@bybrawe/opencode-loop 0.6.6 → 0.6.8

package/scripts/state-process-test.mjs

@@ -0,0 +1,172 @@
+import assert from "node:assert/strict"
+import { spawn, spawnSync } from "node:child_process"
+import { randomUUID } from "node:crypto"
+import { mkdtemp, mkdir, readFile, readdir, rm, writeFile, link, stat } from "node:fs/promises"
+import os from "node:os"
+import path from "node:path"
+import { fileURLToPath } from "node:url"
+import { readState, writeState, removeState, stateDir } from "../src/source/core/state.js"
+
+const filename = fileURLToPath(import.meta.url)
+const pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+async function exists(file) { try { await stat(file); return true } catch (error) { if (error?.code === "ENOENT") return false; throw error } }
+async function until(fn, duration = 15_000) {
+  const started = Date.now()
+  while (Date.now() - started < duration) {
+    if (await fn()) return
+    await pause(20)
+  }
+  throw new Error("state worker sync timeout")
+}
+
+if (process.argv[2] === "--worker") {
+  const [, , , root, sessionID, marker, gate] = process.argv
+  const snapshot = await readState(root, sessionID)
+  await writeFile(`${gate}.${marker}.ready`, "ready")
+  await until(() => exists(gate))
+  if (marker === "delete") await removeState(root, sessionID)
+  else {
+    snapshot.jobs[0][marker] = Number(marker.slice(1))
+    await writeState(root, sessionID, snapshot)
+  }
+} else {
+  const root = await mkdtemp(path.join(os.tmpdir(), "opencode-loop-process-lock-"))
+  const sessionID = "multi-process"
+  const lockFile = path.join(stateDir(root), `${sessionID}.json.lock`)
+  try {
+    for (let round = 0; round < 6; round++) {
+      const initial = await readState(root, sessionID)
+      initial.jobs = [{ id: "shared", round }]
+      await writeState(root, sessionID, initial)
+      const gate = path.join(root, `round-${round}.go`)
+      const workers = []
+      for (let n = 0; n < 4; n++) {
+        const marker = `f${n}`
+        const child = spawn(process.execPath, [filename, "--worker", root, sessionID, marker, gate], { stdio: ["ignore", "ignore", "pipe"] })
+        let stderr = ""
+        child.stderr.on("data", (part) => { stderr += part.toString() })
+        const closed = new Promise((resolve, reject) => {
+          child.once("error", reject)
+          child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`worker ${marker} exited ${code}: ${stderr}`)))
+        })
+        workers.push({ marker, closed })
+      }
+      await until(async () => (await Promise.all(workers.map((w) => exists(`${gate}.${w.marker}.ready`)))).every(Boolean))
+      await writeFile(gate, "go")
+      await Promise.all(workers.map((w) => w.closed))
+      const saved = (await readState(root, sessionID)).jobs[0]
+      assert.equal(saved.round, round)
+      for (let n = 0; n < 4; n++) assert.equal(saved[`f${n}`], n, "each independent writer must survive")
+      assert.equal(await exists(lockFile), false, "all writers must release the lock")
+    }
+
+    // A stale writer must not resurrect a job removed by another process.
+    // Race both operation orders: the lock serializes remove and write, while
+    // baseline-aware merge must preserve the deletion if write runs second.
+    for (let round = 0; round < 8; round++) {
+      const seed = await readState(root, sessionID)
+      seed.jobs = [{ id: "shared", round: `delete-${round}` }]
+      await writeState(root, sessionID, seed)
+      const gate = path.join(root, `delete-${round}.go`)
+      const workers = []
+      for (const marker of ["delete", "f0"]) {
+        const child = spawn(process.execPath, [filename, "--worker", root, sessionID, marker, gate], {
+          stdio: ["ignore", "ignore", "pipe"],
+        })
+        let stderr = ""
+        child.stderr.on("data", (part) => { stderr += part.toString() })
+        workers.push({
+          marker,
+          closed: new Promise((resolve, reject) => {
+            child.once("error", reject)
+            child.once("close", (code) => code === 0 ? resolve() : reject(new Error(`worker ${marker} exited ${code}: ${stderr}`)))
+          }),
+        })
+      }
+      await until(async () => (await Promise.all(workers.map((w) =>
+        exists(`${gate}.${w.marker}.ready`)))).every(Boolean))
+      await writeFile(gate, "go")
+      await Promise.all(workers.map((w) => w.closed))
+      assert.deepEqual((await readState(root, sessionID)).jobs, [],
+        "remove-vs-stale-writer must not resurrect deleted work")
+      assert.equal(await exists(lockFile), false, "both processes must release lock after deletion race")
+    }
+    const fresh = await readState(root, sessionID)
+    fresh.jobs = [{ id: "shared", round: "reseeded" }]
+    await writeState(root, sessionID, fresh)
+
+    // A malformed lock is never stolen or silently removed.
+    const corrupt = await readState(root, sessionID)
+    await writeFile(lockFile, "corrupt owner")
+    corrupt.jobs[0].newField = "must-not-commit"
+    await assert.rejects(writeState(root, sessionID, corrupt), /state lock invalid_owner/)
+    assert.equal((await readState(root, sessionID)).jobs[0].newField, undefined)
+    await rm(lockFile)
+
+    // A dead owner is reclaimed with an election lock, never a blind unlink.
+    const dead = spawnSync(process.execPath, ["-e", "process.exit(0)"], { encoding: "utf8" })
+    assert.equal(dead.status, 0)
+    assert.ok(dead.pid > 0)
+    const token = randomUUID()
+    const candidate = path.join(stateDir(root), `.loop-lock-${dead.pid}-${token}.json`)
+    const owner = { schemaVersion: 1, pid: dead.pid, token, acquiredAt: Date.now(), candidateName: path.basename(candidate) }
+    await writeFile(candidate, JSON.stringify(owner))
+    await link(candidate, lockFile)
+    // Simulate a crash while an earlier process was cleaning the dead owner.
+    // A stray, dead `.lock.cleanup` must not permanently block recovery.
+    const cleanupToken = randomUUID()
+    const cleanupCandidate = path.join(stateDir(root), `.loop-lock-${dead.pid}-${cleanupToken}.json`)
+    const cleanupOwner = {
+      schemaVersion: 1, pid: dead.pid, token: cleanupToken,
+      acquiredAt: Date.now(), candidateName: path.basename(cleanupCandidate),
+    }
+    await writeFile(cleanupCandidate, JSON.stringify(cleanupOwner))
+    await link(cleanupCandidate, `${lockFile}.cleanup`)
+    const revived = await readState(root, sessionID)
+    revived.jobs[0].recovered = true
+    await writeState(root, sessionID, revived)
+    assert.equal((await readState(root, sessionID)).jobs[0].recovered, true)
+    assert.equal(await exists(lockFile), false)
+    assert.equal(await exists(candidate), false)
+    assert.equal(await exists(cleanupCandidate), false, "orphaned election candidate must be cleaned")
+    assert.equal(await exists(`${lockFile}.cleanup`), false, "orphaned cleanup lock must be removed")
+
+    // A malformed election must fail closed and not delete another owner's files.
+    const badToken = randomUUID()
+    const badCandidate = path.join(stateDir(root), `.loop-lock-${dead.pid}-${badToken}.json`)
+    const badOwner = {
+      schemaVersion: 1, pid: dead.pid, token: badToken,
+      acquiredAt: Date.now(), candidateName: path.basename(badCandidate),
+    }
+    await writeFile(badCandidate, JSON.stringify(badOwner))
+    await link(badCandidate, lockFile)
+    await writeFile(`${lockFile}.cleanup`, "not valid owner metadata")
+    const blocked = await readState(root, sessionID)
+    blocked.jobs[0].mustNotWrite = true
+    await assert.rejects(writeState(root, sessionID, blocked), /state lock invalid_owner/)
+    assert.equal((await readState(root, sessionID)).jobs[0].mustNotWrite, undefined)
+    assert.equal(await exists(lockFile), true, "invalid election must not erase the dead canonical owner")
+    await rm(lockFile)
+    await rm(`${lockFile}.cleanup`)
+    await rm(badCandidate)
+
+    // A path supplied by another tool cannot symlink Loop state outside the project.
+    const other = await mkdtemp(path.join(os.tmpdir(), "opencode-loop-escape-"))
+    const unsafe = path.join(root, "unsafe")
+    await mkdir(unsafe)
+    try {
+      const linkTarget = path.join(unsafe, ".opencode")
+      try {
+        const { symlink } = await import("node:fs/promises")
+        await symlink(other, linkTarget, process.platform === "win32" ? "junction" : "dir")
+        await assert.rejects(readState(unsafe, sessionID), /state lock unsafe_path/)
+        await assert.rejects(writeState(unsafe, sessionID, { version: 4, jobs: [] }), /state lock unsafe_path/)
+      } catch (error) {
+        if (process.platform !== "win32" || !["EPERM", "EACCES"].includes(error?.code)) throw error
+      }
+    } finally { await rm(other, { recursive: true, force: true }) }
+    console.log("Loop multi-process write/delete races, stale-owner recovery, and unsafe-path regressions passed")
+  } finally {
+    await rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 })
+  }
+}

package/src/index.js

@@ -381,6 +381,7 @@ import { spawn } from "child_process";
 
 // src/source/core/state.js
 import { promises as fs } from "fs";
+import { randomUUID as stateLockRandomUUID } from "crypto";
 import os from "os";
 import path from "path";
 var STATE_DIR = ".opencode/opencode-loop";
@@ -403,6 +404,226 @@ async function pathExists(filePath) {
     return false;
   }
 }
+var STATE_PROCESS_LOCK_TIMEOUT_MS = 5000;
+var STATE_PROCESS_LOCK_POLL_MS = 20;
+function stateLockError(kind, detail) {
+  const error = new Error(`OpenCode Loop state lock ${kind}: ${detail}`);
+  error.code = "OPENCODE_LOOP_STATE_LOCK";
+  return error;
+}
+async function assertStatePathSafe(directory, target) {
+  const root = path.resolve(directory);
+  const relative = path.relative(root, path.resolve(target));
+  if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw stateLockError("unsafe_path", `path escapes project: ${target}`);
+  }
+  let current = root;
+  for (const part of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, part);
+    let info;
+    try {
+      info = await fs.lstat(current);
+    } catch (error) {
+      if (error?.code === "ENOENT")
+        return;
+      throw error;
+    }
+    if (info.isSymbolicLink())
+      throw stateLockError("unsafe_path", `symbolic link or junction: ${current}`);
+  }
+}
+function stateProcessLockOwner() {
+  const token = stateLockRandomUUID();
+  return {
+    schemaVersion: 1,
+    pid: process.pid,
+    token,
+    acquiredAt: Date.now(),
+    candidateName: `.loop-lock-${process.pid}-${token}.json`
+  };
+}
+function stateProcessLockOwnerValid(owner) {
+  return owner?.schemaVersion === 1 && Number.isSafeInteger(owner.pid) && owner.pid > 0 && typeof owner.token === "string" && /^[0-9a-f-]{36}$/i.test(owner.token) && Number.isFinite(owner.acquiredAt) && owner.acquiredAt > 0 && owner.candidateName === `.loop-lock-${owner.pid}-${owner.token}.json` && path.basename(owner.candidateName) === owner.candidateName;
+}
+async function readStateProcessOwner(file) {
+  let raw;
+  for (let attempt = 0;; attempt++) {
+    try {
+      raw = await fs.readFile(file, "utf8");
+      break;
+    } catch (error) {
+      if (error?.code === "ENOENT")
+        return null;
+      if (process.platform !== "win32" || !["EPERM", "EACCES", "EBUSY"].includes(error?.code) || attempt >= 5)
+        throw error;
+      await delay(10 * (attempt + 1));
+    }
+  }
+  if (raw.length === 0) {
+    for (let attempt = 0;attempt < 8 && raw.length === 0; attempt++) {
+      await delay(10 * (attempt + 1));
+      try {
+        raw = await fs.readFile(file, "utf8");
+      } catch (error) {
+        if (error?.code === "ENOENT")
+          return null;
+        throw error;
+      }
+    }
+  }
+  let owner;
+  try {
+    owner = JSON.parse(raw);
+  } catch {
+    throw stateLockError("invalid_owner", `corrupt lock metadata at ${file}`);
+  }
+  if (!stateProcessLockOwnerValid(owner))
+    throw stateLockError("invalid_owner", `invalid lock metadata at ${file}`);
+  return owner;
+}
+function stateProcessAlive(pid) {
+  if (pid === process.pid)
+    return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+async function removeStateProcessFile(file) {
+  for (let attempt = 0;; attempt++) {
+    try {
+      await fs.rm(file, { force: true });
+      return;
+    } catch (error) {
+      if (process.platform !== "win32" || !["EPERM", "EACCES", "EBUSY"].includes(error?.code) || attempt >= 5)
+        throw error;
+      await delay(10 * (attempt + 1));
+    }
+  }
+}
+async function claimStateProcessLock(candidate, canonical) {
+  for (let attempt = 0;; attempt++) {
+    try {
+      await fs.link(candidate, canonical);
+      return true;
+    } catch (error) {
+      if (error?.code === "EEXIST")
+        return false;
+      if (["EISDIR", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EPERM", "EACCES"].includes(error?.code)) {
+        const contents = await fs.readFile(candidate);
+        let handle;
+        try {
+          handle = await fs.open(canonical, "wx", 384);
+        } catch (failure) {
+          if (failure?.code === "EEXIST")
+            return false;
+          throw failure;
+        }
+        try {
+          await handle.writeFile(contents);
+        } catch (failure) {
+          await handle.close().catch(() => {});
+          await removeStateProcessFile(canonical).catch(() => {});
+          throw failure;
+        }
+        await handle.close();
+        return true;
+      }
+      if (process.platform !== "win32" || !["EPERM", "EACCES", "EBUSY"].includes(error?.code) || attempt >= 5)
+        throw error;
+      await delay(10 * (attempt + 1));
+    }
+  }
+}
+async function createStateLockCandidate(directory, owner) {
+  const candidate = path.join(stateDir(directory), owner.candidateName);
+  await assertStatePathSafe(directory, candidate);
+  await fs.writeFile(candidate, `${JSON.stringify(owner)}
+`, { flag: "wx", mode: 384 });
+  return candidate;
+}
+async function recoverDeadStateProcessLock(directory, canonical, stale, depth = 0) {
+  const cleanupFile = `${canonical}.cleanup`;
+  const cleanupOwner = stateProcessLockOwner();
+  const cleanupCandidate = await createStateLockCandidate(directory, cleanupOwner);
+  let elected = false;
+  try {
+    await assertStatePathSafe(directory, cleanupFile);
+    elected = await claimStateProcessLock(cleanupCandidate, cleanupFile);
+    if (!elected) {
+      const existing = await readStateProcessOwner(cleanupFile);
+      if (existing && !stateProcessAlive(existing.pid)) {
+        if (depth >= 6)
+          throw stateLockError("recovery_depth", `too many orphaned cleanup elections for ${canonical}`);
+        await recoverDeadStateProcessLock(directory, cleanupFile, existing, depth + 1);
+      }
+      return false;
+    }
+    const current = await readStateProcessOwner(canonical);
+    if (!current || current.token !== stale.token || current.pid !== stale.pid || stateProcessAlive(current.pid))
+      return false;
+    await assertStatePathSafe(directory, canonical);
+    await removeStateProcessFile(canonical);
+    const staleCandidate = path.join(stateDir(directory), current.candidateName);
+    await assertStatePathSafe(directory, staleCandidate);
+    await removeStateProcessFile(staleCandidate).catch(() => {});
+    return true;
+  } finally {
+    if (elected) {
+      const current = await readStateProcessOwner(cleanupFile).catch(() => null);
+      if (current?.token === cleanupOwner.token)
+        await removeStateProcessFile(cleanupFile);
+    }
+    await removeStateProcessFile(cleanupCandidate).catch(() => {});
+  }
+}
+async function acquireStateProcessLock(directory, sessionID) {
+  const targetDirectory = stateDir(directory);
+  await assertStatePathSafe(directory, targetDirectory);
+  await ensureDir(targetDirectory);
+  await assertStatePathSafe(directory, targetDirectory);
+  const target = statePath(directory, sessionID);
+  const canonical = `${target}.lock`;
+  await assertStatePathSafe(directory, target);
+  await assertStatePathSafe(directory, canonical);
+  const owner = stateProcessLockOwner();
+  const candidate = await createStateLockCandidate(directory, owner);
+  const started = Date.now();
+  let acquired = false;
+  try {
+    while (true) {
+      await assertStatePathSafe(directory, canonical);
+      if (await claimStateProcessLock(candidate, canonical)) {
+        acquired = true;
+        break;
+      }
+      const current = await readStateProcessOwner(canonical);
+      if (current && !stateProcessAlive(current.pid))
+        await recoverDeadStateProcessLock(directory, canonical, current);
+      if (Date.now() - started >= STATE_PROCESS_LOCK_TIMEOUT_MS) {
+        throw stateLockError("timeout", `session ${sessionID} remained locked for ${STATE_PROCESS_LOCK_TIMEOUT_MS}ms`);
+      }
+      await delay(STATE_PROCESS_LOCK_POLL_MS);
+    }
+    return async () => {
+      const current = await readStateProcessOwner(canonical);
+      if (current?.token !== owner.token || current.pid !== owner.pid) {
+        throw stateLockError("lost", `session ${sessionID} lock ownership changed`);
+      }
+      await assertStatePathSafe(directory, canonical);
+      await removeStateProcessFile(canonical);
+      await removeStateProcessFile(candidate);
+    };
+  } catch (error) {
+    if (acquired && (await readStateProcessOwner(canonical).catch(() => null))?.token === owner.token) {
+      await removeStateProcessFile(canonical).catch(() => {});
+    }
+    await removeStateProcessFile(candidate).catch(() => {});
+    throw error;
+  }
+}
 function stateLockKey(directory, sessionID) {
   return `${path.resolve(directory)}:${safeID(sessionID)}`;
 }
@@ -416,21 +637,32 @@ async function withStateWriteLock(directory, sessionID, fn) {
   const next = previous.catch(() => {}).then(() => current);
   stateWriteLocks.set(key, next);
   await previous.catch(() => {});
+  let unlock;
   try {
+    unlock = await acquireStateProcessLock(directory, sessionID);
     return await fn();
   } finally {
-    release();
-    if (stateWriteLocks.get(key) === next)
-      stateWriteLocks.delete(key);
+    try {
+      if (unlock)
+        await unlock();
+    } finally {
+      release();
+      if (stateWriteLocks.get(key) === next)
+        stateWriteLocks.delete(key);
+    }
   }
 }
 async function readStateFile(directory, sessionID) {
   const target = statePath(directory, sessionID);
+  await assertStatePathSafe(directory, target);
   const attempts = 5;
   for (let attempt = 0;attempt < attempts; attempt++) {
     try {
       const parsed = JSON.parse(await fs.readFile(target, "utf8"));
-      return { version: 4, jobs: Array.isArray(parsed.jobs) ? parsed.jobs : [] };
+      if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.jobs)) {
+        throw new SyntaxError("invalid Loop state schema: jobs must be an array");
+      }
+      return { version: 4, jobs: parsed.jobs };
     } catch (error) {
       if (error?.code === "ENOENT")
         return { version: 4, jobs: [] };
@@ -444,7 +676,7 @@ async function readStateFile(directory, sessionID) {
     await ensureDir(stateDir(directory));
     await fs.copyFile(target, `${target}.corrupt-${Date.now()}`);
   } catch {}
-  return { version: 4, jobs: [] };
+  throw new Error(`OpenCode Loop state at ${target} could not be read; refusing to replace persisted jobs.`);
 }
 async function readState(directory, sessionID) {
   const state = await readStateFile(directory, sessionID);
@@ -574,25 +806,31 @@ function mergeStateJobs(baseJobs, intendedJobs, currentJobs) {
 }
 async function writeState(directory, sessionID, state) {
   await withStateWriteLock(directory, sessionID, async () => {
-    await ensureDir(stateDir(directory));
     const target = statePath(directory, sessionID);
+    await assertStatePathSafe(directory, target);
+    const current = await readStateFile(directory, sessionID);
     const baseline = state?.[STATE_BASELINE];
     let jobs = structuredClone(state.jobs || []);
     if (Array.isArray(baseline)) {
-      const current = await readStateFile(directory, sessionID);
       jobs = mergeStateJobs(baseline, jobs, current.jobs || []);
-      state.jobs = structuredClone(jobs);
-      state[STATE_BASELINE] = structuredClone(jobs);
     }
     const payload = JSON.stringify({ version: 4, jobs }, null, 2);
     await writeFileAtomically(target, payload);
+    state.jobs = structuredClone(jobs);
+    if (Array.isArray(baseline))
+      state[STATE_BASELINE] = structuredClone(jobs);
   });
 }
 async function removeState(directory, sessionID) {
   await withStateWriteLock(directory, sessionID, async () => {
+    const target = statePath(directory, sessionID);
+    await assertStatePathSafe(directory, target);
     try {
-      await fs.unlink(statePath(directory, sessionID));
-    } catch {}
+      await fs.unlink(target);
+    } catch (error) {
+      if (error?.code !== "ENOENT")
+        throw error;
+    }
   });
 }