@doubling/compound-sync 1.7.1 → 1.10.1

package/auth-persistence.js

@@ -31,6 +31,18 @@ export function resolveAuthFilePath({ authFileEnv, homeDir, projectId, accountKe
 }
 
 export function makeFilePersistence(filePath) {
+  // Freeze guard: starts true. During daemon startup the Firebase Auth
+  // SDK validates the cached refresh token against the backend. With
+  // App Check enforcement on Authentication enabled, that validation
+  // request lacks an App Check header (App Check is initialized after
+  // authStateReady today), the backend rejects, and the SDK calls
+  // _remove(userKey) on our persistence, wiping credentials. While
+  // frozen, _remove is a no-op. The daemon calls FilePersistence.unfreeze()
+  // after authStateReady resolves, restoring normal sign-out behavior.
+  // Per factory call (per account): unfreezing one account's persistence
+  // must not unfreeze another's.
+  let frozen = true;
+
   function readStore() {
     try {
       return JSON.parse(fs.readFileSync(filePath, 'utf8'));
@@ -41,8 +53,17 @@ export function makeFilePersistence(filePath) {
   }
 
   function writeStore(store) {
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(store), { mode: 0o600 });
+    // Atomic write: temp file + rename. fs.writeFileSync is not atomic,
+    // so a crash or kill mid-write would truncate the credentials file
+    // and the next launch would read it as an empty store (parse fail
+    // = {}), forcing a browser popup. rename(2) on the same filesystem
+    // is atomic, so on-disk state is always either the prior valid
+    // JSON or the new valid JSON.
+    const dir = path.dirname(filePath);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.tmp`);
+    fs.writeFileSync(tmp, JSON.stringify(store), { mode: 0o600 });
+    fs.renameSync(tmp, filePath);
   }
 
   return class FilePersistence {
@@ -51,6 +72,13 @@ export function makeFilePersistence(filePath) {
     static type = 'LOCAL';
     type = 'LOCAL';
 
+    // Called by the daemon once auth restore is past the validation
+    // window (after authStateReady). Sign-out _remove calls after this
+    // point are honored normally.
+    static unfreeze() {
+      frozen = false;
+    }
+
     async _isAvailable() {
       return true;
     }
@@ -67,6 +95,10 @@ export function makeFilePersistence(filePath) {
     }
 
     async _remove(key) {
+      // See the freeze comment above the closure. During init we keep
+      // the cached credential rather than letting the SDK's startup
+      // validation wipe it.
+      if (frozen) return;
       const store = readStore();
       delete store[key];
       writeStore(store);

package/files.js

@@ -264,11 +264,20 @@ export async function deleteFolderFromCloud({
  *               and for new files defaults to 'text/markdown' to keep
  *               legacy callers working.
  *
+ *   - localModifiedAt: ISO timestamp of the local file's last
+ *               modification (mtime). When provided, a push that would
+ *               overwrite a server copy whose `updatedAt` is strictly
+ *               newer is skipped instead, so an older local file cannot
+ *               clobber a newer remote edit (last-write-wins, symmetric
+ *               with the firestore -> local pull guard). Omit it to
+ *               force the push regardless of timestamps (legacy callers).
+ *
  * Returns one of:
- *   { action: 'skipped', reason: 'shared-scope' }
- *   { action: 'noop',    fileId }
- *   { action: 'created', fileId, fileData, storageError? }
- *   { action: 'updated', fileId, storageError? }
+ *   { action: 'skipped',       reason: 'shared-scope' }
+ *   { action: 'noop',          fileId }
+ *   { action: 'skipped-stale', fileId }  // server copy is newer
+ *   { action: 'created',       fileId, fileData, storageError? }
+ *   { action: 'updated',       fileId, storageError? }
  */
 export async function pushFileToCloud({
   filesRef,
@@ -281,6 +290,14 @@ export async function pushFileToCloud({
   data,
   mimeType,
   now = new Date().toISOString(),
+  localModifiedAt = null,
+  // The contentHash this caller saw as "current" when it last pulled.
+  // If the existing remote doc has a different contentHash, another
+  // writer landed an edit in the meantime; we refuse to overwrite and
+  // return action='conflict' so the caller can write a conflict copy
+  // and pull the new remote state. Undefined disables the check (used
+  // for create-from-nothing where no baseline exists).
+  expectedRemoteHash = undefined,
 }) {
   if (scope === 'shared-with-me' || scope === 'shared-by-me') {
     return { action: 'skipped', reason: 'shared-scope' };
@@ -362,6 +379,30 @@ export async function pushFileToCloud({
       && (existing.parentId == null ? null : existing.parentId) === parentId) {
     return { action: 'noop', fileId: docSnap.id };
   }
+  // Compare-and-swap (DOU-167): if the caller passed a baseline of
+  // what they last saw as current, refuse the push when the remote
+  // has moved on. The daemon will write the proposed local content
+  // to a sibling conflict file and pull the new remote state into
+  // the live path. Without this guard, a stale push silently
+  // overwrites another user's freshly-saved edits (data loss).
+  if (
+    expectedRemoteHash !== undefined &&
+    existing.contentHash !== expectedRemoteHash
+  ) {
+    return {
+      action: 'conflict',
+      fileId: docSnap.id,
+      remoteHash: existing.contentHash,
+      remoteData: { id: docSnap.id, ...existing },
+    };
+  }
+  // Last-write-wins: never let an older local file overwrite a newer
+  // server edit. The caller (sync daemon) passes the local file's mtime;
+  // if the server doc was updated more recently, leave it for the
+  // firestore -> local pull to bring down instead.
+  if (localModifiedAt && existing.updatedAt && existing.updatedAt > localModifiedAt) {
+    return { action: 'skipped-stale', fileId: docSnap.id };
+  }
   const resolvedMime = mimeType || existing.mimeType || 'text/markdown';
   await updateDoc(docSnap.ref, {
     type: 'file',