isomorphic-jj 1.7.0 → 1.9.0

package/src/backend/isomorphic-git-backend.js

@@ -11,7 +11,8 @@ import { JJCheckout } from '../core/jj-checkout.js';
 import { JJTreeState } from '../core/jj-tree-state.js';
 import { JJOperationStore } from '../core/jj-operation-store.js';
 import { JJViewStore } from '../core/jj-view-store.js';
-import crypto from 'crypto';
+import { randomHex } from '../utils/id-generation.js';
+import { mkdirp } from '../utils/mkdirp.js';
 
 /**
  * Backend adapter for isomorphic-git
@@ -540,7 +541,11 @@ export class IsomorphicGitBackend {
    * @param {boolean} [opts.force] - Allow non-fast-forward
    * @param {any} [opts.onProgress] - Progress callback
    * @param {any} [opts.onAuth] - Authentication callback
-   * @returns {Promise<{pushedRefs: Array<any>, rejectedRefs: Array<any>}>} Push result
+   * @returns {Promise<{pushedRefs: Array<{name: string, oid: string}>, rejectedRefs: Array<{name: string, code: string, reason: string, message: string}>}>} Push result.
+   *   Each rejected ref carries a `code` (one of `AUTH_FAILED`,
+   *   `NETWORK_ERROR`, `NON_FAST_FORWARD`, `OTHER`) and a human-readable
+   *   `reason`, so callers can tell an auth failure apart from a
+   *   non-fast-forward rejection instead of guessing (see issue #14).
    */
   async push(opts) {
     if (!this.http) {
@@ -576,8 +581,13 @@ export class IsomorphicGitBackend {
             pushedRefs.push({ name: ref, oid });
           }
         } catch (pushError) {
-          // Track rejected refs
-          rejectedRefs.push(ref);
+          // Track rejected refs with the categorized reason so callers can
+          // distinguish an auth failure from a non-fast-forward rejection
+          // (or a network blip) instead of guessing — see issue #14. A
+          // caller that blindly retries with force:true on every rejection
+          // risks doing so on what was actually an auth/network problem.
+          const { code, reason } = this._categorizePushError(pushError);
+          rejectedRefs.push({ name: ref, code, reason, message: pushError.message });
         }
       }
 
@@ -609,6 +619,53 @@ export class IsomorphicGitBackend {
     }
   }
 
+  /**
+   * Categorize a per-ref push failure into a stable code/reason pair so
+   * callers can distinguish auth failures, network errors, and
+   * non-fast-forward rejections from each other and from other/unknown
+   * failures — see issue #14. isomorphic-git doesn't throw a single
+   * "AuthError" class; auth failures generally surface as an HttpError with
+   * a 401/403 status code (or a UserCanceledError if onAuth cancels).
+   *
+   * @private
+   * @param {any} error - Error thrown by git.push() for a single ref
+   * @returns {{code: string, reason: string}}
+   */
+  _categorizePushError(error) {
+    const errCode = error && error.code;
+
+    if (errCode === 'PushRejectedError') {
+      const reason = error.data && error.data.reason;
+      return {
+        code: 'NON_FAST_FORWARD',
+        reason: reason === 'tag-exists' ? 'tag already exists on remote' : 'non-fast-forward',
+      };
+    }
+
+    if (errCode === 'HttpError') {
+      const status = error.data && error.data.statusCode;
+      if (status === 401 || status === 403) {
+        return { code: 'AUTH_FAILED', reason: `HTTP ${status}` };
+      }
+      return { code: 'NETWORK_ERROR', reason: status ? `HTTP ${status}` : 'HTTP error' };
+    }
+
+    if (
+      errCode === 'AuthError' ||
+      errCode === 'UserCanceledError' ||
+      errCode === 'MissingUsernameError' ||
+      errCode === 'MissingPasswordTokenError'
+    ) {
+      return { code: 'AUTH_FAILED', reason: errCode };
+    }
+
+    if (errCode === 'NetworkError' || errCode === 'UnknownTransportError') {
+      return { code: 'NETWORK_ERROR', reason: errCode };
+    }
+
+    return { code: 'OTHER', reason: (error && error.message) || String(error) };
+  }
+
   /**
    * Create minimal .jj/repo structure for jj CLI compatibility
    * @private
@@ -618,14 +675,14 @@ export class IsomorphicGitBackend {
     const jjRepo = `${jjDir}/repo`;
 
     // Create directory structure
-    await this.fs.promises.mkdir(`${jjRepo}/store`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/store/extra/heads`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/op_store/operations`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/op_store/views`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/op_heads/heads`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/index`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjRepo}/submodule_store`, { recursive: true });
-    await this.fs.promises.mkdir(`${jjDir}/working_copy`, { recursive: true });
+    await mkdirp(this.fs, `${jjRepo}/store`);
+    await mkdirp(this.fs, `${jjRepo}/store/extra/heads`);
+    await mkdirp(this.fs, `${jjRepo}/op_store/operations`);
+    await mkdirp(this.fs, `${jjRepo}/op_store/views`);
+    await mkdirp(this.fs, `${jjRepo}/op_heads/heads`);
+    await mkdirp(this.fs, `${jjRepo}/index`);
+    await mkdirp(this.fs, `${jjRepo}/submodule_store`);
+    await mkdirp(this.fs, `${jjDir}/working_copy`);
 
     // Write type files
     await this.fs.promises.writeFile(`${jjRepo}/store/type`, 'git');
@@ -652,8 +709,8 @@ export class IsomorphicGitBackend {
    */
   async _createInitialJJState() {
     // Generate unique IDs for initial state
-    const operationId = crypto.randomBytes(64).toString('hex'); // 512-bit = 128 hex chars
-    const viewId = crypto.randomBytes(64).toString('hex');
+    const operationId = randomHex(64); // 512-bit = 128 hex chars
+    const viewId = randomHex(64);
     const emptyTreeId = '4b825dc642cb6eb9a060e54bf8d69288fbee4904'; // Git's empty tree hash
 
     // Get the initial commit from Git
@@ -665,7 +722,7 @@ export class IsomorphicGitBackend {
         ref: 'HEAD',
       });
       if (headOid) {
-        initialCommitId = crypto.randomBytes(64).toString('hex');
+        initialCommitId = randomHex(64);
       }
     } catch (error) {
       // No initial commit yet

package/src/browser/helpers.js

@@ -5,24 +5,30 @@
  */
 
 /**
- * Create a browser-compatible filesystem using LightningFS
+ * Create a browser-compatible filesystem, defaulting to LightningFS.
  *
- * Requires: @isomorphic-git/lightning-fs
+ * Requires (unless `opts.fs` is supplied): @isomorphic-git/lightning-fs
  *
- * @param {Object} opts - Options
+ * @param {Object} [opts] - Options
  * @param {string} [opts.backend='idb'] - Storage backend ('idb' or 'memory')
  * @param {string} [opts.name='jj'] - Database name for IndexedDB
  * @param {boolean} [opts.wipe=false] - Wipe existing data
- * @returns {Object} LightningFS instance
+ * @param {any} [opts.fs] - Bring your own filesystem instead of the default
+ *   LightningFS auto-import. Pass either an already-constructed
+ *   isomorphic-git-compatible fs (e.g. a `memfs` volume, or your own
+ *   LightningFS instance) — returned as-is — or a constructor with the
+ *   LightningFS signature (`new Ctor(name, { wipe })`), which is
+ *   instantiated the same way the default LightningFS would be.
+ * @returns {Promise<Object>} Filesystem instance compatible with isomorphic-git
  *
  * @example
  * ```javascript
- * import { createBrowserFS } from 'isomorphic-jj/browser';
- * import { createJJ } from 'isomorphic-jj';
+ * import { createBrowserFS } from '@johnhenry/isomorphic-jj/browser';
+ * import { createJJ } from '@johnhenry/isomorphic-jj';
  * import git from 'isomorphic-git';
  * import http from 'isomorphic-git/http/web';
  *
- * const fs = createBrowserFS({ backend: 'idb', name: 'my-repo' });
+ * const fs = await createBrowserFS({ backend: 'idb', name: 'my-repo' });
  * const jj = await createJJ({
  *   fs,
  *   dir: '/repo',
@@ -30,24 +36,36 @@
  *   http
  * });
  * ```
+ *
+ * @example Bring your own fs (e.g. memfs)
+ * ```javascript
+ * import { fs as memfs } from 'memfs';
+ * const fs = await createBrowserFS({ fs: memfs });
+ * ```
  */
-export function createBrowserFS(opts = {}) {
+export async function createBrowserFS(opts = {}) {
   // Check if we're in a browser environment
   if (typeof window === 'undefined') {
     throw new Error('createBrowserFS() should only be used in browser environments');
   }
 
-  // Dynamic import to avoid issues in Node.js
-  // Users must install @isomorphic-git/lightning-fs separately
-  try {
-    // This will be resolved by the bundler
-    const LightningFS = require('@isomorphic-git/lightning-fs');
-
-    const fs = new LightningFS(opts.name || 'jj', {
-      wipe: opts.wipe || false,
-    });
+  // Caller supplied their own filesystem — use it directly instead of
+  // pulling in LightningFS at all.
+  if (opts.fs) {
+    if (typeof opts.fs === 'function') {
+      return new opts.fs(opts.name || 'jj', { wipe: opts.wipe || false });
+    }
+    return opts.fs;
+  }
 
-    return fs;
+  // Dynamic `import()` (not `require`) so this resolves in an ESM browser
+  // bundle — `require` does not exist there (see issue #28). Users must
+  // install @isomorphic-git/lightning-fs separately; it's an optional
+  // peer/dev dependency of this package.
+  let LightningFS;
+  try {
+    const mod = await import('@isomorphic-git/lightning-fs');
+    LightningFS = mod.default ?? mod;
   } catch (error) {
     throw new Error(
       'LightningFS not found. Install it with: npm install @isomorphic-git/lightning-fs\n' +
@@ -55,6 +73,10 @@ export function createBrowserFS(opts = {}) {
         error.message
     );
   }
+
+  return new LightningFS(opts.name || 'jj', {
+    wipe: opts.wipe || false,
+  });
 }
 
 /**

package/src/browser/index.d.ts

@@ -14,6 +14,13 @@ export interface BrowserFSOptions {
   name?: string;
   /** Wipe existing data on initialization */
   wipe?: boolean;
+  /**
+   * Bring your own filesystem instead of the default LightningFS
+   * auto-import. Pass either an already-constructed isomorphic-git
+   * compatible fs (returned as-is) or a LightningFS-shaped constructor
+   * (`new Ctor(name, { wipe })`).
+   */
+  fs?: any;
 }
 
 /**
@@ -99,11 +106,11 @@ export interface ServiceWorkerUtils {
  * import git from 'isomorphic-git';
  * import http from 'isomorphic-git/http/web';
  *
- * const fs = createBrowserFS({ backend: 'idb', name: 'my-repo' });
+ * const fs = await createBrowserFS({ backend: 'idb', name: 'my-repo' });
  * const jj = await createJJ({ fs, dir: '/repo', git, http });
  * ```
  */
-export function createBrowserFS(opts?: BrowserFSOptions): any;
+export function createBrowserFS(opts?: BrowserFSOptions): Promise<any>;
 
 /**
  * Get storage quota information (browser only)

package/src/core/change-graph.js

@@ -6,6 +6,7 @@
 
 import { JJError } from '../utils/errors.js';
 import { validateChangeId } from '../utils/validation.js';
+import { randomHex } from '../utils/id-generation.js';
 
 export class ChangeGraph {
   /**
@@ -95,6 +96,68 @@ export class ChangeGraph {
     await this.save();
   }
 
+  /**
+   * Add a DIVERGENT copy of an existing change: another commit that also
+   * claims `change.changeId` (see issue #32 / the `divergent()` revset —
+   * "multiple visible commits sharing one change id"). `addChange()`
+   * can't represent this: `nodes` is a `Map<changeId, change>`, one entry
+   * per key, by design — every other API (getChange, getParents,
+   * getChildren, ...) keys on plain changeId and would be ambiguous if
+   * that stopped being unique.
+   *
+   * Divergent copies are therefore stored under a synthetic internal key
+   * (`${changeId}\0${commitId}`) so the `nodes` Map stays a true map, but
+   * each copy's *own* `changeId` field is unchanged — so `getAll()` (and
+   * therefore the existing `divergent()` revset filter, which counts
+   * occurrences of `c.changeId` across `getAll()`) sees both/all of them
+   * and correctly reports the change as divergent. `getChange(changeId)`
+   * deliberately keeps resolving to just the primary copy (the one
+   * actually stored under the plain `changeId` key) — for anything that
+   * needs every copy, see getDivergentSiblings().
+   *
+   * @param {Record<string, any>} change - The divergent copy (must have
+   *   the same `changeId` as an existing change, and its own `commitId`)
+   */
+  async addDivergentCopy(change) {
+    validateChangeId(change.changeId);
+
+    if (!this.nodes.has(change.changeId)) {
+      throw new JJError(
+        'CHANGE_NOT_FOUND',
+        `Cannot add a divergent copy of ${change.changeId}: no existing change with that id`,
+        { changeId: change.changeId, suggestion: 'Use addChange() to create the first copy' }
+      );
+    }
+
+    const key = `${change.changeId}\0${change.commitId}`;
+    if (this.nodes.has(key)) {
+      throw new JJError(
+        'CHANGE_EXISTS',
+        `Change ${change.changeId} already has a divergent copy with commit ${change.commitId}`,
+        { changeId: change.changeId, commitId: change.commitId }
+      );
+    }
+
+    change.divergent = true;
+    this.nodes.set(key, change);
+    this.commitIndex.set(change.commitId, change.changeId);
+
+    await this.save();
+  }
+
+  /**
+   * Get every visible copy of a (possibly divergent) change id — just the
+   * one copy in the common case, or the primary plus every divergent copy
+   * added via addDivergentCopy().
+   *
+   * @param {string} changeId - Change ID
+   * @returns {Array<any>} All copies sharing this changeId, primary first
+   */
+  getDivergentSiblings(changeId) {
+    validateChangeId(changeId);
+    return this.getAll().filter((change) => change.changeId === changeId);
+  }
+
   /**
    * Get a change by ID
    *
@@ -206,6 +269,65 @@ export class ChangeGraph {
     await this.save();
   }
 
+  /**
+   * Remove one divergent copy added via addDivergentCopy() — e.g. after
+   * converge() (issue #32) resolves a divergence and only needs to drop
+   * the now-superseded copy. The *primary* copy (stored under the plain
+   * `changeId` key) is never touched by this — use deleteChange() (or
+   * updateChange() to overwrite it with a resolved result) for that.
+   *
+   * @param {string} changeId
+   * @param {string} commitId - The divergent copy's own commit id
+   * @returns {Promise<boolean>} Whether a copy was actually removed
+   */
+  async deleteDivergentCopy(changeId, commitId) {
+    validateChangeId(changeId);
+
+    const key = `${changeId}\0${commitId}`;
+    const change = this.nodes.get(key);
+    if (!change) {
+      return false;
+    }
+
+    this.nodes.delete(key);
+    if (this.commitIndex.get(commitId) === changeId) {
+      this.commitIndex.delete(commitId);
+    }
+
+    await this.save();
+    return true;
+  }
+
+  /**
+   * Remove a change from the graph outright.
+   *
+   * Used to reverse an addChange() — e.g. undoing an operation that created
+   * a change (new(), or squash()'s synthetic empty working-copy change) —
+   * where restoring a "before" snapshot doesn't apply because there was no
+   * "before": the change simply didn't exist yet. A soft-delete (setting
+   * `abandoned: true` via updateChange()) is NOT the same thing and is used
+   * separately for abandon() itself.
+   *
+   * @param {string} changeId - Change ID to remove
+   * @returns {Promise<boolean>} Whether a change was actually removed
+   */
+  async deleteChange(changeId) {
+    validateChangeId(changeId);
+
+    const change = this.nodes.get(changeId);
+    if (!change) {
+      return false;
+    }
+
+    this.nodes.delete(changeId);
+    if (this.commitIndex.get(change.commitId) === changeId) {
+      this.commitIndex.delete(change.commitId);
+    }
+
+    await this.save();
+    return true;
+  }
+
   /**
    * Get all ancestors of a change (recursive parent traversal)
    *
@@ -243,10 +365,9 @@ export class ChangeGraph {
    * @returns {Promise<Record<string, any>>} Created change object
    */
   async createChange(params = {}) {
-    const crypto = await import('crypto');
-    const changeId = params.changeId || crypto.randomBytes(16).toString('hex');
-    const commitId = params.commitId || crypto.randomBytes(20).toString('hex');
-    const tree = params.tree || crypto.randomBytes(20).toString('hex');
+    const changeId = params.changeId || randomHex(16);
+    const commitId = params.commitId || randomHex(20);
+    const tree = params.tree || randomHex(20);
     const timestamp = params.timestamp || new Date().toISOString();
 
     /** @type {Record<string, any>} */

package/src/core/conflict-model.js

@@ -10,9 +10,11 @@
  * This matches JJ's philosophy: conflicts never block you.
  */
 
-import path from 'path';
+import * as path from '../utils/posix-path.js';
 import { JJError } from '../utils/errors.js';
+import { isBytes } from '../utils/bytes.js';
 import { generateId } from '../utils/id-generation.js';
+import { mkdirp } from '../utils/mkdirp.js';
 
 /**
  * Conflict types supported by JJ
@@ -174,6 +176,15 @@ export class ConflictModel {
       const conflict = this._detectPathConflict(path, baseContent, leftContent, rightContent);
       if (conflict) {
         conflicts.push(conflict);
+      } else if (workingCopyDir) {
+        // No conflict, but "no conflict" doesn't mean "nothing to do": of
+        // _detectPathConflict's null-returning cases, every one *except*
+        // "right side changed, left didn't" already matches what's on disk,
+        // because `leftContent` **is** what's on disk (read straight from
+        // the working copy above) -- so only that one case needs a write.
+        if (baseContent === leftContent && baseContent !== rightContent) {
+          await this._applyCleanResolution(workingCopyDir, path, rightContent);
+        }
       }
     }
 
@@ -261,6 +272,30 @@ export class ConflictModel {
     return null;
   }
 
+  /**
+   * Create a content conflict with more than two disagreeing versions —
+   * every other conflict in this module has exactly two sides (`left`/
+   * `right`, or `left`/`right` on an add-add), because every OTHER caller
+   * (merge, rebase) only ever three-way-merges two changes at a time.
+   * converge() (issue #32) can face more than two divergent copies of one
+   * change in a single call, so `sides` here is `{ base, versions }`
+   * instead: `versions` is every distinct value found across all copies
+   * that differs from `base`, each paired with (one of) the commitId(s)
+   * that has it.
+   *
+   * @param {string} path
+   * @param {any} base
+   * @param {Array<{commitId: string, content: any}>} versions
+   */
+  createNWayConflict(path, base, versions) {
+    return this._createConflict({
+      type: ConflictType.CONTENT,
+      path,
+      sides: { base, versions },
+      message: `${versions.length} divergent copies disagree on this file's content`,
+    });
+  }
+
   /**
    * Create a conflict object
    *
@@ -504,6 +539,36 @@ export class ConflictModel {
     return result;
   }
 
+  /**
+   * Apply a clean (non-conflicting) three-way resolution to the working
+   * copy, for the default (no merge driver) path in detectConflicts(): the
+   * "right side wins" case, where the resolved content differs from what's
+   * currently on disk (see the call site for why this is the only clean
+   * case that needs one).
+   *
+   * @param {string} workingCopyDir - Working copy directory
+   * @param {string} filePath - File path
+   * @param {any} content - The winning (right) side's content, or
+   *   `undefined` to mean the file was deleted on that side
+   */
+  async _applyCleanResolution(workingCopyDir, filePath, content) {
+    const fullPath = path.join(workingCopyDir, filePath);
+
+    if (content === undefined) {
+      await this.fs.promises.unlink(fullPath).catch(() => {});
+      return;
+    }
+
+    const dir = path.dirname(fullPath);
+    await mkdirp(this.fs, dir);
+
+    if (isBytes(content)) {
+      await this.fs.promises.writeFile(fullPath, content);
+    } else {
+      await this.fs.promises.writeFile(fullPath, content, 'utf8');
+    }
+  }
+
   /**
    * Write merge driver result to working copy (v0.5)
    *
@@ -516,14 +581,14 @@ export class ConflictModel {
 
     // Ensure directory exists
     const dir = path.dirname(fullPath);
-    await this.fs.promises.mkdir(dir, { recursive: true });
+    await mkdirp(this.fs, dir);
 
     // Write main file
     if (result.content !== null && result.content !== undefined) {
-      if (Buffer.isBuffer(result.content)) {
+      if (isBytes(result.content)) {
         await this.fs.promises.writeFile(fullPath, result.content);
       } else {
-        await this.fs.promises.writeFile(fullPath, result.content, 'utf-8');
+        await this.fs.promises.writeFile(fullPath, result.content, 'utf8');
       }
     }
 
@@ -532,12 +597,12 @@ export class ConflictModel {
       for (const [additionalPath, additionalContent] of Object.entries(result.additionalFiles)) {
         const additionalFullPath = path.join(workingCopyDir, additionalPath);
         const additionalDir = path.dirname(additionalFullPath);
-        await this.fs.promises.mkdir(additionalDir, { recursive: true });
+        await mkdirp(this.fs, additionalDir);
 
-        if (Buffer.isBuffer(additionalContent)) {
+        if (isBytes(additionalContent)) {
           await this.fs.promises.writeFile(additionalFullPath, additionalContent);
         } else {
-          await this.fs.promises.writeFile(additionalFullPath, additionalContent, 'utf-8');
+          await this.fs.promises.writeFile(additionalFullPath, additionalContent, 'utf8');
         }
       }
     }

package/src/core/jj-checkout.js

@@ -5,18 +5,8 @@
  * This file tracks which operation the working copy is at.
  */
 
-import protobuf from 'protobufjs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-// Determine proto path based on whether we're running from dist or src
-const inDist = __dirname.includes('/dist') || __dirname.includes('\\dist');
-const protoDir = inDist
-  ? path.join(__dirname, '..', 'src', 'protos')
-  : path.join(__dirname, '..', 'protos');
+import { getLocalWorkingCopyRoot } from '../protos/schema.js';
+import { hexToBytes } from '../utils/bytes.js';
 
 export class JJCheckout {
   /**
@@ -26,7 +16,6 @@ export class JJCheckout {
   constructor(fs, dir) {
     this.fs = fs;
     this.dir = dir;
-    this.protoPath = path.join(protoDir, 'local_working_copy.proto');
   }
 
   /**
@@ -37,11 +26,11 @@ export class JJCheckout {
    */
   async writeCheckout(operationId, workspaceName = 'default') {
     // Load protobuf schema
-    const root = await protobuf.load(this.protoPath);
+    const root = getLocalWorkingCopyRoot();
     const Checkout = root.lookupType('local_working_copy.Checkout');
 
     // Convert hex operation ID to bytes
-    const opIdBuffer = Buffer.from(operationId, 'hex');
+    const opIdBuffer = hexToBytes(operationId);
 
     // Create message (use camelCase for protobufjs)
     const message = Checkout.create({
@@ -73,7 +62,7 @@ export class JJCheckout {
     const buffer = await this.fs.promises.readFile(checkoutPath);
 
     // Load protobuf schema
-    const root = await protobuf.load(this.protoPath);
+    const root = getLocalWorkingCopyRoot();
     const Checkout = root.lookupType('local_working_copy.Checkout');
 
     // Decode

package/src/core/jj-operation-store.js

@@ -5,18 +5,9 @@
  * Operations track the history of changes to the repository.
  */
 
-import protobuf from 'protobufjs';
-import path from 'path';
-import { fileURLToPath } from 'url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-
-// Determine proto path based on whether we're running from dist or src
-const inDist = __dirname.includes('/dist') || __dirname.includes('\\dist');
-const protoDir = inDist
-  ? path.join(__dirname, '..', 'src', 'protos')
-  : path.join(__dirname, '..', 'protos');
+import { atomicWriteFile } from '../utils/atomic-write.js';
+import { getSimpleOpStoreRoot } from '../protos/schema.js';
+import { hexToBytes } from '../utils/bytes.js';
 
 export class JJOperationStore {
   /**
@@ -26,7 +17,6 @@ export class JJOperationStore {
   constructor(fs, dir) {
     this.fs = fs;
     this.dir = dir;
-    this.protoPath = path.join(protoDir, 'simple_op_store.proto');
   }
 
   /**
@@ -39,12 +29,12 @@ export class JJOperationStore {
    */
   async writeOperation(operationId, viewId, parentIds, metadata) {
     // Load protobuf schema
-    const root = await protobuf.load(this.protoPath);
+    const root = getSimpleOpStoreRoot();
     const Operation = root.lookupType('simple_op_store.Operation');
 
     // Convert hex IDs to bytes
-    const viewIdBuffer = Buffer.from(viewId, 'hex');
-    const parentBuffers = parentIds.map((id) => Buffer.from(id, 'hex'));
+    const viewIdBuffer = hexToBytes(viewId);
+    const parentBuffers = parentIds.map((id) => hexToBytes(id));
 
     // Create metadata message (use camelCase for protobufjs)
     const metadataMsg = {
@@ -81,9 +71,11 @@ export class JJOperationStore {
     // Encode to binary
     const buffer = Operation.encode(message).finish();
 
-    // Write to .jj/repo/op_store/operations/OPERATIONID
+    // Write to .jj/repo/op_store/operations/OPERATIONID (atomically — a
+    // crash mid-write must never leave a truncated/undecodable file, see
+    // issue #16).
     const opPath = `${this.dir}/.jj/repo/op_store/operations/${operationId}`;
-    await this.fs.promises.writeFile(opPath, buffer);
+    await atomicWriteFile(this.fs, opPath, buffer);
   }
 
   /**
@@ -98,7 +90,7 @@ export class JJOperationStore {
     const buffer = await this.fs.promises.readFile(opPath);
 
     // Load protobuf schema
-    const root = await protobuf.load(this.protoPath);
+    const root = getSimpleOpStoreRoot();
     const Operation = root.lookupType('simple_op_store.Operation');
 
     // Decode