@4pm/cli 0.2.2 → 0.3.1

package/dist/index.js

@@ -3725,18 +3725,41 @@ import {
   chmodSync,
   existsSync as existsSync2,
   readFileSync as readFileSync2,
-  rmSync,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 
 // src/config/profile.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
 var DEFAULT_PROFILE = "default";
-function resolveProfile(args) {
+function defaultPointerPath() {
+  return join(homedir(), ".4pm", "default");
+}
+function defaultProfileName() {
+  try {
+    const userId = readFileSync(defaultPointerPath(), "utf8").trim();
+    if (userId) return userId;
+  } catch {
+  }
+  return DEFAULT_PROFILE;
+}
+function writeDefaultProfile(userId) {
+  mkdirSync(join(homedir(), ".4pm"), { recursive: true });
+  writeFileSync(defaultPointerPath(), userId, "utf8");
+}
+function clearDefaultProfileIf(name) {
+  try {
+    if (readFileSync(defaultPointerPath(), "utf8").trim() === name) {
+      rmSync(defaultPointerPath(), { force: true });
+    }
+  } catch {
+  }
+}
+function resolveProfileArg(args) {
   const index = args.indexOf("--profile");
   if (index >= 0) {
     const name = args[index + 1];
@@ -3746,7 +3769,7 @@ function resolveProfile(args) {
     const rest = [...args.slice(0, index), ...args.slice(index + 2)];
     return [name, rest];
   }
-  return [process.env.FOURPM_PROFILE ?? DEFAULT_PROFILE, args];
+  return [process.env.FOURPM_PROFILE ?? null, args];
 }
 function profileDir(name) {
   const dir = join(homedir(), ".4pm", "profiles", name);
@@ -3777,7 +3800,7 @@ function readCredential(profileDir2, profileName) {
           readFileSync2(LEGACY_CRE_PATH, "utf8")
         );
         writeCredential(profileDir2, legacy);
-        rmSync(LEGACY_CRE_PATH, { force: true });
+        rmSync2(LEGACY_CRE_PATH, { force: true });
         return legacy;
       } catch {
         return null;
@@ -3797,7 +3820,7 @@ function writeCredential(profileDir2, credential) {
   chmodSync(path, 384);
 }
 function deleteCredential(profileDir2) {
-  rmSync(credentialPath(profileDir2), { force: true });
+  rmSync2(credentialPath(profileDir2), { force: true });
 }
 
 // src/core/fingerprint.ts
@@ -3884,15 +3907,17 @@ async function fetchCliVersion(serverUrl) {
 }
 
 // src/commands/link.ts
-async function runLink(serverUrl, profileDir2, profileName) {
-  if (readCredential(profileDir2, profileName)) {
+async function runLink(serverUrl, explicitProfile) {
+  const currentName = explicitProfile ?? defaultProfileName();
+  if (readCredential(profileDir(currentName), currentName)) {
+    const flag = explicitProfile ? ` --profile ${explicitProfile}` : "";
     console.log(
-      `Profile "${profileName}" is already linked (.cre). Run \`4pm unlink --profile ${profileName}\` first if you want to pair again.`
+      `Profile "${currentName}" is already linked (.cre). Run \`4pm unlink${flag}\` first if you want to pair again.`
     );
     return;
   }
   const hashcode1 = randomBytes(32).toString("hex");
-  console.log(`\u2500\u2500 4PM cli pairing (profile: ${profileName}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
+  console.log(`\u2500\u2500 4PM cli pairing (profile: ${explicitProfile ?? "default"}) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500`);
   console.log("1. Open the 4PM web \u2192 /machines, enter hashcode (1):");
   console.log(`
    ${hashcode1}
@@ -3901,15 +3926,23 @@ async function runLink(serverUrl, profileDir2, profileName) {
   const rl = createInterface({ input: process.stdin, output: process.stdout });
   const hashcode2 = (await rl.question("hashcode (2): ")).trim();
   rl.close();
-  const { hashcode3 } = await confirmPairing(serverUrl, hashcode2, collectFingerprint());
-  writeCredential(profileDir2, {
+  const { hashcode3, userId, username } = await confirmPairing(
+    serverUrl,
+    hashcode2,
+    collectFingerprint()
+  );
+  const profileName = explicitProfile ?? userId;
+  writeCredential(profileDir(profileName), {
     serverUrl,
     hashcode3,
     scope: "unknown",
     // scope is decided by the server based on the pairing user (ADR-0010)
     pairedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  console.log("\u2714 Linked successfully \u2014 saved .cre. Run `4pm start` to connect.");
+  if (!explicitProfile) writeDefaultProfile(userId);
+  console.log(
+    `\u2714 Linked successfully as "${username}" \u2014 saved .cre. Run \`4pm start\` to connect.`
+  );
 }
 
 // src/commands/start.ts
@@ -3930,7 +3963,7 @@ MCowBQYDK2VwAyEARlfzjaFhe5bhRrMp/ZuH6sVqg/S7f8B1dliuF21iDTw=
 `;
 
 // src/version.ts
-var CLI_VERSION = "0.2.2";
+var CLI_VERSION = "0.3.1";
 
 // src/core/update.ts
 function compareSemver(a, b) {
@@ -4074,6 +4107,7 @@ var Role = {
 };
 var ALL_ROLES = Object.values(Role);
 var EXCLUSIVE_ROLES = [Role.ADMIN, Role.MACHINE];
+var PM_GRANTABLE_ROLES = [Role.SA_SE, Role.QA, Role.BA];
 
 // ../../22-packages/11-shared/11-constants/src/permissions.ts
 var PermissionCode = {
@@ -4260,6 +4294,13 @@ var SELF_SERVICE_CODES = [
   P.USER_READ_SELF,
   P.NOTIFICATION_READ
 ];
+var ADMIN_ONLY_CODES = [
+  P.ORG_READ,
+  P.ORG_UPDATE,
+  P.ORG_DELETE,
+  P.BILLING_READ,
+  P.BILLING_MANAGE
+];
 var TEAM_GRANTABLE_CODES = [
   P.TEAM_READ,
   P.TEAM_UPDATE,
@@ -4302,10 +4343,11 @@ var PROJECT_GRANTABLE_CODES = [
   P.MACHINE_PHYSIC_MANAGE
 ];
 var SELF_SERVICE_SET = new Set(SELF_SERVICE_CODES);
+var ADMIN_ONLY_SET = new Set(ADMIN_ONLY_CODES);
 var TEAM_GRANTABLE_SET = new Set(TEAM_GRANTABLE_CODES);
 var PROJECT_GRANTABLE_SET = new Set(PROJECT_GRANTABLE_CODES);
 function grantSubjectsFor(code) {
-  if (SELF_SERVICE_SET.has(code)) return [];
+  if (SELF_SERVICE_SET.has(code) || ADMIN_ONLY_SET.has(code)) return [];
   const subjects = [GrantSubjectType.USER];
   if (TEAM_GRANTABLE_SET.has(code)) subjects.push(GrantSubjectType.TEAM);
   if (PROJECT_GRANTABLE_SET.has(code)) subjects.push(GrantSubjectType.PROJECT);
@@ -4835,6 +4877,7 @@ async function addProject(payload, onProgress) {
 
 // src/core/ws-client.ts
 var HEARTBEAT_MS = 3e4;
+var MAX_HASHCODE_INVALID_RETRIES = 5;
 var CLOSE_DRAINING = 4001;
 var OFFLINE_BUFFER_MAX_BYTES = 512 * 1024;
 var WsClient = class {
@@ -4859,16 +4902,32 @@ var WsClient = class {
    * Main lifecycle: connect + reconnect backoff until revoked.
    */
   async run() {
+    let hashcodeInvalidStreak = 0;
     for (let attempt = 0; !this.stopped; attempt++) {
       try {
         await this.connectOnce();
         attempt = 0;
+        hashcodeInvalidStreak = 0;
       } catch (err) {
-        if (err instanceof CliApiError && ["HASHCODE_INVALID", "HASHCODE_EXPIRED", "LINK_REVOKED"].includes(err.errorCode)) {
-          this.logout(err.errorCode);
-          return;
+        if (err instanceof CliApiError) {
+          if (["HASHCODE_EXPIRED", "LINK_REVOKED"].includes(err.errorCode)) {
+            this.logout(err.errorCode);
+            return;
+          }
+          if (err.errorCode === "HASHCODE_INVALID") {
+            if (++hashcodeInvalidStreak > MAX_HASHCODE_INVALID_RETRIES) {
+              this.logout(err.errorCode);
+              return;
+            }
+            console.warn(
+              `Token request rejected (HASHCODE_INVALID) \u2014 retrying (${hashcodeInvalidStreak}/${MAX_HASHCODE_INVALID_RETRIES}).`
+            );
+          } else {
+            console.error(`Connection error: ${err}`);
+          }
+        } else {
+          console.error(`Connection error: ${err}`);
         }
-        console.error(`Connection error: ${err}`);
       }
       if (this.stopped) return;
       const wait = backoffJitterMs(Math.min(attempt, 6), 1e3, 6e4);
@@ -4946,6 +5005,14 @@ var WsClient = class {
           this.socket?.close();
           return;
         }
+        if (message.errorCode === "SESSION_REPLACED") {
+          this.stopped = true;
+          console.error(
+            "Another session for this profile took over \u2014 this instance is stopping. (Are you running `4pm start` twice for the same profile?)"
+          );
+          this.socket?.close();
+          return;
+        }
         console.warn(`Server reported an error: ${message.errorCode}`);
         this.socket?.close();
         return;
@@ -5149,6 +5216,41 @@ var WsClient = class {
   }
 };
 
+// src/core/instance-lock.ts
+import { readFileSync as readFileSync5, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
+function lockPath(profileDir2) {
+  return join6(profileDir2, "start.lock");
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function lockHolder(profileDir2) {
+  try {
+    const pid = Number.parseInt(readFileSync5(lockPath(profileDir2), "utf8").trim(), 10);
+    if (Number.isInteger(pid) && pid > 0 && isAlive(pid)) return pid;
+  } catch {
+  }
+  return null;
+}
+function acquireInstanceLock(profileDir2) {
+  if (lockHolder(profileDir2) !== null) return false;
+  writeFileSync5(lockPath(profileDir2), String(process.pid), "utf8");
+  return true;
+}
+function releaseInstanceLock(profileDir2) {
+  try {
+    const pid = Number.parseInt(readFileSync5(lockPath(profileDir2), "utf8").trim(), 10);
+    if (pid === process.pid) rmSync3(lockPath(profileDir2), { force: true });
+  } catch {
+  }
+}
+
 // src/commands/start.ts
 async function runStart(profileDir2, profileName) {
   const credential = readCredential(profileDir2, profileName);
@@ -5178,13 +5280,28 @@ async function runStart(profileDir2, profileName) {
     child.on("exit", (code) => process.exit(code ?? 0));
     return;
   }
-  initCommandHistory(profileDir2, profileName, config.commandHistoryUploadMinutes ?? 10);
-  console.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
-  await new WsClient({
-    credential,
-    machine: collectFingerprint(),
-    profileDir: profileDir2
-  }).run();
+  if (!acquireInstanceLock(profileDir2)) {
+    console.error(
+      `Profile "${profileName}" is already running (pid ${lockHolder(profileDir2)}). Only one \`4pm start\` per profile is allowed.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const release = () => releaseInstanceLock(profileDir2);
+  process.once("exit", release);
+  process.once("SIGINT", () => process.exit(0));
+  process.once("SIGTERM", () => process.exit(0));
+  try {
+    initCommandHistory(profileDir2, profileName, config.commandHistoryUploadMinutes ?? 10);
+    console.log(`Connecting to ${credential.serverUrl} (profile: ${profileName})\u2026`);
+    await new WsClient({
+      credential,
+      machine: collectFingerprint(),
+      profileDir: profileDir2
+    }).run();
+  } finally {
+    release();
+  }
 }
 
 // src/commands/unlink.ts
@@ -5194,6 +5311,7 @@ function runUnlink(profileDir2, profileName) {
     return;
   }
   deleteCredential(profileDir2);
+  clearDefaultProfileIf(profileName);
   console.log("\u2714 Deleted .cre \u2014 revoke the server-side link at web /machines.");
 }
 
@@ -5244,30 +5362,37 @@ function flagValue(args, name) {
   return index >= 0 ? args[index + 1] : void 0;
 }
 async function main() {
-  const [profileName, args] = resolveProfile(process.argv.slice(2));
+  const [explicitProfile, args] = resolveProfileArg(process.argv.slice(2));
   const [command, ...rest] = args;
-  const dir = profileDir(profileName);
   switch (command) {
     case "link": {
       const serverUrl = flagValue(rest, "server") ?? process.env.FOURPM_SERVER ?? "http://localhost:3001";
-      await runLink(serverUrl.replace(/\/$/, ""), dir, profileName);
+      await runLink(serverUrl.replace(/\/$/, ""), explicitProfile);
       break;
     }
-    case "start":
-      await runStart(dir, profileName);
+    case "start": {
+      const name = explicitProfile ?? defaultProfileName();
+      await runStart(profileDir(name), name);
       break;
-    case "unlink":
-      runUnlink(dir, profileName);
+    }
+    case "unlink": {
+      const name = explicitProfile ?? defaultProfileName();
+      runUnlink(profileDir(name), name);
       break;
+    }
     case "version":
     case "--version":
-    case "-v":
-      await runVersion(dir, profileName, flagValue(rest, "server"));
+    case "-v": {
+      const name = explicitProfile ?? defaultProfileName();
+      await runVersion(profileDir(name), name, flagValue(rest, "server"));
       break;
+    }
     case "update":
-    case "upgrade":
-      await runUpdate(dir, profileName, flagValue(rest, "server"));
+    case "upgrade": {
+      const name = explicitProfile ?? defaultProfileName();
+      await runUpdate(profileDir(name), name, flagValue(rest, "server"));
       break;
+    }
     default:
       console.log(
         [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4pm/cli",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "private": false,
   "description": "4PM CLI — drives Claude/Codex CLIs on AI worker machines (Node + TypeScript)",
   "type": "module",