chainlesschain 0.163.7 → 0.164.0

package/src/lib/scoped-permission-store.js

@@ -0,0 +1,369 @@
+/**
+ * Workspace-bound, expiring permission rules owned by the CLI.
+ *
+ * The state lives outside the repository so an agent cannot authorize itself
+ * by editing a project file. Mutations use the shared durable security store:
+ * cross-process lock, atomic replace, fsync, and fail-closed corrupt reads.
+ */
+
+import fs from "node:fs";
+import path from "node:path";
+import { createHash, randomUUID } from "node:crypto";
+import projectRoot from "./project-root.cjs";
+import permissionRules from "./permission-rules.cjs";
+import { getMachineSecurityAnchorDir } from "./paths.js";
+import {
+  mutateSecurityStore,
+  readSecurityStore,
+} from "./durable-security-store.js";
+
+const { findGitProjectRoot } = projectRoot;
+const { parseRule } = permissionRules;
+
+const STATE_SCHEMA = "cc.scoped-permission-rules";
+const STATE_SCHEMA_VERSION = 1;
+const STORE_LABEL = "scoped permission";
+const RULE_ID_PATTERN = /^spr_[0-9a-f]{32}$/;
+const DECISIONS = new Set(["allow", "ask", "deny"]);
+const DEFAULT_MAX_RECORDS = 1000;
+
+export const SCOPED_PERMISSION_ERROR_CODES = Object.freeze({
+  INVALID: "CC_SCOPED_PERMISSION_INVALID",
+  CONFLICT: "CC_SCOPED_PERMISSION_CONFLICT",
+  NOT_FOUND: "CC_SCOPED_PERMISSION_NOT_FOUND",
+  CORRUPT: "CC_SCOPED_PERMISSION_CORRUPT",
+});
+
+function scopedPermissionError(code, message, cause = null) {
+  const error = new Error(message);
+  error.code = code;
+  if (cause) error.cause = cause;
+  return error;
+}
+
+function canonicalWorkspaceRoot(cwd) {
+  const resolved = path.resolve(cwd || process.cwd());
+  const root = findGitProjectRoot(resolved) || resolved;
+  let canonical = root;
+  try {
+    canonical = fs.realpathSync.native(root);
+  } catch {
+    // A missing/unreadable cwd will be rejected by the caller that uses it.
+  }
+  const normalized = path.normalize(canonical);
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+
+function workspaceBinding(cwd) {
+  const root = canonicalWorkspaceRoot(cwd);
+  const id = createHash("sha256")
+    .update(`cc-scoped-permission-workspace-v1\n${root}`, "utf8")
+    .digest("hex");
+  return Object.freeze({ id, root });
+}
+
+export function defaultScopedPermissionStatePath(cwd = process.cwd()) {
+  const workspace = workspaceBinding(cwd);
+  return path.join(
+    getMachineSecurityAnchorDir(),
+    "permission-center",
+    "workspaces",
+    `${workspace.id}.json`,
+  );
+}
+
+function emptyState(workspace) {
+  return {
+    schema: STATE_SCHEMA,
+    schemaVersion: STATE_SCHEMA_VERSION,
+    generation: 0,
+    updatedAt: null,
+    workspace,
+    rules: [],
+  };
+}
+
+function validateRecord(record, seenIds) {
+  if (
+    !record ||
+    !RULE_ID_PATTERN.test(record.id || "") ||
+    seenIds.has(record.id) ||
+    !DECISIONS.has(record.decision) ||
+    !parseRule(record.rule) ||
+    !Number.isInteger(record.revision) ||
+    record.revision < 1 ||
+    !Number.isFinite(record.createdAt) ||
+    !Number.isFinite(record.expiresAt) ||
+    record.expiresAt <= record.createdAt ||
+    (record.revokedAt !== null && !Number.isFinite(record.revokedAt)) ||
+    typeof record.reason !== "string" ||
+    record.reason.length > 500
+  ) {
+    throw scopedPermissionError(
+      SCOPED_PERMISSION_ERROR_CODES.CORRUPT,
+      "Scoped permission state contains an invalid rule record",
+    );
+  }
+  seenIds.add(record.id);
+}
+
+function validateState(value, workspace) {
+  if (
+    !value ||
+    value.schema !== STATE_SCHEMA ||
+    value.schemaVersion !== STATE_SCHEMA_VERSION ||
+    !Number.isInteger(value.generation) ||
+    value.generation < 0 ||
+    !value.workspace ||
+    value.workspace.id !== workspace.id ||
+    value.workspace.root !== workspace.root ||
+    !Array.isArray(value.rules)
+  ) {
+    throw scopedPermissionError(
+      SCOPED_PERMISSION_ERROR_CODES.CORRUPT,
+      "Scoped permission state has an invalid schema or workspace binding",
+    );
+  }
+  const seenIds = new Set();
+  for (const record of value.rules) validateRecord(record, seenIds);
+  return value;
+}
+
+function statusFor(record, now) {
+  if (record.revokedAt !== null) return "revoked";
+  if (record.expiresAt <= now) return "expired";
+  return "active";
+}
+
+function projectRecord(record, now, filePath) {
+  return Object.freeze({
+    ...structuredClone(record),
+    status: statusFor(record, now),
+    source: "cli-security-store",
+    sourceFile: filePath,
+    scope: "workspace",
+  });
+}
+
+export class ScopedPermissionStore {
+  constructor({
+    cwd = process.cwd(),
+    filePath = null,
+    now = () => Date.now(),
+    maxRecords = DEFAULT_MAX_RECORDS,
+    lock = undefined,
+    randomId = () => `spr_${randomUUID().replaceAll("-", "")}`,
+  } = {}) {
+    this.workspace = workspaceBinding(cwd);
+    this.filePath = path.resolve(
+      filePath || defaultScopedPermissionStatePath(this.workspace.root),
+    );
+    const relativeToWorkspace = path.relative(
+      this.workspace.root,
+      this.filePath,
+    );
+    if (
+      relativeToWorkspace === "" ||
+      (!relativeToWorkspace.startsWith("..") &&
+        !path.isAbsolute(relativeToWorkspace))
+    ) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "Scoped permission authority must be stored outside the workspace",
+      );
+    }
+    this._now = typeof now === "function" ? now : () => Number(now);
+    this.maxRecords = Math.max(
+      1,
+      Math.floor(Number(maxRecords) || DEFAULT_MAX_RECORDS),
+    );
+    this._lock = lock;
+    this._randomId = randomId;
+  }
+
+  _read() {
+    const stored = readSecurityStore(this.filePath, STORE_LABEL);
+    if (Object.keys(stored).length === 0) return emptyState(this.workspace);
+    return validateState(stored, this.workspace);
+  }
+
+  list() {
+    const state = this._read();
+    const now = this._now();
+    return Object.freeze({
+      schema: state.schema,
+      schemaVersion: state.schemaVersion,
+      generation: state.generation,
+      updatedAt: state.updatedAt,
+      workspace: structuredClone(state.workspace),
+      file: this.filePath,
+      rules: state.rules.map((record) =>
+        projectRecord(record, now, this.filePath),
+      ),
+    });
+  }
+
+  add({
+    decision,
+    rule,
+    expiresAt,
+    reason = "",
+    expectedGeneration = null,
+  } = {}) {
+    const normalizedDecision = String(decision || "")
+      .trim()
+      .toLowerCase();
+    const normalizedRule = String(rule || "").trim();
+    const normalizedReason = String(reason || "").trim();
+    const now = this._now();
+    const expiry = Number(expiresAt);
+    if (!DECISIONS.has(normalizedDecision)) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "decision must be allow | ask | deny",
+      );
+    }
+    if (!parseRule(normalizedRule)) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "rule must be a valid Tool or Tool(pattern) permission rule",
+      );
+    }
+    if (!Number.isFinite(expiry) || expiry <= now) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "expiresAt must be a future timestamp",
+      );
+    }
+    if (normalizedReason.length > 500) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "reason must be at most 500 characters",
+      );
+    }
+
+    let created = null;
+    mutateSecurityStore(
+      this.filePath,
+      STORE_LABEL,
+      (draft) => {
+        const current =
+          Object.keys(draft).length === 0
+            ? emptyState(this.workspace)
+            : validateState(draft, this.workspace);
+        if (
+          expectedGeneration !== null &&
+          Number(expectedGeneration) !== current.generation
+        ) {
+          throw scopedPermissionError(
+            SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
+            `Scoped permission generation changed (expected ${expectedGeneration}, current ${current.generation})`,
+          );
+        }
+
+        const retained = [...current.rules];
+        while (retained.length >= this.maxRecords) {
+          const inactiveIndex = retained.findIndex(
+            (record) => statusFor(record, now) !== "active",
+          );
+          if (inactiveIndex < 0) break;
+          retained.splice(inactiveIndex, 1);
+        }
+        if (retained.length >= this.maxRecords) {
+          throw scopedPermissionError(
+            SCOPED_PERMISSION_ERROR_CODES.INVALID,
+            `Scoped permission store is full (${this.maxRecords} retained rules)`,
+          );
+        }
+        const id = this._randomId();
+        if (
+          !RULE_ID_PATTERN.test(id) ||
+          retained.some((item) => item.id === id)
+        ) {
+          throw scopedPermissionError(
+            SCOPED_PERMISSION_ERROR_CODES.INVALID,
+            "Could not allocate a valid unique scoped permission id",
+          );
+        }
+        created = {
+          id,
+          decision: normalizedDecision,
+          rule: normalizedRule,
+          revision: 1,
+          createdAt: now,
+          expiresAt: expiry,
+          revokedAt: null,
+          reason: normalizedReason,
+        };
+        Object.assign(draft, current, {
+          generation: current.generation + 1,
+          updatedAt: now,
+          rules: [...retained, created],
+        });
+        validateState(draft, this.workspace);
+      },
+      this._lock ? { lock: this._lock } : undefined,
+    );
+    return projectRecord(created, now, this.filePath);
+  }
+
+  revoke({ id, expectedRevision = null } = {}) {
+    const normalizedId = String(id || "").trim();
+    if (!RULE_ID_PATTERN.test(normalizedId)) {
+      throw scopedPermissionError(
+        SCOPED_PERMISSION_ERROR_CODES.INVALID,
+        "A valid scoped permission id is required",
+      );
+    }
+    const now = this._now();
+    let revoked = null;
+    mutateSecurityStore(
+      this.filePath,
+      STORE_LABEL,
+      (draft) => {
+        const current =
+          Object.keys(draft).length === 0
+            ? emptyState(this.workspace)
+            : validateState(draft, this.workspace);
+        const index = current.rules.findIndex(
+          (record) => record.id === normalizedId,
+        );
+        if (index < 0) {
+          throw scopedPermissionError(
+            SCOPED_PERMISSION_ERROR_CODES.NOT_FOUND,
+            `Scoped permission rule not found: ${normalizedId}`,
+          );
+        }
+        const record = current.rules[index];
+        if (
+          expectedRevision !== null &&
+          Number(expectedRevision) !== record.revision
+        ) {
+          throw scopedPermissionError(
+            SCOPED_PERMISSION_ERROR_CODES.CONFLICT,
+            `Scoped permission revision changed (expected ${expectedRevision}, current ${record.revision})`,
+          );
+        }
+        if (record.revokedAt !== null) {
+          revoked = record;
+          return;
+        }
+        revoked = {
+          ...record,
+          revision: record.revision + 1,
+          revokedAt: now,
+        };
+        const rules = [...current.rules];
+        rules[index] = revoked;
+        Object.assign(draft, current, {
+          generation: current.generation + 1,
+          updatedAt: now,
+          rules,
+        });
+        validateState(draft, this.workspace);
+      },
+      this._lock ? { lock: this._lock } : undefined,
+    );
+    return projectRecord(revoked, now, this.filePath);
+  }
+}

package/src/lib/session-anti-rollback-anchor.js

@@ -35,6 +35,17 @@ export const SESSION_ANTI_ROLLBACK_DETECTED_CODE =
 export const SESSION_ANTI_ROLLBACK_UNAVAILABLE_CODE =
   "CC_SESSION_ANTI_ROLLBACK_UNAVAILABLE";
 
+// Test-only seams for deterministic durability failures. Production callers
+// never assign these hooks; keeping them immediately before the two fsync
+// boundaries lets tests exercise the real append and rollback path without
+// replacing node:fs for the namespace or lock stores.
+export const _sessionAntiRollbackFaultHooks = Object.seal({
+  afterRecordOpen: null,
+  beforeRecordFsync: null,
+  beforeRecordDirectoryFsync: null,
+  beforeRecordRollback: null,
+});
+
 const NAMESPACE_VERSION = 1;
 const ANCHOR_SCHEMA = "chainlesschain.session-anti-rollback-anchor/v1";
 const GENERATION_SCHEMA = "chainlesschain.session-generation-authority/v1";
@@ -59,12 +70,19 @@ function anchorError(code, message, cause = null, details = {}) {
 
 function unavailable(cause, filePath = null) {
   if (cause?.code === SESSION_ANTI_ROLLBACK_DETECTED_CODE) return cause;
-  return anchorError(
+  const error = anchorError(
     SESSION_ANTI_ROLLBACK_UNAVAILABLE_CODE,
     "Session anti-rollback witness is unavailable; canonical session access is denied",
     cause,
     filePath ? { filePath } : {},
   );
+  for (const key of ["commitState", "rollbackState", "persistenceTarget"]) {
+    if (cause?.[key] != null) error[key] = cause[key];
+  }
+  if (cause?.rollbackCause) {
+    error.rollbackErrorCode = cause.rollbackCause?.code || null;
+  }
+  return error;
 }
 
 function rollback(sessionId, message, current = null, candidate = null) {
@@ -628,11 +646,173 @@ function appendRecord(location, record) {
   return appendRecordAtPath(location.recordPath, record, null);
 }
 
+function settleExistingRecord(location, record) {
+  if (isAffectedWindowsZeroDeviceStatRuntime()) {
+    return withTrustedFileParentSync(
+      fs,
+      location.recordPath,
+      ({ canonicalPath, parentDevice }) =>
+        settleExistingRecordAtPath(canonicalPath, record, parentDevice),
+    );
+  }
+  return settleExistingRecordAtPath(location.recordPath, record, null);
+}
+
+function runFaultHook(name, payload) {
+  if (process.env.CC_SESSION_ANTI_ROLLBACK_FAULT_INJECTION !== "1") return;
+  const hook = _sessionAntiRollbackFaultHooks[name];
+  if (typeof hook === "function") hook(payload);
+}
+
+function fsyncDirectory(directory) {
+  const descriptor = fs.openSync(directory, "r");
+  try {
+    fs.fsyncSync(descriptor);
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+
+function settleExistingRecordAtPath(recordPath, record, parentDevice) {
+  let descriptor = null;
+  try {
+    let flags = fs.constants.O_RDWR;
+    if (typeof fs.constants.O_NOFOLLOW === "number") {
+      flags |= fs.constants.O_NOFOLLOW;
+    }
+    descriptor = fs.openSync(recordPath, flags);
+    const opened = fs.fstatSync(descriptor, { bigint: true });
+    const published = fs.lstatSync(recordPath, { bigint: true });
+    const identityMatches =
+      parentDevice === null
+        ? String(opened.dev) === String(published.dev) &&
+          String(opened.ino) === String(published.ino)
+        : samePathHandleStableFileIdentity(published, opened, parentDevice);
+    if (
+      !opened.isFile() ||
+      published.isSymbolicLink() ||
+      !published.isFile() ||
+      !identityMatches
+    ) {
+      throw new Error("session anti-rollback record identity changed");
+    }
+    runFaultHook("beforeRecordFsync", {
+      recordPath,
+      record,
+      createsRecord: false,
+      unchanged: true,
+    });
+    fs.fsyncSync(descriptor);
+    const after = fs.lstatSync(recordPath, { bigint: true });
+    const afterIdentityMatches =
+      parentDevice === null
+        ? String(opened.dev) === String(after.dev) &&
+          String(opened.ino) === String(after.ino)
+        : samePathHandleStableFileIdentity(after, opened, parentDevice);
+    if (after.isSymbolicLink() || !after.isFile() || !afterIdentityMatches) {
+      throw new Error("session anti-rollback record identity changed");
+    }
+    // A complete revision-1 line can survive a process death before either
+    // the file fsync or the first directory-entry barrier. Replaying the exact
+    // candidate must settle both boundaries before reporting success.
+    if (record.revision === "1" && process.platform !== "win32") {
+      runFaultHook("beforeRecordDirectoryFsync", {
+        recordPath,
+        record,
+        createsRecord: false,
+        recoveredCompleteRecord: true,
+      });
+      fsyncDirectory(path.dirname(recordPath));
+    }
+  } catch (cause) {
+    if (cause && typeof cause === "object" && !cause.commitState) {
+      cause.commitState = "unknown";
+      cause.rollbackState = "not-required";
+      cause.persistenceTarget = recordPath;
+    }
+    throw cause;
+  } finally {
+    if (descriptor !== null) fs.closeSync(descriptor);
+  }
+}
+
+function rollbackRecordAppend({
+  recordPath,
+  opened,
+  initialSize,
+  createsRecord,
+  parentDevice,
+}) {
+  runFaultHook("beforeRecordRollback", {
+    recordPath,
+    initialSize,
+    createsRecord,
+  });
+  let descriptor = null;
+  try {
+    let flags = fs.constants.O_RDWR;
+    if (typeof fs.constants.O_NOFOLLOW === "number") {
+      flags |= fs.constants.O_NOFOLLOW;
+    }
+    descriptor = fs.openSync(recordPath, flags);
+    const rollbackOpened = fs.fstatSync(descriptor, { bigint: true });
+    const published = fs.lstatSync(recordPath, { bigint: true });
+    const identityMatches =
+      !published.isSymbolicLink() &&
+      published.isFile() &&
+      String(opened.dev) === String(rollbackOpened.dev) &&
+      String(opened.ino) === String(rollbackOpened.ino) &&
+      (parentDevice === null
+        ? String(rollbackOpened.dev) === String(published.dev) &&
+          String(rollbackOpened.ino) === String(published.ino)
+        : samePathHandleStableFileIdentity(
+            published,
+            rollbackOpened,
+            parentDevice,
+          ));
+    if (!identityMatches) {
+      throw new Error("session anti-rollback rollback record identity changed");
+    }
+    fs.ftruncateSync(descriptor, initialSize);
+    fs.fsyncSync(descriptor);
+  } finally {
+    if (descriptor !== null) fs.closeSync(descriptor);
+  }
+  if (createsRecord) {
+    fs.unlinkSync(recordPath);
+    if (process.platform !== "win32") {
+      fsyncDirectory(path.dirname(recordPath));
+    }
+  }
+}
+
+function rollbackEmptyCreatedRecord(recordPath) {
+  const published = fs.lstatSync(recordPath, { bigint: true });
+  if (
+    published.isSymbolicLink() ||
+    !published.isFile() ||
+    published.size !== 0n
+  ) {
+    throw new Error(
+      "session anti-rollback unverified first record cannot be removed",
+    );
+  }
+  fs.unlinkSync(recordPath);
+  if (process.platform !== "win32") {
+    fsyncDirectory(path.dirname(recordPath));
+  }
+}
+
 function appendRecordAtPath(recordPath, record, parentDevice) {
   let descriptor = null;
+  let recordOpened = false;
+  let createsRecord = false;
+  let requiresDirectoryPublication = false;
+  let initialSize = 0;
+  let opened = null;
   try {
     let flags = fs.constants.O_WRONLY | fs.constants.O_APPEND;
-    const createsRecord = !fs.existsSync(recordPath);
+    createsRecord = !fs.existsSync(recordPath);
     if (createsRecord) {
       flags |= fs.constants.O_CREAT | fs.constants.O_EXCL;
     }
@@ -640,7 +820,18 @@ function appendRecordAtPath(recordPath, record, parentDevice) {
       flags |= fs.constants.O_NOFOLLOW;
     }
     descriptor = fs.openSync(recordPath, flags, 0o600);
-    const opened = fs.fstatSync(descriptor, { bigint: true });
+    recordOpened = true;
+    runFaultHook("afterRecordOpen", { recordPath, record, createsRecord });
+    opened = fs.fstatSync(descriptor, { bigint: true });
+    if (!opened.isFile()) {
+      throw new Error("session anti-rollback append target is not a file");
+    }
+    initialSize = Number(opened.size);
+    // A previous process can die immediately after O_CREAT|O_EXCL and leave a
+    // visible zero-byte entry before its parent-directory fsync. Treat that
+    // exact crash residue like a first publication: the retry must flush the
+    // directory entry after it writes and fsyncs revision 1.
+    requiresDirectoryPublication = createsRecord || opened.size === 0n;
     const payload = Buffer.from(`${JSON.stringify(record)}\n`, "utf8");
     let offset = 0;
     while (offset < payload.length) {
@@ -657,6 +848,11 @@ function appendRecordAtPath(recordPath, record, parentDevice) {
       }
       offset += written;
     }
+    runFaultHook("beforeRecordFsync", {
+      recordPath,
+      record,
+      createsRecord,
+    });
     fs.fsyncSync(descriptor);
     const published = fs.lstatSync(recordPath, { bigint: true });
     const identityMatches =
@@ -667,14 +863,64 @@ function appendRecordAtPath(recordPath, record, parentDevice) {
     if (published.isSymbolicLink() || !published.isFile() || !identityMatches) {
       throw new Error("session anti-rollback record identity changed");
     }
-    if (createsRecord && process.platform !== "win32") {
+    if (requiresDirectoryPublication && process.platform !== "win32") {
       const directoryDescriptor = fs.openSync(path.dirname(recordPath), "r");
       try {
+        runFaultHook("beforeRecordDirectoryFsync", {
+          recordPath,
+          record,
+          createsRecord,
+          recoveredEmptyRecord: !createsRecord,
+        });
         fs.fsyncSync(directoryDescriptor);
       } finally {
         fs.closeSync(directoryDescriptor);
       }
     }
+  } catch (cause) {
+    // A completed JSON line is immediately readable even when its fsync (or a
+    // first-record directory fsync) reports failure. Best-effort rollback to
+    // the pre-append byte boundary prevents that unacknowledged record from
+    // becoming the next readback authority in the still-running process. If
+    // this was the first record, remove the empty entry and durably publish
+    // that removal on POSIX so a retry recreates and flushes the entry again.
+    try {
+      if (descriptor !== null) {
+        fs.closeSync(descriptor);
+        descriptor = null;
+      }
+      if (opened !== null) {
+        rollbackRecordAppend({
+          recordPath,
+          opened,
+          initialSize,
+          createsRecord,
+          parentDevice,
+        });
+      } else if (recordOpened && createsRecord) {
+        rollbackEmptyCreatedRecord(recordPath);
+      }
+      if (cause && typeof cause === "object") {
+        cause.commitState = "not-committed";
+        cause.rollbackState = "restored";
+        cause.persistenceTarget = recordPath;
+      }
+    } catch (rollbackCause) {
+      if (cause && typeof cause === "object") {
+        cause.rollbackCause = rollbackCause;
+        cause.commitState = "unknown";
+        cause.rollbackState = "failed";
+        cause.persistenceTarget = recordPath;
+      }
+    }
+    if (cause && typeof cause === "object" && !cause.commitState) {
+      // open/fstat failures happen before any payload write. A successfully
+      // opened first entry is removed above before reporting this state.
+      cause.commitState = "not-committed";
+      cause.rollbackState = "not-required";
+      cause.persistenceTarget = recordPath;
+    }
+    throw cause;
   } finally {
     if (descriptor !== null) fs.closeSync(descriptor);
   }
@@ -708,7 +954,18 @@ export function publishSessionAntiRollbackAnchor(
           current.headHash === candidate.headHash &&
           current.eventCount === candidate.eventCount &&
           current.deletedAtMs === candidate.deletedAtMs;
-        if (unchanged) return current;
+        // Revision 1 is the only record that can carry an unsettled first
+        // directory entry. Settle it before either acknowledging an exact
+        // replay or advancing directly to a proven successor.
+        if (current?.revision === "1") {
+          settleExistingRecord(location, current);
+        }
+        if (unchanged) {
+          if (current.revision !== "1") {
+            settleExistingRecord(location, current);
+          }
+          return current;
+        }
         if (current === null) ensureNamespaceEntry(location);
         const core = recordCore(
           location,