@aopslabs/aops 0.3.16 → 0.3.17

package/dist/utils/chatv3-session-store.js

@@ -1,10 +1,32 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import { getAopsCliConfigFilePath } from './config.js';
 import { decryptWithPassword, encryptWithPassword, } from './password-crypto.js';
+export class Chatv3SessionCryptoError extends Error {
+    storePath;
+    secretPath;
+    sessionId;
+    field;
+    constructor(args) {
+        super([
+            `ChatV3 session "${args.sessionId}" could not be decrypted (field: ${args.field}).`,
+            `Session store: ${args.storePath}`,
+            `At-rest key: ${args.secretPath}`,
+            'The record was encrypted with a different at-rest key than the one on disk',
+            '(older CLI versions could overwrite session.key during a concurrent first save).',
+            'Repair: delete the saved session with "aops chat session forget --session <id>" and re-join the channel with the same handle.',
+        ].join(' '), { cause: args.cause instanceof Error ? args.cause : undefined });
+        this.name = 'Chatv3SessionCryptoError';
+        this.storePath = args.storePath;
+        this.secretPath = args.secretPath;
+        this.sessionId = args.sessionId;
+        this.field = args.field;
+    }
+}
 const STORE_FILENAME = 'chatv3-sessions.json';
 const SECRET_FILENAME = 'chatv3-session.key';
 const OWNER_STORE_DIRECTORY = 'chatv3';
@@ -102,34 +124,390 @@ async function readStore(storePath, owner) {
         throw error;
     }
 }
+function sleepMs(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const STORE_RENAME_RETRY_ATTEMPTS = 12;
 async function writeStore(storePath, store) {
     await ensureDir(storePath);
-    await fs.writeFile(storePath, `${JSON.stringify(store, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    const tempPath = `${storePath}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    await fs.writeFile(tempPath, `${JSON.stringify(store, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    let lastError;
+    for (let attempt = 0; attempt < STORE_RENAME_RETRY_ATTEMPTS; attempt += 1) {
+        try {
+            await fs.rename(tempPath, storePath);
+            lastError = undefined;
+            break;
+        }
+        catch (error) {
+            const code = error.code;
+            lastError = error;
+            if (code !== 'EPERM' && code !== 'EACCES' && code !== 'EBUSY')
+                break;
+            await sleepMs(15 + attempt * 15);
+        }
+    }
+    if (lastError) {
+        await fs.rm(tempPath, { force: true }).catch(() => undefined);
+        throw lastError;
+    }
     await enforceOwnerOnlyFileMode(storePath);
 }
+const STORE_LOCK_STALE_MS = 15_000;
+const STORE_LOCK_LIVE_TAKEOVER_MS = 600_000;
+const STORE_LOCK_TIMEOUT_MS = 20_000;
+function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function parseStoreLockHolder(raw) {
+    if (raw === undefined)
+        return undefined;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function restoreForeignLock(claimPath, lockPath) {
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+        try {
+            await fs.link(claimPath, lockPath);
+            await fs.rm(claimPath, { force: true }).catch(() => undefined);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'EEXIST')
+                return;
+            if (!isTransientFsError(error))
+                return;
+            await sleepMs(10 + attempt * 10);
+        }
+    }
+}
+async function reapStaleLock(lockPath, expectedRaw) {
+    const claimPath = `${lockPath}.reap-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+    try {
+        await fs.rename(lockPath, claimPath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT' || isTransientFsError(error))
+            return;
+        throw error;
+    }
+    const claimedRaw = await fs.readFile(claimPath, 'utf8').catch(() => undefined);
+    if (expectedRaw !== undefined && claimedRaw !== undefined && claimedRaw !== expectedRaw) {
+        await restoreForeignLock(claimPath, lockPath);
+        return;
+    }
+    await fs.rm(claimPath, { force: true }).catch(() => undefined);
+}
+async function releaseOwnedStoreLock(lockPath, token) {
+    const claimPath = `${lockPath}.rel-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+    try {
+        await fs.rename(lockPath, claimPath);
+    }
+    catch {
+        return;
+    }
+    const holder = parseStoreLockHolder(await fs.readFile(claimPath, 'utf8').catch(() => undefined));
+    if (holder?.token === token) {
+        await fs.rm(claimPath, { force: true }).catch(() => undefined);
+        return;
+    }
+    await restoreForeignLock(claimPath, lockPath);
+}
+const UV_FS_O_EXLOCK_WIN32 = 0x10000000;
+const DARWIN_O_EXLOCK = 0x20;
+const DARWIN_O_NONBLOCK = 0x0004;
+const EXCLUSIVE_LOCK_CONTENTION_CODES = new Set(['EBUSY', 'EAGAIN', 'EWOULDBLOCK', 'EPERM', 'EACCES', 'ETXTBSY']);
+export function getChatv3SessionStoreLockStrategy() {
+    if (process.platform === 'win32')
+        return 'kernel-exclusive-handle';
+    if (process.platform === 'darwin')
+        return 'kernel-flock-handle';
+    if (process.platform === 'linux')
+        return 'kernel-abstract-socket';
+    return 'token-file';
+}
+async function acquireAbstractSocketLock(storePath, timeoutMs) {
+    const name = `\0aops-chatv3-store-lock-${crypto
+        .createHash('sha256')
+        .update(path.resolve(storePath))
+        .digest('hex')
+        .slice(0, 32)}`;
+    const deadline = Date.now() + timeoutMs;
+    let delay = 10;
+    for (;;) {
+        try {
+            const server = await new Promise((resolve, reject) => {
+                const candidate = net.createServer();
+                candidate.once('error', reject);
+                candidate.listen({ path: name }, () => {
+                    candidate.removeListener('error', reject);
+                    resolve(candidate);
+                });
+            });
+            let released = false;
+            return async () => {
+                if (released)
+                    return;
+                released = true;
+                await new Promise((resolve) => server.close(() => resolve()));
+            };
+        }
+        catch (error) {
+            const code = String(error.code);
+            if (code !== 'EADDRINUSE')
+                throw error;
+            if (Date.now() > deadline) {
+                throw new Error(`ChatV3 session store lock timeout: the abstract-socket lock for ${storePath} is held by a live process (kernel lock); retry after it finishes.`);
+            }
+            await sleepMs(delay + Math.floor(Math.random() * 10));
+            delay = Math.min(delay * 2, 250);
+        }
+    }
+}
+function exclusiveOpenFlags() {
+    if (process.platform === 'win32') {
+        return fsSync.constants.O_RDWR | fsSync.constants.O_CREAT | UV_FS_O_EXLOCK_WIN32;
+    }
+    const exlock = fsSync.constants.O_EXLOCK ?? DARWIN_O_EXLOCK;
+    const nonblock = fsSync.constants.O_NONBLOCK ?? DARWIN_O_NONBLOCK;
+    return fsSync.constants.O_RDWR | fsSync.constants.O_CREAT | exlock | nonblock;
+}
+async function acquireExclusiveHandleLock(lockPath, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    let delay = 10;
+    for (;;) {
+        try {
+            const handle = await fs.open(lockPath, exclusiveOpenFlags(), 0o600);
+            await handle.truncate(0).catch(() => undefined);
+            await handle
+                .write(`${JSON.stringify({ pid: process.pid, at: Date.now() })}\n`)
+                .catch(() => undefined);
+            let released = false;
+            return async () => {
+                if (released)
+                    return;
+                released = true;
+                await handle.close().catch(() => undefined);
+            };
+        }
+        catch (error) {
+            const code = String(error.code);
+            if (!EXCLUSIVE_LOCK_CONTENTION_CODES.has(code))
+                throw error;
+            if (Date.now() > deadline) {
+                const holderRaw = await fs.readFile(lockPath, 'utf8').catch(() => undefined);
+                const holder = parseStoreLockHolder(holderRaw);
+                throw new Error(`ChatV3 session store lock timeout: ${lockPath} is exclusively held by a live process${holder?.pid ? ` (pid ${holder.pid})` : ''} (kernel lock); retry after it finishes.`);
+            }
+            await sleepMs(delay + Math.floor(Math.random() * 10));
+            delay = Math.min(delay * 2, 250);
+        }
+    }
+}
+export async function acquireChatv3SessionStoreLock(storePath, options = {}) {
+    const timeoutMs = options.timeoutMs ?? STORE_LOCK_TIMEOUT_MS;
+    const staleMs = options.staleMs ?? STORE_LOCK_STALE_MS;
+    const liveTakeoverMs = options.liveTakeoverMs ?? STORE_LOCK_LIVE_TAKEOVER_MS;
+    const strategy = getChatv3SessionStoreLockStrategy();
+    if (strategy === 'kernel-abstract-socket') {
+        return acquireAbstractSocketLock(storePath, timeoutMs);
+    }
+    const lockPath = `${storePath}.lock`;
+    await ensureDir(lockPath);
+    if (strategy !== 'token-file') {
+        return acquireExclusiveHandleLock(lockPath, timeoutMs);
+    }
+    const token = crypto.randomUUID();
+    const deadline = Date.now() + timeoutMs;
+    let delay = 10;
+    for (;;) {
+        const payload = `${JSON.stringify({ token, pid: process.pid, at: Date.now() })}\n`;
+        try {
+            await fs.writeFile(lockPath, payload, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            return async () => releaseOwnedStoreLock(lockPath, token);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST') {
+                if (!isTransientFsError(error))
+                    throw error;
+                if (Date.now() > deadline) {
+                    throw new Error(`ChatV3 session store lock timeout: ${lockPath} could not be opened (${code}); delete the file if its holder is gone.`);
+                }
+                await sleepMs(delay + Math.floor(Math.random() * 10));
+                delay = Math.min(delay * 2, 250);
+                continue;
+            }
+        }
+        let holderRaw;
+        let holderReadExhausted = false;
+        try {
+            holderRaw = await readFileWithTransientRetry(lockPath);
+        }
+        catch (error) {
+            if (!isTransientFsError(error))
+                throw error;
+            holderReadExhausted = true;
+        }
+        if (holderReadExhausted) {
+            if (Date.now() > deadline) {
+                throw new Error(`ChatV3 session store lock timeout: ${lockPath} could not be read; delete the file if its holder is gone.`);
+            }
+            await sleepMs(delay + Math.floor(Math.random() * 10));
+            delay = Math.min(delay * 2, 250);
+            continue;
+        }
+        if (holderRaw === undefined)
+            continue;
+        const holder = parseStoreLockHolder(holderRaw);
+        let reapEligible;
+        if (!holder) {
+            const stats = await fs.stat(lockPath).catch(() => null);
+            reapEligible = !stats || Date.now() - stats.mtimeMs > staleMs;
+        }
+        else {
+            const age = Date.now() - (typeof holder.at === 'number' ? holder.at : 0);
+            reapEligible = isProcessAlive(holder.pid ?? -1) ? age > liveTakeoverMs : true;
+        }
+        if (reapEligible) {
+            await reapStaleLock(lockPath, holderRaw);
+            continue;
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`ChatV3 session store lock timeout: ${lockPath} is held by pid ${holder?.pid ?? 'unknown'}; delete the file if that process is gone.`);
+        }
+        await sleepMs(delay + Math.floor(Math.random() * 10));
+        delay = Math.min(delay * 2, 250);
+    }
+}
+const storeWriteLocks = new Map();
+async function withStoreLock(storePath, run) {
+    const key = path.resolve(storePath);
+    const task = async () => {
+        const release = await acquireChatv3SessionStoreLock(storePath);
+        try {
+            return await run();
+        }
+        finally {
+            await release();
+        }
+    };
+    const previous = storeWriteLocks.get(key) ?? Promise.resolve();
+    const next = previous.then(task, task);
+    storeWriteLocks.set(key, next.then(() => undefined, () => undefined));
+    return next;
+}
+const TRANSIENT_FS_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+function isTransientFsError(error) {
+    return TRANSIENT_FS_CODES.has(String(error?.code));
+}
+async function readFileWithTransientRetry(filePath) {
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            return await fs.readFile(filePath, 'utf8');
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 'ENOENT')
+                return undefined;
+            if (!isTransientFsError(error) || attempt >= 8)
+                throw error;
+            await sleepMs(10 + attempt * 10);
+        }
+    }
+}
+async function readExistingSessionSecret(secretPath) {
+    const raw = await readFileWithTransientRetry(secretPath);
+    const secret = raw === undefined ? undefined : normalizeNonEmpty(raw);
+    if (secret) {
+        await enforceOwnerOnlyFileMode(secretPath);
+        return secret;
+    }
+    return undefined;
+}
+async function mintSessionSecret(secretPath) {
+    const secret = crypto.randomBytes(32).toString('base64');
+    await ensureDir(secretPath);
+    const tempPath = `${secretPath}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    await fs.writeFile(tempPath, `${secret}\n`, { encoding: 'utf8', mode: 0o600 });
+    try {
+        for (let attempt = 0;; attempt += 1) {
+            try {
+                await fs.link(tempPath, secretPath);
+                await enforceOwnerOnlyFileMode(secretPath);
+                return secret;
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'EEXIST') {
+                    if (isTransientFsError(error) && attempt < 20) {
+                        await sleepMs(10 + attempt * 10);
+                        continue;
+                    }
+                    throw error;
+                }
+            }
+            const existing = await readExistingSessionSecret(secretPath);
+            if (existing)
+                return existing;
+            const claimPath = `${secretPath}.bad-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
+            try {
+                await fs.rename(secretPath, claimPath);
+            }
+            catch (error) {
+                const code = error.code;
+                if (code !== 'ENOENT' && !isTransientFsError(error))
+                    throw error;
+                await sleepMs(10);
+                continue;
+            }
+            const claimedRaw = await fs.readFile(claimPath, 'utf8').catch(() => undefined);
+            if (claimedRaw !== undefined && normalizeNonEmpty(claimedRaw)) {
+                await restoreForeignLock(claimPath, secretPath);
+                const adopted = await readExistingSessionSecret(secretPath);
+                if (adopted)
+                    return adopted;
+                continue;
+            }
+            await fs.rm(claimPath, { force: true }).catch(() => undefined);
+        }
+    }
+    finally {
+        await fs.rm(tempPath, { force: true }).catch(() => undefined);
+    }
+}
+const pendingSecretResolutions = new Map();
 async function resolveSessionSecret(secretPath) {
     const envSecret = normalizeNonEmpty(process.env.AOPS_CHATV3_SESSION_SECRET) ??
         normalizeNonEmpty(process.env.AOPS_MCP_TOKEN_SECRET) ??
         normalizeNonEmpty(process.env.AOPS_MCP_CONFIG_SECRET);
     if (envSecret)
         return envSecret;
+    const cacheKey = path.resolve(secretPath);
+    const pending = pendingSecretResolutions.get(cacheKey);
+    if (pending)
+        return pending;
+    const resolution = (async () => (await readExistingSessionSecret(secretPath)) ?? mintSessionSecret(secretPath))();
+    pendingSecretResolutions.set(cacheKey, resolution);
     try {
-        const raw = await fs.readFile(secretPath, 'utf8');
-        const secret = normalizeNonEmpty(raw);
-        if (secret) {
-            await enforceOwnerOnlyFileMode(secretPath);
-            return secret;
-        }
+        return await resolution;
     }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
+    finally {
+        pendingSecretResolutions.delete(cacheKey);
     }
-    const secret = crypto.randomBytes(32).toString('base64');
-    await ensureDir(secretPath);
-    await fs.writeFile(secretPath, `${secret}\n`, { encoding: 'utf8', mode: 0o600 });
-    await enforceOwnerOnlyFileMode(secretPath);
-    return secret;
 }
 function encodeEncryptedPayload(payload) {
     return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
@@ -154,34 +532,44 @@ async function encryptEpochKeys(keys, secretPath) {
 }
 async function decryptEpochKeys(keys, secretPath) {
     if (!keys || keys.length === 0)
-        return undefined;
-    return Promise.all(keys.map(async ({ rawEpochKeyEnc, ...rest }) => ({
-        ...rest,
-        rawEpochKey: await decryptSecret(rawEpochKeyEnc, secretPath),
-    })));
+        return { keys: undefined, stale: [] };
+    const decrypted = [];
+    const stale = [];
+    for (const { rawEpochKeyEnc, ...rest } of keys) {
+        try {
+            decrypted.push({ ...rest, rawEpochKey: await decryptSecret(rawEpochKeyEnc, secretPath) });
+        }
+        catch {
+            stale.push({ roomId: rest.roomId, epoch: rest.epoch });
+        }
+    }
+    return { keys: decrypted.length > 0 ? decrypted : undefined, stale };
 }
 export async function saveChatv3Session(input, secrets, options = {}) {
     const owner = resolveChatv3SessionOwner(options.owner);
     const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
     const secretPath = resolveChatv3SessionSecretPath(storePath);
-    const store = await readStore(storePath, owner);
-    const existing = store.sessions[input.id];
-    const now = new Date().toISOString();
-    const wrapSecretEnc = secrets.wrapSecret ? await encryptSecret(secrets.wrapSecret, secretPath) : undefined;
-    const epochKeysEnc = await encryptEpochKeys(secrets.epochKeys, secretPath);
-    const record = {
-        version: 1,
-        ...input,
-        rooms: input.rooms,
-        createdAt: input.createdAt ?? existing?.createdAt ?? now,
-        updatedAt: input.updatedAt ?? now,
-        memberTokenEnc: await encryptSecret(secrets.memberToken, secretPath),
-        ...(wrapSecretEnc ? { wrapSecretEnc } : {}),
-        ...(epochKeysEnc ? { epochKeysEnc } : {}),
-    };
-    store.sessions[input.id] = record;
-    await writeStore(storePath, store);
-    return record;
+    return withStoreLock(storePath, async () => {
+        const wrapSecretEnc = secrets.wrapSecret ? await encryptSecret(secrets.wrapSecret, secretPath) : undefined;
+        const epochKeysEnc = await encryptEpochKeys(secrets.epochKeys, secretPath);
+        const memberTokenEnc = await encryptSecret(secrets.memberToken, secretPath);
+        const store = await readStore(storePath, owner);
+        const existing = store.sessions[input.id];
+        const now = new Date().toISOString();
+        const record = {
+            version: 1,
+            ...input,
+            rooms: input.rooms,
+            createdAt: input.createdAt ?? existing?.createdAt ?? now,
+            updatedAt: input.updatedAt ?? now,
+            memberTokenEnc,
+            ...(wrapSecretEnc ? { wrapSecretEnc } : {}),
+            ...(epochKeysEnc ? { epochKeysEnc } : {}),
+        };
+        store.sessions[input.id] = record;
+        await writeStore(storePath, store);
+        return record;
+    });
 }
 async function readLegacySessionRecord(id) {
     const legacyStorePath = resolveLegacyChatv3SessionStorePath();
@@ -228,7 +616,7 @@ async function claimLegacySession(id, owner, options) {
             wrapSecret: legacyRecord.wrapSecretEnc
                 ? await decryptSecret(legacyRecord.wrapSecretEnc, legacySecretPath)
                 : undefined,
-            epochKeys: await decryptEpochKeys(legacyRecord.epochKeysEnc, legacySecretPath),
+            epochKeys: (await decryptEpochKeys(legacyRecord.epochKeysEnc, legacySecretPath)).keys,
         },
     };
     await saveChatv3Session({
@@ -257,13 +645,52 @@ export async function loadChatv3Session(id, options = {}) {
         record = migrated.sessions[id];
     }
     const secretPath = resolveChatv3SessionSecretPath(storePath);
+    let memberToken;
+    try {
+        memberToken = await decryptSecret(record.memberTokenEnc, secretPath);
+    }
+    catch (error) {
+        throw new Chatv3SessionCryptoError({ storePath, secretPath, sessionId: id, field: 'memberToken', cause: error });
+    }
+    let wrapSecret;
+    if (record.wrapSecretEnc) {
+        try {
+            wrapSecret = await decryptSecret(record.wrapSecretEnc, secretPath);
+        }
+        catch (error) {
+            throw new Chatv3SessionCryptoError({ storePath, secretPath, sessionId: id, field: 'wrapSecret', cause: error });
+        }
+    }
+    const epochKeys = await decryptEpochKeys(record.epochKeysEnc, secretPath);
+    if (epochKeys.stale.length > 0) {
+        const staleRefs = new Set(epochKeys.stale.map((entry) => `${entry.roomId}:${entry.epoch}`));
+        const pruneRecord = (target) => {
+            const pruned = (target.epochKeysEnc ?? []).filter((entry) => !staleRefs.has(`${entry.roomId}:${entry.epoch}`));
+            const next = { ...target };
+            if (pruned.length > 0)
+                next.epochKeysEnc = pruned;
+            else
+                delete next.epochKeysEnc;
+            return next;
+        };
+        record = pruneRecord(record);
+        await withStoreLock(storePath, async () => {
+            const fresh = await readStore(storePath, owner);
+            const current = fresh.sessions[id];
+            if (!current)
+                return;
+            fresh.sessions[id] = pruneRecord(current);
+            await writeStore(storePath, fresh);
+        });
+    }
     return {
         record,
         secrets: {
-            memberToken: await decryptSecret(record.memberTokenEnc, secretPath),
-            wrapSecret: record.wrapSecretEnc ? await decryptSecret(record.wrapSecretEnc, secretPath) : undefined,
-            epochKeys: await decryptEpochKeys(record.epochKeysEnc, secretPath),
+            memberToken,
+            wrapSecret,
+            epochKeys: epochKeys.keys,
         },
+        ...(epochKeys.stale.length > 0 ? { staleEpochKeys: epochKeys.stale } : {}),
     };
 }
 export async function getChatv3SessionRecord(id, options = {}) {
@@ -284,11 +711,13 @@ export async function listChatv3SessionRecords(options = {}) {
 export async function deleteChatv3Session(id, options = {}) {
     const owner = resolveChatv3SessionOwner(options.owner);
     const storePath = resolveChatv3SessionStorePath(options.storePath, options.owner);
-    const store = await readStore(storePath, owner);
-    const existed = Boolean(store.sessions[id]);
-    delete store.sessions[id];
-    await writeStore(storePath, store);
-    return existed;
+    return withStoreLock(storePath, async () => {
+        const store = await readStore(storePath, owner);
+        const existed = Boolean(store.sessions[id]);
+        delete store.sessions[id];
+        await writeStore(storePath, store);
+        return existed;
+    });
 }
 export function summarizeChatv3Session(record) {
     return {

package/native/manifest.json

@@ -42,7 +42,7 @@
       "capabilityClass": "windows-ntfs-crash-recoverable-v1",
       "qualification": {
         "relativePath": "qualifications/win32-x64.json",
-        "sha256": "b6d7f7beb5e36dfd092286a3858724bf7d50d952832cbe2934cfe03d1d407434"
+        "sha256": "08d7ccc099bcc86e1e4a8cea6ea0d7b50eee76f3a126d6020bf11b2b2edacb3c"
       }
     }
   ]

package/native/qualifications/win32-x64.json

@@ -7,7 +7,7 @@
   "filesystem": "NTFS",
   "primitiveProfile": "windows-createfile-flush-movefileex-v1",
   "capabilityClass": "windows-ntfs-crash-recoverable-v1",
-  "evidenceSha256": "16b36958eb0a25b26cbebe2fc6d456ed90429069b16db7fbe8409691dff1d6bb",
+  "evidenceSha256": "dd80c815d10feb9499911bc5eb9c3bf56964afe66faa894ebc9de478cb0e5311",
   "crashInjectionPoints": [
     "authority-history",
     "authority-current",

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@aopslabs/aops",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "type": "module",
   "description": "AOPS CLI and terminal setup application.",
-  "aopsDockerServerVersion": "0.2.14",
+  "aopsDockerServerVersion": "0.2.15",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -43,7 +43,7 @@
     "test:commercial-performance": "node --test test/commercial-performance.test.mjs",
     "test:package-identity": "node --test test/package-identity.test.mjs test/npm-tar-entry-mode.test.mjs",
     "test:tui-launcher": "node --test test/tui-launcher.test.mjs",
-    "test:global-update": "node --test test/global-update.test.mjs",
+    "test:global-update": "node --test test/global-update.test.mjs test/cli-error-format.test.mjs",
     "test:skill-discovery": "node --test test/skill-discovery.test.mjs",
     "test:target-auth": "node --test test/target-auth.test.mjs test/device-login.test.mjs",
     "test:target-transport": "node --test test/target-transport.test.mjs",
@@ -59,11 +59,11 @@
     "start": "node dist/main.js"
   },
   "dependencies": {
-    "@aopslabs/aops-server": "0.2.14",
+    "@aopslabs/aops-server": "0.2.15",
     "@aopslabs/artifact-trust-contracts": "0.3.1",
     "@aopslabs/cli-kit": "0.1.0",
     "@aopslabs/aops-host-registration": "0.2.1",
-    "@aopslabs/aops-pg-bootstrap": "0.2.2",
+    "@aopslabs/aops-pg-bootstrap": "0.2.3",
     "@aopslabs/aops-runtime-config": "0.2.1",
     "@sigstore/bundle": "4.0.0",
     "@sigstore/protobuf-specs": "0.5.1",