mixdog 1.3.0 → 1.3.2

package/src/runtime/shared/worktrees/registry.mjs

@@ -6,12 +6,15 @@
  * transaction ledger that makes creation rollback and deletion resumable:
  * which resources this transaction created ('pending' is written before a
  * resource is made, 'created' after), the deletion decision and any recovery
- * diagnostics. Writes are atomic (temp file + rename) under a file lock; an
- * unreadable registry is an error, never silently replaced.
+ * diagnostics. Writes are atomic (temp file + rename) under a file lock and keep
+ * the replaced version as registry.json.bak. A damaged registry (NUL, truncated,
+ * malformed) never blocks worktree operations: its bytes are kept aside as
+ * registry.json.corrupt-<ts>, the last good copy is restored when there is one,
+ * and otherwise the registry starts empty (worktree folders on disk are never
+ * touched by that).
  */
-import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { parseJsonText, withFileLock, writeJsonAtomicAsync } from '../atomic-file.mjs';
+import { readJsonState, readJsonStateSync, updateJsonAtomic } from '../atomic-file.mjs';
 import { isPlainObject } from '../object.mjs';
 import { resolvePluginData } from '../plugin-paths.mjs';
 import { normalizeWorktreeEntry, WORKTREE_STORE_DIR } from './contract.mjs';
@@ -30,24 +33,21 @@ function emptyDoc() {
   return { version: REGISTRY_VERSION, entries: {} };
 }
 
-async function readDoc(path) {
-  let text;
-  try {
-    text = await readFile(path, 'utf8');
-  } catch (error) {
-    if (error?.code === 'ENOENT') return emptyDoc();
-    throw error;
-  }
-  const value = parseJsonText(text);
-  if (!isPlainObject(value) || !isPlainObject(value.entries)) {
-    throw new Error(`Worktree registry ${path} is malformed.`);
-  }
+const isRegistryDoc = (value) => isPlainObject(value) && isPlainObject(value.entries);
+
+function validateDoc(value) {
+  if (!isRegistryDoc(value)) throw new Error('Worktree registry is malformed.');
   return value;
 }
 
 /** Snapshot of every record (plain clones). */
 export async function readRegistry() {
-  return readDoc(registryPath());
+  return (await readJsonState(registryPath(), { validate: validateDoc })) ?? emptyDoc();
+}
+
+/** readRegistry for synchronous callers (the workspace admission gate). */
+export function readRegistrySync() {
+  return readJsonStateSync(registryPath(), { validate: validateDoc }) ?? emptyDoc();
 }
 
 /**
@@ -58,17 +58,17 @@ export async function readRegistry() {
  * @returns {Promise<T>}
  */
 export async function mutateRegistry(mutate) {
-  const path = registryPath();
-  return withFileLock(
-    `${path}.lock`,
-    async () => {
-      const doc = await readDoc(path);
-      const result = mutate(doc);
-      await writeJsonAtomicAsync(path, doc, { lock: false });
-      return result;
+  let result;
+  await updateJsonAtomic(
+    registryPath(),
+    (current) => {
+      const doc = isRegistryDoc(current) ? current : emptyDoc();
+      result = mutate(doc);
+      return doc;
     },
-    { timeoutMs: 15_000 }
+    { timeoutMs: 15_000, backup: true }
   );
+  return result;
 }
 
 export async function getRecord(id) {

package/src/runtime/tidy/core-install.mjs

@@ -76,6 +76,11 @@ function powerShellHost(env) {
   return false;
 }
 
+function coreInstallable(id, manifest, env) {
+  if (!TIDY_CORE_ENGINE_IDS.includes(id) || !manifestAsset(manifest, id)) return false;
+  return id !== 'psscriptanalyzer' || powerShellHost(env);
+}
+
 let installJob = null;
 let installInFlight = null;
 // Bumped on every job mutation and every refreshed host-module probe, so the
@@ -118,6 +123,14 @@ async function cachedHostModuleProbe(engine) {
   return entry?.version || '';
 }
 
+/** A host-module engine (PSScriptAnalyzer) whose host exists but whose first
+ *  probe has not answered yet. Until then "module missing" only means "not
+ *  looked at yet", so the status reports it as pending instead. */
+function hostModuleProbing(catalog, engine) {
+  if (!catalog.managedModule || engine.source !== 'missing' || !engine.command) return false;
+  return (hostModuleCache.get(String(engine.command))?.at || 0) === 0;
+}
+
 function clampPercent(value) {
   return Math.max(0, Math.min(100, Math.round(value)));
 }
@@ -222,14 +235,17 @@ async function runCoreInstall({
   signal = null,
   installEngines = installEnginesImpl,
   resolveEngines = resolveEnginesImpl,
+  engines: only = null,
 } = {}) {
   const loaded = manifest || readEnginesManifest();
   const toolsDir = pluginData ? managedToolsDir(pluginData) : '';
-  const job = startJob(TIDY_CORE_ENGINE_IDS);
+  // A retry for named engines installs just those; the default is the set.
+  const wanted = Array.isArray(only) ? TIDY_CORE_ENGINE_IDS.filter((id) => only.includes(id)) : TIDY_CORE_ENGINE_IDS;
+  const job = startJob(wanted);
   try {
     const resolution = await resolveEngines({
       cwd: resolutionScope(toolsDir),
-      engineIds: [...TIDY_CORE_ENGINE_IDS],
+      engineIds: [...wanted],
       pluginData,
       manifest: loaded,
       env,
@@ -238,7 +254,7 @@ async function runCoreInstall({
     });
     const resolved = new Map((resolution.engines || []).map((engine) => [engine.id, engine]));
     const pending = [];
-    for (const id of TIDY_CORE_ENGINE_IDS) {
+    for (const id of wanted) {
       const catalog = ENGINE_CATALOG[id];
       const engine = resolved.get(id);
       if (id === 'psscriptanalyzer' && !powerShellHost(env)) {
@@ -400,6 +416,7 @@ function withInstallStatus(inventory) {
     toolsDir: inventory.toolsDir,
     core: [...inventory.core],
     engines: inventory.engines.map((engine) => ({ ...engine })),
+    probing: inventory.probing,
     installing: tidyInstallStatus(),
   };
 }
@@ -424,6 +441,7 @@ async function buildEngineInventory({ pluginData, manifest, env, probeVersions,
     const source = statusSource(engine.source);
     const version = engine.version || '';
     const installHint = engine.installHint || catalog.installHint || '';
+    const probing = hostModuleProbing(catalog, engine);
     return {
       id,
       title: catalog.title || id,
@@ -437,7 +455,11 @@ async function buildEngineInventory({ pluginData, manifest, env, probeVersions,
       // Managed engines carry their on-disk cost; a host binary is the user's.
       ...(source === 'managed' ? { bytes: managedEngineBytes(pluginData, id, version) } : {}),
       ...(source === 'missing' && installHint ? { installHint } : {}),
+      // The host probe has not answered: pending, neither installed nor missing.
+      ...(probing ? { probing: true } : {}),
+      // A missing core engine the Install/Retry control can fetch right now.
+      ...(source === 'missing' && !probing && coreInstallable(id, loaded, env) ? { installable: true } : {}),
     };
   });
-  return { toolsDir, core: [...TIDY_CORE_ENGINE_IDS], engines };
+  return { toolsDir, core: [...TIDY_CORE_ENGINE_IDS], engines, probing: engines.some((engine) => engine.probing) };
 }

package/src/runtime/tidy/install.mjs

@@ -4,11 +4,12 @@
 // Policy gating happens BEFORE any network call: 'never' refuses, 'ask' returns
 // needsApproval unless the call carried approveDownloads:true, 'auto' proceeds.
 // Toolchain engines (rustfmt, gofmt, zig fmt, ...) are never downloadable.
-import { chmodSync, existsSync, mkdirSync, renameSync, rmSync, statSync } from 'node:fs';
+import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { join } from 'node:path';
 import { MAX_NATIVE_BINARY_DOWNLOAD_BYTES, streamResponseToFile } from '../shared/bounded-download.mjs';
 import { platformEntryKey, platformKey, sha256File } from '../shared/native-asset.mjs';
+import { fileHasData } from '../shared/file-has-data.mjs';
 import { readJsonSafe } from '../shared/json-file.mjs';
 import { ENGINE_CATALOG } from './engines.mjs';
 import { extractArchive } from './extract.mjs';
@@ -51,7 +52,7 @@ export function managedEngineBinary({ id, manifest, pluginData }) {
   const binPath = String(found.asset.binPath || '');
   if (!binPath) return null;
   const full = join(managedEngineDir(pluginData, id, found.version), binPath);
-  return existsSync(full) ? { path: full, version: found.version } : null;
+  return fileHasData(full) ? { path: full, version: found.version } : null;
 }
 
 /** Throws unless `filePath` hashes to `expected`. */
@@ -148,44 +149,109 @@ export function planInstall({ ids = [], manifest, pluginData = '', policy = 'aut
   return { targets, present, errors, needsApproval: null };
 }
 
-async function downloadAsset(target, tmpDir, fetchFn, signal, onProgress) {
-  const archiveFile = join(tmpDir, `asset-${target.id}`);
-  const response = await fetchFn(target.url, { signal, redirect: 'follow' });
-  if (!response?.ok) {
-    throw new Error(`${LABEL} ${target.id}: HTTP ${response?.status || 0} for ${target.url}`);
+// A network switch can leave a socket open that never delivers another byte;
+// without a deadline the install (and the single in-flight job behind it)
+// would wait forever.
+const DEFAULT_STALL_TIMEOUT_MS = 60_000;
+// A `.tmp-<pid>-<ms>-…` staging dir whose owner crashed is never cleaned by
+// that owner; an hour is far beyond any live download.
+const STALE_TMP_AGE_MS = 60 * 60 * 1000;
+
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+/** Remove staging dirs a killed install left behind (dead owner, or ancient). */
+function reclaimStaleStaging(engineRoot) {
+  let names;
+  try {
+    names = readdirSync(engineRoot);
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    const match = /^\.tmp-(\d+)-(\d+)-/.exec(name);
+    if (!match) continue;
+    const pid = Number(match[1]);
+    const ownerGone = pid !== process.pid && !pidAlive(pid);
+    if (!ownerGone && Date.now() - Number(match[2]) < STALE_TMP_AGE_MS) continue;
+    try {
+      rmSync(join(engineRoot, name), { recursive: true, force: true });
+    } catch {
+      /* best-effort */
+    }
   }
-  await streamResponseToFile(response, archiveFile, {
-    maxBytes: MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
-    label: `${LABEL} ${target.id}`,
-    // Byte progress per engine: the desktop card renders it live, so the
-    // callback carries the engine id the bytes belong to.
-    ...(typeof onProgress === 'function'
-      ? {
-          onProgress: ({ downloaded, total }) => {
-            onProgress({ id: target.id, receivedBytes: downloaded, totalBytes: total });
-          },
+}
+
+async function downloadAsset(target, tmpDir, fetchFn, signal, onProgress, stallTimeoutMs) {
+  const archiveFile = join(tmpDir, `asset-${target.id}`);
+  const stalled = new AbortController();
+  const merged = signal ? AbortSignal.any([signal, stalled.signal]) : stalled.signal;
+  let timer;
+  const arm = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => stalled.abort(), stallTimeoutMs);
+  };
+  arm();
+  try {
+    const response = await fetchFn(target.url, { signal: merged, redirect: 'follow' });
+    if (!response?.ok) {
+      throw new Error(`${LABEL} ${target.id}: HTTP ${response?.status || 0} for ${target.url}`);
+    }
+    await streamResponseToFile(response, archiveFile, {
+      maxBytes: MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
+      label: `${LABEL} ${target.id}`,
+      signal: merged,
+      // Byte progress per engine: the desktop card renders it live, so the
+      // callback carries the engine id the bytes belong to. Any bytes also
+      // prove the connection is alive.
+      onProgress: ({ downloaded, total }) => {
+        arm();
+        if (typeof onProgress === 'function') {
+          onProgress({ id: target.id, receivedBytes: downloaded, totalBytes: total });
         }
-      : {}),
-  });
+      },
+    });
+  } catch (error) {
+    if (stalled.signal.aborted && !signal?.aborted) {
+      throw new Error(`${LABEL} ${target.id}: download stalled (no data for ${stallTimeoutMs / 1000}s)`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
   return archiveFile;
 }
 
 /** Download + verify + extract one engine into its versioned managed dir. */
 export async function installEngine(
   target,
-  { pluginData, fetchFn = globalThis.fetch, signal = null, onProgress = null } = {}
+  {
+    pluginData,
+    fetchFn = globalThis.fetch,
+    signal = null,
+    onProgress = null,
+    stallTimeoutMs = DEFAULT_STALL_TIMEOUT_MS,
+  } = {}
 ) {
   const engineRoot = join(managedToolsDir(pluginData), target.id);
   const finalDir = managedEngineDir(pluginData, target.id, target.version);
   const binFull = join(finalDir, target.binPath);
-  if (existsSync(binFull)) {
+  // An engine binary a crash left NUL-filled is not present: it is installed again.
+  if (fileHasData(binFull)) {
     return { id: target.id, version: target.version, path: binFull, bytes: 0, status: 'present' };
   }
   mkdirSync(engineRoot, { recursive: true });
+  reclaimStaleStaging(engineRoot);
   const tmpDir = join(engineRoot, `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
   mkdirSync(tmpDir, { recursive: true });
   try {
-    const archiveFile = await downloadAsset(target, tmpDir, fetchFn, signal, onProgress);
+    const archiveFile = await downloadAsset(target, tmpDir, fetchFn, signal, onProgress, stallTimeoutMs);
     await verifyDownloadDigest(archiveFile, target.sha256);
     const bytes = statSync(archiveFile).size;
     const stageDir = join(tmpDir, 'stage');
@@ -207,6 +273,7 @@ export async function installEngine(
       }
     }
     try {
+      if (existsSync(finalDir) && !fileHasData(binFull)) rmSync(finalDir, { recursive: true, force: true });
       renameSync(stageDir, finalDir);
     } catch (error) {
       // A concurrent install won the race; its verified copy is equivalent.
@@ -235,6 +302,7 @@ export async function installEngines({
   fetchFn = globalThis.fetch,
   signal = null,
   onProgress = null,
+  stallTimeoutMs = undefined,
 } = {}) {
   const loaded = manifest || readEnginesManifest();
   const plan = planInstall({ ids, manifest: loaded, pluginData, policy, approveDownloads });
@@ -249,7 +317,7 @@ export async function installEngines({
   }
   for (const target of plan.targets) {
     try {
-      installed.push(await installEngine(target, { pluginData, fetchFn, signal, onProgress }));
+      installed.push(await installEngine(target, { pluginData, fetchFn, signal, onProgress, stallTimeoutMs }));
     } catch (error) {
       errors.push({ id: target.id, error: error?.message || String(error) });
     }

package/src/runtime/web-search/lib/config.mjs

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolvePluginData } from '../../shared/plugin-paths.mjs';
-import { renameWithRetrySync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
+import { readJsonStateSync, writeJsonAtomicSync } from '../../shared/atomic-file.mjs';
 
 // Unified mode: web search shares the plugin data dir with the rest of mixdog.
 const SHARED_DATA_DIR = resolvePluginData();
@@ -19,22 +19,10 @@ export function ensureDataDir() {
   fs.mkdirSync(DATA_DIR, { recursive: true });
 }
 
+// usage/cache state: a damaged file (empty, NUL-filled, truncated) is kept as
+// <file>.corrupt-<ts> and reads as `fallback`, so search/fetch keep working.
 export function readJson(filePath, fallback) {
-  try {
-    const raw = fs.readFileSync(filePath, 'utf8');
-    try {
-      return JSON.parse(raw);
-    } catch (parseErr) {
-      try {
-        renameWithRetrySync(filePath, `${filePath}.corrupt.${Date.now()}`);
-      } catch {}
-      process.stderr.write(`[web-search-config] corrupt JSON backed up: ${filePath}\n`);
-      throw parseErr;
-    }
-  } catch (err) {
-    if (err.code === 'ENOENT') return fallback;
-    throw err;
-  }
+  return readJsonStateSync(filePath, { fallback });
 }
 
 export function writeJson(filePath, value) {