Skip to content

fix(snapshot): scope restore and diff to the session directory - #6

Open
ryangamerdev wants to merge 1 commit into
devfrom
snapshot-restore-scope
Open

fix(snapshot): scope restore and diff to the session directory#6
ryangamerdev wants to merge 1 commit into
devfrom
snapshot-restore-scope

Conversation

@ryangamerdev

Copy link
Copy Markdown

Issue for this PR

Closes anomalyco#39513

Type of change

  • Bug fix
  • New feature
  • Refactor / code improvement
  • Documentation

What does this PR do?

Fixes a data-loss bug: reverting or unreverting a session started in a subdirectory can silently overwrite an unrelated edit in a sibling directory.

The snapshot index is shared across the whole project (git worktree), but a snapshot taken from a subdirectory only updates that subdirectory's entries — add() runs ls-files ... -- . scoped with cwd: state.directory. restore(), however, ran checkout-index -a -f, which writes every entry in the shared index across the entire worktree. So a sibling directory's file that was captured in the index at an earlier (stale) revision, then edited on disk afterward, gets clobbered back to the stale blob on revert — destroying current work the session never touched. diff() had the matching scope gap (it ran -- . from cwd: state.worktree, reporting changes for unrelated directories).

The fix scopes both to the session directory:

  • restore() lists the snapshot's files under the session-directory prefix (ls-tree -r --name-only <snapshot> -- <prefix>/) and checks out only those paths, instead of checkout-index -a.
  • diff() runs from cwd: state.directory so its -- . path spec is relative to the session directory, consistent with add(), patch(), and diffFull().

This is an urgent, minimal interim fix for live data loss. It is intentionally small and does not attempt the broader snapshot rework being discussed in anomalyco#44511 (mutation epochs) — whose own acceptance criteria include "reverting one session cannot silently overwrite changes attributed to another actor." This PR delivers that guarantee for the subdirectory case today, while that design is still in discussion.

How did you verify your code works?

  • bun typecheck passes across all packages, rebased on current dev.
  • Deterministic reproduction (full script in Snapshot restore from a subdirectory can overwrite sibling files anomalyco/opencode#39513): a git repo with frontend/ and backend/, snapshot taken from frontend/ (seeds the shared index with backend at its original revision), then backend edited on disk. Before the fix, restore()'s checkout-index -a -f overwrites the current backend file with the stale index blob. After the fix, restore lists only files under the frontend/ prefix and leaves backend's current edit untouched, restoring only frontend/.

Checklist

  • I have tested my changes locally
  • I have not included unrelated changes in this PR

The snapshot index is shared across a whole project (git worktree), but a
snapshot taken from a subdirectory only updates that subdirectory's entries
via `add()` (scoped with `cwd: state.directory`). `restore()` used
`checkout-index -a -f`, which writes every entry in the shared index across
the entire worktree - so reverting/unreverting a session started in a
subdirectory could overwrite a sibling directory's current file with a stale
index blob, silently destroying unrelated edits. `diff()` had the matching
scope gap: it ran `-- .` from `cwd: state.worktree`, reporting changes for
unrelated directories.

Scope both to the session directory:
- restore() lists the snapshot's files under the session-directory prefix
  (`ls-tree -r`) and checks out only those, instead of `checkout-index -a`.
- diff() runs from `cwd: state.directory` so `-- .` is relative to the
  session directory, consistent with add()/patch()/diffFull().
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Snapshot restore from a subdirectory can overwrite sibling files

1 participant