fix(workspace): fence stale plugin activation

Author: lefarcen

apps/daemon/src/plugins/registry.ts

@@ -285,6 +285,34 @@ export function workspaceTeamPluginBindingAllowsRead(
     && binding.resourceState !== 'deleted';
 }
 
+/**
+ * Snapshot the local binding generation before an asynchronous hub read.
+ * `resourceState` is intentionally part of the fence in addition to
+ * `updatedAt`: two synchronous SQLite writes can share the same millisecond,
+ * but an intervening tombstone must still invalidate an older positive read.
+ * `null` is the generation for a binding that does not exist yet.
+ */
+export function workspaceTeamPluginBindingActivationFence(
+  db: SqliteDb,
+  workspaceId: string,
+  pluginId: string,
+): string | null {
+  const binding = getWorkspaceResourceByResourceId(
+    db,
+    'plugin',
+    workspaceTeamPluginBindingResourceId(workspaceId, pluginId),
+  );
+  if (!binding) return null;
+  return JSON.stringify([
+    binding.workspaceId,
+    binding.visibility,
+    binding.resourceState ?? null,
+    binding.updatedAt,
+    binding.updatedByWorkspaceMemberId ?? null,
+    binding.resourceHubResourceId ?? null,
+  ]);
+}
+
 const WORKSPACE_TEAM_PLUGIN_BINDING_PREFIX = 'team-mirror:';
 
 /**
@@ -325,7 +353,9 @@ export async function resolveWorkspaceTeamPluginWithBindingGate<T>(input: {
 
 export async function resolveAndActivateWorkspaceTeamPlugin<T>(input: {
   resolve: () => Promise<T | null>;
+  captureActivationFence: () => string | null;
   stillShared: () => Promise<boolean>;
+  activationFenceIsCurrent: (fence: string | null) => boolean;
   activate: () => boolean;
 }): Promise<T | null> {
   const resolved = await input.resolve();
@@ -335,10 +365,19 @@ export async function resolveAndActivateWorkspaceTeamPlugin<T>(input: {
 }
 
 export async function activateWorkspaceTeamPluginIfStillShared(input: {
+  captureActivationFence: () => string | null;
   stillShared: () => Promise<boolean>;
+  activationFenceIsCurrent: (fence: string | null) => boolean;
   activate: () => boolean;
 }): Promise<boolean> {
+  const activationFence = input.captureActivationFence();
   if (!await input.stillShared()) return false;
+  // The hub read above is asynchronous. A newer reconciliation may retire the
+  // binding while it is pending, so a positive result is authoritative only
+  // for the binding generation captured before that read. Both this final
+  // check and `activate` are synchronous, leaving no event-loop interleave in
+  // which a tombstone can be overwritten.
+  if (!input.activationFenceIsCurrent(activationFence)) return false;
   return input.activate();
 }
 

apps/daemon/src/server.ts

@@ -373,6 +373,7 @@ import {
   resolveAndActivateWorkspaceTeamPlugin,
   resolvePluginFolder,
   resolveWorkspaceTeamPluginWithBindingGate,
+  workspaceTeamPluginBindingActivationFence,
   workspaceTeamPluginBindingAllowsRead,
   workspaceTeamPluginBindingResourceId,
 } from './plugins/registry.js';
@@ -5007,11 +5008,13 @@ export async function startServer({
       resource.id,
       resource.id,
     );
+    const bindingResourceId = workspaceTeamPluginBindingResourceId(
+      workspaceId,
+      resource.id,
+    );
+    const captureActivationFence = (): string | null =>
+      workspaceTeamPluginBindingActivationFence(db, workspaceId, resource.id);
     const markTeamSynced = (): boolean => {
-      const bindingResourceId = workspaceTeamPluginBindingResourceId(
-        workspaceId,
-        resource.id,
-      );
       const existingBinding = getWorkspaceResourceByResourceId(
         db,
         'plugin',
@@ -5045,7 +5048,9 @@ export async function startServer({
       teamResourceVersions.get(workspaceId, 'plugin', resource.id) === resource.versionId
     ) {
       await activateWorkspaceTeamPluginIfStillShared({
+        captureActivationFence,
         stillShared: () => teamResourceStillShared('plugin', resource, scope),
+        activationFenceIsCurrent: (fence) => captureActivationFence() === fence,
         activate: markTeamSynced,
       });
       return;
@@ -5057,7 +5062,9 @@ export async function startServer({
       : '';
     if (fs.existsSync(targetDir) && !resource.versionId && (!remoteDescription || localDescription === remoteDescription)) {
       await activateWorkspaceTeamPluginIfStillShared({
+        captureActivationFence,
         stillShared: () => teamResourceStillShared('plugin', resource, scope),
+        activationFenceIsCurrent: (fence) => captureActivationFence() === fence,
         activate: markTeamSynced,
       });
       return;
@@ -5108,7 +5115,9 @@ export async function startServer({
           }
           return resolved.record;
         },
+        captureActivationFence,
         stillShared: () => teamResourceStillShared('plugin', resource, scope),
+        activationFenceIsCurrent: (fence) => captureActivationFence() === fence,
         activate: markTeamSynced,
       });
       if (!activated) return;

apps/daemon/tests/plugins-workspace-scope.test.ts

@@ -24,6 +24,7 @@ import path from 'node:path';
 import {
   closeDatabase,
   ensureWorkspaceResource,
+  getWorkspaceResourceByResourceId,
   openDatabase,
   updateWorkspaceResource,
 } from '../src/db.js';
@@ -33,6 +34,7 @@ import {
   resolveAndActivateWorkspaceTeamPlugin,
   resolveWorkspaceTeamPluginWithBindingGate,
   upsertInstalledPlugin,
+  workspaceTeamPluginBindingActivationFence,
   workspaceTeamPluginBindingAllowsRead,
   workspaceTeamPluginBindingResourceId,
 } from '../src/plugins/registry.js';
@@ -236,7 +238,9 @@ describe('listInstalledPlugins workspace scope', () => {
         resolveStarted();
         return resolveGate;
       },
+      captureActivationFence: () => 'active',
       stillShared: async () => false,
+      activationFenceIsCurrent: () => false,
       activate: () => {
         updateWorkspaceResource(db, 'plugin', workspaceId, bindingId, {
           resourceState: 'active',
@@ -276,10 +280,14 @@ describe('listInstalledPlugins workspace scope', () => {
         readStarted = resolve;
       });
       const oldListing = activateWorkspaceTeamPluginIfStillShared({
+        captureActivationFence: () =>
+          workspaceTeamPluginBindingActivationFence(db, workspaceId, pluginId),
         stillShared: async () => {
           readStarted();
           return authoritativeRead;
         },
+        activationFenceIsCurrent: (fence) =>
+          workspaceTeamPluginBindingActivationFence(db, workspaceId, pluginId) === fence,
         activate: () => {
           updateWorkspaceResource(db, 'plugin', workspaceId, bindingId, {
             resourceState: 'active',
@@ -299,4 +307,56 @@ describe('listInstalledPlugins workspace scope', () => {
       ).toBe(false);
     },
   );
+
+  it('rejects a superseded positive shared read after a newer binding tombstone', async () => {
+    const db = openDatabase(tempDir, { dataDir: tempDir });
+    const pluginId = 'plugin-superseded-positive';
+    const workspaceId = 'ws-team';
+    const bindingId = workspaceTeamPluginBindingResourceId(workspaceId, pluginId);
+    ensureWorkspaceResource(db, 'plugin', workspaceId, bindingId, {
+      visibility: 'team',
+      resourceState: 'active',
+    });
+
+    let finishAuthoritativeRead!: (stillShared: boolean) => void;
+    const authoritativeRead = new Promise<boolean>((resolve) => {
+      finishAuthoritativeRead = resolve;
+    });
+    let readStarted!: () => void;
+    const started = new Promise<void>((resolve) => {
+      readStarted = resolve;
+    });
+    const staleActivation = activateWorkspaceTeamPluginIfStillShared({
+      captureActivationFence: () =>
+        workspaceTeamPluginBindingActivationFence(db, workspaceId, pluginId),
+      stillShared: async () => {
+        readStarted();
+        return authoritativeRead;
+      },
+      activationFenceIsCurrent: (fence) =>
+        workspaceTeamPluginBindingActivationFence(db, workspaceId, pluginId) === fence,
+      activate: () => {
+        updateWorkspaceResource(db, 'plugin', workspaceId, bindingId, {
+          resourceState: 'active',
+        });
+        return true;
+      },
+    });
+    await started;
+    const originalUpdatedAt = Number(
+      getWorkspaceResourceByResourceId(db, 'plugin', bindingId)?.updatedAt,
+    );
+    updateWorkspaceResource(db, 'plugin', workspaceId, bindingId, {
+      resourceState: 'deleted',
+      // Simulate two writes in the same millisecond: resourceState must keep
+      // the tombstone visible even when updatedAt alone cannot distinguish it.
+      updatedAt: originalUpdatedAt,
+    });
+    finishAuthoritativeRead(true);
+
+    await expect(staleActivation).resolves.toBe(false);
+    expect(
+      workspaceTeamPluginBindingAllowsRead(db, workspaceId, pluginId),
+    ).toBe(false);
+  });
 });