dsh-live-compact 1.1.4 → 1.1.6

package/shadow.js

@@ -38,7 +38,7 @@ const PLUGIN_NAME = /^(?:(?:cut|official|shadow)-\d+-[0-9a-f]{8}|raw-[0-9a-f]{16
 let cachedSid = "";
 const lockedDirs = new Map();
 const lockedFiles = new Map();
-let shadowFuse = false;
+let shadowFuseState = new Int32Array(new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT));
 const shadowWarnings = new Set();
 
 // No shared byte ledger. A positively dead holder leaves an immutable fence:
@@ -89,17 +89,78 @@ function touchExclusive(file, body = "") {
 }
 
 function readRotationOwner(file) {
+  if (!lstatSync(file).isFile()) throw new Error("shadow owner is not a regular file");
   const fd = openSync(file, "r");
   try {
-    const buffer = Buffer.alloc(49);
+    const info = fstatSync(fd, { bigint: true });
+    if (!info.isFile() || info.size <= 0n || info.size > 256n) throw new Error("invalid shadow owner size");
+    const buffer = Buffer.alloc(257);
     const count = readSync(fd, buffer, 0, buffer.length, 0);
-    const token = buffer.subarray(0, count).toString("utf8");
-    return /^[0-9a-f]{48}$/.test(token) ? token : "";
+    const text = buffer.subarray(0, count).toString("utf8");
+    const record = JSON.parse(text);
+    if (count !== Number(info.size) || record?.v !== 1 ||
+        !Number.isSafeInteger(record.pid) || record.pid <= 0 || record.pid > 0x7fffffff ||
+        !/^[0-9a-f]{48}$/.test(record.id) || `${JSON.stringify({ v: 1, pid: record.pid, id: record.id })}\n` !== text) {
+      throw new Error("invalid shadow owner record");
+    }
+    return record;
   } finally {
     closeSync(fd);
   }
 }
 
+function rotationOwnerText(record) {
+  return `${JSON.stringify({ v: 1, pid: record.pid, id: record.id })}\n`;
+}
+
+function publishRotationOwner(file, record) {
+  const temp = `${file}.${randomBytes(24).toString("hex")}.tmp`;
+  let fd;
+  try {
+    fd = openSync(temp, "wx", 0o600);
+    writeFileSync(fd, rotationOwnerText(record));
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    // The rotation lock serializes owner claims. Remove only the stale owner
+    // after its PID was proven dead, then publish the complete replacement.
+    try { unlinkSync(file); } catch (error) { if (error?.code !== "ENOENT") throw error; }
+    renameSync(temp, file);
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    try { unlinkSync(temp); } catch {}
+  }
+}
+
+function ownerProcessAlive(record) {
+  try {
+    process.kill(record.pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code !== "ESRCH";
+  }
+}
+
+function claimRotationOwner(file) {
+  const next = { pid: process.pid, id: rotationOwner };
+  let current;
+  try {
+    current = readRotationOwner(file);
+  } catch (error) {
+    if (error?.code !== "ENOENT") return false;
+  }
+  if (current) {
+    if (current.pid === next.pid && current.id === next.id) return true;
+    if (ownerProcessAlive(current)) return false;
+  }
+  try {
+    publishRotationOwner(file, next);
+    return readRotationOwner(file).pid === next.pid && readRotationOwner(file).id === next.id;
+  } catch {
+    return false;
+  }
+}
+
 function rotationRecordText(record) {
   return `${JSON.stringify({ v: 1, pid: record.pid, id: record.id })}\n`;
 }
@@ -390,12 +451,18 @@ export function withShadowRoot(dir, action) {
     const optedIn = guard.owned && dedicatedRoot(root, identity);
     const owner = join(root, ROTATION_OWNER);
     let token = "";
-    if (optedIn && !existsSync(owner) && !existsSync(shared)) {
+    let currentOwner;
+    try { currentOwner = readRotationOwner(owner); } catch {}
+    const ownsCurrent = currentOwner?.pid === process.pid && currentOwner?.id === rotationOwner;
+    if (optedIn && !existsSync(shared) && !ownsCurrent) {
       shadowUsage = null;
-      touchExclusive(owner, rotationOwner);
+      if (!claimRotationOwner(owner)) touchExclusive(shared);
     }
     if (existsSync(owner)) {
-      try { token = readRotationOwner(owner); } catch {}
+      try {
+        const record = readRotationOwner(owner);
+        token = record.pid === process.pid && record.id === rotationOwner ? record.id : "";
+      } catch {}
       if (token !== rotationOwner || !optedIn) touchExclusive(shared);
     }
     const exclusive = optedIn && token === rotationOwner && !existsSync(shared);
@@ -420,16 +487,31 @@ export function resetShadowAccessState() {
   cachedSid = "";
   lockedDirs.clear();
   lockedFiles.clear();
-  shadowFuse = false;
+  // Test/restart helper only: callers must have no in-flight workers. Keep the
+  // same shared buffer so idle worker retirement never creates a new fuse domain.
+  Atomics.store(shadowFuseState, 0, 0);
   shadowWarnings.clear();
 }
 
 export function shadowAccessFused() {
-  return shadowFuse;
+  return Atomics.load(shadowFuseState, 0) !== 0;
+}
+
+export function shadowAccessFuseBuffer() {
+  return shadowFuseState.buffer;
+}
+
+export function attachShadowAccessFuse(buffer) {
+  if (!(buffer instanceof SharedArrayBuffer) || buffer.byteLength !== Int32Array.BYTES_PER_ELEMENT) {
+    throw new TypeError("spine: invalid shared shadow access fuse");
+  }
+  const alreadyFused = shadowAccessFused();
+  shadowFuseState = new Int32Array(buffer);
+  if (alreadyFused) Atomics.store(shadowFuseState, 0, 1);
 }
 
 function tripFuse() {
-  shadowFuse = true;
+  Atomics.store(shadowFuseState, 0, 1);
 }
 
 function envValue(env, name) {
@@ -766,7 +848,7 @@ export function defaultShadowAccessRunner({
     return true;
   }
 
-  if (shadowFuse) {
+  if (shadowAccessFused()) {
     const error = new Error("spine: shadow permission already failed");
     error.code = "ESHADOWACCESS";
     throw error;
@@ -846,7 +928,7 @@ export function defaultShadowAccessRunner({
 export function tightenShadow(path, kind = "dir", access = {}) {
   const platform = access.platform ?? process.platform;
   const windows = platform === "win32" && !access.runner;
-  if (windows && shadowFuse) {
+  if (windows && shadowAccessFused()) {
     const error = new Error("spine: shadow permission action failed; backup refused");
     error.code = "ESHADOWACCESS";
     throw error;
@@ -890,8 +972,25 @@ export function ensureShadowDir(dir, access = {}) {
   return dir;
 }
 
-export function tightenCreatedShadow(file, fd, access, { remember = true } = {}) {
-  if ((access.platform ?? process.platform) === "win32" && !access.runner && !shadowFuse) {
+export function tightenCreatedShadow(file, fd, access, { remember = true, skipRunner = false } = {}) {
+  if (skipRunner) {
+    try {
+      const entry = accessEntry(file);
+      const opened = fstatSync(fd, { bigint: true });
+      if (!entry.identity || entry.identity !== accessIdentity(opened) || opened.nlink !== 1n) {
+        throw new Error("spine: shadow published file identity changed");
+      }
+      if (remember) lockedFiles.set(entry.canonical, entry);
+      return;
+    } catch (cause) {
+      tripFuse();
+      const error = new Error("spine: shadow permission action failed; backup refused", { cause });
+      error.code = "ESHADOWACCESS";
+      error.step = "file";
+      throw error;
+    }
+  }
+  if ((access.platform ?? process.platform) === "win32" && !access.runner && !shadowAccessFused()) {
     try {
       if (shadowDirLocked(dirname(file))) {
         const entry = accessEntry(file, "file");
@@ -961,12 +1060,13 @@ function writeShadowFileLocked(file, body, access, { exclusive, write, unlink, a
   const dir = dirname(file);
   const parentIdentity = rememberShadowParent(dir);
 
-  const target = exclusive
-    ? file
-    : join(
-        dir,
-        `.${basename(file)}-${randomBytes(8).toString("hex")}.tmp`,
-      );
+  // Always stage the body in a private temporary file. Publishing the final
+  // name only after the bytes are flushed prevents readers from observing a
+  // half-written raw or meta file after a process interruption.
+  const target = join(
+    dir,
+    `.${basename(file)}-${randomBytes(8).toString("hex")}.tmp`,
+  );
 
   let fd = null;
   let created = false;
@@ -976,25 +1076,34 @@ function writeShadowFileLocked(file, body, access, { exclusive, write, unlink, a
     fd = openSync(target, "wx", 0o600);
     created = true;
 
-    if (!exclusive) {
-      renameSync(target, file);
-      protectedPath = file;
-    }
-
-    // Keep the caller's spelling for the permission cache/runner.
-    // The opened descriptor and cleanup path remain in the canonical root.
-    tightenCreatedShadow(accessPath, fd, access);
     verifyRotationScope();
     if (parentIdentity && directoryIdentity(dir) !== parentIdentity) {
       retireRotationScope();
       throw coordinationError(new Error("shadow session directory identity changed"));
     }
+    // Confirm ACL/mode before any secret bytes are written to the staged file.
+    tightenCreatedShadow(target, fd, access);
     // Full replacement bytes are a conservative charge, even for overwrites,
     // partial writes and failed cleanup. Metadata/owner/stats are not capacity.
     if (shadowUsage && isPluginShadowName(basename(file))) {
       shadowUsage.bytes += typeof body === "string" ? Buffer.byteLength(body, "utf8") : body.byteLength;
     }
     write(fd, body);
+    fsyncSync(fd);
+
+    // The rotation/root lock provides the no-overwrite boundary for exclusive
+    // raw files. Refuse a file that appeared after admission; never replace it.
+    if (exclusive && existsSync(file)) {
+      const error = new Error("shadow file already exists");
+      error.code = "EEXIST";
+      throw error;
+    }
+    renameSync(target, file);
+    protectedPath = file;
+
+    // Keep the caller's spelling for the permission cache/runner. The opened
+    // descriptor and the final path now refer to the same published object.
+    tightenCreatedShadow(file, fd, access, { skipRunner: true });
 
     const opened = fd;
     fd = null;
@@ -1049,7 +1158,12 @@ function readSessionKey(file) {
   }
 }
 
-export function listPluginShadows(dir, { readdir = readdirSync, stat = statSync, onError } = {}) {
+export function listPluginShadows(dir, {
+  readdir = readdirSync,
+  stat = statSync,
+  onError,
+  includeSessionKey = true,
+} = {}) {
   let names = [];
   try {
     names = readdir(dir);
@@ -1069,7 +1183,7 @@ export function listPluginShadows(dir, { readdir = readdirSync, stat = statSync,
         path,
         size: info.size,
         mtimeMs: info.mtimeMs,
-        sessionKey: readSessionKey(path),
+        sessionKey: includeSessionKey ? readSessionKey(path) : "",
       });
     } catch { onError?.(); }
   }
@@ -1080,7 +1194,12 @@ function byAge(left, right) {
   return left.mtimeMs - right.mtimeMs || left.name.localeCompare(right.name);
 }
 
-export function listShadowEntries(dir, alive = processAlive, { readdir = readdirSync, stat = statSync, onError } = {}) {
+export function listShadowEntries(dir, alive = processAlive, {
+  readdir = readdirSync,
+  stat = statSync,
+  onError,
+  includeSessionKey = false,
+} = {}) {
   const entries = [];
   let names = [];
   try {
@@ -1113,7 +1232,7 @@ export function listShadowEntries(dir, alive = processAlive, { readdir = readdir
     if (owner > 0) {
       try { live = alive(owner) !== false; } catch { live = true; }
     }
-    for (const file of listPluginShadows(path, { readdir, stat, onError })) {
+    for (const file of listPluginShadows(path, { readdir, stat, onError, includeSessionKey })) {
       // The directory and its owner define deletion authority. Raw tool output
       // is untrusted data and may itself start with a spine-session marker.
       entries.push({ ...file, legacy: false, live, sessionKey: entry.name });
@@ -1130,6 +1249,65 @@ export function rotateShadow(options) {
   return withShadowRoot(options.dir, () => rotateShadowLocked(options));
 }
 
+// Complete backup transaction used by both the synchronous compatibility API
+// and the optional root-writer worker. The rotation lock stays held from the
+// full reconcile through ACL-protected body publication; callers must not move
+// only the scan to a worker and release the lock before the write.
+export function saveShadowTransaction({
+  shadow,
+  file,
+  body,
+  required = false,
+  protectPaths = [],
+  sessionKey = "default",
+  cap,
+  access = {},
+  rotationIO = {},
+} = {}) {
+  ensureShadowDir(shadow, access);
+  const dir = sessionDir(shadow, sessionKey);
+  ensureShadowDir(dir, access);
+  return withShadowRoot(shadow, () => {
+    const owner = join(dir, "owner");
+    const ownerExisted = existsSync(owner);
+    let ownerWritten = false;
+    try {
+      writeShadowOwner(dir, access, shadow);
+      ownerWritten = true;
+      const incoming = Buffer.byteLength(body);
+      const rotation = rotateShadow({
+        ...rotationIO,
+        dir: shadow,
+        incomingBytes: incoming,
+        protectPath: file,
+        protectPaths,
+        sessionKey,
+        cap,
+      });
+      if (!rotation.ok) {
+        if (rotation.reason) {
+          const incomplete = rotation.reason === "scan-incomplete";
+          const error = Object.assign(new Error(incomplete
+            ? "spine: shadow capacity scan is incomplete; backup refused; leaving the span"
+            : "spine: shadow capacity measurement is invalid; backup refused; leaving the span"), {
+            code: incomplete ? "ESHADOWSCAN" : "ESHADOWMETER",
+          });
+          if (required) throw error;
+          return { ok: false, skipped: true, reason: rotation.reason, rotation };
+        }
+        if (required) throw new Error("spine: shadow backup is full; leaving the span");
+        return { ok: false, skipped: true, reason: "full", rotation };
+      }
+      writeShadowFile(file, body, access, { root: shadow });
+      if (!existsSync(file)) throw new Error("spine: shadow backup was not written");
+      return { ok: true, file, rotation };
+    } catch (error) {
+      if (ownerWritten && !ownerExisted) discardShadowFiles([owner], error);
+      throw error;
+    }
+  });
+}
+
 function rotationTime(now) {
   try {
     const value = now();

package/shell.js

@@ -68,9 +68,11 @@ function releaseCompaction(ctx, previous) {
   const store = ctx?.reflect?.store;
   const key = ctx?.[Symbol.for("cordis.isolate")]?.compaction;
   const current = compactionRecord(ctx);
-  if (!current || current === previous || current.fiber !== ctx.fiber) return false;
+  const currentFiber = current?.fiber ?? current?.ctx?.fiber;
+  const contextFiber = ctx?.fiber;
+  if (!current || current === previous || currentFiber !== contextFiber) return false;
   delete store[key];
-  if (ctx.fiber?.store?.compaction === current) delete ctx.fiber.store.compaction;
+  if (contextFiber?.store?.compaction === current) delete contextFiber.store.compaction;
   return true;
 }
 

package/thunder.js

@@ -34,7 +34,14 @@ function estimateTokens(text) {
 }
 
 export function buildSendLess({ taskLine, uncovered, facts, proseTokens = PROSE_TOKEN_CAP }) {
-  const kept = (facts || []).filter(Boolean);
+  const kept = (facts || []).filter(Boolean).map((fact) => {
+    if (typeof fact === "object" && fact !== null) {
+      const role = String(fact.role || "unknown");
+      const line = String(fact.line || "");
+      return line ? `[${role}] ${line}` : "";
+    }
+    return `[unknown] ${String(fact)}`;
+  }).filter(Boolean);
   let prose = uncovered || "";
   if (estimateTokens(prose) > proseTokens) {
     let low = 0;