Files
learnharness/app/api/settings/prompts/[...segment]/route.ts
T
amosblomqvist e79f85ebe4 Prompt-override orphan trap: delete clears the switch, writes heal orphans
Contract-fix interlude (2026-09-26), two bugs from UI's prompts-overhaul
(6edc220):

(a) ORPHAN-400 TRAP: an ON switch whose override file dies orphaned the
record; every agent-section write then 400'd (ON-must-have-file) while
the disabled toggle couldn't reach the OFF escape hatch — a user stuck
unable to write settings. Verified live on 3004 before the fix.
Two-layer fix:
- DELETE /api/settings/prompts/[...segment] now clears the record's
  switch in the same operation (switch-first order: a crash between the
  two leaves the valid off+file state, never an orphan). Response gains
  switchCleared (additive). Overrules the 2026-09-19 switch-survives-
  delete note — the delete route and the record agree by construction.
- PUT /api/settings/[section] agent writes HEAL an orphaned ON to OFF
  (key dropped) inside the write — never a 400 (defense in depth: disk
  wipes outside the app can still orphan). A valid ON with its file
  stays valid; the invariant: a user can never get stuck unable to
  write settings, and the record never contradicts file reality for
  long. Heal logs at info.

(b) TEST WIPES REAL DATA: tests/prompt-overrides.test.ts wiped
data/prompts/ (REAL user override files) in after() and its empty-list
case — every npm test killed actual overrides and orphaned their ON
switches (feeding trap a). Isolated via the established LH_DATA_DIR
seam (mkdtemp + env set before the first config.ts-loading import; all
app-module imports dynamic). after() now snapshots the REAL repo
data/prompts before/after and fails the suite if it changed; the seam is
pinned (writes land under the temp dir).

Pins: delete-clears-switch (incl. idempotent no-op), the exact repro
(disk-level wipe → mirror-the-orphan + tool toggle → 200, healed key,
rest of the write landed), vanished-fragment ON heals, valid ON stays.
Live: the 400-forever write now lands 200, heal info-logged, record
clean.

Gates: 967/967 (+5), typecheck, lint, build green.
2026-09-25 19:07:12 +03:00

81 lines
3.7 KiB
TypeScript

/**
* PUT/DELETE /api/settings/prompts/[...segment] — the override TEXT for
* one prompt segment (settings-storage wave, 2026-09-19).
*
* PUT body {text} → writes data/prompts/<segment path mirror>. 200.
* The segment must be a CURRENT source segment (allSegmentPaths
* — derived from src/agent/prompts at runtime): overriding a
* segment that doesn't compose is a typo or a vanished fragment,
* a 400, never a silent orphan.
* DELETE → removes the override file (idempotent) AND clears the
* record's switch for that segment in the same operation
* (contract fix, interlude 2026-09-26 — overrules the 2026-09-19
* "switch survives a delete/re-write cycle" note). The old
* behavior orphaned the on-switch: the write validation then
* 400'd every agent-section write while the UI's disabled toggle
* couldn't reach the OFF escape hatch — a user stuck unable to
* write settings. Delete clears the switch so the route and the
* record agree BY CONSTRUCTION; the write path additionally heals
* any orphan that still arises (disk-level wipes outside the
* app's control) — see [section]/route.ts. Order here: clear the
* switch first, then unlink — a crash between the two leaves
* "off + file", a valid state, never an orphan.
*
* The ON/OFF switch itself lives in the record's agent.prompts map
* (PUT /api/settings/agent) — file presence alone is never the override.
*/
import {
allSegmentPaths,
isValidSegmentPath,
promptOverrides,
readSettingsRecord,
writeSettingsRecord,
} from "@/src/server";
export const dynamic = "force-dynamic";
/** Re-join the catch-all segments into the mirror-layout path; null when
* the shape is invalid (traversal, wrong layout — the store re-guards). */
function segmentPathFrom(segments: string[]): string | null {
const joined = segments.map(decodeURIComponent).join("/");
return isValidSegmentPath(joined) ? joined : null;
}
export async function PUT(request: Request, ctx: { params: Promise<{ segment: string[] }> }) {
const { segment } = await ctx.params;
const path = segmentPathFrom(segment);
if (!path) return Response.json({ error: "invalid segment path" }, { status: 400 });
const body = (await request.json().catch(() => null)) as { text?: unknown } | null;
if (!body || typeof body.text !== "string") {
return Response.json({ error: "body must be {text: string}" }, { status: 400 });
}
if (!new Set(allSegmentPaths()).has(path)) {
return Response.json(
{ error: `"${path}" is not a current source segment`, supported: allSegmentPaths() },
{ status: 400 },
);
}
promptOverrides.writeOverride(path, body.text);
return Response.json({ path, text: body.text });
}
export async function DELETE(_request: Request, ctx: { params: Promise<{ segment: string[] }> }) {
const { segment } = await ctx.params;
const path = segmentPathFrom(segment);
if (!path) return Response.json({ error: "invalid segment path" }, { status: 400 });
// Clear the record's switch FIRST (crash between the two leaves "off +
// file" — valid — never an orphaned ON), then unlink the file.
const record = readSettingsRecord();
const hadSwitch = record?.agent?.prompts?.[path] === true;
if (record && record.agent?.prompts?.[path] !== undefined) {
const prompts = { ...record.agent.prompts };
delete prompts[path];
writeSettingsRecord({ ...record, agent: { ...record.agent, prompts } });
}
promptOverrides.deleteOverride(path);
// switchCleared tells the caller their on-switch went off WITH the file
// (additive; the GET view derives the same truth from record+file).
return Response.json({ path, deleted: true, switchCleared: hadSwitch });
}