javi-forge 1.39.4 → 1.39.5

package/dist/lib/__fixtures__/fake-secure-fs.d.ts

@@ -13,6 +13,8 @@ interface FakeFile {
 }
 /** Per-call fault predicates; every one defaults to "no fault". */
 export interface FakeFaults {
+    closeRefuse?: (dirPath: string) => boolean;
+    reuseFirstHandle?: (dirPath: string) => boolean;
     /** Refuse revalidateIdentity for a path on its Nth (1-based) call. */
     revalidateRefuse?: (target: string, callIndex: number) => boolean;
     /** Refuse proveOwnershipAndMode for a path on its Nth call. */
@@ -57,8 +59,11 @@ export interface FakeSecureFs extends PlatformSecureFs {
     readonly dirs: Set<string>;
     readonly files: Map<string, FakeFile>;
     readonly dirModes: Map<string, number>;
+    readonly events: string[];
+    readonly closeAttempts: string[];
     faults: FakeFaults;
     seedDir(dirPath: string): void;
+    shareDirIdentity(target: string, source: string): void;
     seedFile(filePath: string, bytes: Buffer, mode?: number): void;
     fileText(filePath: string): string | undefined;
     hasBackup(dirPath: string): boolean;

package/dist/lib/__fixtures__/fake-secure-fs.js

@@ -34,6 +34,9 @@ export function makeFakeSecureFs() {
     const endangeringCounts = new Map();
     const writeCounts = new Map();
     const managedCounts = new Map();
+    const events = [];
+    const closeAttempts = [];
+    let handleSeq = 0, firstHandle;
     const inoFor = (p) => {
         let ino = inos.get(p);
         if (ino === undefined) {
@@ -47,11 +50,23 @@ export function makeFakeSecureFs() {
         m.set(key, next);
         return next;
     };
-    const handleFor = (p) => ({
-        path: p,
-        identity: { dev: 1, ino: inoFor(p) },
-        close: async () => { },
-    });
+    const handleFor = (p) => {
+        if (firstHandle && fake.faults.reuseFirstHandle?.(p))
+            return firstHandle;
+        const token = `${p}#${++handleSeq}`;
+        const handle = {
+            path: p,
+            identity: { dev: 1, ino: inoFor(p) },
+            close: async () => {
+                events.push(`close ${token}`);
+                closeAttempts.push(token);
+                if (fake.faults.closeRefuse?.(p))
+                    throw new Error(`close failed ${p}`);
+            },
+        };
+        firstHandle ??= handle;
+        return handle;
+    };
     const isEmptyDir = (p) => {
         const prefix = `${p}/`;
         for (const f of files.keys())
@@ -66,10 +81,15 @@ export function makeFakeSecureFs() {
         dirs,
         files,
         dirModes,
+        events,
+        closeAttempts,
         faults: {},
         seedDir(dirPath) {
             dirs.add(dirPath);
         },
+        shareDirIdentity(target, source) {
+            inos.set(target, inoFor(source));
+        },
         seedFile(filePath, bytes, mode = 0o644) {
             files.set(filePath, { bytes, mode });
         },
@@ -94,6 +114,7 @@ export function makeFakeSecureFs() {
             return okValue(handleFor(dirPath));
         },
         async revalidateIdentity(target, held) {
+            events.push(`revalidate ${target}`);
             const idx = bump(revalidateCounts, target);
             if (fake.faults.revalidateRefuse?.(target, idx)) {
                 return unsafe(`identity drift ${target}`);
@@ -135,6 +156,7 @@ export function makeFakeSecureFs() {
         },
         async createDirExclusive(parent, name, mode) {
             const full = path.join(parent.path, name);
+            events.push(`create ${full}`);
             if (dirs.has(full) || files.has(full))
                 return unsafe(`EEXIST ${full}`);
             dirs.add(full);
@@ -199,6 +221,7 @@ export function makeFakeSecureFs() {
             return ok();
         },
         async rmdirIfIdentityEmpty(handle) {
+            events.push(`rmdir ${handle.path}`);
             if (!dirs.has(handle.path))
                 return unsafe(`rmdir enoent ${handle.path}`);
             if (inoFor(handle.path) !== handle.identity.ino) {

package/dist/lib/secure-fs-transaction.js

@@ -120,11 +120,15 @@ export async function runTransaction(input) {
     // refuse ANY extended entry (lenient-gated THEN strict-managed); only ancestor-
     // only segments loosen. No `process.platform` here — role is expressed by which
     // dirs get proveManagedContainer'd (the managedContainers set).
+    function hold(dirPath, handle) {
+        heldByPath.set(dirPath, handle);
+        if (!heldOrder.includes(handle))
+            heldOrder.push(handle);
+    }
     async function gate(dirPath, handle) {
         // Transfer ownership before refusal-capable proofs so `finally` closes a
         // successfully opened handle even when either proof fails.
-        heldByPath.set(dirPath, handle);
-        heldOrder.push(handle);
+        hold(dirPath, handle);
         must(`ownership ${dirPath}`, await secureFs.proveOwnershipAndMode(dirPath));
         must(`acl ${dirPath}`, await secureFs.proveNoEndangeringAcl(dirPath));
     }
@@ -164,6 +168,7 @@ export async function runTransaction(input) {
         // Own the created segment before post-create validation so any refusal rolls
         // it back and closes its handle.
         createdDirs.push(created);
+        hold(fullPath, created);
         // Post-create identity revalidation + full gate on the new segment.
         must(`revalidate-created ${fullPath}`, await secureFs.revalidateIdentity(fullPath, created.identity));
         await gate(fullPath, created);
@@ -191,6 +196,8 @@ export async function runTransaction(input) {
         }
         return true;
     }
+    let workSucceeded = false;
+    const errors = [];
     try {
         // --- PREFLIGHT: gate the existing chain root..projectDir ---
         for (const dirPath of ancestorChain(projectDir)) {
@@ -240,7 +247,14 @@ export async function runTransaction(input) {
             must(`stage-mode ${tName}`, await secureFs.applyExactMode(path.join(dir.path, tName), prior ? prior.mode : 0o600));
             // Identity revalidation after each writeExclusive (JD-B-005).
             must(`revalidate-staged ${parentPath}`, await secureFs.revalidateIdentity(dir.path, dir.identity));
-            staged.push({ dir, tempName: tName, target: component, prior });
+            const stagedEntry = {
+                dir,
+                tempName: tName,
+                target: component,
+                prior,
+            };
+            staged.push(stagedEntry);
+            stagedEntry.identity = must(`capture-staged ${tName}`, await secureFs.captureFile(path.join(dir.path, tName))).identity;
         }
         // --- PRE-FIRST-RENAME FULL-GATE RE-PROVE (JD-007) ---
         for (const handle of heldOrder) {
@@ -259,7 +273,8 @@ export async function runTransaction(input) {
             }
         }
         // --- COMMIT: asset first, settings second ---
-        for (const entry of staged) {
+        while (staged.length > 0) {
+            const entry = staged[0];
             const base = path.basename(entry.target.path);
             must(`pre-rename ${entry.dir.path}`, await secureFs.revalidateIdentity(entry.dir.path, entry.dir.identity));
             const wroteHash = sha256(entry.target.desired);
@@ -273,6 +288,7 @@ export async function runTransaction(input) {
                     wasAbsent: entry.target.wasAbsent,
                     prior: entry.prior,
                 });
+                staged.shift();
             }
             else if (renamed.mutation === "unknown") {
                 unknownRenameTarget = entry.target.path;
@@ -280,35 +296,38 @@ export async function runTransaction(input) {
             must(`rename ${base}`, renamed);
             must(`post-rename ${entry.dir.path}`, await secureFs.revalidateIdentity(entry.dir.path, entry.dir.identity));
         }
-        return {
-            ok: true,
-            committed: committed.map((c) => c.path),
-            backups,
-            errors: [],
-        };
+        workSucceeded = true;
     }
     catch (error) {
-        const errors = [
-            error instanceof TxAbort ? error.message : String(error),
-        ];
+        errors.push(error instanceof TxAbort ? error.message : String(error));
         if (unknownRenameTarget) {
             errors.push(`STOP: unknown rename outcome at ${unknownRenameTarget}; manual recovery; no rollback or directory cleanup`);
         }
         else {
-            await rollback(committed, createdDirs, errors);
+            try {
+                await rollback(committed, staged, createdDirs, errors);
+            }
+            catch (rollbackError) {
+                errors.push(`rollback: ${String(rollbackError)}`);
+            }
         }
-        return {
-            ok: false,
-            committed: committed.map((c) => c.path),
-            backups,
-            errors,
-        };
     }
     finally {
-        for (const handle of new Set([...createdDirs, ...heldOrder])) {
-            await handle.close().catch(() => { });
+        for (const handle of heldOrder) {
+            try {
+                await handle.close();
+            }
+            catch (error) {
+                errors.push(`close ${handle.path}: ${String(error)}`);
+            }
         }
     }
+    return {
+        ok: workSucceeded && errors.length === 0,
+        committed: committed.map((c) => c.path),
+        backups,
+        errors,
+    };
     /** A rejected or malformed rename reply never proves absence of mutation. */
     async function observeRename(dir, from, to) {
         try {
@@ -340,7 +359,7 @@ export async function runTransaction(input) {
         }
         throw new TxAbort("backup", `no exclusive backup name after ${BACKUP_NONCE_CANDIDATES}`);
     }
-    async function rollback(done, created, errors) {
+    async function rollback(done, pending, created, errors) {
         for (const entry of [...done].reverse()) {
             if (!(await gateStillValid())) {
                 errors.push(`STOP: lost parent-chain proof; manual recovery at ${entry.path}`);
@@ -393,6 +412,14 @@ export async function runTransaction(input) {
                 }
             }
         }
+        for (const entry of pending) {
+            const identity = entry.identity ??
+                must(`recapture-staged ${entry.tempName}`, await secureFs.captureFile(path.join(entry.dir.path, entry.tempName))).identity;
+            const removed = await secureFs.unlinkIfIdentity(entry.dir, entry.tempName, identity);
+            const detail = removed.detail ?? removed.refusal;
+            if (!removed.ok)
+                errors.push(`cleanup ${entry.tempName}: ${detail}`);
+        }
         // Remove only tx-created, identity-matched, still-empty segments, child-first.
         for (const handle of [...created].reverse()) {
             await secureFs.rmdirIfIdentityEmpty(handle);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.39.4",
+	"version": "1.39.5",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {