fix(store): stop backups overwriting a new file; adopt kit v0.26.0 file helpers - #920
Merged
Merged
Conversation
roborev: Combined Review (
|
Member
|
looking |
Adopt the shared file helpers to prevent backup publication from replacing a newly created target and to reuse atomic writes for persisted state. - fix(store): never overwrite an existing file when publishing a backup - refactor: write tokens and deletion manifests through kit atomicfile - refactor: publish private runtime state through kit atomicfile - refactor: sync directories with kit atomicfile.SyncDir - refactor: use kit atomicfile in developer tool writers Generated with Claude Code Generated with Codex Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Codex <noreply@openai.com>
Kit's hard-link-first publisher does not write through the new name on Windows. Use its exclusive write-through rename, as kit does for new-file publication, while retaining the no-overwrite contract on every platform. Exercise the race by creating a competing file after the backup's initial check. Document why unsupported publication must fail and why the existing owner-only credential permissions cannot be replaced with kit's broader Windows private-file permissions. Generated with Codex Co-authored-by: Codex <noreply@openai.com>
wesm
force-pushed
the
kit-v026-fs-helpers
branch
from
September 26, 2026 14:51
d9efd6b to
f60586e
Compare
roborev: Combined Review (
|
The Windows API job returned nil where the bounded CLI request should report a deadline error. Its test races two wall-clock timers, so delayed scheduling can leave both select branches ready. Run each policy case with virtual time while keeping the real middleware and the existing timeout and success assertions. Generated with Codex Co-authored-by: Codex <noreply@openai.com>
roborev: Combined Review (
|
The loopback request-deadline test passed both request assertions but its one-second shutdown deadline failed on CI. The rejected body leaves HTTP connection cleanup to net/http, which delays closing and polls for shutdown. Give cleanup five seconds without changing the request deadlines or the assertions that distinguish marked and unmarked requests. Generated with Codex Co-authored-by: Codex <noreply@openai.com>
roborev: Combined Review (
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SQLite maintenance backups now preserve files created at the target path during
VACUUM INTO. Publication uses a hard link or atomic no-replace rename on Unix, and a write-through no-replace rename on Windows. A competing file survives and the backup returns "backup target already exists".Filesystems with neither publication primitive still reject the backup. A check-then-rename fallback would restore the overwrite race.
Kit v0.26.0 also replaces repeated atomic-write and directory-sync code for tokens, deletion manifests, runtime state, cache publication, and developer tools. Sync errors propagate even when publication already succeeded. Migrated replacement writers reject symlink targets.
The token helper and credential stores retain their Windows permission handling. Kit's
WithPrivatealso grants SYSTEM and Administrators access, unlike their current-user-only policy.API timing tests use virtual time for request-timeout policy and allow HTTP connection cleanup after the loopback read-deadline checks. Production timeout behavior is unchanged.