root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(FN-5627): close merger TOCTOU + add fast-path reachability gate

Browse Source 
The merger persisted `mergeConfirmed: true` + `commitSha` to the task row
as soon as the local squash commit was built, BEFORE running
`git update-ref refs/heads/<integration>` to actually advance the
integration branch. If the ref-advance then failed for any reason (lock
contention, hook rejection, packed-refs race, or a misclassified non-CAS
error via the merger-ref-update-advance.ts string heuristic), the task row
was poisoned: the auto-merge scheduler's mergeConfirmed fast-path would
silently promote the never-landed work to 'done' on the next tick,
including emitting task:merged and closing the linked GitHub tracking
issue. The 'expected SHA == observed SHA' log signature on FN-5625 was a
red herring — the ref-advance had failed for non-race reasons but the
string heuristic in merger-ref-update-advance.ts classified it as
'concurrent-advance', and the downstream IntegrationBranchConcurrentAdvanceError
routed through the unsafe 'merge already confirmed' recovery path.

This silently dropped real work on at least 9 tasks across 2026-05-27/28
(FN-5596, FN-5597, FN-5599, FN-5612, FN-5613, FN-5614, FN-5616, FN-5623,
FN-5625) and likely affected older now-archived tasks for which evidence
has been pruned.

Three-layer fix:

1. merger.ts (~9752): in reuseTaskWorktreeMerge mode, persist
   `mergeConfirmed: false` initially. After advanceIntegrationBranchRef
   returns advanced=true, do a follow-up updateTask to flip the flag.
   Other merge paths (legacy in-place, verified no-op fast-paths,
   owned-commit recovery) advance the ref BEFORE the mergeDetails write
   and remain unchanged.

2. project-engine.ts (~1378): defense-in-depth reachability gate on the
   auto-merge 'merge already confirmed' fast-path. Before moveTask to
   'done', verify `git merge-base --is-ancestor <commitSha>
   refs/heads/<integration>` succeeds. On failure, clear mergeConfirmed,
   set status='failed' with descriptive error, leave task in 'in-review',
   and emit `merger:fast-path-blocked-foreign-commit` run-audit event.
   Legitimate no-op merges (no commitSha) bypass the gate; ancient tasks
   missing mergeTargetBranch also bypass to avoid false-positive parks.

3. merger-ref-update-advance.ts (~189): replace fragile string heuristic
   ('is at' / 'expected' / 'cannot lock ref' in stderr) with structured
   detection. After update-ref fails, re-read the ref: if observed ==
   expected, classify as `ref-update-refused` (no race occurred); only
   classify as `concurrent-advance` when ref actually moved. Eliminates
   the misleading 'expected X observed X' same-SHA pair.

Tests: 3 new regression tests covering all three layers. Full engine
suite: 6150 tests pass.

Fixes:
- FN-5625 (autopilot validator trigger fix lost)
- FN-5623 (`fn goals` CLI lost)
- FN-5616 (source-issue close handlers lost)
- FN-5614 (`fn update` collision retry lost)
- FN-5613 (dashboard reload banner lost)
- FN-5612 (bundled-plugin-install lost)
- FN-5599 (tablet modal width lost)
- FN-5597 (ntfy notifier priority lost)
- FN-5596 (PR tab spacing test lost)

Fusion-Task-Id: FN-5627
This commit is contained in:
gsxdsm
2026-05-28 13:02:30 -07:00
parent 200dda95dc
commit b2d547eae5
7 changed files with 434 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
.changeset/FN-5627-merger-fast-path-toctou-fix.md Normal file
View File

@@ -0,0 +1,17 @@
---
"@runfusion/fusion": patch
---
fix(FN-5627): close TOCTOU window between merger optimistic `mergeConfirmed: true` write and integration ref advance, add reachability gate on auto-merge fast-path
The merger previously persisted `mergeConfirmed: true` + `commitSha` to the task row as soon as the local squash commit was built, **before** running `git update-ref refs/heads/<integration>` to actually advance the integration branch. If the ref-advance then failed for any reason (lock contention, hook rejection, packed-refs race, or a misclassified non-CAS error via the `merger-ref-update-advance.ts` string heuristic), the task row was poisoned: the auto-merge scheduler's `mergeConfirmed` fast-path would silently promote the never-landed work to `done` on the next tick, including emitting `task:merged` and closing the GitHub tracking issue.
This affected at least 9 tasks across 2026-05-27/28 (FN-5596, FN-5597, FN-5599, FN-5612, FN-5613, FN-5614, FN-5616, FN-5623, FN-5625) — the merger silently dropped real work and marked the tasks complete.
The fix has three layers:
1. **merger.ts** — In `reuseTaskWorktreeMerge` mode, persist `mergeConfirmed: false` initially. Promote to `true` only after `advanceIntegrationBranchRef` returns `advanced: true`. Other merge paths (legacy in-place merge, verified no-op fast-paths, owned-commit recovery) are unchanged because they advance the ref before this point.
2. **project-engine.ts** — Defense-in-depth reachability gate on the auto-merge "merge already confirmed" fast-path. Before `moveTask(taskId, "done")`, verify `git merge-base --is-ancestor <commitSha> <integrationBranch>` succeeds. On failure, clear `mergeConfirmed`, mark task `status: "failed"`, leave in `in-review`, and emit `merger:fast-path-blocked-foreign-commit` run-audit event. Legitimate no-op merges (no `commitSha`) bypass the gate.
3. **merger-ref-update-advance.ts** — Replace the fragile string heuristic that classified update-ref failures as `concurrent-advance` (matching `"is at"` / `"expected"` / `"cannot lock ref"` in error text) with structured detection. After update-ref fails, re-read the ref: if observed equals expected, classify as `ref-update-refused` (no actual race occurred). Eliminates the misleading "expected X observed X" same-SHA log signature seen on FN-5625.