Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 77 Pull Requests 10 Actions Packages Projects Releases Wiki Activity

fix(recovery): address PR #703 review findings F1-F6 (#702)

Browse Source 
Fixes the six defects from the formal REQUEST_CHANGES review at
889931d553:

- F1: run sanctioned stale-binding recovery in
  gitea_resolve_task_capability BEFORE the terminal launcher probe, so a
  worktree removed mid-session can no longer wedge mutation resolution on
  'missing cwd' before recovery runs. The fail-closed probe block now also
  carries the binding classification evidence.
- F2: _resolve_preflight_workspace_path resolves with the same
  verify_paths existence checks as the canonical mutation context, and
  _get_workspace_porcelain returns a synthetic tracked-dirty sentinel when
  the workspace is missing or git fails — an uninspectable workspace can
  never read as clean/empty porcelain.
- F3: the orphaned_expired_superseded_head cleanup matrix now requires
  affirmative safe worktree evidence (worktree_clean=true or
  worktree_exists=false), aligned with the sibling orphaned_owner_missing
  gate and the diagnosis path; unknown evidence fails closed.
- F4: reviewer-session-lease shadows and stale-binding audit records are
  recovery-critical kinds exempt from the 4h session-state TTL; they
  persist until a sanctioned clear terminally reconciles them.
- F5: session-lease shadows are keyed by lease session id (collision-safe
  identity) with a list_states enumeration API; concurrent same-profile
  sessions can no longer overwrite or misattribute each other's crash
  evidence. Legacy single-slot records remain readable.
- F6: the durable audit record is persisted (status=pending) BEFORE the
  environment binding is cleared; if audit persistence fails the clear
  does not happen and the failure is reported explicitly.

30 new regression tests cover deleted-worktree recovery ordering, missing/
deleted/symlinked/mid-evaluation path changes, unknown-evidence cleanup,
TTL boundary (before/at/after), interleaved and reconnected concurrent
sessions, and audit-write failure/retry/idempotence/ordering.

Issue #704 dotenv load-path prevention is intentionally NOT included.

Full suite: 2695 passed, 6 skipped, 161 subtests passed.

Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
sysadmin
2026-07-13 16:40:58 -04:00
co-authored by Claude Fable 5
parent 889931d553
commit c2fc2683b9
4 changed files with 947 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gitea_mcp_server.py
+109 -29
View File
@@ -298,23 +298,61 @@ def _assess_stale_active_binding(auto_recover: bool = False) -> dict:
not _preflight_in_test_mode()
or os.environ.get("GITEA_FORCE_STALE_BINDING_RECOVERY") == "1"
)
audit_persisted: bool | None = None
if auto_recover and plan.get("clear_allowed") and recovery_enabled:
applied = stale_binding_recovery.apply_recovery(plan)
if applied.get("performed"):
try:
import mcp_session_state as mss
# #702 F6: the durable audit record must exist BEFORE the environment
# is cleared. If audit persistence fails the recovery does not run —
# an env clear without durable proof is an unauditable mutation.
pending_value = (os.environ.get(ACTIVE_WORKTREE_ENV) or "").strip() or None
audit_error: str | None = None
try:
import mcp_session_state as mss
mss.save_state(
kind=mss.KIND_STALE_BINDING_RECOVERY,
payload={
"cleared_env": applied.get("cleared_env"),
"cleared_value": applied.get("cleared_value"),
"classification": applied.get("classification"),
"reasons": applied.get("reasons"),
},
)
except Exception:
pass
mss.save_state(
kind=mss.KIND_STALE_BINDING_RECOVERY,
payload={
"cleared_env": ACTIVE_WORKTREE_ENV,
"cleared_value": pending_value,
"classification": plan.get("classification"),
"reasons": list(plan.get("reasons") or []),
"recovery_status": "pending",
},
)
audit_persisted = True
except Exception as exc:
audit_persisted = False
audit_error = f"{type(exc).__name__}: {exc}"
if audit_persisted:
applied = stale_binding_recovery.apply_recovery(plan)
if applied.get("performed"):
try:
import mcp_session_state as mss
mss.save_state(
kind=mss.KIND_STALE_BINDING_RECOVERY,
payload={
"cleared_env": applied.get("cleared_env"),
"cleared_value": applied.get("cleared_value"),
"classification": applied.get("classification"),
"reasons": applied.get("reasons"),
"recovery_status": "performed",
},
)
except Exception:
# The pre-clear "pending" record is already durable; the
# status refresh is best-effort and never rolls back.
pass
else:
applied = {
"performed": False,
"action": stale_binding_recovery.RECOVERY_ACTION_NONE,
"audit_write_failed": True,
"reasons": [
"audit persistence failed; stale binding NOT cleared "
"(fail closed, #702 F6)"
]
+ ([audit_error] if audit_error else []),
}
report = {
"classification": classification.get("classification"),
"active_worktree": classification.get("active_worktree"),
@@ -324,6 +362,13 @@ def _assess_stale_active_binding(auto_recover: bool = False) -> dict:
"recovery_performed": bool(applied.get("performed")),
"reasons": classification.get("reasons") or [],
}
if audit_persisted is not None:
report["audit_persisted"] = audit_persisted
if applied.get("audit_write_failed"):
report["audit_write_failed"] = True
report["reasons"] = list(report["reasons"]) + list(
applied.get("reasons") or []
)
if applied.get("performed"):
report["cleared_value"] = applied.get("cleared_value")
if plan.get("exact_next_action"):
@@ -332,7 +377,13 @@ def _assess_stale_active_binding(auto_recover: bool = False) -> dict:
def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
"""Resolve the namespace-scoped workspace root inspected by pre-flight guards."""
"""Resolve the namespace-scoped workspace root inspected by pre-flight guards.
#702 F2: preflight resolves with the same existence verification as the
canonical mutation context (verify_paths). A dead env binding must demote
here exactly as it does in :func:`_resolve_namespace_mutation_context`,
or preflight would inspect a path the mutation guard never uses.
"""
role = _effective_workspace_role()
workspace, _source = nwb.resolve_namespace_workspace(
role_kind=role,
@@ -342,6 +393,7 @@ def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
_reviewer_session_worktree() if role in {"reviewer", "merger"} else None
),
profile_name=get_profile().get("profile_name"),
verify_paths=True,
)
return workspace
@@ -388,6 +440,15 @@ def _get_git_root(path: str) -> str | None:
return (res.stdout or "").strip() or None
# #702 F2: synthetic tracked-dirty porcelain returned when the preflight
# workspace cannot be inspected (missing path, git failure). Shaped as a
# modified tracked entry so every consumer treats "workspace unavailable"
# as dirty — an uninspectable workspace must never read as clean.
PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN = (
" M __gitea_preflight_workspace_unavailable__\n"
)
def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
"""Return tracked-workspace porcelain for pre-flight attribution."""
if os.environ.get("GITEA_TEST_FORCE_DIRTY"):
@@ -396,6 +457,8 @@ def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
if override is not None:
return override
workspace = _resolve_preflight_workspace_path(worktree_path)
if not os.path.isdir(workspace):
return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
try:
res = subprocess.run(
["git", "status", "--porcelain"],
@@ -403,9 +466,11 @@ def _get_workspace_porcelain(worktree_path: str | None = None) -> str:
text=True,
cwd=workspace,
)
return res.stdout or ""
except Exception:
return ""
return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
if res.returncode != 0:
return PREFLIGHT_WORKSPACE_UNAVAILABLE_PORCELAIN
return res.stdout or ""
def _parse_porcelain_entries(porcelain: str) -> dict[str, str]:
@@ -8127,7 +8192,10 @@ def gitea_diagnose_reviewer_pr_lease_handoff(
# shadow left behind by a crashed daemon. Only a provably dead recorded
# owner pid yields False; PID liveness alone never proves ownership.
orphan_evidence = reviewer_pr_lease.assess_crashed_session_lease_orphan(
reviewer_pr_lease.load_session_lease_shadow(), lease=active
reviewer_pr_lease.load_session_lease_shadow(
session_id=(active or {}).get("session_id")
),
lease=active,
)
diagnosis = reviewer_pr_lease.diagnose_reviewer_pr_lease_handoff(
@@ -8379,7 +8447,10 @@ def gitea_cleanup_obsolete_reviewer_comment_lease(
# session-lease shadow; an explicitly passed value always wins.
if owner_process_alive is None:
owner_process_alive = reviewer_pr_lease.assess_crashed_session_lease_orphan(
reviewer_pr_lease.load_session_lease_shadow(), lease=lease
reviewer_pr_lease.load_session_lease_shadow(
session_id=(lease or {}).get("session_id")
),
lease=lease,
).get("owner_process_alive")
assessment = reviewer_pr_lease.assess_obsolete_reviewer_comment_lease_cleanup(
comments,
@@ -11674,6 +11745,18 @@ def gitea_resolve_task_capability(
"exact_safe_next_action": next_safe_action,
}
# #702 F1: validate (and, when provably stale, recover) the inherited
# GITEA_ACTIVE_WORKTREE binding BEFORE the terminal launcher probe. The
# probe uses that binding as its cwd; a worktree removed mid-session
# would otherwise wedge every mutation-task resolution on 'missing cwd'
# before the sanctioned recovery could ever run. Recovery stays
# fail-closed: only the provably-stale classes clear, with the durable
# audit record persisted first (F6).
try:
stale_binding = _assess_stale_active_binding(auto_recover=True)
except Exception:
stale_binding = None
# ── Terminal Launcher Preflight Check (#556) ──
if task in native_mcp_preference.GITEA_MUTATION_TASKS:
in_test = _preflight_in_test_mode()
@@ -11697,7 +11780,7 @@ def gitea_resolve_task_capability(
"Do not attempt git/pytest finalization or unsafe fallbacks. "
"Run gitea_diagnose_terminal, emit blocked-diagnose-report, and stop."
)
return {
blocked_result = {
"requested_task": task,
"required_operation_permission": required_permission,
"required_role_kind": required_role,
@@ -11717,6 +11800,11 @@ def gitea_resolve_task_capability(
"different_mcp_namespace_required": False,
"exact_safe_next_action": next_safe_action,
}
if stale_binding is not None and stale_binding.get(
"classification"
) != stale_binding_recovery.CLASSIFICATION_UNBOUND:
blocked_result["stale_binding_recovery"] = stale_binding
return blocked_result
record_preflight_check("capability", required_role, resolved_task=task)
@@ -11886,14 +11974,6 @@ def gitea_resolve_task_capability(
record_mutation_authority(profile["profile_name"], username, remote if remote in REMOTES else None, task)
# #702: validate the inherited GITEA_ACTIVE_WORKTREE binding during
# capability resolution; provably-stale bindings are cleared by the
# sanctioned in-daemon mechanism with a durable audit record.
try:
stale_binding = _assess_stale_active_binding(auto_recover=True)
except Exception:
stale_binding = None
result = {
"requested_task": task,
"required_operation_permission": required_permission,