devlaunch 0.0.19__tar.gz → 0.0.20__tar.gz

{devlaunch-0.0.19 → devlaunch-0.0.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlaunch
-Version: 0.0.19
+Version: 0.0.20
 Summary: DevLaunch - A streamlined CLI for devpod workspaces
 Project-URL: Source, https://github.com/blooop/devlaunch
 Project-URL: Home, https://github.com/blooop/devlaunch

{devlaunch-0.0.19 → devlaunch-0.0.20}/devlaunch/dl.py

@@ -1659,7 +1659,12 @@ def _get_clone_manager() -> WorkspaceCloneManager:
     if "clone_manager" not in _cache:
         manager = WorkspaceCloneManager()
         try:
-            migrate_cache(manager.storage, pathlib.Path(manager.config.repos_dir))
+            # Under the metadata lock so two dl processes cannot migrate at
+            # once: the renames are not idempotent mid-flight, and exclusive()
+            # reloads first so the version check sees the other side's result.
+            # migrate_cache calls save() directly, never a locked mutator.
+            with manager.storage.exclusive():
+                migrate_cache(manager.storage, pathlib.Path(manager.config.repos_dir))
         except OSError as e:
             # A failed migration must not take the command with it. The renames
             # that did happen are still resumable: the version header is only

devlaunch-0.0.20/devlaunch/worktree/locks.py

@@ -0,0 +1,55 @@
+"""Inter-process locks for the shared cache.
+
+Several dl processes can run at once — two agents launched on their own
+branches, a completion refresh in the background — and they share one bare-clone
+cache and one metadata.json. These locks are what keeps simultaneous runs from
+racing each other over that state: without them, two first launches of a repo
+both ran ``git clone --bare`` into the same path (and the loser's cleanup
+deleted the winner's half-written clone), and metadata writers rewrote the file
+from stale in-memory copies, dropping each other's records.
+
+``flock`` rather than a pid file: the kernel releases it when the process dies,
+however it dies, so a crashed dl never leaves the cache wedged.
+
+Two deliberate limits, both load-bearing:
+
+- **Not reentrant.** Acquiring a path twice in one process deadlocks (the second
+  open file description blocks on the first). Call sites are structured so no
+  lock is ever taken while the same lock is held — see the acquisition comments
+  at each site.
+- **The lock file is never deleted.** Unlinking an flock'd file is the classic
+  self-defeating move: a process that opened the old inode still "holds" a lock
+  nobody else can see, while new arrivals lock a fresh file and walk straight
+  past it. A few empty ``.lock`` files in the cache are the price of the
+  guarantee; ``dl --purge`` sweeps them away with everything else.
+"""
+
+import contextlib
+import fcntl
+import os
+import sys
+from pathlib import Path
+from typing import Iterator, Optional
+
+
+@contextlib.contextmanager
+def hold_lock(lock_path: Path, waiting_note: Optional[str] = None) -> Iterator[None]:
+    """Hold an exclusive inter-process lock on *lock_path* for the block.
+
+    Blocks until the lock is free. When another process already holds it and
+    *waiting_note* is given, one line is printed to stderr first, so a dl run
+    that sits waiting on a sibling's long clone says why it is sitting.
+    """
+    lock_path.parent.mkdir(parents=True, exist_ok=True)
+    fd = os.open(lock_path, os.O_RDWR | os.O_CREAT, 0o600)
+    try:
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            if waiting_note:
+                print(f"dl: waiting for {waiting_note}", file=sys.stderr)
+            fcntl.flock(fd, fcntl.LOCK_EX)
+        yield
+    finally:
+        # Closing the descriptor releases the lock; nothing is unlinked.
+        os.close(fd)

{devlaunch-0.0.19 → devlaunch-0.0.20}/devlaunch/worktree/repo_manager.py

@@ -7,6 +7,7 @@ from datetime import datetime
 from pathlib import Path
 from typing import Optional, TYPE_CHECKING
 
+from .locks import hold_lock
 from .models import BaseRepository
 from .storage import MetadataStorage
 
@@ -41,6 +42,15 @@ class RepositoryManager:
         """Get the bare git directory for a repository."""
         return self.get_repo_path(owner, repo) / ".bare"
 
+    def lock_path(self, owner: str, repo: str) -> Path:
+        """The lock every process takes before mutating repos/<owner>/<repo>.
+
+        A file, not a directory, inside the repo dir: every walker of the cache
+        filters on ``is_dir()``, so it is invisible to discovery, migration and
+        completion scans.
+        """
+        return self.get_repo_path(owner, repo) / ".lock"
+
     def clone_repo(self, owner: str, repo: str, remote_url: str) -> BaseRepository:
         """Clone a new base repository as bare (no working directory).
 
@@ -58,7 +68,21 @@ class RepositoryManager:
             existing_repo = self.get_repo(owner, repo)
             if existing_repo:
                 return existing_repo
-            # Repository path exists but metadata doesn't - continue to create metadata
+            if (bare_path / "HEAD").exists():
+                # The bare clone is already on disk but this process has no
+                # record of it -- another process just made it (this process's
+                # metadata was loaded before that one saved), or an earlier run
+                # died between clone and save. Either way the clone on disk is
+                # the authority and the record is derived state: rebuild the
+                # record. Cloning over it instead is not an option -- git
+                # refuses the non-empty destination, and the failure cleanup
+                # below would then delete a cache another launch is using.
+                return self._register_existing_bare(owner, repo, remote_url, bare_path)
+            # No HEAD: a dead run's partial clone. Holding the repo lock (every
+            # caller comes through ensure_repo) means no live process owns it,
+            # so clear it and clone fresh.
+            logger.warning(f"Removing partial clone at {bare_path}")
+            shutil.rmtree(bare_path)
 
         # Create parent directory
         bare_path.parent.mkdir(parents=True, exist_ok=True)
@@ -97,11 +121,28 @@ class RepositoryManager:
 
         except subprocess.CalledProcessError as e:
             logger.debug(f"Failed to clone repository: {e.stderr}")
-            # Clean up partial clone
+            # Clean up the partial clone. Safe to delete: the exists-cases were
+            # all handled above, so this directory is one this call created.
             if bare_path.exists():
                 shutil.rmtree(bare_path)
             raise RuntimeError(f"Failed to clone repository: {e.stderr}") from e
 
+    def _register_existing_bare(
+        self, owner: str, repo: str, remote_url: str, bare_path: Path
+    ) -> BaseRepository:
+        """Rebuild the metadata record for a bare clone already on disk."""
+        base_repo = BaseRepository(
+            owner=owner,
+            repo=repo,
+            remote_url=remote_url,
+            local_path=bare_path,
+            default_branch=self._get_default_branch(bare_path),
+            last_fetched=datetime.now(),
+            worktrees=[],
+        )
+        self.storage.add_repository(base_repo)
+        return base_repo
+
     def fetch_repo(self, owner: str, repo: str) -> None:
         """Fetch latest changes from remote."""
         bare_path = self.get_bare_path(owner, repo)
@@ -166,20 +207,33 @@ class RepositoryManager:
         """Ensure repo exists locally, clone if needed.
 
         Uses lazy fetch: only fetches if fetch_interval has elapsed since last fetch.
-        """
-        if self.repo_exists(owner, repo):
-            existing_repo = self.get_repo(owner, repo)
-            if existing_repo:
-                # Only fetch if interval has elapsed (lazy fetch)
-                if auto_fetch and self._should_fetch(existing_repo):
-                    try:
-                        self.fetch_repo(owner, repo)
-                    except Exception as e:
-                        logger.warning(f"Failed to fetch updates: {e}")
-                return existing_repo
-            # Metadata doesn't exist but repo exists - fall through to clone (which will add metadata)
 
-        return self.clone_repo(owner, repo, remote_url)
+        The whole exists-check-then-clone sequence runs under the repo lock:
+        without it, two processes launching the same repo at once both saw no
+        clone and both ran ``git clone --bare`` into the same path — and the
+        loser's cleanup in clone_repo deleted the winner's half-written cache.
+        Serialized, the loser just waits and then reuses the winner's clone.
+        clone_repo and fetch_repo rely on this lock rather than taking it
+        themselves (hold_lock is not reentrant).
+        """
+        with hold_lock(
+            self.lock_path(owner, repo),
+            waiting_note=f"another dl run preparing {owner}/{repo}",
+        ):
+            if self.repo_exists(owner, repo):
+                existing_repo = self.get_repo(owner, repo)
+                if existing_repo:
+                    # Only fetch if interval has elapsed (lazy fetch)
+                    if auto_fetch and self._should_fetch(existing_repo):
+                        try:
+                            self.fetch_repo(owner, repo)
+                        except Exception as e:
+                            logger.warning(f"Failed to fetch updates: {e}")
+                    return existing_repo
+                # Metadata doesn't exist but repo exists - fall through to clone
+                # (which will add metadata)
+
+            return self.clone_repo(owner, repo, remote_url)
 
     def repo_exists(self, owner: str, repo: str) -> bool:
         """Check if repository exists locally."""

{devlaunch-0.0.19 → devlaunch-0.0.20}/devlaunch/worktree/storage.py

@@ -12,6 +12,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 from devlaunch.xdg import devlaunch_cache
 
+from .locks import hold_lock
 from .models import BaseRepository, WorktreeInfo, unknown_fields
 
 # Version of the on-disk metadata.json format.
@@ -83,8 +84,28 @@ class MetadataStorage:
         self.metadata_path.parent.mkdir(parents=True, exist_ok=True)
         # Every file operation targets the real file, not a symlink pointing at it.
         self._file_path = _resolve_link(self.metadata_path)
+        # A sidecar rather than the file itself: save() replaces metadata.json
+        # by rename, and a lock taken on a replaced inode guards nothing.
+        self._lock_path = self._file_path.with_name(self._file_path.name + ".lock")
         self._load()
 
+    @contextlib.contextmanager
+    def exclusive(self):
+        """Hold the metadata lock and reload before the block runs.
+
+        Every mutation goes through this: the in-memory copy was loaded whenever
+        this process started, and other dl processes may have written since.
+        Rewriting the file from that stale copy silently drops their records —
+        reloading under the lock is what makes read-modify-write safe. The
+        caller applies its change and calls save() before the block ends.
+
+        Not reentrant (see locks.py), so mutators must never be called from
+        inside an exclusive() block — they take this lock themselves.
+        """
+        with hold_lock(self._lock_path, waiting_note="another dl run updating the workspace list"):
+            self._load()
+            yield
+
     def _quarantine(self, reason: str) -> None:
         """Move an unusable metadata file aside so the data stays inspectable.
 
@@ -288,8 +309,9 @@ class MetadataStorage:
     def add_repository(self, repo: BaseRepository) -> None:
         """Add or update a repository."""
         key = f"{repo.owner}/{repo.repo}"
-        self.repositories[key] = repo
-        self.save()
+        with self.exclusive():
+            self.repositories[key] = repo
+            self.save()
 
     def get_repository(self, owner: str, repo: str) -> Optional[BaseRepository]:
         """Get a repository by owner and name."""
@@ -303,22 +325,24 @@ class MetadataStorage:
     def remove_repository(self, owner: str, repo: str) -> None:
         """Remove a repository."""
         key = f"{owner}/{repo}"
-        if key in self.repositories:
-            del self.repositories[key]
-            self.save()
+        with self.exclusive():
+            if key in self.repositories:
+                del self.repositories[key]
+                self.save()
 
     def add_worktree(self, worktree: WorktreeInfo) -> None:
         """Add or update a worktree."""
         key = f"{worktree.owner}/{worktree.repo}/{worktree.branch}"
-        self.worktrees[key] = worktree
+        with self.exclusive():
+            self.worktrees[key] = worktree
 
-        # Update repository's worktree list in memory, then write once.
-        repo = self.get_repository(worktree.owner, worktree.repo)
-        if repo and worktree.branch not in repo.worktrees:
-            repo.worktrees.append(worktree.branch)
-            self.repositories[f"{worktree.owner}/{worktree.repo}"] = repo
+            # Update repository's worktree list in memory, then write once.
+            repo = self.get_repository(worktree.owner, worktree.repo)
+            if repo and worktree.branch not in repo.worktrees:
+                repo.worktrees.append(worktree.branch)
+                self.repositories[f"{worktree.owner}/{worktree.repo}"] = repo
 
-        self.save()
+            self.save()
 
     def get_worktree(self, owner: str, repo: str, branch: str) -> Optional[WorktreeInfo]:
         """Get a worktree by repository and branch."""
@@ -348,13 +372,14 @@ class MetadataStorage:
     def remove_worktree(self, owner: str, repo: str, branch: str) -> None:
         """Remove a worktree."""
         key = f"{owner}/{repo}/{branch}"
-        if key in self.worktrees:
-            del self.worktrees[key]
+        with self.exclusive():
+            if key in self.worktrees:
+                del self.worktrees[key]
 
-            # Update repository's worktree list in memory, then write once.
-            repo_obj = self.get_repository(owner, repo)
-            if repo_obj and branch in repo_obj.worktrees:
-                repo_obj.worktrees.remove(branch)
-                self.repositories[f"{owner}/{repo}"] = repo_obj
+                # Update repository's worktree list in memory, then write once.
+                repo_obj = self.get_repository(owner, repo)
+                if repo_obj and branch in repo_obj.worktrees:
+                    repo_obj.worktrees.remove(branch)
+                    self.repositories[f"{owner}/{repo}"] = repo_obj
 
-            self.save()
+                self.save()

{devlaunch-0.0.19 → devlaunch-0.0.20}/devlaunch/worktree/workspace_clone.py

@@ -25,6 +25,7 @@ from typing import Optional
 from ..workspace_id import WorkspaceId, validate_ref_name
 from .branch_manager import BranchManager
 from .config import WorktreeConfig, get_worktree_config
+from .locks import hold_lock
 from .models import WorktreeInfo
 from .repo_manager import RepositoryManager
 from .storage import MetadataStorage
@@ -173,27 +174,36 @@ class WorkspaceCloneManager:
 
         Fetches latest refs, then uses BranchManager to create the branch
         locally if needed. Does not push to the remote.
+
+        Runs under the repo lock: the fetch and the branch creation both write
+        refs in the shared bare repo, and two processes doing so at once trip
+        over git's own ref locks. (hold_lock is not reentrant; no callee here
+        takes the repo lock.)
         """
         bare_path = self.repo_manager.get_bare_path(owner, repo)
-        # Lazy-fetch: only hits the network when the fetch interval has elapsed
-        try:
-            self.repo_manager.lazy_fetch(owner, repo)
-        except (RuntimeError, ValueError, OSError) as e:
-            logger.warning(f"Failed to fetch before branch ensure: {e}")
+        with hold_lock(
+            self.repo_manager.lock_path(owner, repo),
+            waiting_note=f"another dl run preparing {owner}/{repo}",
+        ):
+            # Lazy-fetch: only hits the network when the fetch interval has elapsed
+            try:
+                self.repo_manager.lazy_fetch(owner, repo)
+            except (RuntimeError, ValueError, OSError) as e:
+                logger.warning(f"Failed to fetch before branch ensure: {e}")
 
-        try:
-            default_branch = self.repo_manager.get_default_branch(owner, repo)
-        except (RuntimeError, subprocess.CalledProcessError, OSError) as e:
-            logger.warning(f"Failed to resolve default branch: {e}")
-            default_branch = None
-
-        self.branch_manager.ensure_branch_exists(
-            bare_path,
-            branch,
-            create_remote=False,
-            start_point=default_branch or "HEAD",
-            use_local_refs=True,
-        )
+            try:
+                default_branch = self.repo_manager.get_default_branch(owner, repo)
+            except (RuntimeError, subprocess.CalledProcessError, OSError) as e:
+                logger.warning(f"Failed to resolve default branch: {e}")
+                default_branch = None
+
+            self.branch_manager.ensure_branch_exists(
+                bare_path,
+                branch,
+                create_remote=False,
+                start_point=default_branch or "HEAD",
+                use_local_refs=True,
+            )
 
     def ensure_workspace(
         self,
@@ -223,6 +233,28 @@ class WorkspaceCloneManager:
         bare_repo_path = self.repo_manager.get_bare_path(owner, repo)
 
         ws_path = self.get_workspace_path(owner, repo, branch)
+
+        # Steps 2-6 mutate the workspace clone, so they run under the repo
+        # lock: fire the same workspace twice at once and, unserialized, each
+        # process saw no clone, both cloned into the same path, and the loser's
+        # cleanup deleted the winner's. The lock is taken only after
+        # ensure_repo (which takes the same lock) has returned -- hold_lock is
+        # not reentrant.
+        with hold_lock(
+            self.repo_manager.lock_path(owner, repo),
+            waiting_note=f"another dl run preparing {owner}/{repo}",
+        ):
+            return self._prepare_workspace(workspace, bare_repo_path, ws_path, remote_url)
+
+    def _prepare_workspace(
+        self,
+        workspace: WorkspaceId,
+        bare_repo_path: Path,
+        ws_path: Path,
+        remote_url: str,
+    ) -> Path:
+        """Steps 2-6 of ensure_workspace; the caller holds the repo lock."""
+        owner, repo, branch = workspace.owner, workspace.repo, workspace.ref
         is_new_workspace = False
         if not self.workspace_exists(owner, repo, branch):
             is_new_workspace = True

{devlaunch-0.0.19 → devlaunch-0.0.20}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devlaunch"
-version = "0.0.19"
+version = "0.0.20"
 authors = [{ name = "Austin Gregg-Smith", email = "blooop@gmail.com" }]
 description = "DevLaunch - A streamlined CLI for devpod workspaces"
 readme = "README.md"