Merge pull request #195 from redxzeta/sync/selective-upstream-20260907

Backport Synara reliability fixes while preserving Forkara

Author: redxzeta

.mise.toml

@@ -1,3 +1,3 @@
 [tools]
 node = "24.13.1"
-bun = "1.3.12"
+bun = "1.4.2"

README.md

@@ -76,6 +76,12 @@ and usage limits remain with that provider.
 See the [development guide](docs/development.md) for supported tool versions, repository structure,
 focused tests, and the pull-request base branch.
 
+### Type checking
+
+`bun run typecheck` uses TypeScript 7 with the native Effect checker for the TypeScript workspaces. The Astro marketing workspace retains `astro check` to validate its `.astro` files. Installation patches the native checker; the root check also reapplies the patch before running. TypeScript 5 remains installed for build tools and `bun run typecheck:legacy`. Native and legacy checks use separate caches.
+
+The native Effect checker does not currently enforce every legacy diagnostic, including `importFromBarrel`. `bun run architecture:check` remains mandatory; use the legacy check when investigating diagnostic differences. `bun run typecheck:native` is an alias for the default check.
+
 ## Documentation
 
 - [Quickstart](docs/quickstart.md)

apps/desktop/package.json

@@ -9,9 +9,11 @@
     "dev:electron": "bun run scripts/dev-electron.mjs",
     "build": "tsdown",
     "start": "bun run scripts/start-electron.mjs",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "node ../../node_modules/@typescript/native/bin/tsc --noEmit --tsBuildInfoFile node_modules/.cache/typescript-native.tsbuildinfo",
+    "typecheck:native": "bun run typecheck",
     "test": "vitest run --passWithNoTests",
-    "smoke-test": "node scripts/smoke-test.mjs"
+    "smoke-test": "node scripts/smoke-test.mjs",
+    "typecheck:legacy": "tsc --noEmit"
   },
   "dependencies": {
     "effect": "catalog:",

apps/desktop/perf/browserDiagnostics.perf.test.ts

@@ -0,0 +1,81 @@
+// FORKARA_PERF=1 FORKARA_PERF_OUT=/tmp/diagnostics.json bun run --cwd apps/desktop test perf/browserDiagnostics.perf.test.ts
+import { createHash } from "node:crypto";
+import { EventEmitter } from "node:events";
+import { writeFileSync } from "node:fs";
+import type { WebContents } from "electron";
+import { ThreadId } from "@forkara/contracts";
+import { expect, it, vi } from "vitest";
+import { BrowserDiagnosticsStore } from "../src/browserAutomation/browserDiagnostics";
+
+it.skipIf(process.env.FORKARA_PERF !== "1")(
+  "measures bounded browser-log reads",
+  async () => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+    vi.setSystemTime(new Date("2026-09-06T00:00:00Z"));
+    const report = [];
+    try {
+      for (const urlLength of [100, 8_000]) {
+        const events = new EventEmitter();
+        const runtime = {
+          threadId: ThreadId.makeUnsafe("perf"),
+          tabId: "025aa711-edf6-4c63-b957-d7c96a3fdabb",
+          webContents: {
+            isDestroyed: () => false,
+            once: () => {},
+            debugger: {
+              isAttached: () => true,
+              sendCommand: async () => ({}),
+              on: events.on.bind(events),
+              removeListener: events.removeListener.bind(events),
+            },
+          } as unknown as WebContents,
+        };
+        const store = new BrowserDiagnosticsStore();
+        await store.observe(runtime);
+        try {
+          for (let index = 0; index < 200; index += 1) {
+            events.emit("message", {}, "Network.requestWillBeSent", {
+              requestId: `request-${index}`,
+              request: {
+                method: "GET",
+                url: `https://example.test/${"x".repeat(urlLength)}?token=secret-${index}`,
+              },
+            });
+          }
+          const input = { includeConsole: false, includeNetwork: true, limit: 200 };
+          const iterations = urlLength === 100 ? 50 : 1;
+          const wallMs: number[] = [];
+          let output;
+          for (let sample = -3; sample < 11; sample += 1) {
+            const start = performance.now();
+            for (let iteration = 0; iteration < iterations; iteration += 1)
+              output = await store.read(runtime, input);
+            if (sample >= 0) wallMs.push((performance.now() - start) / iterations);
+          }
+          const json = JSON.stringify(output);
+          expect(Buffer.byteLength(json)).toBeLessThanOrEqual(320 * 1_024);
+          const ordered = wallMs.toSorted((a, b) => a - b);
+          report.push({
+            name: `read/200-entries-${urlLength}-char-url`,
+            iterations,
+            wallMs,
+            medianMs: ordered[5],
+            p95Ms: ordered[10],
+            entries: output?.entries.length,
+            bytes: Buffer.byteLength(json),
+            outputHash: createHash("sha256").update(json).digest("hex"),
+          });
+        } finally {
+          store.dispose(runtime);
+        }
+      }
+    } finally {
+      vi.useRealTimers();
+    }
+    writeFileSync(
+      process.env.FORKARA_PERF_OUT ?? "/tmp/forkara-diagnostics.json",
+      JSON.stringify({ node: process.version, warmups: 3, samples: 11, report }, null, 2),
+    );
+  },
+  120_000,
+);

apps/desktop/src/backendProcessOutput.ts

@@ -2,7 +2,8 @@
 // Purpose: Tee piped backend output into startup detectors and the configured log destination.
 
 export interface BackendOutputDetector {
-  push(chunk: Buffer): void;
+  push(chunk: Buffer, source: "stdout" | "stderr"): void;
+  end?(source: "stdout" | "stderr"): void;
 }
 
 export interface CaptureBackendProcessOutputInput {
@@ -28,6 +29,7 @@ export function captureBackendProcessOutput(
   const attachStream = (
     stream: NodeJS.ReadableStream | null | undefined,
     writeFallback: (chunk: Buffer) => void,
+    source: "stdout" | "stderr",
   ): Promise<void> => {
     if (!stream) return Promise.resolve();
 
@@ -39,7 +41,7 @@ export function captureBackendProcessOutput(
         writeFallback(buffer);
       }
       for (const detector of input.detectors) {
-        detector.push(buffer);
+        detector.push(buffer, source);
       }
     });
 
@@ -48,6 +50,9 @@ export function captureBackendProcessOutput(
       const resolveOnce = () => {
         if (resolved) return;
         resolved = true;
+        for (const detector of input.detectors) {
+          detector.end?.(source);
+        }
         resolve();
       };
       stream.once("end", resolveOnce);
@@ -58,8 +63,8 @@ export function captureBackendProcessOutput(
     });
   };
 
-  const stdoutDrained = attachStream(input.stdout, input.writeStdout);
-  const stderrDrained = attachStream(input.stderr, input.writeStderr);
+  const stdoutDrained = attachStream(input.stdout, input.writeStdout, "stdout");
+  const stderrDrained = attachStream(input.stderr, input.writeStderr, "stderr");
   return {
     drained: Promise.all([stdoutDrained, stderrDrained]).then(() => undefined),
   };

apps/desktop/src/backendStartupBlock.test.ts

@@ -1,7 +1,44 @@
 import { describe, expect, it } from "vitest";
+import {
+  createMigrationDivergenceConsentToken,
+  serializeMigrationDivergenceConsentChallenge,
+  serializeMigrationSchemaTooNewStartupBlock,
+  type MigrationDivergenceConsentChallenge,
+  type MigrationSchemaTooNewStartupBlock,
+} from "@forkara/shared/migrationRecovery";
 
 import { BackendStartupBlockDetector } from "./backendStartupBlock";
 
+const divergenceChallengeWithoutToken: Omit<MigrationDivergenceConsentChallenge, "consentToken"> = {
+  version: 1,
+  databasePath: "/data/state.sqlite",
+  backupDirectory: "/data/state.sqlite.backups",
+  sourceVersion: "imported-v90-from90",
+  targetVersion: 96,
+  firstDivergedId: 90,
+  expectedName: "ProjectionThreadMessageTextSegments",
+  recordedName: "AuthSessionRenewalPolicy",
+  highWaterMark: 90,
+  lineageFingerprint: "a".repeat(64),
+};
+const divergenceChallenge: MigrationDivergenceConsentChallenge = {
+  ...divergenceChallengeWithoutToken,
+  consentToken: createMigrationDivergenceConsentToken(divergenceChallengeWithoutToken),
+};
+
+const schemaTooNewBlock: MigrationSchemaTooNewStartupBlock = {
+  version: 1,
+  databasePath: "/data/state.sqlite",
+  databaseMigrationId: 97,
+  latestSupportedMigrationId: 96,
+  recovery: {
+    kind: "restore-available",
+    backupPath: "/data/state.sqlite.backups/exact.sqlite",
+    provenancePath: "/data/state.sqlite.migration-backup.json",
+    backupMigrationId: 90,
+  },
+};
+
 describe("BackendStartupBlockDetector", () => {
   it("recognizes a live database owner across output chunks", () => {
     const detector = new BackendStartupBlockDetector();
@@ -30,6 +67,133 @@ describe("BackendStartupBlockDetector", () => {
     expect(detector.read()).toEqual({ kind: "migration-recovery-required" });
   });
 
+  it("extracts a divergence consent challenge across output chunks", () => {
+    const detector = new BackendStartupBlockDetector();
+    const serialized = serializeMigrationDivergenceConsentChallenge(divergenceChallenge);
+
+    detector.push(`MigrationDivergenceConsentRequiredError: blocked\n${serialized.slice(0, 80)}`);
+    detector.push(`${serialized.slice(80)}\n    at migrate`);
+
+    expect(detector.read()).toEqual({
+      kind: "migration-divergence-consent-required",
+      challenge: divergenceChallenge,
+    });
+  });
+
+  it("selects the final authoritative challenge from drained output", () => {
+    const detector = new BackendStartupBlockDetector();
+    const injectedWithoutToken = {
+      ...divergenceChallengeWithoutToken,
+      databasePath: "/injected/state.sqlite",
+      backupDirectory: "/injected/state.sqlite.backups",
+      recordedName: "InjectedMigration",
+    };
+    const injected = {
+      ...injectedWithoutToken,
+      consentToken: createMigrationDivergenceConsentToken(injectedWithoutToken),
+    };
+
+    detector.push(`${serializeMigrationDivergenceConsentChallenge(injected)}\n`);
+    detector.push(`${serializeMigrationDivergenceConsentChallenge(divergenceChallenge)}\n`);
+
+    expect(detector.read()).toEqual({
+      kind: "migration-divergence-consent-required",
+      challenge: divergenceChallenge,
+    });
+  });
+
+  it("decodes split UTF-8 independently for stdout and stderr", () => {
+    const detector = new BackendStartupBlockDetector();
+    const challengeWithoutToken = {
+      ...divergenceChallengeWithoutToken,
+      recordedName: "Migrazione cafè",
+    };
+    const challenge = {
+      ...challengeWithoutToken,
+      consentToken: createMigrationDivergenceConsentToken(challengeWithoutToken),
+    };
+    const bytes = Buffer.from(`${serializeMigrationDivergenceConsentChallenge(challenge)}\n`);
+    const splitAt = bytes.indexOf(Buffer.from("è")) + 1;
+
+    detector.push(Buffer.from("🙂").subarray(0, 1), "stdout");
+    detector.push(bytes.subarray(0, splitAt), "stderr");
+    detector.push(bytes.subarray(splitAt), "stderr");
+    detector.end("stderr");
+
+    expect(detector.read()).toEqual({
+      kind: "migration-divergence-consent-required",
+      challenge,
+    });
+  });
+
+  it("preserves a consent challenge larger than the general output buffer", () => {
+    const detector = new BackendStartupBlockDetector();
+    const challengeWithoutToken = {
+      ...divergenceChallengeWithoutToken,
+      recordedName:
+        `prefix-${serializeMigrationDivergenceConsentChallenge(divergenceChallenge)}-` +
+        "x".repeat(20_000),
+    };
+    const challenge = {
+      ...challengeWithoutToken,
+      consentToken: createMigrationDivergenceConsentToken(challengeWithoutToken),
+    };
+    const serialized = serializeMigrationDivergenceConsentChallenge(challenge);
+
+    detector.push(`MigrationDivergenceConsentRequiredError: blocked\n${serialized.slice(0, 100)}`);
+    detector.push(serialized.slice(100));
+
+    expect(detector.read()).toEqual({
+      kind: "migration-divergence-consent-required",
+      challenge,
+    });
+  });
+
+  it("recognizes a migration bundle identity mismatch", () => {
+    const detector = new BackendStartupBlockDetector();
+
+    detector.push(
+      "MigrationRuntimeIdentityMismatchError: desktop and server bundles were built from different migration sources\n",
+    );
+
+    expect(detector.read()).toEqual({ kind: "migration-runtime-identity-mismatch" });
+  });
+
+  it("extracts schema-too-new recovery before crash supervision retries", () => {
+    const detector = new BackendStartupBlockDetector();
+    const serialized = serializeMigrationSchemaTooNewStartupBlock(schemaTooNewBlock);
+
+    detector.push(`MigrationSchemaTooNewError: blocked\n${serialized.slice(0, 70)}`);
+    detector.push(`${serialized.slice(70)}\n    at migrate`);
+
+    expect(detector.read()).toEqual({ kind: "migration-schema-too-new", block: schemaTooNewBlock });
+  });
+
+  it("fails closed instead of retrying a malformed structured block", () => {
+    const detector = new BackendStartupBlockDetector();
+
+    detector.push("FORKARA_MIGRATION_SCHEMA_TOO_NEW={not-json}\n");
+
+    expect(detector.read()).toEqual({ kind: "migration-startup-block-invalid" });
+  });
+
+  it("rejects a valid structured block before parsing when it exceeds the safety cap", () => {
+    const detector = new BackendStartupBlockDetector();
+    const oversizedBlock: MigrationSchemaTooNewStartupBlock = {
+      ...schemaTooNewBlock,
+      recovery: {
+        kind: "restore-available",
+        backupPath: `/data/${"x".repeat(1_050_000)}.sqlite`,
+        provenancePath: "/data/state.sqlite.migration-backup.json",
+        backupMigrationId: 90,
+      },
+    };
+
+    detector.push(serializeMigrationSchemaTooNewStartupBlock(oversizedBlock));
+
+    expect(detector.read()).toEqual({ kind: "migration-startup-block-invalid" });
+  });
+
   it("ignores unrelated startup failures", () => {
     const detector = new BackendStartupBlockDetector();