sorokin.oleg.edu/learnharness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Prompt-override orphan trap: delete clears the switch, writes heal orphans

Browse Source 
Contract-fix interlude (2026-09-26), two bugs from UI's prompts-overhaul
(6edc220):

(a) ORPHAN-400 TRAP: an ON switch whose override file dies orphaned the
record; every agent-section write then 400'd (ON-must-have-file) while
the disabled toggle couldn't reach the OFF escape hatch — a user stuck
unable to write settings. Verified live on 3004 before the fix.
Two-layer fix:
- DELETE /api/settings/prompts/[...segment] now clears the record's
  switch in the same operation (switch-first order: a crash between the
  two leaves the valid off+file state, never an orphan). Response gains
  switchCleared (additive). Overrules the 2026-09-19 switch-survives-
  delete note — the delete route and the record agree by construction.
- PUT /api/settings/[section] agent writes HEAL an orphaned ON to OFF
  (key dropped) inside the write — never a 400 (defense in depth: disk
  wipes outside the app can still orphan). A valid ON with its file
  stays valid; the invariant: a user can never get stuck unable to
  write settings, and the record never contradicts file reality for
  long. Heal logs at info.

(b) TEST WIPES REAL DATA: tests/prompt-overrides.test.ts wiped
data/prompts/ (REAL user override files) in after() and its empty-list
case — every npm test killed actual overrides and orphaned their ON
switches (feeding trap a). Isolated via the established LH_DATA_DIR
seam (mkdtemp + env set before the first config.ts-loading import; all
app-module imports dynamic). after() now snapshots the REAL repo
data/prompts before/after and fails the suite if it changed; the seam is
pinned (writes land under the temp dir).

Pins: delete-clears-switch (incl. idempotent no-op), the exact repro
(disk-level wipe → mirror-the-orphan + tool toggle → 200, healed key,
rest of the write landed), vanished-fragment ON heals, valid ON stays.
Live: the 400-forever write now lands 200, heal info-logged, record
clean.

Gates: 967/967 (+5), typecheck, lint, build green.
This commit is contained in:
amosblomqvist
2026-09-25 19:07:12 +03:00
parent 178995c987
commit e79f85ebe4
3 changed files with 258 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/settings/[section]/route.ts
+29 -14
View File
@@ -15,9 +15,14 @@
* level CLAMPS to the named model's nearest supported level and the
* clamped value is stored — model swaps just work, same as the
* defaults route. The agent section additionally validates prompt
* switches: an ON switch must reference a CURRENT source segment with an
* existing override file (an OFF switch may reference anything — users
* cleaning up orphans must not be blocked).
* switches — under the orphan-heal contract (interlude 2026-09-26): an
* ON switch with its override file present is valid as-is; an ON whose
* file is gone (deleted outside the app, a disk wipe, or a record from
* before the delete-clears-switch fix) is an ORPHAN and is healed to
* OFF (the key drops) inside the same write — never a 400. Invariant:
* a user can never get stuck unable to write settings, and switch
* state never contradicts file reality for long (the delete route
* clears the switch by construction; this is the backstop).
*
* The static siblings (defaults, prompts) take precedence over this
* dynamic segment — Next resolves static routes first, so "prompts" never
@@ -58,6 +63,7 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
if (!parsed.ok) {
return Response.json({ error: parsed.error }, { status: 400 });
}
let agentHealed: AgentSettings | undefined;
// Section-specific cross-validation (against the catalog / the prompt
// store) — the parsers only see shapes.
@@ -77,19 +83,23 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
}
}
if (section === "agent") {
// Orphan-heal (contract fix, interlude 2026-09-26): an ON switch
// whose override file is gone (or whose segment left the source
// tree) is healed to OFF (key dropped) inside this write — never a
// 400. The old 400 trapped users: the record's own orphaned ON was
// mirrored back by every write while the disabled toggle couldn't
// reach the OFF escape hatch. An ON with a real file stays valid.
const agent = parsed.settings as AgentSettings;
const segments = new Set(allSegmentPaths());
const orphans: string[] = [];
for (const [path, on] of Object.entries(agent.prompts ?? {})) {
if (on && (!segments.has(path) || promptOverrides.readOverride(path) === null)) {
return Response.json(
{
error: `prompt switch for "${path}" cannot be on: ${
segments.has(path) ? "no override file exists" : "not a current source segment"
}`,
},
{ status: 400 },
);
}
if (on && (!segments.has(path) || promptOverrides.readOverride(path) === null)) orphans.push(path);
}
if (orphans.length > 0) {
const prompts = { ...(agent.prompts ?? {}) };
for (const path of orphans) delete prompts[path];
agentHealed = { ...agent, prompts };
console.info(`[settings] healed orphaned prompt switch(es) to off: ${orphans.join(", ")}`);
}
}
@@ -100,12 +110,17 @@ export async function PUT(request: Request, ctx: { params: Promise<{ section: st
// value is what lands in the record. The chat section's bare levels
// clamp against the record's resolved strong slot (the chain's
// fallback); the models section's slots each carry their own model.
// The agent section lands HEALED when orphaned prompt switches were
// found above (the healed copy) — after every write the record and
// file reality agree.
const sectionOut =
section === "chat"
? clampChatLevel(parsed.settings as ChatSettings, effectiveSettings().models.strong)
: section === "models"
? clampModelsLevels(parsed.settings as ModelsSettings)
: parsed.settings;
: section === "agent" && agentHealed
? agentHealed
: parsed.settings;
// Read-modify-write ONE section of the record; everything else rides
// along untouched (other sections, unknown keys — sanitize preserves).
app/api/settings/prompts/[...segment]/route.ts
+32 -6
View File
@@ -7,16 +7,31 @@
* — derived from src/agent/prompts at runtime): overriding a
* segment that doesn't compose is a typo or a vanished fragment,
* a 400, never a silent orphan.
* DELETE → removes the override file (idempotent). Switches are NOT
* touched — an on-switch with no file composes the source
* default (inert by design), so the user's switch state survives
* a delete/re-write cycle.
* DELETE → removes the override file (idempotent) AND clears the
* record's switch for that segment in the same operation
* (contract fix, interlude 2026-09-26 — overrules the 2026-09-19
* "switch survives a delete/re-write cycle" note). The old
* behavior orphaned the on-switch: the write validation then
* 400'd every agent-section write while the UI's disabled toggle
* couldn't reach the OFF escape hatch — a user stuck unable to
* write settings. Delete clears the switch so the route and the
* record agree BY CONSTRUCTION; the write path additionally heals
* any orphan that still arises (disk-level wipes outside the
* app's control) — see [section]/route.ts. Order here: clear the
* switch first, then unlink — a crash between the two leaves
* "off + file", a valid state, never an orphan.
*
* The ON/OFF switch itself lives in the record's agent.prompts map
* (PUT /api/settings/agent) — file presence alone is never the override.
*/
import { allSegmentPaths, isValidSegmentPath, promptOverrides } from "@/src/server";
import {
allSegmentPaths,
isValidSegmentPath,
promptOverrides,
readSettingsRecord,
writeSettingsRecord,
} from "@/src/server";
export const dynamic = "force-dynamic";
@@ -49,6 +64,17 @@ export async function DELETE(_request: Request, ctx: { params: Promise<{ segment
const { segment } = await ctx.params;
const path = segmentPathFrom(segment);
if (!path) return Response.json({ error: "invalid segment path" }, { status: 400 });
// Clear the record's switch FIRST (crash between the two leaves "off +
// file" — valid — never an orphaned ON), then unlink the file.
const record = readSettingsRecord();
const hadSwitch = record?.agent?.prompts?.[path] === true;
if (record && record.agent?.prompts?.[path] !== undefined) {
const prompts = { ...record.agent.prompts };
delete prompts[path];
writeSettingsRecord({ ...record, agent: { ...record.agent, prompts } });
}
promptOverrides.deleteOverride(path);
return Response.json({ path, deleted: true });
// switchCleared tells the caller their on-switch went off WITH the file
// (additive; the GET view derives the same truth from record+file).
return Response.json({ path, deleted: true, switchCleared: hadSwitch });
}