superpowers-manager 0.7.0 → 0.7.1

package/dist/harnesses/opencode/discovery.js

@@ -1,4 +1,5 @@
 import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
 import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 import { tmpdir, userInfo } from "node:os";
@@ -12,9 +13,7 @@ import { canonicalizeProspectivePath, classifyPathNoFollow, isContained, isErrno
 import { runValidator } from "../../validator.js";
 import { withWorkspace } from "../../workspace.js";
 import { parseOpenCodeConfig, readOpenCodeConfig, } from "./config.js";
-// Account inspection pays a full-copy cost so it never opens the native DB or
-// its WAL with SQLite. Keep DB+WAL to one finite 16 MiB capture, without retry.
-const MAX_ACCOUNT_FILE_BYTES = 16 * 1024 * 1024;
+const MAX_AUTH_FILE_BYTES = 16 * 1024 * 1024;
 const ACCOUNT_QUERY_POLICY = {
     timeoutMs: 2_000,
     graceMs: 200,
@@ -339,7 +338,7 @@ async function captureFile(path) {
     try {
         handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
         const stat = await handle.stat();
-        if (!stat.isFile() || stat.size > MAX_ACCOUNT_FILE_BYTES)
+        if (!stat.isFile() || stat.size > MAX_AUTH_FILE_BYTES)
             throw new Error("unsupported account database file");
         const bytes = Buffer.allocUnsafe(stat.size);
         let offset = 0;
@@ -360,13 +359,59 @@ async function captureFile(path) {
         await handle?.close().catch(() => { });
     }
 }
-function sameCapture(left, right) {
+async function hashFile(path, copyTo) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (cause) {
+        if (isErrno(cause, "ENOENT"))
+            return null;
+        throw cause;
+    }
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile())
+            throw new Error("unsupported account database file");
+        const hash = createHash("sha256");
+        const out = copyTo === undefined
+            ? undefined
+            : await open(copyTo, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+        try {
+            for await (const chunk of handle.createReadStream({
+                autoClose: false,
+                start: 0,
+            })) {
+                hash.update(chunk);
+                for (let offset = 0; out !== undefined && offset < chunk.length;) {
+                    const { bytesWritten } = await out.write(chunk, offset);
+                    if (bytesWritten === 0)
+                        throw new Error("account copy stalled");
+                    offset += bytesWritten;
+                }
+            }
+        }
+        finally {
+            await out?.close();
+        }
+        return {
+            hash: hash.digest("hex"),
+            dev: stat.dev,
+            ino: stat.ino,
+            mode: stat.mode,
+        };
+    }
+    finally {
+        await handle.close().catch(() => { });
+    }
+}
+function sameFile(left, right) {
     return left === null || right === null
         ? left === right
         : left.dev === right.dev &&
             left.ino === right.ino &&
             left.mode === right.mode &&
-            left.bytes.equals(right.bytes);
+            left.hash === right.hash;
 }
 function accountDatabasePath(env, dataRoot) {
     const configured = env.OPENCODE_DB;
@@ -381,46 +426,31 @@ async function inspectAccount(state, dataRoot) {
     if (database === null)
         return;
     const wal = `${database}-wal`;
-    let initialDb;
-    let initialWal;
     try {
-        [initialDb, initialWal] = await Promise.all([
-            captureFile(database),
-            captureFile(wal),
-        ]);
-        if (initialDb === null) {
-            if (initialWal !== null)
+        if ((await classifyPathNoFollow(database)) === "missing") {
+            if ((await classifyPathNoFollow(wal)) !== "missing")
                 throw new Error("orphan account WAL");
             return;
         }
-        if (initialDb.bytes.length + (initialWal?.bytes.length ?? 0) >
-            MAX_ACCOUNT_FILE_BYTES)
-            throw new Error("account database capture limit");
+        // Account inspection pays a streamed full-copy cost so it never opens the
+        // native DB or its WAL with SQLite: a live read-only open rewrites -shm and
+        // creates -wal/-shm when absent. ponytail: copy time and temp space scale
+        // with DB size; query live only if that cost is measured to matter and
+        // -shm writes can be avoided.
         const result = await withWorkspace(tmpdir(), "spw-opencode-account-", async (workspace) => {
             const copy = join(workspace, "opencode.db");
-            await (await open(copy, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600)).close();
-            const dbOut = await open(copy, constants.O_WRONLY);
-            try {
-                await dbOut.writeFile(initialDb.bytes);
-            }
-            finally {
-                await dbOut.close();
-            }
-            if (initialWal !== null) {
-                const walOut = await open(`${copy}-wal`, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
-                try {
-                    await walOut.writeFile(initialWal.bytes);
-                }
-                finally {
-                    await walOut.close();
-                }
-            }
+            const [initialDb, initialWal] = await Promise.all([
+                hashFile(database, copy),
+                hashFile(wal, `${copy}-wal`),
+            ]);
+            if (initialDb === null)
+                throw new Error("account database moved");
             const beforeQuery = await Promise.all([
-                captureFile(database),
-                captureFile(wal),
+                hashFile(database),
+                hashFile(wal),
             ]);
-            if (!sameCapture(initialDb, beforeQuery[0]) ||
-                !sameCapture(initialWal, beforeQuery[1]))
+            if (!sameFile(initialDb, beforeQuery[0]) ||
+                !sameFile(initialWal, beforeQuery[1]))
                 throw new Error("account database moved");
             const run = await runValidator([
                 process.execPath,
@@ -436,15 +466,15 @@ async function inspectAccount(state, dataRoot) {
                 run.stderr.text !== "" ||
                 (run.stdout.text !== "active" && run.stdout.text !== "absent"))
                 throw new Error("account database query failed");
+            const afterQuery = await Promise.all([
+                hashFile(database),
+                hashFile(wal),
+            ]);
+            if (!sameFile(initialDb, afterQuery[0]) ||
+                !sameFile(initialWal, afterQuery[1]))
+                throw new Error("account database moved");
             return run.stdout.text;
         });
-        const afterQuery = await Promise.all([
-            captureFile(database),
-            captureFile(wal),
-        ]);
-        if (!sameCapture(initialDb, afterQuery[0]) ||
-            !sameCapture(initialWal, afterQuery[1]))
-            throw new Error("account database moved");
         if (result === "active")
             addBlocked(state, "OpenCode active account remote configuration");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superpowers-manager",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Install obra/superpowers directly from upstream for Codex, Pi, and OpenCode. Stay on a known-good release or commit, try a branch, and upgrade when you choose.",
   "keywords": [
     "superpowers",