@nanhara/hara 0.121.0 → 0.122.0

package/dist/undo.js

@@ -1,7 +1,11 @@
 // In-session undo stack for file changes. Each edit tool records the prior state of the files it
 // touched; `/undo` pops the last group and restores it. Process-scoped (one REPL session).
-import { unlink } from "node:fs/promises";
-import { atomicWriteText } from "./fs-write.js";
+import { randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { linkSync, lstatSync, readlinkSync, symlinkSync } from "node:fs";
+import { rename, symlink, unlink } from "node:fs/promises";
+import { atomicWriteText, discardClaimedPath, FileChangedError, removeCreatedDirectories } from "./fs-write.js";
+import { readRegularFileSnapshotNoFollow } from "./fs-read.js";
 import { invalidateFileCandidates } from "./context/mentions.js";
 const stack = [];
 const MAX = 50;
@@ -16,27 +20,99 @@ export function recordEdit(group) {
 export function undoDepth() {
     return stack.length;
 }
+async function restoreMovedFile(quarantine, target) {
+    const info = lstatSync(quarantine);
+    // link(2) may follow a symlink source on some platforms. Recreate its topology explicitly while retaining
+    // create-if-absent semantics; a regular inode can still use an atomic hard link.
+    const linkTarget = info.isSymbolicLink() ? readlinkSync(quarantine) : undefined;
+    if (linkTarget !== undefined)
+        symlinkSync(linkTarget, target);
+    else
+        linkSync(quarantine, target);
+    discardClaimedPath(quarantine, {
+        dev: info.dev,
+        ino: info.ino,
+        mode: info.mode & 0o777,
+        nlink: info.nlink + (linkTarget === undefined ? 1 : 0),
+        linkTarget,
+    });
+}
+/** Undo an update/create only if the path still names the exact inode and bytes written by that tool. */
+async function undoCommitted(s) {
+    if (!s.committed || s.after === undefined)
+        throw new Error(`missing committed snapshot for ${s.path}`);
+    const target = s.committed.target;
+    const quarantine = join(dirname(target), `.hara-undo-${process.pid}-${randomUUID()}.tmp`);
+    await rename(target, quarantine);
+    try {
+        // O_NOFOLLOW + same-fd fstat/read rejects a path replaced with a symlink to the committed inode.
+        const current = await readRegularFileSnapshotNoFollow(quarantine);
+        if (current.dev !== s.committed.dev ||
+            current.ino !== s.committed.ino ||
+            current.mode !== s.committed.mode ||
+            current.nlink !== s.committed.nlink ||
+            current.text !== s.after) {
+            await restoreMovedFile(quarantine, target);
+            throw new FileChangedError(s.path);
+        }
+        if (s.before === null) {
+            discardClaimedPath(quarantine, s.committed);
+            await removeCreatedDirectories(s.committed.createdDirs);
+            return;
+        }
+        await atomicWriteText(target, s.before, { expected: null, mode: s.beforeMode });
+        discardClaimedPath(quarantine, s.committed);
+    }
+    catch (error) {
+        // If restoration failed after the owned inode was moved, put it back only when the destination is still
+        // absent. link(2) never overwrites a concurrent file; leave quarantine for recovery if another appeared.
+        try {
+            await restoreMovedFile(quarantine, target);
+        }
+        catch {
+            /* the original error remains the useful user-facing failure */
+        }
+        throw error;
+    }
+}
 /** Restore the most recent edit group. Returns the files reverted, or an error. */
 export async function undoLast() {
     const group = stack.pop();
     if (!group)
         return { error: "nothing to undo" };
     const files = [];
+    const failures = [];
     for (const s of group) {
         try {
-            if (s.before === null) {
-                await unlink(s.absPath).catch(() => { }); // was newly created → remove
+            if (s.committed && s.after !== undefined) {
+                await undoCommitted(s);
+            }
+            else if (s.before === null) {
+                try {
+                    await unlink(s.absPath); // legacy snapshot: was newly created → remove
+                }
+                catch (error) {
+                    if (error?.code !== "ENOENT")
+                        throw error;
+                }
+            }
+            else if (s.linkTarget !== undefined) {
+                await symlink(s.linkTarget, s.absPath); // atomic create-if-absent; never clobbers a newer path
             }
             else {
-                await atomicWriteText(s.absPath, s.before);
+                await atomicWriteText(s.absPath, s.before, { expected: s.removed ? null : undefined, mode: s.beforeMode });
             }
             files.push(s.path);
         }
-        catch {
-            /* skip a file we can't restore */
+        catch (error) {
+            failures.push(`${s.path}: ${error?.message ?? String(error)}`);
         }
     }
     if (files.length)
         invalidateFileCandidates();
+    if (failures.length) {
+        const prefix = files.length ? `partially reverted ${files.join(", ")}; ` : "";
+        return { error: `${prefix}could not safely undo ${failures.join("; ")}` };
+    }
     return { files };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanhara/hara",
-  "version": "0.121.0",
+  "version": "0.122.0",
   "description": "hara — a coding agent CLI that runs like an engineering org.",
   "bin": {
     "hara": "dist/index.js"