@logicseek/hello-cc 1.0.0 → 1.0.2-dsh.3

package/lib/cli/commands/gc.mjs

@@ -39,6 +39,8 @@ import {
 } from '../../runtime/buffer-gc.mjs';
 import { applyClockSafeBufferPlan } from '../../runtime/buffer-gc-protocol.mjs';
 
+export const RUNTIME_BUFFER_GC_TIMEOUT_MS = 30_000;
+
 export function createGcCommands(deps) {
   const {
     connect, now, helpGc,
@@ -109,7 +111,8 @@ function observeGcClockSafety(ctx, db, {
   observedAt,
   historyCategories,
   includeStalePeers,
-  historySnapshot
+  historySnapshot,
+  bufferPathGuard = null
 }) {
   try {
     return runOptimisticEvidenceMutation(db, {
@@ -124,10 +127,13 @@ function observeGcClockSafety(ctx, db, {
       }),
       observe: (subject) => observeGcEvidence(ctx, subject),
       same: (left, right) => JSON.stringify(left) === JSON.stringify(right),
-      beforeMutate: (subject, evidenceByOwner) => observeClockSafetyInTransactionOrThrow(
-        db,
-        gcClockSafetyOptions(subject, evidenceByOwner, olderThanDays)
-      ),
+      beforeMutate: (subject, evidenceByOwner) => {
+        if (bufferPathGuard) assertBufferDirectoryPathUnchanged(bufferPathGuard);
+        return observeClockSafetyInTransactionOrThrow(
+          db,
+          gcClockSafetyOptions(subject, evidenceByOwner, olderThanDays)
+        );
+      },
       changedMessage: 'GC subjects changed while clock evidence was being observed; retry',
       mutate: (subject, evidenceByOwner, observation) => ({
         ...observation,
@@ -192,6 +198,128 @@ function previewGcClockSafety(ctx, db, options) {
   }
 }
 
+function bufferDirectoryPathForbidden(message, directory) {
+  return new CliError('PROJECT_PATH_FORBIDDEN', `${message}: ${directory}`);
+}
+
+function assertBufferDirectoryPathUnchanged(captured) {
+  let resolvedRoot;
+  try {
+    resolvedRoot = fs.realpathSync.native(captured.requestedRoot);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    throw bufferDirectoryPathForbidden(
+      'Project root changed during buffer GC',
+      captured.requestedRoot
+    );
+  }
+  if (resolvedRoot !== captured.canonicalRoot) {
+    throw bufferDirectoryPathForbidden(
+      'Project root changed during buffer GC',
+      captured.requestedRoot
+    );
+  }
+  for (const component of captured.components) {
+    let current;
+    try {
+      current = fs.lstatSync(component.path);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+      throw bufferDirectoryPathForbidden(
+        'Buffer directory path changed during lease acquisition',
+        captured.directory
+      );
+    }
+    if (current.isSymbolicLink() || !current.isDirectory() ||
+        current.dev !== component.stat.dev || current.ino !== component.stat.ino) {
+      throw bufferDirectoryPathForbidden(
+        'Buffer directory path changed during lease acquisition',
+        captured.directory
+      );
+    }
+  }
+  if (!captured.exists) {
+    try {
+      fs.lstatSync(captured.directory);
+    } catch (error) {
+      if (error?.code === 'ENOENT') return;
+      throw error;
+    }
+    throw bufferDirectoryPathForbidden(
+      'Buffer directory path changed during lease acquisition',
+      captured.directory
+    );
+  }
+}
+
+function captureRequiredBufferDirectoryComponent(component, description) {
+  const stat = fs.lstatSync(component);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw bufferDirectoryPathForbidden(`${description} must be a real directory`, component);
+  }
+  return { path: component, stat };
+}
+
+function captureOptionalBufferDirectory(root, directoryName) {
+  const requestedRoot = path.resolve(root);
+  const canonicalRoot = fs.realpathSync.native(requestedRoot);
+  const stateDirectory = path.join(canonicalRoot, '.hello-cc');
+  const directory = path.join(stateDirectory, directoryName);
+  const components = [
+    captureRequiredBufferDirectoryComponent(canonicalRoot, 'Project root'),
+    captureRequiredBufferDirectoryComponent(stateDirectory, 'Project state directory')
+  ];
+
+  let stat;
+  try {
+    stat = fs.lstatSync(directory);
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      const captured = {
+        requestedRoot,
+        canonicalRoot,
+        directory,
+        components,
+        exists: false
+      };
+      assertBufferDirectoryPathUnchanged(captured);
+      return captured;
+    }
+    throw error;
+  }
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    throw bufferDirectoryPathForbidden('Buffer directory must be a real directory', directory);
+  }
+  components.push({ path: directory, stat });
+  return { requestedRoot, canonicalRoot, directory, components, exists: true };
+}
+
+function collectGuardedBufferEvidence(collector, captured) {
+  const evidence = collector(captured.directory);
+  assertBufferDirectoryPathUnchanged(captured);
+  return evidence;
+}
+
+function withOptionalBufferDirectoryLease(captured, callback) {
+  assertBufferDirectoryPathUnchanged(captured);
+  if (!captured.exists) return null;
+  return withBufferDirectoryLease(captured.directory, (leasedDirectory) => {
+    const assertDirectoryUnchanged = () => {
+      assertBufferDirectoryPathUnchanged(captured);
+      if (fs.realpathSync.native(captured.directory) !== leasedDirectory) {
+        throw bufferDirectoryPathForbidden(
+          'Buffer directory path changed during lease acquisition',
+          captured.directory
+        );
+      }
+    };
+    assertDirectoryUnchanged();
+    const result = callback(leasedDirectory, assertDirectoryUnchanged);
+    assertDirectoryUnchanged();
+    return result;
+  }, { createParent: false });
+}
+
 function runGc(ctx, db, {
   olderThanDays = 7,
   dryRun = false,
@@ -203,6 +331,9 @@ function runGc(ctx, db, {
   history = false,
   observedAt = null
 } = {}) {
+  const bufferPathGuard = skipBufferFiles
+    ? null
+    : captureOptionalBufferDirectory(ctx.root, BUFS_DIR_NAME);
   const auto = scope === 'auto';
   const historyCategories = auto ? ['events'] : ['events', 'tasks', 'messages', 'handoffs'];
   const applyHistory = auto || history;
@@ -213,16 +344,19 @@ function runGc(ctx, db, {
     : gcNow * 1000 - (auto ? Math.min(olderThanDays, 7) : olderThanDays) * 86400000;
   const bufferRetentionSec = (auto ? Math.min(olderThanDays, 7) : olderThanDays) * 86400;
   const preparedBufferEvidence = !skipBufferFiles && collectBufferEvidenceNow
-    ? collectBufferEvidenceNow()
+    ? collectGuardedBufferEvidence(collectBufferEvidenceNow, bufferPathGuard)
     : null;
-  const bufferGcCutoffs = bufferDirectoryPaths(bufferDirectory(ctx)).flatMap((file) => {
-    try {
-      const stat = fs.lstatSync(file);
-      return [Math.max(0, Math.floor(stat.mtimeMs / 1000) + bufferRetentionSec)];
-    } catch {
-      return [];
-    }
-  });
+  const bufferGcCutoffs = skipBufferFiles
+    ? []
+    : bufferDirectoryPaths(bufferPathGuard.directory).flatMap((file) => {
+        try {
+          const stat = fs.lstatSync(file);
+          return [Math.max(0, Math.floor(stat.mtimeMs / 1000) + bufferRetentionSec)];
+        } catch {
+          return [];
+        }
+      });
+  if (bufferPathGuard) assertBufferDirectoryPathUnchanged(bufferPathGuard);
   bufferGcCutoffs.push(...(preparedBufferEvidence?.gcCutoffs || []));
   const historySnapshot = createHistoryGcSnapshot(db, gcNow - retentionSec, {
     categories: historyCategories,
@@ -245,7 +379,8 @@ function runGc(ctx, db, {
       bufferGcCutoffs,
       historyCategories,
       gcNow,
-      historySnapshot
+      historySnapshot,
+      bufferPathGuard
     }),
     'History GC run'
   );
@@ -266,6 +401,7 @@ function runGcWithHistorySnapshot(ctx, db, {
   historyCategories,
   gcNow,
   historySnapshot,
+  bufferPathGuard = null,
   clockObservation: preparedClockObservation = null,
   forceDefer = false
 }) {
@@ -275,17 +411,23 @@ function runGcWithHistorySnapshot(ctx, db, {
     observedAt: gcNow,
     historyCategories,
     includeStalePeers: !auto,
-    historySnapshot
+    historySnapshot,
+    bufferPathGuard
   });
   const graceActive = forceDefer || clockGraceSuppressed(gcNow, clockObservation.graceUntil);
   let databaseGraceActive = graceActive;
   const beforeDatabaseMutate = () => {
+    if (bufferPathGuard) assertBufferDirectoryPathUnchanged(bufferPathGuard);
     if (databaseGraceActive) return false;
     try {
       const observedAt = now();
       const allowed = !clockGraceSuppressed(observedAt, readClockGraceUntil(db));
-      if (!allowed) databaseGraceActive = true;
-      return allowed;
+      if (!allowed) {
+        databaseGraceActive = true;
+        return false;
+      }
+      if (bufferPathGuard) assertBufferDirectoryPathUnchanged(bufferPathGuard);
+      return true;
     } catch (error) {
       if (error instanceof CliError) throw error;
       throw clockSafetyUnavailable(error);
@@ -325,14 +467,16 @@ function runGcWithHistorySnapshot(ctx, db, {
   const bufCutoffMs = Number.isFinite(bufferCutoffMs)
     ? bufferCutoffMs
     : gcNow * 1000 - (auto ? Math.min(olderThanDays, 7) : olderThanDays) * 86400000;
-  const bufsDir = path.join(ctx.root, '.hello-cc', BUFS_DIR_NAME);
   if (!graceActive && !skipBufferFiles) {
-    const bufferResult = withBufferDirectoryLease(bufsDir, () => {
+    const bufferResult = withOptionalBufferDirectoryLease(bufferPathGuard, (
+      leasedBufsDir,
+      assertDirectoryUnchanged
+    ) => {
       const currentEvidence = collectBufferEvidenceNow
-        ? collectBufferEvidenceNow()
+        ? collectGuardedBufferEvidence(collectBufferEvidenceNow, bufferPathGuard)
         : preparedBufferEvidence || { protectedPaths: protectedBuffers, unknownPaths: new Set(), gcCutoffs: [] };
       const currentPlan = planBufferFiles({
-        directories: [bufsDir],
+        directories: [leasedBufsDir],
         cutoffMs: bufCutoffMs,
         protectedPaths: currentEvidence.protectedPaths,
         unknownPaths: currentEvidence.unknownPaths,
@@ -341,12 +485,16 @@ function runGcWithHistorySnapshot(ctx, db, {
           ...(currentEvidence.gcCutoffs || [])
         ]
       });
+      assertDirectoryUnchanged();
       const currentObservedAt = now();
-      const currentObservation = tx(db, () => observeClockSafetyInTransaction(db, {
-        operation: 'gc',
-        gcCutoffs: bufferPlanGcCutoffs(currentPlan, bufferRetentionSec),
-        nowSec: currentObservedAt
-      }));
+      const currentObservation = tx(db, () => {
+        assertDirectoryUnchanged();
+        return observeClockSafetyInTransaction(db, {
+          operation: 'gc',
+          gcCutoffs: bufferPlanGcCutoffs(currentPlan, bufferRetentionSec),
+          nowSec: currentObservedAt
+        });
+      });
       if (clockGraceSuppressed(currentObservedAt, currentObservation.graceUntil)) {
         databaseGraceActive = true;
         return deferBufferPlan(currentPlan);
@@ -360,9 +508,11 @@ function runGcWithHistorySnapshot(ctx, db, {
       }
       return applyBufferPlan(currentPlan);
     });
-    results.buf_files = bufferResult.deleted;
-    results.protected_buf_files = bufferResult.protected;
-    results.deferred_buf_files = bufferResult.deferred;
+    if (bufferResult !== null) {
+      results.buf_files = bufferResult.deleted;
+      results.protected_buf_files = bufferResult.protected;
+      results.deferred_buf_files = bufferResult.deferred;
+    }
   }
 
   // A clock jump can make every lock look expired at once. Preserve those rows
@@ -589,7 +739,7 @@ async function prepareManualBufferGc(ctx, db, { retentionSec, dryRun }) {
         phase: 'prepare',
         retentionSec,
         dryRun
-      }, runtime, { timeoutMs: 5000 });
+      }, runtime, { timeoutMs: RUNTIME_BUFFER_GC_TIMEOUT_MS });
       return {
         mode: 'runtime',
         runtime,
@@ -668,7 +818,7 @@ async function applyManualBufferGc(ctx, db, prepared, { dryRun, graceActive }) {
     const applied = await runtimeRequest(ctx, 'POST', '/api/runtime/gc-buffers', {
       phase: 'apply',
       token: prepared.token
-    }, prepared.runtime, { timeoutMs: 5000 });
+    }, prepared.runtime, { timeoutMs: RUNTIME_BUFFER_GC_TIMEOUT_MS });
     const counts = requireBufferGcResult(applied);
     if (typeof applied?.complete !== 'boolean' || typeof applied?.graceActive !== 'boolean') {
       throw new CliError('RUNTIME_BAD_RESPONSE', 'Runtime buffer GC returned invalid completion state');