Skip to content

Fix over-broad rebuild live-server interlock: lsof-scoped, warn-by-default (#1138) - #1138

Merged
jeonghun-jj-lee merged 2 commits into
mainfrom
jj/1138-fix-rebuild-interlock
Sep 14, 2026
Merged

jeonghun-jj-lee merged 2 commits into
mainfrom
jj/1138-fix-rebuild-interlock

Conversation

@jeonghun-jj-lee

Copy link
Copy Markdown
Contributor

What

Fixes the over-broad running-server interlock (OB12) in the rebuild scripts that refused a rebuild when the chat server — or any unrelated opencode process — was running, even though nothing held this rebuild's DB.

Why

The interlock is new in #1135 — the pre-S9 scripts and the in-app Rebuild path never blocked on a live server. It used pgrep -f 'opencode.*serve', which matches any process whose args contain "opencode" then "serve" (including the Amicode server you're chatting through), so it false-refused. Reported live:

==> Rebuild mode: main ... ERROR: A live opencode server appears to be running — close the Extension Dev Host ...

Change (scripts/rebuild_amicode.sh)

  • lsof-scoped: the check now runs lsof -t against the actual target DB files ($DBDIR/opencode*.db + -wal/-shm), excluding this script's own pid+parent (a & job shares the parent pgid, so no pgid filter — a real server runs in its own group). No lsof → silent pass.
  • Warn-by-default (restores old-script + in-app parity): a genuine holder prints a one-line warning and continues. db_is_zeroed + WAL-checkpoint + restore-only-if-zeroed already guard a torn backup.
  • --strict-live-check opts into the hard refuse; --allow-live-server silences the warning.
  • Added a --check-live-only hook for isolated testing.
  • Drive-by: fixed a dirty-files=0\n0 double-print in the deploy-transparency line.

Tests / gates (all command-run)

  • TDD: new AC10 in rebuild_amicode_check.sh — (a) holder → warn+exit 0; (b) --strict → refuse; (c) unrelated opencode…serve-named process holding no target DB → not tripped (regression guard for the exact false positive); (d) no lsof → pass. RED first (failed on current code), then GREEN.
  • Harness: 12/12 pass, 0 fail, 1 skip (AC9 heavy build opt-in).
  • bash -n = 0 · shellcheck (all 4 scripts) = 0 findings · fork-refs = 0.
  • Both scripts ran end-to-end on this machine: rebuild_amicode_locally.sh --yes (build→deploy→binary copy→done) and rebuild_amicode_remotely.sh --yes on a clean tree (full --mode main sync→build→deploy→done); the dirty-tree refuse still fires correctly when the tree is dirty.

Scope

Scripts only — the in-app path never had this interlock, so no coordinator.ts/chat_bridge.ts change; the two surfaces stay consistent (neither hard-blocks on a live server).

@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

…efault (#1138)

The OB12 interlock added in #1135 used pgrep -f 'opencode.*serve', which
matched unrelated opencode processes (incl. the chat server) and refused the
rebuild when nothing held THIS rebuild's DB. Neither the pre-S9 scripts nor
the in-app path ever blocked on a live server.

- Scope the check to processes actually holding $DBDIR/opencode*.db (+wal/shm)
  via lsof -t, excluding this script's own pid+parent (a & job shares the
  parent pgid, so no pgid filter). A real server runs in its own group.
- Default = non-blocking WARNING (db_is_zeroed already guards a torn backup);
  --strict-live-check opts into the hard refuse; --allow-live-server silences.
- Add --check-live-only hook for isolated testing.
- AC10 in the harness: warn+pass by default, --strict refuses, unrelated
  named process does not trip, no-lsof passes.

Gates: harness 12/12, bash -n 0, shellcheck 0. Local rebuild ran end-to-end.
@jeonghun-jj-lee
jeonghun-jj-lee force-pushed the jj/1138-fix-rebuild-interlock branch from ea5e7cc to c727e68 Compare September 14, 2026 13:34
#1138)

Commit 87f947a (pushed directly to main) edited the overlay-tracked file
packages/core/src/database/migration/20260913221452_session-receipt-budget-reservation.ts
without re-stamping its manifest hash, so materialize hard-failed with
MANIFEST MISMATCH and build-binary went red on main (and on this rebased PR).

Surgical single-key fix: aa0463b1… → a09f5e22… (the file's current content
hash). NOT run via refresh_manifest, which is not exceptions-aware and would
have hoisted 23 amicode-only legacy paths into files{} (ledger §7) — verified
by reverting its over-broad output and editing the one key by hand.

Verified: materialize now applies the overlay with 0 MANIFEST MISMATCH.
@jeonghun-jj-lee
jeonghun-jj-lee marked this pull request as ready for review September 14, 2026 13:50
@jeonghun-jj-lee
jeonghun-jj-lee merged commit d9eb460 into main Sep 14, 2026
11 checks passed
@jeonghun-jj-lee
jeonghun-jj-lee deleted the jj/1138-fix-rebuild-interlock branch September 14, 2026 13:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant