@cortexkit/opencode-antigravity-auth 2.2.0 → 3.0.0

package/src/common-auth-embedded/rpc/port-file.js

@@ -0,0 +1,217 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, mkdir, open, readdir, readFile, rename, rmdir, stat, unlink, } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+/**
+ * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
+ * a process group rather than a process, and an unsafe integer cannot name a
+ * real process, so neither is ever probed.
+ */
+function isProbeablePid(pid) {
+    return typeof pid === 'number' && Number.isSafeInteger(pid) && pid > 0;
+}
+function pidAlive(pid) {
+    if (!isProbeablePid(pid))
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+export function createManagedRpcStateDirPredicate(directoryPrefix) {
+    return (name) => isManagedRpcStateDir(name, directoryPrefix);
+}
+export function isManagedRpcStateDir(name, directoryPrefix) {
+    if (/^[0-9a-f]{16}$/.test(name))
+        return true;
+    return (name.startsWith(directoryPrefix) &&
+        /^[0-9a-f]{16}$/.test(name.slice(directoryPrefix.length)));
+}
+export function getRpcDir(rpcRoot, directoryPrefix, projectDirectory) {
+    return join(rpcRoot, directoryPrefix +
+        createHash('sha256').update(projectDirectory).digest('hex').slice(0, 16));
+}
+/** The PID a port file's name claims, or undefined for a malformed name. */
+function filenamePid(name) {
+    const match = /^port-(\d+)\.json$/.exec(name);
+    return match ? Number(match[1]) : undefined;
+}
+/**
+ * An entry a client may connect to: its PID is probeable and matches the PID
+ * in its file name (a mismatch means the file was not written by the server
+ * it names), its port is a real TCP port, and its token is non-empty (an
+ * absent token would otherwise be sent as `Bearer undefined`).
+ */
+function isUsablePortFileEntry(value, name) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const { pid, port, token } = value;
+    return (isProbeablePid(pid) &&
+        filenamePid(name) === pid &&
+        typeof port === 'number' &&
+        Number.isInteger(port) &&
+        port >= 1 &&
+        port <= 65_535 &&
+        typeof token === 'string' &&
+        token.length > 0);
+}
+async function removeCorruptPortFile(portFile, log) {
+    log?.debug('rpc corrupt port file', { pid: process.pid, portFile });
+    await unlink(portFile).catch(() => { });
+}
+export async function writePortFile(dir, entry, options = {}) {
+    // The directory can be removed by another project's sweep between our
+    // mkdir and the first open/rename, so the whole create-then-rename
+    // unit is retried once on ENOENT. The retry recreates the directory; a
+    // persistent ENOENT (e.g. permission, read-only parent) will surface on
+    // the second attempt — failing fast beats an unbounded loop.
+    const writeOnce = async () => {
+        await mkdir(dir, {
+            recursive: true,
+            mode: options.secureDir ? 0o700 : undefined,
+        });
+        if (options.secureDir)
+            await chmod(dir, 0o700);
+        await options.beforeWrite?.();
+        const full = { ...entry, startedAt: Date.now() };
+        const target = join(dir, `port-${entry.pid}.json`);
+        const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
+        let handle;
+        let created = false;
+        try {
+            handle = await open(tmp, 'wx', 0o600);
+            created = true;
+            await handle.writeFile(JSON.stringify(full), 'utf8');
+            await handle.chmod(0o600);
+            await handle.close();
+            handle = undefined;
+            await rename(tmp, target);
+            created = false;
+        }
+        finally {
+            await handle?.close().catch(() => { });
+            // Remove token-bearing staging bytes only if this call created them.
+            if (created)
+                await unlink(tmp).catch(() => { });
+        }
+        return target;
+    };
+    try {
+        return await writeOnce();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return await writeOnce();
+        }
+        throw error;
+    }
+}
+export async function sweepRpcState(root, activeDir, isManagedDir, log) {
+    let projectDirs;
+    try {
+        projectDirs = await readdir(root, { withFileTypes: true });
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    const active = resolve(activeDir);
+    for (const projectDir of projectDirs) {
+        if (!projectDir.isDirectory() || !isManagedDir(projectDir.name)) {
+            continue;
+        }
+        const dir = join(root, projectDir.name);
+        let names;
+        try {
+            names = await readdir(dir);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                continue;
+            throw error;
+        }
+        for (const name of names) {
+            if (!name.startsWith('port-') || !name.endsWith('.json'))
+                continue;
+            const portFile = join(dir, name);
+            let raw;
+            try {
+                raw = await readFile(portFile, 'utf8');
+            }
+            catch {
+                continue;
+            }
+            if (raw === undefined)
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                await removeCorruptPortFile(portFile, log);
+                continue;
+            }
+            if (!isUsablePortFileEntry(parsed, name)) {
+                await removeCorruptPortFile(portFile, log);
+                continue;
+            }
+            const entry = parsed;
+            if (!pidAlive(entry.pid))
+                await unlink(portFile).catch(() => { });
+        }
+        if (resolve(dir) !== active)
+            await rmdir(dir).catch(() => { });
+    }
+}
+/** Internal cache validation: probe only the selected file and its PID. */
+export async function portFileIdentity(dir, entry) {
+    if (!pidAlive(entry.pid))
+        return null;
+    const path = join(resolve(dir), `port-${entry.pid}.json`);
+    try {
+        const info = await stat(path);
+        return `${path}:${info.dev}:${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch {
+        return null;
+    }
+}
+export async function discoverPortFile(dir, expectedPid, options = {}) {
+    let names;
+    try {
+        names = await readdir(dir);
+    }
+    catch {
+        return null;
+    }
+    const live = [];
+    for (const name of names) {
+        if (!name.startsWith('port-') || !name.endsWith('.json'))
+            continue;
+        try {
+            const parsed = JSON.parse(await readFile(join(dir, name), 'utf8'));
+            if (isUsablePortFileEntry(parsed, name)) {
+                if (pidAlive(parsed.pid))
+                    live.push(parsed);
+                else
+                    await unlink(join(dir, name)).catch(() => { });
+            }
+        }
+        catch { }
+    }
+    if (live.length === 0)
+        return null;
+    const candidates = expectedPid !== undefined && expectedPid >= 1
+        ? live.filter((entry) => entry.pid === expectedPid)
+        : [];
+    if (options.exactPid === true && candidates.length === 0)
+        return null;
+    const entries = candidates.length > 0 ? candidates : live;
+    const sortTime = (entry) => typeof entry.startedAt === 'number' && Number.isFinite(entry.startedAt)
+        ? entry.startedAt
+        : -Infinity;
+    return entries.sort((a, b) => sortTime(b) - sortTime(a))[0] ?? null;
+}

package/src/common-auth-embedded/rpc/rpc-client.d.ts

@@ -0,0 +1,30 @@
+import type { ApplyRequest, ApplyResult, RpcNotification } from './notifications.js';
+import { type DiscoverPortFileOptions, discoverPortFile, type PortFileEntry } from './port-file.js';
+export interface RpcClient {
+    pending: (lastReceivedId: number, sessionId?: string, timeoutMs?: number) => Promise<RpcNotification[]>;
+    apply: (request: ApplyRequest, timeoutMs?: number) => Promise<ApplyResult>;
+}
+export declare const DEFAULT_RPC_TIMEOUT_MS = 2000;
+/**
+ * `exactPid`: every call goes only to the expected PID's server. With no
+ * such server (or no expected PID) a call returns its fallback without
+ * opening a socket, on every call. Off by default, when a call falls back to
+ * the newest live server.
+ */
+export type RpcClientOptions = DiscoverPortFileOptions & {
+    /** Internal discovery-count seam. */
+    discover?: typeof discoverPortFile;
+};
+/**
+ * A client for the server in `dir`, preferring `expectedPid`'s.
+ *
+ * `onSelected` reports the first selection: it is told which entry (or null)
+ * discovery chose, until one call of it returns normally. It is a report, not
+ * a gate: an observer that throws rejects that call before any request is
+ * sent and is asked again on the next call, but nothing stops a later call
+ * once an observer has returned. A caller that must never reach another
+ * server passes `{ exactPid: true }`. Validated selections are shared by
+ * directory, expected PID and exactPid until their file identity changes or a
+ * connect/auth/stale-server failure triggers one rediscovery in the same call.
+ */
+export declare function createRpcClient(dir: string, expectedPid?: number, onSelected?: (entry: PortFileEntry | null) => void, options?: RpcClientOptions): RpcClient;

package/src/common-auth-embedded/rpc/rpc-client.js

@@ -0,0 +1,253 @@
+import { open } from 'node:fs/promises';
+import { connect } from 'node:net';
+import { join, resolve } from 'node:path';
+import { discoverPortFile, portFileIdentity, } from './port-file.js';
+export const DEFAULT_RPC_TIMEOUT_MS = 2_000;
+const selections = new Map();
+const discoveries = new Map();
+// The identity a cached selection is checked against must belong to the bytes
+// that named this server. Statting the path after discovery is not enough: the
+// file can be replaced in between, which would pin the old server to the new
+// file's identity. So read and fstat one open descriptor, and bind only when
+// those bytes still name the discovered entry.
+async function boundIdentity(dir, entry) {
+    const path = join(resolve(dir), `port-${entry.pid}.json`);
+    let handle;
+    try {
+        handle = await open(path, 'r');
+        const info = await handle.stat();
+        const current = JSON.parse(await handle.readFile('utf8'));
+        if (current.pid !== entry.pid ||
+            current.port !== entry.port ||
+            current.token !== entry.token)
+            return null;
+        return `${path}:${info.dev}:${info.ino}:${info.mtimeMs}:${info.size}`;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        await handle?.close().catch(() => { });
+    }
+}
+async function select(key, dir, expectedPid, options) {
+    const cached = selections.get(key);
+    if (cached && (await portFileIdentity(dir, cached.entry)) === cached.identity)
+        return cached;
+    selections.delete(key);
+    const pending = discoveries.get(key);
+    if (pending)
+        return pending;
+    const discovery = (async () => {
+        const entry = await (options.discover ?? discoverPortFile)(dir, expectedPid, options);
+        if (!entry)
+            return null;
+        const identity = await boundIdentity(dir, entry);
+        // The file changed under discovery: use what was discovered for this
+        // call, as an uncached selection, so the next call discovers again.
+        if (!identity)
+            return { entry, identity: '' };
+        const selected = { entry, identity };
+        selections.set(key, selected);
+        return selected;
+    })();
+    discoveries.set(key, discovery);
+    try {
+        return await discovery;
+    }
+    finally {
+        if (discoveries.get(key) === discovery)
+            discoveries.delete(key);
+    }
+}
+async function request(entry, method, params, timeoutMs = DEFAULT_RPC_TIMEOUT_MS) {
+    // A raw loopback socket never consults runtime HTTP proxy settings, which
+    // otherwise can expose the bearer token to a configured proxy. timeoutMs is
+    // a total deadline for connect, request and the full response, not idle time.
+    return new Promise((resolve) => {
+        let socket;
+        let settled = false;
+        let connected = false;
+        const done = (value, stale = false) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket?.destroy();
+            resolve({ value, stale });
+        };
+        const timer = setTimeout(() => done(null), timeoutMs);
+        try {
+            const body = JSON.stringify(params);
+            socket = connect({ host: '127.0.0.1', port: entry.port });
+            socket.on('connect', () => {
+                connected = true;
+                // HTTP/1.0 avoids chunked responses; explicitly request connection close
+                // because older Bun servers can keep delayed HTTP/1.0 replies open.
+                socket?.write(`POST /rpc/${method} HTTP/1.0\r\n` +
+                    `Host: 127.0.0.1:${entry.port}\r\n` +
+                    'Connection: close\r\n' +
+                    'Content-Type: application/json\r\n' +
+                    `Content-Length: ${Buffer.byteLength(body)}\r\n` +
+                    `Authorization: Bearer ${entry.token}\r\n\r\n` +
+                    body);
+            });
+            const chunks = [];
+            let bytes = 0;
+            let headerBytes;
+            let contentLength;
+            let prefix = Buffer.alloc(0);
+            const finishBody = () => {
+                if (headerBytes === undefined)
+                    return done(null);
+                try {
+                    const payload = Buffer.concat(chunks).subarray(headerBytes);
+                    done(JSON.parse(payload.toString('utf8')));
+                }
+                catch {
+                    done(null);
+                }
+            };
+            socket.on('data', (chunk) => {
+                if (settled)
+                    return;
+                bytes += chunk.length;
+                chunks.push(chunk);
+                if (headerBytes === undefined) {
+                    prefix = Buffer.concat([prefix, chunk]);
+                    const separator = prefix.indexOf('\r\n\r\n');
+                    if (separator >= 0)
+                        headerBytes = separator + 4;
+                    if ((headerBytes ?? prefix.length) > 16 * 1024)
+                        return done(null);
+                    if (headerBytes !== undefined) {
+                        const headers = prefix
+                            .subarray(0, separator)
+                            .toString('latin1')
+                            .split('\r\n');
+                        const status = /^HTTP\/1\.[01] (\d{3})(?: |$)/.exec(headers[0] ?? '');
+                        if (!status)
+                            return done(null);
+                        const code = Number(status[1]);
+                        if (code < 200 || code >= 300)
+                            // Only statuses meaning "this is not the server you meant" may
+                            // rediscover and resend. A 504 is this server's apply deadline:
+                            // the handler can still be running, so resending it to another
+                            // server could run the command twice. 5xx is never retried.
+                            return done(null, [401, 403, 404, 410].includes(code));
+                        for (const header of headers.slice(1)) {
+                            const colon = header.indexOf(':');
+                            const name = header.slice(0, colon).toLowerCase();
+                            const value = header.slice(colon + 1).trim();
+                            if (name === 'transfer-encoding')
+                                return done(null);
+                            if (name === 'content-length') {
+                                if (contentLength !== undefined || !/^\d+$/.test(value))
+                                    return done(null);
+                                contentLength = Number(value);
+                                if (!Number.isSafeInteger(contentLength) ||
+                                    contentLength > 8 * 1024 * 1024)
+                                    return done(null);
+                            }
+                        }
+                        prefix = Buffer.alloc(0);
+                    }
+                }
+                const bodyBytes = bytes - (headerBytes ?? bytes);
+                if (bodyBytes > 8 * 1024 * 1024)
+                    return done(null);
+                if (contentLength !== undefined) {
+                    if (bodyBytes > contentLength)
+                        return done(null);
+                    // Bun 1.3.14 can keep an async HTTP/1.0 reply open after sending
+                    // its complete Content-Length body; don't wait for EOF in that case.
+                    if (bodyBytes === contentLength)
+                        finishBody();
+                }
+            });
+            socket.on('end', () => {
+                if (contentLength !== undefined &&
+                    bytes - (headerBytes ?? 0) !== contentLength)
+                    return done(null);
+                finishBody();
+            });
+            socket.on('error', () => done(null, !connected));
+            socket.on('close', () => done(null));
+        }
+        catch {
+            done(null, !connected);
+        }
+    });
+}
+async function call(dir, expectedPid, options, onSelected, method, params, timeoutMs = DEFAULT_RPC_TIMEOUT_MS) {
+    const key = JSON.stringify([
+        resolve(dir),
+        expectedPid ?? null,
+        options.exactPid === true,
+    ]);
+    const selected = await select(key, dir, expectedPid, options);
+    onSelected(selected?.entry ?? null);
+    if (!selected)
+        return null;
+    const deadline = Date.now() + timeoutMs;
+    const out = await request(selected.entry, method, params, timeoutMs);
+    if (!out.stale)
+        return out.value;
+    if (selections.get(key) === selected)
+        selections.delete(key);
+    // Retry only definite pre-dispatch/stale-server failures, never an ambiguous
+    // response or timeout that could replay an already executed apply command.
+    const replacement = await select(key, dir, expectedPid, options);
+    if (!replacement || Date.now() >= deadline)
+        return null;
+    if (replacement.entry.port === selected.entry.port &&
+        replacement.entry.pid === selected.entry.pid &&
+        replacement.entry.token === selected.entry.token) {
+        if (selections.get(key) === replacement)
+            selections.delete(key);
+        return null;
+    }
+    const retry = await request(replacement.entry, method, params, deadline - Date.now());
+    if (retry.stale && selections.get(key) === replacement)
+        selections.delete(key);
+    return retry.value;
+}
+/**
+ * A client for the server in `dir`, preferring `expectedPid`'s.
+ *
+ * `onSelected` reports the first selection: it is told which entry (or null)
+ * discovery chose, until one call of it returns normally. It is a report, not
+ * a gate: an observer that throws rejects that call before any request is
+ * sent and is asked again on the next call, but nothing stops a later call
+ * once an observer has returned. A caller that must never reach another
+ * server passes `{ exactPid: true }`. Validated selections are shared by
+ * directory, expected PID and exactPid until their file identity changes or a
+ * connect/auth/stale-server failure triggers one rediscovery in the same call.
+ */
+export function createRpcClient(dir, expectedPid, onSelected, options = {}) {
+    const discoverOptions = {
+        exactPid: options.exactPid,
+        discover: options.discover,
+    };
+    let reportedSelection = false;
+    const reportSelected = (entry) => {
+        if (reportedSelection)
+            return;
+        onSelected?.(entry);
+        // Counted only after the observer returns, so a throwing one is not
+        // silently skipped on later calls.
+        reportedSelection = true;
+    };
+    return {
+        async pending(lastReceivedId, sessionId, timeoutMs) {
+            const out = await call(dir, expectedPid, discoverOptions, reportSelected, 'pending-notifications', { lastReceivedId, sessionId }, timeoutMs);
+            return out?.messages ?? [];
+        },
+        async apply(request, timeoutMs) {
+            const out = await call(dir, expectedPid, discoverOptions, reportSelected, 'apply', {
+                ...request,
+            }, timeoutMs);
+            return out ?? { text: 'apply failed', knobs: {} };
+        },
+    };
+}

package/src/common-auth-embedded/rpc/rpc-server.d.ts

@@ -0,0 +1,58 @@
+import type { RpcLogChannel } from './index.js';
+import { type ApplyRequest, type ApplyResult, type RpcNotification } from './notifications.js';
+export interface RpcServerHandle {
+    port: number;
+    token: string;
+    stop: () => Promise<void>;
+}
+export interface RpcServerOptions {
+    dir: string;
+    log?: RpcLogChannel;
+    isManagedDir: (name: string) => boolean;
+    secureDir?: boolean;
+    sweepRoot?: string;
+    drain: (lastReceivedId: number, sessionId?: string) => RpcNotification[];
+    drainAsync?: never;
+    /** Replace default cursor parsing with plugin policy over the raw JSON value. */
+    parsePending?: (params: unknown) => {
+        lastReceivedId: number;
+        sessionId?: string;
+    };
+    apply: (request: ApplyRequest) => Promise<ApplyResult>;
+    /**
+     * Refuse a `pending-notifications` drain whose `sessionId` is absent, not a
+     * string or empty, with 400 and without calling `drain`. Pair it with a
+     * strict notification scope (`requireSession`) so neither the wire nor
+     * the queue can hand one session's notifications to another. Off by
+     * default, when a session-less drain is passed to `drain` as undefined.
+     */
+    requireSession?: boolean;
+    timeoutMs?: number;
+    receiptTimeoutMs?: number;
+    /**
+     * Answer an `apply` call whose handler is still running after this many
+     * milliseconds with 504 `{error: 'handler deadline exceeded'}`. The handler
+     * is not cancelled; its eventual result is discarded. Unset by default,
+     * when only the socket inactivity timeout (`timeoutMs`) bounds a handler,
+     * by destroying the socket.
+     */
+    applyDeadlineMs?: number;
+}
+/** Async-only options keep the existing synchronous drain type unchanged. */
+export interface RpcServerAsyncOptions extends Omit<RpcServerOptions, 'drain' | 'drainAsync'> {
+    drain?: never;
+    drainAsync: (lastReceivedId: number, sessionId?: string) => Promise<RpcNotification[]>;
+}
+/**
+ * Thrown by an `apply`, `drain`, or `parsePending` handler to refuse a request with a 4xx
+ * status. Its message is sent on the wire as `{error: message}`, so it must
+ * be written for the client and never quote a credential. Any other error an
+ * apply/drain handler throws answers 500 with a fixed code; other parser
+ * errors answer 400 invalid params. Async drain failures always answer 500.
+ */
+export declare class RpcRequestError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+export declare function startRpcServer(options: RpcServerAsyncOptions): Promise<RpcServerHandle>;
+export declare function startRpcServer(options: RpcServerOptions): Promise<RpcServerHandle>;