80b3b6d917
Review findings applied across the group: - storage hub: stale disposers no longer remove a successor registration; the package now default-exports the Storage service class per the service-package export shape. - json backend: failed publishes roll back the authoritative memory state (a rejected write can no longer resurface via get() or ride the next publish); close() drains in-flight writes and blocks in-flight opens; double-open rejects as a plain caller error instead of malformed-medium. - sqlite backend: loadAll builds records on a null prototype (__proto__ keys round-trip instead of polluting), user_version is stamped only after the schema is fully created, and corrupt record JSON rejects as malformed-medium instead of a bare SyntaxError. - domain form: writes persist before mutating authoritative memory or emitting; DomainChanged is a put/deleted discriminated union. - workspace: attach/detach idempotence decided on the write chain (stale snapshots no longer short-circuit), create() requires a directory, and startup fails loud on duplicate stored paths. Eleven regression tests pin the fixed behaviors.
@deepseek-ai/dsh-storage-json
JSON backend for the storage hub: one human-readable <unit>.json file per unit under a configured root, registered as backend json. Design: domain KV storage Agent Note.
Model
- The in-memory unit state is authoritative; every write primitive republishes the whole file via temp-write + fsync + atomic
rename()replace. A unit file is always the complete current net state — legibility is this backend's reason to exist; scale is the SQLite backend's job. - A missing file opens as an empty unit and materializes on the first write. A foreign or unparsable file rejects with
malformed-medium; a stored version differing from the descriptor rejects withversion-mismatch(no migration, pre-release stance). - Write ordering across calls belongs to the caller (the domain layer's write chain); each single call is atomic and durable once resolved.
Config
| Key | Type | Default | Meaning |
|---|---|---|---|
root |
string | required — no default (a cwd fallback would scatter files) | Directory holding unit files; created 0o700 on demand |
Model Experience
No model-visible surface: this package serves host-side persistence only; nothing it does reaches prompts, tool schemas, or token budgets.
Known Limitations and Deferred Work
- Windows durability relies on libuv's
rename()(MoveFileExWwith replacement) without an explicit write-through flag; the session-log backend's stricter Win32 write-through publish helper is planned to move down here when the append-log facet lands (see the Agent Note's migration section). - No cross-process write locking: two processes writing the same root can interleave whole-file replacements (last write wins). Single-host-process deployments are the current consumer; the multi-process story is deferred per the Agent Note's out-of-scope table.