@oclif/plugin-update 4.7.42 → 4.7.44

package/README.md

@@ -81,7 +81,7 @@ EXAMPLES
     $ oclif-example update --available
 ```
 
-_See code: [src/commands/update.ts](https://github.com/oclif/plugin-update/blob/4.7.42/src/commands/update.ts)_
+_See code: [src/commands/update.ts](https://github.com/oclif/plugin-update/blob/4.7.44/src/commands/update.ts)_
 <!-- commandsstop -->
 
 # Contributing

package/dist/hooks/init.js

@@ -1,7 +1,7 @@
 import makeDebug from 'debug';
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { mkdir, open, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, stat, unlink, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { touch } from '../util.js';
 const debug = makeDebug('cli:updater');
@@ -56,10 +56,23 @@ export const init = async function (opts) {
     const clientDir = join(clientRoot, config.version);
     if (existsSync(clientDir))
         await touch(clientDir);
-    if (!(await autoupdateNeeded()))
+    // Atomically claim the right to spawn an autoupdate.
+    //
+    // The original `if (!(await autoupdateNeeded())) return; await writeFile(...)`
+    // sequence had a non-atomic read-then-write window: several otto invocations
+    // starting in parallel on a machine with no marker file (e.g. a fresh
+    // laptop being set up) could all pass the autoupdateNeeded() check before
+    // any one of them wrote the marker, and each would spawn its own
+    // `<cli> update --autoupdate` child. Those children then pin in debounce()
+    // (which never exits while CLI activity continues) and accumulate until OOM.
+    //
+    // Fix: combine the check and the marker creation into a single atomic step
+    // using O_EXCL (`open(path, 'wx')`). Only one process can create the marker;
+    // others see EEXIST and bail (or, if the marker is stale, race to reclaim it
+    // — which is bounded to one race per debounce window per machine).
+    if (!(await claimAutoupdate(autoupdatefile)))
         return;
     debug('autoupdate running');
-    await writeFile(autoupdatefile, '');
     debug(`spawning autoupdate on ${binPath}`);
     const fd = await open(autoupdatelogfile, 'a');
     await writeFile(fd, timestamp(`starting \`${binPath} update --autoupdate\` from ${process.argv.slice(1, 3).join(' ')}\n`));
@@ -73,4 +86,45 @@ export const init = async function (opts) {
         .on('error', (e) => process.emitWarning(e))
         .on('close', () => fd.close())
         .unref();
+    async function claimAutoupdate(markerPath) {
+        // Fast path: try to atomically create the marker. Wins the race when no
+        // marker exists yet (fresh-laptop case — the catastrophic scenario).
+        try {
+            const fd = await open(markerPath, 'wx');
+            await fd.close();
+            return true;
+        }
+        catch (error) {
+            const err = error;
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        // Marker exists. If it's within the debounce window, nothing to do.
+        if (!(await autoupdateNeeded()))
+            return false;
+        // Marker is stale (debounce window has elapsed). Reclaim by unlinking and
+        // re-creating atomically. There remains a tiny window between unlink and
+        // open where two stale-marker processes could both win, but it's
+        // microseconds vs the multi-await window of the original bug, and
+        // bounded to one race per debounce window per machine.
+        try {
+            await unlink(markerPath);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        try {
+            const fd = await open(markerPath, 'wx');
+            await fd.close();
+            return true;
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'EEXIST')
+                return false;
+            throw err;
+        }
+    }
 };

package/oclif.manifest.json

@@ -106,5 +106,5 @@
       ]
     }
   },
-  "version": "4.7.42"
+  "version": "4.7.44"
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@oclif/plugin-update",
-  "version": "4.7.42",
+  "version": "4.7.44",
   "author": "Salesforce",
   "bugs": "https://github.com/oclif/plugin-update/issues",
   "dependencies": {
     "@inquirer/select": "^2.5.0",
     "@oclif/core": "^4",
-    "@oclif/table": "^0.5.8",
+    "@oclif/table": "^0.5.9",
     "ansis": "^3.17.0",
     "debug": "^4.4.1",
     "filesize": "^6.1.0",
@@ -31,7 +31,7 @@
     "chai": "^4.5.0",
     "commitlint": "^19",
     "eslint": "^9.39.4",
-    "eslint-config-oclif": "^6.0.164",
+    "eslint-config-oclif": "^6.0.165",
     "eslint-config-prettier": "^10.1.8",
     "husky": "^9.1.7",
     "lint-staged": "^15",