@cortexkit/common-auth 0.9.1 → 0.9.2

package/dist/claustrum/enrollment.js

@@ -271,18 +271,22 @@ async function writeStateAtomic(path, state) {
     }
     const temporary = join(parent, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
     let descriptor;
+    let created = false;
     try {
         descriptor = await open(temporary, 'wx', 0o600);
+        created = true;
         await descriptor.writeFile(bytes, 'utf8');
+        await descriptor.chmod(0o600);
         await descriptor.sync();
         await descriptor.close();
         descriptor = undefined;
-        await chmod(temporary, 0o600);
         await rename(temporary, path);
+        created = false;
     }
     finally {
         await descriptor?.close().catch(() => { });
-        await unlink(temporary).catch(() => { });
+        if (created)
+            await unlink(temporary).catch(() => { });
     }
 }
 export async function readClaustrumEnrollmentStatus(paths, proposedName) {

package/dist/dump/index.d.ts

@@ -59,6 +59,8 @@ export interface DumpOptions {
      * files that were written stay.
      */
     cleanupFailedDumps?: boolean;
+    /** Test seam for forcing response staging-name collisions. */
+    stageName?: () => string;
 }
 export interface DumpInput {
     /** The session the request belongs to; missing means `session-unknown`. */

package/dist/dump/index.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { chmod, lstat, mkdir, readdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open, readdir, readFile, rename, unlink, writeFile, } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { createRedactor } from '../logger/redact.js';
 const PREVIOUS_BODY_LIMIT = 100;
@@ -132,21 +132,23 @@ export async function sweepDumpDirectory(options) {
  * reader never sees half a file and a symlink planted at a predictable
  * staging name is never followed.
  */
-async function replaceFile(path, text) {
+async function replaceFile(path, text, stageName) {
     for (let attempt = 0;; attempt += 1) {
-        const staging = `${path}.${randomBytes(12).toString('hex')}.partial`;
+        const staging = `${path}.${stageName ? stageName() : randomBytes(12).toString('hex')}.partial`;
         let created = false;
+        let handle;
         try {
-            await writeFile(staging, text, {
-                encoding: 'utf8',
-                mode: 0o600,
-                flag: 'wx',
-            });
+            handle = await open(staging, 'wx', 0o600);
             created = true;
+            await handle.writeFile(text, 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(staging, path);
             return;
         }
         catch (error) {
+            await handle?.close().catch(() => { });
             if (created)
                 await unlink(staging).catch(() => { });
             const code = error.code;
@@ -500,7 +502,7 @@ export function createDumper(options) {
             complete: input.complete ?? true,
         });
         try {
-            await replaceFile(result.responseFile, `${JSON.stringify(artifact, null, 2)}\n`);
+            await replaceFile(result.responseFile, `${JSON.stringify(artifact, null, 2)}\n`, options.stageName);
             return result.responseFile;
         }
         catch (error) {

package/dist/fs/atomic-write.d.ts

@@ -1,5 +1,7 @@
 export interface AtomicWriteOptions {
     serialize?: (value: unknown) => string;
     beforeRename?: () => Promise<void>;
+    /** Test seam for forcing staging-name collisions; defaults to randomUUID. */
+    stageName?: () => string;
 }
 export declare function writeJsonAtomic(path: string, value: unknown, options?: AtomicWriteOptions): Promise<void>;

package/dist/fs/atomic-write.js

@@ -1,22 +1,28 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { mkdir, open, rename, rm } from 'node:fs/promises';
 import { dirname } from 'node:path';
 export async function writeJsonAtomic(path, value, options = {}) {
     await mkdir(dirname(path), { recursive: true });
-    const tempPath = `${path}.${randomUUID()}.tmp`;
+    const tempPath = `${path}.${(options.stageName ?? randomUUID)()}.tmp`;
+    let handle;
+    let created = false;
     try {
-        await writeFile(tempPath, options.serialize
+        handle = await open(tempPath, 'wx', 0o600);
+        created = true;
+        await handle.writeFile(options.serialize
             ? options.serialize(value)
-            : `${JSON.stringify(value, null, 2)}\n`, {
-            encoding: 'utf8',
-            mode: 0o600,
-        });
+            : `${JSON.stringify(value, null, 2)}\n`, 'utf8');
+        await handle.chmod(0o600);
+        await handle.close();
+        handle = undefined;
         await options.beforeRename?.();
         await rename(tempPath, path);
+        created = false;
     }
-    catch (error) {
-        // A failed write can leave partial staging bytes just like a failed rename.
-        await rm(tempPath, { force: true }).catch(() => { });
-        throw error;
+    finally {
+        await handle?.close().catch(() => { });
+        // A failed write can leave partial bytes, but a collision is not ours to remove.
+        if (created)
+            await rm(tempPath, { force: true }).catch(() => { });
     }
 }

package/dist/fs/refresh-file-lock.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat, writeFile, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { LockOwnershipError, lockPathFor } from './with-lock.js';
 const setRefreshLockRenewalTimeout = globalThis.setTimeout.bind(globalThis);
@@ -67,12 +67,22 @@ export async function acquireRefreshFileLock(options) {
     async function writeOwner() {
         // Readers must see a complete lease, even while renewal is writing.
         const tempPath = `${lockPath}.${randomUUID()}.tmp`;
+        let handle;
+        let created = false;
         try {
-            await writeFile(tempPath, `${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+            handle = await open(tempPath, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(`${JSON.stringify({ ownerId, expiresAt: now() + options.ttlMs })}\n`, 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(tempPath, lockPath);
+            created = false;
         }
         finally {
-            await rm(tempPath, { force: true }).catch(() => { });
+            await handle?.close().catch(() => { });
+            if (created)
+                await rm(tempPath, { force: true }).catch(() => { });
         }
     }
     async function tryAcquire() {

package/dist/rpc/port-file.d.ts

@@ -15,6 +15,8 @@ export declare function writePortFile(dir: string, entry: {
 }, options?: {
     secureDir?: boolean;
     beforeWrite?: () => void | Promise<void>;
+    /** Test seam for forcing staging-name collisions; defaults to randomUUID. */
+    stageName?: () => string;
 }): Promise<string>;
 export declare function sweepRpcState(root: string, activeDir: string, isManagedDir: (name: string) => boolean, log?: RpcLogChannel): Promise<void>;
 export interface DiscoverPortFileOptions {

package/dist/rpc/port-file.js

@@ -1,5 +1,5 @@
-import { createHash } from 'node:crypto';
-import { chmod, mkdir, readdir, readFile, rename, rmdir, unlink, writeFile, } from 'node:fs/promises';
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, readdir, readFile, rename, rmdir, unlink, } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 /**
  * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
@@ -63,7 +63,7 @@ async function removeCorruptPortFile(portFile, log) {
 }
 export async function writePortFile(dir, entry, options = {}) {
     // The directory can be removed by another project's sweep between our
-    // mkdir and the first writeFile/rename, so the whole create-then-rename
+    // mkdir and the first open/rename, so the whole create-then-rename
     // unit is retried once on ENOENT. The retry recreates the directory; a
     // persistent ENOENT (e.g. permission, read-only parent) will surface on
     // the second attempt — failing fast beats an unbounded loop.
@@ -77,18 +77,24 @@ export async function writePortFile(dir, entry, options = {}) {
         await options.beforeWrite?.();
         const full = { ...entry, startedAt: Date.now() };
         const target = join(dir, `port-${entry.pid}.json`);
-        const tmp = `${target}.${process.pid}.tmp`;
+        const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
+        let handle;
+        let created = false;
         try {
-            await writeFile(tmp, JSON.stringify(full), {
-                encoding: 'utf8',
-                mode: 0o600,
-            });
+            handle = await open(tmp, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(JSON.stringify(full), 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
             await rename(tmp, target);
+            created = false;
         }
-        catch (error) {
-            // The staged file carries the server token; never leave it behind.
-            await unlink(tmp).catch(() => { });
-            throw error;
+        finally {
+            await handle?.close().catch(() => { });
+            // Remove token-bearing staging bytes only if this call created them.
+            if (created)
+                await unlink(tmp).catch(() => { });
         }
         return target;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cortexkit/common-auth",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Shared code for the CortexKit auth plugins: account pool, quota and routing, commands and auth menu, OpenCode 2 hooks, Claustrum custody, and plumbing (loopback RPC, file locks, logger, sidebar state, TUI preferences and build).",
   "license": "MIT",
   "repository": {