存在チェックが通っても書けない — 無人実行の前提を能力プローブで測る

#!/usr/bin/env python3
"""Preflight capability probes for unattended runs."""
from __future__ import annotations
 
import os
import subprocess
import time
import uuid
from dataclasses import dataclass, field
from typing import Callable
 
CREATE, REPLACE, DELETE, GIT_REPO, SECRET = "create", "replace", "delete", "git", "secret"
 
 
@dataclass
class Check:
    name: str
    kind: str
    target: str
    remedy: str          # 失敗したときに人が取る行動
    ok: bool = False
    detail: str = ""
    ms: float = field(default=0.0)
 
 
def _probe_path(kind: str, path: str) -> tuple[bool, str]:
    # 実行ごとに一意な名前にする。固定名にすると、
    # 「削除できなかった前回のプローブ残骸」を掴むことがある。
    probe = os.path.join(path, f".preflight-{uuid.uuid4().hex[:8]}")
    try:
        with open(probe, "w") as fp:
            fp.write("probe")
    except OSError as exc:
        return False, f"create: {exc.strerror}"
 
    try:
        if kind in (REPLACE, DELETE):
            os.replace(probe, probe + ".tmp")
            probe = probe + ".tmp"
        if kind == DELETE:
            os.remove(probe)
            return True, "create/replace/delete all permitted"
    except OSError as exc:
        try:                      # 消せる残骸は残さない
            os.remove(probe)
        except OSError:
            pass
        return False, f"{kind}: {exc.strerror}"
 
    try:
        os.remove(probe)
    except OSError as exc:
        # 削除を要求していない検査なら、削除不可は失格にしない
        return kind != DELETE, f"created, but unlink failed: {exc.strerror}"
    return True, "ok"
 
 
def _probe_git(path: str) -> tuple[bool, str]:
    try:
        res = subprocess.run(
            ["git", "-C", path, "rev-parse", "--git-dir"],
            capture_output=True, text=True, timeout=15,
        )
    except (OSError, subprocess.TimeoutExpired) as exc:
        return False, f"git unavailable: {exc}"
    if res.returncode != 0:
        return False, res.stderr.strip().splitlines()[0] if res.stderr else "not a repository"
    return True, res.stdout.strip()
 
 
def _probe_secret(spec: str) -> tuple[bool, str]:
    # spec = "<file>::<label>"。本番と同じ読み方で取り出し、形だけ検査する。
    # ここで空文字を通すと、ずっと後ろで認証エラーとして現れる。
    path, _, label = spec.partition("::")
    try:
        with open(path, encoding="utf-8") as fp:
            lines = [ln.rstrip("\n") for ln in fp]
    except OSError as exc:
        return False, f"{exc.strerror}: {path}"
    for i, line in enumerate(lines):
        if line.startswith(label) and i + 1 < len(lines):
            value = lines[i + 1].strip()
            if len(value) < 20:
                return False, f"value for {label!r} is {len(value)} chars — too short"
            return True, f"{label}: {len(value)} chars"
    return False, f"label {label!r} not found in {os.path.basename(path)}"
 
 
PROBES: dict[str, Callable[[str], tuple[bool, str]]] = {
    CREATE: lambda p: _probe_path(CREATE, p),
    REPLACE: lambda p: _probe_path(REPLACE, p),
    DELETE: lambda p: _probe_path(DELETE, p),
    GIT_REPO: _probe_git,
    SECRET: _probe_secret,
}
 
 
def run(checks: list[Check]) -> list[Check]:
    for check in checks:
        start = time.perf_counter()
        try:
            check.ok, check.detail = PROBES[check.kind](check.target)
        except KeyError:
            check.ok, check.detail = False, f"unknown probe kind: {check.kind}"
        check.ms = (time.perf_counter() - start) * 1000
    return checks
 
 
def report(checks: list[Check]) -> int:
    failed = [c for c in checks if not c.ok]
    total = sum(c.ms for c in checks)
    for c in checks:
        mark = "PASS" if c.ok else "FAIL"
        print(f"[{mark}] {c.name:<26} {c.ms:6.2f}ms  {c.detail}")
    print(f"\n{len(checks) - len(failed)}/{len(checks)} passed in {total:.2f}ms")
    for c in failed:
        print(f"  -> {c.name}: {c.remedy}")
    return 1 if failed else 0

checks = [
    Check("workspace/clone-root", DELETE,   f"{HOME}/repos",              "別の書き込み可能な場所へ退避する"),
    Check("artifact-dir",         DELETE,   outputs_dir,                  "削除できない場所は再実行前提の置き場に使わない"),
    Check("repo/claudelab.net",   GIT_REPO, f"{HOME}/repos/claudelab.net", "clone をやり直す"),
    Check("credential",           SECRET,   f"{tokens}::Claude Lab",      "ラベル名と値を確認する"),
]
sys.exit(report(run(checks)))

GITHUB_TOKEN=$(grep -A1 "^Claude Lab" tokens.txt | tail -1 | tr -d '[:space:]')

set -euo pipefail
 
token=$(grep -A1 "^Claude Lab" "$TOKENS" | tail -1 | tr -d '[:space:]') || true
if [ "${#token}" -lt 20 ]; then
  echo "preflight: credential for 'Claude Lab' is empty or too short (${#token} chars)" >&2
  exit 78            # EX_CONFIG — 設定側の問題であることを終了コードで示す
fi
export GITHUB_TOKEN="$token"