@cortexkit/antigravity-auth-core 3.0.3 → 3.0.4

package/dist/common-auth-embedded/fs/refresh-file-lock.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'node:crypto';
 import { mkdir, open, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { createPrivateBytes, createPrivateDirectoryExclusive, ensurePrivateDirectory, PrivateFileError, privateOperation, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from './private-files.js';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
 const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
@@ -10,7 +11,8 @@ const clearRefreshLockRenewalTimeout = globalThis.clearTimeout.bind(globalThis);
 // to hold — a lost race the caller should retry, not a fatal lock error.
 export function isLostMarkerRaceError(error) {
     const code = error?.code;
-    return code === 'ENOENT' || code === 'EINVAL' || code === 'ENOTDIR';
+    return (code === 'ENOENT' ||
+        (!windowsPrivateFiles && (code === 'EINVAL' || code === 'ENOTDIR')));
 }
 export async function acquireRefreshFileLock(options) {
     const lockPath = lockPathFor(options.path, options.name);
@@ -19,6 +21,7 @@ export async function acquireRefreshFileLock(options) {
     const now = options.now ?? Date.now;
     let renewTimer = null;
     let released = false;
+    let releaseConfirmed = false;
     let loss;
     let resolveLoss;
     const lostPromise = new Promise((resolve) => {
@@ -61,6 +64,7 @@ export async function acquireRefreshFileLock(options) {
         cancelRenewalTimer();
         resolveLoss(loss);
     }
+    let terminalIOError;
     let renewalInFlight = null;
     // Only the owner of this exclusively-created marker may remove or renew a
     // lock. A contender recovering a stale marker can accidentally rename a newer
@@ -72,6 +76,18 @@ export async function acquireRefreshFileLock(options) {
     const EVICT_TTL = 5_000;
     const MAX_STEAL_ATTEMPTS = 8;
     async function readOwner() {
+        if (windowsPrivateFiles) {
+            try {
+                return JSON.parse(await readPrivateText(lockPath, true));
+            }
+            catch (error) {
+                if (error.code !== 'EISDIR' &&
+                    error.reason !== 'wrong-kind')
+                    throw error;
+                await verifyPrivate(lockPath, 'directory', true);
+                return JSON.parse(await readPrivateText(legacyOwnerPath, true));
+            }
+        }
         try {
             return JSON.parse(await readFile(lockPath, 'utf8'));
         }
@@ -83,6 +99,25 @@ export async function acquireRefreshFileLock(options) {
         }
     }
     async function writeOwner() {
+        if (windowsPrivateFiles) {
+            const owner = await readOwner();
+            const remaining = Number(owner?.expiresAt) - now();
+            await writePrivateAtomic(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, {
+                deadline: performance.now() + Math.max(0, remaining),
+                beforeRename: async () => {
+                    const current = await readOwner();
+                    if (current?.ownerId !== ownerId ||
+                        !(Number(current?.expiresAt) > now()) ||
+                        !(await ownsEvictionMarker())) {
+                        throw new LockOwnershipError({
+                            target: options.path,
+                            name: options.name,
+                        });
+                    }
+                },
+            });
+            return;
+        }
         // Readers must see a complete lease, even while renewal is writing.
         const tempPath = `${lockPath}.${randomUUID()}.tmp`;
         let handle;
@@ -94,6 +129,15 @@ export async function acquireRefreshFileLock(options) {
             await handle.chmod(0o600);
             await handle.close();
             handle = undefined;
+            const current = await readOwner();
+            if (current?.ownerId !== ownerId ||
+                !(Number(current?.expiresAt) > now()) ||
+                !(await ownsEvictionMarker())) {
+                throw new LockOwnershipError({
+                    target: options.path,
+                    name: options.name,
+                });
+            }
             await rename(tempPath, lockPath);
             created = false;
         }
@@ -103,25 +147,56 @@ export async function acquireRefreshFileLock(options) {
                 await rm(tempPath, { force: true }).catch(() => { });
         }
     }
+    async function createLease() {
+        const bytes = `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`;
+        if (windowsPrivateFiles)
+            await createPrivateBytes(lockPath, bytes);
+        else
+            await writeFile(lockPath, bytes, {
+                encoding: 'utf8',
+                mode: 0o600,
+                flag: 'wx',
+            });
+    }
+    async function leaseContention(error) {
+        const code = error.code;
+        if (code === 'EEXIST') {
+            if (windowsPrivateFiles)
+                await readOwner();
+            return true;
+        }
+        if (code === 'EISDIR') {
+            if (windowsPrivateFiles) {
+                await verifyPrivate(lockPath, 'directory', true);
+                await readPrivateText(legacyOwnerPath, true);
+            }
+            return true;
+        }
+        return false;
+    }
     async function tryAcquire() {
+        if (windowsPrivateFiles)
+            await ensurePrivateDirectory(dirname(lockPath));
         try {
-            await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            await createLease();
             return true;
         }
         catch (error) {
             const code = error.code;
-            if (code === 'EEXIST' || code === 'EISDIR')
+            if (await leaseContention(error))
                 return false;
             if (code === 'ENOENT') {
                 // Reboots can clear runtime temp directories before the next lock acquisition.
-                await mkdir(dirname(lockPath), { recursive: true });
+                if (windowsPrivateFiles)
+                    await ensurePrivateDirectory(dirname(lockPath));
+                else
+                    await mkdir(dirname(lockPath), { recursive: true });
                 try {
-                    await writeFile(lockPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+                    await createLease();
                     return true;
                 }
                 catch (retryError) {
-                    const retryCode = retryError.code;
-                    if (retryCode === 'EEXIST' || retryCode === 'EISDIR')
+                    if (await leaseContention(retryError))
                         return false;
                     throw retryError;
                 }
@@ -132,41 +207,108 @@ export async function acquireRefreshFileLock(options) {
     async function backoff() {
         await new Promise((resolve) => setTimeout(resolve, Math.floor(Math.random() * 4)));
     }
-    async function lockIsLive() {
+    async function readLockState(notifyReady = true) {
+        if (notifyReady && options.onStep)
+            await options.onStep('lock-read-ready');
+        let owner;
         try {
-            const currentOwner = await readOwner();
-            return Number(currentOwner?.expiresAt) > now();
+            owner = await readOwner();
         }
-        catch {
-            try {
-                const current = await stat(lockPath);
-                return current.mtimeMs + options.ttlMs > now();
-            }
-            catch {
-                // Lock doesn't exist — safe to acquire.
-                return false;
+        catch (error) {
+            if (windowsPrivateFiles &&
+                error.code !== 'ENOENT')
+                throw error;
+        }
+        const expiresAt = Number(owner?.expiresAt);
+        if (Number.isFinite(expiresAt) && expiresAt > now())
+            return { status: 'live' };
+        if (typeof owner?.ownerId === 'string' && Number.isFinite(expiresAt)) {
+            return {
+                status: 'stale',
+                identity: { kind: 'owner', ownerId: owner.ownerId, expiresAt },
+            };
+        }
+        try {
+            const current = await stat(lockPath);
+            const legacyExpiry = Number.isFinite(expiresAt)
+                ? expiresAt
+                : current.mtimeMs + options.ttlMs;
+            if (legacyExpiry > now())
+                return { status: 'live' };
+            return {
+                status: 'stale',
+                identity: {
+                    kind: 'stat',
+                    dev: current.dev,
+                    ino: current.ino,
+                    mtimeMs: current.mtimeMs,
+                    expiresAt: legacyExpiry,
+                },
+            };
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                if (options.onStep)
+                    await options.onStep('lock-missing');
+                return { status: 'missing' };
             }
+            throw error;
+        }
+    }
+    function sameStaleLock(observed, current) {
+        if (current.status !== 'stale')
+            return false;
+        const identity = current.identity;
+        if (observed.kind === 'owner' && identity.kind === 'owner') {
+            return (observed.ownerId === identity.ownerId &&
+                observed.expiresAt === identity.expiresAt);
         }
+        return (observed.kind === 'stat' &&
+            identity.kind === 'stat' &&
+            observed.dev === identity.dev &&
+            observed.ino === identity.ino &&
+            observed.mtimeMs === identity.mtimeMs &&
+            observed.expiresAt === identity.expiresAt);
     }
     // Fail-closed: any read error means we do NOT own the marker.
     async function ownsEvictionMarker() {
         try {
-            const owner = JSON.parse(await readFile(evictOwnerPath, 'utf8'));
+            const owner = JSON.parse(await readPrivateText(evictOwnerPath, windowsPrivateFiles));
             return owner?.ownerId === evictOwnerId;
         }
-        catch {
+        catch (error) {
+            if (windowsPrivateFiles &&
+                error.code !== 'ENOENT')
+                throw error;
             return false;
         }
     }
+    async function removeLeaseObject(path) {
+        if (windowsPrivateFiles)
+            await privateOperation(path, 'remove', () => rm(path, { recursive: true, force: true }));
+        else
+            await rm(path, { recursive: true, force: true }).catch(() => { });
+    }
     async function releaseEvictionMarker() {
         if (await ownsEvictionMarker()) {
-            await rm(evictPath, { recursive: true, force: true }).catch(() => { });
+            await removeLeaseObject(evictPath);
         }
     }
     async function tryAcquireEvictionMarker() {
-        await mkdir(evictPath);
+        if (windowsPrivateFiles)
+            await createPrivateDirectoryExclusive(evictPath);
+        else
+            await mkdir(evictPath);
         try {
-            await writeFile(evictOwnerPath, `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            const bytes = `${JSON.stringify({ ownerId: evictOwnerId, createdAt: now() })}\n`;
+            if (windowsPrivateFiles)
+                await createPrivateBytes(evictOwnerPath, bytes);
+            else
+                await writeFile(evictOwnerPath, bytes, {
+                    encoding: 'utf8',
+                    mode: 0o600,
+                    flag: 'wx',
+                });
         }
         catch (error) {
             // A competing contender can rename our just-created marker directory
@@ -193,6 +335,8 @@ export async function acquireRefreshFileLock(options) {
                 return 'missing';
             throw error;
         }
+        if (windowsPrivateFiles)
+            await verifyPrivate(evictPath, 'directory', true);
         if (evictStat.mtimeMs + EVICT_TTL > now())
             return 'fresh';
         if (options.onStep)
@@ -208,7 +352,7 @@ export async function acquireRefreshFileLock(options) {
         }
         if (options.onStep)
             await options.onStep('stale-marker-claimed');
-        await rm(claimedPath, { recursive: true, force: true }).catch(() => { });
+        await removeLeaseObject(claimedPath);
         return 'recovered';
     }
     async function withEvictionMarker(action) {
@@ -217,8 +361,19 @@ export async function acquireRefreshFileLock(options) {
                 return false;
         }
         catch (error) {
-            if (error.code === 'EEXIST')
+            if (error.code === 'EEXIST') {
+                if (windowsPrivateFiles) {
+                    await verifyPrivate(evictPath, 'directory', true);
+                    try {
+                        await readPrivateText(evictOwnerPath, true);
+                    }
+                    catch (ownerError) {
+                        if (ownerError.code !== 'ENOENT')
+                            throw ownerError;
+                    }
+                }
                 return false;
+            }
             throw error;
         }
         try {
@@ -241,7 +396,9 @@ export async function acquireRefreshFileLock(options) {
             try {
                 owner = await readOwner();
             }
-            catch {
+            catch (error) {
+                if (windowsPrivateFiles)
+                    throw error;
                 return;
             }
             if (owner?.ownerId !== ownerId)
@@ -250,7 +407,9 @@ export async function acquireRefreshFileLock(options) {
                 await rm(lockPath, { recursive: true, force: true });
                 return;
             }
-            catch {
+            catch (error) {
+                if (windowsPrivateFiles)
+                    throw error;
                 await backoff();
             }
         }
@@ -306,6 +465,8 @@ export async function acquireRefreshFileLock(options) {
                             return;
                         }
                         await writeOwner();
+                        if (options.onStep)
+                            await options.onStep('renewal-write-finished');
                         if (!(await ownsEvictionMarker())) {
                             // If marker ownership cannot be read, stop claiming the lease
                             // and remove only a record that still carries our owner id.
@@ -319,7 +480,12 @@ export async function acquireRefreshFileLock(options) {
                         await options.onStep('renewal-marker-unavailable');
                     }
                 }
-                catch {
+                catch (error) {
+                    if (windowsPrivateFiles && error instanceof PrivateFileError) {
+                        terminalIOError = error;
+                        recordLoss('renewal-failed');
+                        shouldReschedule = false;
+                    }
                     // Retry transient failures only while the lease can still be verified.
                     try {
                         const owner = await readOwner();
@@ -376,8 +542,12 @@ export async function acquireRefreshFileLock(options) {
             acquired = await tryAcquire();
             if (acquired)
                 break;
-            if (await lockIsLive())
+            const observed = await readLockState();
+            if (observed.status === 'live')
                 return contended();
+            // Absence is a create opportunity, never evidence of an expired lease.
+            if (observed.status === 'missing')
+                continue;
             if (options.onStep)
                 await options.onStep('stale-lock-observed');
             try {
@@ -397,8 +567,11 @@ export async function acquireRefreshFileLock(options) {
                 continue;
             }
             try {
-                if (await lockIsLive())
+                const confirmed = await readLockState();
+                if (confirmed.status === 'live')
                     return contended();
+                if (!sameStaleLock(observed.identity, confirmed))
+                    continue;
                 // Verify marker ownership before removing a lock found not live.
                 if (!(await ownsEvictionMarker()))
                     return null;
@@ -408,7 +581,18 @@ export async function acquireRefreshFileLock(options) {
                 // our marker, so verify ownership again after the callback.
                 if (!(await ownsEvictionMarker()))
                     return null;
-                await rm(lockPath, { recursive: true, force: true }).catch(() => { });
+                // Do not await a callback between this ownership check and the lock read.
+                const current = await readLockState(false);
+                if (!sameStaleLock(observed.identity, current))
+                    continue;
+                // The final read and removal are not atomic. While this stale file
+                // exists, wx cannot create a successor; the marker excludes other
+                // evictors and release/renewal. An expired holder cannot renew: renewal
+                // rechecks expiry and marker ownership immediately before publishing.
+                // With the marker still owned, cooperating users cannot replace it in
+                // this window. Arbitrary suspension across marker expiry or filesystem
+                // changes still need a kernel lock for an atomic guarantee.
+                await removeLeaseObject(lockPath);
                 // Fence check 3: re-verify ownership after removing the stale lock.
                 if (!(await ownsEvictionMarker()))
                     return null;
@@ -442,6 +626,8 @@ export async function acquireRefreshFileLock(options) {
         whenLost: () => lostPromise,
         hasLost: () => loss !== undefined,
         assertOwned: async () => {
+            if (terminalIOError)
+                throw terminalIOError;
             let observed;
             try {
                 const owner = await readOwner();
@@ -453,9 +639,11 @@ export async function acquireRefreshFileLock(options) {
                     return;
                 recordLoss(owner?.ownerId !== ownerId ? 'taken-over' : 'expired', owner);
             }
-            catch {
+            catch (error) {
                 // Unreadable ownership is not evidence of a valid lease.
                 recordLoss('unreadable');
+                if (windowsPrivateFiles && error instanceof PrivateFileError)
+                    throw error;
             }
             throw new LockOwnershipError({
                 target: options.path,
@@ -470,32 +658,61 @@ export async function acquireRefreshFileLock(options) {
             });
         },
         release: async () => {
+            if (windowsPrivateFiles && releaseConfirmed)
+                return;
             released = true;
             cancelRenewalTimer();
             await renewalInFlight;
             for (let attempt = 0; attempt < MAX_STEAL_ATTEMPTS; attempt++) {
                 try {
+                    let removalConfirmed = false;
                     const markerAcquired = await withEvictionMarker(async () => {
-                        const owner = await readOwner();
-                        if (owner?.ownerId !== ownerId)
+                        let owner;
+                        try {
+                            owner = await readOwner();
+                        }
+                        catch (error) {
+                            if (windowsPrivateFiles &&
+                                error.code === 'ENOENT') {
+                                removalConfirmed = true;
+                                return;
+                            }
+                            throw error;
+                        }
+                        if (owner?.ownerId !== ownerId) {
+                            removalConfirmed = true;
                             return;
+                        }
                         if (options.onStep)
                             await options.onStep('release-owner-confirmed');
                         if (!(await ownsEvictionMarker()))
                             return;
-                        await rm(lockPath, { recursive: true, force: true }).catch(() => { });
+                        await removeLeaseObject(lockPath);
+                        removalConfirmed = true;
                     });
-                    if (markerAcquired)
+                    if (markerAcquired) {
+                        if (windowsPrivateFiles && !removalConfirmed)
+                            throw new PrivateFileError(lockPath, 'release-not-confirmed', {
+                                code: 'EIO',
+                            });
+                        releaseConfirmed = removalConfirmed;
                         return;
+                    }
                     await recoverStaleEvictionMarker();
                 }
-                catch {
+                catch (error) {
+                    if (windowsPrivateFiles)
+                        throw error;
                     return;
                 }
                 await backoff();
             }
             // Do not delete by pathname without the marker: bounded retries leave the
             // lease to expire rather than risking removal of a successor's lock.
+            if (windowsPrivateFiles)
+                throw new PrivateFileError(lockPath, 'release-not-confirmed', {
+                    code: 'ETIMEDOUT',
+                });
         },
     };
 }

package/dist/common-auth-embedded/fs/with-lock.d.ts

@@ -1,3 +1,4 @@
+import { acquireRefreshFileLock } from './refresh-file-lock.js';
 export declare function lockPathFor(target: string, name: string): string;
 export declare class LockContentionError extends Error {
     readonly details: {
@@ -27,6 +28,8 @@ export interface LockOptions {
     ttlMs: number;
     timeoutMs: number;
     renew?: boolean;
+    onStep?: Parameters<typeof acquireRefreshFileLock>[0]['onStep'];
+    onRenewalTimer?: Parameters<typeof acquireRefreshFileLock>[0]['onRenewalTimer'];
 }
 export declare function withLock<T>(target: string, options: LockOptions, fn: (lock: {
     assertOwned(): Promise<void>;

package/dist/common-auth-embedded/fs/with-lock.js

@@ -26,6 +26,10 @@ export async function withLock(target, options, fn) {
             name: options.name,
             ttlMs: options.ttlMs,
             renew: options.renew ?? false,
+            ...(options.onStep ? { onStep: options.onStep } : {}),
+            ...(options.onRenewalTimer
+                ? { onRenewalTimer: options.onRenewalTimer }
+                : {}),
         });
         if (lock) {
             try {

package/dist/common-auth-embedded/logger/engine.d.ts

@@ -62,11 +62,10 @@ export interface LoggerInstance {
     /** Operator override of the level floor; undefined removes it. */
     setLogLevel(level: Level | undefined): void;
     /**
-     * Write whatever is buffered. Safe to call synchronously from a
-     * process-exit handler, which is how each host drains the buffer on
-     * shutdown.
+     * On Windows this returns a promise and must be awaited before shutdown;
+     * synchronous process-exit flushing remains available on POSIX only.
      */
-    flushLogs(): void;
+    flushLogs(): void | Promise<void>;
 }
 /**
  * A logger instance of its own, configured with `options`. A plugin whose
@@ -84,11 +83,10 @@ export declare function createLoggerInstance(options: LoggerOptions): LoggerInst
 export declare function initLogger(options: LoggerOptions): LoggerInstance;
 export declare function setLogLevel(l: Level | undefined): void;
 /**
- * Write whatever the default logger has buffered. Safe to call synchronously
- * from a process-exit handler, which is how each host drains the buffer on
- * shutdown.
+ * Write whatever the default logger has buffered. On Windows await the
+ * promise before shutdown; POSIX keeps synchronous process-exit flushing.
  */
-export declare function flushLogs(): void;
+export declare function flushLogs(): void | Promise<void>;
 export declare function createLogger(channel: string): ChannelLogger;
 export declare function flushForTest(): Promise<void>;
 /**