Pine/deepseek-harness
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

fix(storage,workspace): post-review hardening

Browse Source 
Review findings applied across the group:
- storage hub: stale disposers no longer remove a successor registration;
  the package now default-exports the Storage service class per the
  service-package export shape.
- json backend: failed publishes roll back the authoritative memory state
  (a rejected write can no longer resurface via get() or ride the next
  publish); close() drains in-flight writes and blocks in-flight opens;
  double-open rejects as a plain caller error instead of malformed-medium.
- sqlite backend: loadAll builds records on a null prototype (__proto__
  keys round-trip instead of polluting), user_version is stamped only
  after the schema is fully created, and corrupt record JSON rejects as
  malformed-medium instead of a bare SyntaxError.
- domain form: writes persist before mutating authoritative memory or
  emitting; DomainChanged is a put/deleted discriminated union.
- workspace: attach/detach idempotence decided on the write chain (stale
  snapshots no longer short-circuit), create() requires a directory, and
  startup fails loud on duplicate stored paths.

Eleven regression tests pin the fixed behaviors.
This commit is contained in:
imccyu
2026-07-24 21:30:32 +08:00
parent 3f16cb4c3c
commit 80b3b6d917
19 changed files with 470 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/storage/domain/src/domain.ts
+9 -7
View File
@@ -1,9 +1,11 @@
/**
* Runtime of one open domain: authoritative in-memory state, the single
* per-domain write chain, and change-event emission. Reads are synchronous
* from memory; every write queues on the chain, mutates memory, awaits
* backend durability, then emits `domain/changed` — so events carry values
* that equal the in-memory state at emission and arrive in write order.
* from memory; every write queues on the chain, awaits backend durability
* FIRST, then mutates memory, then emits `domain/changed` — a rejected
* backend write leaves memory untouched (no divergence between reads and the
* medium), and events carry values that equal the in-memory state at
* emission, in write order.
* @module @deepseek-ai/dsh-domain/src/domain
*/
@@ -175,8 +177,8 @@ export class DomainImpl {
return this.globalValue
},
set: (value) => this.enqueue(async () => {
this.globalValue = value
await this.unit.setGlobal(value)
this.globalValue = value
host.emitChanged({ domain: this.name, table: '', key: '', operation: 'put', value })
}),
}
@@ -271,8 +273,8 @@ class KvTableImpl<K extends string, V> implements KvTable<K, V> {
put(key: K, value: V): Promise<void> {
return this.host.enqueue(async () => {
this.records.set(key, value)
await this.host.unit.putRecord(this.tableName, key, value)
this.records.set(key, value)
this.emitPut(key, value)
})
}
@@ -282,8 +284,8 @@ class KvTableImpl<K extends string, V> implements KvTable<K, V> {
// Existence is decided at this job's chain slot, not at call time: an
// earlier queued put of the same key makes this delete observe it.
if (!this.records.has(key)) return false
this.records.delete(key)
await this.host.unit.deleteRecord(this.tableName, key)
this.records.delete(key)
this.host.emitChanged({
domain: this.host.domainName,
table: this.tableName,
@@ -303,8 +305,8 @@ class KvTableImpl<K extends string, V> implements KvTable<K, V> {
)
}
const next = fn(this.records.get(key) as V)
this.records.set(key, next)
await this.host.unit.putRecord(this.tableName, key, next)
this.records.set(key, next)
this.emitPut(key, next)
return next
})
packages/storage/domain/src/events.ts
+19 -7
View File
@@ -7,20 +7,32 @@
* @module @deepseek-ai/dsh-domain/src/events
*/
/** One durable domain change: a record upsert/delete or a global write. */
export interface DomainChanged {
/** Shared location fields of one durable domain change. */
export interface DomainChangedBase {
/** Owning domain name. */
readonly domain: string
/** Table name; `''` for a global-singleton write. */
readonly table: string
/** Record key; `''` for a global-singleton write. */
readonly key: string
/** What happened: `put` covers insert and overwrite; `deleted` is a tombstone. */
readonly operation: 'put' | 'deleted'
/** The new snapshot; absent for `deleted`. */
readonly value?: unknown
}
/** A record (or the global singleton) was inserted or overwritten. */
export interface DomainChangedPut extends DomainChangedBase {
readonly operation: 'put'
/** The new snapshot. */
readonly value: unknown
}
/** A record was deleted; tombstones carry no value. */
export interface DomainChangedDeleted extends DomainChangedBase {
readonly operation: 'deleted'
readonly value?: never
}
/** One durable domain change; a closed union — switch on `operation`. */
export type DomainChanged = DomainChangedPut | DomainChangedDeleted
declare module 'cordis' {
interface Events {
/**
@@ -28,7 +40,7 @@ declare module 'cordis' {
* strictly after the backend acknowledged durability. Events of one
* domain arrive in its write-chain order.
* @param change - domain, table (`''` for global), key (`''` for global),
* operation discriminant, and the new snapshot (absent for deletions).
* operation discriminant, and on `put` the new snapshot.
* @mode emit
*/
'domain/changed'(change: DomainChanged): void
packages/storage/domain/src/invariant.ts
+19 -14
View File
@@ -35,20 +35,25 @@ const install: InvariantInstaller = Object.assign((ctx: Context, fail: Invariant
return
}
const current = domain.table(change.table).get(change.key)
if (change.operation === 'deleted') {
if (current !== undefined) {
return fail(
`domain/changed deletion of '${change.domain}'.'${change.table}'['${change.key}'] `
+ 'emitted while the record is still in memory',
)
}
return
}
if (current !== change.value) {
return fail(
`domain/changed value for '${change.domain}'.'${change.table}'['${change.key}'] `
+ 'differs from the in-memory record',
)
switch (change.operation) {
case 'deleted':
if (current !== undefined) {
return fail(
`domain/changed deletion of '${change.domain}'.'${change.table}'['${change.key}'] `
+ 'emitted while the record is still in memory',
)
}
return
case 'put':
if (current !== change.value) {
return fail(
`domain/changed value for '${change.domain}'.'${change.table}'['${change.key}'] `
+ 'differs from the in-memory record',
)
}
return
default:
change satisfies never
}
}, { global: true })
}, { inject: ['storage'] })
packages/storage/domain/tests/domain.spec.ts
+37 -2
View File
@@ -1,7 +1,7 @@
import { describe, expect, it } from 'vitest'
import { Context } from 'cordis'
import { z } from 'zod'
import { apply as applyStorage } from '@deepseek-ai/dsh-storage'
import Storage from '@deepseek-ai/dsh-storage'
import { DomainFacility, defineDomain, domainTable } from '../src/index.ts'
import type { Config } from '../src/index.ts'
import type { DomainChanged } from '../src/events.ts'
@@ -28,7 +28,7 @@ const bareSpec = defineDomain({
/** Boot a context with the storage hub, one memory backend, and a facility over it. */
async function harness(options?: { pool?: MemoryMediaPool; config?: Partial<Config> }) {
const ctx = new Context()
await ctx.plugin({ apply: applyStorage })
await ctx.plugin(Storage)
const backend = new MemoryStorageBackend(options?.pool)
ctx.storage.backend.register('memory', backend)
const facility = new DomainFacility(ctx, { backend: 'memory', routes: {}, ...options?.config })
@@ -149,6 +149,41 @@ describe('KvTable writes', () => {
})
})
describe('durability failure', () => {
it('leaves memory untouched and emits nothing when the backend rejects a write', async () => {
const pool = new MemoryMediaPool()
const { facility, changes } = await harness({ pool })
const domain = await facility.open(spec)
const table = domain.table('items')
await table.put('a', { label: 'x', count: 1 })
const seen = changes.length
pool.failNextWrites = 3
await expect(table.put('a', { label: 'x', count: 99 })).rejects.toThrow(/injected/)
await expect(table.update('a', (c) => ({ ...c, count: c.count + 1 }))).rejects.toThrow(/injected/)
await expect(table.delete('a')).rejects.toThrow(/injected/)
// Reads still serve the pre-failure record; no events leaked.
expect(table.get('a')).toEqual({ label: 'x', count: 1 })
expect(pool.media.get('demo')!.tables.get('items')!.get('a')).toEqual({ label: 'x', count: 1 })
expect(changes).toHaveLength(seen)
// The chain survives rejections: the next write lands cleanly with no residue.
await table.update('a', (c) => ({ ...c, count: c.count + 1 }))
expect(table.get('a')).toEqual({ label: 'x', count: 2 })
})
it('keeps serving initial when the first global set fails durability', async () => {
const pool = new MemoryMediaPool()
const { facility } = await harness({ pool })
const domain = await facility.open(spec)
pool.failNextWrites = 1
await expect(domain.global.set({ theme: 'dark' })).rejects.toThrow(/injected/)
expect(domain.global.get()).toEqual({ theme: 'plain' })
expect(pool.media.get('demo')!.global).toBeNull()
})
})
describe('global singleton', () => {
it('serves initial before first set without materializing, then persists the first set', async () => {
const pool = new MemoryMediaPool()
packages/storage/domain/tests/helpers/memory-backend.ts
+22 -2
View File
@@ -28,13 +28,29 @@ export interface MemoryMedium {
* Shared media pool. Construct one and hand it to several
* {@link MemoryStorageBackend} instances to simulate reopening the same
* medium after a restart; `versions` holds the stamped unit versions and is
* writable by tests to inject a mismatching on-medium version.
* writable by tests to inject a mismatching on-medium version, and
* `failNextWrites` injects write-primitive failures.
*/
export class MemoryMediaPool {
/** Unit name → its records; a missing entry is a never-materialized unit. */
readonly media = new Map<string, MemoryMedium>()
/** Unit name → stamped version; tests may pre-stamp to force `version-mismatch`. */
readonly versions = new Map<string, number>()
/**
* When positive, that many subsequent write primitives (putRecord /
* deleteRecord / setGlobal) reject without touching the medium, decrementing
* per rejection. Negative-path seam: callers assert their state is
* untouched after a durability failure.
*/
failNextWrites = 0
/** Consume one injected failure, throwing in a rejected write's place. */
consumeInjectedFailure(): void {
if (this.failNextWrites > 0) {
this.failNextWrites -= 1
throw new Error('injected write failure')
}
}
}
/** In-memory KV unit over one pooled medium. */
@@ -42,6 +58,7 @@ class MemoryKvUnit implements KvUnit {
private closed = false
constructor(
private readonly pool: MemoryMediaPool,
private readonly medium: MemoryMedium,
private readonly descriptor: KvUnitDescriptor,
private readonly onClose: () => void,
@@ -64,6 +81,7 @@ class MemoryKvUnit implements KvUnit {
async putRecord(table: string, key: string, value: unknown): Promise<void> {
this.assertOpen()
this.pool.consumeInjectedFailure()
let records = this.medium.tables.get(table)
if (records === undefined) {
records = new Map()
@@ -74,11 +92,13 @@ class MemoryKvUnit implements KvUnit {
async deleteRecord(table: string, key: string): Promise<void> {
this.assertOpen()
this.pool.consumeInjectedFailure()
this.medium.tables.get(table)?.delete(key)
}
async setGlobal(value: unknown): Promise<void> {
this.assertOpen()
this.pool.consumeInjectedFailure()
this.medium.global = value
}
@@ -128,7 +148,7 @@ export class MemoryStorageBackend implements StorageBackend {
this.pool.media.set(descriptor.name, medium)
}
this.openUnits.add(descriptor.name)
return new MemoryKvUnit(medium, descriptor, () => this.openUnits.delete(descriptor.name))
return new MemoryKvUnit(this.pool, medium, descriptor, () => this.openUnits.delete(descriptor.name))
},
}
}