Repository navigation
fix(editor-view): preload a verified private copy instead of the store path - #2187
Merged
Merged
Conversation
…e path agent-identity: agent/effect-utils/build-cache agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
schickling-assistant
added
origin:agent
Contributor
Pipeline traces24 jobs; 7 successful, 0 failed, 0 cancelled, 17 skipped Image unavailable; jobs-only Mermaid timeline below.
All other jobs (19)
Main baseline samples (by job): default-ref-policy n=7, pr-reviews-resolved n=7, tested-tree n=7, test-megarepo-store-gc n=0, pr-buck2-tools n=0, trusted-buck2-remote-cache-proof n=7, test-live-deploy-ci-tools n=7, test-integration-notion n=7, consumer-smoke n=7, promote-published n=7, quality n=0, weaver n=0, test-playwright-tui-react n=0, test[runner=namespace-profile-linux-x86-64] n=0, cargo n=0, test-playwright-utils n=0, test-integration-restate n=0, pr-a-inert-buck n=0, build-products n=0, test[runner=namespace-profile-macos-arm64] n=0, publish-products n=7, deploy-storybooks n=7, source-shape n=0, notify-alignment n=7. Pipeline timelinegantt
title Pipeline jobs (start 2026-10-30 02:23:35 UTC; axis in local time)
dateFormat YYYY-MM-DD HH:mm:ssZZ
axisFormat %H:%M
todayMarker off
section Jobs
pr-reviews-resolved (success) :job1, 2026-10-30 02:23:35+0000, 3s
tested-tree (success) :job2, 2026-10-30 02:23:35+0000, 3s
test-megarepo-store-gc (success) :job3, 2026-10-30 02:23:41+0000, 382s
default-ref-policy (success) :job0, 2026-10-30 02:23:42+0000, 51s
pr-buck2-tools (success) :job4, 2026-10-30 02:23:42+0000, 299s
quality (success) :job10, 2026-10-30 02:23:46+0000, 642s
source-shape (success) :job22, 2026-10-30 02:24:35+0000, 57s
17 job(s) without a start time are omitted from the timeline, not measured as zero. |
Contributor
Storybook Previews
Report historyPR 2187 · 2026-10-30 02:35 UTC
PR 2187 · 2026-10-30 02:20 UTC
PR 2187 · 2026-10-30 01:38 UTC
|
agent-identity: agent/effect-utils/build-cache agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
agent-identity: agent/effect-utils/build-cache agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
agent-identity: agent/effect-utils/build-cache agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
agent-identity: agent/effect-utils/build-cache agent-persona: generalist agent-supervisor: unavailable agent-tool: OMP agent-tool-version: 18.10.2 agent-runtime: OMP 18.10.2 agent-model: anthropic/claude-opus-5-5
Collaborator
Author
|
Review GO at 4b0a251
Posted on behalf of @schickling
|
Collaborator
Author
|
Receipts at 4b0a251 New tests (scripts/editor-view-source.integration.test.ts, task genie:buck2:test, CI job pr/quality step "Genie projection and CI workflow regression tests"), all passing in this job:
Local evidence (Linux): changed file 35/0; buck2:cache-posture:test 160/0 at the final behavior head, with no "killed dangling process" message (it was failing locally before with 15 s and 60 s timeouts). Inherited child Bun start under the real launcher: median 12.3 ms, previously about 450 ms. Posted on behalf of @schickling
|
schickling-assistant
marked this pull request as ready for review
October 30, 2026 02:39
Collaborator
Author
|
Handoff from Build-cache (agent/effect-utils/build-cache): ready at 4b0a251, with owner GO (buck-toolchain), independent exact-head GO and green CI. Waiting for effect-utils-manager to queue it. Handoff message: message/4d4ec42b99e3f288 (waiting for delivery). Posted on behalf of @schickling
|
Collaborator
Author
|
Merge record (effect-utils-manager): head 4b0a251, PR CI green (36 checks), owner GO at 01738e3 plus a 1-commit delta to 4b0a251 (test-file formatting only), independent review GO at 4b0a251 after the NO-GO round, no Hypermerge label, no timeout changes. Enqueuing. Posted on behalf of @schickling
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 30, 2026
Collaborator
Author
|
Merge record (effect-utils-manager): ejected at 02:54Z by Posted on behalf of @schickling
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The source lease launcher exports a store-backed JavaScript preload to every Node/Bun child. Bun 1.4.4 enumerates a resolved module's parent and uncached ancestor directories, including the entire store directory. Consequently every short-lived fake native/worker process in the cache-posture fixtures paid approximately 450 ms of resolver overhead. The isolation fixture launches 126 Bun processes; healthy forward progress then exceeded its unchanged 60-second aggregate deadline. This is not a daemon lock deadlock.
The mechanism is already reported in oven-sh/bun#32389. Proposed fix #32392 remains open and is scoped to the main entry point, not a demonstrated preload/ancestor fix. Exact 1.4.4 resolver evidence:
Goal
Keep the bootstrap-safe preload's exact trusted bytes while removing store enumeration from every child startup. No timeout changes or retries.
Decisions
preload-<sha256>.cjsunder a privateeditor-view-leasedirectory: Linux$XDG_RUNTIME_DIR, macOS per-user$TMPDIR, otherwise the user's cache directory./: root/current-user ownership, and no group/other write permissions unless sticky. The private base/leaf remain current-user-owned and non-writable by group/others. Unsafe candidates fall through to the next platform candidate or cache fallback; if none qualifies, launch fails closed.^[A-Za-z0-9._/+-]+$, so runtime option tokenization cannot split or reinterpret it. Inherited child forwarding applies the same character check. Refusals name the affected path and a repair/removal remedy.Consumer audit
consumer.nixexports one verified path consistently throughEDITOR_VIEW_LEASE_PRELOAD,NODE_OPTIONS --require, andBUN_OPTIONS --preload.inherit.cjschecks its own__filenameagainst the same option-safe character whitelist before forwarding, so descendants naturally retain the verified copy, including replacement environments and patched spawn methods. Genie'sts-api.tsimports the exported absolute path and has no store-prefix identity check; its comment now describes the verified bootstrap mapper. The native lease contains no preload-path comparison or store-prefix trust check. Standalone-staging metadata continues to identify the immutable source artifact; direct descriptor-handoff fixtures intentionally exercise that tracked source rather than a production path override.Verification
Final head:
01738e3a17f8906ee0067fe9687e216cd6e93918.Final review-hardening proofs
At the exact final clean head, under
gate-slot --class eval --max-hold 1800andnice -n 19:bun test ./scripts/editor-view-source.integration.test.ts: 35 pass, 0 fail, 123 assertions, 7.45 s.devenv tasks run buck2:cache-posture:test --mode single --refresh-task-cache --no-tui: 160 pass, 0 fail, 1,223 assertions, 38.50 s; zero classified timeout/assertion/other failures and no killed-dangling message./varresolution, and surfacing BunspawnSync's returned refusal error rather than ignoring it. No timeout changes, amendments, or force pushes.Initial implementation proofs
The measurements and aggregate results below were collected at initial head
7f1fdaeed8e34a7651cecc77b2760c4d7437540c, before the additional ancestry checks. They are retained as mechanism evidence, not as a new measurement of final-launcher overhead.All execution was scoped and admitted through
gate-slot --class evalwithnice -n 19; no workspace-wide check was run.buck2:cache-posture:test --mode single --refresh-task-cache --no-tui, run 1scripts/editor-view-source.integration.test.tsthrough the real source launcherbuck2:editor:publish:testprerequisitegenie:buck2:test --mode single --refresh-task-cache --no-tuiNew regressions cover the real launcher's three consistent non-store exports, content hash/tampering, exact file mode, concurrent first installs, wrong-owner and group/world-writable directories, and symlink rejection. Their owning task is
genie:buck2:test, run by CIquality/ pr/quality, step Genie projection and CI workflow regression tests; the aggregate also participates in the regulartest:runlane. CI executes the same launcher/installer path.Startup measurements
Bun 1.4.4; 10 interleaved real-launcher starts per variant, same checkout and runtime:
-e 1spawned by the actual preloaded Bun parent, retaining exported lease environment, median of 10The remaining launcher cost is its existing native workspace/lease discovery, paid once per launcher, not once per child. A traced new-launcher start had 2,656 getdents64 calls across 1,326 directories in native discovery; the Bun phase had only 38 calls and zero enumeration of the store root. Largest native directories held 338, 258 and 243 entries.
strace -f -ccounted 19,623 newfstatat (94.721 ms), 2,698 getdents64 (30.565 ms), 1,801 openat (8.870 ms), and 13 statx (0.071 ms). These traced syscall times are not untraced wall-clock measurements.Complexity
One bootstrap-independent shell installer, using the wrapper's existing coreutils dependency. No new runtime/language dependency or lease protocol change.
Concerns
The full owning aggregate is not locally green in this narrowly provisioned checkout: its three unchanged reaper fixtures lack the scheduled megarepo dependency publication (
@overeng/effect-path). Before the approved scoped prerequisite, they lackedeffect; afterward they still lack the workspace dependency. The original store-backed launcher reproduces the same three missing-module failures on the unchanged reaper file, independently of this fix. Publication was not widened beyond the approved source-test prerequisite. The changed file and both cache-posture acceptance runs are green. macOS behavior is covered by the shared code path and CI, not a local macOS run.Friction & bottlenecks
Single-mode task execution omits the owning aggregate's scheduled megarepo installer; dependency failures are explicitly retained above rather than described as passing tests. The native launcher's recursive discovery is a separate fixed-per-launch cost, not changed here. Focused verification waited through a scheduled resource-admission fence; no admission bypass was used.
Follow-ups
Upstream resolver optimization is tracked by oven-sh/bun#32389 and #32392; no upstream issue was opened for this change.
References
Refs #1990 (source lease wrapper), #2180 (private fixture roots), #2182 (Bun 1.4.4 task runtime).
Posted on behalf of @schickling
agent_identitysessionagent_personaagent_supervisoragent_toolagent_tool_versionagent_runtimeagent_modelworktree