@bridge_gpt/mcp-server 0.2.66 → 0.2.68

package/build/credential-store.js

@@ -37,6 +37,7 @@
  * {@link resolveCredentialBundle}, and the durable source of truth is the
  * user-scoped `~/.config/bridge/credentials.json` store written here.
  */
+import { validateBootstrapDisplayName, validateBootstrapRepoName } from "./bootstrap-project-identity.js";
 import path from "path";
 import { diagnosticComponent } from "./epic-launch-diagnostic.js";
 // ---------------------------------------------------------------------------
@@ -336,37 +337,30 @@ function defaultTempSuffix() {
 // ---------------------------------------------------------------------------
 /** Poll interval while waiting for a contended lock. */
 const LOCK_POLL_INTERVAL_MS = 50;
-/** Bounded wait before a held lock is treated as abandoned. */
+/** Bounded acquisition wait; elapsed time never establishes abandonment. */
 const LOCK_TIMEOUT_MS = 5_000;
 /** Lock path, adjacent to the primary store. Never carries secret material. */
 export function getCredentialStoreLockPath(deps) {
     return `${getPrimaryCredentialStorePath(deps)}.lock`;
 }
 /**
- * Acquire the exclusive credential-store lock: an atomically created (`wx`) lock
- * file beside the store, with a bounded wait.
- *
- * When `deps.open` is absent there is no lock primitive available, so the caller
- * runs unlocked — exactly the pre-BAPI-606 behavior, preserved so existing
- * builders and in-memory test doubles keep working.
- *
- * Stale-lock recovery: a lock still held after {@link LOCK_TIMEOUT_MS} (orders of
- * magnitude longer than a legitimate sub-millisecond read-modify-write) is
- * treated as abandoned by a crashed process and stolen exactly once. The
- * alternative — refusing forever — wedges every future install behind a lock file
- * no user knows to delete.
+ * Exclusive creation with bounded fail-closed contention. No writer steals or
+ * replaces a held lock; only the successful owner can release it. Abandonment
+ * cannot be established by this portable primitive, so recovery requires support.
  */
 async function acquireCredentialStoreLock(deps) {
     const open = deps.open;
-    if (!open)
-        return { ok: true, release: async () => { } };
+    if (!open || !deps.unlink)
+        return { ok: false, error: "Exclusive credential storage is unavailable. Resume from the original folder with installation support." };
     const lockPath = getCredentialStoreLockPath(deps);
     const isPosix = deps.platform !== "win32";
     const now = deps.now ?? (() => Date.now());
     const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    let released = false;
     const release = async () => {
-        if (!deps.unlink)
+        if (released || !deps.unlink)
             return;
+        released = true;
         try {
             await deps.unlink(lockPath);
         }
@@ -403,14 +397,9 @@ async function acquireCredentialStoreLock(deps) {
             break;
         await sleep(LOCK_POLL_INTERVAL_MS);
     }
-    // Bounded wait exhausted — steal the abandoned lock, once.
-    await release();
-    const stolen = await tryAcquire();
-    if (stolen.ok)
-        return { ok: true, release };
     return {
         ok: false,
-        error: `Timed out waiting for the credentials lock at ${lockPath} (another install may be running).`,
+        error: `Timed out waiting for exclusive credential storage at ${lockPath}. Another installer may still be running. Resume from the original folder with installation support; preserve recovery proof.`,
     };
 }
 /**
@@ -418,7 +407,9 @@ async function acquireCredentialStoreLock(deps) {
  * lock is always released, and `onLockError` maps an acquisition failure into the
  * caller's own (secret-free) result shape.
  */
-export async function withCredentialStoreLock(deps, fn, onLockError) {
+export async function withCredentialStoreLock(deps, fn, onLockError, requireExclusive = true) {
+    if (!requireExclusive && !deps.open)
+        return fn();
     const lock = await acquireCredentialStoreLock(deps);
     if (!lock.ok)
         return onLockError(lock.error);
@@ -457,7 +448,7 @@ export async function durablyReplaceCredentialStoreJson(primaryPath, value, deps
     let handle;
     try {
         await deps.mkdir(dir, { recursive: true });
-        handle = await open(tempPath, "w", isPosix ? 0o600 : undefined);
+        handle = await open(tempPath, "wx", isPosix ? 0o600 : undefined);
         await handle.writeFile(json, { encoding: "utf-8" });
         await handle.sync();
         await handle.close();
@@ -490,19 +481,22 @@ export async function durablyReplaceCredentialStoreJson(primaryPath, value, deps
             error: `Failed to durably write the credentials file at ${primaryPath}.`,
         };
     }
-    try {
-        const dirHandle = await open(dir, "r");
+    // Windows cannot open directory handles through Node's portable fs API.
+    // File sync plus atomic rename still apply; directory durability is limited.
+    if (deps.platform !== "win32") {
         try {
-            await dirHandle.sync();
+            const dirHandle = await open(dir, "r");
+            try {
+                await dirHandle.sync();
+            }
+            finally {
+                await dirHandle.close();
+            }
         }
-        finally {
-            await dirHandle.close();
+        catch {
+            return { ok: false, kind: "post-rename-uncertain", error: "Credential replacement completed but durability could not be confirmed. Preserve recovery proof and rerun from the original folder." };
         }
     }
-    catch {
-        /* directory fsync is unsupported on some platforms; the file fsync above is
-           the load-bearing one and already succeeded. */
-    }
     return { ok: true };
 }
 // ---------------------------------------------------------------------------
@@ -597,8 +591,10 @@ async function loadStoreForMutation(deps) {
     if (primary.state === "present") {
         return { ok: true, base: { ...primary.value } };
     }
-    const seeded = await mergeFallbackCredentialStoreOnFirstPrimaryWrite(deps);
-    return { ok: true, base: seeded.base };
+    const fallback = await readCredentialStoreJsonIfPresent(getFallbackCredentialStorePath(deps), deps);
+    if (fallback.state === "error")
+        return { ok: false, kind: fallback.kind, error: "Recovery storage could not be read. Preserve it and contact installation support." };
+    return { ok: true, base: fallback.state === "present" ? { ...fallback.value } : {} };
 }
 /** Does a real (non-empty) `BAPI_API_KEY` already exist for `bapi:<repo>`? */
 function hasExistingBapiKey(store, repoName) {
@@ -704,17 +700,8 @@ function storedPendingIsSelfServe(store, repoName) {
  * (an ordinary, fingerprint-only record) keeps the original fail-closed guidance,
  * because there the CLI genuinely cannot replay it.
  */
-function pendingConflictError(target, primaryPath, storedIsSelfServe) {
-    if (storedIsSelfServe) {
-        return (`A pending self-serve signup for a DIFFERENT invite already exists at ${target} in ` +
-            `${primaryPath}. It is the only proof that can replay that signup, so it will not be ` +
-            "overwritten. Re-run install-bridge and choose the email option — it will resume that " +
-            "signup automatically. Do NOT remove the entry by hand.");
-    }
-    return (`A pending bootstrap-invite credential for a DIFFERENT invite already exists at ${target} ` +
-        `in ${primaryPath}. It is the only proof that can replay that redemption, so it will not be ` +
-        "overwritten. Complete that redemption first, or — only if you are certain its invite was " +
-        "never exchanged — remove the entry from the store by hand.");
+function pendingConflictError(_target, _primaryPath, _storedIsSelfServe) {
+    return "An earlier installation has saved recovery proof. Resume from its original folder with its original invite or signup flow, or contact installation support. Preserve the saved proof.";
 }
 /**
  * Generate (or REUSE) the bootstrap `key_secret` and durably persist it as a
@@ -1413,7 +1400,7 @@ export async function upsertBapiCredential(repoName, apiKey, deps) {
             };
         }
         return { ok: true, path: primaryPath, target, action, migratedFallback };
-    }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }));
+    }, (error) => ({ ok: false, path: primaryPath, target, kind: "lock-error", error }), false);
 }
 // ---------------------------------------------------------------------------
 // Epic-launch credential binding (BAPI-1260)
@@ -1603,3 +1590,176 @@ export async function bindEpicLaunchCredential(repoName, targetBaseUrl, deps) {
         return { ok: true, target, action: previous === null ? "bound" : "rebound", path: primaryPath };
     }, (error) => ({ ok: false, target, kind: "lock-error", error }));
 }
+const modernRecoveryError = "Installation recovery is inconsistent or unavailable. Preserve proof and resume with the original folder and invite, or contact installation support.";
+function parseModernBootstrapRecord(entry) {
+    if (!entry)
+        return null;
+    const raw = JSON.parse(entry.RECORD);
+    if (raw.version !== 1 || raw.mode !== "server_assigned" || typeof raw.baseUrl !== "string" || typeof raw.folder !== "string" || typeof raw.label !== "string" || typeof raw.keySecret !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(raw.keySecret))
+        throw new Error(modernRecoveryError);
+    validateBootstrapDisplayName(raw.label);
+    if (raw.fingerprint !== undefined && !/^[a-f0-9]{64}$/.test(raw.fingerprint))
+        throw new Error(modernRecoveryError);
+    if (raw.canonical !== undefined) {
+        validateBootstrapRepoName(raw.canonical);
+        validateBootstrapDisplayName(raw.serverLabel);
+    }
+    return raw;
+}
+export async function mutateModernBootstrapRecord(scope, deps, change, previousLocator) {
+    const primaryPath = getPrimaryCredentialStorePath(deps);
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                return { ok: false, error: modernRecoveryError };
+            const store = loaded.base;
+            const reference = store[scope.folderReference];
+            const actualLocator = reference?.LOCATOR ?? scope.locator;
+            if (reference && (reference.FOLDER !== scope.folder || reference.BASE_URL !== scope.baseUrl || (actualLocator !== scope.locator && actualLocator !== previousLocator)))
+                throw new Error(modernRecoveryError);
+            const record = parseModernBootstrapRecord(store[actualLocator]);
+            if (reference && !record)
+                throw new Error(modernRecoveryError);
+            if (record && (!reference || record.folder !== scope.folder || record.baseUrl !== scope.baseUrl))
+                throw new Error(modernRecoveryError);
+            const next = change(record);
+            if (next.folder !== scope.folder || next.baseUrl !== scope.baseUrl || (record && (record.keySecret !== next.keySecret || record.label !== next.label)))
+                throw new Error(modernRecoveryError);
+            const destination = store[scope.locator];
+            if (actualLocator !== scope.locator && destination && JSON.stringify(parseModernBootstrapRecord(destination)) !== JSON.stringify(next))
+                throw new Error(modernRecoveryError);
+            const updated = { ...store, [scope.locator]: { RECORD: JSON.stringify(next) }, [scope.folderReference]: { LOCATOR: scope.locator, FOLDER: scope.folder, BASE_URL: scope.baseUrl } };
+            if (actualLocator !== scope.locator)
+                delete updated[actualLocator];
+            const written = await durablyReplaceCredentialStoreJson(primaryPath, updated, deps);
+            return written.ok ? { ok: true, record: next, path: primaryPath } : { ok: false, error: written.error };
+        }
+        catch {
+            return { ok: false, error: modernRecoveryError };
+        }
+    }, () => ({ ok: false, error: modernRecoveryError }));
+}
+export async function lookupModernBootstrapRecord(scope, deps) {
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                throw new Error(modernRecoveryError);
+            const reference = loaded.base[scope.folderReference];
+            if (!reference) {
+                // A stray modern or legacy record could be a redeemed proof; never replace it.
+                if (loaded.base[scope.locator])
+                    throw new Error(modernRecoveryError);
+                return { ok: true, record: null, path: getPrimaryCredentialStorePath(deps) };
+            }
+            if (reference.FOLDER !== scope.folder || reference.BASE_URL !== scope.baseUrl)
+                throw new Error(modernRecoveryError);
+            const record = parseModernBootstrapRecord(loaded.base[reference.LOCATOR]);
+            if (!record || record.folder !== scope.folder || record.baseUrl !== scope.baseUrl)
+                throw new Error(modernRecoveryError);
+            if (scope.locator.startsWith("bootstrap-pending:invite:") && reference.LOCATOR !== scope.locator)
+                throw new Error(modernRecoveryError);
+            return { ok: true, record, path: getPrimaryCredentialStorePath(deps) };
+        }
+        catch {
+            return { ok: false, error: modernRecoveryError };
+        }
+    }, () => ({ ok: false, error: modernRecoveryError }));
+}
+export async function prepareModernBootstrapInvite(scope, fingerprint, label, generateKeySecret, deps) {
+    return mutateModernBootstrapRecord(scope, deps, record => {
+        if (record) {
+            if (record.fingerprint !== fingerprint)
+                throw new Error(modernRecoveryError);
+            return record;
+        }
+        return { version: 1, mode: "server_assigned", baseUrl: scope.baseUrl, folder: scope.folder,
+            label: validateBootstrapDisplayName(label), keySecret: generateKeySecret(), fingerprint };
+    });
+}
+export async function lookupLegacyBootstrapInvite(fingerprint, deps) {
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                throw new Error(modernRecoveryError);
+            const candidates = Object.entries(loaded.base).filter(([target, entry]) => target.startsWith(BOOTSTRAP_PENDING_TARGET_PREFIX) && entry.BOOTSTRAP_INVITE_FINGERPRINT === fingerprint);
+            if (candidates.length > 1)
+                throw new Error(modernRecoveryError);
+            if (!candidates.length)
+                return { ok: true };
+            const [target, entry] = candidates[0];
+            const repoName = validateBootstrapRepoName(target.slice(BOOTSTRAP_PENDING_TARGET_PREFIX.length));
+            if (!/^[A-Za-z0-9_-]{43}$/.test(entry.BAPI_API_KEY))
+                throw new Error(modernRecoveryError);
+            return { ok: true, repoName };
+        }
+        catch {
+            return { ok: false, error: modernRecoveryError };
+        }
+    }, () => ({ ok: false, error: modernRecoveryError }));
+}
+export async function prepareModernBootstrapSignup(scope, label, email, generateKeySecret, deps) {
+    return mutateModernBootstrapRecord(scope, deps, record => {
+        if (record)
+            return record;
+        return { version: 1, mode: "server_assigned", baseUrl: scope.baseUrl, folder: scope.folder,
+            label: validateBootstrapDisplayName(label), keySecret: generateKeySecret(), signupEmail: email };
+    });
+}
+export async function transitionModernBootstrapSignup(signupScope, inviteScope, fingerprint, replayToken, challengeHandle, deps) {
+    return mutateModernBootstrapRecord(inviteScope, deps, record => {
+        if (!record || record.challengeHandle !== challengeHandle)
+            throw new Error(modernRecoveryError);
+        if (record.fingerprint && (record.fingerprint !== fingerprint || record.replayToken !== replayToken))
+            throw new Error(modernRecoveryError);
+        return { ...record, fingerprint, replayToken };
+    }, signupScope.locator);
+}
+export async function checkpointModernBootstrapIdentity(scope, proof, canonical, serverLabel, deps) {
+    return mutateModernBootstrapRecord(scope, deps, record => {
+        if (!record || record.keySecret !== proof.keySecret || record.fingerprint !== proof.fingerprint ||
+            (record.canonical && record.canonical !== canonical))
+            throw new Error(modernRecoveryError);
+        return { ...record, canonical: validateBootstrapRepoName(canonical), serverLabel: validateBootstrapDisplayName(serverLabel) };
+    });
+}
+export async function promoteModernBootstrapCredential(scope, proof, deps, allowOverwrite = false, consentedKey) {
+    return withCredentialStoreLock(deps, async () => {
+        try {
+            if (!proof.canonical || !proof.fingerprint)
+                throw new Error(modernRecoveryError);
+            const loaded = await loadStoreForMutation(deps);
+            if (!loaded.ok)
+                throw new Error(modernRecoveryError);
+            const store = loaded.base;
+            const target = getBapiTarget(validateBootstrapRepoName(proof.canonical));
+            const existingKey = store[target]?.BAPI_API_KEY;
+            const record = parseModernBootstrapRecord(store[scope.locator]);
+            const reference = store[scope.folderReference];
+            // A completed uncertain/concurrent promotion is recognized by exact proof.
+            if (!record && !reference && existingKey === proof.keySecret)
+                return { ok: true, path: getPrimaryCredentialStorePath(deps) };
+            if (!record || record.keySecret !== proof.keySecret || record.canonical !== proof.canonical || record.fingerprint !== proof.fingerprint || record.folder !== scope.folder || record.baseUrl !== scope.baseUrl || reference?.LOCATOR !== scope.locator || reference.FOLDER !== scope.folder || reference.BASE_URL !== scope.baseUrl)
+                throw new Error(modernRecoveryError);
+            if (existingKey && existingKey !== proof.keySecret) {
+                if (!allowOverwrite)
+                    return { ok: false, error: "The canonical credential already exists; overwrite consent is required.", needsConsent: true, observedKey: existingKey };
+                if (consentedKey !== undefined && existingKey !== consentedKey)
+                    return { ok: false, error: "Destination credential changed after consent. Resume and confirm again." };
+            }
+            const entry = { ...store[target], BAPI_API_KEY: proof.keySecret };
+            if (existingKey !== proof.keySecret)
+                delete entry.BAPI_EPIC_LAUNCH_BOUND_BASE_URL;
+            const updated = { ...store, [target]: entry };
+            delete updated[scope.locator];
+            delete updated[scope.folderReference];
+            const written = await durablyReplaceCredentialStoreJson(getPrimaryCredentialStorePath(deps), updated, deps);
+            return written.ok ? { ok: true, path: getPrimaryCredentialStorePath(deps) } : { ok: false, error: written.error };
+        }
+        catch {
+            return { ok: false, error: modernRecoveryError };
+        }
+    }, () => ({ ok: false, error: modernRecoveryError }));
+}