@cortexkit/common-auth 0.11.1 → 0.11.2

package/dist/claustrum/custody.d.ts

@@ -87,6 +87,12 @@ export interface ClaustrumScopedAttempt {
      * in from the roster or from a token parse.
      */
     readonly assertedAccountIdentity?: string;
+    /**
+     * The non-secret Google Cloud project id the vault served in get_scoped for
+     * this attempt, if any. Never filled in from list_scoped, the roster or a
+     * token parse. A project change in the vault takes effect on the next send.
+     */
+    readonly projectId?: string;
     /**
      * Kept in memory only and hidden from JSON.stringify and object spreads, so
      * logging a receipt never leaks it. Authorize again for every dispatch and retry.

package/dist/claustrum/custody.js

@@ -298,6 +298,9 @@ export class ClaustrumScopedCustody {
             ...(assertedIdentity !== undefined && {
                 assertedAccountIdentity: assertedIdentity,
             }),
+            ...(served.projectId !== undefined && {
+                projectId: served.projectId,
+            }),
             recordVersion: served.recordVersion,
             expiresAtMs,
         }, 'accessToken', { value: accessToken, enumerable: false }));

package/dist/opencode2/errors.d.ts

@@ -2,7 +2,9 @@
  * Why an OpenCode 2 auth hook refused a request.
  *
  * - `no-account`: the adapter had no account to offer for this request, so
- *   the request is stopped before the host picks a transport.
+ *   the request is stopped before the host picks a transport. Also used when
+ *   session forgetting or installation disposal revokes an in-flight auth
+ *   selection: that selection no longer has an account it may send under.
  * - `host-credential-on-wire`: after every rewrite, a header still carried
  *   one of the host's placeholder credentials. Sending it would leak a
  *   non-routable value to the provider and fail with a confusing error.

package/dist/opencode2/install.js

@@ -129,6 +129,9 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     let warnedUnmarkedSend = false;
     const listeners = new Map();
     let seq = 0;
+    let disposed = false;
+    /** Only active hook calls are held; forgetting never leaves a session tombstone. */
+    const inFlight = new Map();
     const warn = (message, data) => {
         try {
             logger?.warn(message, data);
@@ -200,12 +203,47 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     const accountOf = (rec) => rec.accountId === undefined
         ? undefined
         : { ...rec.scope, accountId: rec.accountId };
-    const noAccount = (scope) => new OpenCode2AuthError({
+    const noAccount = (scope, message) => new OpenCode2AuthError({
         kind: 'no-account',
         providerID,
         sessionID: scope.sessionID,
         requestKind: scope.kind,
+        ...(message === undefined ? {} : { message }),
     });
+    const revokeSelections = (sessionID) => {
+        inFlight.get(sessionID)?.clear();
+        inFlight.delete(sessionID);
+    };
+    /**
+     * Owns selection through its transport handoff, not just the adapter calls.
+     * Deleting a session's set revokes its old calls without poisoning reuse of
+     * that id. Each await must recheck before calling the adapter or publishing.
+     */
+    const withSelection = async (scope, run) => {
+        const revoked = () => noAccount(scope, `${providerID} ${scope.kind} request has no account: its auth selection was revoked by session forgetting or installation disposal`);
+        if (disposed)
+            throw revoked();
+        let selections = inFlight.get(scope.sessionID);
+        if (!selections) {
+            selections = new Set();
+            inFlight.set(scope.sessionID, selections);
+        }
+        const token = {};
+        selections.add(token);
+        const assertActive = () => {
+            if (!selections.has(token))
+                throw revoked();
+        };
+        try {
+            return await run(assertActive);
+        }
+        finally {
+            selections.delete(token);
+            // An old call may settle after a new call has reused the session id.
+            if (selections.size === 0 && inFlight.get(scope.sessionID) === selections)
+                inFlight.delete(scope.sessionID);
+        }
+    };
     const guard = (scope, headers) => {
         for (const [name, value] of headers) {
             if (forbidden.some((secret) => value.includes(secret))) {
@@ -240,7 +278,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         }
     };
-    const select = async (scope, hook, transport) => {
+    const select = async (scope, hook, assertActive, transport) => {
         const key = keyOf(scope.sessionID, scope.kind);
         const retried = pendingRetries.get(key);
         pendingRetries.delete(key);
@@ -254,10 +292,12 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                 : { rerouteFrom: retried.rerouteFrom }),
         };
         const accountId = await adapter.chooseAccount(input);
+        assertActive();
         let headers = {};
         let data;
         if (accountId !== undefined) {
             const result = await adapter.accountHeaders({ ...scope, accountId });
+            assertActive();
             if (isHeadersResult(result)) {
                 headers = result.headers;
                 data = result.attempt;
@@ -306,7 +346,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     // of the attempt it started. Choosing here too keeps a request that skipped
     // it from going out under the host credential, and a second send of the
     // same attempt from reusing the first send's attempt.
-    const bind = async (scope, hook, transport, mark) => {
+    const bind = async (scope, hook, transport, mark, assertActive) => {
         const key = keyOf(scope.sessionID, scope.kind);
         let rec = mark === undefined ? undefined : attempts.get(mark);
         if (rec?.key !== key)
@@ -322,7 +362,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         }
         if (!rec || rec.transport !== undefined || rec.ended)
-            rec = await select(scope, hook, transport);
+            rec = await select(scope, hook, assertActive, transport);
         else {
             rec.transport = transport;
             if (rec.attempt)
@@ -443,18 +483,20 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
     };
     const scoped = { providerID };
     const registrations = [];
-    registrations.push(await ctx.session.hook('model.request', async (draft) => {
-        const rec = await select(scopeOf(draft), 'model.request');
+    registrations.push(await ctx.session.hook('model.request', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
+        const rec = await select(scopeOf(draft), 'model.request', assertActive);
+        assertActive();
         if (rec.accountId === undefined)
             throw noAccount(rec.scope);
         applyHeaderEdits(draft.headers, {
             ...rec.headers,
             [ATTEMPT_HEADER]: rec.id,
         });
-    }, scoped));
-    registrations.push(await ctx.session.hook('http.request', async (draft) => {
+    }), scoped));
+    registrations.push(await ctx.session.hook('http.request', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
         const mark = draft.request.headers.get(ATTEMPT_HEADER) ?? undefined;
-        const rec = await bind(scopeOf(draft), 'http.request', 'http', mark);
+        const rec = await bind(scopeOf(draft), 'http.request', 'http', mark, assertActive);
+        assertActive();
         const account = accountOf(rec);
         const attempt = rec.attempt;
         if (!account || !attempt)
@@ -475,6 +517,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                         request,
                         attempt,
                     })) ?? request;
+                assertActive();
             }
             const headers = new Headers(request.headers);
             headers.delete(ATTEMPT_HEADER);
@@ -484,7 +527,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             byRequest.set(final, rec);
             draft.request = final;
         });
-    }, scoped));
+    }), scoped));
     registrations.push(await ctx.session.hook('http.response', async (draft) => {
         const rec = byRequest.get(draft.request);
         if (!rec) {
@@ -554,7 +597,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
         if (response !== original)
             draft.response = response;
     }, scoped));
-    registrations.push(await ctx.session.hook('experimental.ws.handshake', async (draft) => {
+    registrations.push(await ctx.session.hook('experimental.ws.handshake', (draft) => withSelection(scopeOf(draft), async (assertActive) => {
         let mark;
         for (const name of Object.keys(draft.headers)) {
             if (name.toLowerCase() !== ATTEMPT_HEADER)
@@ -562,7 +605,8 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             mark ??= draft.headers[name];
             delete draft.headers[name];
         }
-        const rec = await bind(scopeOf(draft), 'experimental.ws.handshake', 'ws', mark);
+        const rec = await bind(scopeOf(draft), 'experimental.ws.handshake', 'ws', mark, assertActive);
+        assertActive();
         const account = accountOf(rec);
         const attempt = rec.attempt;
         if (!account || !attempt)
@@ -578,7 +622,7 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
                 draft.url = url;
             guard(rec.scope, Object.entries(draft.headers));
         });
-    }, scoped));
+    }), scoped));
     const rewriteFrame = adapter.rewriteWebSocketFrame?.bind(adapter);
     if (rewriteFrame) {
         registrations.push(await ctx.session.hook('experimental.ws.send', async (draft) => {
@@ -624,68 +668,79 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             return;
         }
         const rec = picked;
-        rec.judged = true;
-        let decision = hostDecision;
-        let reason;
-        let rerouteFrom;
-        const attempt = rec.attempt;
-        if (rec.accountId === undefined || !attempt) {
-            decision = { retry: false };
-            reason = 'no-account';
-        }
-        else if (rec.outputStarted) {
-            // The user has already seen part of this answer; a retry would
-            // send it again.
-            decision = { retry: false };
-            reason = 'output-started';
-        }
-        else {
-            if (!rec.limit) {
-                const signal = adapter.limitFromError?.(draft.error, attempt);
-                if (signal)
-                    noteLimit(rec, signal, 'error');
+        await withSelection(rec.scope, async (assertActive) => {
+            rec.judged = true;
+            let decision = hostDecision;
+            let reason;
+            let rerouteFrom;
+            const attempt = rec.attempt;
+            if (rec.accountId === undefined || !attempt) {
+                decision = { retry: false };
+                reason = 'no-account';
             }
-            // The next `chooseAccount` should see whatever the plugin learnt
-            // from how this attempt ended.
-            if (rec.ended)
-                await rec.ended;
-            if (rec.limit) {
-                await rec.limit.delivered;
-                rec.rerouted = true;
-                rerouteFrom = { accountId: rec.accountId, limit: rec.limit.signal };
-                // No delay: the next attempt goes to another account, and the
-                // host would otherwise wait out the refused account's backoff,
-                // or not retry at all for errors it deems final.
-                decision = { retry: true, delay: 0 };
-                reason = 'reroute';
+            else if (rec.outputStarted) {
+                // The user has already seen part of this answer; a retry would
+                // send it again.
+                decision = { retry: false };
+                reason = 'output-started';
             }
             else {
-                reason = 'host-decides';
+                if (!rec.limit) {
+                    const signal = adapter.limitFromError?.(draft.error, attempt);
+                    if (signal)
+                        noteLimit(rec, signal, 'error');
+                }
+                // The next `chooseAccount` should see whatever the plugin learnt
+                // from how this attempt ended.
+                if (rec.ended) {
+                    await rec.ended;
+                    assertActive();
+                }
+                if (rec.limit) {
+                    await rec.limit.delivered;
+                    assertActive();
+                    rec.rerouted = true;
+                    rerouteFrom = {
+                        accountId: rec.accountId,
+                        limit: rec.limit.signal,
+                    };
+                    // No delay: the next attempt goes to another account, and the
+                    // host would otherwise wait out the refused account's backoff,
+                    // or not retry at all for errors it deems final.
+                    decision = { retry: true, delay: 0 };
+                    reason = 'reroute';
+                }
+                else {
+                    reason = 'host-decides';
+                }
             }
-        }
-        draft.decision = decision;
-        // The host's retry runs `model.request` again for this attempt's
-        // session and kind; that next attempt, and no other attempt of the
-        // session, is told what this one ended with.
-        if (decision.retry && rec.accountId !== undefined) {
-            pendingRetries.set(rec.key, {
-                sessionID: rec.scope.sessionID,
-                accountId: rec.accountId,
-                ...(rerouteFrom === undefined ? {} : { rerouteFrom }),
+            draft.decision = decision;
+            // The host's retry runs `model.request` again for this attempt's
+            // session and kind; that next attempt, and no other attempt of the
+            // session, is told what this one ended with.
+            if (decision.retry && rec.accountId !== undefined) {
+                pendingRetries.set(rec.key, {
+                    sessionID: rec.scope.sessionID,
+                    accountId: rec.accountId,
+                    ...(rerouteFrom === undefined ? {} : { rerouteFrom }),
+                });
+            }
+            await emit('retry', {
+                sessionID: draft.sessionID,
+                ...(rec.accountId === undefined
+                    ? {}
+                    : { accountId: rec.accountId }),
+                kind: rec.scope.kind,
+                attempt: draft.attempt,
+                reason,
+                hostDecision,
+                decision,
+                ...(attempt === undefined ? {} : { handle: attempt }),
             });
-        }
-        await emit('retry', {
-            sessionID: draft.sessionID,
-            ...(rec.accountId === undefined ? {} : { accountId: rec.accountId }),
-            kind: rec.scope.kind,
-            attempt: draft.attempt,
-            reason,
-            hostDecision,
-            decision,
-            ...(attempt === undefined ? {} : { handle: attempt }),
         });
     }, scoped));
     const forgetSession = (sessionID) => {
+        revokeSelections(sessionID);
         for (const rec of [...attempts.values()]) {
             if (rec.scope.sessionID !== sessionID)
                 continue;
@@ -716,7 +771,6 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             }
         })();
     }
-    let disposed = false;
     return {
         on(event, listener) {
             let set = listeners.get(event);
@@ -741,6 +795,8 @@ export async function installOpenCode2Auth(ctx, adapter, options = {}) {
             if (disposed)
                 return;
             disposed = true;
+            for (const sessionID of inFlight.keys())
+                revokeSelections(sessionID);
             abort.abort();
             for (const rec of attempts.values())
                 abandon(rec, 'the installation was disposed');

package/dist/opencode2/types.d.ts

@@ -381,10 +381,13 @@ export interface OpenCode2AuthInstallation<Q, A = unknown> {
      * handle.
      */
     accountFor(sessionID: string, kind: RequestKind): string | undefined;
-    /** Drops every attempt of a session. Session deletion does this itself. */
+    /**
+     * Drops every attempt and revokes in-flight auth selections of a session.
+     * Session deletion does this itself. Later requests may reuse the session id.
+     */
     forgetSession(sessionID: string): void;
     /** Number of attempts held. */
     readonly size: number;
-    /** Removes every hook and stops listening for session deletion. */
+    /** Removes every hook, revokes in-flight auth and stops listening for session deletion. */
     dispose(): Promise<void>;
 }

package/dist/rpc/rpc-server.js

@@ -293,10 +293,10 @@ export async function startRpcServer(options) {
         token,
         async stop() {
             await new Promise((resolve) => {
-                server.close(() => resolve());
-                // Stop accepting connections before ending requests that may never finish.
+                // Bun's close() disables closeAllConnections(), and a peer sending
+                // incomplete headers may not have reached the tracked connection set.
                 server.closeAllConnections?.();
-                // Bun exposes closeAllConnections but leaves partial requests open.
+                server.close(() => resolve());
                 for (const socket of connections)
                     socket.destroy();
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {