@narumitw/pi-sync 0.54.3 → 0.57.0

package/src/sync/agent-store.ts

@@ -0,0 +1,151 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import lockfile from "proper-lockfile";
+import { writeJson } from "../state/json-file.js";
+import { withLock } from "../state/lock.js";
+import { LOCK_GUARD_STALE_MS, LOCK_GUARD_UPDATE_MS } from "../state/lock-policy.js";
+import { LOCKFILE_FS_ADAPTER } from "../state/lockfile-fs.js";
+import { stateDir } from "../state/state-directory.js";
+import { AGENT_OUTPUT_BYTES } from "./agent-policy.js";
+import { ContinuousError } from "./continuous-errors.js";
+
+interface Claim {
+  version: 1;
+  id: string;
+  pid: number;
+}
+function paths() {
+  const root = path.join(stateDir(), "agent-resolver");
+  return { root, claim: path.join(root, "claim.json") };
+}
+async function directory() {
+  const { root } = paths();
+  await fs.mkdir(root, { mode: 0o700 });
+}
+async function checkDirectory() {
+  const stat = await fs.lstat(paths().root);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || (process.platform !== "win32" && stat.mode & 0o077))
+    throw new Error("Unsafe agent resolver directory; evidence retained.");
+}
+async function readPrivate(file: string): Promise<unknown> {
+  try {
+    await checkDirectory();
+    const stat = await fs.lstat(file);
+    if (
+      !stat.isFile() ||
+      stat.isSymbolicLink() ||
+      stat.nlink !== 1 ||
+      stat.size > AGENT_OUTPUT_BYTES * 2 ||
+      (process.platform !== "win32" && stat.mode & 0o077)
+    )
+      throw new Error("Unsafe agent resolver record; evidence retained.");
+    return JSON.parse(await fs.readFile(file, "utf8"));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw new Error("Unreadable agent resolver record; evidence retained.");
+  }
+}
+async function readClaim(): Promise<Claim | undefined> {
+  const value = await readPrivate(paths().claim);
+  if (value === undefined) return;
+  const claim = value as Claim;
+  if (
+    claim?.version !== 1 ||
+    typeof claim.id !== "string" ||
+    !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.test(claim.id) ||
+    Object.keys(claim).sort().join(",") !== "id,pid,version" ||
+    !Number.isSafeInteger(claim.pid) ||
+    claim.pid < 1 ||
+    claim.pid > 2_147_483_647
+  )
+    throw new Error("Invalid agent resolver claim; evidence retained.");
+  return claim;
+}
+function alive(pid: number) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code !== "ESRCH";
+  }
+}
+
+/** Caller retains the state-directory migration guard; claim changes use a separate short-lived guard. */
+export async function withAgentClaim<T>(fn: (assertOwner: () => Promise<void>) => Promise<T>): Promise<T> {
+  const claim: Claim = { version: 1, id: randomUUID(), pid: process.pid };
+  let armed = false;
+  const assertOwner = async () => {
+    const current = await readClaim();
+    if (current?.id !== claim.id || current.pid !== process.pid)
+      throw new Error("Agent resolver ownership changed; candidate not applied.");
+  };
+  try {
+    await withLock("agent-claim", async () => {
+      try {
+        await directory();
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      }
+      await checkDirectory();
+      await withClaimGuard(async () => {
+        const existing = await readClaim();
+        if (existing && alive(existing.pid))
+          throw new ContinuousError("contention", "Agent mode deferred: another local resolver is running.");
+        // A durability failure can occur after rename: cleanup must own partial initialization too.
+        armed = true;
+        await writeJson(paths().claim, claim);
+      });
+    });
+    return await fn(assertOwner);
+  } finally {
+    if (armed) await releaseClaim(claim);
+  }
+}
+async function releaseClaim(claim: Claim) {
+  // Ordinary transfers may hold the operation lock for an arbitrary time.
+  // Cleanup needs only the claim guard; it never waits for that operation lock.
+  await withClaimGuard(async () => {
+    const current = await readClaim();
+    if (current?.id === claim.id && current.pid === claim.pid) await fs.rm(paths().claim);
+  });
+}
+async function withClaimGuard<T>(run: () => Promise<T>): Promise<T> {
+  await checkDirectory();
+  let compromisedError: Error | undefined;
+  const release = await lockfile.lock(paths().claim, {
+    fs: LOCKFILE_FS_ADAPTER,
+    realpath: false,
+    stale: LOCK_GUARD_STALE_MS,
+    update: LOCK_GUARD_UPDATE_MS,
+    retries: { retries: 100, factor: 1.2, minTimeout: 10, maxTimeout: 100 },
+    onCompromised: (error) => {
+      compromisedError = error;
+    },
+  });
+  try {
+    const result = await run();
+    if (compromisedError) throw compromisedError;
+    return result;
+  } finally {
+    await release();
+  }
+}
+function candidatePath(key: string) {
+  if (!/^[a-f0-9]{64}$/u.test(key)) throw new Error("Invalid agent candidate key.");
+  return path.join(paths().root, `${key}.json`);
+}
+export async function readAgentCandidate(key: string): Promise<unknown> {
+  return readPrivate(candidatePath(key));
+}
+export async function saveAgentCandidate(key: string, candidate: unknown) {
+  await checkDirectory();
+  const target = candidatePath(key);
+  const existing = await readPrivate(target);
+  if (existing !== undefined) {
+    if (JSON.stringify(existing) !== JSON.stringify(candidate))
+      throw new Error("Agent candidate changed before save; existing evidence retained.");
+    return;
+  }
+  await writeJson(target, candidate, { maxBytes: AGENT_OUTPUT_BYTES * 2 });
+}

package/src/sync/agent-sync.ts

@@ -0,0 +1,91 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import type { CommandOptions } from "../commands/command-types.js";
+import { withLock } from "../state/lock.js";
+import { setSyncStatus } from "../ui/sync-status.js";
+import { AGENT_MAX_ATTEMPTS } from "./agent-policy.js";
+import { type AgentAcceptance, AgentResolutionRequired } from "./agent-request.js";
+import { ContinuousError } from "./continuous-errors.js";
+
+/** All callers retain their existing state-directory access guard. Off stays lazy. */
+export async function withAgentSyncLock<T>(
+  ctx: ExtensionContext,
+  options: CommandOptions,
+  run: (options: CommandOptions) => Promise<T>,
+): Promise<T> {
+  let request: AgentResolutionRequired;
+  const background = options.background;
+  try {
+    return await withLock("sync", () => run(options));
+  } catch (error) {
+    if (!(error instanceof AgentResolutionRequired)) throw error;
+    request = error;
+  }
+  const { withAgentClaim, readAgentCandidate, saveAgentCandidate } = await import("./agent-store.js");
+  const { parseAgentCandidate } = await import("./agent-candidate.js");
+  const { runAgentResolver } = await import("./agent-runner.js");
+  return withAgentClaim(async (assertOwner) => {
+    const clearStatus = () => setSyncStatus(ctx, undefined);
+    const onAbort = () => {
+      try {
+        clearStatus();
+      } catch {
+        /* UI can already be disposed. */
+      }
+    };
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      options.signal?.throwIfAborted();
+      for (let attempt = 0; attempt < AGENT_MAX_ATTEMPTS; attempt++) {
+        const validate = () =>
+          withLock("agent-validate", async () => {
+            options.signal?.throwIfAborted();
+            await assertOwner();
+            await request.validate();
+            options.signal?.throwIfAborted();
+          });
+        await validate();
+        setSyncStatus(ctx, "sync resolving");
+        const cached = await withLock("agent-cache-read", async () => {
+          await assertOwner();
+          return readAgentCandidate(request.key);
+        });
+        const raw =
+          cached === undefined
+            ? await runAgentResolver(
+                ctx,
+                request.evidence,
+                validate,
+                options.signal,
+                background ? () => background.reserve(request.key) : undefined,
+              )
+            : JSON.stringify(cached);
+        let candidate: ReturnType<typeof parseAgentCandidate>;
+        try {
+          candidate = parseAgentCandidate(raw, request.evidence);
+        } catch {
+          throw new ContinuousError("model", "Agent mode paused: invalid resolver output; evidence retained.");
+        }
+        await validate();
+        await withLock("agent-cache-save", async () => {
+          await assertOwner();
+          await saveAgentCandidate(request.key, candidate);
+        });
+        const acceptance: AgentAcceptance = { key: request.key, candidate };
+        try {
+          return await withLock("sync", async () => {
+            await assertOwner();
+            options.signal?.throwIfAborted();
+            return run({ ...options, agentAcceptance: acceptance });
+          });
+        } catch (error) {
+          if (!(error instanceof AgentResolutionRequired)) throw error;
+          request = error;
+        }
+      }
+      throw new ContinuousError("stale", "Agent mode paused: content changed repeatedly; retry later.");
+    } finally {
+      options.signal?.removeEventListener("abort", onAbort);
+      if (!options.signal?.aborted) clearStatus();
+    }
+  });
+}

package/src/sync/automatic-sync.ts

@@ -12,6 +12,7 @@ import { stateDirectoryMigrationNotice } from "../state/state-directory.js";
 import { ensureStateDir, readStateForConfig } from "../state/sync-state-store.js";
 import { configureSyncStatus, setSyncStatus } from "../ui/sync-status.js";
 import { safeTerminalText } from "../ui/terminal-text.js";
+import { startupTransferEnabled } from "./agent-policy.js";
 import { throwIfAborted } from "./signals.js";
 import { createStartupTimings } from "./startup-timings.js";
 import { errorMessage } from "./sync-errors.js";
@@ -69,7 +70,7 @@ export async function startSession(ctx: ExtensionContext, signal: AbortSignal) {
       throwIfAborted(signal);
       configureSyncStatus(ctx, config.showStatus);
       outcome = "completed";
-      return config.automatic || config.automaticTransfer ? config : undefined;
+      return config.automatic || startupTransferEnabled(config) ? config : undefined;
     } catch (error) {
       throwIfAborted(signal);
       if (!isMissingConfigError(error)) {

package/src/sync/continuous-errors.ts

@@ -0,0 +1,85 @@
+import { SyncBackendConflictError } from "../backends/sync-backend.js";
+
+export type ContinuousErrorKind =
+  | "transient"
+  | "contention"
+  | "stale"
+  | "authentication"
+  | "storage"
+  | "unsafe"
+  | "model"
+  | "budget"
+  | "unknown";
+
+/** Categories are safe to persist; provider messages and causes are not. */
+export class ContinuousError extends Error {
+  constructor(
+    readonly kind: ContinuousErrorKind,
+    message: string,
+    readonly retryAfterMs?: number,
+  ) {
+    super(message);
+    this.name = "ContinuousError";
+  }
+}
+
+export function continuousFailure(error: unknown): { kind: ContinuousErrorKind; retry: boolean; delay?: number } {
+  const seen = new Set<unknown>();
+  for (let current = error; current && !seen.has(current) && seen.size < 8; ) {
+    seen.add(current);
+    if (current instanceof ContinuousError)
+      return {
+        kind: current.kind,
+        retry: ["transient", "contention", "stale", "budget"].includes(current.kind),
+        delay: current.retryAfterMs,
+      };
+    if (current instanceof SyncBackendConflictError) return { kind: "stale", retry: true };
+    if (typeof current !== "object") break;
+    const value = current as {
+      status?: unknown;
+      code?: unknown;
+      name?: unknown;
+      cause?: unknown;
+      retryAfterMs?: unknown;
+    };
+    if (value.status === 401 || value.status === 403) return { kind: "authentication", retry: false };
+    if (
+      value.status === 408 ||
+      value.status === 429 ||
+      (typeof value.status === "number" && Number.isInteger(value.status) && value.status >= 500 && value.status <= 599)
+    )
+      return { kind: "transient", retry: true, delay: boundedRetryDelay(value.retryAfterMs) };
+    if (value.code === "ELOCKED") return { kind: "contention", retry: true };
+    if (value.code === "ECOMPROMISED") return { kind: "stale", retry: true };
+    if (
+      value.name === "TimeoutError" ||
+      [
+        "ECONNRESET",
+        "ECONNREFUSED",
+        "ETIMEDOUT",
+        "ENETUNREACH",
+        "EHOSTUNREACH",
+        "ENOTFOUND",
+        "EAI_AGAIN",
+        "UND_ERR_CONNECT_TIMEOUT",
+        "UND_ERR_SOCKET",
+      ].includes(String(value.code))
+    )
+      return { kind: "transient", retry: true };
+    if (["EACCES", "EPERM", "ENOSPC", "EROFS", "EIO"].includes(String(value.code)))
+      return { kind: "storage", retry: false };
+    current = value.cause;
+  }
+  return { kind: "unknown", retry: false };
+}
+
+export function boundedRetryDelay(value: unknown): number | undefined {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.min(value, 300_000) : undefined;
+}
+
+export function retryAfter(response: Response): number | undefined {
+  const value = response.headers.get("retry-after");
+  if (!value) return;
+  const seconds = Number(value);
+  return boundedRetryDelay(Number.isFinite(seconds) ? seconds * 1000 : Date.parse(value) - Date.now());
+}

package/src/sync/continuous-lease.ts

@@ -0,0 +1,221 @@
+import { randomUUID } from "node:crypto";
+import { lstatSync, readFileSync, rmdirSync, type Stats, stat } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import lockfile from "proper-lockfile";
+import { withLock } from "../state/lock.js";
+import { LOCKFILE_FS_ADAPTER } from "../state/lockfile-fs.js";
+import {
+  continuousRoot,
+  prepareContinuousRoot,
+  readContinuousPrivate,
+  writeContinuousPrivate,
+} from "./continuous-storage.js";
+
+const STALE_MS = 30_000;
+const localLeases = new Set<string>();
+const futureGuards = new Map<string, { identity: string; since: number }>();
+interface Owner {
+  version: 1;
+  id: string;
+  pid: number;
+  binding: string;
+}
+export interface ContinuousLease {
+  signal: AbortSignal;
+  assert(): void;
+  release(): Promise<void>;
+}
+function validOwner(value: unknown): value is Owner {
+  if (!value || typeof value !== "object") return false;
+  const owner = value as Owner;
+  return (
+    Object.keys(owner).sort().join(",") === "binding,id,pid,version" &&
+    owner.version === 1 &&
+    typeof owner.id === "string" &&
+    /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/u.test(owner.id) &&
+    Number.isSafeInteger(owner.pid) &&
+    owner.pid > 0 &&
+    owner.pid <= 2147483647 &&
+    typeof owner.binding === "string" &&
+    /^[a-f0-9]{64}$/u.test(owner.binding)
+  );
+}
+
+/** Advisory only: never authority for a transfer or lease takeover. */
+export async function continuousLeaseOwner(binding: string): Promise<string> {
+  const owner = await readContinuousPrivate("owner.json");
+  if (owner === undefined) return "Local scheduler lease: not observed; waiting for an eligible session";
+  if (!validOwner(owner)) throw new Error("Invalid continuous sync owner");
+  try {
+    const guard = await fs.lstat(path.join(continuousRoot(), "scheduler.lock"));
+    if (
+      guard.isDirectory() &&
+      !guard.isSymbolicLink() &&
+      Date.now() - guard.mtimeMs <= STALE_MS &&
+      owner.binding === binding
+    )
+      return `Local scheduler lease: observed for pid ${owner.pid}; this can be another session`;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  return "Local scheduler lease: not observed; waiting for an eligible session";
+}
+
+/** Caller holds state-directory access during acquisition; the renewable guard prevents live migration. */
+export async function acquireContinuousLease(binding: string): Promise<ContinuousLease | undefined> {
+  await prepareContinuousRoot();
+  const file = path.join(continuousRoot(), "scheduler");
+  const guardPath = `${file}.lock`;
+  if (localLeases.has(file)) return undefined;
+  const previousOwner = await readContinuousPrivate("owner.json");
+  if (previousOwner !== undefined && !validOwner(previousOwner))
+    throw new Error("Invalid continuous sync owner; evidence retained.");
+  if (localLeases.has(file)) return undefined;
+  localLeases.add(file);
+  const acquiredAt = performance.now();
+  const ownerPath = path.join(continuousRoot(), "owner.json");
+  const controller = new AbortController();
+  const owner: Owner = { version: 1, id: randomUUID(), pid: process.pid, binding };
+  let identity: { dev: number; ino: number } | undefined;
+  let published = false;
+  // proper-lockfile also uses rmdirSync at process exit. Fence both cleanup paths.
+  const removeGuard = (target: string) => {
+    if (identity) {
+      const current = lstatSync(target);
+      if (current.dev !== identity.dev || current.ino !== identity.ino) return;
+    }
+    let current: unknown;
+    try {
+      const record = lstatSync(ownerPath);
+      if (
+        !record.isFile() ||
+        record.isSymbolicLink() ||
+        record.nlink !== 1 ||
+        record.size > 4096 ||
+        (process.platform !== "win32" && record.mode & 0o077)
+      )
+        return;
+      current = JSON.parse(readFileSync(ownerPath, "utf8"));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+    if (published && current === undefined) return;
+    if (
+      current !== undefined &&
+      (!validOwner(current) ||
+        (current.id !== owner.id && (published || current.id !== (previousOwner as Owner | undefined)?.id)))
+    )
+      return;
+    rmdirSync(target);
+  };
+  const adapter = {
+    ...LOCKFILE_FS_ADAPTER,
+    stat: (target: string, callback: (error: NodeJS.ErrnoException | null, value?: Stats) => void) =>
+      stat(target, (error, value) => {
+        if (!error && value.mtimeMs > Date.now() + STALE_MS) {
+          const identity = `${value.dev}:${value.ino}:${value.mtimeMs}`;
+          const previous = futureGuards.get(target);
+          if (!previous || previous.identity !== identity)
+            futureGuards.set(target, { identity, since: performance.now() });
+          else if (performance.now() - previous.since > STALE_MS) value.mtime = new Date(Date.now() - STALE_MS - 1);
+        } else futureGuards.delete(target);
+        callback(error, value);
+      }),
+    rmdirSync: removeGuard,
+    rmdir: (target: string, callback: (error?: NodeJS.ErrnoException | null) => void) => {
+      try {
+        removeGuard(target);
+        callback();
+      } catch (error) {
+        callback(error as NodeJS.ErrnoException);
+      }
+    },
+  };
+  let compromised = false;
+  let unlock: () => Promise<void>;
+  try {
+    unlock = await lockfile.lock(file, {
+      fs: adapter,
+      realpath: false,
+      stale: STALE_MS,
+      update: 10_000,
+      retries: 0,
+      onCompromised: () => {
+        compromised = true;
+        controller.abort(new DOMException("Continuous sync ownership lost", "AbortError"));
+      },
+    });
+  } catch (error) {
+    localLeases.delete(file);
+    if ((error as NodeJS.ErrnoException).code === "ELOCKED") return undefined;
+    throw error;
+  }
+  let released = false;
+  const release = async () => {
+    if (released) return;
+    released = true;
+    controller.abort(new DOMException("Continuous sync owner released", "AbortError"));
+    try {
+      if (!compromised) await unlock();
+    } finally {
+      localLeases.delete(file);
+      futureGuards.delete(guardPath);
+    }
+  };
+  try {
+    identity = await fs.lstat(guardPath);
+    await withLock("continuous-owner", async () => {
+      const previous = await readContinuousPrivate("owner.json");
+      if (previous !== undefined && !validOwner(previous))
+        throw new Error("Invalid continuous sync owner; evidence retained.");
+      if (
+        (previous as Owner | undefined)?.id !== (previousOwner as Owner | undefined)?.id ||
+        performance.now() - acquiredAt > STALE_MS
+      )
+        throw new Error("Continuous lease generation changed before publication.");
+      const current = lstatSync(guardPath);
+      if (controller.signal.aborted || current.dev !== identity?.dev || current.ino !== identity.ino)
+        throw new Error("Continuous lease changed before publication.");
+      await writeContinuousPrivate("owner.json", owner);
+      published = true;
+    });
+    const assert = () => {
+      controller.signal.throwIfAborted();
+      try {
+        const root = lstatSync(continuousRoot());
+        if (!root.isDirectory() || root.isSymbolicLink() || (process.platform !== "win32" && root.mode & 0o077))
+          throw new Error("Unsafe lease root");
+        const stat = lstatSync(guardPath);
+        if (
+          stat.isSymbolicLink() ||
+          !stat.isDirectory() ||
+          stat.dev !== identity?.dev ||
+          stat.ino !== identity.ino ||
+          Date.now() - stat.mtimeMs > STALE_MS
+        )
+          throw new Error("Lease guard changed");
+        const record = lstatSync(ownerPath);
+        if (
+          !record.isFile() ||
+          record.isSymbolicLink() ||
+          record.nlink !== 1 ||
+          record.size > 4096 ||
+          (process.platform !== "win32" && record.mode & 0o077)
+        )
+          throw new Error("Unsafe owner record");
+        const value: unknown = JSON.parse(readFileSync(ownerPath, "utf8"));
+        if (!validOwner(value) || value.id !== owner.id || value.binding !== binding || value.pid !== process.pid)
+          throw new Error("Lease owner changed");
+      } catch {
+        controller.abort(new DOMException("Continuous sync ownership lost", "AbortError"));
+        controller.signal.throwIfAborted();
+      }
+    };
+    assert();
+    return { signal: controller.signal, assert, release };
+  } catch (error) {
+    await release();
+    throw error;
+  }
+}