@cortexkit/antigravity-auth-core 3.0.16 → 3.0.17

package/dist/common-auth-embedded/fs/refresh-file-lock.d.ts

@@ -1,4 +1,17 @@
 export declare function isLostMarkerRaceError(error: unknown): boolean;
+/** Test-only fault injection between marker mkdir and owner.json write. */
+export interface EvictionMarkerTestHooks {
+    /** Runs after the exclusive mkdir (and identity capture) before owner write. */
+    beforeOwnerWrite?: (evictPath: string, ownerPath: string) => Promise<void> | void;
+    /** Throw to fail the owner write; return an error to throw it. */
+    failOwnerWrite?: (evictPath: string, ownerPath: string) => Promise<unknown> | unknown;
+}
+/**
+ * Tests only: inject a failure or a directory replacement between the
+ * eviction-marker mkdir and its owner.json write. Production never sets this.
+ * Not exported from the fs entry point, so it is not part of the public API.
+ */
+export declare function setEvictionMarkerTestHooksForTest(hooks?: EvictionMarkerTestHooks): void;
 export interface LockLoss {
     readonly reason: 'taken-over' | 'expired' | 'unreadable' | 'renewal-failed' | 'marker-lost';
     readonly expectedOwnerId: string;

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, open, readFile, rename, rm, stat } from 'node:fs/promises';
+import { lstat, mkdir, open, readFile, rename, rm, stat, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
@@ -13,9 +13,35 @@ import { LockOwnershipError, lockPathFor } from './with-lock.js';
  */
 async function createExclusiveText(path, text) {
     const handle = await open(path, 'wx', 0o600);
+    let createdStat;
+    try {
+        createdStat = await handle.stat();
+    }
+    catch {
+        createdStat = undefined;
+    }
     try {
         await handle.writeFile(text, 'utf8');
     }
+    catch (error) {
+        // A failed write after an exclusive create leaves a partial file behind.
+        // Remove only the file just created: when a contender has meanwhile
+        // replaced the path, the identities differ and the successor is left
+        // alone. Removal failures must never mask the original write error.
+        try {
+            const current = await lstat(path).catch(() => undefined);
+            if (createdStat &&
+                current &&
+                current.dev === createdStat.dev &&
+                current.ino === createdStat.ino) {
+                await rm(path, { force: true }).catch(() => { });
+            }
+        }
+        catch {
+            // Best effort only; the original error below explains the failure.
+        }
+        throw error;
+    }
     finally {
         await handle.close();
     }
@@ -31,6 +57,31 @@ export function isLostMarkerRaceError(error) {
     return (code === 'ENOENT' ||
         (!windowsPrivateFiles && (code === 'EINVAL' || code === 'ENOTDIR')));
 }
+let evictionMarkerTestHooks;
+/**
+ * Tests only: inject a failure or a directory replacement between the
+ * eviction-marker mkdir and its owner.json write. Production never sets this.
+ * Not exported from the fs entry point, so it is not part of the public API.
+ */
+export function setEvictionMarkerTestHooksForTest(hooks) {
+    evictionMarkerTestHooks = hooks;
+}
+function sameMarkerDirectory(created, current) {
+    if (created.dev !== current.dev || created.ino !== current.ino)
+        return false;
+    // Windows reports the directory identity as a file id that can be 0; fall
+    // back to creation time so a reused id does not look like the same directory.
+    if (created.ino === 0 && created.birthtimeMs !== current.birthtimeMs)
+        return false;
+    return true;
+}
+/**
+ * An ownerless marker older than this is recoverable without waiting for the
+ * full eviction TTL. Honest holders write owner.json within tens of
+ * milliseconds of the mkdir, so one second leaves wide margin for slow Windows
+ * filesystems while still bounding the stall from a crashed holder.
+ */
+const OWNERLESS_MARKER_GRACE_MS = 1_000;
 /** Filesystem leases share wall time across all callers and processes. */
 export function acquireRefreshFileLock(options) {
     return acquireRefreshFileLockWithClock({ ...options, now: Date.now });
@@ -321,12 +372,66 @@ export async function acquireRefreshFileLockWithClock(options) {
             await removeLeaseObject(evictPath);
         }
     }
+    // Returns whether the directory at the marker path was still the one this
+    // process created when its owner write failed. Only then is the failure ours
+    // to report: a gone or replaced directory is a lost race.
+    async function removeOwnMarkerAfterFailedOwnerWrite(created) {
+        // Best effort only: never throws, so the original owner-write error below
+        // keeps explaining the failure. Removes the directory this process just
+        // created when its owner write failed, and leaves a contender's
+        // replacement alone when the identities differ.
+        if (!created)
+            return false;
+        let current;
+        try {
+            const st = await lstat(evictPath);
+            current = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
+        }
+        catch {
+            // Renamed away by a contender's steal: nothing of ours left to clean.
+            return false;
+        }
+        if (!sameMarkerDirectory(created, current))
+            return false;
+        // Remove only an ownerless directory. An owner file that appeared after
+        // our failed write belongs to someone: ours goes through
+        // releaseEvictionMarker in the caller, and a contender's must stay, since
+        // it may be holding the marker right now.
+        try {
+            await stat(evictOwnerPath);
+            return true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                return true;
+        }
+        try {
+            await removeLeaseObject(evictPath);
+        }
+        catch {
+            // A removal failure keeps the stale marker recoverable later; it must
+            // never mask the original owner-write error.
+        }
+        return true;
+    }
     async function tryAcquireEvictionMarker() {
         if (windowsPrivateFiles)
             await createPrivateDirectoryExclusive(evictPath);
         else
             await mkdir(evictPath);
+        let created;
+        try {
+            const st = await lstat(evictPath);
+            created = { dev: st.dev, ino: st.ino, birthtimeMs: st.birthtimeMs };
+        }
+        catch {
+            created = undefined;
+        }
         try {
+            await evictionMarkerTestHooks?.beforeOwnerWrite?.(evictPath, evictOwnerPath);
+            const injected = await evictionMarkerTestHooks?.failOwnerWrite?.(evictPath, evictOwnerPath);
+            if (injected !== undefined)
+                throw injected;
             const bytes = `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}\n`;
             if (windowsPrivateFiles)
                 await createPrivateBytes(evictOwnerPath, bytes);
@@ -339,9 +444,26 @@ export async function acquireRefreshFileLockWithClock(options) {
             // path below does exactly that). That is a lost race, not a failure, so
             // report it as such and let the caller back off and retry rather than
             // failing the whole lock acquisition.
-            if (isLostMarkerRaceError(error))
+            //
+            // The race codes alone cannot prove the directory is gone: the same
+            // codes can surface while our directory is still in place (for example
+            // a permission failure while writing the owner file, which used to
+            // leave an ownerless marker behind). The identity fence
+            // above removes only the directory this process created, and is a no-op
+            // when the contender renamed it away or replaced it, so run it on both
+            // branches before deciding between a retry and a failure.
+            // A race code while our own directory is still in place is not a lost
+            // race but a write that fails here every time: report it, rather than
+            // retrying the same failure until a deadline hides the cause.
+            const stillOurs = await removeOwnMarkerAfterFailedOwnerWrite(created);
+            if (isLostMarkerRaceError(error) && !stillOurs)
                 return false;
-            await releaseEvictionMarker();
+            try {
+                await releaseEvictionMarker();
+            }
+            catch {
+                // Removal must never mask the original owner-write error.
+            }
             throw error;
         }
         if (options.onStep)
@@ -371,8 +493,29 @@ export async function acquireRefreshFileLockWithClock(options) {
                 throw error;
             }
         }
-        if (evictStat.mtimeMs + EVICT_TTL > now())
-            return 'fresh';
+        if (evictStat.mtimeMs + EVICT_TTL > now()) {
+            // A fresh marker with no owner is either this process's orphan (its
+            // owner write just failed) or a holder that crashed between mkdir and
+            // owner write. Honest holders publish owner.json within tens of
+            // milliseconds, so recover ownerless markers after a short grace instead
+            // of stalling for the full TTL. Stealing one is safe: a live holder
+            // stalled past the grace sees its pending owner write fail with ENOENT
+            // (a lost race) and retries, rather than acting on a stolen marker.
+            let hasOwner = true;
+            try {
+                await stat(evictOwnerPath);
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    hasOwner = false;
+                else
+                    return 'fresh';
+            }
+            if (hasOwner)
+                return 'fresh';
+            if (evictStat.mtimeMs + OWNERLESS_MARKER_GRACE_MS > now())
+                return 'fresh';
+        }
         if (options.onStep)
             await options.onStep('stale-marker-stat');
         const claimedPath = `${evictPath}.${randomUUID()}`;
@@ -699,7 +842,12 @@ export async function acquireRefreshFileLockWithClock(options) {
             released = true;
             cancelRenewalTimer();
             await renewalInFlight;
-            for (let attempt = 0; attempt < MAX_STEAL_ATTEMPTS; attempt++) {
+            // A fresh marker may outlive a few quick retries, especially on Windows.
+            // Allow its full TTL plus recovery time, using a monotonic deadline so
+            // wall-clock adjustments cannot extend the retry deadline.
+            const deadline = performance.now() + EVICT_TTL + 1_000;
+            let delayMs = 5;
+            for (;;) {
                 try {
                     let removalConfirmed = false;
                     const markerAcquired = await withEvictionMarker(async () => {
@@ -741,7 +889,11 @@ export async function acquireRefreshFileLockWithClock(options) {
                         throw error;
                     return;
                 }
-                await backoff();
+                const remainingMs = deadline - performance.now();
+                if (remainingMs <= 0)
+                    break;
+                await new Promise((resolve) => setTimeout(resolve, Math.min(delayMs, remainingMs)));
+                delayMs = Math.min(delayMs * 2, 50);
             }
             // Do not delete by pathname without the marker: bounded retries leave the
             // lease to expire rather than risking removal of a successor's lock.

package/dist/common-auth-embedded/pi-slot/lock.js

@@ -75,6 +75,16 @@ async function acquire(path, stale) {
         await remove(path);
         return acquire(path, 0);
     }
+    // The exclusive mkdir above succeeded: capture this directory's identity
+    // before any further step, so cleanup below removes only what we created.
+    let created;
+    try {
+        const st = await stat(path);
+        created = { dev: st.dev, ino: st.ino };
+    }
+    catch {
+        created = undefined;
+    }
     try {
         if (!precision) {
             const probe = new Date(Math.ceil(Date.now() / 1_000) * 1_000 + 5);
@@ -86,7 +96,22 @@ async function acquire(path, stale) {
         return { dev: observed.dev, ino: observed.ino, mtime };
     }
     catch (error) {
-        await remove(path).catch(() => { });
+        // Only remove the directory this call created. A contender can rename it
+        // away and publish its own lock between the mkdir above and this failure;
+        // an unfenced rmdir would then delete the successor. The directory holds
+        // no owner file (mtime is the lease), so identity alone is the fence.
+        try {
+            if (created) {
+                const current = await stat(path).catch(() => undefined);
+                if (current &&
+                    current.dev === created.dev &&
+                    current.ino === created.ino)
+                    await remove(path).catch(() => { });
+            }
+        }
+        catch {
+            // Best effort only; the original error below explains the failure.
+        }
         throw error;
     }
 }

package/dist/common-auth-embedded/source-output.json

@@ -1,7 +1,7 @@
 {
   "schema": 1,
   "package": "@cortexkit/common-auth",
-  "version": "0.28.0",
+  "version": "0.29.0",
   "artifactStatus": "published",
   "publicRoots": {
     "./store": {
@@ -37,15 +37,15 @@
       "import": "./dist/pi-slot/index.js"
     }
   },
-  "input": "tools/common-auth-build/inputs/cortexkit-common-auth-0.28.0.tgz",
-  "tarballSha256": "8070e3c1882238d78ac5e955fb140484e08d9f97ed0f2d5d40f35928c60fbbc5",
-  "sri": "sha512-PRyppMdE3y8dTzF3iQHcFruo5ksPPhgSQExe7g4Ij/oPynDLbalSQqBaInKdSV/v5qyrY0iJs/D0Yu7fbWh3NQ==",
+  "input": "tools/common-auth-build/inputs/cortexkit-common-auth-0.29.0.tgz",
+  "tarballSha256": "6d8795d0672353ab897f938cad86c63556ceab7704bd60498a8c8e1a62dbc207",
+  "sri": "sha512-XnNFY5ppNQRDP09lUTDDONGHwiJ8Z93w8/NP16pmWpC6lzBPkC7XJcHhld+B6iLATaNvbcenfhecitB8fS9nbQ==",
   "canonicalFiles": 147,
-  "canonicalBytes": 985409,
+  "canonicalBytes": 994153,
   "generator": {
     "path": "packages/opencode/scripts/embed-common-auth.ts",
     "version": 3,
-    "sha256": "32e05acc65fbec2114dce8a43e29e3eca2d6f02594f20e3f6e7bc3b1ec9b8aa3"
+    "sha256": "ece06fd4117208e4b276fee17386d3a0f93e641cee49c0d30d985c169c551ad2"
   },
   "files": [
     {
@@ -595,17 +595,17 @@
     {
       "source": "package/dist/fs/refresh-file-lock.d.ts",
       "output": "fs/refresh-file-lock.d.ts",
-      "bytes": 2157,
-      "sourceSha256": "cbce15eb313d425501780dd4be657cbbaa7e41064bab4ae64fea91fbd54918e9",
-      "outputSha256": "cbce15eb313d425501780dd4be657cbbaa7e41064bab4ae64fea91fbd54918e9",
+      "bytes": 2946,
+      "sourceSha256": "b649e67813eb4086ca5642c99d318f90ccccae9702b23ad8fb0616f8d62f5a06",
+      "outputSha256": "b649e67813eb4086ca5642c99d318f90ccccae9702b23ad8fb0616f8d62f5a06",
       "transform": "verbatim"
     },
     {
       "source": "package/dist/fs/refresh-file-lock.js",
       "output": "fs/refresh-file-lock.js",
-      "bytes": 30833,
-      "sourceSha256": "c0e4de79b0c0bb8fac09b13c5cf861eaa008434b336e87ce761d7f0713203a90",
-      "outputSha256": "c0e4de79b0c0bb8fac09b13c5cf861eaa008434b336e87ce761d7f0713203a90",
+      "bytes": 37753,
+      "sourceSha256": "38bc20ae71a195818f9cf7e42954e8305f92a55ff15dd855da33ccdec6b34fa1",
+      "outputSha256": "38bc20ae71a195818f9cf7e42954e8305f92a55ff15dd855da33ccdec6b34fa1",
       "transform": "verbatim"
     },
     {
@@ -707,9 +707,9 @@
     {
       "source": "package/dist/pi-slot/lock.js",
       "output": "pi-slot/lock.js",
-      "bytes": 7385,
-      "sourceSha256": "68b0c7c764b88391e466f3b9fa172df176bf21529399606bf84475f3b920db8b",
-      "outputSha256": "68b0c7c764b88391e466f3b9fa172df176bf21529399606bf84475f3b920db8b",
+      "bytes": 8420,
+      "sourceSha256": "533de03f6b53624301e75565b7d677382acec3c9eda9cfdb7265a0e868aaeb82",
+      "outputSha256": "533de03f6b53624301e75565b7d677382acec3c9eda9cfdb7265a0e868aaeb82",
       "transform": "verbatim"
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/antigravity-auth-core",
-  "version": "3.0.16",
+  "version": "3.0.17",
   "description": "Harness-agnostic core for Google Antigravity OAuth: transport, fingerprint, request transforms, accounts, quota",
   "type": "module",
   "license": "MIT",
@@ -80,7 +80,7 @@
   "dependencies": {
     "@cortexkit/claustrum-client": "0.12.0",
     "@cortexkit/subc-client": "0.22.5",
-    "@cortexkit/private-files": "0.2.1",
+    "@cortexkit/private-files": "0.2.2",
     "xdg-basedir": "^5.1.0",
     "zod": "^4.0.0"
   },