@cortexkit/opencode-magic-context 0.49.0 → 0.49.2

package/src/shared/sqlite-640-review.test.ts

@@ -2,9 +2,10 @@ import { expect, spyOn, test } from "bun:test";
 import { openDatabase } from "../features/magic-context/storage-db";
 import { getOrCreateSessionMeta, updateSessionMeta } from "../features/magic-context/storage-meta";
 import { recordToolDefinition } from "../features/magic-context/tool-definition-tokens";
+import { saveLkgSlotToDb } from "../hooks/magic-context/lkg-persist";
 import { captureLkgSlot } from "../hooks/magic-context/lkg-replay";
 import { lkgReplayFits } from "../hooks/magic-context/lkg-replay-fit";
-import { resetLkgSlotsForTest } from "../hooks/magic-context/lkg-slot";
+import { getSlot, resetLkgSlotsForTest } from "../hooks/magic-context/lkg-slot";
 import type { MessageLike } from "../hooks/magic-context/transform-operations";
 import { createMessagesTransformHandler } from "../plugin/messages-transform";
 import { refreshModelLimitsFromApi } from "./models-dev-cache";
@@ -141,6 +142,9 @@ test("review: OpenCode tries a valid saved request before backed-off writer retr
             providerKey: "openai",
         }),
     ).toBe(true);
+    expect(saveLkgSlotToDb(db, sessionId, getSlot(sessionId)!, undefined, { rebuild: true })).toBe(
+        true,
+    );
     expect(
         lkgReplayFits({
             db,

package/src/shared/storage-file-mutex-review.test.ts

@@ -0,0 +1,162 @@
+import { expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { __resetRpcIdentityTestHooks, __setRpcIdentityTestHooks } from "./rpc-utils";
+import { withStorageFileMutex } from "./storage-file-mutex";
+import { createTestTempDir } from "./test-temp-dir";
+
+const mutex = join(import.meta.dir, "storage-file-mutex.ts");
+
+async function holder(root: string) {
+    const script = `
+import { existsSync } from 'node:fs';
+import { withStorageFileMutex } from ${JSON.stringify(mutex)};
+withStorageFileMutex(${JSON.stringify(join(root, "locks"))}, () => {
+ console.log('HELD');
+ const pause = new Int32Array(new SharedArrayBuffer(4));
+ while (!existsSync(${JSON.stringify(join(root, "release"))})) Atomics.wait(pause, 0, 0, 10);
+});`;
+    const child = Bun.spawn([process.execPath, "--eval", script], {
+        env: {
+            ...process.env,
+            XDG_DATA_HOME: root,
+            XDG_CONFIG_HOME: root,
+            MAGIC_CONTEXT_STORAGE_DIR: root,
+            MAGIC_CONTEXT_TEST_DATA_DIR: root,
+        },
+        stdout: "pipe",
+        stderr: "pipe",
+        windowsHide: true,
+    });
+    const reader = child.stdout.getReader();
+    const first = await reader.read();
+    expect(new TextDecoder().decode(first.value)).toContain("HELD");
+    reader.releaseLock();
+    if (process.platform === "darwin") {
+        const files = spawnSync("/usr/sbin/lsof", ["-p", String(child.pid), "-Fn"], {
+            encoding: "utf8",
+            windowsHide: true,
+        });
+        expect(files.status).toBe(0);
+        const names = files.stdout.split("\n").filter((line) => line.startsWith("n"));
+        expect(
+            names.some((line) =>
+                /\/(?:\.local\/share\/opencode|\.local\/share\/cortexkit\/magic-context|\.config\/(?:opencode|cortexkit))\//.test(
+                    line,
+                ),
+            ),
+        ).toBe(false);
+        console.log(`REVIEW_LSOF pid=${child.pid} paths=${names.length} forbidden=0`);
+    }
+    return child;
+}
+
+test.skipIf(process.platform === "win32")(
+    "independent mutex: paused live holder is not taken over, dead holder is reclaimed",
+    async () => {
+        const { dir: root, cleanup } = createTestTempDir("mc-mutex-review-");
+        const child = await holder(root);
+        try {
+            process.kill(child.pid, "SIGSTOP");
+            const start = performance.now();
+            expect(() =>
+                withStorageFileMutex(
+                    join(root, "locks"),
+                    () => {
+                        throw new Error("LIVE HOLDER WAS TAKEN OVER");
+                    },
+                    200,
+                ),
+            ).toThrow("Storage safety publication lock is unavailable");
+            expect(performance.now() - start).toBeLessThan(2500);
+            process.kill(child.pid, "SIGKILL");
+            await child.exited;
+            let reached = false;
+            withStorageFileMutex(
+                join(root, "locks"),
+                () => {
+                    reached = true;
+                },
+                200,
+            );
+            expect(reached).toBe(true);
+            expect(readdirSync(join(root, "locks"))).toEqual([]);
+        } finally {
+            if (child.exitCode === null) {
+                child.kill("SIGKILL");
+                await child.exited;
+            }
+            cleanup();
+        }
+    },
+    15000,
+);
+
+test.skipIf(process.platform === "win32")(
+    "independent mutex: corrupt live-owner identity refuses within a bound",
+    async () => {
+        const { dir: root, cleanup } = createTestTempDir("mc-mutex-review-");
+        const child = await holder(root);
+        try {
+            const locks = join(root, "locks");
+            const ticket = join(locks, readdirSync(locks)[0]!);
+            expect(JSON.parse(readFileSync(ticket, "utf8")).birth).toBeString();
+            writeFileSync(ticket, "inconclusive owner identity", { mode: 0o600 });
+            const start = performance.now();
+            let entered = false;
+            expect(() =>
+                withStorageFileMutex(
+                    locks,
+                    () => {
+                        entered = true;
+                    },
+                    200,
+                ),
+            ).toThrow("Storage safety publication lock is unavailable");
+            expect(entered).toBe(false);
+            expect(performance.now() - start).toBeLessThan(2500);
+            expect(readdirSync(locks)).toHaveLength(1);
+        } finally {
+            child.kill("SIGKILL");
+            await child.exited;
+            cleanup();
+        }
+    },
+    15000,
+);
+
+test.skipIf(process.platform === "win32")(
+    "independent mutex: denied PID probe is inconclusive and refuses within a bound",
+    async () => {
+        const { dir: root, cleanup } = createTestTempDir("mc-mutex-inconclusive-review-");
+        const child = await holder(root);
+        try {
+            __setRpcIdentityTestHooks({
+                processKill: () => {
+                    throw Object.assign(new Error("Denied PID probe"), { code: "EPERM" });
+                },
+            });
+            const start = performance.now();
+            let entered = false;
+            expect(() =>
+                withStorageFileMutex(
+                    join(root, "locks"),
+                    () => {
+                        entered = true;
+                    },
+                    200,
+                ),
+            ).toThrow("Storage safety publication lock is unavailable");
+            expect(entered).toBe(false);
+            expect(performance.now() - start).toBeLessThan(2500);
+            expect(readdirSync(join(root, "locks"))).toHaveLength(1);
+        } finally {
+            __resetRpcIdentityTestHooks();
+            child.kill("SIGKILL");
+            await child.exited;
+            cleanup();
+        }
+    },
+    15000,
+);

package/src/shared/storage-file-mutex.ts

@@ -0,0 +1,130 @@
+import { execFileSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { readdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { isPidAlive, readProcessStartTime } from "./rpc-utils";
+import {
+    ensurePrivateStorageDirectorySync,
+    writeStorageFileAtomicSync,
+    writeStorageFileSync,
+} from "./storage-permissions";
+
+interface Ticket {
+    choosing: boolean;
+    number: number;
+    birth: string | null;
+    checksum: string;
+}
+const ticketChecksum = (name: string, ticket: Ticket) =>
+    createHash("sha256")
+        .update(JSON.stringify([name, ticket.choosing, ticket.number, ticket.birth]))
+        .digest("hex");
+function processBirth(pid: number): string | null {
+    if (process.platform === "linux") {
+        try {
+            const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+            const ticks = stat
+                .slice(stat.lastIndexOf(")") + 2)
+                .trim()
+                .split(/\s+/)[19];
+            if (!ticks || !/^\d+$/.test(ticks)) return null;
+            return `${readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim()}:${ticks}`;
+        } catch {
+            return null;
+        }
+    }
+    if (process.platform === "darwin") {
+        try {
+            return (
+                execFileSync("ps", ["-p", String(pid), "-o", "lstart="], {
+                    encoding: "utf8",
+                    timeout: 1000,
+                    windowsHide: true,
+                    env: { ...process.env, TZ: "UTC", LC_ALL: "C" },
+                    stdio: ["ignore", "pipe", "pipe"],
+                }).trim() || null
+            );
+        } catch {
+            return null;
+        }
+    }
+    const start = readProcessStartTime(pid);
+    return start === null ? null : String(start);
+}
+const pause = new Int32Array(new SharedArrayBuffer(4));
+
+/**
+ * Lamport's bakery mutex using unique contender files on a local filesystem.
+ * Exclusive creation and atomic replacement work on POSIX and Windows. A dead
+ * owner is removed by PID/start-time evidence, never by age: a paused live
+ * publisher must not lose its lock. Uncertain liveness refuses after the budget.
+ * Unique names mean reclaiming a dead ticket cannot unlink a successor's lock.
+ */
+export function withStorageFileMutex<T>(directory: string, work: () => T, timeoutMs = 1000): T {
+    ensurePrivateStorageDirectorySync(directory);
+    const name = `${process.pid}-${randomUUID()}.lock`;
+    const ownPath = join(directory, name);
+    const birth = processBirth(process.pid);
+    const ticket: Ticket = { choosing: true, number: 0, birth, checksum: "" };
+    const encodedTicket = () =>
+        JSON.stringify({ ...ticket, checksum: ticketChecksum(name, ticket) });
+    writeStorageFileSync(ownPath, encodedTicket(), { flag: "wx", forcePrivate: true });
+    const deadline = performance.now() + timeoutMs;
+    const peers = (): [string, Ticket | null][] => {
+        const found: [string, Ticket | null][] = [];
+        for (const other of readdirSync(directory)) {
+            if (other === name || !/^\d+-[\da-f-]+\.lock$/.test(other)) continue;
+            const pid = Number(other.split("-")[0]);
+            const otherPath = join(directory, other);
+            let value: Ticket | null = null;
+            try {
+                const parsed = JSON.parse(readFileSync(otherPath, "utf8")) as Ticket;
+                if (
+                    typeof parsed.choosing === "boolean" &&
+                    Number.isSafeInteger(parsed.number) &&
+                    parsed.number >= 0 &&
+                    (parsed.birth === null || typeof parsed.birth === "string") &&
+                    parsed.checksum === ticketChecksum(other, parsed)
+                )
+                    value = parsed;
+            } catch (error) {
+                if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+            }
+            const alive = isPidAlive(pid);
+            const actualBirth = alive === "alive" && value?.birth ? processBirth(pid) : null;
+            if (
+                alive === "dead" ||
+                (actualBirth !== null && value?.birth && actualBirth !== value.birth)
+            ) {
+                rmSync(otherPath, { force: true });
+                continue;
+            }
+            found.push([other, value]);
+        }
+        return found;
+    };
+    try {
+        ticket.number = 1 + Math.max(0, ...peers().map(([, value]) => value?.number ?? 0));
+        ticket.choosing = false;
+        writeStorageFileAtomicSync(ownPath, encodedTicket(), true);
+        while (
+            peers().some(
+                ([other, value]) =>
+                    !value ||
+                    value.choosing ||
+                    value.number < ticket.number ||
+                    (value.number === ticket.number && other < name),
+            )
+        ) {
+            if (performance.now() >= deadline)
+                throw new Error("Storage safety publication lock is unavailable");
+            Atomics.wait(pause, 0, 0, 10);
+        }
+        const result = work();
+        if (result && typeof (result as { then?: unknown }).then === "function")
+            throw new TypeError("Storage publication mutex requires synchronous work");
+        return result;
+    } finally {
+        rmSync(ownPath, { force: true });
+    }
+}

package/src/shared/storage-permissions.ts

@@ -10,6 +10,7 @@ import {
     chmodSync,
     closeSync,
     createWriteStream,
+    fsyncSync,
     lstatSync,
     mkdirSync,
     openSync,
@@ -54,6 +55,15 @@ export function ensureStorageDirectorySync(
     });
 }
 
+/** Replay-authorizing files require a private real directory, even after a permissive restore. */
+export function ensurePrivateStorageDirectorySync(directory: string): void {
+    ensureStorageDirectorySync(directory, true);
+    const stat = lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error("Private storage directory is not a real directory");
+    if (process.platform !== "win32") chmodSync(directory, 0o700);
+}
+
 /** Create or replace a storage file using a private mode from the first byte. */
 export function writeStorageFileSync(
     filePath: string,
@@ -85,6 +95,42 @@ export function writeStorageFileAtomicSync(
     }
 }
 
+/** Flush the namespace containing a safety-critical sidecar (POSIX only). */
+export function syncStorageDirectorySync(directory: string): void {
+    const fd = openSync(directory, "r");
+    try {
+        fsyncSync(fd);
+    } finally {
+        closeSync(fd);
+    }
+}
+
+/** Publish a safety record only after both its bytes and directory entry are durable. */
+export function writeStorageFileDurableAtomicSync(
+    filePath: string,
+    content: string,
+    afterTempSync?: () => void,
+): void {
+    const directory = dirname(filePath);
+    ensurePrivateStorageDirectorySync(directory);
+    const tempPath = `${filePath}.${process.pid}.${randomBytes(12).toString("hex")}.tmp`;
+    let fd: number | undefined;
+    try {
+        fd = openStorageFileSync(tempPath, "wx", true);
+        writeFileSync(fd, content, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        afterTempSync?.();
+        renameSync(tempPath, filePath);
+        syncStorageDirectorySync(directory);
+        syncStorageDirectorySync(dirname(directory));
+    } finally {
+        if (fd !== undefined) closeSync(fd);
+        rmSync(tempPath, { force: true });
+    }
+}
+
 export function copyStorageFileSync(
     sourcePath: string,
     destinationPath: string,