sidSame, directory) + yield* goal.set(sidForeign, FOREIGN_GOAL, 10) + yield* goal.set(sidSame, "ship the feature", 10) + yield* loop.init() + + // Positive control: the same-directory goal IS evaluated by the scan. + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "startup scan never evaluated the same-directory goal", + "5 seconds", + ) + // Let any (buggy) foreign evaluation settle before asserting. + yield* Effect.sleep("300 millis") + const same = yield* goal.load(sidSame) + const foreign = yield* goal.load(sidForeign) + expect(Number(same?.turns_used)).toBe(1) + expect(foreignJudgeCalls).toBe(0) + expect(foreign?.status).toBe("active") + expect(Number(foreign?.turns_used)).toBe(0) + }), + ) + + it.instance("D-2: a defective scan query never kills init; the idle path still works", () => + Effect.gen(function* () { + reset() + const { db } = yield* Database.Service + // Corrupt DB state: the scan query hits a missing table. + yield* db.run("DROP TABLE goal_state") + const loop = yield* GoalLoop.Service + yield* loop.init() // must not die + yield* db.run( + "CREATE TABLE goal_state (session_id TEXT PRIMARY KEY NOT NULL, payload TEXT NOT NULL, updated_at INTEGER NOT NULL)", + ) + const goal = yield* Goal.Service + const events = yield* EventV2Bridge.Service + const directory = (yield* TestInstance).directory + const sid = SessionID.descending() + yield* seedSessionRow(sid, directory) + yield* goal.set(sid, "ship the feature", 10) + yield* Effect.yieldNow + + // The idle subscription (armed before the scan) must still drive the + // goal — the defective scan degraded, it did not kill the loop. + yield* events.publish(SessionStatus.Event.Status, { sessionID: sid, status: { type: "idle" } }) + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "idle path dead after a defective scan", + "5 seconds", + ) + expect(Number((yield* goal.load(sid))?.turns_used)).toBe(1) + }), + ) + + it.instance("D-3: an undecodable goal_state row is skipped with a visible warning log", () => + Effect.gen(function* () { + reset() + const { db } = yield* Database.Service + const directory = (yield* TestInstance).directory + const sid = SessionID.descending() + yield* seedSessionRow(sid, directory) + yield* db + .insert(GoalStateTable) + .values({ session_id: sid, payload: "{corrupt", updated_at: Date.now() }) + const loop = yield* GoalLoop.Service + yield* loop.init() + const logs = JSON.stringify(yield* logLines) + expect(logs).toContain("goal startup scan skipped undecodable goal_state row") + expect(logs).toContain(String(sid)) + }), + ) + + it.instance("D-4: a scan evaluation racing an idle evaluation commits exactly once", () => + Effect.gen(function* () { + reset() + parkFirstJudge = true + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const events = yield* EventV2Bridge.Service + const directory = (yield* TestInstance).directory + const sid = SessionID.descending() + yield* seedSessionRow(sid, directory) + yield* goal.set(sid, "ship the feature", 10) + yield* loop.init() + + // Wait for the scan's evaluation to reach the judge, where it parks. + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 1 ? true : undefined)), + "the scan's evaluation never reached the judge", + "5 seconds", + ) + // Now a second evaluation races it: the idle event drives an + // independent trigger for the SAME turn boundary. The fiber map's + // interrupt-on-replace kills the parked scan evaluation, and exactly + // ONE commit for the boundary must land. + yield* events.publish(SessionStatus.Event.Status, { sessionID: sid, status: { type: "idle" } }) + + yield* pollWithTimeout( + Effect.gen(function* () { + const g = yield* goal.load(sid) + return Number(g?.turns_used) >= 1 ? true : undefined + }), + "no racing evaluation committed", + "5 seconds", + ) + yield* Effect.sleep("50 millis") + yield* Deferred.succeed(judgeRelease, undefined) + const g = yield* goal.load(sid) + expect(g?.status).toBe("active") + // The single-writer commit point (matchesExpected + record gate) must + // yield exactly ONE commit for the boundary — not two. + expect(Number(g?.turns_used)).toBe(1) + }), + ) +}) From 1da14396d0fa7d3ac93889d6ef7f42428772ee82 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 09:17:31 +0800 Subject: [PATCH 32/34] fix(goal): close P3 hygiene findings (GOAL-FP-01-07/-08/-09/-12/-13/-14/-15) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - GOAL-FP-01-07: updateAfterJudge `expected` (goalID+revision) is now a required parameter — the stale-judge protection is the contract, not a caller convention. matchesExpected's optional short-circuit is gone; typecheck enforces every caller passes the pre-judge identity. - GOAL-FP-01-08: Goal.set now unregisters the previous goal id from the automation lease atomically with the overwrite, so a replaced goal can no longer leave a double id in the registration set (owner() returned the stale first id and silently starved the new goal's claim). - GOAL-FP-01-09: the goal tool's `complete` no longer shows "✓ 目标已达成" when markDone no-ops (clear/complete race) — it reports the no-op instead of presenting a goal that no longer exists as achieved. - GOAL-FP-01-12: the dispatch-failure path now pauses via pauseGoal (pauseAndPublish + inline lease unregister), symmetric with every other pause site instead of depending on the trailing afterDispatch load. - GOAL-FP-01-13 (test): one integration test drives the goal continuation through the REAL SessionRunState.startIfIdle admission gate — real busy flip, real admission rejection, and the REAL Runner onIdle re-driving the loop to done with no manual idle events. Remains mocked: SessionPrompt admitPrompt/runLoop (full app layer — disproportionate), Session, Provider, judge LLM. - GOAL-FP-01-14: wake delivery dedupes on retry — a summary whose transcript part was already written is only re-marked, never re-prompted (in-process; the crash-between-write-and-mark residual on the restart sweep is registered — a durable delivering-marker would need a schema change). The delivery failure log now carries the cause. - GOAL-FP-01-15: the done confirmation prompt failure is logged instead of silently swallowed (no retry — a retried line could re-inject after a new goal is set; the crash-window transcript loss is inherent to the durable-leads-presentation invariant and the event stream still notifies consumers). Tests: red-first pinning tests for -08 (lease), -09 (tool API), -12 (lease after a defecting trailing load), -14 (wake retry dedupe); -13's test is the artifact. Mutation-verified for -08/-09/-12/-14. Co-Authored-By: Claude --- packages/opencode/src/dag/runtime/loop.ts | 89 ++++-- packages/opencode/src/goal/goal.ts | 32 ++- packages/opencode/src/goal/loop.ts | 25 +- packages/opencode/src/tool/goal.ts | 26 +- .../test/dag/dag-goal-wake-retrigger.test.ts | 88 +++++- packages/opencode/test/goal/e2e-loop.test.ts | 261 ++++++++++++++++++ packages/opencode/test/goal/goal.test.ts | 139 ++++++++-- packages/opencode/test/tool/goal-tool.test.ts | 22 ++ 8 files changed, 603 insertions(+), 79 deletions(-) diff --git a/packages/opencode/src/dag/runtime/loop.ts b/packages/opencode/src/dag/runtime/loop.ts index 6a62852fcc..06f09f9af1 100644 --- a/packages/opencode/src/dag/runtime/loop.ts +++ b/packages/opencode/src/dag/runtime/loop.ts @@ -69,6 +69,17 @@ const serviceLayer = Layer.effect( const recovering = new Set() const wakeInFlight = new Set() const wakePending = new Set() + // GOAL-FP-01-14: per-session record of the last wake summary whose + // transcript part was written. The durable mark runs AFTER the write + // (at-least-once delivery: a mark failure keeps the batch unreported + // for a retry), so a retry of an already-written summary would + // re-inject the same digest into the transcript. The retry dedupes on + // this map and only re-marks. In-process only — a crash between write + // and mark still duplicates on the restart sweep (a durable + // delivering-marker would need a schema change; registered, see + // GOAL-FP-01-14). Capped: evicting entries degrades to the pre-fix + // duplicate visibility, never to a lost wake. + const deliveredWakeSummaries = new Map() // Seed the commented global dag.jsonc once per instance init — the // per-round DagConfig.load below stays a pure read so the spawn @@ -1211,42 +1222,60 @@ const serviceLayer = Layer.effect( // receives the node result and can act) but NOT rendered as a user // message in the TUI chat — DAG data surfaces via the sidebar panel // and Inspector, keeping the chat conversation clean. + // + // GOAL-FP-01-14: the transcript part is written BEFORE the + // durable mark. A mark failure (or a crash between the two) + // leaves the batch unreported and the retry would re-inject the + // SAME summary. When this session already had this exact summary + // written, skip the prompt and only re-mark — the write is + // idempotent in effect because an identical digest adds no + // information. A differing summary (new results committed + // between attempts) always prompts. + if (deliveredWakeSummaries.size > 1024) deliveredWakeSummaries.clear() const didDeliver = Option.getOrElse( yield* automation.use( wakeLease, - promptSvc.promptIfIdle({ - sessionID: SessionID.make(sessionID), - parts: [{ type: "text", text: summary, synthetic: true }], - }).pipe( - Effect.flatMap(Option.match({ - onNone: () => Effect.succeed(false), - onSome: () => - store.markWakeBatchReported(batch).pipe( - Effect.tap(() => - Effect.forEach( - batch.workflows.filter((workflow) => - isWorkflowTerminalStatus(workflow.status as never), - ), - (workflow) => - automation.unregister(SessionID.make(sessionID), { - kind: "dag", - id: workflow.id, - }), - { discard: true }, - ), + Effect.gen(function* () { + if (deliveredWakeSummaries.get(sessionID) !== summary) { + const delivered = yield* promptSvc.promptIfIdle({ + sessionID: SessionID.make(sessionID), + parts: [{ type: "text", text: summary, synthetic: true }], + }) + if (Option.isNone(delivered)) return false + // Record BEFORE the mark: the transcript part was + // already written (the prompt just succeeded), so the + // retry must skip the prompt even when the mark below + // fails again. + deliveredWakeSummaries.set(sessionID, summary) + } + yield* store.markWakeBatchReported(batch).pipe( + Effect.tap(() => + Effect.forEach( + batch.workflows.filter((workflow) => + isWorkflowTerminalStatus(workflow.status as never), ), - Effect.tap(() => - Effect.sync(() => { - plan.unresponsiveDagIDs.forEach((workflowID) => - deliveredUnresponsiveDagIDs.add(workflowID), - ) + (workflow) => + automation.unregister(SessionID.make(sessionID), { + kind: "dag", + id: workflow.id, }), - ), - Effect.as(true), + { discard: true }, ), - })), - Effect.catchCause(() => - Effect.logWarning("DAG wake delivery failed", { sessionID }).pipe(Effect.as(false)), + ), + Effect.tap(() => + Effect.sync(() => { + plan.unresponsiveDagIDs.forEach((workflowID) => + deliveredUnresponsiveDagIDs.add(workflowID), + ) + }), + ), + ) + return true + }).pipe( + Effect.catchCause((cause) => + Effect.logWarning("DAG wake delivery failed", { sessionID, cause: Cause.pretty(cause) }).pipe( + Effect.as(false), + ), ), ), ), diff --git a/packages/opencode/src/goal/goal.ts b/packages/opencode/src/goal/goal.ts index b3a0aadcd4..c7fcb0af81 100644 --- a/packages/opencode/src/goal/goal.ts +++ b/packages/opencode/src/goal/goal.ts @@ -60,7 +60,11 @@ export interface Interface { verdict: GoalState.Verdict, reason: string, parseFailed: boolean, - expected?: { readonly goalID: string; readonly revision: number }, + /** GOAL-FP-01-07: the pre-judge state identity is part of the contract — + * a judge result is only applied when the durable row still carries this + * goalID+revision pair. Required (not optional): an omitted expected would + * let a stale loop result mutate whatever goal replaced the judged one. */ + expected: { readonly goalID: string; readonly revision: number }, ) => Effect.Effect< | { state: GoalState.Info @@ -285,10 +289,8 @@ const serviceLayer = Layer.effect( const matchesExpected = ( state: GoalState.Info, - expected?: { readonly goalID: string; readonly revision: number }, - ) => - !expected || - ((state.goal_id ?? "legacy") === expected.goalID && (state.revision ?? 0) === expected.revision) + expected: { readonly goalID: string; readonly revision: number }, + ) => (state.goal_id ?? "legacy") === expected.goalID && (state.revision ?? 0) === expected.revision const deleteAndPublishDone = Effect.fnUntraced(function* (sessionID: SessionID, reason: string) { return yield* transition(sessionID, (state) => { @@ -376,9 +378,21 @@ const serviceLayer = Layer.effect( consecutive_parse_failures: GoalState.nni(0), subgoals: [], }) - const result = yield* transition(sessionID, () => ({ tag: "save", state, value: state })) - yield* automation.register(sessionID, { kind: "goal", id: result.goal_id ?? "legacy" }) - return result + // GOAL-FP-01-08: the overwrite must stay consistent with the lease. The + // previous id is captured from the SAME seam read that decides the + // overwrite, and unregistered before the new id is registered — a stale + // id left in the registration set would be returned by owner() and + // reject the new goal's claim (loop silently starved until /goal clear). + const result = yield* transition(sessionID, (previous) => ({ + tag: "save", + state, + value: { state, previousGoalID: previous?.goal_id ?? "legacy" }, + })) + if (result.previousGoalID !== (result.state.goal_id ?? "legacy")) { + yield* automation.unregister(sessionID, { kind: "goal", id: result.previousGoalID }) + } + yield* automation.register(sessionID, { kind: "goal", id: result.state.goal_id ?? "legacy" }) + return result.state }) const pause = Effect.fn("Goal.pause")(function* (sessionID: SessionID, reason: string) { @@ -530,7 +544,7 @@ const serviceLayer = Layer.effect( verdict: GoalState.Verdict, reason: string, parseFailed: boolean, - expected?: { readonly goalID: string; readonly revision: number }, + expected: { readonly goalID: string; readonly revision: number }, ) { return yield* transition(sessionID, (state) => { if (!state || state.status !== "active" || !matchesExpected(state, expected)) diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index 2306354bcf..b43ebd294c 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -314,11 +314,25 @@ const serviceLayer = Layer.effect( yield* automation.unregister(sessionID, goalOwner) evaluatedRevisions.delete(sessionID) if (verdict.verdict === "done") { + // GOAL-FP-01-15: the done transition has already committed when this + // prompt runs (durable state leads presentation — the row is gone + // and goal.updated(done)/goal.cleared are published), so a failure + // here loses only the transcript line, never the state. Never + // swallow it silently — log it so a lost confirmation is + // diagnosable. No retry: a retried prompt could re-inject a "done" + // line after the goal was re-created. yield* promptSvc.prompt({ sessionID, noReply: true, parts: [{ type: "text", text: updateResult.message }], - }).pipe(Effect.ignore) + }).pipe( + Effect.catchCause((cause) => + Effect.logWarning("goal done message delivery failed", { + sessionID, + cause: Cause.pretty(cause), + }), + ), + ) } else { // Auto-pause branch: updateAfterJudge paused the goal due to // judge-parse-failure or budget exhaustion (verdict.verdict is @@ -428,7 +442,14 @@ const serviceLayer = Layer.effect( } const errMsg = `continuation dispatch failed: ${Cause.pretty(cause)}` yield* Effect.logWarning("goal continuation dispatch failed", { error: Cause.pretty(cause) }) - yield* goal.pauseAndPublish(sessionID, errMsg).pipe(Effect.ignore) + // GOAL-FP-01-12: symmetric with every other pause site — the + // unregister must be part of the failure transition, not + // deferred to the trailing afterDispatch load (which a defect or + // a concurrent replacement can skip, leaking the registration + // until /goal clear). pauseGoal keeps the fiber-safe + // pauseAndPublish (goal.pause would clearFiber — us — + // mid-publish) and releases the lease registration inline. + yield* pauseGoal(sessionID, errMsg).pipe(Effect.ignore) yield* promptSvc.prompt({ sessionID, noReply: true, parts: [{ type: "text", text: `⏸ 目标已暂停 — ${errMsg}` }] }).pipe(Effect.ignore) return Option.none() }), diff --git a/packages/opencode/src/tool/goal.ts b/packages/opencode/src/tool/goal.ts index 8ad1243c67..55c3197c89 100644 --- a/packages/opencode/src/tool/goal.ts +++ b/packages/opencode/src/tool/goal.ts @@ -127,18 +127,30 @@ export const GoalTool = Tool.define( // could be missed in the "N turns" count shown to the user. const finalState = yield* goal.markDone(ctx.sessionID, params.reason.trim()) - const displayState = finalState ?? state - const completionMsg = `✓ 目标已达成（${displayState.turns_used}/${displayState.max_turns} 轮）：${displayState.goal}\nReason: ${params.reason.trim()}` + // GOAL-FP-01-09: markDone returns undefined when the transition did + // not happen (the goal was cleared or completed between the `load` + // above and the markDone transition). Presenting the pre-call state + // as completed would claim an achievement for a goal that no longer + // exists — report the no-op instead. + if (!finalState) { + return { + title: "goal no longer active", + output: + "Cannot complete goal: the goal is no longer active (it may have been cleared or completed concurrently). No state transition was applied.", + metadata: { goal: null }, + } + } + const completionMsg = `✓ 目标已达成（${finalState.turns_used}/${finalState.max_turns} 轮）：${finalState.goal}\nReason: ${params.reason.trim()}` return { - title: `goal completed (${displayState.turns_used}/${displayState.max_turns})`, + title: `goal completed (${finalState.turns_used}/${finalState.max_turns})`, output: completionMsg, metadata: { goal: { - text: displayState.goal, + text: finalState.goal, status: "done" as const, - turnsUsed: displayState.turns_used, - maxTurns: displayState.max_turns, - subgoals: displayState.subgoals ?? [], + turnsUsed: finalState.turns_used, + maxTurns: finalState.max_turns, + subgoals: finalState.subgoals ?? [], }, }, } diff --git a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts index 60fb088287..45d62f4080 100644 --- a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts +++ b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts @@ -103,17 +103,39 @@ function takeWithin(queue: Queue.Queue, message: string) { let judgeCalls = 0 let promptCalls: { noReply?: boolean; text: string }[] = [] let parentPromptCalls = 0 +let markReportCalls = 0 const reset = () => { judgeCalls = 0 promptCalls = [] parentPromptCalls = 0 + markReportCalls = 0 } -function goalWakeLayer(input: { childPrompts: Queue.Queue }) { +function goalWakeLayer(input: { childPrompts: Queue.Queue; failFirstMarkReport?: boolean }) { const database = Database.layerFromPath(":memory:") const events = EventV2.layer.pipe(Layer.provide(database)) const bridge = EventV2Bridge.layer.pipe(Layer.provide(events)) - const store = DagStore.layer.pipe(Layer.provide(database)) + const store = input.failFirstMarkReport + ? // GOAL-FP-01-14 harness: the real store with ONE injected failure on the + // first markWakeBatchReported call — the wake transcript part has + // already been written when that mark fails, and the retry must not + // re-inject the summary. + Layer.effect( + DagStore.Service, + Effect.gen(function* () { + const real = yield* DagStore.Service + return DagStore.Service.of({ + ...real, + markWakeBatchReported: (batch: DagStore.WakeBatch) => + Effect.gen(function* () { + markReportCalls += 1 + if (markReportCalls === 1) return yield* Effect.die("injected markWakeBatchReported failure") + return yield* real.markWakeBatchReported(batch) + }), + }) + }), + ).pipe(Layer.provide(DagStore.layer.pipe(Layer.provide(database)))) + : DagStore.layer.pipe(Layer.provide(database)) const status = SessionStatus.layer.pipe(Layer.provide(bridge)) const projector = DagProjector.layer.pipe( Layer.provide(events), @@ -263,6 +285,7 @@ function runGoalWakeTest( readonly database: Database.Interface readonly childPrompts: Queue.Queue }) => Effect.Effect, + layerInput: { failFirstMarkReport?: boolean } = {}, ) { return Effect.gen(function* () { const childPrompts = yield* Queue.unbounded() @@ -297,7 +320,7 @@ function runGoalWakeTest( .pipe(Effect.orDie) return yield* test({ dag, loop, goalLoop, store, goal, automation, database, childPrompts }) }).pipe( - Effect.provide(goalWakeLayer({ childPrompts })), + Effect.provide(goalWakeLayer({ childPrompts, ...layerInput })), Effect.provideService(InstanceRef, { directory: process.cwd(), worktree: process.cwd(), @@ -386,3 +409,62 @@ describe("DagLoop final wake delivery re-triggers the goal (GOAL-FP-01-02)", () ) }) }) + +// GOAL-FP-01-14: the wake transcript part is written BEFORE the durable +// markWakeBatchReported, so a mark failure (or a crash between the two) leaves +// the batch unreported — and the retry re-injects the SAME summary into the +// transcript (duplicate visibility). The delivery must dedupe on retry: when +// the summary was already written, the retry only re-marks, it must not +// re-prompt. The retry here is armed by the wake turn's own idle event (the +// prompt mock mirrors the real runner's end-of-turn idle). +describe("DagLoop wake delivery — a mark failure retry must not re-inject the summary (GOAL-FP-01-14)", () => { + it("the wake summary reaches the transcript exactly once when the first mark fails", async () => { + await Effect.runPromise( + runGoalWakeTest( + ({ dag, loop, store, childPrompts }) => + Effect.gen(function* () { + reset() + yield* loop.init() + yield* Effect.yieldNow + + const dagID = yield* dag.create({ + projectID: PROJECT_ID, + sessionID: PARENT_SESSION, + title: "mark failure retry", + config: { name: "mark-fail", nodes: [node("implement")] }, + }) + + const child = yield* takeWithin(childPrompts, "implement did not start") + yield* Deferred.succeed(child.release, "done") + yield* pollWithTimeout( + store.getWorkflow(dagID).pipe( + Effect.map((workflow) => (workflow?.status === "completed" ? workflow : undefined)), + ), + "workflow did not complete", + ) + + // First delivery attempt writes the transcript part, then the + // injected mark failure leaves the batch unreported. The retry + // (armed by the wake turn's own idle event) must re-mark only. + yield* pollWithTimeout( + Effect.sync(() => (markReportCalls >= 2 ? true : undefined)), + "wake delivery never retried after the injected mark failure", + "5 seconds", + ) + yield* pollWithTimeout( + store.getWorkflow(dagID).pipe( + Effect.map((workflow) => (workflow?.wakeReported ? workflow : undefined)), + ), + "wake was never reported", + ) + + // Pre-fix: the retry re-prompted the identical summary — the + // transcript would show the wake digest twice. + const wakeSummaries = promptCalls.filter((p) => p.text.includes("[DAG Workflow completed]")) + expect(wakeSummaries.length).toBe(1) + }), + { failFirstMarkReport: true }, + ), + ) + }) +}) diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index 0b24da1b51..ec5d68fc15 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -7,6 +7,7 @@ import { EventV2Bridge } from "@/event-v2-bridge" import { SessionStatus } from "@/session/status" import { Session } from "@/session/session" import { SessionPrompt } from "@/session/prompt" +import { SessionRunState } from "@/session/run-state" import { Provider } from "@/provider/provider" import { SessionID } from "@/session/schema" import { SessionAutomationLease } from "@/session/automation-lease" @@ -576,6 +577,266 @@ describe("GoalLoop — continuation dispatch failure → recoverable pause (D1)" ) }) +// ── GOAL-FP-01-12: dispatch-failure unregister must not depend on the +// trailing load ───────────────────────────────────────────────────────── +// +// The failure path pauses the goal and the loop releases the lease +// registration afterwards. That release must be SYMMETRIC with the pause +// (pauseAndPublish + unregister in the same handler) — it must not depend on +// the afterDispatch load that follows the dispatch attempt. To make the +// dependency observable, the failure path's visible-pause prompt parks on a +// gate; the test body then drops the goal_state table and releases the gate, +// so the trailing load dies with a defect: only an inline unregister can +// release the lease. +describe("GoalLoop — dispatch failure releases the lease without the trailing load (GOAL-FP-01-12)", () => { + let judgeCalls = 0 + let promptGate = Deferred.makeUnsafe() + const reset = () => { + judgeCalls = 0 + promptGate = Deferred.makeUnsafe() + } + + const sessionMock = Layer.mock(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + }) + // Continuation dispatch fails (promptIfIdle). The failure handler's + // visible-pause prompt parks on a gate — the sync point where the test body + // drops the goal_state table — so afterDispatch's goal.load defects: the + // lease release must NOT depend on that trailing load. The die after the + // gate is swallowed by the handler's Effect.ignore. + const promptFailAndParkMock = Layer.mock(SessionPrompt.Service, { + prompt: () => + Effect.gen(function* () { + yield* Deferred.await(promptGate) + return yield* Effect.die("failure-path prompt is the last stop before the trailing load") + }), + promptIfIdle: () => Effect.die(new Error("continuation provider down")), + }) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => + Effect.sync(() => { + judgeCalls += 1 + return JSON.stringify({ done: false, reason: "more steps needed" }) + }), + }), + ) + const failLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptFailAndParkMock), + Layer.provide(Layer.mock(Provider.Service, {})), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + Layer.provideMerge(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + Layer.provideMerge(Database.defaultLayer), + ) + const it = testEffect(failLayer) + + it.instance("the lease registration is gone after the failure pause even when the post-dispatch load dies", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const automation = yield* SessionAutomationLease.Service + const { db } = yield* Database.Service + const events = yield* EventV2Bridge.Service + const seen = yield* captureEvents(events) + yield* loop.init() + const sid = SessionID.descending() + const goalState = yield* goal.set(sid, "ship the feature", 10) + const goalOwner = { kind: "goal" as const, id: goalState.goal_id ?? "legacy" } + yield* Effect.yieldNow + + yield* events.publish(SessionStatus.Event.Status, { sessionID: sid, status: { type: "idle" } }) + // The pause committed and published BEFORE the handler reaches the + // parked prompt — the parked handler is the deterministic sync point. + yield* pollWithTimeout( + Effect.sync(() => + seen.some((e) => e.type === GoalEvent.Updated.type && e.status === "paused") ? true : undefined, + ), + "failure path never paused the goal", + "5 seconds", + ) + // Kill the trailing load: the handler is parked on the prompt gate, so + // dropping the table here guarantees afterDispatch's goal.load defects. + yield* db.run("DROP TABLE goal_state") + yield* Deferred.succeed(promptGate, undefined) + // Give the (defecting) trailing load a scheduler turn to run. + yield* Effect.sleep("100 millis") + expect(judgeCalls).toBeGreaterThanOrEqual(1) + + // The registration must already be released — pre-fix it leaks until + // /goal clear because the trailing load (the only unregister) died. + expect(Option.isNone(yield* automation.claim(sid, goalOwner))).toBe(true) + }), + ) +}) + +// ── GOAL-FP-01-13: real admission seam for the goal continuation ─────── +// +// Every other GoalLoop harness mocks SessionPrompt with a flat +// `promptIfIdle: () => Option.some(...)` — the real admission gate +// (SessionRunState.startIfIdle: Runner state machine, busy flip, onIdle → +// real SessionStatus.set → real idle event) is never exercised, so the +// lease-claim + promptIfIdle atomicity has no regression coverage. +// +// The REAL SessionPrompt layer pulls in the whole app (Permission, MCP, LSP, +// ToolRegistry, Config, Plugin, …) — disproportionate for this suite. The +// tightest feasible real seam: the REAL SessionRunState.defaultLayer, with a +// SessionPrompt mock that delegates promptIfIdle admission to the real gate +// exactly like the real implementation's core. Remains mocked (reported): +// SessionPrompt.admitPrompt (transcript write) + runLoop (provider turn), +// Session.messages, Provider, judge LLM. +describe("GoalLoop — real SessionRunState admission seam (GOAL-FP-01-13)", () => { + let judgeCalls = 0 + let admissions = 0 + let rejectedAdmissions = 0 + let firstAdmissionParked = false + let admissionRelease = Deferred.makeUnsafe() + const reset = () => { + judgeCalls = 0 + admissions = 0 + rejectedAdmissions = 0 + firstAdmissionParked = false + admissionRelease = Deferred.makeUnsafe() + } + + const sessionMock = Layer.mock(Session.Service, { + messages: () => Effect.succeed([mkAssistant()]), + }) + // Effect.fn-wrapped like the wake-integration harness's `deliver` mock. The + // real SessionRunState is resolved via serviceOption (R-free, same pattern + // the harness uses for the bridge) so the implementation stays assignable to + // the SessionPrompt Interface while still hitting the REAL admission gate. + // + // The scripted "run" completes with an interrupt (typed never, no cast): + // the Runner's finishRun still emits the real onIdle (status.set(idle) → + // real event) before completing the handle, so the loop re-drive chain is + // real. The mock returns Option.none() even on admission — afterIdle + // discards the promptIfIdle result (only its failure matters), and + // admission is observable through the real status flip and the counters. + const promptIfIdle = Effect.fn("test.goalSeam.SessionPrompt.promptIfIdle")(function* ( + input: SessionPrompt.PromptInput, + ) { + const runState = yield* Effect.serviceOption(SessionRunState.Service) + if (Option.isNone(runState)) return yield* Effect.die("SessionRunState not provided to the seam mock") + const admitted = yield* runState.value.startIfIdle( + input.sessionID, + Effect.die("onInterrupt is not exercised in this scenario"), + Effect.gen(function* () { + admissions += 1 + if (admissions === 1) { + firstAdmissionParked = true + yield* Deferred.await(admissionRelease) + } + return yield* Effect.interrupt + }), + ) + if (Option.isNone(admitted)) { + rejectedAdmissions += 1 + return Option.none() + } + // Await the run's completion (the Cancelled exit is captured) so the + // mock's promptIfIdle stays faithful to the real one's waiting behavior. + yield* admitted.value.pipe(Effect.exit, Effect.asVoid) + return Option.none() + }) + const promptMock = Layer.mock(SessionPrompt.Service, { + prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), + promptIfIdle, + }) + const judgeMock = Layer.succeed( + GoalLoopJudgeLLM, + GoalLoopJudgeLLM.of({ + call: () => + Effect.sync(() => { + judgeCalls += 1 + // Calls 1-2 continue (drive admissions 1-2); call 3 ends the goal. + return judgeCalls <= 2 + ? JSON.stringify({ done: false, reason: "more steps needed" }) + : JSON.stringify({ done: true, reason: "feature shipped" }) + }), + }), + ) + const seamLayer = GoalLoop.layer.pipe( + Layer.provide(sessionMock), + Layer.provide(promptMock), + Layer.provide(Layer.mock(Provider.Service, {})), + Layer.provide(judgeMock), + Layer.provideMerge(Goal.defaultLayer), + Layer.provideMerge(SessionStatus.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + Layer.provideMerge(SessionRunState.defaultLayer), + ) + const it = testEffect(seamLayer) + + it.instance("a continuation admitted by the real gate flips the session busy, blocks concurrent admission, and the real idle re-drives the loop to done", () => + Effect.gen(function* () { + reset() + const loop = yield* GoalLoop.Service + const goal = yield* Goal.Service + const status = yield* SessionStatus.Service + const runState = yield* SessionRunState.Service + const events = yield* EventV2Bridge.Service + const seen = yield* captureEvents(events) + yield* loop.init() + const sid = SessionID.descending() + yield* goal.set(sid, "ship the feature", 10) + yield* Effect.yieldNow + + // Turn 1: idle → judge(continue) → continuation admitted through the + // REAL admission gate; the scripted run parks and the session is BUSY. + yield* events.publish(SessionStatus.Event.Status, { sessionID: sid, status: { type: "idle" } }) + yield* pollWithTimeout( + Effect.sync(() => (firstAdmissionParked ? true : undefined)), + "the continuation was never admitted through the real gate", + "5 seconds", + ) + // Real seam proof: admission itself flipped the session status to busy. + expect((yield* status.get(sid)).type).toBe("busy") + // The real gate rejects concurrent admission while the goal run holds it + // (the probe work is Effect.never — a rejection never forks it). + const probe = yield* runState.startIfIdle( + sid, + Effect.die("probe onInterrupt is not exercised"), + Effect.never, + ) + expect(Option.isNone(probe)).toBe(true) + expect(admissions).toBe(1) + + // Release the run: the REAL Runner onIdle publishes the REAL idle + // status event, which re-drives GoalLoop with NO manual idle publish — + // the next continuation and the judge(done) terminal transition both + // ride the real chain. + yield* Deferred.succeed(admissionRelease, undefined) + yield* pollWithTimeout( + Effect.sync(() => (admissions >= 2 ? true : undefined)), + "the real onIdle event never re-drove the goal loop", + "5 seconds", + ) + expect(rejectedAdmissions).toBe(0) + yield* pollWithTimeout( + Effect.sync(() => (judgeCalls >= 3 ? true : undefined)), + "the loop never reached the terminal judge call", + "5 seconds", + ) + + // Terminal contract through the real chain: exactly one done update, + // the cleared event, and the row is gone. + const doneUpdates = seen.filter((e) => e.type === GoalEvent.Updated.type && e.status === "done") + expect(doneUpdates.length).toBe(1) + expect(seen.some((e) => e.type === GoalEvent.Cleared.type)).toBe(true) + expect(yield* goal.load(sid)).toBeUndefined() + expect(admissions).toBe(2) + expect(judgeCalls).toBe(3) + }), + ) +}) + // ── Stall-prevention branch coverage ─────────────────────────────────── // // afterIdle has four historically-silent stall paths that now surface as diff --git a/packages/opencode/test/goal/goal.test.ts b/packages/opencode/test/goal/goal.test.ts index 739f08e13b..ef65f9babc 100644 --- a/packages/opencode/test/goal/goal.test.ts +++ b/packages/opencode/test/goal/goal.test.ts @@ -1,10 +1,11 @@ import { describe, expect } from "bun:test" -import { Deferred, Effect, Fiber, Layer } from "effect" +import { Deferred, Effect, Fiber, Layer, Option } from "effect" import { Goal } from "@/goal/goal" import { GoalEvent } from "@/goal/events" import { GoalPrompts } from "@/goal/prompts" import { EventV2Bridge } from "@/event-v2-bridge" import { SessionStatus } from "@/session/status" +import { SessionAutomationLease } from "@/session/automation-lease" import { Database } from "@opencode-ai/core/database/database" import { SessionID } from "@/session/schema" import { pollWithTimeout, testEffect } from "../lib/effect" @@ -99,10 +100,13 @@ describe("Goal.updateAfterJudge — continue branch", () => { const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "build feature X", 10) + const state = yield* goal.set(sessionID, "build feature X", 10) seen.length = 0 // drop the set() goal.updated(active) - const result = yield* goal.updateAfterJudge(sessionID, "continue", "more steps", false) + const result = yield* goal.updateAfterJudge(sessionID, "continue", "more steps", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) expect(result?.shouldContinue).toBe(true) const loaded = yield* goal.load(sessionID) @@ -128,7 +132,10 @@ describe("Goal.updateAfterJudge — atomic done transition", () => { const before = yield* goal.load(sessionID) const n = Number(before?.turns_used) - const result = yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) + const result = yield* goal.updateAfterJudge(sessionID, "done", "delivered", false, { + goalID: before?.goal_id ?? "legacy", + revision: before?.revision ?? 0, + }) expect(result?.state.status).toBe("done") expect(Number(result?.state.turns_used)).toBe(n) @@ -148,10 +155,13 @@ describe("Goal.updateAfterJudge — done branch (terminal event contract)", () = const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "ship feature X", 10) + const state = yield* goal.set(sessionID, "ship feature X", 10) seen.length = 0 - yield* goal.updateAfterJudge(sessionID, "done", "delivered", false) + yield* goal.updateAfterJudge(sessionID, "done", "delivered", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) const types = seen.map((e) => e.type) expect(types).toEqual([GoalEvent.Updated.type, GoalEvent.Cleared.type]) @@ -174,7 +184,7 @@ describe("Goal.updateAfterJudge — blocked branch", () => { const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "deploy production", 10) + const state = yield* goal.set(sessionID, "deploy production", 10) seen.length = 0 const result = yield* goal.updateAfterJudge( @@ -182,6 +192,7 @@ describe("Goal.updateAfterJudge — blocked branch", () => { "blocked", "missing production credentials", false, + { goalID: state.goal_id ?? "legacy", revision: state.revision ?? 0 }, ) expect(result?.state.status).toBe("paused") @@ -197,12 +208,15 @@ describe("Goal transition authority — stale loop decisions", () => { Effect.gen(function* () { const goal = yield* Goal.Service const sessionID = SessionID.descending() - yield* goal.set(sessionID, "ship feature X", 10) + const state = yield* goal.set(sessionID, "ship feature X", 10) yield* Effect.all( [ goal.pause(sessionID, "user-paused"), - goal.updateAfterJudge(sessionID, "continue", "racing judge result", false), + goal.updateAfterJudge(sessionID, "continue", "racing judge result", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }), ], { concurrency: 2 }, ) @@ -215,12 +229,15 @@ describe("Goal transition authority — stale loop decisions", () => { Effect.gen(function* () { const goal = yield* Goal.Service const sessionID = SessionID.descending() - yield* goal.set(sessionID, "ship feature X", 10) + const state = yield* goal.set(sessionID, "ship feature X", 10) yield* Effect.all( [ goal.clear(sessionID), - goal.updateAfterJudge(sessionID, "continue", "racing judge result", false), + goal.updateAfterJudge(sessionID, "continue", "racing judge result", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }), ], { concurrency: 2 }, ) @@ -309,9 +326,12 @@ describe("Goal.markDone — turns_used is budget-neutral", () => { const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "ship feature X", 10) + const state = yield* goal.set(sessionID, "ship feature X", 10) // Simulate one continuation dispatch (the budget-consuming event). - yield* goal.updateAfterJudge(sessionID, "continue", "more steps", false) + yield* goal.updateAfterJudge(sessionID, "continue", "more steps", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) const continued = yield* goal.load(sessionID) seen.length = 0 @@ -324,6 +344,39 @@ describe("Goal.markDone — turns_used is budget-neutral", () => { ) }) +// --------------------------------------------------------------------------- +// GOAL-FP-01-08: Goal.set must not leave the previous goal's id in the lease. +// The lease's owner() returns the FIRST id in the registration set, so a stale +// entry makes the new goal's claim be rejected (selected.id !== request.id) +// and the loop silently starves. Replacing a goal must unregister the previous +// id atomically with the new registration. +// --------------------------------------------------------------------------- + +const setLeaseLayer = Goal.layer.pipe( + Layer.provide(SessionStatus.defaultLayer), + Layer.provideMerge(SessionAutomationLease.defaultLayer), + Layer.provideMerge(Database.defaultLayer), + Layer.provideMerge(EventV2Bridge.defaultLayer), +) + +describe("Goal.set — replacing a goal unregisters the previous lease id (GOAL-FP-01-08)", () => { + testEffect(setLeaseLayer).live("set on an existing goal leaves exactly the new goal id claimable", () => + Effect.gen(function* () { + const goal = yield* Goal.Service + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + + const first = yield* goal.set(sessionID, "goal A", 10) + const second = yield* goal.set(sessionID, "goal B", 10) + + // Pre-fix: the lease still holds BOTH ids (register never removes the + // previous one), so the stale id is claimable and the fresh one is not. + expect(Option.isNone(yield* lease.claim(sessionID, { kind: "goal", id: first.goal_id ?? "legacy" }))).toBe(true) + expect(Option.isSome(yield* lease.claim(sessionID, { kind: "goal", id: second.goal_id ?? "legacy" }))).toBe(true) + }), + ) +}) + // --------------------------------------------------------------------------- // §5 — Expand state-machine coverage (lock the contract). All PASS against // current post-bug-fix behavior; they exist to catch regressions when §6-§10 @@ -406,9 +459,12 @@ describe("Goal.resume — preserves turns_used (no fresh budget), resets parse f const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "build feature X", 10) + const state = yield* goal.set(sessionID, "build feature X", 10) // One continuation dispatch with a parse failure → turns_used=1, cpf=1 - yield* goal.updateAfterJudge(sessionID, "continue", "more steps", true) + yield* goal.updateAfterJudge(sessionID, "continue", "more steps", true, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) const beforePause = yield* goal.load(sessionID) expect(Number(beforePause?.turns_used)).toBe(1) expect(Number(beforePause?.consecutive_parse_failures)).toBe(1) @@ -445,9 +501,15 @@ describe("Goal.resume — preserves turns_used (no fresh budget), resets parse f const sessionID = SessionID.descending() // max_turns=2: a second continue verdict trips the budget-pause branch - yield* goal.set(sessionID, "build feature X", 2) - yield* goal.updateAfterJudge(sessionID, "continue", "step 1", false) // turns_used 1 - yield* goal.updateAfterJudge(sessionID, "continue", "step 2", false) // turns_used 2 >= max → paused + const state = yield* goal.set(sessionID, "build feature X", 2) + const step1 = yield* goal.updateAfterJudge(sessionID, "continue", "step 1", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) // turns_used 1 + yield* goal.updateAfterJudge(sessionID, "continue", "step 2", false, { + goalID: step1?.state.goal_id ?? "legacy", + revision: step1?.state.revision ?? 0, + }) // turns_used 2 >= max → paused const paused = yield* goal.load(sessionID) expect(paused?.status).toBe("paused") @@ -587,12 +649,18 @@ describe("Goal.updateAfterJudge — transport failures trigger auto-pause (D5)", const seen = yield* captureEvents(events) const sessionID = SessionID.descending() - yield* goal.set(sessionID, "build feature X", 10) + const state = yield* goal.set(sessionID, "build feature X", 10) seen.length = 0 // Two transport failures — still active, counter climbing 1 → 2 - const r1 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 1", true) - const r2 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 2", true) + const r1 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 1", true, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) + const r2 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 2", true, { + goalID: r1?.state.goal_id ?? "legacy", + revision: r1?.state.revision ?? 0, + }) expect(r1?.shouldContinue).toBe(true) expect(r2?.shouldContinue).toBe(true) @@ -601,7 +669,10 @@ describe("Goal.updateAfterJudge — transport failures trigger auto-pause (D5)", expect(Number(midState?.consecutive_parse_failures)).toBe(2) // Third transport failure — counter reaches 3 → auto-pause - const r3 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 3", true) + const r3 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error 3", true, { + goalID: r2?.state.goal_id ?? "legacy", + revision: r2?.state.revision ?? 0, + }) expect(r3?.shouldContinue).toBe(false) const finalState = yield* goal.load(sessionID) @@ -625,22 +696,31 @@ describe("Goal.updateAfterJudge — transport failures trigger auto-pause (D5)", const goal = yield* Goal.Service const sessionID = SessionID.descending() - yield* goal.set(sessionID, "build feature X", 10) + const seeded = yield* goal.set(sessionID, "build feature X", 10) // transport-fail (parseFailed: true) → counter 1 - yield* goal.updateAfterJudge(sessionID, "continue", "transport error", true) + const first = yield* goal.updateAfterJudge(sessionID, "continue", "transport error", true, { + goalID: seeded.goal_id ?? "legacy", + revision: seeded.revision ?? 0, + }) let state = yield* goal.load(sessionID) expect(Number(state?.consecutive_parse_failures)).toBe(1) expect(state?.status).toBe("active") // parse-fail (parseFailed: true) → counter 2 - yield* goal.updateAfterJudge(sessionID, "continue", "无法解析", true) + yield* goal.updateAfterJudge(sessionID, "continue", "无法解析", true, { + goalID: first?.state.goal_id ?? "legacy", + revision: first?.state.revision ?? 0, + }) state = yield* goal.load(sessionID) expect(Number(state?.consecutive_parse_failures)).toBe(2) expect(state?.status).toBe("active") // transport-fail (parseFailed: true) → counter 3 → PAUSE - const r3 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error", true) + const r3 = yield* goal.updateAfterJudge(sessionID, "continue", "transport error", true, { + goalID: state?.goal_id ?? "legacy", + revision: state?.revision ?? 0, + }) expect(r3?.shouldContinue).toBe(false) state = yield* goal.load(sessionID) @@ -877,8 +957,11 @@ describe("Goal.dispatch resume — busy guard (D5)", () => { const goal = yield* Goal.Service const sessionID = SessionID.descending() // max_turns 1 → one continue exhausts the budget and auto-pauses. - yield* goal.set(sessionID, "ship feature X", 1) - yield* goal.updateAfterJudge(sessionID, "continue", "more", false) + const state = yield* goal.set(sessionID, "ship feature X", 1) + yield* goal.updateAfterJudge(sessionID, "continue", "more", false, { + goalID: state.goal_id ?? "legacy", + revision: state.revision ?? 0, + }) const paused = yield* goal.load(sessionID) expect(paused?.status).toBe("paused") diff --git a/packages/opencode/test/tool/goal-tool.test.ts b/packages/opencode/test/tool/goal-tool.test.ts index 3ba125b036..577977417e 100644 --- a/packages/opencode/test/tool/goal-tool.test.ts +++ b/packages/opencode/test/tool/goal-tool.test.ts @@ -120,6 +120,28 @@ describe("tool.goal — service resolution phase", () => { }), ) + // GOAL-FP-01-09: markDone re-loads the current row and can no-op when the + // goal was cleared or completed between the tool's `load` and the transition. + // The tool must NOT present that no-op as an achievement — the stale + // "✓ 目标已达成" line would claim a transition that never happened. + it.instance("complete does not claim achievement when markDone did not transition (GOAL-FP-01-09)", () => + Effect.gen(function* () { + const info = yield* GoalTool + const tool = yield* info.init() + const goalLayer = Layer.mock(Goal.Service, { + load: () => Effect.succeed(activeGoal), + markDone: () => Effect.succeed(undefined), + }) + + const result = yield* tool.execute({ action: "complete", reason: "docs read" }, ctx()).pipe( + Effect.provide(goalLayer), + ) + + expect(result.output).not.toContain("目标已达成") + expect(result.output).toContain("Cannot complete goal") + }), + ) + it.instance("status degrades gracefully when Goal.Service is absent (headless)", () => Effect.gen(function* () { const info = yield* GoalTool From 3c7ae2833bf0810d50dbc356f4f10865509b9249 Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 10:20:03 +0800 Subject: [PATCH 33/34] =?UTF-8?q?fix(goal):=20harden=20the=20startup-scan?= =?UTF-8?q?=20seam=20=E2=80=94=20session.directory=20index,=20defensive=20?= =?UTF-8?q?scan=20ref,=20lease=20SessionStatus=20requirement?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Standards deep review follow-ups on the GOAL-FP-01-04 startup scan and the GOAL-FP-01-02 dag-release re-trigger (S-1..S-3, all P2). S-1: missing session.directory index. The boot scan joins goal_state → session filtered on session.directory, so every instance boot linearly scanned the whole channel-global session table. Added the inline index("session_directory_idx").on(table.directory) to the session table definition and generated the migration + snapshot via the sanctioned generator (packages/core/script/migration.ts): new migration file 20260813020344_bored_skaar, schema.json / schema.gen.ts / migration.gen.ts regenerated; `bun run script/migration.ts --check` is clean. The regeneration also reconciled pre-existing snapshot drift: the hand-written 20260811060000_goal_outcome migration had never been baked into schema.json/schema.gen (the check was already red at HEAD); the generator's duplicate of it was discarded so existing installs never re-run the DDL. S-2: scanDirectoryRef fragile-by-construction. The unset-ref invariant lives only in the init→builder call order. The builder now reads the ref defensively: if it is unset at build time, log an ERROR and skip the scan (loud no-op) instead of querying with an empty directory that silently matches no session. The alternative (threading the directory through the ScopedCache key or InstanceState.make input) would require modifying shared instance-state.ts beyond the listed files; the defensive read is the accepted fallback. Not covered by a test: the unset path is unreachable through the public seam — init sets the ref before the only call site of InstanceState.get — so no injectable unset-ref path exists without exposing internals. S-3: serviceOption(SessionStatus) unsanctioned in the lease. The dag-release re-trigger silently degraded to a dropped re-trigger when SessionStatus was absent. SessionStatus.Service is now a HARD requirement of the lease layer (Layer.sync → Layer.effect; the serviceOption/None branch is gone); defaultLayer self-provides SessionStatus.defaultLayer, and the node lists SessionStatus.node (added to Session's node list — the documented "missing wire fails silently" invariant). All production and test consumers already build via defaultLayer, so only the standalone lease test needed wiring; it now also gains a re-trigger test asserting the blocked goal claim is re-driven through the real SessionStatus idle publish (typed via the event definition's data schema, no unsafe assertions). Verified: bun test test/goal test/dag test/session/automation-lease.test.ts (579 pass, 0 fail) and bun test test/session (408 pass, 0 fail), bun typecheck clean, bun lint 4852 warnings (≤ 4852). Co-Authored-By: Claude --- packages/core/schema.json | 89 ++++++++++++++++++- packages/core/src/database/migration.gen.ts | 1 + .../migration/20260813020344_bored_skaar.ts | 11 +++ packages/core/src/database/schema.gen.ts | 19 ++-- packages/core/src/session/sql.ts | 3 + packages/opencode/src/goal/loop.ts | 14 +++ .../opencode/src/session/automation-lease.ts | 38 ++++---- packages/opencode/src/session/session.ts | 5 ++ .../test/session/automation-lease.test.ts | 46 +++++++++- 9 files changed, 195 insertions(+), 31 deletions(-) create mode 100644 packages/core/src/database/migration/20260813020344_bored_skaar.ts diff --git a/packages/core/schema.json b/packages/core/schema.json index 126f187051..cd735b190a 100644 --- a/packages/core/schema.json +++ b/packages/core/schema.json @@ -1,9 +1,9 @@ { "version": "7", "dialect": "sqlite", - "id": "abdf5c23-7f2e-4ca3-b08b-012db47b5aa5", + "id": "7e8e00e9-7bbb-443e-996b-f646ec030c2b", "prevIds": [ - "442cdbd5-86a8-41a9-86d6-5361dbac90e0" + "cce2163c-da01-4239-86fa-776d48a58d89" ], "ddl": [ { @@ -50,6 +50,10 @@ "name": "event", "entityType": "tables" }, + { + "name": "goal_outcome", + "entityType": "tables" + }, { "name": "goal_state", "entityType": "tables" @@ -1018,6 +1022,46 @@ "entityType": "columns", "table": "event" }, + { + "type": "text", + "notNull": false, + "autoincrement": false, + "default": null, + "generated": null, + "name": "goal_id", + "entityType": "columns", + "table": "goal_outcome" + }, + { + "type": "text", + "notNull": true, + "autoincrement": false, + "default": null, + "generated": null, + "name": "session_id", + "entityType": "columns", + "table": "goal_outcome" + }, + { + "type": "text", + "notNull": true, + "autoincrement": false, + "default": null, + "generated": null, + "name": "payload", + "entityType": "columns", + "table": "goal_outcome" + }, + { + "type": "integer", + "notNull": true, + "autoincrement": false, + "default": null, + "generated": null, + "name": "completed_at", + "entityType": "columns", + "table": "goal_outcome" + }, { "type": "text", "notNull": false, @@ -2364,6 +2408,15 @@ "table": "event", "entityType": "pks" }, + { + "columns": [ + "goal_id" + ], + "nameExplicit": false, + "name": "goal_outcome_pk", + "table": "goal_outcome", + "entityType": "pks" + }, { "columns": [ "session_id" @@ -2640,6 +2693,24 @@ "entityType": "indexes", "table": "event" }, + { + "columns": [ + { + "value": "session_id", + "isExpression": false + }, + { + "value": "completed_at", + "isExpression": false + } + ], + "isUnique": false, + "where": null, + "origin": "manual", + "name": "goal_outcome_session_completed_idx", + "entityType": "indexes", + "table": "goal_outcome" + }, { "columns": [ { @@ -2910,6 +2981,20 @@ "entityType": "indexes", "table": "session" }, + { + "columns": [ + { + "value": "directory", + "isExpression": false + } + ], + "isUnique": false, + "where": null, + "origin": "manual", + "name": "session_directory_idx", + "entityType": "indexes", + "table": "session" + }, { "columns": [ { diff --git a/packages/core/src/database/migration.gen.ts b/packages/core/src/database/migration.gen.ts index aaf56d9868..ddffdb838b 100644 --- a/packages/core/src/database/migration.gen.ts +++ b/packages/core/src/database/migration.gen.ts @@ -52,5 +52,6 @@ export const migrations = ( import("./migration/20260805094941_workflow_node_timeout_extensions"), import("./migration/20260805094942_workflow_node_escalation_pending"), import("./migration/20260811060000_goal_outcome"), + import("./migration/20260813020344_bored_skaar"), ]) ).map((module) => module.default) satisfies DatabaseMigration.Migration[] diff --git a/packages/core/src/database/migration/20260813020344_bored_skaar.ts b/packages/core/src/database/migration/20260813020344_bored_skaar.ts new file mode 100644 index 0000000000..a20fb7ab1b --- /dev/null +++ b/packages/core/src/database/migration/20260813020344_bored_skaar.ts @@ -0,0 +1,11 @@ +import { Effect } from "effect" +import type { DatabaseMigration } from "../migration" + +export default { + id: "20260813020344_bored_skaar", + up(tx) { + return Effect.gen(function* () { + yield* tx.run(`CREATE INDEX \`session_directory_idx\` ON \`session\` (\`directory\`);`) + }) + }, +} satisfies DatabaseMigration.Migration diff --git a/packages/core/src/database/schema.gen.ts b/packages/core/src/database/schema.gen.ts index 224a2f04e8..8cc88289be 100644 --- a/packages/core/src/database/schema.gen.ts +++ b/packages/core/src/database/schema.gen.ts @@ -149,13 +149,6 @@ export default { CONSTRAINT \`fk_event_aggregate_id_event_sequence_aggregate_id_fk\` FOREIGN KEY (\`aggregate_id\`) REFERENCES \`event_sequence\`(\`aggregate_id\`) ON DELETE CASCADE ); `) - yield* tx.run(` - CREATE TABLE \`goal_state\` ( - \`session_id\` text PRIMARY KEY, - \`payload\` text NOT NULL, - \`updated_at\` integer NOT NULL - ); - `) yield* tx.run(` CREATE TABLE \`goal_outcome\` ( \`goal_id\` text PRIMARY KEY, @@ -164,6 +157,13 @@ export default { \`completed_at\` integer NOT NULL ); `) + yield* tx.run(` + CREATE TABLE \`goal_state\` ( + \`session_id\` text PRIMARY KEY, + \`payload\` text NOT NULL, + \`updated_at\` integer NOT NULL + ); + `) yield* tx.run(` CREATE TABLE \`permission\` ( \`id\` text PRIMARY KEY, @@ -331,8 +331,10 @@ export default { ) yield* tx.run(`CREATE UNIQUE INDEX \`event_aggregate_seq_idx\` ON \`event\` (\`aggregate_id\`,\`seq\`);`) yield* tx.run(`CREATE INDEX \`event_aggregate_type_seq_idx\` ON \`event\` (\`aggregate_id\`,\`type\`,\`seq\`);`) + yield* tx.run( + `CREATE INDEX \`goal_outcome_session_completed_idx\` ON \`goal_outcome\` (\`session_id\`,\`completed_at\`);`, + ) yield* tx.run(`CREATE INDEX \`goal_state_updated_at_idx\` ON \`goal_state\` (\`updated_at\`);`) - yield* tx.run(`CREATE INDEX \`goal_outcome_session_completed_idx\` ON \`goal_outcome\` (\`session_id\`, \`completed_at\`);`) yield* tx.run( `CREATE UNIQUE INDEX \`permission_project_action_resource_idx\` ON \`permission\` (\`project_id\`,\`action\`,\`resource\`);`, ) @@ -363,6 +365,7 @@ export default { yield* tx.run(`CREATE INDEX \`session_project_idx\` ON \`session\` (\`project_id\`);`) yield* tx.run(`CREATE INDEX \`session_workspace_idx\` ON \`session\` (\`workspace_id\`);`) yield* tx.run(`CREATE INDEX \`session_parent_idx\` ON \`session\` (\`parent_id\`);`) + yield* tx.run(`CREATE INDEX \`session_directory_idx\` ON \`session\` (\`directory\`);`) yield* tx.run(`CREATE INDEX \`todo_session_idx\` ON \`todo\` (\`session_id\`);`) }) }, diff --git a/packages/core/src/session/sql.ts b/packages/core/src/session/sql.ts index 264a1d2cca..a7ce8df496 100644 --- a/packages/core/src/session/sql.ts +++ b/packages/core/src/session/sql.ts @@ -62,6 +62,9 @@ export const SessionTable = sqliteTable( index("session_project_idx").on(table.project_id), index("session_workspace_idx").on(table.workspace_id), index("session_parent_idx").on(table.parent_id), + // GOAL-FP-01-04 (S-1): the GoalLoop startup scan joins goal_state → + // session and filters on session.directory on every instance boot. + index("session_directory_idx").on(table.directory), ], ) diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index b43ebd294c..792d130d75 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -153,6 +153,20 @@ const serviceLayer = Layer.effect( // Defect, so ANY query failure degrades to no-scan + a log and can // never kill the builder — which would close the ScopedCache entry // scope and take the idle subscription down with it. + // + // S-2: defensive read. The ref being set before the first state get + // is an invariant of the init→builder chain, not of the type system — + // if any future path builds this state without init setting the ref + // first, scanning with the empty value would silently match no + // session (a quiet no-op that looks healthy). Fail LOUD instead: + // log an error and skip the scan. The idle subscription above stays + // armed either way, so the event-driven path is unaffected. + if (!scanDirectoryRef.current) { + yield* Effect.logError( + "goal startup scan skipped: instance directory not resolved before state build", + ) + return {} + } const snapshot = yield* goal.listActiveSessions(scanDirectoryRef.current).pipe( Effect.catchCause((cause) => { const empty: ReadonlyArray = [] diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts index ac0fd00012..ce839fcef3 100644 --- a/packages/opencode/src/session/automation-lease.ts +++ b/packages/opencode/src/session/automation-lease.ts @@ -31,8 +31,16 @@ export interface Interface { export class Service extends Context.Service()("@opencode/SessionAutomationLease") {} -export const layer = Layer.sync(Service, () => { - const locks = KeyedMutex.makeUnsafe() +// S-3: SessionStatus is a HARD requirement of the lease layer. The +// dag-release re-trigger (GOAL-FP-01-02) must never silently degrade — a +// busy session's turn always re-emits idle when it finishes, so the +// re-trigger needs the real status map to gate and emit. SessionStatus is +// lightweight and dependency-free, so this adds no cycle. +export const layer = Layer.effect( + Service, + Effect.gen(function* () { + const sessionStatus = yield* SessionStatus.Service + const locks = KeyedMutex.makeUnsafe() const registrations = new Map< SessionID, { readonly goals: Set; readonly dags: Set; generation: number } @@ -124,22 +132,15 @@ export const layer = Layer.sync(Service, () => { }), ) if (!goalRetryDue) return - // SessionStatus is resolved optionally: automation-lease is deliberately - // dependency-free (consumers wire it standalone, e.g. - // test/session/automation-lease.test.ts), and every entry point that runs - // the lease (AppLayer, DagLoop, GoalLoop) provides SessionStatus. Without - // it the re-trigger degrades to the pre-fix behavior (the caller's next - // idle event still drives the goal — claim re-evaluation is never - // load-bearing for correctness of the lease itself). - const status = yield* Effect.serviceOption(SessionStatus.Service) - if (Option.isNone(status)) return // Only re-trigger when the session is actually idle: a busy session's // turn ALWAYS re-emits idle when it finishes (runner onIdle → // SessionStatus.set), which re-drives the goal claim with the dag already - // released. Emitting here mid-turn would waste a judge call and transiently - // drop the busy entry from the status map. - if ((yield* status.value.get(sessionID)).type !== "idle") return - yield* status.value.set(sessionID, { type: "idle" }) + // released. Emitting here mid-turn would waste a judge call and + // transiently drop the busy entry from the status map. SessionStatus is + // a hard requirement of the lease layer (S-3), so this gate can never + // silently degrade to a dropped re-trigger. + if ((yield* sessionStatus.get(sessionID)).type !== "idle") return + yield* sessionStatus.set(sessionID, { type: "idle" }) }) const claim = Effect.fn("SessionAutomationLease.claim")(function* ( @@ -200,7 +201,8 @@ export const layer = Layer.sync(Service, () => { }) return Service.of({ register, unregister, claim, use, purgeSession }) -}) + }), +) -export const defaultLayer = layer -export const node = LayerNode.make(layer, []) +export const defaultLayer = layer.pipe(Layer.provide(SessionStatus.defaultLayer)) +export const node = LayerNode.make(layer, [SessionStatus.node]) diff --git a/packages/opencode/src/session/session.ts b/packages/opencode/src/session/session.ts index eeb747f578..27789bc6bb 100644 --- a/packages/opencode/src/session/session.ts +++ b/packages/opencode/src/session/session.ts @@ -46,6 +46,7 @@ import { ModelV2 } from "@opencode-ai/core/model" import { SessionMessageID } from "@opencode-ai/schema/session-message-id" import { Goal } from "@/goal/goal" import { SessionAutomationLease } from "./automation-lease" +import { SessionStatus } from "./status" import { Dag } from "@/dag/dag" import { isWorkflowTerminalStatus } from "@opencode-ai/core/dag/core/types" import { landSystemMessages } from "@/hook/trigger-result" @@ -1200,6 +1201,10 @@ export const node = LayerNode.make(layer, [ EventV2Bridge.node, Goal.node, SessionAutomationLease.node, + // S-3: the lease node now requires SessionStatus (hard requirement for + // the dag-release re-trigger); consumers listing the lease node must + // provide it or the wiring fails silently. + SessionStatus.node, Dag.node, ]) diff --git a/packages/opencode/test/session/automation-lease.test.ts b/packages/opencode/test/session/automation-lease.test.ts index 59a080268c..a40595d766 100644 --- a/packages/opencode/test/session/automation-lease.test.ts +++ b/packages/opencode/test/session/automation-lease.test.ts @@ -1,10 +1,17 @@ import { describe, expect } from "bun:test" -import { Effect, Option } from "effect" +import { Effect, Layer, Option, Schema } from "effect" import { SessionAutomationLease } from "@/session/automation-lease" import { SessionID } from "@/session/schema" -import { testEffect } from "../lib/effect" +import { SessionStatus } from "@/session/status" +import { EventV2Bridge } from "@/event-v2-bridge" +import { testEffect, pollWithTimeout } from "../lib/effect" -const it = testEffect(SessionAutomationLease.defaultLayer) +// S-3: the lease's dag-release re-trigger requires the real SessionStatus — +// the defaultLayer self-provides it, and the merged EventV2Bridge shares the +// memoized instance so the test can observe the re-triggered idle event. +const it = testEffect( + SessionAutomationLease.defaultLayer.pipe(Layer.provideMerge(EventV2Bridge.defaultLayer)), +) describe("SessionAutomationLease", () => { it.instance("DAG registration preempts Goal and invalidates its generation", () => @@ -42,4 +49,37 @@ describe("SessionAutomationLease", () => { expect(Option.isSome(yield* lease.claim(sessionID, goal))).toBe(true) }), ) + + // S-3: the dag-release re-trigger must reach the real SessionStatus and + // emit the idle status event — the re-trigger can never silently degrade + // now that SessionStatus is a hard requirement of the lease layer. + it.instance("S-3: a blocked goal claim is re-triggered through SessionStatus when the dag releases", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const events = yield* EventV2Bridge.Service + const idleSessions: string[] = [] + const unsubscribe = yield* events.listen((event) => + Effect.sync(() => { + // event.data is untyped on the bus — decode it with the event + // definition's data schema instead of asserting on it. + if (event.type !== SessionStatus.Event.Status.type) return + const payload = Schema.decodeUnknownSync(SessionStatus.Event.Status.data)(event.data) + if (payload.status.type === "idle") idleSessions.push(String(payload.sessionID)) + }), + ) + yield* Effect.addFinalizer(() => unsubscribe) + + const sessionID = SessionID.descending() + yield* lease.register(sessionID, { kind: "dag", id: "dag-1" }) + // A goal claim rejected by the dag records the blocked obligation. + expect(Option.isNone(yield* lease.claim(sessionID, { kind: "goal", id: "goal-1" }))).toBe(true) + + yield* lease.unregister(sessionID, { kind: "dag", id: "dag-1" }) + yield* pollWithTimeout( + Effect.sync(() => (idleSessions.includes(String(sessionID)) ? true : undefined)), + "dag release never re-triggered the idle status event", + "5 seconds", + ) + }), + ) }) From 910c06f106242333adfa539e7e6103d98df17dfc Mon Sep 17 00:00:00 2001 From: Lex Date: Thu, 13 Aug 2026 16:13:03 +0800 Subject: [PATCH 34/34] fix(opencode): fence goal and dag automation --- packages/opencode/src/dag/runtime/loop.ts | 78 +++++------ packages/opencode/src/goal/CONTEXT.md | 2 +- .../adr/0001-goal-transition-authority.md | 2 +- packages/opencode/src/goal/loop.ts | 11 +- .../opencode/src/session/automation-lease.ts | 47 ++++++- packages/opencode/src/session/prompt.ts | 51 ++++++- .../test/dag/dag-adoption-step-races.test.ts | 5 +- .../test/dag/dag-goal-wake-retrigger.test.ts | 5 +- .../test/dag/dag-lease-lifecycle.test.ts | 5 +- .../opencode/test/dag/dag-loop-guards.test.ts | 5 +- .../dag/dag-loop-recovery-integration.test.ts | 5 +- .../dag/dag-orphan-pending-recovery.test.ts | 5 +- .../dag/dag-recovery-escalated-loop.test.ts | 5 +- .../dag/dag-replan-stale-nodefailed.test.ts | 5 +- .../test/dag/dag-timeout-escalation.test.ts | 5 +- .../test/dag/dag-wake-integration.test.ts | 35 ++++- packages/opencode/test/goal/e2e-loop.test.ts | 75 +++++----- packages/opencode/test/lib/session-prompt.ts | 28 ++++ .../test/session/automation-lease.test.ts | 131 +++++++++++++++++- packages/opencode/test/session/prompt.test.ts | 35 ++++- 20 files changed, 421 insertions(+), 119 deletions(-) create mode 100644 packages/opencode/test/lib/session-prompt.ts diff --git a/packages/opencode/src/dag/runtime/loop.ts b/packages/opencode/src/dag/runtime/loop.ts index 06f09f9af1..ba06226b9c 100644 --- a/packages/opencode/src/dag/runtime/loop.ts +++ b/packages/opencode/src/dag/runtime/loop.ts @@ -1232,54 +1232,42 @@ const serviceLayer = Layer.effect( // information. A differing summary (new results committed // between attempts) always prompts. if (deliveredWakeSummaries.size > 1024) deliveredWakeSummaries.clear() - const didDeliver = Option.getOrElse( - yield* automation.use( - wakeLease, - Effect.gen(function* () { - if (deliveredWakeSummaries.get(sessionID) !== summary) { - const delivered = yield* promptSvc.promptIfIdle({ - sessionID: SessionID.make(sessionID), - parts: [{ type: "text", text: summary, synthetic: true }], - }) - if (Option.isNone(delivered)) return false - // Record BEFORE the mark: the transcript part was - // already written (the prompt just succeeded), so the - // retry must skip the prompt even when the mark below - // fails again. - deliveredWakeSummaries.set(sessionID, summary) - } - yield* store.markWakeBatchReported(batch).pipe( - Effect.tap(() => - Effect.forEach( - batch.workflows.filter((workflow) => - isWorkflowTerminalStatus(workflow.status as never), - ), - (workflow) => - automation.unregister(SessionID.make(sessionID), { - kind: "dag", - id: workflow.id, - }), - { discard: true }, - ), - ), - Effect.tap(() => - Effect.sync(() => { - plan.unresponsiveDagIDs.forEach((workflowID) => - deliveredUnresponsiveDagIDs.add(workflowID), - ) - }), - ), - ) - return true - }).pipe( - Effect.catchCause((cause) => - Effect.logWarning("DAG wake delivery failed", { sessionID, cause: Cause.pretty(cause) }).pipe( - Effect.as(false), - ), + const didDeliver = yield* Effect.gen(function* () { + if (deliveredWakeSummaries.get(sessionID) !== summary) { + const delivered = yield* SessionPrompt.admitIfIdle(promptSvc, automation, wakeLease, { + sessionID: SessionID.make(sessionID), + parts: [{ type: "text", text: summary, synthetic: true }], + }) + if (Option.isNone(delivered)) return false + deliveredWakeSummaries.set(sessionID, summary) + yield* delivered.value.pipe( + Effect.onError(() => + Effect.sync(() => { + if (deliveredWakeSummaries.get(sessionID) === summary) { + deliveredWakeSummaries.delete(sessionID) + } + }), ), + ) + } + + const markLease = yield* automation.claim(SessionID.make(sessionID), { kind: "dag" }) + if (Option.isNone(markLease)) return false + const marked = yield* automation.use(markLease.value, store.markWakeBatchReported(batch)) + if (Option.isNone(marked)) return false + plan.unresponsiveDagIDs.forEach((workflowID) => deliveredUnresponsiveDagIDs.add(workflowID)) + yield* Effect.forEach( + batch.workflows.filter((workflow) => isWorkflowTerminalStatus(workflow.status as never)), + (workflow) => automation.unregister(SessionID.make(sessionID), { kind: "dag", id: workflow.id }), + { discard: true }, + ) + return true + }).pipe( + Effect.catchCause((cause) => + Effect.logWarning("DAG wake delivery failed", { sessionID, cause: Cause.pretty(cause) }).pipe( + Effect.as(false), ), ), - () => false, ) if (!didDeliver) return } diff --git a/packages/opencode/src/goal/CONTEXT.md b/packages/opencode/src/goal/CONTEXT.md index 449914813a..de912d9f3f 100644 --- a/packages/opencode/src/goal/CONTEXT.md +++ b/packages/opencode/src/goal/CONTEXT.md @@ -21,7 +21,7 @@ Standing Goal keeps one durable autonomous objective for a Session and advances - Terminal completion writes `goal_outcome` and deletes the current row in one transition; a durable `done` row is never an intermediate cleanup obligation. - `blocked` pauses the Goal and remains distinguishable from `done` in state, events, transcript text, and judge prompts. - `SessionAutomationLease` elects one automation owner per Session. DAG owns the Session while any registered workflow remains; Goal is eligible only after the final DAG owner releases it. -- Goal and DAG effects revalidate the claimed generation immediately before mutation or prompt admission. `SessionPrompt.promptIfIdle` remains the final idle-state guard. +- Goal and DAG hold the claimed generation fence through a durable mutation or prompt admission. Provider execution starts only after that fence is released; `SessionPrompt.promptIfIdle` remains the final idle-state guard. - The current Session runner is process-local, so the automation lease is process-local. Clustered execution requires a separate durable lease design. ## Boundaries diff --git a/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md b/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md index 6f29f22716..ce91e4dabc 100644 --- a/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md +++ b/packages/opencode/src/goal/docs/adr/0001-goal-transition-authority.md @@ -19,7 +19,7 @@ A `done` verdict writes an immutable `goal_outcome` snapshot and deletes the cur Judge output is tri-state: `done`, `continue`, or `blocked`. `blocked` writes a paused Goal with the blocker as its reason. -`SessionAutomationLease` is the process-local authority for Goal/DAG ownership. Goal and DAG register their active identities; DAG has priority while any workflow is registered. A claim carries a generation that is revalidated immediately before a state transition or autonomous prompt. Registration changes invalidate older claims. After that ownership check, `SessionPrompt.promptIfIdle` remains the final atomic idle-state admission guard. Failure at either boundary admits no Goal prompt and leaves the durable Goal available for a later idle event. +`SessionAutomationLease` is the process-local authority for Goal/DAG ownership. Goal and DAG register their active identities; DAG has priority while any workflow is registered. A claim carries a generation, and the lease holds its per-Session fence through the durable transition or prompt admission. Registration changes cannot overtake that commit. Provider execution starts after the fence is released, so a slow model turn does not block ownership transfer. `SessionPrompt.promptIfIdle` remains the final atomic idle-state admission guard. Failure at either boundary admits no Goal prompt and leaves the durable Goal available for a later idle event. ## Consequences diff --git a/packages/opencode/src/goal/loop.ts b/packages/opencode/src/goal/loop.ts index 792d130d75..39d1be8590 100644 --- a/packages/opencode/src/goal/loop.ts +++ b/packages/opencode/src/goal/loop.ts @@ -425,12 +425,14 @@ const serviceLayer = Layer.effect( // clearFiber — us — mid-publish; see the preempt branches above). const continuationLease = Option.getOrUndefined(yield* automation.claim(sessionID, goalOwner)) if (!continuationLease) return - yield* automation.use( - continuationLease, - promptSvc.promptIfIdle({ + yield* Effect.gen(function* () { + const admitted = yield* SessionPrompt.admitIfIdle(promptSvc, automation, continuationLease, { sessionID, parts: [{ type: "text", text: continuationText }], - }).pipe( + }) + if (Option.isNone(admitted)) return + yield* admitted.value + }).pipe( Effect.catchCause((cause) => Effect.gen(function* () { // F1: Only pause for non-interrupt causes. An interrupt (user @@ -468,7 +470,6 @@ const serviceLayer = Layer.effect( return Option.none() }), ), - ), ) const afterDispatch = yield* goal.load(sessionID) if (!afterDispatch || afterDispatch.status !== "active") { diff --git a/packages/opencode/src/session/automation-lease.ts b/packages/opencode/src/session/automation-lease.ts index ce839fcef3..1613608c39 100644 --- a/packages/opencode/src/session/automation-lease.ts +++ b/packages/opencode/src/session/automation-lease.ts @@ -16,6 +16,12 @@ export interface Token { readonly generation: number } +export interface AfterFence { + readonly activate: Effect.Effect + readonly result: Effect.Effect + readonly abort: Effect.Effect +} + type Request = | { readonly kind: "goal"; readonly id: string } | { readonly kind: "dag" } @@ -25,6 +31,10 @@ export interface Interface { readonly unregister: (sessionID: SessionID, owner: Owner) => Effect.Effect readonly claim: (sessionID: SessionID, request: Request) => Effect.Effect> readonly use: (token: Token, effect: Effect.Effect) => Effect.Effect, E, R> + readonly handoff: ( + token: Token, + prepare: Effect.Effect>, E2, R2>, + ) => Effect.Effect>, E2, R2> /** Drop every registration and retry obligation for a session (session deletion). */ readonly purgeSession: (sessionID: SessionID) => Effect.Effect } @@ -169,20 +179,45 @@ export const layer = Layer.effect( }) const use: Interface["use"] = Effect.fn("SessionAutomationLease.use")(function* (token, effect) { - const valid = yield* locks.withLock(token.sessionID)( - Effect.sync(() => { + return yield* locks.withLock(token.sessionID)( + Effect.gen(function* () { const current = registrations.get(token.sessionID) const selected = owner(token.sessionID) - return !( + const valid = !( !current || current.generation !== token.generation || selected?.kind !== token.owner.kind || selected.id !== token.owner.id ) + if (!valid) return Option.none() + return Option.some(yield* effect) + }), + ) + }) + + const handoff: Interface["handoff"] = Effect.fn("SessionAutomationLease.handoff")(function* (token, prepare) { + return yield* Effect.uninterruptibleMask((restore) => + Effect.gen(function* () { + const prepared = yield* restore( + locks.withLock(token.sessionID)( + Effect.gen(function* () { + const current = registrations.get(token.sessionID) + const selected = owner(token.sessionID) + if ( + !current || + current.generation !== token.generation || + selected?.kind !== token.owner.kind || + selected.id !== token.owner.id + ) return Option.none() + return yield* prepare + }), + ), + ) + if (Option.isNone(prepared)) return Option.none() + yield* prepared.value.activate.pipe(Effect.onError(() => prepared.value.abort)) + return Option.some(prepared.value.result) }), ) - if (!valid) return Option.none() - return Option.some(yield* effect) }) // GOAL-FP-01-06: session deletion must drop every registration the session @@ -200,7 +235,7 @@ export const layer = Layer.effect( ) }) - return Service.of({ register, unregister, claim, use, purgeSession }) + return Service.of({ register, unregister, claim, use, handoff, purgeSession }) }), ) diff --git a/packages/opencode/src/session/prompt.ts b/packages/opencode/src/session/prompt.ts index cc744bd998..fcc8f5736e 100644 --- a/packages/opencode/src/session/prompt.ts +++ b/packages/opencode/src/session/prompt.ts @@ -67,6 +67,7 @@ import { HookStartContext } from "@/hook/start-context" import { Goal } from "@/goal/goal" import { KeyedMutex } from "@opencode-ai/core/effect/keyed-mutex" import { Memory } from "@/memory/memory" +import { SessionAutomationLease } from "./automation-lease" // @ts-ignore globalThis.AI_SDK_LOG_WARNINGS = false @@ -113,6 +114,7 @@ function isOrphanedInterruptedTool(part: SessionV1.ToolPart) { export interface Interface { readonly cancel: (sessionID: SessionID) => Effect.Effect readonly prompt: (input: PromptInput) => Effect.Effect + readonly prepareIfIdle: (input: PromptInput) => Effect.Effect, Image.Error> readonly promptIfIdle: (input: PromptInput) => Effect.Effect, Image.Error> readonly loop: (input: LoopInput) => Effect.Effect readonly shell: (input: ShellInput) => Effect.Effect @@ -120,6 +122,12 @@ export interface Interface { readonly resolvePromptParts: (template: string) => Effect.Effect } +export interface IdleAdmission { + readonly activate: Effect.Effect + readonly result: Effect.Effect + readonly abort: Effect.Effect +} + export class Service extends Context.Service()("@opencode/SessionPrompt") {} export const layer = Layer.effect( @@ -1386,11 +1394,12 @@ export const layer = Layer.effect( return yield* wait }) - const promptIfIdle: Interface["promptIfIdle"] = Effect.fn("SessionPrompt.promptIfIdle")( + const prepareIfIdle: Interface["prepareIfIdle"] = Effect.fn("SessionPrompt.prepareIfIdle")( function* (input: PromptInput) { - const wait = yield* promptLocks.withLock(input.sessionID)( + return yield* promptLocks.withLock(input.sessionID)( Effect.uninterruptibleMask((restore) => Effect.gen(function* () { + const activation = yield* Deferred.make() const admission = yield* Deferred.make< Exit.Exit<{ readonly message: SessionV1.WithParts; readonly run: boolean }, Image.Error> >() @@ -1398,26 +1407,44 @@ export const layer = Layer.effect( input.sessionID, lastAssistant(input.sessionID), Effect.gen(function* () { + yield* Deferred.await(activation) const admitted = yield* Deferred.await(admission) if (Exit.isFailure(admitted)) return yield* Effect.failCause(admitted.cause) if (!admitted.value.run) return admitted.value.message return yield* runLoop(input.sessionID) }).pipe(Effect.orDie), ) - if (Option.isNone(wait)) return wait + if (Option.isNone(wait)) return Option.none() const admitted = yield* restore(admitPrompt(input)).pipe(Effect.exit) yield* Deferred.succeed(admission, admitted) - if (Exit.isFailure(admitted)) return yield* Effect.failCause(admitted.cause) - return wait + if (Exit.isFailure(admitted)) { + yield* Deferred.succeed(activation, undefined) + return yield* Effect.failCause(admitted.cause) + } + return Option.some({ + activate: Deferred.succeed(activation, undefined).pipe(Effect.asVoid), + result: wait.value, + abort: state.cancel(input.sessionID), + }) }), ), ) - if (Option.isNone(wait)) return Option.none() - return Option.some(yield* wait.value) }, ) + const promptIfIdle: Interface["promptIfIdle"] = Effect.fn("SessionPrompt.promptIfIdle")( + (input: PromptInput) => + Effect.uninterruptibleMask((restore) => + Effect.gen(function* () { + const prepared = yield* restore(prepareIfIdle(input)) + if (Option.isNone(prepared)) return Option.none() + yield* prepared.value.activate.pipe(Effect.onError(() => prepared.value.abort)) + return Option.some(yield* restore(prepared.value.result)) + }), + ), + ) + const lastAssistant = Effect.fnUntraced(function* (sessionID: SessionID) { const match = yield* sessions.findMessage(sessionID, (m) => m.info.role !== "user").pipe(Effect.orDie) if (Option.isSome(match)) return match.value @@ -2097,6 +2124,7 @@ export const layer = Layer.effect( return Service.of({ cancel, prompt, + prepareIfIdle, promptIfIdle, loop, shell, @@ -2295,4 +2323,13 @@ export const node = LayerNode.make(layer, [ HookStartContext.node, SettingsHook.node, Goal.node, ]) +export function admitIfIdle( + service: Interface, + automation: SessionAutomationLease.Interface, + token: SessionAutomationLease.Token, + input: PromptInput, +): Effect.Effect>, Image.Error> { + return automation.handoff(token, service.prepareIfIdle(input)) +} + export * as SessionPrompt from "./prompt" diff --git a/packages/opencode/test/dag/dag-adoption-step-races.test.ts b/packages/opencode/test/dag/dag-adoption-step-races.test.ts index 074f2add11..8fe4743b44 100644 --- a/packages/opencode/test/dag/dag-adoption-step-races.test.ts +++ b/packages/opencode/test/dag/dag-adoption-step-races.test.ts @@ -19,6 +19,7 @@ import { MessageID } from "@/session/schema" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" interface PromptGate { readonly title: string @@ -100,7 +101,7 @@ function raceLayer(input: { }), messages: (value) => input.messages(value as never) as never, }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: (sessionID) => Effect.sync(() => void input.cancelled.push(sessionID as string)), prompt: Effect.fn("test.SessionPrompt.prompt")(function* (value: SessionPrompt.PromptInput) { const sessionID = value.sessionID as string @@ -113,7 +114,7 @@ function raceLayer(input: { }), // Keep wake delivery pending so the tests observe scheduling only. promptIfIdle: () => Effect.succeed(Option.none()), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ name: "build", diff --git a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts index 45d62f4080..245676836c 100644 --- a/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts +++ b/packages/opencode/test/dag/dag-goal-wake-retrigger.test.ts @@ -25,6 +25,7 @@ import { SessionPrompt } from "@/session/prompt" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" // GOAL-FP-01-02: the final DAG lease unregister (U2) lands AFTER the wake // turn's idle event. GoalLoop's claim runs on idle while the dag registration @@ -221,11 +222,11 @@ function goalWakeLayer(input: { childPrompts: Queue.Queue; fail yield* Queue.offer(input.childPrompts, { title: childTitles.get(sessionID) ?? sessionID, release }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.void, prompt: deliver, promptIfIdle: (value: SessionPrompt.PromptInput) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ diff --git a/packages/opencode/test/dag/dag-lease-lifecycle.test.ts b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts index c8fc4e1aaf..df58e5e1c9 100644 --- a/packages/opencode/test/dag/dag-lease-lifecycle.test.ts +++ b/packages/opencode/test/dag/dag-lease-lifecycle.test.ts @@ -24,6 +24,7 @@ import { SessionPrompt } from "@/session/prompt" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" // GOAL-FP-01-01 / GOAL-FP-01-03: the DAG automation-lease registration lifetime // must be bound to WORKFLOW STATE, not to wake delivery. @@ -164,11 +165,11 @@ function leaseLifecycleLayer(input: { childPrompts: Queue.Queue yield* Queue.offer(input.childPrompts, { title: childTitles.get(sessionID) ?? sessionID, release }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.void, prompt: deliver, promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ diff --git a/packages/opencode/test/dag/dag-loop-guards.test.ts b/packages/opencode/test/dag/dag-loop-guards.test.ts index 7b461f74af..b2b4ab1d8f 100644 --- a/packages/opencode/test/dag/dag-loop-guards.test.ts +++ b/packages/opencode/test/dag/dag-loop-guards.test.ts @@ -37,6 +37,7 @@ import { MessageID } from "@/session/schema" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" interface PromptGate { readonly title: string @@ -140,14 +141,14 @@ function guardLayer(input: { }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: (sessionID) => Effect.sync(() => { input.cancels.push(sessionID as string) }), prompt: deliver, promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ name: "build", diff --git a/packages/opencode/test/dag/dag-loop-recovery-integration.test.ts b/packages/opencode/test/dag/dag-loop-recovery-integration.test.ts index ca17578d6c..e5592afb71 100644 --- a/packages/opencode/test/dag/dag-loop-recovery-integration.test.ts +++ b/packages/opencode/test/dag/dag-loop-recovery-integration.test.ts @@ -17,6 +17,7 @@ import { SessionPrompt } from "@/session/prompt" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" type ChildStatus = "active" | "completed" | "failed" | "unknown" @@ -71,14 +72,14 @@ function recoveryLayer(input: { return Effect.succeed([{ info: { role: "assistant", finish: "stop" } }] as never) }), }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: Effect.fn("test.SessionPrompt.cancel")((sessionID: string) => Effect.sync(() => input.cancelled.push(sessionID)), ), // Keep wake delivery pending so tests can inspect durable unreported rows. prompt: () => Effect.never, promptIfIdle: () => Effect.succeed(Option.none()), - }) + })) const loop = DagLoop.layer.pipe( Layer.provide(base), Layer.provide(session), diff --git a/packages/opencode/test/dag/dag-orphan-pending-recovery.test.ts b/packages/opencode/test/dag/dag-orphan-pending-recovery.test.ts index 4e9b412d29..123ba50265 100644 --- a/packages/opencode/test/dag/dag-orphan-pending-recovery.test.ts +++ b/packages/opencode/test/dag/dag-orphan-pending-recovery.test.ts @@ -16,6 +16,7 @@ import { SessionPrompt } from "@/session/prompt" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" const ORPHAN_REASON = "orphan pending workflow recovered at startup" @@ -41,14 +42,14 @@ function orphanRecoveryLayer(input: { promptCalls: string[] }) { get: Effect.fn("test.Session.get")(() => Effect.succeed({} as never)), messages: Effect.fn("test.Session.messages")(() => Effect.succeed([])), }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: Effect.fn("test.SessionPrompt.cancel")(() => Effect.void), prompt: Effect.fn("test.SessionPrompt.prompt")(() => { input.promptCalls.push("prompt") return Effect.never }), promptIfIdle: () => Effect.succeed(Option.none()), - }) + })) const loop = DagLoop.layer.pipe( Layer.provide(base), Layer.provide(session), diff --git a/packages/opencode/test/dag/dag-recovery-escalated-loop.test.ts b/packages/opencode/test/dag/dag-recovery-escalated-loop.test.ts index 3a7f266688..f797f0b272 100644 --- a/packages/opencode/test/dag/dag-recovery-escalated-loop.test.ts +++ b/packages/opencode/test/dag/dag-recovery-escalated-loop.test.ts @@ -17,6 +17,7 @@ import { SessionPrompt } from "@/session/prompt" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" function node(id: string, timeoutMs?: number): NodeConfig { return { @@ -74,7 +75,7 @@ function recoveryLayer(input: { wakes: string[] }) { get: () => Effect.succeed({} as never), messages: () => Effect.succeed([]), }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.void, prompt: () => Effect.never, promptIfIdle: (value) => @@ -84,7 +85,7 @@ function recoveryLayer(input: { wakes: string[] }) { }).pipe( Effect.map(() => Option.some(reply(value.sessionID as string, "wake handled"))), ), - }) + })) const loop = DagLoop.layer.pipe( Layer.provide(base), Layer.provide(session), diff --git a/packages/opencode/test/dag/dag-replan-stale-nodefailed.test.ts b/packages/opencode/test/dag/dag-replan-stale-nodefailed.test.ts index f19067b952..6c9de51b77 100644 --- a/packages/opencode/test/dag/dag-replan-stale-nodefailed.test.ts +++ b/packages/opencode/test/dag/dag-replan-stale-nodefailed.test.ts @@ -17,6 +17,7 @@ import { MessageID } from "@/session/schema" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" interface PromptGate { readonly title: string @@ -118,11 +119,11 @@ function loopLayer(input: { }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.void, prompt: deliver, promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ name: "build", diff --git a/packages/opencode/test/dag/dag-timeout-escalation.test.ts b/packages/opencode/test/dag/dag-timeout-escalation.test.ts index 1ba5489df6..f8c88f46a8 100644 --- a/packages/opencode/test/dag/dag-timeout-escalation.test.ts +++ b/packages/opencode/test/dag/dag-timeout-escalation.test.ts @@ -21,6 +21,7 @@ import { MessageID, PartID, SessionID } from "@/session/schema" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" interface PromptGate { readonly title: string @@ -163,11 +164,11 @@ function loopLayer(input: { }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.sync(() => { cancelCount++ }), prompt: deliver, promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ name: "build", diff --git a/packages/opencode/test/dag/dag-wake-integration.test.ts b/packages/opencode/test/dag/dag-wake-integration.test.ts index 7417be2129..47e916fa46 100644 --- a/packages/opencode/test/dag/dag-wake-integration.test.ts +++ b/packages/opencode/test/dag/dag-wake-integration.test.ts @@ -18,10 +18,11 @@ import { DagLoop } from "@/dag/runtime/loop" import { InstanceRef } from "@/effect/instance-ref" import { EventV2Bridge } from "@/event-v2-bridge" import { SessionPrompt } from "@/session/prompt" -import { MessageID } from "@/session/schema" +import { MessageID, SessionID } from "@/session/schema" import { Session } from "@/session/session" import { SessionStatus } from "@/session/status" import { pollWithTimeout, testEffect } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" const integration = testEffect(Layer.empty) @@ -146,11 +147,11 @@ function wakeLayer(input: { }) return reply(sessionID, yield* Deferred.await(release)) }) - const prompt = Layer.mock(SessionPrompt.Service, { + const prompt = Layer.mock(SessionPrompt.Service, withIdleAdmission({ cancel: () => Effect.void, prompt: deliver, promptIfIdle: (value) => deliver(value).pipe(Effect.map(Option.some)), - }) + })) const agent = Layer.mock(Agent.Service, { get: () => Effect.succeed({ name: "build", @@ -1048,6 +1049,34 @@ describe("DagLoop atomic wake integration", () => { ) }) + it("retries the parent prompt after a provider failure instead of silently marking the wake", async () => { + await Effect.runPromise( + runWakeTest(({ dag, store, status, childPrompts, parentPrompts, parentSettled }) => + Effect.gen(function* () { + yield* dag.create({ + projectID: "project-1", + sessionID: "ses_parent", + title: "Retryable workflow", + config: { name: "retryable", nodes: [node("retryable-node")] }, + }) + const child = yield* takeWithin(childPrompts, "retryable node did not start") + yield* Deferred.succeed(child.release, "retry me") + const first = yield* takeWithin(parentPrompts, "retryable batch did not wake the parent") + yield* Deferred.succeed(first.release, "failure") + yield* takeWithin(parentSettled, "failed parent prompt did not settle") + yield* status.set(SessionID.make("ses_parent"), { type: "idle" }) + + const second = yield* takeWithin(parentPrompts, "failed provider wake was not prompted again") + expect(promptText(second.input)).toContain('Node "retryable-node" completed: retry me') + yield* Deferred.succeed(second.release, "success") + yield* takeWithin(parentSettled, "successful retry did not settle") + expect(yield* store.getUnreportedWakeNodes("ses_parent")).toHaveLength(0) + expect(yield* store.getUnreportedWakeWorkflows("ses_parent")).toHaveLength(0) + }), + ), + ) + }) + it("redelivers an unreported durable batch during startup", async () => { await Effect.runPromise( runWakeTest( diff --git a/packages/opencode/test/goal/e2e-loop.test.ts b/packages/opencode/test/goal/e2e-loop.test.ts index ec5d68fc15..144b1c70ed 100644 --- a/packages/opencode/test/goal/e2e-loop.test.ts +++ b/packages/opencode/test/goal/e2e-loop.test.ts @@ -20,6 +20,7 @@ import { AbsolutePath } from "@opencode-ai/core/schema" import { TestInstance } from "../fixture/fixture" import { logLines } from "effect/testing/TestConsole" import { testEffect, pollWithTimeout } from "../lib/effect" +import { withIdleAdmission } from "../lib/session-prompt" // P2b: full-cycle Goal regression (D5). Drives set → idle → judge(continue) → // continuation → idle → judge(done) → terminal event sequence, with the judge @@ -77,19 +78,19 @@ const mkAssistantTools = () => // the mock; the goal state and event captures are the observable contract. const recordingPrompt = (sink: { noReply?: boolean; text: string }[]) => Layer.succeed(SessionPrompt.Service, (() => { - const record = (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + const record = (input: SessionPrompt.PromptInput) => Effect.sync(() => { sink.push({ noReply: input.noReply, - text: input.parts?.map((p) => p.text).join("\n") ?? "", + text: input.parts.map((part) => (part.type === "text" ? part.text : "")).join("\n"), }) return undefined as never }) - return { + return withIdleAdmission({ prompt: record, - promptIfIdle: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + promptIfIdle: (input: SessionPrompt.PromptInput) => record(input).pipe(Effect.map(Option.some)), - } as never + }) as never })()) describe("GoalLoop end-to-end — continue → done lifecycle (P2b)", () => { @@ -108,19 +109,19 @@ describe("GoalLoop end-to-end — continue → done lifecycle (P2b)", () => { messages: () => Effect.succeed([mkAssistant()]), } as never) const promptMock = Layer.succeed(SessionPrompt.Service, (() => { - const record = (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + const record = (input: SessionPrompt.PromptInput) => Effect.sync(() => { promptCalls.push({ noReply: input.noReply, - text: input.parts?.map((p) => p.text).join("\n") ?? "", + text: input.parts.map((part) => (part.type === "text" ? part.text : "")).join("\n"), }) return undefined as never }) - return { + return withIdleAdmission({ prompt: record, - promptIfIdle: (input: { noReply?: boolean; parts?: Array<{ type: string; text: string }> }) => + promptIfIdle: (input: SessionPrompt.PromptInput) => record(input).pipe(Effect.map(Option.some)), - } as never + }) as never })()) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( @@ -203,7 +204,7 @@ describe("GoalLoop — shared Session automation lease", () => { const sessionMock = Layer.succeed(Session.Service, { messages: () => Effect.succeed([mkAssistant()]), } as never) - const promptMock = Layer.succeed(SessionPrompt.Service, { + const promptMock = Layer.succeed(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.sync(() => { directPromptAttempts += 1 @@ -214,7 +215,7 @@ describe("GoalLoop — shared Session automation lease", () => { leaseAttempts += 1 return Option.none() }), - } as never) + }) as never) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ @@ -266,14 +267,14 @@ describe("GoalLoop + DAG owner arbitration", () => { const sessionMock = Layer.succeed(Session.Service, { messages: () => Effect.succeed([mkAssistant()]), } as never) - const promptMock = Layer.succeed(SessionPrompt.Service, { + const promptMock = Layer.succeed(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.succeed(undefined as never), promptIfIdle: () => Effect.sync(() => { continuationCalls += 1 return Option.some(undefined as never) }), - } as never) + }) as never) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ @@ -369,7 +370,7 @@ describe("GoalLoop — dag release must not double-evaluate a boundary (GOAL-FP- // Second continuation dispatch parks on a gate: under the unfixed // re-trigger the boundary fiber commits (turns 1 → 2) and reaches the gate; // the test then observes the settled double-commit state. - const promptMock = Layer.mock(SessionPrompt.Service, { + const promptMock = Layer.mock(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), promptIfIdle: () => Effect.sync(() => { @@ -384,7 +385,7 @@ describe("GoalLoop — dag release must not double-evaluate a boundary (GOAL-FP- }), Effect.map(() => Option.none()), ), - }) + })) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ @@ -483,10 +484,10 @@ describe("GoalLoop — continuation dispatch failure → recoverable pause (D1)" messages: () => Effect.succeed([mkAssistant()]), } as never) // Always-failing prompt — simulates provider fault / session write error. - const promptFailMock = Layer.succeed(SessionPrompt.Service, { + const promptFailMock = Layer.succeed(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.fail(new Error("continuation provider down")), promptIfIdle: () => Effect.fail(new Error("continuation provider down")), - } as never) + }) as never) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, @@ -604,14 +605,14 @@ describe("GoalLoop — dispatch failure releases the lease without the trailing // drops the goal_state table — so afterDispatch's goal.load defects: the // lease release must NOT depend on that trailing load. The die after the // gate is swallowed by the handler's Effect.ignore. - const promptFailAndParkMock = Layer.mock(SessionPrompt.Service, { + const promptFailAndParkMock = Layer.mock(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.gen(function* () { yield* Deferred.await(promptGate) return yield* Effect.die("failure-path prompt is the last stop before the trailing load") }), promptIfIdle: () => Effect.die(new Error("continuation provider down")), - }) + })) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ @@ -718,15 +719,17 @@ describe("GoalLoop — real SessionRunState admission seam (GOAL-FP-01-13)", () // real. The mock returns Option.none() even on admission — afterIdle // discards the promptIfIdle result (only its failure matters), and // admission is observable through the real status flip and the counters. - const promptIfIdle = Effect.fn("test.goalSeam.SessionPrompt.promptIfIdle")(function* ( + const prepareIfIdle = Effect.fn("test.goalSeam.SessionPrompt.prepareIfIdle")(function* ( input: SessionPrompt.PromptInput, ) { const runState = yield* Effect.serviceOption(SessionRunState.Service) if (Option.isNone(runState)) return yield* Effect.die("SessionRunState not provided to the seam mock") + const activation = yield* Deferred.make() const admitted = yield* runState.value.startIfIdle( input.sessionID, Effect.die("onInterrupt is not exercised in this scenario"), Effect.gen(function* () { + yield* Deferred.await(activation) admissions += 1 if (admissions === 1) { firstAdmissionParked = true @@ -739,13 +742,23 @@ describe("GoalLoop — real SessionRunState admission seam (GOAL-FP-01-13)", () rejectedAdmissions += 1 return Option.none() } - // Await the run's completion (the Cancelled exit is captured) so the - // mock's promptIfIdle stays faithful to the real one's waiting behavior. - yield* admitted.value.pipe(Effect.exit, Effect.asVoid) - return Option.none() + return Option.some({ + activate: Deferred.succeed(activation, undefined).pipe(Effect.asVoid), + result: admitted.value.pipe(Effect.exit, Effect.as(mkAssistant())), + abort: runState.value.cancel(input.sessionID), + }) + }) + const promptIfIdle = Effect.fn("test.goalSeam.SessionPrompt.promptIfIdle")(function* ( + input: SessionPrompt.PromptInput, + ) { + const prepared = yield* prepareIfIdle(input) + if (Option.isNone(prepared)) return Option.none() + yield* prepared.value.activate + return Option.some(yield* prepared.value.result) }) const promptMock = Layer.mock(SessionPrompt.Service, { prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), + prepareIfIdle, promptIfIdle, }) const judgeMock = Layer.succeed( @@ -1070,10 +1083,10 @@ describe("GoalLoop — continuation interrupted → no pause, goal stays active // undefined id — the F1 miss case that Cause.interruptors silently drops and // the old interruptors().size check misclassified as a dispatch failure. let interruptCause: Cause.Cause = Cause.interrupt(0) - const promptInterruptMock = Layer.succeed(SessionPrompt.Service, { + const promptInterruptMock = Layer.succeed(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.failCause(interruptCause), promptIfIdle: () => Effect.failCause(interruptCause), - } as never) + }) as never) const providerMock = Layer.succeed(Provider.Service, {} as never) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, @@ -1206,14 +1219,14 @@ describe("GoalLoop — startup scan resumes pre-boot active goals (GOAL-FP-01-04 const sessionMock = Layer.mock(Session.Service, { messages: () => Effect.succeed([mkAssistant()]), }) - const promptMock = Layer.mock(SessionPrompt.Service, { + const promptMock = Layer.mock(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), promptIfIdle: () => Effect.sync(() => { continuationCalls += 1 return Option.none() }), - }) + })) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ @@ -1401,10 +1414,10 @@ describe("GoalLoop — startup scan scoping and hardening (GOAL-FP-01-04 follow- const sessionMock = Layer.mock(Session.Service, { messages: () => Effect.succeed([mkAssistant()]), }) - const promptMock = Layer.mock(SessionPrompt.Service, { + const promptMock = Layer.mock(SessionPrompt.Service, withIdleAdmission({ prompt: () => Effect.die("the direct prompt path is not exercised in this scenario"), promptIfIdle: () => Effect.sync(() => Option.none()), - }) + })) const judgeMock = Layer.succeed( GoalLoopJudgeLLM, GoalLoopJudgeLLM.of({ diff --git a/packages/opencode/test/lib/session-prompt.ts b/packages/opencode/test/lib/session-prompt.ts new file mode 100644 index 0000000000..88dd287b27 --- /dev/null +++ b/packages/opencode/test/lib/session-prompt.ts @@ -0,0 +1,28 @@ +import { Cause, Effect, Option } from "effect" +import { SessionPrompt } from "@/session/prompt" +import { SessionV1 } from "@opencode-ai/core/v1/session" + +export function withIdleAdmission( + service: Value & { + readonly promptIfIdle: ( + input: SessionPrompt.PromptInput, + ) => Effect.Effect, Error> + }, +) { + return { + ...service, + prepareIfIdle: (input: SessionPrompt.PromptInput) => + Effect.succeed( + Option.some({ + activate: Effect.void, + result: service.promptIfIdle(input).pipe( + Effect.flatMap(Option.match({ onNone: () => Effect.interrupt, onSome: Effect.succeed })), + Effect.catchCause((cause) => + Cause.hasInterrupts(cause) ? Effect.interrupt : Effect.die(Cause.squash(cause)), + ), + ), + abort: Effect.void, + }), + ), + } +} diff --git a/packages/opencode/test/session/automation-lease.test.ts b/packages/opencode/test/session/automation-lease.test.ts index a40595d766..bc035c4082 100644 --- a/packages/opencode/test/session/automation-lease.test.ts +++ b/packages/opencode/test/session/automation-lease.test.ts @@ -1,5 +1,5 @@ import { describe, expect } from "bun:test" -import { Effect, Layer, Option, Schema } from "effect" +import { Deferred, Effect, Fiber, Layer, Option, Schema } from "effect" import { SessionAutomationLease } from "@/session/automation-lease" import { SessionID } from "@/session/schema" import { SessionStatus } from "@/session/status" @@ -31,6 +31,135 @@ describe("SessionAutomationLease", () => { }), ) + it.instance("DAG cannot claim before a Goal fenced commit finishes", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const entered = yield* Deferred.make() + const release = yield* Deferred.make() + let dagClaimedBeforeCommit = false + + yield* lease.register(sessionID, goal) + const token = Option.getOrThrow(yield* lease.claim(sessionID, goal)) + const commit = yield* lease.use( + token, + Deferred.succeed(entered, undefined).pipe( + Effect.andThen(Deferred.await(release)), + ), + ).pipe(Effect.forkChild) + + yield* Deferred.await(entered) + const dag = yield* Effect.gen(function* () { + yield* lease.register(sessionID, { kind: "dag", id: "dag-1" }) + dagClaimedBeforeCommit = Option.isSome(yield* lease.claim(sessionID, { kind: "dag" })) + }).pipe(Effect.forkChild) + yield* Effect.yieldNow + expect(dagClaimedBeforeCommit).toBe(false) + yield* Deferred.succeed(release, undefined) + yield* Fiber.join(commit) + yield* Fiber.join(dag) + expect(dagClaimedBeforeCommit).toBe(true) + }), + ) + + it.instance("handoff activates outside the fence", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const activationEntered = yield* Deferred.make() + const releaseActivation = yield* Deferred.make() + + yield* lease.register(sessionID, goal) + const token = Option.getOrThrow(yield* lease.claim(sessionID, goal)) + const handoff = yield* lease.handoff( + token, + Effect.succeed(Option.some({ + activate: Deferred.succeed(activationEntered, undefined).pipe( + Effect.andThen(Deferred.await(releaseActivation)), + ), + result: Effect.void, + abort: Effect.void, + })), + ).pipe(Effect.forkChild) + + yield* Deferred.await(activationEntered) + yield* lease.register(sessionID, { kind: "dag", id: "dag-1" }).pipe( + Effect.timeoutOrElse({ + duration: "250 millis", + orElse: () => Effect.die("activation still held the automation fence"), + }), + Effect.ensuring(Deferred.succeed(releaseActivation, undefined)), + ) + expect(Option.isSome(yield* lease.claim(sessionID, { kind: "dag" }))).toBe(true) + yield* Fiber.join(handoff) + }), + ) + + it.instance("handoff activation survives interruption", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const entered = yield* Deferred.make() + const release = yield* Deferred.make() + let activated = false + let aborted = false + + yield* lease.register(sessionID, goal) + const token = Option.getOrThrow(yield* lease.claim(sessionID, goal)) + const handoff = yield* lease.handoff( + token, + Effect.succeed(Option.some({ + activate: Deferred.succeed(entered, undefined).pipe( + Effect.andThen(Deferred.await(release)), + Effect.andThen(Effect.sync(() => (activated = true))), + ), + result: Effect.void, + abort: Effect.sync(() => (aborted = true)), + })), + ).pipe(Effect.forkChild) + + yield* Deferred.await(entered) + const interrupted = yield* Fiber.interrupt(handoff).pipe(Effect.forkChild) + yield* Effect.yieldNow + yield* Deferred.succeed(release, undefined) + yield* Fiber.join(interrupted) + expect({ activated, aborted }).toEqual({ activated: true, aborted: false }) + }), + ) + + it.instance("handoff interruption cancels a blocked preparation and releases the fence", () => + Effect.gen(function* () { + const lease = yield* SessionAutomationLease.Service + const sessionID = SessionID.descending() + const goal = { kind: "goal" as const, id: "goal-1" } + const entered = yield* Deferred.make() + let finalized = false + + yield* lease.register(sessionID, goal) + const token = Option.getOrThrow(yield* lease.claim(sessionID, goal)) + const handoff = yield* lease.handoff( + token, + Deferred.succeed(entered, undefined).pipe( + Effect.andThen(Effect.never), + Effect.ensuring(Effect.sync(() => (finalized = true))), + ), + ).pipe(Effect.forkChild) + + yield* Deferred.await(entered) + yield* Fiber.interrupt(handoff) + yield* lease.register(sessionID, { kind: "dag", id: "dag-1" }).pipe( + Effect.timeoutOrElse({ + duration: "250 millis", + orElse: () => Effect.die("interrupted preparation retained the automation fence"), + }), + ) + expect(finalized).toBe(true) + }), + ) + it.instance("Goal becomes owner again after the final DAG unregisters", () => Effect.gen(function* () { const lease = yield* SessionAutomationLease.Service diff --git a/packages/opencode/test/session/prompt.test.ts b/packages/opencode/test/session/prompt.test.ts index 9969f785c9..1d05d4b5a4 100644 --- a/packages/opencode/test/session/prompt.test.ts +++ b/packages/opencode/test/session/prompt.test.ts @@ -6,7 +6,7 @@ import { eq } from "drizzle-orm" import { EventV2Bridge } from "@/event-v2-bridge" import { FetchHttpClient } from "effect/unstable/http" import { expect } from "bun:test" -import { Cause, Deferred, Duration, Effect, Exit, Fiber, Layer } from "effect" +import { Cause, Deferred, Duration, Effect, Exit, Fiber, Layer, Option } from "effect" import path from "path" import { fileURLToPath, pathToFileURL } from "url" import { NamedError } from "@opencode-ai/core/util/error" @@ -1854,6 +1854,39 @@ it.instance("idle-only prompt resolves only after the full provider turn complet }), ) +it.instance("idle-only preparation keeps the provider stopped until activation", () => + Effect.gen(function* () { + const { llm } = yield* useServerConfig(providerCfg) + const prompt = yield* SessionPrompt.Service + const sessions = yield* Session.Service + const chat = yield* sessions.create({ title: "Pinned" }) + let releaseTurn: (value: unknown) => void = () => {} + yield* llm.hold("wake handled", new Promise((resolve) => { + releaseTurn = resolve + })) + + const prepared = Option.getOrThrow(yield* prompt.prepareIfIdle({ + sessionID: chat.id, + agent: "build", + model: ref, + parts: [{ type: "text", text: "fenced synthetic wake", synthetic: true }], + })) + const beforeActivation = yield* llm.wait(1).pipe( + Effect.as("provider-started" as const), + Effect.timeoutOrElse({ + duration: "250 millis", + orElse: () => Effect.succeed("provider-stopped" as const), + }), + ) + expect(beforeActivation).toBe("provider-stopped") + + yield* prepared.activate + yield* awaitWithTimeout(llm.wait(1), "idle-only preparation did not activate the provider") + releaseTurn(undefined) + yield* awaitWithTimeout(prepared.result, "idle-only preparation did not finish") + }), +) + it.instance("prompt submitted during an active run is included in the next LLM input", () => Effect.gen(function* () { const { llm } = yield* useServerConfig(providerCfg)