mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-28 07:32:14 +02:00
v1.91.2.0 fix: consolidate gstack reliability wave (#2959)
* fix(memory-ingest): --scan-secrets scans the rendered page and fails closed --scan-secrets ran gitleaks on the raw transcript .jsonl, then imported a page rendered from it. gitleaks' assignment rules don't match across a JSON-escaped quote (KEY=\"v\" on disk), so a secret the rendered page shows as KEY="v" was imported unflagged. And the gate skipped a file only on scanner "gitleaks" with findings, so a scan that errored (non-zero exit, 16MB maxBuffer overflow on a file with many findings, unparseable report) or could not run (gitleaks missing, slow-probe cooldown) imported the file unscanned. Scan the rendered page body, the exact bytes writeStaged() writes, via a new secretScanText() helper, and skip the file whenever the scan did not complete. Skipped files stay out of the state file, so the next run retries them. Reword the helper warnings and setup-gbrain/memory.md, which described the fail-open as intended. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(test): reconcile Bun failure markers and footer counts * fix(sync-gbrain): verify source-scoped reads without mutation * fix(test): recognize grounded TTHW target choices structurally * fix(aside): make the readiness probe work under zsh and report why it failed The probe built its deadline into `_T` and expanded it unquoted, so `$_T aside repl …` only worked in a shell that word-splits. zsh does not: it looked for a command literally named "gtimeout 30", the probe answered ASIDE_NOT_RUNNING with Aside installed and ready, and every browsing skill fell back to the bundled Chromium in silence. zsh is the macOS default and Aside is macOS-only, so on a stock Mac the probe could never report READY. The deadline becomes a function, `_gs_d`. It receives the command as "$@", already split, so sh, bash and zsh all behave the same, and the gtimeout → timeout → perl alarm chain is unchanged. A 4th arm runs the call unbounded when none of the three is present, which is what the empty `_T` did before. Not `eval`: it re-parses the string, so the parens and `;` of the perl arm become syntax and that arm dies in bash *and* zsh — on a stock Mac, the arm that actually runs. On failure the probe now prints the CLI's reason after ASIDE_NOT_RUNNING:, the shape gstack-render already uses: the first line that starts with a capital letter, i.e. the CLI's own sentence or Node's `Error:` line below its loader frame. "Not running" covers states with different fixes — no window open for the profile, a NODE_OPTIONS preload that kills the CLI — and a bare verdict sent all of them to "open the Aside app". The BROWSER SETUP prose quotes that reason before asking the user to open the app. The text pin asserted the broken invocation verbatim, so it now pins the function and asserts neither `$_T aside repl` nor an eval form comes back. A second test executes the rendered probe in sh, bash and zsh on each of the four deadline arms with stubbed binaries on a narrowed PATH, plus two failing CLIs: one that prints its own sentence, one that crashes like Node with the useful line below the frame. The deadline function costs zero bytes against the lines it replaces; the reason costs 53 per copy of the probe (44 where the reworded BROWSER SETUP line gives 9 back). That moves four guards by the measured amount: plan-devex-review's skeleton cap to 68,550 (measured 68,544), plan-ceo-review's skeleton cap to 80,150 (measured 80,111) and union ratio to 1.081 (measured 1.0803), and plan-eng-review's union ratio to 1.151 (measured 1.1504). Fixes #2842, #2941. * Clarify engineering review startup and decision flow * Fix Windows readiness fixture PATH and command shim * fix(test): recognize grounded TTHW target choices structurally * Clarify engineering review startup and decision flow * fix(test): restrict QA-only fixture tools to its no-Edit contract * v1.90.0.0 fix(sync-gbrain): guard readiness verdicts and refresh metadata * fix(browse): validate canonical upload targets * fix(gbrain): classify structured PGLite busy response * fix(browse): preserve native extension runtime APIs * Fix displayless browser handoff ownership * Accept unique installed autoplan methodology aliases * fix(skills): preserve positional literals during installation * fix(browse): checksum installer contents through stdin * fix(test): normalize Windows checksum fixture paths * test: emulate unavailable shasum in Windows checksum fixture * fix(investigate): preserve owned freeze lifecycle * fix(review): preserve N+1 retry and Red Team completion * fix: bound Aside readiness and preserve safe fallback * test: exercise setup and Chromium on native ARM * fix: preserve install ownership and ARM browser selection * Fix gbrain ingest scan boundaries and seed observation * Refresh managed ship hooks and supervise expanded paid census * Reject resumed gbrain pages excluded by current policy * Recover zombie agent locks safely and enable CI Python venv * Repair paid actor declarations and Aside pitch assertions * Bump consolidated wave to next free minor release * Clarify CEO review admin choices and option tradeoffs * Preserve CEO mode handoff anchors in clarified workflow * Make Windows portability fixtures use shell-native paths * Restore ARM Bun alias and clarify ship review gates * Refresh ship workflow golden snapshots * Fix Windows DX documentation controls without piped stdin * Decode Codex child pipes without Bun's encoded-stream stall * Bound DX pre-review audit before product questions * Clarify trusted review-start read in paid revalidation * Bump consolidated wave to next free minor release * Clarify CEO review admin choices and option tradeoffs * Preserve CEO mode handoff anchors in clarified workflow * Make Windows portability fixtures use shell-native paths * Restore ARM Bun alias and clarify ship review gates * Refresh ship workflow golden snapshots * Fix Windows DX documentation controls without piped stdin * Decode Codex child pipes without Bun's encoded-stream stall * Bound DX pre-review audit before product questions * Clarify trusted review-start read in paid revalidation * Reconcile new main planning flow and paid judge census * fix: reconcile rebased planning and source-bound validation * test: pin cookie workflow judge to scored Sonnet model * fix: keep terminal agent boot out of module imports * fix: preserve pending-question uncertainty in engineering review * fix: stabilize Windows reliability-wave fixtures * fix: clarify design consultation research workflow * fix: preserve independent design consultation inputs * fix: resolve design taste scope and browser research guidance * fix: make consultation opt-in preflight unambiguous * test: await native Edge owner readiness or terminal result --------- Co-authored-by: Bruce Krysiak <brucek@alum.mit.edu> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Antonio Vitalic <antoninte99@gmail.com>
This commit is contained in:
Garry Tan
co-authored by
Bruce Krysiak
Claude Opus 5.5
Antonio Vitalic
Bruce Krysiak
Claude Opus 5.5
Antonio Vitalic
parent
2a113ae7e6
commit
01593aa67c
+208
-66
@@ -26,7 +26,8 @@
|
||||
* ~/.gstack/builder-profile.jsonl — typed: builder-profile-entry
|
||||
*
|
||||
* State: ~/.gstack/.transcript-ingest-state.json (LOCAL per ED1, never synced).
|
||||
* Secret scanning: gitleaks via lib/gstack-memory-helpers#secretScanFile (D19).
|
||||
* Secret scanning: opt-in gitleaks over each rendered page via
|
||||
* lib/gstack-memory-helpers#secretScanText (D19).
|
||||
* Concurrent-write handling: partial-flag + re-ingest on next pass (D10).
|
||||
*
|
||||
* V1.0 NOTE: Cursor SQLite extraction is a V1.0.1 follow-up. The plan promoted it to
|
||||
@@ -46,6 +47,7 @@ import {
|
||||
writeFileSync,
|
||||
statSync,
|
||||
mkdirSync,
|
||||
mkdtempSync,
|
||||
appendFileSync,
|
||||
renameSync,
|
||||
openSync,
|
||||
@@ -54,7 +56,7 @@ import {
|
||||
rmSync,
|
||||
realpathSync,
|
||||
} from "fs";
|
||||
import { join, basename, dirname, delimiter } from "path";
|
||||
import { join, basename, dirname, delimiter, relative } from "path";
|
||||
import { execFileSync, spawnSync, spawn, type ChildProcess } from "child_process";
|
||||
import { homedir } from "os";
|
||||
import { createHash } from "crypto";
|
||||
@@ -62,6 +64,7 @@ import { createHash } from "crypto";
|
||||
import {
|
||||
canonicalizeRemote,
|
||||
secretScanFile,
|
||||
secretScanText,
|
||||
detectEngineTier,
|
||||
withErrorContext,
|
||||
} from "../lib/gstack-memory-helpers";
|
||||
@@ -84,7 +87,8 @@ interface CliArgs {
|
||||
limit: number | null;
|
||||
noWrite: boolean;
|
||||
/**
|
||||
* Opt-in per-file gitleaks scan during the prepare phase. Off by
|
||||
* Opt-in gitleaks scan of each rendered page during the prepare phase;
|
||||
* pages with findings, or that could not be scanned, are skipped. Off by
|
||||
* default — the cross-machine boundary (gstack-brain-sync, git push)
|
||||
* has its own scanner. Setting this adds ~4-8 min to cold runs.
|
||||
*/
|
||||
@@ -216,9 +220,9 @@ Options:
|
||||
--limit <N> Stop after N pages written (smoke testing).
|
||||
--no-write Skip gbrain put calls (still updates state file).
|
||||
Used by tests + dry runs without actual ingest.
|
||||
--scan-secrets Opt-in per-file gitleaks scan during prepare. Off by
|
||||
default; gstack-brain-sync already gates the git-push
|
||||
boundary. Adds ~4-8 min to cold runs.
|
||||
--scan-secrets Opt-in gitleaks scan of outgoing rendered pages, including
|
||||
resumed staging. Findings and incomplete scans block
|
||||
writes and remain retryable. Off by default.
|
||||
--help This text.
|
||||
`);
|
||||
}
|
||||
@@ -342,13 +346,13 @@ function fileSha256(path: string): string {
|
||||
}
|
||||
}
|
||||
|
||||
function fileChangedSinceState(path: string, state: IngestState): boolean {
|
||||
function fileChangedSinceState(path: string, state: IngestState, verifyHash = false): boolean {
|
||||
const entry = state.sessions[path];
|
||||
if (!entry) return true;
|
||||
try {
|
||||
const st = statSync(path);
|
||||
const mtimeNs = Math.floor(st.mtimeMs * 1e6);
|
||||
if (mtimeNs === entry.mtime_ns) return false;
|
||||
if (!verifyHash && mtimeNs === entry.mtime_ns) return false;
|
||||
const sha = fileSha256(path);
|
||||
if (sha === entry.sha256) {
|
||||
// mtime changed but content didn't; just refresh mtime to skip future hashing
|
||||
@@ -560,11 +564,10 @@ interface ParsedSession {
|
||||
partial: boolean;
|
||||
}
|
||||
|
||||
export function parseTranscriptJsonl(path: string): ParsedSession | null {
|
||||
export function parseTranscriptJsonl(path: string, raw?: string): ParsedSession | null {
|
||||
// Best-effort tolerant parser. Handles truncated last lines (D10 partial-flag).
|
||||
let raw: string;
|
||||
try {
|
||||
raw = readFileSync(path, "utf-8");
|
||||
raw ??= readFileSync(path, "utf-8");
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
@@ -812,10 +815,10 @@ export function buildTranscriptPage(path: string, session: ParsedSession): PageR
|
||||
};
|
||||
}
|
||||
|
||||
function buildArtifactPage(path: string, type: MemoryType): PageRecord {
|
||||
function buildArtifactPage(path: string, type: MemoryType, raw?: string): PageRecord {
|
||||
const stats = statSync(path);
|
||||
const sha = fileSha256(path);
|
||||
const raw = readFileSync(path, "utf-8");
|
||||
raw ??= readFileSync(path, "utf-8");
|
||||
|
||||
// Extract repo slug from path: ~/.gstack/projects/<slug>/...
|
||||
let slug_repo = "_unattributed";
|
||||
@@ -851,8 +854,8 @@ function buildArtifactPage(path: string, type: MemoryType): PageRecord {
|
||||
// Architecture (post plan-eng-review + Codex outside-voice):
|
||||
//
|
||||
// walkAllSources(ctx)
|
||||
// → for each path: mtime-skip / source-file gitleaks (D3) / parse / buildPage
|
||||
// → renderPageBody injects title/type/tags into YAML frontmatter
|
||||
// → for each path: mtime-skip / parse / buildPage
|
||||
// → renderPageBody injects title/type/tags; opt-in scan checks these bytes
|
||||
// → writeStaged: mkdir -p slug subdirs (D1), write ${slug}.md
|
||||
// → snapshot ~/.gbrain/sync-failures.jsonl byte-offset (D7)
|
||||
// → spawnSync `gbrain import <stagingDir> --no-embed --json` (D6)
|
||||
@@ -935,6 +938,8 @@ export function renderPageBody(page: PageRecord): string {
|
||||
return body;
|
||||
}
|
||||
|
||||
type SourceFingerprint = Pick<IngestState["sessions"][string], "mtime_ns" | "sha256">;
|
||||
|
||||
interface PreparedPage {
|
||||
/** Page slug (path-shaped, e.g. "transcripts/claude-code/foo"). */
|
||||
slug: string;
|
||||
@@ -942,6 +947,7 @@ interface PreparedPage {
|
||||
source_path: string;
|
||||
/** Full markdown including frontmatter — ready to write. */
|
||||
rendered_body: string;
|
||||
source_fingerprint?: SourceFingerprint;
|
||||
/** Carry-through fields for state recording on success. */
|
||||
page_slug: string;
|
||||
partial: boolean;
|
||||
@@ -955,6 +961,17 @@ interface PreparedPage {
|
||||
git_remote?: string;
|
||||
}
|
||||
|
||||
function sourceFingerprintForStamp(page: PreparedPage): SourceFingerprint | null {
|
||||
const current = {
|
||||
mtime_ns: Math.floor(statSync(page.source_path).mtimeMs * 1e6),
|
||||
sha256: fileSha256(page.source_path),
|
||||
};
|
||||
const prepared = page.source_fingerprint;
|
||||
if (!prepared) return current;
|
||||
if (current.mtime_ns !== prepared.mtime_ns || current.sha256 !== prepared.sha256) return null;
|
||||
return prepared;
|
||||
}
|
||||
|
||||
interface StagingResult {
|
||||
staging_dir: string;
|
||||
written: number;
|
||||
@@ -985,7 +1002,7 @@ export function stagedRelPath(slug: string): string {
|
||||
return `${slug}.md`;
|
||||
}
|
||||
|
||||
function writeStaged(prepared: PreparedPage[], stagingDir: string): StagingResult {
|
||||
function writeStaged(prepared: PreparedPage[], stagingDir: string, scanned = false): StagingResult {
|
||||
mkdirSync(stagingDir, { recursive: true });
|
||||
const stagedPathToSource = new Map<string, string>();
|
||||
const errors: Array<{ slug: string; error: string }> = [];
|
||||
@@ -993,13 +1010,23 @@ function writeStaged(prepared: PreparedPage[], stagingDir: string): StagingResul
|
||||
for (const p of prepared) {
|
||||
const relPath = stagedRelPath(p.slug);
|
||||
const absPath = join(stagingDir, relPath);
|
||||
let pendingDir: string | undefined;
|
||||
try {
|
||||
mkdirSync(dirname(absPath), { recursive: true });
|
||||
writeFileSync(absPath, p.rendered_body, "utf-8");
|
||||
if (scanned) {
|
||||
pendingDir = mkdtempSync(join(GSTACK_HOME, ".brain-ingest-write-"));
|
||||
const pendingPath = join(pendingDir, "page.md");
|
||||
writeFileSync(pendingPath, p.rendered_body, { encoding: "utf-8", mode: 0o600 });
|
||||
renameSync(pendingPath, absPath);
|
||||
} else {
|
||||
writeFileSync(absPath, p.rendered_body, "utf-8");
|
||||
}
|
||||
stagedPathToSource.set(relPath, p.source_path);
|
||||
written++;
|
||||
} catch (err) {
|
||||
errors.push({ slug: p.slug, error: (err as Error).message });
|
||||
} finally {
|
||||
if (pendingDir) rmSync(pendingDir, { recursive: true, force: true });
|
||||
}
|
||||
}
|
||||
return { staging_dir: stagingDir, written, errors, stagedPathToSource };
|
||||
@@ -1281,7 +1308,7 @@ async function probeMode(args: CliArgs): Promise<ProbeReport> {
|
||||
|
||||
const entry = state.sessions[path];
|
||||
if (!entry) newCount++;
|
||||
else if (fileChangedSinceState(path, state)) updatedCount++;
|
||||
else if (fileChangedSinceState(path, state, args.scanSecrets)) updatedCount++;
|
||||
else unchangedCount++;
|
||||
}
|
||||
|
||||
@@ -1372,9 +1399,9 @@ export function disambiguateSlugs(
|
||||
}
|
||||
|
||||
/**
|
||||
* Prepare phase: walk sources, apply incremental + optional-secret-scan filters,
|
||||
* parse transcripts/artifacts into PageRecord, render bodies with
|
||||
* frontmatter. Returns the PreparedPage[] to stage + counts of files
|
||||
* Prepare phase: walk sources, apply incremental filters, parse into PageRecord,
|
||||
* render bodies with frontmatter, then apply the optional secret scan.
|
||||
* Returns the PreparedPage[] to stage + counts of files
|
||||
* filtered at each gate.
|
||||
*
|
||||
* Secret scanning policy (post 2026-05-10 perf review):
|
||||
@@ -1397,6 +1424,7 @@ function preparePages(
|
||||
args: CliArgs,
|
||||
ctx: WalkContext,
|
||||
state: IngestState,
|
||||
scanRenderedPages = args.scanSecrets,
|
||||
): {
|
||||
prepared: PreparedPage[];
|
||||
skippedSecret: number;
|
||||
@@ -1406,6 +1434,7 @@ function preparePages(
|
||||
skippedPolicyDeny: number;
|
||||
parseFailed: number;
|
||||
partialPages: number;
|
||||
policyStoreExists: boolean;
|
||||
/**
|
||||
* #2392: set when the per-remote policy store EXISTS but could not be
|
||||
* read (corrupt file, spawn failure). The caller must abort before any
|
||||
@@ -1431,34 +1460,23 @@ function preparePages(
|
||||
for (const { path, type } of walkAllSources(ctx)) {
|
||||
if (args.limit !== null && !policyStoreExists && prepared.length >= args.limit) break;
|
||||
|
||||
if (args.mode === "incremental" && !fileChangedSinceState(path, state)) {
|
||||
if (args.mode === "incremental" && !fileChangedSinceState(path, state, args.scanSecrets)) {
|
||||
skippedDedup++;
|
||||
continue;
|
||||
}
|
||||
|
||||
// Optional belt-and-suspenders: when --scan-secrets is set, scan the
|
||||
// source file with gitleaks and skip dirty ones. Off by default
|
||||
// because gstack-brain-sync already gates the cross-machine boundary
|
||||
// and per-file gitleaks costs ~256ms/file (4-8 min on a real corpus).
|
||||
if (args.scanSecrets) {
|
||||
const scan = secretScanFile(path);
|
||||
if (scan.scanner === "gitleaks" && scan.findings.length > 0) {
|
||||
skippedSecret++;
|
||||
if (!args.quiet) {
|
||||
console.error(
|
||||
`[secret-scan match] ${path} (${scan.findings.length} finding${
|
||||
scan.findings.length === 1 ? "" : "s"
|
||||
}); skipped`,
|
||||
);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
let page: PageRecord;
|
||||
let sourceFingerprint: SourceFingerprint | undefined;
|
||||
try {
|
||||
let raw: string | undefined;
|
||||
if (args.scanSecrets) {
|
||||
const mtime_ns = Math.floor(statSync(path).mtimeMs * 1e6);
|
||||
const bytes = readFileSync(path);
|
||||
sourceFingerprint = { mtime_ns, sha256: createHash("sha256").update(bytes).digest("hex") };
|
||||
raw = bytes.toString("utf-8");
|
||||
}
|
||||
if (type === "transcript") {
|
||||
const session = parseTranscriptJsonl(path);
|
||||
const session = parseTranscriptJsonl(path, raw);
|
||||
if (!session) {
|
||||
parseFailed++;
|
||||
continue;
|
||||
@@ -1473,7 +1491,7 @@ function preparePages(
|
||||
}
|
||||
page = buildTranscriptPage(path, session);
|
||||
} else {
|
||||
page = buildArtifactPage(path, type);
|
||||
page = buildArtifactPage(path, type, raw);
|
||||
}
|
||||
} catch (err) {
|
||||
parseFailed++;
|
||||
@@ -1481,10 +1499,40 @@ function preparePages(
|
||||
continue;
|
||||
}
|
||||
|
||||
const renderedBody = renderPageBody(page);
|
||||
|
||||
// Optional belt-and-suspenders: when --scan-secrets is set, gitleaks the
|
||||
// rendered page — the exact bytes writeStaged() hands to gbrain — and
|
||||
// skip the file on any finding. Scanning the source file instead missed
|
||||
// secrets that JSON escaping hides from gitleaks' rules (`KEY=\"v\"` in
|
||||
// the .jsonl, `KEY="v"` in the page). A scan that could not run
|
||||
// (scanner "missing" or "error") skips the file too: the flag promises
|
||||
// nothing unscanned gets imported. Skipped files are not recorded in
|
||||
// state, so the next run retries them. Off by default because
|
||||
// gstack-brain-sync already gates the cross-machine boundary and
|
||||
// per-file gitleaks costs ~256ms/file (4-8 min on a real corpus).
|
||||
if (scanRenderedPages) {
|
||||
const scan = secretScanText(renderedBody);
|
||||
if (!scan.scanned || scan.scanner !== "gitleaks" || scan.findings.length > 0) {
|
||||
skippedSecret++;
|
||||
if (!args.quiet) {
|
||||
console.error(
|
||||
scan.scanner === "gitleaks"
|
||||
? `[secret-scan match] ${path} (${scan.findings.length} finding${
|
||||
scan.findings.length === 1 ? "" : "s"
|
||||
}); skipped`
|
||||
: `[secret-scan ${scan.scanner}] ${path} (gitleaks could not scan it); skipped`,
|
||||
);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
prepared.push({
|
||||
slug: page.slug,
|
||||
source_path: path,
|
||||
rendered_body: renderPageBody(page),
|
||||
rendered_body: renderedBody,
|
||||
source_fingerprint: sourceFingerprint,
|
||||
page_slug: page.slug,
|
||||
partial: page.partial ?? false,
|
||||
type,
|
||||
@@ -1575,6 +1623,7 @@ function preparePages(
|
||||
skippedPolicyDeny,
|
||||
parseFailed,
|
||||
partialPages,
|
||||
policyStoreExists,
|
||||
policyError,
|
||||
};
|
||||
}
|
||||
@@ -1915,9 +1964,16 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
const t0 = Date.now();
|
||||
const state = loadState();
|
||||
const ctx = makeWalkContext(args, state);
|
||||
const remoteHttpMode = isRemoteHttpMcpMode();
|
||||
const resumeDir = process.env.GSTACK_INGEST_RESUME_DIR;
|
||||
const resuming = !args.noWrite && !remoteHttpMode
|
||||
&& typeof resumeDir === "string"
|
||||
&& resumeDir.length > 0
|
||||
&& existsSync(resumeDir)
|
||||
&& checkOwnedStagingDir(resumeDir, GSTACK_HOME).ok;
|
||||
|
||||
// Phase 1: prepare (parse + secret-scan + filter + render frontmatter).
|
||||
const prep = preparePages(args, ctx, state);
|
||||
// Phase 1: prepare (parse + render frontmatter + secret-scan + filter).
|
||||
const prep = preparePages(args, ctx, state, args.scanSecrets && !resuming);
|
||||
|
||||
let written = 0;
|
||||
let failed = 0;
|
||||
@@ -1949,9 +2005,10 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
const nowIso = new Date().toISOString();
|
||||
for (const p of prep.prepared) {
|
||||
try {
|
||||
const fingerprint = sourceFingerprintForStamp(p);
|
||||
if (!fingerprint) continue;
|
||||
state.sessions[p.source_path] = {
|
||||
mtime_ns: Math.floor(statSync(p.source_path).mtimeMs * 1e6),
|
||||
sha256: fileSha256(p.source_path),
|
||||
...fingerprint,
|
||||
ingested_at: nowIso,
|
||||
page_slug: p.page_slug,
|
||||
partial: p.partial,
|
||||
@@ -2026,17 +2083,10 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
// at an existing dir from a prior SIGTERM'd run), reuse that staging dir
|
||||
// and skip the prepare/writeStaged phase entirely. gbrain's checkpoint
|
||||
// tells it where to resume.
|
||||
const remoteHttpMode = isRemoteHttpMcpMode();
|
||||
const resumeDir = process.env.GSTACK_INGEST_RESUME_DIR;
|
||||
// #1802 second entry point: this binary is runnable directly, so it must not
|
||||
// trust GSTACK_INGEST_RESUME_DIR just because it exists — a stale/poisoned env
|
||||
// could make us `gbrain import` (and later clean up) an arbitrary directory.
|
||||
// Prove ownership here too, independently of the orchestrator's decideResume.
|
||||
const resuming = !remoteHttpMode
|
||||
&& typeof resumeDir === "string"
|
||||
&& resumeDir.length > 0
|
||||
&& existsSync(resumeDir)
|
||||
&& checkOwnedStagingDir(resumeDir, GSTACK_HOME).ok;
|
||||
if (!remoteHttpMode && resumeDir && resumeDir.length > 0 && !resuming) {
|
||||
console.error(
|
||||
`[memory-ingest] ignoring GSTACK_INGEST_RESUME_DIR="${resumeDir}" — not a proven staging dir (#1802); staging fresh.`,
|
||||
@@ -2058,10 +2108,88 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
// pointing at this staging dir, so the finally preserves it for the next run
|
||||
// instead of deleting it (the SIGTERM forwarder's preserve branch only runs
|
||||
// when the PARENT is signalled, which an internal timeout never does).
|
||||
let preserveStaging = false;
|
||||
let preserveStaging = resuming && args.scanSecrets;
|
||||
const enforceResumePolicy = resuming && hasRepoPolicyStore();
|
||||
try {
|
||||
let staging: StagingResult;
|
||||
if (resuming) {
|
||||
const stagedPagePaths = new Set<string>();
|
||||
const stagedPathToSource = new Map<string, string>();
|
||||
if (args.scanSecrets || enforceResumePolicy) {
|
||||
try {
|
||||
if (enforceResumePolicy && !prep.policyStoreExists) {
|
||||
throw new Error("[repo policy] policy store appeared after source preparation");
|
||||
}
|
||||
const eligiblePages = enforceResumePolicy
|
||||
? new Map(prep.prepared.map((p) => [stagedRelPath(p.slug), p]))
|
||||
: null;
|
||||
const pending = [stagingDir];
|
||||
while (pending.length > 0) {
|
||||
const dir = pending.pop()!;
|
||||
for (const entry of readdirSync(dir, { withFileTypes: true })) {
|
||||
const path = join(dir, entry.name);
|
||||
if (entry.isDirectory()) pending.push(path);
|
||||
else if (entry.isFile()) {
|
||||
if (path === join(stagingDir, STAGING_MARKER)) continue;
|
||||
if (args.scanSecrets) {
|
||||
const scan = secretScanFile(path);
|
||||
if (!scan.scanned || scan.scanner !== "gitleaks" || scan.findings.length > 0) {
|
||||
const reason = scan.scanned ? "match" : scan.scanner;
|
||||
throw new Error(`[secret-scan ${reason}] ${path}`);
|
||||
}
|
||||
}
|
||||
if (entry.name.endsWith(".md")) {
|
||||
const relPath = relative(stagingDir, path).split("\\").join("/");
|
||||
stagedPagePaths.add(relPath);
|
||||
if (eligiblePages) {
|
||||
const page = eligiblePages.get(relPath);
|
||||
if (!page || readFileSync(path, "utf-8") !== page.rendered_body) {
|
||||
throw new Error(`[repo policy] staged page is not a current permitted source: ${relPath}`);
|
||||
}
|
||||
stagedPathToSource.set(relPath, page.source_path);
|
||||
}
|
||||
} else if (enforceResumePolicy) {
|
||||
throw new Error(`[repo policy] unrecognized staged file: ${path}`);
|
||||
}
|
||||
} else {
|
||||
throw new Error(`[${args.scanSecrets ? "secret-scan error" : "repo policy"}] unsupported staging entry: ${path}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
if (stagedPagePaths.size === 0) {
|
||||
throw new Error(`[${args.scanSecrets ? "secret-scan error" : "repo policy"}] resumed staging contains no pages`);
|
||||
}
|
||||
if (!enforceResumePolicy) {
|
||||
for (const p of prep.prepared) {
|
||||
const path = stagedRelPath(p.slug);
|
||||
if (stagedPagePaths.has(path) && readFileSync(join(stagingDir, path), "utf-8") === p.rendered_body) {
|
||||
stagedPathToSource.set(path, p.source_path);
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
preserveStaging = true;
|
||||
const cause = (err as Error).message;
|
||||
const scannerFailed = cause.startsWith("[secret-scan");
|
||||
const msg = `${cause}; resumed import refused. Staging preserved; ` +
|
||||
(scannerFailed
|
||||
? "repair gitleaks and retry, or rerun without resume to restage."
|
||||
: "rerun without resume to restage under the current repo policy.");
|
||||
console.error(`[memory-ingest] ERR: ${msg}`);
|
||||
return {
|
||||
written: 0,
|
||||
skipped_secret: prep.skippedSecret + (scannerFailed ? 1 : 0),
|
||||
skipped_dedup: prep.skippedDedup,
|
||||
skipped_unattributed: prep.skippedUnattributed,
|
||||
skipped_policy_readonly: prep.skippedPolicyReadonly,
|
||||
skipped_policy_deny: prep.skippedPolicyDeny,
|
||||
failed: prep.parseFailed + prep.prepared.length,
|
||||
duration_ms: Date.now() - t0,
|
||||
partial_pages: prep.partialPages,
|
||||
system_error: msg,
|
||||
};
|
||||
}
|
||||
}
|
||||
// Pages are already on disk from the previous run. Skip writeStaged.
|
||||
// The "written" count for the verdict reflects what's on disk now;
|
||||
// gbrain's import will skip already-completed entries via its own
|
||||
@@ -2075,13 +2203,19 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
// readNewFailures() can still map gbrain's per-file failures back to
|
||||
// sources on resume. An empty map made every failed file fall through to
|
||||
// state-recording — i.e. silently marked ingested despite failing.
|
||||
const stagedPathToSource = new Map<string, string>();
|
||||
for (const p of prep.prepared) {
|
||||
stagedPathToSource.set(stagedRelPath(p.slug), p.source_path);
|
||||
if (!args.scanSecrets && !enforceResumePolicy) {
|
||||
for (const p of prep.prepared) {
|
||||
stagedPathToSource.set(stagedRelPath(p.slug), p.source_path);
|
||||
}
|
||||
}
|
||||
staging = { staging_dir: stagingDir, written: prep.prepared.length, errors: [], stagedPathToSource };
|
||||
staging = {
|
||||
staging_dir: stagingDir,
|
||||
written: args.scanSecrets || enforceResumePolicy ? stagedPagePaths.size : prep.prepared.length,
|
||||
errors: [],
|
||||
stagedPathToSource,
|
||||
};
|
||||
} else {
|
||||
staging = writeStaged(prep.prepared, stagingDir);
|
||||
staging = writeStaged(prep.prepared, stagingDir, args.scanSecrets);
|
||||
}
|
||||
failed += staging.errors.length;
|
||||
if (!args.quiet && staging.errors.length > 0) {
|
||||
@@ -2124,9 +2258,11 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
const nowIso = new Date().toISOString();
|
||||
for (const p of prep.prepared) {
|
||||
try {
|
||||
if (args.scanSecrets && staging.stagedPathToSource.get(stagedRelPath(p.slug)) !== p.source_path) continue;
|
||||
const fingerprint = sourceFingerprintForStamp(p);
|
||||
if (!fingerprint) continue;
|
||||
state.sessions[p.source_path] = {
|
||||
mtime_ns: Math.floor(statSync(p.source_path).mtimeMs * 1e6),
|
||||
sha256: fileSha256(p.source_path),
|
||||
...fingerprint,
|
||||
ingested_at: nowIso,
|
||||
page_slug: p.page_slug,
|
||||
partial: p.partial,
|
||||
@@ -2315,7 +2451,7 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
// run artifacts-init, collect_files returns 0 for every batch.
|
||||
//
|
||||
// `skipped` counts content_hash no-ops, which ARE successful landings.
|
||||
const expectedLandings = prep.prepared.length - failedSources.size;
|
||||
const expectedLandings = (args.scanSecrets || enforceResumePolicy ? staging.written : prep.prepared.length) - failedSources.size;
|
||||
const accountedLandings =
|
||||
(importJson.imported ?? 0) + (importJson.skipped ?? 0);
|
||||
if (accountedLandings < expectedLandings) {
|
||||
@@ -2353,9 +2489,13 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
for (const p of prep.prepared) {
|
||||
if (failedSources.has(p.source_path)) continue;
|
||||
try {
|
||||
if ((args.scanSecrets || enforceResumePolicy) && staging.stagedPathToSource.get(stagedRelPath(p.slug)) !== p.source_path) continue;
|
||||
if (resuming && (args.scanSecrets || enforceResumePolicy) &&
|
||||
readFileSync(join(stagingDir, stagedRelPath(p.slug)), "utf-8") !== p.rendered_body) continue;
|
||||
const fingerprint = sourceFingerprintForStamp(p);
|
||||
if (!fingerprint) continue;
|
||||
state.sessions[p.source_path] = {
|
||||
mtime_ns: Math.floor(statSync(p.source_path).mtimeMs * 1e6),
|
||||
sha256: fileSha256(p.source_path),
|
||||
...fingerprint,
|
||||
ingested_at: nowIso,
|
||||
page_slug: p.page_slug,
|
||||
partial: p.partial,
|
||||
@@ -2374,6 +2514,8 @@ async function ingestPass(args: CliArgs): Promise<BulkResult> {
|
||||
}
|
||||
}
|
||||
|
||||
if (resuming && (args.scanSecrets || enforceResumePolicy)) preserveStaging = written < staging.written || failedSources.size > 0;
|
||||
|
||||
if (!args.quiet) {
|
||||
console.error(
|
||||
`[memory-ingest] gbrain import: ${importJson.imported ?? 0} imported, ` +
|
||||
|
||||
Reference in New Issue
Block a user