mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-27 22:15:33 +00:00
* feat(core): shared computeSyncDelta + spend-posture module (#2139) sync-delta.ts: ONE implementation of "what changed since last_commit", consumed by both the sync executor and the inline cost estimator so the gate's dollar figure can't drift from what the sync imports. spend-posture.ts: spend.posture config + parseUsdLimit/formatUsdLimit off-switch parsing (off/unlimited/none → Infinity; undefined at the budget boundary so ledger rows never serialize null). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(sync): delta-aware cost estimator + non-TTY auto-defer + per-source failure acks (#2139) The inline-embed cost gate was a ~400x phantom: it priced the entire tree whenever the working tree was dirty (always, on an active brain), then blocked the daily cron with exit 2. Now: - performSyncInner + the estimator both route through computeSyncDelta, so the estimate mirrors execution (fetch-first delta; dirty-but-caught-up tree → $0). - shouldBlockSync is posture-aware; non-TTY above floor AUTO-DEFERS embeds to capped backfill jobs (exit 0) instead of wedging — single shared runInlineCostGate on both --all and single-source paths. - --full prices delta + stale backlog (full sync sweeps it inline). - off/unlimited on the cost knobs; tokenmax bypasses the backfill cap (still ledgered) but never the cooldown. - --skip-failed/--retry-failed scoped per source; the D15 parallel refusal is lifted (the #1939 ledger is per-source + lock-serialized). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(config): register spend-control keys + validate spend.posture (#2139) Adds spend.posture + the five previously --force-only spend knobs to KNOWN_CONFIG_KEYS so `config set` accepts them directly (removes the archaeology the issue complained about), and rejects invalid spend.posture values at set time with a paste-ready hint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(reindex,enrich,onboard): spend.posture across the remaining cost gates (#2139) reindex-code: tokenmax makes the cost gate informational; --max-cost accepts off/unlimited. enrich + onboard --auto: tokenmax lifts the refuse-without-cap guardrail and runs UNCAPPED (spend still ledgered by BudgetTracker). Explicit --max-usd always wins over posture. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: cost-gate, delta estimator, spend-posture, off-switch coverage (#2139) New sync-delta + sync-cost-estimate unit suites; rewritten cost-gate serial tests (auto-defer instead of exit 2, posture, off-switch, format split, single-source); parseUsdLimit/posture-aware shouldBlockSync; backfill cap-off + tokenmax-bypass + cooldown-still-refuses; config known-key acceptance. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(spend-controls): single spend-control surface + ref-map + follow-up TODOs (#2139) New docs/operations/spend-controls.md (every gate, key, default, off switch, posture interaction); CLAUDE.md reference-map row; two P3 follow-up TODOs (measured chunk-count gating, per-source defer granularity). llms bundles regenerated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(spend): SSRF-harden estimator fetch + complete off/uncapped across reindex/enrich/onboard (#2139) Ship-stage codex pre-landing review caught four P1s in the secondary cost gates: - The delta estimator's fetch-first ran `git fetch` through the plain git() helper, bypassing the GIT_SSRF_FLAGS + GIT_TERMINAL_PROMPT=0 hardening that real sync uses. Added `fetchRemote()` to git-remote.ts (same flags as pullRepo) and route the estimator through it — a cost preview / dry-run can no longer hit a remote through a less-protected path. - `reindex --max-cost off`, `enrich --max-usd off`, `onboard --auto --max-usd off` were parsed but didn't actually proceed/uncap. Now: explicit off (and spend.posture=tokenmax) proceed past the confirmation/missing-cap refusal AND run uncapped. enrich threads an Infinity sentinel mapped to "no BudgetTracker ceiling" (never raw Infinity → no null in audit rows); reindex/onboard use their native undefined=uncapped path. Spend still ledgered. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: bump version and changelog (v0.42.45.0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(KEY_FILES): update sync/embedding/git-remote/reindex entries to post-#2139 truth document-release pass: the cost-gate entries described the pre-#2139 behavior (full-tree-ceiling estimator, --skip-failed-rejects-under-parallel, exit-2 confirmation gate). Updated to current truth — delta-aware estimator via the shared computeSyncDelta, per-source failure acks under parallel, non-TTY auto-defer (no exit 2), posture-aware shouldBlockSync. Added entries for the two new core modules (sync-delta.ts, spend-posture.ts) + fetchRemote on git-remote.ts + reindex --max-cost off. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
54 lines
2.8 KiB
TypeScript
54 lines
2.8 KiB
TypeScript
/**
|
|
* v0.42.42.0 (#2139) — `--max-usd off` / `--max-cost off` uncapped-switch pins
|
|
* across enrich / onboard / reindex (the T6 secondary cost gates).
|
|
*
|
|
* The enrich arg parser carries the real logic (off → Infinity sentinel, mapped
|
|
* to "no BudgetTracker ceiling" in runEnrichCore), so it gets a direct unit test.
|
|
* reindex + onboard detect `off` inline at the CLI dispatch and proceed past the
|
|
* confirmation / missing-cap refusal; those are pinned as source-level regression
|
|
* guards (the codex pre-landing review found all three half-built — these keep
|
|
* them from silently regressing without standing up full CLI+gateway harnesses).
|
|
*/
|
|
import { describe, test, expect } from 'bun:test';
|
|
import { parseArgs } from '../src/commands/enrich.ts';
|
|
|
|
describe('enrich parseArgs — --max-usd off → uncapped (Infinity sentinel)', () => {
|
|
test('off / unlimited / none (case-insensitive) → Infinity', () => {
|
|
for (const v of ['off', 'OFF', 'unlimited', 'none', 'None']) {
|
|
expect(parseArgs(['--max-usd', v]).maxCostUsd).toBe(Infinity);
|
|
}
|
|
// --max-cost-usd alias too.
|
|
expect(parseArgs(['--max-cost-usd', 'off']).maxCostUsd).toBe(Infinity);
|
|
});
|
|
test('finite positive number passes through; absent → undefined; garbage → undefined', () => {
|
|
expect(parseArgs(['--max-usd', '5']).maxCostUsd).toBe(5);
|
|
expect(parseArgs([]).maxCostUsd).toBeUndefined();
|
|
expect(parseArgs(['--max-usd', 'abc']).maxCostUsd).toBeUndefined();
|
|
expect(parseArgs(['--max-usd', '0']).maxCostUsd).toBeUndefined(); // non-positive ignored
|
|
});
|
|
});
|
|
|
|
describe('reindex / onboard off-switch dispatch (regression guards)', () => {
|
|
test('reindex-code: --max-cost off proceeds past the confirmation gate', async () => {
|
|
const src = await Bun.file(new URL('../src/commands/reindex-code.ts', import.meta.url)).text();
|
|
// off sets maxCostOff and the gate proceeds when (tokenmax || maxCostOff).
|
|
expect(src).toMatch(/maxCostOff\s*=\s*true/);
|
|
expect(src).toMatch(/posture === 'tokenmax' \|\| maxCostOff/);
|
|
});
|
|
|
|
test('onboard: --max-usd off lifts the --auto missing-cap refusal', async () => {
|
|
const src = await Bun.file(new URL('../src/commands/onboard.ts', import.meta.url)).text();
|
|
expect(src).toMatch(/maxUsdOff\s*=/);
|
|
// refusal skipped when (maxUsdOff || tokenmax).
|
|
expect(src).toMatch(/maxUsdOff \|\| tokenmax/);
|
|
});
|
|
|
|
test('enrich: uncapped path maps the Infinity sentinel to no BudgetTracker ceiling', async () => {
|
|
const src = await Bun.file(new URL('../src/commands/enrich.ts', import.meta.url)).text();
|
|
// The sentinel must become `undefined` at the tracker (never raw Infinity,
|
|
// which serializes to null in audit rows).
|
|
expect(src).toMatch(/opts\.maxCostUsd === Infinity \? undefined/);
|
|
expect(src).toMatch(/uncapped \? Infinity : parsed\.maxCostUsd/);
|
|
});
|
|
});
|