@cortexkit/common-auth 0.9.0 → 0.9.2

package/dist/claustrum/enrollment.js

@@ -271,18 +271,22 @@ async function writeStateAtomic(path, state) {
     }
     const temporary = join(parent, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
     let descriptor;
+    let created = false;
     try {
         descriptor = await open(temporary, 'wx', 0o600);
+        created = true;
         await descriptor.writeFile(bytes, 'utf8');
+        await descriptor.chmod(0o600);
         await descriptor.sync();
         await descriptor.close();
         descriptor = undefined;
-        await chmod(temporary, 0o600);
         await rename(temporary, path);
+        created = false;
     }
     finally {
         await descriptor?.close().catch(() => { });
-        await unlink(temporary).catch(() => { });
+        if (created)
+            await unlink(temporary).catch(() => { });
     }
 }
 export async function readClaustrumEnrollmentStatus(paths, proposedName) {

package/dist/dump/index.d.ts

@@ -59,6 +59,8 @@ export interface DumpOptions {
      * files that were written stay.
      */
     cleanupFailedDumps?: boolean;
+    /** Test seam for forcing response staging-name collisions. */
+    stageName?: () => string;
 }
 export interface DumpInput {
     /** The session the request belongs to; missing means `session-unknown`. */

package/dist/dump/index.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { chmod, lstat, mkdir, readdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open, readdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { createRedactor } from '../logger/redact.js';
 const PREVIOUS_BODY_LIMIT = 100;
@@ -132,21 +132,23 @@ export async function sweepDumpDirectory(options) {
  * reader never sees half a file and a symlink planted at a predictable
  * staging name is never followed.
  */
-async function replaceFile(path, text) {
+async function replaceFile(path, text, stageName) {
     for (let attempt = 0;; attempt += 1) {
-        const staging = `${path}.${randomBytes(12).toString('hex')}.partial`;
+        const staging = `${path}.${stageName ? stageName() : randomBytes(12).toString('hex')}.partial`;
         let created = false;
+        let handle;
         try {
-            await writeFile(staging, text, {
-                encoding: 'utf8',
-                mode: 0o600,
-                flag: 'wx',
-            });
+            handle = await open(staging, 'wx', 0o600);
             created = true;
+            await handle.writeFile(text, 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(staging, path);
             return;
         }
         catch (error) {
+            await handle?.close().catch(() => { });
             if (created)
                 await unlink(staging).catch(() => { });
             const code = error.code;
@@ -500,7 +502,7 @@ export function createDumper(options) {
             complete: input.complete ?? true,
         });
         try {
-            await replaceFile(result.responseFile, `${JSON.stringify(artifact, null, 2)}\n`);
+            await replaceFile(result.responseFile, `${JSON.stringify(artifact, null, 2)}\n`, options.stageName);
             return result.responseFile;
         }
         catch (error) {

package/dist/fs/atomic-write.d.ts

@@ -1,5 +1,7 @@
 export interface AtomicWriteOptions {
     serialize?: (value: unknown) => string;
     beforeRename?: () => Promise<void>;
+    /** Test seam for forcing staging-name collisions; defaults to randomUUID. */
+    stageName?: () => string;
 }
 export declare function writeJsonAtomic(path: string, value: unknown, options?: AtomicWriteOptions): Promise<void>;

package/dist/fs/atomic-write.js

@@ -1,22 +1,28 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, open, rename, rm } from 'node:fs/promises';
 import { dirname } from 'node:path';
 export async function writeJsonAtomic(path, value, options = {}) {
     await mkdir(dirname(path), { recursive: true });
-    const tempPath = `${path}.${randomUUID()}.tmp`;
+    const tempPath = `${path}.${(options.stageName ?? randomUUID)()}.tmp`;
+    let handle;
+    let created = false;
     try {
-        await writeFile(tempPath, options.serialize
+        handle = await open(tempPath, 'wx', 0o600);
+        created = true;
+        await handle.writeFile(options.serialize
             ? options.serialize(value)
-            : `${JSON.stringify(value, null, 2)}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
+            : `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await handle.chmod(0o600);
+        await handle.close();
+        handle = undefined;
         await options.beforeRename?.();
         await rename(tempPath, path);
+        created = false;
     }
-    catch (error) {
-        // A failed write can leave partial staging bytes just like a failed rename.
-        await rm(tempPath, { force: true }).catch(() => { });
-        throw error;
+    finally {
+        await handle?.close().catch(() => { });
+        // A failed write can leave partial bytes, but a collision is not ours to remove.
+        if (created)
+            await rm(tempPath, { force: true }).catch(() => { });
     }
 }

package/dist/fs/refresh-file-lock.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
@@ -67,12 +67,22 @@ export async function acquireRefreshFileLock(options) {
     async function writeOwner() {
         // Readers must see a complete lease, even while renewal is writing.
         const tempPath = `${lockPath}.${randomUUID()}.tmp`;
+        let handle;
+        let created = false;
         try {
-            await writeFile(tempPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            handle = await open(tempPath, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(tempPath, lockPath);
+            created = false;
         }
         finally {
-            await rm(tempPath, { force: true }).catch(() => { });
+            await handle?.close().catch(() => { });
+            if (created)
+                await rm(tempPath, { force: true }).catch(() => { });
         }
     }
     async function tryAcquire() {

package/dist/rpc/port-file.d.ts

@@ -15,6 +15,8 @@ export declare function writePortFile(dir: string, entry: {
 }, options?: {
     secureDir?: boolean;
     beforeWrite?: () => void | Promise<void>;
+    /** Test seam for forcing staging-name collisions; defaults to randomUUID. */
+    stageName?: () => string;
 }): Promise<string>;
 export declare function sweepRpcState(root: string, activeDir: string, isManagedDir: (name: string) => boolean, log?: RpcLogChannel): Promise<void>;
 export interface DiscoverPortFileOptions {

package/dist/rpc/port-file.js

@@ -1,5 +1,5 @@
-import { createHash } from 'node:crypto';
-import { chmod, mkdir, readdir, readFile, rename, rmdir, unlink, writeFile, } from 'node:fs/promises';
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, readdir, readFile, rename, rmdir, unlink, } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 /**
  * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
@@ -63,7 +63,7 @@ async function removeCorruptPortFile(portFile, log) {
 }
 export async function writePortFile(dir, entry, options = {}) {
     // The directory can be removed by another project's sweep between our
-    // mkdir and the first writeFile/rename, so the whole create-then-rename
+    // mkdir and the first open/rename, so the whole create-then-rename
     // unit is retried once on ENOENT. The retry recreates the directory; a
     // persistent ENOENT (e.g. permission, read-only parent) will surface on
     // the second attempt — failing fast beats an unbounded loop.
@@ -77,18 +77,24 @@ export async function writePortFile(dir, entry, options = {}) {
         await options.beforeWrite?.();
         const full = { ...entry, startedAt: Date.now() };
         const target = join(dir, `port-${entry.pid}.json`);
-        const tmp = `${target}.${process.pid}.tmp`;
+        const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
+        let handle;
+        let created = false;
         try {
-            await writeFile(tmp, JSON.stringify(full), {
-                encoding: 'utf8',
-                mode: 0o600,
-            });
+            handle = await open(tmp, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(JSON.stringify(full), 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(tmp, target);
+            created = false;
         }
-        catch (error) {
-            // The staged file carries the server token; never leave it behind.
-            await unlink(tmp).catch(() => { });
-            throw error;
+        finally {
+            await handle?.close().catch(() => { });
+            // Remove token-bearing staging bytes only if this call created them.
+            if (created)
+                await unlink(tmp).catch(() => { });
         }
         return target;
     };

package/dist/rpc/rpc-server.d.ts

@@ -12,6 +12,12 @@ export interface RpcServerOptions {
     secureDir?: boolean;
     sweepRoot?: string;
     drain: (lastReceivedId: number, sessionId?: string) => RpcNotification[];
+    drainAsync?: never;
+    /** Replace default cursor parsing with plugin policy over the raw JSON value. */
+    parsePending?: (params: unknown) => {
+        lastReceivedId: number;
+        sessionId?: string;
+    };
     apply: (request: ApplyRequest) => Promise<ApplyResult>;
     /**
      * Refuse a `pending-notifications` drain whose `sessionId` is absent, not a
@@ -32,14 +38,21 @@ export interface RpcServerOptions {
      */
     applyDeadlineMs?: number;
 }
+/** Async-only options keep the existing synchronous drain type unchanged. */
+export interface RpcServerAsyncOptions extends Omit<RpcServerOptions, 'drain' | 'drainAsync'> {
+    drain?: never;
+    drainAsync: (lastReceivedId: number, sessionId?: string) => Promise<RpcNotification[]>;
+}
 /**
- * Thrown by an `apply` or `drain` handler to refuse a request with a 4xx
+ * Thrown by an `apply`, `drain`, or `parsePending` handler to refuse a request with a 4xx
  * status. Its message is sent on the wire as `{error: message}`, so it must
- * be written for the client and never quote a credential. Any other error a
- * handler throws answers 500 with a fixed code.
+ * be written for the client and never quote a credential. Any other error an
+ * apply/drain handler throws answers 500 with a fixed code; other parser
+ * errors answer 400 invalid params. Async drain failures always answer 500.
  */
 export declare class RpcRequestError extends Error {
     readonly status: number;
     constructor(status: number, message: string);
 }
+export declare function startRpcServer(options: RpcServerAsyncOptions): Promise<RpcServerHandle>;
 export declare function startRpcServer(options: RpcServerOptions): Promise<RpcServerHandle>;

package/dist/rpc/rpc-server.js

@@ -5,10 +5,11 @@ import { join } from 'node:path';
 import { isSessionId, } from './notifications.js';
 import { sweepRpcState, writePortFile } from './port-file.js';
 /**
- * Thrown by an `apply` or `drain` handler to refuse a request with a 4xx
+ * Thrown by an `apply`, `drain`, or `parsePending` handler to refuse a request with a 4xx
  * status. Its message is sent on the wire as `{error: message}`, so it must
- * be written for the client and never quote a credential. Any other error a
- * handler throws answers 500 with a fixed code.
+ * be written for the client and never quote a credential. Any other error an
+ * apply/drain handler throws answers 500 with a fixed code; other parser
+ * errors answer 400 invalid params. Async drain failures always answer 500.
  */
 export class RpcRequestError extends Error {
     status;
@@ -78,6 +79,9 @@ function tokenOk(header, token) {
     return got.length === want.length && timingSafeEqual(got, want);
 }
 export async function startRpcServer(options) {
+    if ((typeof options.drain === 'function') ===
+        (typeof options.drainAsync === 'function'))
+        throw new TypeError('exactly one of drain or drainAsync must be provided');
     const log = options.log ?? { warn() { }, debug() { } };
     const token = randomBytes(32).toString('hex');
     // The receipt timeout limits request delivery, not handler execution.
@@ -85,12 +89,17 @@ export async function startRpcServer(options) {
     const handlerTimeoutMs = options.timeoutMs ?? 90_000;
     const receiptTimeoutMs = options.receiptTimeoutMs ?? 2_000;
     let warnedMissingNotificationSession = false;
+    const connections = new Set();
     const server = createServer((req, res) => {
         req.setTimeout(handlerTimeoutMs, () => {
             req.socket.destroy();
         });
         void dispatch(req, res);
     });
+    server.on('connection', (socket) => {
+        connections.add(socket);
+        socket.once('close', () => connections.delete(socket));
+    });
     server.requestTimeout = receiptTimeoutMs;
     server.headersTimeout = receiptTimeoutMs;
     async function dispatch(req, res) {
@@ -132,16 +141,59 @@ export async function startRpcServer(options) {
                 return json(400, { error: 'invalid json' });
             }
             if (method === 'pending-notifications') {
-                if (options.requireSession === true && !isSessionId(params.sessionId))
+                let pending;
+                try {
+                    if (options.parsePending) {
+                        pending = options.parsePending(params);
+                    }
+                    else {
+                        if (!params || typeof params !== 'object' || Array.isArray(params))
+                            throw new Error('invalid params');
+                        const raw = params;
+                        if (options.requireSession === true && !isSessionId(raw.sessionId))
+                            return json(400, { error: 'session required' });
+                        if (('lastReceivedId' in raw &&
+                            (typeof raw.lastReceivedId !== 'number' ||
+                                !Number.isSafeInteger(raw.lastReceivedId) ||
+                                raw.lastReceivedId < 0)) ||
+                            ('sessionId' in raw && typeof raw.sessionId !== 'string'))
+                            throw new Error('invalid params');
+                        pending = {
+                            lastReceivedId: Number(raw.lastReceivedId ?? 0),
+                            sessionId: typeof raw.sessionId === 'string' ? raw.sessionId : undefined,
+                        };
+                    }
+                }
+                catch (error) {
+                    if (error instanceof RpcRequestError)
+                        throw error;
+                    return json(400, { error: 'invalid params' });
+                }
+                const { lastReceivedId, sessionId } = pending;
+                if (options.requireSession === true && !isSessionId(sessionId))
                     return json(400, { error: 'session required' });
-                const sessionId = typeof params.sessionId === 'string' ? params.sessionId : undefined;
                 if (sessionId === undefined && !warnedMissingNotificationSession) {
                     warnedMissingNotificationSession = true;
                     log.warn('rpc notification drain missing session id', {
                         pid: process.pid,
                     });
                 }
-                const messages = options.drain(Number(params.lastReceivedId ?? 0), sessionId);
+                let messages;
+                if (options.drainAsync) {
+                    try {
+                        messages = await options.drainAsync(lastReceivedId, sessionId);
+                    }
+                    catch (error) {
+                        log.warn('rpc notification drain failed', {
+                            pid: process.pid,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                        return json(500, { error: 'drain failed' });
+                    }
+                }
+                else {
+                    messages = options.drain?.(lastReceivedId, sessionId);
+                }
                 return json(200, { messages });
             }
             if (method === 'apply') {
@@ -214,7 +266,14 @@ export async function startRpcServer(options) {
         port,
         token,
         async stop() {
-            await new Promise((resolve) => server.close(() => resolve()));
+            await new Promise((resolve) => {
+                server.close(() => resolve());
+                // Stop accepting connections before ending requests that may never finish.
+                server.closeAllConnections?.();
+                // Bun exposes closeAllConnections but leaves partial requests open.
+                for (const socket of connections)
+                    socket.destroy();
+            });
             const portFile = join(options.dir, `port-${process.pid}.json`);
             const current = await readFile(portFile, 'utf8')
                 .then((raw) => JSON.parse(raw))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {