Repository navigation
fix(web): move spaces sync to the Nov 5 alpha so full repo downloads read again - #538
Merged
Merged
Conversation
Since the Nov 5 alpha (bluesky-social/atproto#5808) the hosted spaces alpha puts a control byte before each record in a STAR archive and ends the archive with another. The Oct 29 reader can't read that framing, so every full repo download failed with errors like "invalid record path: &", where the path it reports is really a length byte. This pins every @atproto and @atproto-labs package to 0.0.0-spaces-alpha-20261105160032. @atproto/space now depends on the new @atproto/star package, which joins the overrides: its caret range would otherwise resolve to 0.0.0-stage, which sorts above the alpha.
…n writers
isMacFailure counted every RepoVerificationError as a MAC failure. verifyRepoStar throws that error for an archive that doesn't parse as well as for a commit that fails its MAC, so a parse error got a KEM key refresh and a second download that couldn't help, and the log said the MAC didn't verify. A full download now reads the archive with readRepoStar and checks the commit with verifyCommit, throwing SpaceMacError as the oplog path does, and only SpaceMacError counts as a MAC failure. Anything else fails the repo with the reader's own message and goes through the usual retry and backoff.
A writer whose repo host answers RepoTakendown, RepoSuspended or RepoDeactivated is skipped: no fallback to a full download, and the pass doesn't fail on its account. The repo keeps its retry row, so it's tried again on the usual backoff and picked up once the account is back, and the system page shows the error on the space and on the repo. A repo that has never synced now gets a line of its own there too ("never synced" and its error), where before only the space's error said anything about it, and a repo's error is set off by " · " again. The same errors from getSpaceCredential or listRepos (bluesky-social/atproto#5810) mean the authority is taken down or deactivated, which only suspends the space. The pass stops as before and the local copy stays, now with tests that check it.
github-actions
Bot
added
documentation
bnb
approved these changes
Nov 9, 2026
Coverage Report for apps/web
File Coverage
SizeCompared with main. KiB are 1,024 bytes.
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Coverage Report for apps/localtoolbox
File CoverageNo changed files found.SizeCompared with main. KiB are 1,024 bytes.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production sync has been failing on full repo downloads from the hosted spaces alpha. The repos in the staff space (
at://did:plc:d42l64gsczg6qh2vo243xv5l/space/computer.localnetwork.space.staff/main) and an EPK space don't sync. A production sync of the staff space at 2026-11-09T19:31:30Z failed withRepoVerificationError: invalid NSID in record path: /, thrown from the Oct 29verifyRepoStarFull, and the EPK space fails withinvalid record path: &. The host already runs the Nov 5 alpha, whose STAR archives put a0x01byte before each record and end with0x00(atproto#5808). Our Oct 29 reader takes the0x01as a key length of one, so the "path" it reports is the real path's length byte (&is 38,/is 47). Reading a Nov 5 archive with both versions of@atproto/spacelocally gives the same error from the Oct 29 reader, and the Nov 5 reader returns the records.Changed
@atproto/*and@atproto-labs/*package, in apps/web and in the workspace overrides, moves from0.0.0-spaces-alpha-20261029171913to0.0.0-spaces-alpha-20261105160032.@atproto/staris new in this release and comes in through@atproto/space. It joins the overrides because its caret range would otherwise resolve to0.0.0-stage, which sorts above the alpha. Our code doesn't import any of the STAR exports the Nov 5 migration notes move or remove, so the upgrade needs no import changes.isMacFailureinapps/web/src/lib/server/atproto/credentials.tsnow counts onlySpaceMacError. It used to count everyRepoVerificationError, whichverifyRepoStarthrows both for a commit that fails its MAC and for an archive that doesn't parse. So a parse error got logged as "MAC did not verify; retrying with a refreshed KEM key", followed by a second download that couldn't help. A full download inapps/web/src/lib/server/sync/engine.tsnow reads the archive withreadRepoStarand checks the commit withverifyCommit, throwingSpaceMacErrorthe way the oplog path already did. Any other failure fails the repo with the reader's own message and goes through the existing retry and backoff.RepoTakendown,RepoSuspendedorRepoDeactivatedis skipped. There's no fallback to a full download, and the pass no longer fails on its account. The repo keeps its retry row, so it's tried again on the usual backoff and picked up once the account is back. /admin/system shows the error on the space and on the repo.SpaceSyncer.status()adds those repos fromsyncRepoRetry, with no rev or sync time. A repo's error also gets its " · " separator back: Svelte trimmed the leading space inside the span, so a synced repo with an error read@ rev· error.Added
RepoTakendownorRepoDeactivatedfromlistReposorgetSpaceCredentialkeeps its local copy (atproto#5810: that only suspends the space). That last behaviour already worked and had no tests. Two more tests cover the system page: one thatstatus()reports a repo that never synced, and one for the page lines of a synced repo and a never-synced one with its error.Removed
RepoVerificationErrorimport fromcredentials.tsand theverifyRepoStarFullcall in the engine.The live host wasn't checked from a local server. Reading a production space needs the production root account's session, and a pass also calls
registerNotify, so there's no read-only way to run one against it.Fixes LOC-271