@doubling/compound-sync 1.12.6 → 1.13.0

package/org-sync.js

@@ -559,9 +559,30 @@ export async function startOrgSync({ db, storage, userId, orgId, localPath, maxU
     // route local paths once the watcher starts. Per-team file listeners
     // and the live teams-collection onSnapshot are wired after reconcile
     // completes so their initial snapshots cannot race with startup cleanup.
-    const teamsSnap = await getDocs(collection(db, `orgs/${orgId}/teams`));
+    //
+    // Filter to teams the user has an explicit teamMember doc for. Any
+    // orgMember can list every team in `orgs/{orgId}/teams`
+    // (firestore.rules:77), but file reads require canAccessTeam, which
+    // means isOrgOwner OR isTeamMember. Without this filter, manifest
+    // reconcile's per-team `where teamId == X` query throws
+    // permission-denied on any team the user is not in and the daemon
+    // process crashes (DOU-269). Restricting teamRegistry to teams the
+    // user has joined matches the daemon's "only sync what I'm in"
+    // semantic and prevents the crash.
+    const [teamsSnap, teamMembersSnap] = await Promise.all([
+        getDocs(collection(db, `orgs/${orgId}/teams`)),
+        getDocs(query(collection(db, `orgs/${orgId}/teamMembers`), where('userId', '==', userId))),
+    ]);
+    const memberTeamIds = new Set();
+    for (const memberDoc of teamMembersSnap.docs) {
+        const teamIdValue = memberDoc.data()['teamId'];
+        if (typeof teamIdValue === 'string')
+            memberTeamIds.add(teamIdValue);
+    }
     for (const teamDoc of teamsSnap.docs) {
-        teamRegistry.bootstrap(teamDoc.id, teamDoc.data());
+        if (memberTeamIds.has(teamDoc.id)) {
+            teamRegistry.bootstrap(teamDoc.id, teamDoc.data());
+        }
     }
     console.log(`  [${orgId}] Teams: ${teamRegistry.names().join(', ') || 'none'}`);
     function trackingKeyFromDocData(data) {
@@ -741,66 +762,86 @@ export async function startOrgSync({ db, storage, userId, orgId, localPath, maxU
             ...cloudByKey.keys(),
         ]);
         for (const trackingKey of allKeys) {
-            const entry = manifestStore.getEntry(trackingKey);
-            let localFilePath = localByKey.get(trackingKey) ?? null;
-            const cloud = cloudByKey.get(trackingKey) ?? null;
-            if (!localFilePath && cloud) {
-                localFilePath = localPathForCloudData(cloud.data);
-            }
-            const onDisk = !!(localFilePath && fs.existsSync(localFilePath));
-            if (entry && onDisk && !cloud) {
-                let localHash;
-                try {
-                    ({ contentHash: localHash } = readLocalFilePayload(localFilePath));
-                }
-                catch {
-                    localHash = null;
-                }
-                if (localHash === null) {
-                    console.warn(`  [${orgId}] [manifest reconcile] skip unreadable local file ${trackingKey}`);
-                }
-                else if (entry.contentHash && localHash !== entry.contentHash) {
-                    await pushLocalFileAtPath(localFilePath);
-                }
-                else {
-                    deleteLocalReconcile(localFilePath, entry.fileId, trackingKey);
+            // Each per-file reconcile decision (push, remote delete, local
+            // delete, manifest upsert) is independently fallible. Per-file
+            // permission failures are surprisingly common in long-lived orgs:
+            // stale teamIds on docs created before a team was reorganized,
+            // private files whose ownership shifted to a deleted account,
+            // sharedWith arrays with uids the user can read but not write,
+            // etc. Without per-iteration error isolation, a single bad doc
+            // crashes the daemon during reconcile and the supervisor
+            // relaunches in an indefinite backoff loop (DOU-269).
+            //
+            // Catching here means: one bad file is logged and skipped, the
+            // rest of reconcile proceeds, the daemon reaches "Sync running",
+            // and a human reading the log can identify which file is stale.
+            try {
+                const entry = manifestStore.getEntry(trackingKey);
+                let localFilePath = localByKey.get(trackingKey) ?? null;
+                const cloud = cloudByKey.get(trackingKey) ?? null;
+                if (!localFilePath && cloud) {
+                    localFilePath = localPathForCloudData(cloud.data);
                 }
-            }
-            else if (!entry && onDisk && !cloud) {
-                const baselineHash = lastSyncedHash.get(trackingKey);
-                let localHash;
-                try {
-                    ({ contentHash: localHash } = readLocalFilePayload(localFilePath));
+                const onDisk = !!(localFilePath && fs.existsSync(localFilePath));
+                if (entry && onDisk && !cloud) {
+                    let localHash;
+                    try {
+                        ({ contentHash: localHash } = readLocalFilePayload(localFilePath));
+                    }
+                    catch {
+                        localHash = null;
+                    }
+                    if (localHash === null) {
+                        console.warn(`  [${orgId}] [manifest reconcile] skip unreadable local file ${trackingKey}`);
+                    }
+                    else if (entry.contentHash && localHash !== entry.contentHash) {
+                        await pushLocalFileAtPath(localFilePath);
+                    }
+                    else {
+                        deleteLocalReconcile(localFilePath, entry.fileId, trackingKey);
+                    }
                 }
-                catch {
-                    localHash = null;
+                else if (!entry && onDisk && !cloud) {
+                    const baselineHash = lastSyncedHash.get(trackingKey);
+                    let localHash;
+                    try {
+                        ({ contentHash: localHash } = readLocalFilePayload(localFilePath));
+                    }
+                    catch {
+                        localHash = null;
+                    }
+                    if (localHash === null) {
+                        console.warn(`  [${orgId}] [manifest reconcile] skip unreadable local file ${trackingKey}`);
+                    }
+                    else if (baselineHash && localHash === baselineHash) {
+                        deleteLocalReconcile(localFilePath, null, trackingKey);
+                    }
+                    else {
+                        await pushLocalFileAtPath(localFilePath);
+                    }
                 }
-                if (localHash === null) {
-                    console.warn(`  [${orgId}] [manifest reconcile] skip unreadable local file ${trackingKey}`);
+                else if (entry && !onDisk && cloud) {
+                    await deleteRemoteReconcile(cloud.data, trackingKey);
                 }
-                else if (baselineHash && localHash === baselineHash) {
-                    deleteLocalReconcile(localFilePath, null, trackingKey);
+                else if ((entry || cloud) && onDisk && cloud) {
+                    manifestStore.upsertEntry(trackingKey, {
+                        fileId: cloud.fileId,
+                        contentHash: cloud.data['contentHash'],
+                        lastSyncedAt: cloud.data['updatedAt'] || cloud.data['createdAt'] || new Date().toISOString(),
+                    });
                 }
-                else {
-                    await pushLocalFileAtPath(localFilePath);
+                else if (!entry && onDisk && cloud) {
+                    manifestStore.upsertEntry(trackingKey, {
+                        fileId: cloud.fileId,
+                        contentHash: cloud.data['contentHash'],
+                        lastSyncedAt: cloud.data['updatedAt'] || cloud.data['createdAt'] || new Date().toISOString(),
+                    });
                 }
             }
-            else if (entry && !onDisk && cloud) {
-                await deleteRemoteReconcile(cloud.data, trackingKey);
-            }
-            else if ((entry || cloud) && onDisk && cloud) {
-                manifestStore.upsertEntry(trackingKey, {
-                    fileId: cloud.fileId,
-                    contentHash: cloud.data['contentHash'],
-                    lastSyncedAt: cloud.data['updatedAt'] || cloud.data['createdAt'] || new Date().toISOString(),
-                });
-            }
-            else if (!entry && onDisk && cloud) {
-                manifestStore.upsertEntry(trackingKey, {
-                    fileId: cloud.fileId,
-                    contentHash: cloud.data['contentHash'],
-                    lastSyncedAt: cloud.data['updatedAt'] || cloud.data['createdAt'] || new Date().toISOString(),
-                });
+            catch (err) {
+                const code = err?.code;
+                const message = err instanceof Error ? err.message : String(err);
+                console.warn(`  [${orgId}] [manifest reconcile] skip ${trackingKey}: ${code ?? 'error'}: ${message}`);
             }
         }
         manifestStore.flush();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doubling/compound-sync",
-  "version": "1.12.6",
+  "version": "1.13.0",
   "description": "Bidirectional sync between Compound and local markdown files",
   "type": "module",
   "bin": {
@@ -51,7 +51,7 @@
     "typecheck": "tsc --noEmit",
     "prepack": "npm run build",
     "test:unit": "node --import tsx --test config.test.ts paths.test.ts storage-helpers.test.ts folder-chain.test.ts team-registry.test.ts auth-persistence.test.ts pre-mint-app-check.test.ts setup-auth-with-pre-mint.test.ts sync-state.test.ts manifest.test.ts push-outcome.test.ts yjs-file-binding.test.ts yjs-binding-state.test.ts files-helpers.test.ts",
-    "test:integration": "node --import tsx --test --test-timeout=180000 files-push-create-private.test.ts files-push-create-team.test.ts files-push-update-private.test.ts files-push-binary.test.ts files-push-staleness.test.ts files-push-storage-fail.test.ts files-push-no-content.test.ts files-push-stamps.test.ts files-push-folder.test.ts files-delete.test.ts files-delete-folder.test.ts files-read-blob.test.ts org-sync-local-edit.test.ts org-sync-file-ops.test.ts org-sync-mtime.test.ts org-sync-rename.test.ts org-sync-yjs-pull.test.ts org-sync-yjs-push.test.ts org-sync-cold-start.test.ts org-sync-startup-ordering.test.ts org-sync-manifest-reconcile.test.ts org-sync-special-chars.test.ts org-sync-copy.test.ts two-user-happy-paths.test.ts two-user-yjs-convergence.test.ts files-concurrency-folder-create.test.ts files-concurrency-file-create.test.ts files-concurrency-file-create-sandbox.test.ts files-concurrency-file-delete.test.ts files-concurrency-folder-delete.test.ts",
+    "test:integration": "node --import tsx --test --test-timeout=180000 files-push-create-private.test.ts files-push-create-team.test.ts files-push-update-private.test.ts files-push-binary.test.ts files-push-staleness.test.ts files-push-storage-fail.test.ts files-push-no-content.test.ts files-push-stamps.test.ts files-push-folder.test.ts files-delete.test.ts files-delete-folder.test.ts files-read-blob.test.ts org-sync-local-edit.test.ts org-sync-file-ops.test.ts org-sync-mtime.test.ts org-sync-rename.test.ts org-sync-yjs-pull.test.ts org-sync-yjs-push.test.ts org-sync-cold-start.test.ts org-sync-startup-ordering.test.ts org-sync-manifest-reconcile.test.ts org-sync-team-membership-filter.test.ts org-sync-special-chars.test.ts org-sync-copy.test.ts two-user-happy-paths.test.ts two-user-yjs-convergence.test.ts files-concurrency-folder-create.test.ts files-concurrency-file-create.test.ts files-concurrency-file-create-sandbox.test.ts files-concurrency-file-delete.test.ts files-concurrency-folder-delete.test.ts",
     "test:integration:emulator": "USE_EMULATOR=true firebase emulators:exec --only firestore,storage,auth 'npm run test:integration'",
     "test": "npm run test:unit && npm run test:integration"
   },