Release M277.2

.github/workflows/build.yaml

@@ -24,7 +24,7 @@ permissions:
   checks: read
 
 env:
-  GIT_VERSION: ${{ github.event.inputs.git_version || 'v2.54.0.vfs.0.2' }}
+  GIT_VERSION: ${{ github.event.inputs.git_version || 'v2.54.0.vfs.0.4' }}
 
 jobs:
   validate:

AGENTS.md

@@ -166,6 +166,39 @@ Do not manually delete or re-run vcpkg unless you've changed an overlay
 port. If you've copied `out\` from another enlistment as a build-time
 shortcut, vcpkg results come along with it.
 
+## What ships in a public release
+
+The signed release pipeline builds several artifacts, but the **public GitHub
+release only carries the installer and symbols**: `SetupGVFS.<version>.exe`
+(per arch) and `Symbols.zip`.
+
+- **FastFetch is NOT shipped publicly.** `FastFetch.exe` is built and
+  ESRP-signed as a pipeline artifact, but it is not attached to the GitHub
+  release. Treat FastFetch-only changes as **non-shipping** when scoping a
+  release or writing changelog notes — they don't reach the installer end
+  users get.
+- **Git is NOT bundled.** VFS for Git does not ship Microsoft Git. PRs titled
+  "update default Microsoft Git version" change only the CI `GIT_VERSION` in
+  `.github/workflows/build.yaml` (used to install Git for build + functional
+  test runs) — they are **non-shipping**. The only shipped Git constraint is
+  the compiled `MinimumGitVersion` constant in `Version.props`, which is
+  changed separately and rarely.
+
+## Feature flags
+
+Product feature flags are **git config** keys under the `gvfs.` prefix (not a
+separate config system). To add one, mirror `gvfs.show-hydration-status`:
+
+- Declare the key name and default in `GVFS.Common/GVFSConstants.cs` under
+  `GitConfig` (e.g. `ShowHydrationStatus = GVFSPrefix + "show-hydration-status"`
+  and `ShowHydrationStatusDefault = false`).
+- Read it via `repo.GetConfigBoolOrDefault(name, default)` (or
+  `LibGit2RepoInvoker.GetConfigBoolOrDefault`) at the point of use.
+
+Default new gates to `false` and gate the **runtime entry point** into a
+feature, not its build, so the code still compiles and ships (and keeps
+getting exercised) while its behavior stays off by default.
+
 ## Coding standards
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for StyleCop rules, error-handling

GVFS/GVFS.Common/Database/SqliteErrorCodes.cs

@@ -22,13 +22,21 @@ public static class SqliteErrorCodes
         public const int NotADatabase = 26;
 
         /// <summary>
-        /// Returns true if the error code represents a transient condition
-        /// that may resolve on retry (I/O errors, locking contention).
+        /// Returns true if the error code represents a transient locking condition
+        /// that is safe to retry. Only BUSY and LOCKED qualify: both mean the operation
+        /// was blocked before executing and was never committed, so retrying is idempotent.
+        ///
+        /// SQLITE_IOERR is intentionally excluded. An I/O error can fire during connection
+        /// disposal AFTER a write has already committed (e.g. WAL flush on close). Retrying
+        /// in that case would re-execute the read phase on an already-empty table and return
+        /// stale results — a risk that exists in ExecuteReadThenWrite (RemoveAllEntriesForFolder).
+        /// IOERR on a genuinely failed write will have been rolled back by SQLite atomically,
+        /// but we cannot distinguish that case at the catch site without inspecting whether
+        /// the write had already committed. The safe choice is to surface IOERR immediately.
         /// </summary>
         public static bool IsTransientError(int sqliteErrorCode)
         {
-            return sqliteErrorCode == DiskIOError
-                || sqliteErrorCode == Busy
+            return sqliteErrorCode == Busy
                 || sqliteErrorCode == Locked;
         }
     }

GVFS/GVFS.Common/GVFSConstants.cs

@@ -29,6 +29,7 @@ public static class GitConfig
             public const string MaxRetriesConfig = GVFSPrefix + "max-retries";
             public const string TimeoutSecondsConfig = GVFSPrefix + "timeout-seconds";
             public const string GitStatusCacheBackoffConfig = GVFSPrefix + "status-cache-backoff-seconds";
+            public const string MaxActiveEnumerationsConfig = GVFSPrefix + "max-active-enumerations";
             public const string MountId = GVFSPrefix + "mount-id";
             public const string EnlistmentId = GVFSPrefix + "enlistment-id";
             public const string CacheServer = GVFSPrefix + "cache-server";
@@ -47,18 +48,32 @@ public static class GitConfig
             public const string ShowHydrationStatus = GVFSPrefix + "show-hydration-status";
             public const bool ShowHydrationStatusDefault = false;
 
+            /* Gates the CLI mount-progress display layer (progress phase strings surfaced
+             * over the named pipe during `gvfs mount`). Disabled by default so stabilization
+             * builds keep the reliability-relevant early-pipe infrastructure without shipping
+             * the newer progress-display behavior. The early pipe, HandleRequest Mounting
+             * guard, volatile currentState, and null-safe GetStatus are always on regardless. */
+            public const string MountProgress = GVFSPrefix + "mount-progress";
+            public const bool MountProgressDefault = false;
+
             public const string MaxHttpConnectionsConfig = GVFSPrefix + "max-http-connections";
 
             public const string PrefetchUseIdx = GVFSPrefix + "prefetch-use-idx";
             public const bool PrefetchUseIdxDefault = false;
+
+            /* Gates the background (fire-and-forget) auth + /gvfs/config behavior on
+             * mount when a cache server is configured locally. When false (default),
+             * mount blocks on auth/config synchronously before starting virtualization.
+             * When true, auth runs in the background so mount is not delayed. */
+            public const string BackgroundCacheAuth = GVFSPrefix + "background-cache-auth";
+            public const bool BackgroundCacheAuthDefault = false;
+
+            public const string PrefetchOffload = GVFSPrefix + "prefetch-offload";
+            public const bool PrefetchOffloadDefault = false;
         }
 
         public static class LocalGVFSConfig
         {
-            public const string UpgradeRing = "upgrade.ring";
-            public const string UpgradeFeedPackageName = "upgrade.feedpackagename";
-            public const string UpgradeFeedUrl = "upgrade.feedurl";
-            public const string OrgInfoServerUrl = "upgrade.orgInfoServerUrl";
             public const string USNJournalUpdates = "usn.updateDirectories";
         }
 
@@ -268,17 +283,5 @@ public static class Unmount
                 public const string SkipLock = "skip-wait-for-lock";
             }
         }
-
-        public static class UpgradeVerbMessages
-        {
-            public const string GVFSUpgrade = "`gvfs upgrade`";
-            public const string GVFSUpgradeDryRun = "`gvfs upgrade --dry-run`";
-            public const string NoUpgradeCheckPerformed = "No upgrade check was performed.";
-            public const string NoneRingConsoleAlert = "Upgrade ring set to \"None\". " + NoUpgradeCheckPerformed;
-            public const string NoRingConfigConsoleAlert = "Upgrade ring is not set. " + NoUpgradeCheckPerformed;
-            public const string InvalidRingConsoleAlert = "Upgrade ring set to unknown value. " + NoUpgradeCheckPerformed;
-            public const string SetUpgradeRingCommand = "To set or change upgrade ring, run `gvfs config " + LocalGVFSConfig.UpgradeRing + " [\"Fast\"|\"Slow\"|\"None\"]` from a command prompt.";
-            public const string UnmountRepoWarning = "Upgrade will unmount and remount gvfs repos, ensure you are at a stopping point.";
-        }
     }
 }

GVFS/GVFS.Common/GVFSJsonContext.cs

@@ -23,7 +23,6 @@ namespace GVFS.Common
     [JsonSerializable(typeof(List<string>))]
     [JsonSerializable(typeof(List<GitObjectsHttpRequestor.GitObjectSize>))]
     [JsonSerializable(typeof(ServerGVFSConfig))]
-    [JsonSerializable(typeof(VersionResponse))]
     [JsonSerializable(typeof(InternalVerbParameters))]
     [JsonSerializable(typeof(CacheServerInfo))]
     [JsonSerializable(typeof(NamedPipeMessages.GetStatus.Response), TypeInfoPropertyName = "GetStatusResponse")]

GVFS/GVFS.Common/GVFSLock.cs

@@ -47,7 +47,8 @@ public bool TryAcquireLockForExternalRequestor(
             // failure on OpenProcess for a different-integrity caller) we still accept the
             // lock and fall back to the legacy PID-only orphan check; record the fallback in
             // telemetry so we can spot if it becomes common.
-            long? requestorStartTime = GVFSPlatform.Instance.TryGetActiveProcessStartTime(requestor.PID, out long startTime)
+            long? requestorStartTime =
+                GVFSPlatform.Instance.TryGetActiveProcessStartTime(requestor.PID, out long startTime) == ProcessStartTimeResult.Success
                 ? startTime
                 : (long?)null;
             if (requestorStartTime == null)
@@ -215,6 +216,17 @@ private bool IsLockAvailable(bool checkExternalHolderOnly, out NamedPipeMessages
                     this.tracer.SetGitCommandSessionId(string.Empty);
                     existingExternalHolder = null;
                 }
+                else if (terminationReason == "StartTimeIndeterminate" && existingExternalHolder != null)
+                {
+                    // We could not determine whether the holder is still alive, so we deliberately
+                    // kept the lock rather than risk releasing one that is still held. Record it so
+                    // we can see whether these transient failures ever happen in the field (and,
+                    // if a holder ever gets stuck this way, why the lock was not released).
+                    EventMetadata metadata = new EventMetadata();
+                    metadata.Add("CurrentLockHolder", existingExternalHolder.ToString());
+                    metadata.Add("Reason", terminationReason);
+                    this.tracer.RelatedEvent(EventLevel.Verbose, "ExternalHolderLivenessIndeterminate", metadata);
+                }
 
                 return existingExternalHolder == null;
             }
@@ -460,17 +472,43 @@ public NamedPipeMessages.LockData GetExternalHolder(out bool externalHolderTermi
                     {
                         // Identity check: confirm the same process still owns this PID by comparing
                         // the OS-supplied process start time we captured at acquisition with the
-                        // current one. A mismatch means the original holder exited and Windows
-                        // recycled the PID to a different process (the bug this code fixes).
-                        if (!GVFSPlatform.Instance.TryGetActiveProcessStartTime(pid, out long currentStartTime))
+                        // current one. We only conclude the holder is gone (and release its lock)
+                        // when we have positive evidence, so that a transient failure to read the
+                        // start time can never release a lock that is still legitimately held.
+                        ProcessStartTimeResult result = GVFSPlatform.Instance.TryGetActiveProcessStartTime(pid, out long currentStartTime);
+                        switch (result)
                         {
-                            externalHolderTerminatedWithoutReleasingLock = true;
-                            terminationReason = "ProcessNotActive";
-                        }
-                        else if (currentStartTime != capturedStartTime)
-                        {
-                            externalHolderTerminatedWithoutReleasingLock = true;
-                            terminationReason = "PidRecycled";
+                            case ProcessStartTimeResult.Success when currentStartTime == capturedStartTime:
+                                // Same process, still alive. Keep the lock.
+                                break;
+
+                            case ProcessStartTimeResult.Success:
+                                // A different, still-running process now owns this PID: the original
+                                // holder exited and Windows recycled the PID (the bug this fixes).
+                                externalHolderTerminatedWithoutReleasingLock = true;
+                                terminationReason = "PidRecycled";
+                                break;
+
+                            case ProcessStartTimeResult.ProcessNotFound:
+                                // Positive evidence the holder is gone (no such PID, or it exited).
+                                externalHolderTerminatedWithoutReleasingLock = true;
+                                terminationReason = "ProcessExited";
+                                break;
+
+                            case ProcessStartTimeResult.Inaccessible:
+                                // We could open the holder at acquire time, and that access is stable
+                                // for the process's lifetime, so an access-denied result now means the
+                                // PID refers to a different process: the original holder is gone.
+                                externalHolderTerminatedWithoutReleasingLock = true;
+                                terminationReason = "HolderInaccessible";
+                                break;
+
+                            case ProcessStartTimeResult.Indeterminate:
+                            default:
+                                // We could not determine liveness (e.g. transient resource error).
+                                // Do NOT release: keep the lock and let the next poll re-evaluate.
+                                terminationReason = "StartTimeIndeterminate";
+                                break;
                         }
                     }
                     else

GVFS/GVFS.Common/GVFSPlatform.cs

@@ -68,16 +68,21 @@ public static void Register(GVFSPlatform platform)
         public abstract bool IsProcessActive(int processId);
 
         /// <summary>
-        /// Returns true and writes an opaque, OS-supplied process-identity token (e.g. process
-        /// creation time on Windows) when the process with the given PID is currently active.
-        /// The token has no meaning beyond identity comparison: two calls for the same underlying
-        /// process yield equal tokens, and a call after the OS has recycled the PID to a different
-        /// process yields a different token. Returns false (and startTime = 0) if the process
-        /// is no longer running, or if it could not be identified for any reason (e.g. permission
-        /// failure). Callers must treat a false return as "no identity information available" and
-        /// fall back to <see cref="IsProcessActive(int)"/> if they still need a liveness check.
+        /// Attempts to read an opaque, OS-supplied process-identity token (e.g. process creation
+        /// time on Windows) for the process with the given PID. The token has no meaning beyond
+        /// identity comparison: two calls for the same underlying process yield equal tokens, and
+        /// a call after the OS has recycled the PID to a different process yields a different token.
         /// </summary>
-        public abstract bool TryGetActiveProcessStartTime(int processId, out long startTime);
+        /// <param name="processId">The PID to inspect.</param>
+        /// <param name="startTime">The identity token, valid only when the result is <see cref="ProcessStartTimeResult.Success"/>.</param>
+        /// <returns>
+        /// A <see cref="ProcessStartTimeResult"/> describing the outcome. Callers making a
+        /// release-versus-hold decision about a lock holder must only treat
+        /// <see cref="ProcessStartTimeResult.ProcessNotFound"/> and
+        /// <see cref="ProcessStartTimeResult.Inaccessible"/> as evidence the original holder is gone;
+        /// <see cref="ProcessStartTimeResult.Indeterminate"/> means "unknown" and must not trigger a release.
+        /// </returns>
+        public abstract ProcessStartTimeResult TryGetActiveProcessStartTime(int processId, out long startTime);
 
         public abstract void IsServiceInstalledAndRunning(string name, out bool installed, out bool running);
         public abstract string GetNamedPipeName(string enlistmentRoot);