2 Commits

Include renames

Author	SHA1	Message	Date
3 people	5c49225e4b	v0.42.45.0 feat(sync): delta-aware cost estimator — stop wedging the daily cron (#2139) (#2224) ... * feat(core): shared computeSyncDelta + spend-posture module (#2139) sync-delta.ts: ONE implementation of "what changed since last_commit", consumed by both the sync executor and the inline cost estimator so the gate's dollar figure can't drift from what the sync imports. spend-posture.ts: spend.posture config + parseUsdLimit/formatUsdLimit off-switch parsing (off/unlimited/none → Infinity; undefined at the budget boundary so ledger rows never serialize null). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(sync): delta-aware cost estimator + non-TTY auto-defer + per-source failure acks (#2139) The inline-embed cost gate was a ~400x phantom: it priced the entire tree whenever the working tree was dirty (always, on an active brain), then blocked the daily cron with exit 2. Now: - performSyncInner + the estimator both route through computeSyncDelta, so the estimate mirrors execution (fetch-first delta; dirty-but-caught-up tree → $0). - shouldBlockSync is posture-aware; non-TTY above floor AUTO-DEFERS embeds to capped backfill jobs (exit 0) instead of wedging — single shared runInlineCostGate on both --all and single-source paths. - --full prices delta + stale backlog (full sync sweeps it inline). - off/unlimited on the cost knobs; tokenmax bypasses the backfill cap (still ledgered) but never the cooldown. - --skip-failed/--retry-failed scoped per source; the D15 parallel refusal is lifted (the #1939 ledger is per-source + lock-serialized). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(config): register spend-control keys + validate spend.posture (#2139) Adds spend.posture + the five previously --force-only spend knobs to KNOWN_CONFIG_KEYS so `config set` accepts them directly (removes the archaeology the issue complained about), and rejects invalid spend.posture values at set time with a paste-ready hint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(reindex,enrich,onboard): spend.posture across the remaining cost gates (#2139) reindex-code: tokenmax makes the cost gate informational; --max-cost accepts off/unlimited. enrich + onboard --auto: tokenmax lifts the refuse-without-cap guardrail and runs UNCAPPED (spend still ledgered by BudgetTracker). Explicit --max-usd always wins over posture. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: cost-gate, delta estimator, spend-posture, off-switch coverage (#2139) New sync-delta + sync-cost-estimate unit suites; rewritten cost-gate serial tests (auto-defer instead of exit 2, posture, off-switch, format split, single-source); parseUsdLimit/posture-aware shouldBlockSync; backfill cap-off + tokenmax-bypass + cooldown-still-refuses; config known-key acceptance. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(spend-controls): single spend-control surface + ref-map + follow-up TODOs (#2139) New docs/operations/spend-controls.md (every gate, key, default, off switch, posture interaction); CLAUDE.md reference-map row; two P3 follow-up TODOs (measured chunk-count gating, per-source defer granularity). llms bundles regenerated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(spend): SSRF-harden estimator fetch + complete off/uncapped across reindex/enrich/onboard (#2139) Ship-stage codex pre-landing review caught four P1s in the secondary cost gates: - The delta estimator's fetch-first ran `git fetch` through the plain git() helper, bypassing the GIT_SSRF_FLAGS + GIT_TERMINAL_PROMPT=0 hardening that real sync uses. Added `fetchRemote()` to git-remote.ts (same flags as pullRepo) and route the estimator through it — a cost preview / dry-run can no longer hit a remote through a less-protected path. - `reindex --max-cost off`, `enrich --max-usd off`, `onboard --auto --max-usd off` were parsed but didn't actually proceed/uncap. Now: explicit off (and spend.posture=tokenmax) proceed past the confirmation/missing-cap refusal AND run uncapped. enrich threads an Infinity sentinel mapped to "no BudgetTracker ceiling" (never raw Infinity → no null in audit rows); reindex/onboard use their native undefined=uncapped path. Spend still ledgered. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v0.42.45.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(KEY_FILES): update sync/embedding/git-remote/reindex entries to post-#2139 truth document-release pass: the cost-gate entries described the pre-#2139 behavior (full-tree-ceiling estimator, --skip-failed-rejects-under-parallel, exit-2 confirmation gate). Updated to current truth — delta-aware estimator via the shared computeSyncDelta, per-source failure acks under parallel, non-TTY auto-defer (no exit 2), posture-aware shouldBlockSync. Added entries for the two new core modules (sync-delta.ts, spend-posture.ts) + fetchRemote on git-remote.ts + reindex --max-cost off. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-16 15:08:47 -07:00
3 people	df86ea5f1d	v0.40.5.0 Federated Sync v2 — parallel source sync + push triggers + per-source health (#1322) ... * wip: federated sync v2 pre-merge snapshot * v0.40.5.0 Federated Sync v2 — parallel source sync + push triggers + per-source health Bump VERSION + package.json + CHANGELOG header + migration walkthrough filename to v0.40.5.0 (claiming the next free slot in the v0.40.x patch series after master's v0.40.1.0). What ships (6 components, all behind sync.federated_v2 feature flag default-on): 1. Per-source sync lock — syncLockId(sourceId), phantom-redirect parity 2. Parallel sync --all — pMapAllSettled fan-out, --max-sources N cap 3. embed-backfill minion handler — D2 per-source lock + D6 $10/job budget + D15.1 fire-and-forget submission + D19 source-level cooldown + 24h $25 rolling cap 4. sync trigger CLI + POST /webhooks/github — HMAC-verified (60 req/min/IP), X-GitHub-Event=push + ref filter against tracked_branch 5. sources status + federation_health doctor — batched GROUP BY pipeline (4 queries instead of 6×N per-source roundtrips) 6. sources federate/unfederate hook — auto-submit embed-backfill on flip Correctness fixes (unconditional): - D21: sync.ts:959 facts backstop now passes sourceId to engine.getPage - D15.4: redactSourceConfig + CI guard prevent webhook_secret leak - D15.5: safeHexEqual extracted to src/core/timing-safe.ts Schema: - Migration v89 (sources_github_repo_index): partial expression index on config->>'github_repo' for fast webhook source-lookup Tests: - 14 new test files, 112 cases. 4 IRON-RULE regressions pinned (SYNC_LOCK_ID back-compat, phantom per-source lock, embed-backfill kill+resume, webhook HMAC prefix-strip). All 9449 unit tests pass. Caught at test-write time: the webhook handler had a Buffer.from('sha256=...', 'hex') truncation bug — without the prefix-strip, every signature would have "matched" empty buffers. Pinned by a test/sources-webhook.test.ts IRON-RULE. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(check-source-config-leak): tighten regex to source-row patterns only The v0.40.5.0 wave added scripts/check-source-config-leak.sh with a too-broad pattern (JSON\.stringify\(.*config) that flagged any variable named 'config' — catching the GLOBAL gbrain config.json serializers in src/commands/init.ts (status envelopes) and src/core/config.ts (the config-file write site). On the CI runner without rg installed, the grep -rE fallback fired correctly and produced 4 false positives that broke the `verify` script. Tightened the patterns to specifically match `(source|src|row|s).config` property access — the actual risk shape (a sources-table row being serialized whole). The global gbrain config has a different shape and threat model (file-mode 0o600 at the write site), so it's safe to exempt at the regex level rather than per-file whitelist. Also fixed a latent bug: the rg branch used `--include='*.ts'` (grep's flag, not rg's). rg silently rejected it and CANDIDATES came back empty, so the local-dev runs (which have rg) would never have caught a real leak. Now branches on tool availability: `-g '*.ts'` for rg, `--include` for grep -rE. Both branches verified against a synthetic leak fixture. Also added init.ts + config.ts to the whitelist as a belt-and-suspenders since they handle gbrain-global config (not source rows) and could otherwise reflect-back via regex iteration. CI: `bun run verify` exit 0 locally with both the original false-positive fixture (clean repo) and a synthetic leak fixture (correctly caught, exit 1). --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 10:21:59 -07:00