@openchambery/web 1.18.2-beta.2 → 1.18.2-beta.4

package/server/lib/opencode/settings-runtime.js

@@ -39,9 +39,41 @@ export const createSettingsRuntime = (deps) => {
     normalizeStringArray,
     formatSettingsResponse,
     resolveDirectoryCandidate,
+    /**
+     * Optional late-bound exclusive runner (Electron injects after startWebUiServer).
+     * May be a function returning the runner, or the runner itself.
+     */
+    getRunExclusivePersist,
+    runExclusivePersist: initialRunExclusivePersist,
   } = deps;
 
   let persistSettingsLock = Promise.resolve();
+  let runExclusivePersist = typeof initialRunExclusivePersist === 'function'
+    ? initialRunExclusivePersist
+    : null;
+
+  const resolveRunExclusivePersist = () => {
+    if (typeof getRunExclusivePersist === 'function') {
+      const resolved = getRunExclusivePersist();
+      if (typeof resolved === 'function') return resolved;
+    }
+    return typeof runExclusivePersist === 'function' ? runExclusivePersist : null;
+  };
+
+  const runPersistedWrite = (work) => {
+    const external = resolveRunExclusivePersist();
+    if (external) {
+      return external(work);
+    }
+    const next = persistSettingsLock.then(async () => work());
+    // Keep the chain alive even if one writer throws.
+    persistSettingsLock = next.catch(() => {});
+    return next;
+  };
+
+  const setRunExclusivePersist = (fn) => {
+    runExclusivePersist = typeof fn === 'function' ? fn : null;
+  };
 
   // Orphan recovery is a one-shot best-effort scan: when orphans can't be
   // matched on first pass they stay on disk and every subsequent settings
@@ -495,7 +527,7 @@ export const createSettingsRuntime = (deps) => {
     await fsPromises.rm(tmp, { force: true });
   };
 
-  const writeSettingsToDisk = async (settings) => {
+  const writeSettingsToDiskUnlocked = async (settings) => {
     try {
       await fsPromises.mkdir(path.dirname(SETTINGS_FILE_PATH), { recursive: true });
       // Atomic write: Electron main and ssh-manager read this file via plain
@@ -511,6 +543,8 @@ export const createSettingsRuntime = (deps) => {
     }
   };
 
+  const writeSettingsToDisk = async (settings) => runPersistedWrite(() => writeSettingsToDiskUnlocked(settings));
+
   const validateProjectEntries = async (projects) => {
     if (!Array.isArray(projects)) {
       return [];
@@ -778,67 +812,63 @@ export const createSettingsRuntime = (deps) => {
     const migration7 = migrateSettingsRemoveApprovedDirectories(migration6.settings);
     const migration8 = migrateSettingsCompactChatDefaults(migration7.settings);
     if (migration1.changed || migration2.changed || migration3.changed || migration4.changed || migration5.changed || migration6.changed || migration7.changed || migration8.changed) {
-      await writeSettingsToDisk(migration8.settings);
+      await runPersistedWrite(() => writeSettingsToDiskUnlocked(migration8.settings));
     }
     return migration8.settings;
   };
 
-  const persistSettings = async (changes) => {
-    persistSettingsLock = persistSettingsLock.then(async () => {
-      // Log field names only — changes can carry credentials (UI password,
-      // client tokens) that must never reach the log file.
-      console.log('[persistSettings] Updating fields:', Object.keys(changes || {}).join(', ') || '(none)');
-      const current = await readSettingsFromDisk();
-      const sanitized = sanitizeSettingsUpdate(changes);
-      let next = mergePersistedSettings(current, sanitized);
-
-      const normalizedState = normalizeSettingsPaths(next);
-      if (normalizedState.changed) {
-        next = normalizedState.settings;
-      }
+  const persistSettings = async (changes) => runPersistedWrite(async () => {
+    // Log field names only — changes can carry credentials (UI password,
+    // client tokens) that must never reach the log file.
+    console.log('[persistSettings] Updating fields:', Object.keys(changes || {}).join(', ') || '(none)');
+    const current = await readSettingsFromDisk();
+    const sanitized = sanitizeSettingsUpdate(changes);
+    let next = mergePersistedSettings(current, sanitized);
 
-      const deterministicProjectIdMigration = await migrateSettingsToDeterministicProjectIds(next);
-      if (deterministicProjectIdMigration.changed) {
-        next = deterministicProjectIdMigration.settings;
-      }
+    const normalizedState = normalizeSettingsPaths(next);
+    if (normalizedState.changed) {
+      next = normalizedState.settings;
+    }
 
-      const approvedDirectoriesMigration = migrateSettingsRemoveApprovedDirectories(next);
-      if (approvedDirectoriesMigration.changed) {
-        next = approvedDirectoriesMigration.settings;
-      }
+    const deterministicProjectIdMigration = await migrateSettingsToDeterministicProjectIds(next);
+    if (deterministicProjectIdMigration.changed) {
+      next = deterministicProjectIdMigration.settings;
+    }
 
-      // Ensure marker + new defaults exist before the first settings write lands.
-      const compactChatDefaultsMigration = migrateSettingsCompactChatDefaults(next);
-      if (compactChatDefaultsMigration.changed) {
-        next = compactChatDefaultsMigration.settings;
-      }
+    const approvedDirectoriesMigration = migrateSettingsRemoveApprovedDirectories(next);
+    if (approvedDirectoriesMigration.changed) {
+      next = approvedDirectoriesMigration.settings;
+    }
 
-      // Validating project paths hits the filesystem for every entry, so only
-      // do it when the incoming update actually touches the projects list —
-      // not on every theme/window-state/etc. save.
-      if (Object.prototype.hasOwnProperty.call(sanitized, 'projects') && Array.isArray(next.projects)) {
-        const validated = await validateProjectEntries(next.projects);
-        next = { ...next, projects: validated };
-      }
+    // Ensure marker + new defaults exist before the first settings write lands.
+    const compactChatDefaultsMigration = migrateSettingsCompactChatDefaults(next);
+    if (compactChatDefaultsMigration.changed) {
+      next = compactChatDefaultsMigration.settings;
+    }
 
-      if (Array.isArray(next.projects) && next.projects.length > 0) {
-        const activeId = typeof next.activeProjectId === 'string' ? next.activeProjectId : '';
-        const active = next.projects.find((project) => project.id === activeId) || null;
-        if (!active) {
-          console.log(`[persistSettings] Active project ID ${activeId} not found, switching to ${next.projects[0].id}`);
-          next = { ...next, activeProjectId: next.projects[0].id };
-        }
-      } else if (next.activeProjectId) {
-        console.log(`[persistSettings] No projects found, clearing activeProjectId ${next.activeProjectId}`);
-        next = { ...next, activeProjectId: undefined };
-      }
+    // Validating project paths hits the filesystem for every entry, so only
+    // do it when the incoming update actually touches the projects list —
+    // not on every theme/window-state/etc. save.
+    if (Object.prototype.hasOwnProperty.call(sanitized, 'projects') && Array.isArray(next.projects)) {
+      const validated = await validateProjectEntries(next.projects);
+      next = { ...next, projects: validated };
+    }
 
-      await writeSettingsToDisk(next);
-      return formatSettingsResponse(next);
-    });
+    if (Array.isArray(next.projects) && next.projects.length > 0) {
+      const activeId = typeof next.activeProjectId === 'string' ? next.activeProjectId : '';
+      const active = next.projects.find((project) => project.id === activeId) || null;
+      if (!active) {
+        console.log(`[persistSettings] Active project ID ${activeId} not found, switching to ${next.projects[0].id}`);
+        next = { ...next, activeProjectId: next.projects[0].id };
+      }
+    } else if (next.activeProjectId) {
+      console.log(`[persistSettings] No projects found, clearing activeProjectId ${next.activeProjectId}`);
+      next = { ...next, activeProjectId: undefined };
+    }
 
-    return persistSettingsLock;
-  };
+    await writeSettingsToDiskUnlocked(next);
+    return formatSettingsResponse(next);
+  });
 
   return {
     readSettingsFromDisk,
@@ -846,5 +876,6 @@ export const createSettingsRuntime = (deps) => {
     readSettingsFromDiskMigrated,
     writeSettingsToDisk,
     persistSettings,
+    setRunExclusivePersist,
   };
 };

package/server/lib/opencode/settings-runtime.test.js

@@ -190,6 +190,48 @@ describe('settings runtime', () => {
     }
   });
 
+  it('joins an external exclusive persist runner when provided', async () => {
+    const { runtime, settingsFilePath, cleanup } = await createRuntime();
+    try {
+      const order = [];
+      let releaseOuter;
+      const outerGate = new Promise((resolve) => {
+        releaseOuter = resolve;
+      });
+
+      runtime.setRunExclusivePersist(async (work) => {
+        order.push('lock-enter');
+        const result = await work();
+        order.push('lock-exit');
+        return result;
+      });
+
+      const pending = (async () => {
+        order.push('outer-start');
+        await outerGate;
+        order.push('outer-before-write');
+        await runtime.writeSettingsToDisk({ theme: 'external' });
+        order.push('outer-after-write');
+      })();
+
+      // Without awaiting the outer gate, ensure the lock wrapper is the one used.
+      releaseOuter();
+      await pending;
+      expect(order).toEqual([
+        'outer-start',
+        'outer-before-write',
+        'lock-enter',
+        'lock-exit',
+        'outer-after-write',
+      ]);
+      await expect(fsPromises.readFile(settingsFilePath, 'utf8')).resolves.toBe(
+        JSON.stringify({ theme: 'external' }, null, 2),
+      );
+    } finally {
+      await cleanup();
+    }
+  });
+
   it.skipIf(process.platform !== 'win32')('falls back when Windows blocks atomic settings replacement', async () => {
     const tempRoot = await fsPromises.mkdtemp(path.join(os.tmpdir(), 'oc-settings-runtime-'));
     const settingsFilePath = path.join(tempRoot, 'settings.json');

package/server/lib/relay/DOCUMENTATION.md

@@ -50,7 +50,7 @@ The host dispatcher restricts tunneled traffic to explicit path allowlists (one
 Private Relay is transparent for allowlisted HTTP paths, so most “works on LAN / Desktop, empty on mobile Relay” bugs are Host routing or client transport-identity mistakes rather than Relay framing bugs:
 
 - **Same path, real Host route required.** Clients call the ordinary `/api/...` path through the tunnel. If that route is missing on the Host process currently holding the relay claim (wrong git worktree, stale packaged Desktop build, or a backend that never registered the OpenChamber route before the OpenCode proxy/SPA fallback), the tunnel still returns HTTP 200 with SPA HTML or proxied OpenCode content. Symptom: chat and status work, Provider/model catalog does not.
-- **HTTP allowlist is prefix-based for `/api/`.** New REST/SSE APIs under `/api/` do not need a tunnel-host allowlist edit. New **WebSocket** paths still need both `ALLOWED_WS_PATHS` and `isUrlAuthWebSocketPath` (see the `relay-transport` skill).
+- **HTTP allowlist is prefix-based for `/api/`.** New REST/SSE APIs under `/api/` do not need a tunnel-host allowlist edit. New **WebSocket** paths still need both `ALLOWED_WS_PATHS` and `isUrlAuthWebSocketPath` (see the `relay-transport` skill). Config sync (`/api/openchamber/config-sync/*`, ticket 05/06) therefore works over Relay without a tunnel-host allowlist change; identity and credential grants remain endpoint concerns (`relay:<serverId>`, pairing-settings / inbound host grant).
 - **Transport identity ≠ runtime key.** After LAN⇄relay swaps, UI catalog loaders commit only when `useConfigStore.catalogTransportIdentity` matches `getRuntimeTransportIdentity()`. `runtimeEndpointReset.ts` must write that transport fingerprint on both full endpoint reset and in-place transport reconnect. Writing `runtimeKey` instead leaves Providers empty because the stable device/instance id is shared across LAN and relay.
 - **Safe catalog projection stays Host-owned.** Provider credentials never cross the browser; Relay only carries the already-allowlisted `GET /api/config/catalog/providers` JSON. Keep Host projection, client parser bounds, and `partial` rules in sync (empty `release_date` is absent, not partial).