@abelxiaoxing/cadence 2.0.0 → 2.0.2

package/src/service/coordination.ts

@@ -19,6 +19,7 @@ import {
   text,
 } from "./contracts/core.ts";
 import {
+  DirectoryWalks,
   encoded,
   type FileSnapshot,
   hash,
@@ -282,8 +283,8 @@ export class ServiceCoordination {
       },
     };
   }
-  assertNamespace(): void {
-    if (!this.files.directory(this.directory)) refused();
+  assertNamespace(walks?: DirectoryWalks): void {
+    if (!this.files.directory(this.directory, false, walks)) refused();
     names(this.directory, [
       "format.json",
       "config.json",
@@ -295,13 +296,18 @@ export class ServiceCoordination {
       "host-config.json",
       "history-v2",
     ]);
-    this.files.directory(join(this.directory, "history-v2"));
+    this.files.directory(join(this.directory, "history-v2"), false, walks);
   }
   private selected(): Selected | undefined {
-    if (!this.files.directory(this.directory)) return undefined;
-    this.assertNamespace();
-    const manifest = this.files.read(this.path("format.json"));
-    const config = this.files.read(this.path("config.json"));
+    const walks = new DirectoryWalks();
+    if (!this.files.directory(this.directory, false, walks)) return undefined;
+    this.assertNamespace(walks);
+    const manifest = this.files.read(
+      this.path("format.json"),
+      undefined,
+      walks,
+    );
+    const config = this.files.read(this.path("config.json"), undefined, walks);
     if (!manifest || !config) refused();
     const f = closed(json(manifest), [
       "schema",
@@ -314,12 +320,24 @@ export class ServiceCoordination {
     literal(f.stateHome, this.stateHome);
     literal(f.configIdentity, config.identity);
     const c = decodeOwnerConfig(json(config));
-    const hostConfig = this.files.read(this.path("host-config.json"));
+    const hostConfig = this.files.read(
+      this.path("host-config.json"),
+      undefined,
+      walks,
+    );
     if (hostConfig && hostConfig.identity !== c.policyIdentity) refused();
-    const registration = this.files.read(this.path("registration.json"));
-    const owner = this.files.read(this.path("owner.lock"));
-    const capability = this.files.read(this.path("local-capability.json"));
-    const checkout = this.files.read(this.store.lockPath, 8192);
+    const registration = this.files.read(
+      this.path("registration.json"),
+      undefined,
+      walks,
+    );
+    const owner = this.files.read(this.path("owner.lock"), undefined, walks);
+    const capability = this.files.read(
+      this.path("local-capability.json"),
+      undefined,
+      walks,
+    );
+    const checkout = this.files.read(this.store.lockPath, 8192, walks);
     const value = registration
       ? decodeRegistration(json(registration))
       : undefined;
@@ -808,8 +826,9 @@ export class OwnerLease {
       this.selected.value.host !== hostname()
     )
       throw new ContractError("conflict");
-    const c = this.coordination;
-    c.assertNamespace();
+    const c = this.coordination,
+      walks = new DirectoryWalks();
+    c.assertNamespace(walks);
     for (const [name, snapshot] of [
       ["config.json", this.selected.config],
       ["host-config.json", this.selected.hostConfig],
@@ -818,8 +837,8 @@ export class OwnerLease {
       ["owner.lock", this.selected.owner],
       ["local-capability.json", this.selected.capability],
     ] as const)
-      c.files.assert(c.path(name), snapshot);
-    c.files.assert(c.store.lockPath, this.selected.checkout, 8192);
+      c.files.assert(c.path(name), snapshot, undefined, walks);
+    c.files.assert(c.store.lockPath, this.selected.checkout, 8192, walks);
     c.store.assertOwner(this.checkout);
   }
   phase(phase: OwnerPhase): void {

package/src/service/private-files.ts

@@ -5,14 +5,16 @@ import {
   fstatSync,
   fsyncSync,
   lstatSync,
+  mkdirSync,
   openSync,
+  readSync,
   renameSync,
   type Stats,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { readBounded, safeDirectory } from "../task-store.ts";
+import { retryWindowsFileOperation, safeDirectory } from "../task-store.ts";
 import { ContractError, parseWireJson } from "./contracts/core.ts";
 
 export const METADATA_BYTES = 16 * 1024;
@@ -46,37 +48,128 @@ function same(a: Stats, b: Stats): boolean {
 function missing(error: unknown): boolean {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
+// Advances once per job, at its first microtask checkpoint. Nothing queued
+// retains a scope, so a dropped read budget is collected as usual.
+let job = 0,
+  advancing = false;
+function currentJob(): number {
+  if (!advancing) {
+    advancing = true;
+    queueMicrotask(() => {
+      job++;
+      advancing = false;
+    });
+  }
+  return job;
+}
+/** Directories that ONE synchronous operation already walked. Reuse re-observes
+ * the directory itself, no-follow, with the walked dev/ino and private mode: an
+ * ancestor substituted for other content resolves elsewhere and walks again. It
+ * goes stale at the next microtask checkpoint, so an await or a later call
+ * always walks; an ancestor's mode change inside one operation is seen by the
+ * next. Absence, refusal and any changed identity fall back to the full walk.
+ */
+export class DirectoryWalks {
+  private readonly job = currentJob();
+  private readonly walked = new Map<string, { dev: number; ino: number }>();
+  private open(): boolean {
+    if (this.job === job) return true;
+    this.walked.clear();
+    return false;
+  }
+  remember(path: string, st: Stats): void {
+    if (this.open()) this.walked.set(path, { dev: st.dev, ino: st.ino });
+  }
+  reuse(path: string): boolean {
+    const walked = this.open() ? this.walked.get(path) : undefined;
+    if (!walked) return false;
+    let st: Stats;
+    try {
+      st = lstatSync(path);
+    } catch (error) {
+      if (!missing(error)) throw error;
+      this.walked.delete(path);
+      return false;
+    }
+    if (
+      !st.isDirectory() ||
+      st.isSymbolicLink() ||
+      st.dev !== walked.dev ||
+      st.ino !== walked.ino
+    ) {
+      this.walked.delete(path);
+      return false;
+    }
+    privateMode(st);
+    return true;
+  }
+}
 /** Strengthens the existing helpers only inside the owned private namespace.
  * Ambient ancestors retain TaskStore's canonicalization policy. No directory CAS
  * or hostile-same-user guarantee; failed temporaries are deliberately preserved.
  */
 export class PrivateFiles {
   constructor(readonly namespace: string) {}
-  directory(path: string, create = false): boolean {
+  directory(path: string, create = false, walks?: DirectoryWalks): boolean {
     const tail = relative(this.namespace, path);
     if (isAbsolute(tail) || tail === ".." || tail.startsWith(`..${sep}`))
       refused();
     if (!create) {
+      const full = resolve(path);
+      if (walks?.reuse(full)) return true;
       const namespace = resolve(this.namespace);
-      let inside = false;
-      return safeDirectory(path, false, (at, st) => {
+      let inside = false,
+        last: Stats | undefined;
+      const found = safeDirectory(path, false, (at, st) => {
         // Exact segment boundary, not a textual prefix. One synchronous walk
         // checks every ambient ancestor and each existing private ancestor,
-        // including an unsafe parent before a missing child. Nothing is cached.
+        // including an unsafe parent before a missing child. Only the caller's
+        // DirectoryWalks keeps the result, for that same synchronous operation.
         if (at === namespace) inside = true;
         if (inside) privateMode(st);
+        last = st;
       });
+      if (found && last) walks?.remember(full, last);
+      return found;
     }
+    // Walk the namespace and its ambient ancestors once, then check each
+    // private segment exactly once, creating a missing one privately.
+    if (!safeDirectory(this.namespace, true)) return false;
+    privateMode(lstatSync(this.namespace));
     let at = this.namespace;
-    for (const part of ["", ...tail.split(sep).filter(Boolean)]) {
-      if (part) at = join(at, part);
-      if (!safeDirectory(at, create)) return false;
-      privateMode(lstatSync(at));
+    for (const part of tail.split(sep).filter(Boolean)) {
+      at = join(at, part);
+      let st: Stats;
+      try {
+        st = lstatSync(at);
+      } catch (error) {
+        if (!missing(error)) throw error;
+        try {
+          mkdirSync(at, { mode: 0o700 });
+        } catch (mkdirError) {
+          if (
+            !(
+              mkdirError instanceof Error &&
+              "code" in mkdirError &&
+              mkdirError.code === "EEXIST"
+            )
+          )
+            throw mkdirError;
+        }
+        st = lstatSync(at);
+      }
+      if (!st.isDirectory() || st.isSymbolicLink())
+        throw new Error("Unsafe directory");
+      privateMode(st);
     }
     return true;
   }
-  read(path: string, maximum = METADATA_BYTES): FileSnapshot | undefined {
-    if (!this.directory(dirname(path))) return undefined;
+  read(
+    path: string,
+    maximum = METADATA_BYTES,
+    walks?: DirectoryWalks,
+  ): FileSnapshot | undefined {
+    if (!this.directory(dirname(path), false, walks)) return undefined;
     let before: Stats;
     try {
       before = lstatSync(path);
@@ -91,15 +184,20 @@ export class PrivateFiles {
     try {
       const opened = fstatSync(fd);
       if (!same(before, opened)) refused();
-      // Reuse the bounded no-follow reader; surround its read with descriptor and
-      // selected-path identity checks rather than weakening legacy behavior.
-      // The caller's independent maximum was already checked above. Bound the
-      // inner allocation to this exact selected size (+1 growth sentinel); keep
-      // its full ancestor/open checks and our final descriptor/path checks.
-      const bytes = readBounded(path, opened.size);
+      // Read this already opened, no-follow, identity-checked descriptor: its
+      // parents were walked just above, so a second walk and open add nothing.
+      // Bound the read to the selected size (+1 growth sentinel) and keep the
+      // final descriptor/path identity checks.
+      const buffer = Buffer.alloc(opened.size + 1);
+      let size = 0;
+      while (size < buffer.length) {
+        const n = readSync(fd, buffer, size, buffer.length - size, null);
+        if (!n) break;
+        size += n;
+      }
+      const bytes = buffer.subarray(0, size);
       if (
-        !bytes ||
-        bytes.length !== opened.size ||
+        size !== opened.size ||
         !same(opened, fstatSync(fd)) ||
         !same(opened, lstatSync(path))
       )
@@ -113,8 +211,9 @@ export class PrivateFiles {
     path: string,
     expected: FileSnapshot | undefined,
     maximum = METADATA_BYTES,
+    walks?: DirectoryWalks,
   ): void {
-    const current = this.read(path, maximum);
+    const current = this.read(path, maximum, walks);
     if (
       current?.identity !== expected?.identity ||
       current?.stamp !== expected?.stamp
@@ -124,7 +223,7 @@ export class PrivateFiles {
   create(path: string, bytes: string, maximum = METADATA_BYTES): FileSnapshot {
     if (Buffer.byteLength(bytes) > maximum) throw new ContractError("oversize");
     this.directory(dirname(path), true);
-    const fd = openSync(path, "wx", 0o600);
+    const fd = retryWindowsFileOperation(() => openSync(path, "wx", 0o600));
     try {
       writeFileSync(fd, bytes);
       fsyncSync(fd);
@@ -146,7 +245,10 @@ export class PrivateFiles {
     const temporary = join(dirname(path), `pending-${randomUUID()}.json`);
     this.create(temporary, bytes, maximum);
     this.assert(path, expected, maximum);
-    renameSync(temporary, path);
+    retryWindowsFileOperation(
+      () => renameSync(temporary, path),
+      () => this.assert(path, expected, maximum),
+    );
     this.syncDirectory(dirname(path));
     const result = this.read(path, maximum);
     if (!result || result.identity !== hash(bytes)) refused();
@@ -154,7 +256,10 @@ export class PrivateFiles {
   }
   remove(path: string, expected: FileSnapshot, maximum = METADATA_BYTES): void {
     this.assert(path, expected, maximum);
-    unlinkSync(path);
+    retryWindowsFileOperation(
+      () => unlinkSync(path),
+      () => this.assert(path, expected, maximum),
+    );
     this.syncDirectory(dirname(path));
   }
   private syncDirectory(path: string): void {