install: key npm cache entries by their integrity, derive URL-based cache names with SHA-256 - #37756
Closed
Jarred-Sumner wants to merge 10 commits into
Closed
install: key npm cache entries by their integrity, derive URL-based cache names with SHA-256#37756Jarred-Sumner wants to merge 10 commits into
Jarred-Sumner wants to merge 10 commits into
Claude / Claude Code Review
completed
Aug 12, 2026 in 16m 18s
Code review found 2 important issues
Found 1 candidates, confirmed 3. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | src/install/PackageManager/PackageManagerDirectories.rs:384-411 |
Concurrent bun installs race on /.id creation, orphaning fingerprinted entries |
Annotations
Check warning on line 411 in src/install/PackageManager/PackageManagerDirectories.rs
claude / Claude Code Review
Concurrent bun installs race on <cache>/.id creation, orphaning fingerprinted entries
The unconditional `sys::unlinkat(cache_dir.fd(), name)` between the failed read and the `O_CREAT|O_EXCL` open defeats `O_EXCL`'s atomicity: two concurrent `bun install`s initialising the same fresh cache directory can each unlink the other's just-created `.id` and both succeed at `O_EXCL`, so one process returns an id that never lands on disk and every entry it fingerprints this session is orphaned. Without the unlinkat the 2-iteration loop already converges (loser's `O_EXCL` EEXISTs, iteration
Loading