dsh-tower 2.0.2 → 2.0.4

package/lib/modeStore.js

@@ -62,33 +62,67 @@ export function loadModes(baseDir) {
   return modes
 }
 
-/** Persist the current modes atomically; failures never break the command. */
+/** Persist the current modes atomically with a short cross-process lock. */
 export function saveModes(modes, baseDir, maxEntries = DEFAULT_MAX_ENTRIES) {
+  const dir = storeDir(baseDir)
+  const file = storeFile(baseDir)
+  const lock = path.join(dir, 'modes.lock')
   try {
-    const dir = storeDir(baseDir)
     fs.mkdirSync(dir, { recursive: true })
-    const limit = Number.isInteger(maxEntries) && maxEntries > 0 ? maxEntries : DEFAULT_MAX_ENTRIES
-    const entries = [...modes.entries()]
-      .sort((a, b) => (Number(b[1]?.at) || 0) - (Number(a[1]?.at) || 0))
-      .slice(0, limit)
-    const payload = { version: 1, modes: Object.fromEntries(entries) }
-    const file = storeFile(baseDir)
-    const tmp = `${file}.tmp-${process.pid}`
-    fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8')
-    let lastError = null
-    for (let attempt = 0; attempt < 5; attempt += 1) {
+    let acquired = false
+    for (let attempt = 0; attempt < 40; attempt += 1) {
       try {
-        fs.renameSync(tmp, file)
-        return true
+        const fd = fs.openSync(lock, 'wx')
+        fs.writeFileSync(fd, JSON.stringify({ pid: process.pid, at: Date.now() }))
+        fs.closeSync(fd)
+        acquired = true
+        break
       } catch (error) {
-        lastError = error
-        if (!['EPERM', 'EBUSY', 'EACCES'].includes(error?.code)) break
-        sleepSync(10 * (attempt + 1))
+        if (error?.code !== 'EEXIST') throw error
+        sleepSync(5)
       }
     }
-    try { fs.unlinkSync(tmp) } catch {}
-    if (lastError) return false
-    return true
+    if (!acquired) return false
+    try {
+      const limit = Number.isInteger(maxEntries) && maxEntries > 0 ? maxEntries : DEFAULT_MAX_ENTRIES
+      let disk = {}
+      try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'))
+        if (parsed && typeof parsed === 'object' && parsed.modes && typeof parsed.modes === 'object') disk = parsed.modes
+      } catch {
+        disk = {}
+      }
+      // Merge by timestamp so two sessions saving concurrently do not erase
+      // each other's mode changes. A disk-only entry from another process is
+      // preserved unless this process has a newer record for the same key.
+      const merged = { ...disk }
+      for (const [key, value] of modes.entries()) {
+        const previous = merged[key]
+        if (!previous || (Number(value?.at) || 0) >= (Number(previous?.at) || 0)) merged[key] = value
+      }
+      const entries = Object.entries(merged)
+        .sort((a, b) => (Number(b[1]?.at) || 0) - (Number(a[1]?.at) || 0))
+        .slice(0, limit)
+      const payload = { version: 1, modes: Object.fromEntries(entries) }
+      const tmp = `${file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`
+      fs.writeFileSync(tmp, JSON.stringify(payload, null, 2), 'utf8')
+      let lastError = null
+      for (let attempt = 0; attempt < 5; attempt += 1) {
+        try {
+          fs.renameSync(tmp, file)
+          return true
+        } catch (error) {
+          lastError = error
+          if (!['EPERM', 'EBUSY', 'EACCES'].includes(error?.code)) break
+          sleepSync(10 * (attempt + 1))
+        }
+      }
+      try { fs.unlinkSync(tmp) } catch {}
+      if (lastError) return false
+      return true
+    } finally {
+      try { fs.unlinkSync(lock) } catch {}
+    }
   } catch {
     return false
   }

package/lib/store.js

@@ -98,15 +98,73 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms))
 }
 
+const PROCESS_STARTED_AT = Date.now() - Math.round(process.uptime() * 1000)
+
+function processAlive(pid) {
+  if (!Number.isInteger(Number(pid)) || Number(pid) <= 0) return null
+  try {
+    process.kill(Number(pid), 0)
+    return true
+  } catch (error) {
+    if (error?.code === 'ESRCH') return false
+    // EPERM means the process exists but belongs to another user.
+    return true
+  }
+}
+
+/** Read the current lock record without acquiring the lock. */
+export async function readStateLock(paths) {
+  try {
+    const text = await fsp.readFile(paths.lock, 'utf8')
+    const record = JSON.parse(text)
+    const alive = processAlive(record?.pid)
+    return { path: paths.lock, record, alive, raw: text }
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { path: paths.lock, record: null, alive: null, raw: null }
+    return { path: paths.lock, record: null, alive: null, raw: null, error: String(error?.message ?? error) }
+  }
+}
+
+async function reclaimDeadLock(paths) {
+  let original
+  try {
+    original = await fsp.readFile(paths.lock, 'utf8')
+  } catch {
+    return false
+  }
+  let parsed
+  try {
+    parsed = JSON.parse(original)
+  } catch {
+    return false
+  }
+  if (processAlive(parsed?.pid) !== false) return false
+  const quarantine = `${paths.lock}.stale-${process.pid}-${crypto.randomUUID()}`
+  try {
+    await fsp.rename(paths.lock, quarantine)
+  } catch {
+    return false
+  }
+  const moved = await fsp.readFile(quarantine, 'utf8').catch(() => null)
+  if (moved === null || moved !== original) {
+    // A concurrent writer replaced the lock between read and rename. Put the
+    // newer record back rather than deleting it.
+    if (moved !== null) await fsp.rename(quarantine, paths.lock).catch(() => {})
+    return false
+  }
+  await fsp.unlink(quarantine).catch(() => {})
+  return true
+}
+
 /**
- * Hold the repo-wide tower lock for one mutation. Stale locks are reported,
- * never silently stolen (matches the fail-closed protocol).
+ * Hold the repo-wide tower lock for one mutation. A lock whose recorded PID is
+ * provably dead is reclaimed atomically; a live lock is reported, never stolen.
  */
 export async function withLock(paths, fn, options = {}) {
   const timeoutMs = options.timeoutMs ?? 5000
   const pollMs = options.pollMs ?? 25
   const token = crypto.randomUUID()
-  const record = JSON.stringify({ token, pid: process.pid, at: Date.now() })
+  const record = JSON.stringify({ token, pid: process.pid, startedAt: PROCESS_STARTED_AT, at: Date.now() })
   const deadline = Date.now() + timeoutMs
 
   for (;;) {
@@ -115,15 +173,12 @@ export async function withLock(paths, fn, options = {}) {
       break
     } catch (error) {
       if (error.code !== 'EEXIST') throw error
+      if (await reclaimDeadLock(paths)) continue
       if (Date.now() > deadline) {
-        let owner = null
-        try {
-          owner = await fsp.readFile(paths.lock, 'utf8')
-        } catch {
-          owner = null
-        }
+        const owner = await readStateLock(paths)
+        const payload = owner.raw ?? (owner.record ? JSON.stringify(owner.record) : null)
         throw new Error(
-          `tower state is locked by another writer${owner ? ` (${owner})` : ''}; retry after it finishes`,
+          `tower state is locked by another writer${payload ? ` (${payload})` : ''}; retry after it finishes`,
         )
       }
       await sleep(pollMs)

package/lib/tests.js

@@ -253,6 +253,40 @@ export function parseJsonArray(stdout) {
   return { tests, ok: failed === 0, count: tests.length, failed, error: null }
 }
 
+/** Test discovery is repository-controlled code: do not hand it secrets. */
+const TEST_ENV_ALLOW = new Set([
+  'PATH',
+  'Path',
+  'PATHEXT',
+  'SystemRoot',
+  'WINDIR',
+  'ComSpec',
+  'HOME',
+  'USERPROFILE',
+  'TMP',
+  'TEMP',
+  'TMPDIR',
+  'LANG',
+  'LC_ALL',
+  'LC_CTYPE',
+  'SHELL',
+  'TERM',
+  'APPDATA',
+  'LOCALAPPDATA',
+  'ProgramFiles',
+  'ProgramFiles(x86)',
+  'NODE_PATH',
+])
+
+export function testProcessEnv(source = process.env) {
+  const env = {}
+  for (const [key, value] of Object.entries(source)) {
+    if (!TEST_ENV_ALLOW.has(key)) continue
+    env[key] = value
+  }
+  return env
+}
+
 /** Platform shell for discovery commands (PowerShell 7 on Windows, bash on POSIX). */
 function shellSpec(platform = process.platform) {
   if (platform === 'win32') {
@@ -379,7 +413,7 @@ function spawnToFiles({ command, cwd, timeoutMs, maxBytes, stdoutPath, stderrPat
         windowsHide: true,
         // POSIX: a process group lets a timeout kill grandchildren too.
         detached: process.platform !== 'win32',
-        env: process.env,
+        env: testProcessEnv(),
       })
     } catch (error) {
       spawnError = error