@cortexkit/opencode-antigravity-auth 3.0.3 → 3.0.5

package/dist/src/common-auth-embedded/logger/engine.js

@@ -1,4 +1,7 @@
 import { appendFileSync, chmodSync, existsSync, renameSync, statSync, } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { createPrivateBytes, ensurePrivateDirectory, privateOperation, replaceWindowsFile, verifyPrivate, windowsPrivateFiles, } from '../fs/private-files.js';
 import { createRedactor } from './redact.js';
 const ORDER = {
     error: 0,
@@ -36,6 +39,75 @@ function rotateIfNeeded(f) {
         /* never throw */
     }
 }
+async function closeWindowsFile(sink) {
+    const { file, handle } = sink;
+    sink.file = undefined;
+    sink.handle = undefined;
+    if (file && handle)
+        await privateOperation(file, 'log-close', () => handle.close());
+}
+async function openWindowsFile(sink, file) {
+    await ensurePrivateDirectory(dirname(file));
+    try {
+        await verifyPrivate(file, 'file', true);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        try {
+            await createPrivateBytes(file, '');
+        }
+        catch (creationError) {
+            if (creationError.code !== 'EEXIST')
+                throw creationError;
+            await verifyPrivate(file, 'file', true);
+        }
+    }
+    // The safe-parent policy denies other ordinary users the ability to create, replace or link entries between verification and fs.open.
+    // This protects against other ordinary users, not the owner or administrators, whose ability to change that namespace is outside our threat model.
+    sink.handle = await privateOperation(file, 'log-open', () => open(file, 'a'));
+    sink.file = file;
+    return sink.handle;
+}
+async function flushWindowsFile(sink, file, text) {
+    file = resolve(file);
+    try {
+        if (sink.file !== file)
+            await closeWindowsFile(sink);
+        let handle = sink.handle ?? (await openWindowsFile(sink, file));
+        const info = await privateOperation(file, 'log-stat', () => handle.stat());
+        if (info.size >= MAX_BYTES) {
+            await closeWindowsFile(sink);
+            for (let i = ROTATE_KEEP - 1; i >= 0; i--) {
+                const source = i === 0 ? file : `${file}.${i}`;
+                const target = `${file}.${i + 1}`;
+                try {
+                    await verifyPrivate(source, 'file', true);
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        continue;
+                    throw error;
+                }
+                try {
+                    await verifyPrivate(target, 'file', true);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+                await replaceWindowsFile(source, target);
+                await verifyPrivate(target, 'file');
+            }
+            handle = await openWindowsFile(sink, file);
+        }
+        await privateOperation(file, 'log-append', () => handle.appendFile(text, 'utf8'));
+    }
+    catch (error) {
+        await closeWindowsFile(sink).catch(() => { });
+        throw error;
+    }
+}
 function safeSerialize(data) {
     try {
         return ` ${JSON.stringify(data)}`;
@@ -63,7 +135,19 @@ function createEngine(options) {
     let captureSink;
     let buffer = [];
     let timer;
+    let orderedSink = Promise.resolve();
+    let sinkError;
+    const windowsFile = {};
+    function queueWindows(operation) {
+        const next = orderedSink.then(operation);
+        orderedSink = next.catch((error) => {
+            sinkError = error;
+        });
+        return next;
+    }
     function configure(next) {
+        if (windowsPrivateFiles && next.file !== logFileSource)
+            void queueWindows(() => closeWindowsFile(windowsFile)).catch(() => { });
         logFileSource = next.file;
         initLevelSource = next.level;
         redactor = createRedactor(next);
@@ -89,25 +173,49 @@ function createEngine(options) {
             return floor;
         return 'info';
     }
-    function flushLogs() {
+    function flushLogs(close = true) {
         if (timer) {
             clearTimeout(timer);
             timer = undefined;
         }
-        if (!buffer.length)
+        if (!buffer.length) {
+            if (windowsPrivateFiles)
+                return queueWindows(async () => {
+                    if (close)
+                        await closeWindowsFile(windowsFile);
+                    if (sinkError)
+                        throw sinkError;
+                });
             return;
+        }
         let file;
         try {
             file = logFilePath();
         }
         catch {
             buffer = [];
+            if (windowsPrivateFiles && close)
+                return queueWindows(() => closeWindowsFile(windowsFile));
             return;
         }
         const text = buffer.join('');
         buffer = [];
-        if (!file)
+        if (!file) {
+            if (windowsPrivateFiles && close)
+                return queueWindows(() => closeWindowsFile(windowsFile));
             return;
+        }
+        if (windowsPrivateFiles) {
+            return queueWindows(async () => {
+                try {
+                    await flushWindowsFile(windowsFile, file, text);
+                }
+                finally {
+                    if (close)
+                        await closeWindowsFile(windowsFile);
+                }
+            });
+        }
         try {
             rotateIfNeeded(file);
             if (existsSync(file))
@@ -122,7 +230,9 @@ function createEngine(options) {
         if (!timer)
             timer = setTimeout(() => {
                 timer = undefined;
-                flushLogs();
+                const flushed = flushLogs(false);
+                if (flushed instanceof Promise)
+                    void flushed.catch(() => { });
             }, 500);
     }
     function emit(channel, level, message, data) {
@@ -157,8 +267,11 @@ function createEngine(options) {
             if (logFileSource === undefined)
                 return;
             buffer.push(line);
-            if (buffer.length >= 50)
-                flushLogs();
+            if (buffer.length >= 50) {
+                const flushed = flushLogs(false);
+                if (flushed instanceof Promise)
+                    void flushed.catch(() => { });
+            }
             else
                 schedule();
         }
@@ -176,6 +289,9 @@ function createEngine(options) {
         };
     }
     function reset() {
+        if (windowsPrivateFiles)
+            void queueWindows(() => closeWindowsFile(windowsFile)).catch(() => { });
+        sinkError = undefined;
         buffer = [];
         if (timer) {
             clearTimeout(timer);
@@ -222,18 +338,17 @@ export function setLogLevel(l) {
     defaultEngine.setLogLevel(l);
 }
 /**
- * Write whatever the default logger has buffered. Safe to call synchronously
- * from a process-exit handler, which is how each host drains the buffer on
- * shutdown.
+ * Write whatever the default logger has buffered. On Windows await the
+ * promise before shutdown; POSIX keeps synchronous process-exit flushing.
  */
 export function flushLogs() {
-    defaultEngine.flushLogs();
+    return defaultEngine.flushLogs();
 }
 export function createLogger(channel) {
     return defaultEngine.createLogger(channel);
 }
 export async function flushForTest() {
-    defaultEngine.flushLogs();
+    return defaultEngine.flushLogs();
 }
 /**
  * Return the default logger to its uninitialised state. Only a test needs

package/dist/src/common-auth-embedded/pi-slot/slot.d.ts

@@ -5,6 +5,8 @@ export declare class PiSlotError extends Error {
     constructor(code: PiSlotErrorCode);
 }
 export interface PiSlotOptions {
+    /** Windows checks safe ancestry and creates missing parents owner-only, regardless of this option. POSIX keeps its existing directory policy. */
+    privateParents?: boolean;
     authPath: string;
     provider: string;
     /**

package/dist/src/common-auth-embedded/pi-slot/slot.js

@@ -4,6 +4,7 @@ import { lstat, mkdir, open, unlink } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { setTimeout as sleep } from 'node:timers/promises';
 import { writeJsonAtomic } from '../fs/atomic-write.js';
+import { ensurePrivateDirectory, PrivateFileError, readPrivateBuffer, windowsPrivateFiles, } from '../fs/private-files.js';
 import { acquirePiLock } from './lock.js';
 /** Errors deliberately contain neither paths nor credentials nor underlying error messages. */
 export class PiSlotError extends Error {
@@ -96,6 +97,21 @@ function code(error) {
     return object(error) ? error.code : undefined;
 }
 async function safeRead(path, privateFile = false, afterReadCheck) {
+    if (windowsPrivateFiles) {
+        try {
+            await afterReadCheck?.(path);
+            const bytes = await readPrivateBuffer(path, true);
+            const text = bytes.toString('utf8');
+            if (!bytes.equals(Buffer.from(text)))
+                throw new PiSlotError(privateFile ? 'invalid-stash' : 'invalid-auth');
+            return text;
+        }
+        catch (error) {
+            if (code(error) === 'ENOENT')
+                return undefined;
+            throw error;
+        }
+    }
     let file;
     try {
         file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -188,6 +204,10 @@ function replaceEntry(auth, provider, next) {
     return `${text.slice(0, offset)}${last ? ',' : ''}${JSON.stringify(provider)}:${next}${text.slice(offset)}`;
 }
 async function syncDir(path) {
+    // Windows flushes file bytes before rename but cannot promise persisted
+    // directory metadata, so this Pi transition deliberately skips directory sync.
+    if (windowsPrivateFiles)
+        return;
     const dir = await open(path, 'r');
     try {
         await dir.sync();
@@ -200,6 +220,7 @@ async function atomicWrite(path, text, assertLock, beforeRename) {
     await writeJsonAtomic(path, null, {
         serialize: () => text,
         durable: true,
+        durability: windowsPrivateFiles ? 'file-only-on-windows' : undefined,
         beforeRename: async () => {
             await beforeRename?.(path);
             assertLock();
@@ -274,7 +295,10 @@ export function createPiSlot(options, onStep, hooks) {
                 throw new PiSlotError('lock-compromised');
         };
         try {
-            await mkdir(dirname(authPath), { recursive: true, mode: 0o700 });
+            if (windowsPrivateFiles)
+                await ensurePrivateDirectory(dirname(authPath));
+            else
+                await mkdir(dirname(authPath), { recursive: true, mode: 0o700 });
             const deadline = Date.now() + timeout;
             let retry = 0;
             while (!release) {
@@ -300,7 +324,7 @@ export function createPiSlot(options, onStep, hooks) {
             return result;
         }
         catch (error) {
-            if (error instanceof PiSlotError)
+            if (error instanceof PiSlotError || error instanceof PrivateFileError)
                 throw error;
             throw new PiSlotError('io');
         }
@@ -342,10 +366,14 @@ export function createPiSlot(options, onStep, hooks) {
             if (stash && digest(auth.entry) !== stash.sha256)
                 throw new PiSlotError('conflict');
             if (!stash) {
-                await mkdir(dirname(stashPath), { recursive: true, mode: 0o700 });
-                const dir = await lstat(dirname(stashPath));
-                if (!dir.isDirectory() || (dir.mode & 0o777) !== 0o700)
-                    throw new PiSlotError('unsafe-path');
+                if (windowsPrivateFiles)
+                    await ensurePrivateDirectory(dirname(stashPath));
+                else {
+                    await mkdir(dirname(stashPath), { recursive: true, mode: 0o700 });
+                    const dir = await lstat(dirname(stashPath));
+                    if (!dir.isDirectory() || (dir.mode & 0o777) !== 0o700)
+                        throw new PiSlotError('unsafe-path');
+                }
                 const saved = {
                     version: 1,
                     provider,

package/dist/src/common-auth-embedded/rpc/port-file.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { chmod, mkdir, open, readdir, readFile, rename, rmdir, stat, unlink, } from 'node:fs/promises';
+import { chmod, mkdir, open, readdir, rename, rmdir, stat, unlink, } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { ensurePrivateDirectory, PrivateFileError, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from '../fs/private-files.js';
 /**
  * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
  * a process group rather than a process, and an unsafe integer cannot name a
@@ -68,6 +69,15 @@ export async function writePortFile(dir, entry, options = {}) {
     // persistent ENOENT (e.g. permission, read-only parent) will surface on
     // the second attempt — failing fast beats an unbounded loop.
     const writeOnce = async () => {
+        const target = join(dir, `port-${entry.pid}.json`);
+        if (windowsPrivateFiles) {
+            await ensurePrivateDirectory(dir, options.secureDir ?? false);
+            await options.beforeWrite?.();
+            await writePrivateAtomic(target, JSON.stringify({ ...entry, startedAt: Date.now() }), {
+                stagePath: `${target}.${(options.stageName ?? randomUUID)()}.tmp`,
+            });
+            return target;
+        }
         await mkdir(dir, {
             recursive: true,
             mode: options.secureDir ? 0o700 : undefined,
@@ -76,7 +86,6 @@ export async function writePortFile(dir, entry, options = {}) {
             await chmod(dir, 0o700);
         await options.beforeWrite?.();
         const full = { ...entry, startedAt: Date.now() };
-        const target = join(dir, `port-${entry.pid}.json`);
         const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
         let handle;
         let created = false;
@@ -139,9 +148,11 @@ export async function sweepRpcState(root, activeDir, isManagedDir, log) {
             const portFile = join(dir, name);
             let raw;
             try {
-                raw = await readFile(portFile, 'utf8');
+                raw = await readPrivateText(portFile);
             }
-            catch {
+            catch (error) {
+                if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+                    throw error;
                 continue;
             }
             if (raw === undefined)
@@ -172,19 +183,27 @@ export async function portFileIdentity(dir, entry) {
         return null;
     const path = join(resolve(dir), `port-${entry.pid}.json`);
     try {
+        if (windowsPrivateFiles)
+            await verifyPrivate(path, 'file');
         const info = await stat(path);
         return `${path}:${info.dev}:${info.ino}:${info.mtimeMs}:${info.size}`;
     }
-    catch {
+    catch (error) {
+        if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+            throw error;
         return null;
     }
 }
 export async function discoverPortFile(dir, expectedPid, options = {}) {
     let names;
     try {
+        if (windowsPrivateFiles)
+            await verifyPrivate(dir, 'directory');
         names = await readdir(dir);
     }
-    catch {
+    catch (error) {
+        if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+            throw error;
         return null;
     }
     const live = [];
@@ -192,7 +211,7 @@ export async function discoverPortFile(dir, expectedPid, options = {}) {
         if (!name.startsWith('port-') || !name.endsWith('.json'))
             continue;
         try {
-            const parsed = JSON.parse(await readFile(join(dir, name), 'utf8'));
+            const parsed = JSON.parse(await readPrivateText(join(dir, name)));
             if (isUsablePortFileEntry(parsed, name)) {
                 if (pidAlive(parsed.pid))
                     live.push(parsed);
@@ -200,7 +219,10 @@ export async function discoverPortFile(dir, expectedPid, options = {}) {
                     await unlink(join(dir, name)).catch(() => { });
             }
         }
-        catch { }
+        catch (error) {
+            if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+                throw error;
+        }
     }
     if (live.length === 0)
         return null;

package/dist/src/common-auth-embedded/rpc/rpc-client.js

@@ -1,6 +1,7 @@
 import { open } from 'node:fs/promises';
 import { connect } from 'node:net';
 import { join, resolve } from 'node:path';
+import { readPrivateText, windowsPrivateFiles } from '../fs/private-files.js';
 import { discoverPortFile, portFileIdentity, } from './port-file.js';
 export const DEFAULT_RPC_TIMEOUT_MS = 2_000;
 const selections = new Map();
@@ -12,6 +13,17 @@ const discoveries = new Map();
 // those bytes still name the discovered entry.
 async function boundIdentity(dir, entry) {
     const path = join(resolve(dir), `port-${entry.pid}.json`);
+    if (windowsPrivateFiles) {
+        const current = JSON.parse(await readPrivateText(path));
+        if (current.pid !== entry.pid ||
+            current.port !== entry.port ||
+            current.token !== entry.token)
+            return null;
+        // private-files does not expose the read handle's identity, so a separate
+        // stat cannot bind an RPC-server cache entry to the file that supplied its
+        // token. On Windows, rediscover the port file on every call.
+        return null;
+    }
     let handle;
     try {
         handle = await open(path, 'r');
@@ -32,7 +44,9 @@ async function boundIdentity(dir, entry) {
 }
 async function select(key, dir, expectedPid, options) {
     const cached = selections.get(key);
-    if (cached && (await portFileIdentity(dir, cached.entry)) === cached.identity)
+    if (!windowsPrivateFiles &&
+        cached &&
+        (await portFileIdentity(dir, cached.entry)) === cached.identity)
         return cached;
     selections.delete(key);
     const pending = discoveries.get(key);

package/dist/src/common-auth-embedded/rpc/rpc-server.js

@@ -1,7 +1,8 @@
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { readFile, unlink } from 'node:fs/promises';
+import { unlink } from 'node:fs/promises';
 import { createServer, } from 'node:http';
 import { join } from 'node:path';
+import { PrivateFileError, readPrivateText } from '../fs/private-files.js';
 import { isSessionId, } from './notifications.js';
 import { sweepRpcState, writePortFile } from './port-file.js';
 /**
@@ -301,9 +302,13 @@ export async function startRpcServer(options) {
                     socket.destroy();
             });
             const portFile = join(options.dir, `port-${process.pid}.json`);
-            const current = await readFile(portFile, 'utf8')
+            const current = await readPrivateText(portFile)
                 .then((raw) => JSON.parse(raw))
-                .catch(() => undefined);
+                .catch((error) => {
+                if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+                    throw error;
+                return undefined;
+            });
             if (current?.port === port && current.token === token)
                 await unlink(portFile).catch(() => { });
         },