agl 21.0.0 → 22.0.0

package/ts/classes.controller.ts

@@ -129,6 +129,7 @@ import {
   resolveInitialRuntimeConfig,
   resolveStoredRuntimeConfig,
 } from './classes.config.js';
+import { resolveAGLHomePaths } from './classes.aglhome.js';
 import { ensureControllerDataRootForStartup } from './functions.controllerdataroot.js';
 import { SmartDataAuthStore } from './classes.authstore.js';
 import { PasskeyManager } from './classes.passkeymanager.js';
@@ -301,6 +302,10 @@ import {
   resolveCurrentPnpmGlobalInstallation,
   resolveInheritedUpgradeTargetInstallation,
 } from './classes.upgradetransaction.js';
+import {
+  upgradeCoordinationRootEnvironmentVariable,
+  upgradeTokenEnvironmentVariable,
+} from './constants.upgradeenvironment.js';
 
 const currentCliName = String(controllerPackageName) === upgradePackageTransitionSource.packageName
   ? upgradePackageTransitionSource.cliName
@@ -1443,6 +1448,7 @@ export class OpenCodeController {
   private flexAutoAcceptDrainTask?: Promise<void>;
   private runtimeConfig?: Awaited<ReturnType<typeof resolveInitialRuntimeConfig>>;
   private controllerId?: string;
+  private openCodeRuntimeDirectory?: string;
   private authStore?: SmartDataAuthStore;
   private passkeyManager?: PasskeyManager;
   private openCodeSupervisor?: OpenCodeSupervisor;
@@ -1594,6 +1600,23 @@ export class OpenCodeController {
     });
   }
 
+  private captureInheritedUpgradeCoordination(): void {
+    try {
+      if (Boolean(this.options.upgradeToken) !== Boolean(this.options.upgradeGlobalRoot)) {
+        throw new Error('Inherited upgrade coordination requires both its token and global root.');
+      }
+      if (!this.options.upgradeToken || !this.options.upgradeGlobalRoot) return;
+      if (process.env[upgradeTokenEnvironmentVariable] !== this.options.upgradeToken) {
+        throw new Error('The inherited upgrade coordination token changed before controller startup.');
+      }
+      this.upgradeToken = this.options.upgradeToken;
+      this.upgradeCoordinator = new UpgradeCoordinator(this.options.upgradeGlobalRoot);
+    } finally {
+      delete process.env[upgradeTokenEnvironmentVariable];
+      delete process.env[upgradeCoordinationRootEnvironmentVariable];
+    }
+  }
+
   public async start(): Promise<IControllerStartResult> {
     if (this.lifecycleState === 'ready') {
       return { status: this.getStatus(), publicUrl: this.requireRuntimeConfig().publicOrigin };
@@ -1705,7 +1728,9 @@ export class OpenCodeController {
   }
 
   private async performStart(): Promise<IControllerStartResult> {
+    process.env.AGL_HOME = resolveAGLHomePaths().root;
     this.lifecycleState = 'starting';
+    this.captureInheritedUpgradeCoordination();
     const identity = await readControllerProcessIdentity(process.pid);
     this.assertStartActive();
     if (identity) {
@@ -1714,9 +1739,11 @@ export class OpenCodeController {
     }
     let upgradeCliPath: string | undefined;
     if (this.options.upgradeToken && this.options.upgradeGlobalRoot) {
-      this.upgradeToken = this.options.upgradeToken;
-      this.upgradeCoordinator = new UpgradeCoordinator(this.options.upgradeGlobalRoot);
-      const transaction = await this.upgradeCoordinator.readTransaction(this.options.upgradeToken);
+      const inheritedCoordinator = this.upgradeCoordinator;
+      if (!inheritedCoordinator || this.upgradeToken !== this.options.upgradeToken) {
+        throw new Error('The inherited upgrade coordination was not captured before startup.');
+      }
+      const transaction = await inheritedCoordinator.readTransaction(this.options.upgradeToken);
       const installation = await resolveInheritedUpgradeTargetInstallation(transaction);
       const cliPath = await plugins.fs.promises.realpath(
         plugins.url.fileURLToPath(new URL('../cli.js', import.meta.url)),
@@ -1732,11 +1759,11 @@ export class OpenCodeController {
         cliName: currentCliName,
         cliRelativePath: './cli.js',
       });
-      this.upgradeStatus = await this.upgradeCoordinator.readSanitizedUpgradeStatus(
+      this.upgradeStatus = await inheritedCoordinator.readSanitizedUpgradeStatus(
         this.options.upgradeToken,
       );
       upgradeCliPath = cliPath;
-      await this.upgradeCoordinator.recordController(this.options.upgradeToken, {
+      await inheritedCoordinator.recordController(this.options.upgradeToken, {
         pid: process.pid,
         processGroupId: this.processGroupId,
         fingerprint: this.processFingerprint,
@@ -1872,6 +1899,17 @@ export class OpenCodeController {
     this.assertStartActive();
     this.runtimeConfig = runtimeConfig;
     this.controllerId = authDocument.id;
+    this.openCodeRuntimeDirectory = plugins.path.join(
+      dataDirectory,
+      'runtime',
+      'opencode',
+      plugins.crypto.createHash('sha256').update(authDocument.id, 'utf8').digest('hex'),
+    );
+    await plugins.fs.promises.mkdir(this.openCodeRuntimeDirectory, {
+      recursive: true,
+      mode: 0o700,
+    });
+    await plugins.fs.promises.chmod(this.openCodeRuntimeDirectory, 0o700);
 
     const passkeyManager = new PasskeyManager({ store: authStore });
     this.passkeyManager = passkeyManager;
@@ -1972,8 +2010,9 @@ export class OpenCodeController {
     this.setupCodeExpiresAt = setupAuthority?.expiresAt.getTime();
     this.assertStartActive();
 
-    // v2 migration: the fixed workspace becomes the first registered project.
-    const pendingProjectRemovals = await this.ensureInitialProject(runtimeConfig.workspaceDirectory);
+    const pendingProjectRemovals = await this.registerExplicitInitialProject(
+      this.options.runtimeOverrides.initialProjectDirectory,
+    );
     const startupProjectState = await this.reconcileProjectState(false);
     for (const project of pendingProjectRemovals) this.retiringProjectIds.add(project.id);
     for (const project of startupProjectState.projects) {
@@ -2107,6 +2146,7 @@ export class OpenCodeController {
       database: flexDatabase,
       flexCredentialDirectory: plugins.path.join(
         dataDirectory,
+        'credentials',
         'flex-provider-credentials',
         plugins.crypto.createHash('sha256').update(controllerId, 'utf8').digest('hex'),
       ),
@@ -2212,7 +2252,8 @@ export class OpenCodeController {
     browserResourceHost = new ControllerBrowserResourceHost({
       runtimeDirectory: plugins.path.join(
         dataDirectory,
-        'browser-runtime',
+        'runtime',
+        'browser',
         plugins.crypto.createHash('sha256').update(controllerId).digest('hex'),
       ),
       authorizeCapability: (requestArg) => (
@@ -2338,6 +2379,19 @@ export class OpenCodeController {
     };
   }
 
+  private coordinatorForUpgradeToken(
+    tokenArg: string,
+    globalRootArg: string,
+  ): UpgradeCoordinator {
+    if (this.upgradeToken === tokenArg && this.upgradeCoordinator) {
+      if (this.upgradeCoordinator.canonicalGlobalRoot !== globalRootArg) {
+        throw new Error('The inherited upgrade coordination global root changed unexpectedly.');
+      }
+      return this.upgradeCoordinator;
+    }
+    return new UpgradeCoordinator(globalRootArg);
+  }
+
   private startOpenCodeEventStream(
     openCodeClientArg: OpenCodeClientAdapter,
     skipInitialStreamAdvanceArg = false,
@@ -2476,9 +2530,12 @@ export class OpenCodeController {
 
   private createOpenCodeSupervisor(): OpenCodeSupervisor {
     const runtimeConfig = this.requireRuntimeConfig();
+    if (!this.openCodeRuntimeDirectory) {
+      throw new Error('The OpenCode runtime directory is unavailable.');
+    }
     let supervisor!: OpenCodeSupervisor;
     supervisor = new OpenCodeSupervisor({
-      directory: runtimeConfig.workspaceDirectory,
+      directory: this.openCodeRuntimeDirectory,
       port: runtimeConfig.opencodePort,
       onChildExit: () => {
         this.openCodeSupervisorExitSignals.get(supervisor)?.resolve();
@@ -3192,6 +3249,7 @@ export class OpenCodeController {
           this.authStore = undefined;
           this.passkeyManager = undefined;
           this.controllerId = undefined;
+          this.openCodeRuntimeDirectory = undefined;
         }
       });
     }
@@ -3312,7 +3370,10 @@ export class OpenCodeController {
           try {
             const installation = await resolveCurrentPnpmGlobalInstallation();
             const status = this.getStatus();
-            const coordinator = new UpgradeCoordinator(installation.globalRoot);
+            const coordinator = this.coordinatorForUpgradeToken(
+              requestArg.token,
+              installation.globalRoot,
+            );
             await coordinator.consumeLaunchGrant({
               token: requestArg.token,
               port: this.requireRuntimeConfig().controllerPort,
@@ -3372,7 +3433,10 @@ export class OpenCodeController {
         return this.runOperation(peer, async (signalArg) => (
           this.runUpgradePreparationAdmission(async () => {
             const installation = await resolveCurrentPnpmGlobalInstallation();
-            const coordinator = new UpgradeCoordinator(installation.globalRoot);
+            const coordinator = this.coordinatorForUpgradeToken(
+              requestArg.token,
+              installation.globalRoot,
+            );
             const status = this.getStatus();
             await coordinator.consumeControllerActionGrant({
               token: requestArg.token,
@@ -3406,7 +3470,10 @@ export class OpenCodeController {
           return this.runOperation(peer, async () => (
             this.runUpgradePreparationAdmission(async () => {
               const installation = await resolveCurrentPnpmGlobalInstallation();
-              const coordinator = new UpgradeCoordinator(installation.globalRoot);
+              const coordinator = this.coordinatorForUpgradeToken(
+                requestArg.token,
+                installation.globalRoot,
+              );
               if (await this.upgradePreparationReplayIsAccepted(
                 coordinator,
                 requestArg.token,
@@ -3454,7 +3521,10 @@ export class OpenCodeController {
         );
         return this.runOperation(peer, async () => {
           const installation = await resolveCurrentPnpmGlobalInstallation();
-          const coordinator = new UpgradeCoordinator(installation.globalRoot);
+          const coordinator = this.coordinatorForUpgradeToken(
+            requestArg.token,
+            installation.globalRoot,
+          );
           const status = this.getStatus();
           await coordinator.consumeControllerActionGrant({
             token: requestArg.token,
@@ -6187,20 +6257,17 @@ export class OpenCodeController {
     return projectsRoot;
   }
 
-  private async ensureInitialProject(
-    workspaceDirectoryArg: string,
+  private async registerExplicitInitialProject(
+    initialProjectDirectoryArg: string | undefined,
   ): Promise<IControllerProjectDocument[]> {
     const authStore = this.requireAuthStore();
-    const [activeProjects, pendingRemovals] = await Promise.all([
-      authStore.listProjects(),
-      authStore.listPendingProjectRemovals(),
-    ]);
-    if (activeProjects.length === 0 && pendingRemovals.length === 0) {
-      const workspaceDirectory = await resolveCanonicalDirectory(workspaceDirectoryArg);
+    const pendingRemovals = await authStore.listPendingProjectRemovals();
+    if (initialProjectDirectoryArg !== undefined) {
+      const initialProjectDirectory = await resolveCanonicalDirectory(initialProjectDirectoryArg);
       await authStore.createProject(
-        plugins.path.basename(workspaceDirectory.directory) || 'workspace',
-        workspaceDirectory.directory,
-        workspaceDirectory,
+        this.deriveProjectName(initialProjectDirectory.directory),
+        initialProjectDirectory.directory,
+        initialProjectDirectory,
       );
     }
     return pendingRemovals;
@@ -14170,13 +14237,12 @@ export class OpenCodeController {
     if (!client) return;
     const deadline = AbortSignal.timeout(abortConversationsOnStopTimeoutMs);
     const directories = new Set<string>();
-    if (this.runtimeConfig) directories.add(this.runtimeConfig.workspaceDirectory);
     try {
       for (const project of (await this.authStore?.listProjects()) ?? []) {
         directories.add(project.directory);
       }
     } catch {
-      // Project registry unavailable — workspace sessions still get aborted.
+      // Project registry unavailable; shutdown continues with owned resources.
     }
     for (const directory of directories) {
       try {

package/ts/classes.embeddeddb.ts

@@ -46,10 +46,8 @@ export class EmbeddedControllerDatabase {
   constructor(private readonly options: IEmbeddedControllerDatabaseOptions) {}
 
   public get socketPath(): string {
-    // Unix socket paths are capped near 108 bytes (SUN_LEN), so the socket
-    // lives in tmpdir under a short name derived from the data directory —
-    // deterministic, so a second controller process attaches to the same
-    // engine, and independent of how deep the data directory is nested.
+    // The hashed name is deterministic so another AGL process can attach to
+    // the same engine without owning its storage files.
     return embeddedDatabaseSocketPath(this.options.dataDirectory);
   }
 
@@ -74,6 +72,9 @@ export class EmbeddedControllerDatabase {
     if (this.localDb || this.migrationRunner?.hasOwnedResources) {
       throw new Error('Embedded database startup cleanup must complete before retrying.');
     }
+    const socketDirectory = plugins.path.dirname(this.socketPath);
+    await plugins.fs.promises.mkdir(socketDirectory, { recursive: true, mode: 0o700 });
+    await plugins.fs.promises.chmod(socketDirectory, 0o700);
     if (this.options.legacyDataDirectory) {
       const migrationRunner = new EmbeddedDatabaseMigrationRunner({
         sourceDirectory: this.options.legacyDataDirectory,

package/ts/classes.gitreversion.ts

@@ -1,4 +1,5 @@
 import * as plugins from './plugins.js';
+import { resolveAGLHomePaths } from './classes.aglhome.js';
 import {
   assertCanonicalDirectory,
   assertCanonicalFilesystemObject,
@@ -665,6 +666,13 @@ class GitReversionInjectedFaultError extends Error {
   }
 }
 
+class GitReversionConcurrentRecordReadError extends Error {
+  constructor(messageArg: string) {
+    super(messageArg);
+    this.name = 'GitReversionConcurrentRecordReadError';
+  }
+}
+
 class GitReversionSourceKeepOwnershipError extends GitReversionFencedError {
   constructor(messageArg: string, optionsArg?: ErrorOptions) {
     super(messageArg, optionsArg);
@@ -739,8 +747,8 @@ export class ControllerGitReversion {
     this.validateLimits();
     this.maximumPrivateTreeEntries = privateTreeTraversalLimit(this.limits);
     this.rootDirectory = optionsArg.temporaryRoot ?? plugins.path.join(
-      plugins.os.tmpdir(),
-      `harness-controller-reversion-${this.ownerKey}`,
+      resolveAGLHomePaths().gitReversion,
+      sha256(optionsArg.ownerId),
     );
     if (!plugins.path.isAbsolute(this.rootDirectory)) {
       throw new Error('The Git reversion temporary root must be absolute.');
@@ -3182,6 +3190,8 @@ export class ControllerGitReversion {
     descriptionArg: string,
     signalArg?: AbortSignal,
     requirePrivateModeArg = false,
+    detectConcurrentReplacementArg = false,
+    afterOpenArg?: () => Promise<void>,
   ): Promise<Buffer> {
     let handle: plugins.fs.promises.FileHandle;
     try {
@@ -3196,7 +3206,13 @@ export class ControllerGitReversion {
       throw new Error(`${descriptionArg} could not be opened safely.`, { cause: errorArg });
     }
     try {
+      await afterOpenArg?.();
       const before = await handle.stat();
+      if (detectConcurrentReplacementArg && before.nlink === 0) {
+        throw new GitReversionConcurrentRecordReadError(
+          `${descriptionArg} was replaced while it was opened.`,
+        );
+      }
       if (
         !before.isFile()
         || (requirePrivateModeArg && before.nlink !== 1)
@@ -3222,12 +3238,46 @@ export class ControllerGitReversion {
         if (total > maximumBytesArg) throw new Error(`${descriptionArg} exceeds its byte limit.`);
       }
       const after = await handle.stat();
+      if (detectConcurrentReplacementArg && after.nlink === 0) {
+        throw new GitReversionConcurrentRecordReadError(
+          `${descriptionArg} was replaced while it was read.`,
+        );
+      }
       if (
         before.dev !== after.dev
         || before.ino !== after.ino
         || before.size !== after.size
         || total !== before.size
+        || !after.isFile()
+        || (requirePrivateModeArg && after.nlink !== 1)
+        || (requirePrivateModeArg && (after.mode & 0o077) !== 0)
+        || (typeof process.getuid === 'function' && after.uid !== process.getuid())
       ) throw new Error(`${descriptionArg} changed while it was read.`);
+      if (detectConcurrentReplacementArg) {
+        let pathAfter: plugins.fs.Stats;
+        try {
+          pathAfter = await plugins.fs.promises.lstat(pathArg);
+        } catch (errorArg) {
+          if ((errorArg as NodeJS.ErrnoException).code === 'ENOENT') {
+            throw new GitReversionConcurrentRecordReadError(
+              `${descriptionArg} was removed while it was read.`,
+            );
+          }
+          throw errorArg;
+        }
+        if (
+          !pathAfter.isFile()
+          || pathAfter.isSymbolicLink()
+          || pathAfter.nlink !== 1
+          || (pathAfter.mode & 0o077) !== 0
+          || (typeof process.getuid === 'function' && pathAfter.uid !== process.getuid())
+        ) throw new Error(`${descriptionArg} pathname is not an exact owned regular file.`);
+        if (pathAfter.dev !== after.dev || pathAfter.ino !== after.ino) {
+          throw new GitReversionConcurrentRecordReadError(
+            `${descriptionArg} was replaced while its pathname was revalidated.`,
+          );
+        }
+      }
       return Buffer.concat(chunks, total);
     } finally {
       await handle.close();
@@ -12121,18 +12171,34 @@ export class ControllerGitReversion {
 
   private async readWorktreeRecordByRef<T>(refArg: string): Promise<{ oid: string; value: T } | undefined> {
     const path = this.worktreeRecordPathForRef(refArg);
-    let bytes: Buffer;
-    try {
-      bytes = await this.readBoundedRegularFile(
-        path,
-        this.limits.maximumMetadataRecordBytes,
-        'Private worktree record',
-        undefined,
-        true,
+    let bytes: Buffer | undefined;
+    let concurrentReadError: GitReversionConcurrentRecordReadError | undefined;
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      try {
+        bytes = await this.readBoundedRegularFile(
+          path,
+          this.limits.maximumMetadataRecordBytes,
+          'Private worktree record',
+          undefined,
+          true,
+          true,
+          () => this.fault({ point: 'worktree.record-read.after-open', ref: refArg }),
+        );
+        break;
+      } catch (errorArg) {
+        if ((errorArg as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
+        if (errorArg instanceof GitReversionConcurrentRecordReadError) {
+          concurrentReadError = errorArg;
+          continue;
+        }
+        throw errorArg;
+      }
+    }
+    if (!bytes) {
+      throw new GitReversionFencedError(
+        'The private worktree record changed repeatedly while it was read.',
+        { cause: concurrentReadError },
       );
-    } catch (errorArg) {
-      if ((errorArg as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
-      throw errorArg;
     }
     let value: unknown;
     try {