@bubblebrain-ai/bubble 0.0.58 → 0.0.60

package/dist/oauth/grok.js

@@ -12,6 +12,7 @@ import { randomBytes, createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { withOAuthRefreshTimeout } from "./refresh-control.js";
 import { chatGptFetch } from "../network/chatgpt-transport.js";
 // Public OAuth client registered for the official Grok CLI ("Grok Build").
 const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
@@ -73,7 +74,7 @@ async function startCallbackServer(timeoutMs, onStatus) {
                     }
                     if (code) {
                         res.writeHead(200, { "Content-Type": "text/html" });
-                        res.end("<html><body><h1>Authorization successful</h1><p>You can close this window and return to the terminal.</p></body></html>");
+                        res.end("<html><body><h1>Authorization received</h1><p>Return to Bubble to check whether sign-in completed. Bubble still needs to exchange and save your credentials.</p></body></html>");
                         finish(() => settle({ code, state: state || "" }));
                         return;
                     }
@@ -186,21 +187,24 @@ export async function loginGrok(callbacks, options = {}) {
     return tokens;
 }
 export async function refreshGrok(refreshToken, options = {}) {
-    const fetchImpl = options.fetch ?? chatGptFetch;
-    const response = await fetchImpl(TOKEN_URL, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-            client_id: CLIENT_ID,
-        }),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => "Unknown error");
-        throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${text}`);
-    }
-    return parseTokenResponse((await response.json()), refreshToken);
+    return withOAuthRefreshTimeout(async (signal) => {
+        const fetchImpl = options.fetch ?? chatGptFetch;
+        const response = await fetchImpl(TOKEN_URL, {
+            method: "POST",
+            signal,
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "Unknown error");
+            throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${text}`);
+        }
+        return parseTokenResponse((await response.json()), refreshToken);
+    }, options.timeoutMs);
 }
 /**
  * One-time credential import from the official Grok CLI's auth store (either

package/dist/oauth/openai-codex.d.ts

@@ -11,4 +11,5 @@ export declare function loginOpenAICodex(callbacks?: OpenAICodexLoginCallbacks,
 }): Promise<OAuthTokens>;
 export declare function refreshOpenAICodex(refreshToken: string, options?: {
     fetch?: ChatGptFetch;
+    timeoutMs?: number;
 }): Promise<OAuthTokens>;

package/dist/oauth/openai-codex.js

@@ -4,6 +4,7 @@
 import { createServer } from "node:http";
 import { exec } from "node:child_process";
 import { randomBytes, createHash } from "node:crypto";
+import { withOAuthRefreshTimeout } from "./refresh-control.js";
 import { chatGptFetch } from "../network/chatgpt-transport.js";
 const CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
 const AUTH_URL = "https://auth.openai.com/oauth/authorize";
@@ -47,7 +48,7 @@ async function startCallbackServer(port, timeoutMs, onStatus) {
                     }
                     if (code) {
                         res.writeHead(200, { "Content-Type": "text/html" });
-                        res.end(`<html><body><h1>Authorization successful</h1><p>You can close this window and return to the terminal.</p></body></html>`);
+                        res.end(`<html><body><h1>Authorization received</h1><p>Return to Bubble to check whether sign-in completed. Bubble still needs to exchange and save your credentials.</p></body></html>`);
                         if (!resolved) {
                             resolved = true;
                             server.close(() => resolve({ code, state: state || "" }));
@@ -162,28 +163,31 @@ export async function loginOpenAICodex(callbacks, options = {}) {
     };
 }
 export async function refreshOpenAICodex(refreshToken, options = {}) {
-    const fetchImpl = options.fetch ?? chatGptFetch;
-    const response = await fetchImpl(TOKEN_URL, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-            grant_type: "refresh_token",
-            refresh_token: refreshToken,
-            client_id: CLIENT_ID,
-        }),
-    });
-    if (!response.ok) {
-        const text = await response.text().catch(() => "Unknown error");
-        throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${text}`);
-    }
-    const data = (await response.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    const accountId = extractAccountId(data.id_token);
-    return {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token || refreshToken,
-        expiresAt,
-        idToken: data.id_token,
-        accountId,
-    };
+    return withOAuthRefreshTimeout(async (signal) => {
+        const fetchImpl = options.fetch ?? chatGptFetch;
+        const response = await fetchImpl(TOKEN_URL, {
+            method: "POST",
+            signal,
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                refresh_token: refreshToken,
+                client_id: CLIENT_ID,
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => "Unknown error");
+            throw new Error(`Token refresh failed: ${response.status} ${response.statusText} - ${text}`);
+        }
+        const data = (await response.json());
+        const expiresAt = Date.now() + data.expires_in * 1000;
+        const accountId = extractAccountId(data.id_token);
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token || refreshToken,
+            expiresAt,
+            idToken: data.id_token,
+            accountId,
+        };
+    }, options.timeoutMs);
 }

package/dist/oauth/refresh-control.d.ts

@@ -0,0 +1,12 @@
+export declare const OAUTH_REFRESH_TIMEOUT_MS = 30000;
+/** Cancel only this caller's wait, never the shared credential rotation.
+ * Keep both handlers attached after cancellation so a late refresh rejection
+ * is observed even when every caller has stopped waiting.
+ */
+export declare function waitForOAuth<T>(promise: Promise<T>, signal?: AbortSignal | null): Promise<T>;
+/** The refresh owner has its own deadline, independent of any chat's signal.
+ * Cover response-body reads as well as connection/headers, and release callers
+ * even if a custom transport fails to honor abort. Only the returned result may
+ * be persisted by the registry; a late response after timeout is discarded.
+ */
+export declare function withOAuthRefreshTimeout<T>(request: (signal: AbortSignal) => Promise<T>, timeoutMs?: number): Promise<T>;

package/dist/oauth/refresh-control.js

@@ -0,0 +1,42 @@
+export const OAUTH_REFRESH_TIMEOUT_MS = 30_000;
+/** Cancel only this caller's wait, never the shared credential rotation.
+ * Keep both handlers attached after cancellation so a late refresh rejection
+ * is observed even when every caller has stopped waiting.
+ */
+export function waitForOAuth(promise, signal) {
+    if (!signal)
+        return promise;
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            signal.removeEventListener("abort", abort);
+            reject(signal.reason ?? new DOMException("Operation aborted", "AbortError"));
+        };
+        promise.then(value => { signal.removeEventListener("abort", abort); resolve(value); }, error => { signal.removeEventListener("abort", abort); reject(error); });
+        if (signal.aborted)
+            abort();
+        else
+            signal.addEventListener("abort", abort, { once: true });
+    });
+}
+/** The refresh owner has its own deadline, independent of any chat's signal.
+ * Cover response-body reads as well as connection/headers, and release callers
+ * even if a custom transport fails to honor abort. Only the returned result may
+ * be persisted by the registry; a late response after timeout is discarded.
+ */
+export async function withOAuthRefreshTimeout(request, timeoutMs = OAUTH_REFRESH_TIMEOUT_MS) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+        throw new Error("Invalid OAuth refresh timeout");
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        const error = new Error("OAuth token refresh timed out. Please try again.");
+        error.name = "TimeoutError";
+        controller.abort(error);
+    }, timeoutMs);
+    timer.unref?.();
+    try {
+        return await waitForOAuth(request(controller.signal), controller.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/oauth/storage.d.ts

@@ -6,10 +6,31 @@
  * which no test could isolate (known-defects #7) and which ignored
  * BUBBLE_HOME / dev mode while every other config file honored them
  * (config.json, sessions, memory all derive from getBubbleHome).
+ *
+ * The file is shared by every Bubble process on the machine (several TUIs, the
+ * desktop app, the Feishu host), and OAuth refresh tokens are single-use, so a
+ * stale copy is not harmless — presenting an already-rotated refresh token is
+ * rejected (`refresh_token_reused`) and forces a new login. Hence:
+ *   - writes are read-merge-write of ONE key plus an atomic rename, never a
+ *     dump of this process's whole in-memory map over the file;
+ *   - reads follow the file (mtime/size check) so a token rotated by another
+ *     process is picked up instead of the stale in-memory one;
+ *   - withRefreshLock() serializes refreshes across processes.
+ *
+ * Node has no flock, so both locks are O_EXCL lock files carrying an owner
+ * token: a holder only ever deletes a lock whose content is its own token,
+ * and stale locks are broken one breaker at a time (see breakLockIfStale), so
+ * a breaker cannot remove a successor's live lock. What remains is a holder
+ * suspended past the stale threshold that resumes and releases in the same
+ * microseconds a breaker acts. The refresh path tolerates even that: results
+ * are stored by compare-and-set, and a rejected token triggers a second look
+ * at the file (ProviderRegistry).
  */
 import type { OAuthCredentials } from "./types.js";
 export declare class AuthStorage {
     private data;
+    /** Identity of the file as last read/written, to detect foreign writes. */
+    private diskStamp;
     private mutationListeners;
     private readonly authPath;
     constructor(authPath?: string);
@@ -21,11 +42,44 @@ export declare class AuthStorage {
      */
     onMutation(listener: (providerId: string) => void): () => void;
     private notifyMutation;
+    private stampOf;
+    private readDisk;
     private load;
-    private save;
+    /**
+     * Adopt writes made by other processes; notifies for the keys that changed.
+     * `force` skips the stamp shortcut: a token rotation keeps the file size, so
+     * on a coarse-mtime filesystem the stamp alone can miss it. The refresh and
+     * write paths cannot afford that.
+     */
+    sync(force?: boolean): void;
+    /**
+     * Read-merge-write of a single key: entries owned by other processes survive.
+     * The whole sequence runs under the cross-process write lock — without it a
+     * process could read, lose the CPU while another persists a rotated token,
+     * then rename its older snapshot over it.
+     */
+    private commit;
+    /** Force a re-read of the file (see sync). */
+    reload(): void;
+    /**
+     * Serialize token refreshes across processes. Callers must re-read the
+     * credentials inside `fn`: whoever held the lock before may already have
+     * rotated them. `fn` never runs without the lock — presenting a single-use
+     * refresh token concurrently can void the login, while a timeout only costs
+     * one retryable request.
+     */
+    withRefreshLock<T>(fn: () => Promise<T>): Promise<T>;
     getPath(): string;
     get(providerId: string): OAuthCredentials | undefined;
     set(providerId: string, creds: OAuthCredentials): void;
+    /**
+     * Store the result of a refresh only if the entry is still the one that was
+     * refreshed (`fromRefreshToken`; null = the key must still be absent). A
+     * /login or /logout in another process only takes the write lock, so it can
+     * land while a refresh request is in flight; its outcome must win over a
+     * result derived from the credentials it replaced.
+     */
+    replaceIfUnchanged(providerId: string, creds: OAuthCredentials, fromRefreshToken: string | null): boolean;
     remove(providerId: string): void;
     has(providerId: string): boolean;
     isExpired(providerId: string, graceMs?: number): boolean;

package/dist/oauth/storage.js

@@ -6,12 +6,150 @@
  * which no test could isolate (known-defects #7) and which ignored
  * BUBBLE_HOME / dev mode while every other config file honored them
  * (config.json, sessions, memory all derive from getBubbleHome).
+ *
+ * The file is shared by every Bubble process on the machine (several TUIs, the
+ * desktop app, the Feishu host), and OAuth refresh tokens are single-use, so a
+ * stale copy is not harmless — presenting an already-rotated refresh token is
+ * rejected (`refresh_token_reused`) and forces a new login. Hence:
+ *   - writes are read-merge-write of ONE key plus an atomic rename, never a
+ *     dump of this process's whole in-memory map over the file;
+ *   - reads follow the file (mtime/size check) so a token rotated by another
+ *     process is picked up instead of the stale in-memory one;
+ *   - withRefreshLock() serializes refreshes across processes.
+ *
+ * Node has no flock, so both locks are O_EXCL lock files carrying an owner
+ * token: a holder only ever deletes a lock whose content is its own token,
+ * and stale locks are broken one breaker at a time (see breakLockIfStale), so
+ * a breaker cannot remove a successor's live lock. What remains is a holder
+ * suspended past the stale threshold that resumes and releases in the same
+ * microseconds a breaker acts. The refresh path tolerates even that: results
+ * are stored by compare-and-set, and a rejected token triggers a second look
+ * at the file (ProviderRegistry).
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, utimesSync, writeFileSync, writeSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { getBubbleHome } from "../bubble-home.js";
+/**
+ * The refresh holder heartbeats its lock, so "stale" means the holder is gone,
+ * not merely slow. Waiters outlast the stale threshold: a crashed holder is
+ * always recovered from, and only a live, stuck one makes a waiter give up.
+ */
+const REFRESH_LOCK_STALE_MS = 30_000;
+const REFRESH_LOCK_HEARTBEAT_MS = 5_000;
+const REFRESH_LOCK_WAIT_MS = 90_000;
+const REFRESH_LOCK_POLL_MS = 50;
+/** The write lock spans a few ms of synchronous file I/O. */
+const WRITE_LOCK_STALE_MS = 5_000;
+const WRITE_LOCK_WAIT_MS = 15_000;
+const WRITE_LOCK_POLL_MS = 5;
+const BREAKER_STALE_MS = 10_000;
+const sleepCell = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+    Atomics.wait(sleepCell, 0, 0, ms);
+}
+/**
+ * One acquisition attempt. Returns the owner token, or undefined on contention
+ * (after breaking the lock if it was stale, so the caller's retry can win).
+ * Anything but EEXIST is a real error — an unwritable home must surface, not
+ * be mistaken for contention and retried forever.
+ */
+function tryAcquireLock(lockPath, staleMs) {
+    const token = `${process.pid}:${randomUUID()}`;
+    let fd;
+    try {
+        const dir = dirname(lockPath);
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+        fd = openSync(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        breakLockIfStale(lockPath, staleMs);
+        return undefined;
+    }
+    try {
+        writeSync(fd, token);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return token;
+}
+function observeLock(lockPath) {
+    try {
+        return { mtimeMs: statSync(lockPath).mtimeMs, token: readFileSync(lockPath, "utf-8") };
+    }
+    catch {
+        return undefined; // released meanwhile
+    }
+}
+function isStale(lockPath, staleMs) {
+    const observed = observeLock(lockPath);
+    return !!observed && Date.now() - observed.mtimeMs > staleMs;
+}
+/**
+ * Breakers are serialized by their own O_EXCL lock, held for the few
+ * microseconds of the re-check and unlink below. Without it, two waiters that
+ * both judged the lock stale could interleave: one unlinks it, a successor
+ * acquires the path, and the other then unlinks the successor's live lock.
+ * Under the breaker lock the second one re-checks and finds a fresh lock.
+ */
+function breakLockIfStale(lockPath, staleMs) {
+    if (!isStale(lockPath, staleMs))
+        return;
+    const breakerPath = `${lockPath}.breaker`;
+    let fd;
+    try {
+        fd = openSync(breakerPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        // Someone else is breaking it right now; only a crash inside that tiny
+        // section leaves the file behind, so clear an old one for the next retry.
+        if (isStale(breakerPath, BREAKER_STALE_MS)) {
+            try {
+                unlinkSync(breakerPath);
+            }
+            catch {
+                // Already gone.
+            }
+        }
+        return;
+    }
+    try {
+        closeSync(fd);
+        if (isStale(lockPath, staleMs))
+            unlinkSync(lockPath);
+    }
+    catch {
+        // Already gone.
+    }
+    finally {
+        try {
+            unlinkSync(breakerPath);
+        }
+        catch {
+            // Already gone.
+        }
+    }
+}
+/** Never delete a lock that is not ours (ours may have been broken as stale). */
+function releaseLock(lockPath, token) {
+    try {
+        if (readFileSync(lockPath, "utf-8") === token)
+            unlinkSync(lockPath);
+    }
+    catch {
+        // Already gone.
+    }
+}
 export class AuthStorage {
     data = {};
+    /** Identity of the file as last read/written, to detect foreign writes. */
+    diskStamp;
     mutationListeners = [];
     authPath;
     constructor(authPath = join(getBubbleHome(), "auth.json")) {
@@ -40,53 +178,180 @@ export class AuthStorage {
             }
         }
     }
+    stampOf() {
+        try {
+            const stat = statSync(this.authPath);
+            // ino + ctime: every write replaces the file by rename, so they change
+            // even when a same-size rotation lands within one coarse mtime tick.
+            return `${stat.ino}:${stat.mtimeMs}:${stat.ctimeMs}:${stat.size}`;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    readDisk() {
+        try {
+            const parsed = JSON.parse(readFileSync(this.authPath, "utf-8"));
+            return parsed && typeof parsed === "object" ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
     load() {
-        if (!existsSync(this.authPath))
+        this.diskStamp = this.stampOf();
+        this.data = this.diskStamp === undefined ? {} : this.readDisk();
+    }
+    /**
+     * Adopt writes made by other processes; notifies for the keys that changed.
+     * `force` skips the stamp shortcut: a token rotation keeps the file size, so
+     * on a coarse-mtime filesystem the stamp alone can miss it. The refresh and
+     * write paths cannot afford that.
+     */
+    sync(force = false) {
+        const stamp = this.stampOf();
+        if (!force && stamp === this.diskStamp)
             return;
+        const previous = this.data;
+        this.diskStamp = stamp;
+        this.data = stamp === undefined ? {} : this.readDisk();
+        for (const key of new Set([...Object.keys(previous), ...Object.keys(this.data)])) {
+            if (JSON.stringify(previous[key]) !== JSON.stringify(this.data[key]))
+                this.notifyMutation(key);
+        }
+    }
+    /**
+     * Read-merge-write of a single key: entries owned by other processes survive.
+     * The whole sequence runs under the cross-process write lock — without it a
+     * process could read, lose the CPU while another persists a rotated token,
+     * then rename its older snapshot over it.
+     */
+    commit(providerId, creds, 
+    /** Compare-and-set guard, checked under the lock against the re-read file. */
+    guard) {
+        const lockPath = `${this.authPath}.wlock`;
+        const deadline = Date.now() + WRITE_LOCK_WAIT_MS;
+        let token = tryAcquireLock(lockPath, WRITE_LOCK_STALE_MS);
+        while (token === undefined) {
+            if (Date.now() >= deadline) {
+                throw new Error(`Timed out waiting for the credential write lock (${lockPath}).`);
+            }
+            sleepSync(WRITE_LOCK_POLL_MS);
+            token = tryAcquireLock(lockPath, WRITE_LOCK_STALE_MS);
+        }
         try {
-            const raw = readFileSync(this.authPath, "utf-8");
-            const parsed = JSON.parse(raw);
-            this.data = parsed;
+            this.sync(true);
+            if (guard && !guard(this.data[providerId]))
+                return false;
+            const next = { ...this.data };
+            if (creds)
+                next[providerId] = creds;
+            else
+                delete next[providerId];
+            const tmpPath = `${this.authPath}.${process.pid}.tmp`;
+            writeFileSync(tmpPath, JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+            // Fencing: if this process was suspended past the stale threshold, the
+            // lock was broken and someone else may have committed since the re-read
+            // above. Publishing the snapshot now would roll their write back.
+            if (observeLock(lockPath)?.token !== token) {
+                unlinkSync(tmpPath);
+                throw new Error("Lost the credential write lock before publishing; the write was not applied.");
+            }
+            renameSync(tmpPath, this.authPath);
+            this.data = next;
+            this.diskStamp = this.stampOf();
+            return true;
         }
-        catch {
-            this.data = {};
+        finally {
+            releaseLock(lockPath, token);
         }
     }
-    save() {
-        const dir = dirname(this.authPath);
-        if (!existsSync(dir))
-            mkdirSync(dir, { recursive: true });
-        writeFileSync(this.authPath, JSON.stringify(this.data, null, 2) + "\n", { mode: 0o600 });
+    /** Force a re-read of the file (see sync). */
+    reload() {
+        this.sync(true);
+    }
+    /**
+     * Serialize token refreshes across processes. Callers must re-read the
+     * credentials inside `fn`: whoever held the lock before may already have
+     * rotated them. `fn` never runs without the lock — presenting a single-use
+     * refresh token concurrently can void the login, while a timeout only costs
+     * one retryable request.
+     */
+    async withRefreshLock(fn) {
+        const lockPath = `${this.authPath}.lock`;
+        const deadline = Date.now() + REFRESH_LOCK_WAIT_MS;
+        let token = tryAcquireLock(lockPath, REFRESH_LOCK_STALE_MS);
+        while (token === undefined) {
+            if (Date.now() >= deadline) {
+                throw new Error("Timed out waiting for another Bubble process to finish refreshing credentials. Try again.");
+            }
+            await new Promise((resolve) => setTimeout(resolve, REFRESH_LOCK_POLL_MS));
+            token = tryAcquireLock(lockPath, REFRESH_LOCK_STALE_MS);
+        }
+        const owned = token;
+        const heartbeat = setInterval(() => {
+            try {
+                if (readFileSync(lockPath, "utf-8") === owned)
+                    utimesSync(lockPath, new Date(), new Date());
+            }
+            catch {
+                // Lock gone: nothing to keep alive.
+            }
+        }, REFRESH_LOCK_HEARTBEAT_MS);
+        heartbeat.unref?.();
+        try {
+            return await fn();
+        }
+        finally {
+            clearInterval(heartbeat);
+            releaseLock(lockPath, owned);
+        }
     }
     getPath() {
         return this.authPath;
     }
     get(providerId) {
+        this.sync();
         return this.data[providerId];
     }
     set(providerId, creds) {
-        this.data[providerId] = creds;
-        this.save();
+        this.commit(providerId, creds);
         this.notifyMutation(providerId);
     }
+    /**
+     * Store the result of a refresh only if the entry is still the one that was
+     * refreshed (`fromRefreshToken`; null = the key must still be absent). A
+     * /login or /logout in another process only takes the write lock, so it can
+     * land while a refresh request is in flight; its outcome must win over a
+     * result derived from the credentials it replaced.
+     */
+    replaceIfUnchanged(providerId, creds, fromRefreshToken) {
+        const written = this.commit(providerId, creds, (onDisk) => fromRefreshToken === null ? onDisk === undefined : onDisk?.refreshToken === fromRefreshToken);
+        if (written)
+            this.notifyMutation(providerId);
+        return written;
+    }
     remove(providerId) {
-        delete this.data[providerId];
-        this.save();
+        this.commit(providerId, undefined);
         this.notifyMutation(providerId);
     }
     has(providerId) {
+        this.sync();
         return !!this.data[providerId];
     }
     isExpired(providerId, graceMs = 5 * 60 * 1000) {
+        this.sync();
         const creds = this.data[providerId];
         if (!creds)
             return true;
         return Date.now() >= creds.expiresAt - graceMs;
     }
     getAccessToken(providerId) {
+        this.sync();
         return this.data[providerId]?.accessToken;
     }
     list() {
+        this.sync();
         return Object.keys(this.data);
     }
 }

package/dist/permissions/rule.d.ts

@@ -21,10 +21,13 @@ export declare function parseRules(inputs: string[]): {
 /**
  * Does `rule` match `query`?
  *
- * Tool name must match (or rule.tool is "*"). If the rule has no pattern, it
- * matches any use of that tool. Otherwise the tool-specific matcher decides.
+ * Tool name must match (or rule.tool is "*"; `mcp__server` covers every
+ * `mcp__server__tool`). If the rule has no pattern, it matches any use of that
+ * tool. Otherwise the tool-specific matcher decides. `list` matters for Bash:
+ * an allow rule must cover every command a compound command runs, while a
+ * deny rule fires if it covers any of them.
  */
-export declare function matchRule(rule: PermissionRule, query: PermissionQuery): boolean;
+export declare function matchRule(rule: PermissionRule, query: PermissionQuery, list?: "allow" | "deny"): boolean;
 /**
  * Evaluate a rule set against a query. Deny wins; otherwise first allow wins;
  * otherwise "ask".