@cortexkit/opencode-openai-auth 0.4.3 → 0.5.1

package/src/tui/command-dialogs.tsx

@@ -18,6 +18,7 @@ type ApplyFn = (
 export function buildCachekeepDialogOptions(payload: OpenDialogPayload) {
   const enabled = payload.knobs.enabled === true
   const subagents = payload.knobs.subagents === true
+  const sustain = payload.knobs.sustain === true
   const running = payload.knobs.running === true
   const tracked = Number(payload.knobs.tracked ?? 0)
   const generatedAt = Number(payload.knobs.generatedAt ?? Date.now())
@@ -31,7 +32,7 @@ export function buildCachekeepDialogOptions(payload: OpenDialogPayload) {
     | undefined
   const windowLabel = windowKnob
     ? `${String(windowKnob.startHour).padStart(2, '0')}-${String(windowKnob.endHour).padStart(2, '0')}`
-    : 'always'
+    : 'always (no window)'
   const lastWarm = lastWarmAt
     ? `${Math.ceil((generatedAt - lastWarmAt) / 1000)}s ago`
     : 'none yet'
@@ -44,6 +45,7 @@ export function buildCachekeepDialogOptions(payload: OpenDialogPayload) {
     `last warm ${lastWarm}`,
     `window ${windowLabel}`,
     `${idleWindow}m idle cap`,
+    `sustain ${sustain ? 'on' : 'off'}`,
     `subagent idle ${subIdleWindow}m`,
   ].filter((part) => part.length > 0)
 
@@ -67,6 +69,14 @@ export function buildCachekeepDialogOptions(payload: OpenDialogPayload) {
         ? `Warm subagent sessions (${subIdleWindow}m idle cap). Disable to skip subagents.`
         : `Skip subagent sessions. Enable to warm them too (${subIdleWindow}m idle cap).`,
     },
+    {
+      title: sustain
+        ? 'Sustain main sessions: on'
+        : 'Sustain main sessions: off',
+      value: sustain ? 'sustain off' : 'sustain on',
+      description:
+        'main-only, idle-cap only; the configured clock window still applies.',
+    },
     {
       title: windowKnob ? `Warm window: ${windowLabel}` : 'Set warm window…',
       value: 'set_window',
@@ -166,6 +176,18 @@ export function openCommandDialog(
             value: 'fallback-first',
             description: 'Prefer fallback accounts, preserve main',
           },
+          {
+            title: 'Sticky balanced',
+            value: 'sticky-balanced',
+            description:
+              'Keep each session on one account while balancing new sessions',
+          },
+          {
+            title: "Reset this session's pin",
+            value: 'reset',
+            description:
+              'Unpin this session; the next request may still choose the same account',
+          },
         ]}
         onSelect={(option) => {
           void apply('openai-routing', String(option.value)).then((r) => {
@@ -436,8 +458,8 @@ function openAccountDialog(
               showAddFlow()
               return
             }
-            // Main has no per-account actions (routing is mode-driven; main is
-            // not removable or reorderable) — the row is informational only.
+            // Main has no per-account actions: it is not removable or reorderable,
+            // regardless of whether the active session uses mode or sticky routing.
             if (option.value === 'main') return
             showL2Fallback(option.value)
           }}

package/src/tui-compiled/rpc/port-file.ts

@@ -1,12 +1,18 @@
+import type { Dirent } from 'node:fs'
 import {
+  chmod,
   mkdir,
   readdir,
   readFile,
   rename,
+  rmdir,
   unlink,
   writeFile,
 } from 'node:fs/promises'
-import { join } from 'node:path'
+import { join, resolve } from 'node:path'
+import { createLogger } from '../logger'
+
+const log = createLogger('rpc')
 
 export interface PortFileEntry {
   port: number
@@ -24,17 +30,118 @@ function pidAlive(pid: number): boolean {
   }
 }
 
+function isManagedRpcStateDir(name: string): boolean {
+  return /^(?:openai-auth-)?[0-9a-f]{16}$/.test(name)
+}
+
+function isUsablePortFileEntry(value: unknown): value is PortFileEntry {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    !Array.isArray(value) &&
+    typeof (value as { pid?: unknown }).pid === 'number' &&
+    Number.isFinite((value as { pid: number }).pid) &&
+    typeof (value as { port?: unknown }).port === 'number' &&
+    Number.isFinite((value as { port: number }).port)
+  )
+}
+
+async function removeCorruptPortFile(portFile: string): Promise<void> {
+  log.debug('rpc corrupt port file', { pid: process.pid, portFile })
+  await unlink(portFile).catch(() => {})
+}
+
 export async function writePortFile(
   dir: string,
   entry: { port: number; token: string; pid: number },
+  options: {
+    secureDir?: boolean
+    beforeWrite?: () => void | Promise<void>
+  } = {},
 ): Promise<string> {
-  await mkdir(dir, { recursive: true })
-  const full: PortFileEntry = { ...entry, startedAt: Date.now() }
-  const target = join(dir, `port-${entry.pid}.json`)
-  const tmp = `${target}.${process.pid}.tmp`
-  await writeFile(tmp, JSON.stringify(full), { encoding: 'utf8', mode: 0o600 })
-  await rename(tmp, target)
-  return target
+  // The directory can be removed by another project's sweep between our
+  // mkdir and the first writeFile/rename, so the whole create-then-rename
+  // unit is retried once on ENOENT. The retry recreates the directory; a
+  // persistent ENOENT (e.g. permission, read-only parent) will surface on
+  // the second attempt — failing fast beats an unbounded loop.
+  const writeOnce = async (): Promise<string> => {
+    await mkdir(dir, {
+      recursive: true,
+      mode: options.secureDir ? 0o700 : undefined,
+    })
+    if (options.secureDir) await chmod(dir, 0o700)
+    await options.beforeWrite?.()
+    const full: PortFileEntry = { ...entry, startedAt: Date.now() }
+    const target = join(dir, `port-${entry.pid}.json`)
+    const tmp = `${target}.${process.pid}.tmp`
+    await writeFile(tmp, JSON.stringify(full), {
+      encoding: 'utf8',
+      mode: 0o600,
+    })
+    await rename(tmp, target)
+    return target
+  }
+  try {
+    return await writeOnce()
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      return await writeOnce()
+    }
+    throw error
+  }
+}
+
+export async function sweepRpcState(
+  root: string,
+  activeDir: string,
+): Promise<void> {
+  let projectDirs: Dirent<string>[]
+  try {
+    projectDirs = await readdir(root, { withFileTypes: true })
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return
+    throw error
+  }
+
+  const active = resolve(activeDir)
+  for (const projectDir of projectDirs) {
+    if (!projectDir.isDirectory() || !isManagedRpcStateDir(projectDir.name)) {
+      continue
+    }
+    const dir = join(root, projectDir.name)
+    let names: string[]
+    try {
+      names = await readdir(dir)
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue
+      throw error
+    }
+    for (const name of names) {
+      if (!name.startsWith('port-') || !name.endsWith('.json')) continue
+      const portFile = join(dir, name)
+      let raw: string | undefined
+      try {
+        raw = await readFile(portFile, 'utf8')
+      } catch {
+        continue
+      }
+      if (raw === undefined) continue
+      let parsed: unknown
+      try {
+        parsed = JSON.parse(raw)
+      } catch {
+        await removeCorruptPortFile(portFile)
+        continue
+      }
+      if (!isUsablePortFileEntry(parsed)) {
+        await removeCorruptPortFile(portFile)
+        continue
+      }
+      const entry = parsed
+      if (!pidAlive(entry.pid)) await unlink(portFile).catch(() => {})
+    }
+    if (resolve(dir) !== active) await rmdir(dir).catch(() => {})
+  }
 }
 
 export async function discoverPortFile(

package/src/tui-compiled/rpc/protocol.ts

@@ -23,6 +23,7 @@ export interface RpcNotification {
 export interface ApplyRequest {
   command: CommandModalName
   arguments: string
+  sessionId?: string
 }
 
 export interface ApplyResult {

package/src/tui-compiled/rpc/rpc-dir.ts

@@ -1,9 +1,27 @@
 import { createHash } from 'node:crypto'
 import { homedir, tmpdir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 
 const RPC_DIR_ENV = 'OPENCODE_OPENAI_AUTH_RPC_DIR'
 
+export interface RpcDirResolution {
+  dir: string
+  secureDir: boolean
+  sweepRoot?: string
+}
+
+function rpcHash(projectDirectory: string): string {
+  return createHash('sha256')
+    .update(projectDirectory)
+    .digest('hex')
+    .slice(0, 16)
+}
+
+function defaultRpcRoot(): string {
+  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
+  return join(base, 'cortexkit', 'openai-auth', 'rpc')
+}
+
 // Both processes must resolve the SAME dir from the SAME project directory.
 export function getRpcDir(projectDirectory: string): string {
   const override = process.env[RPC_DIR_ENV]?.trim()
@@ -11,12 +29,18 @@ export function getRpcDir(projectDirectory: string): string {
   // so server and TUI halves always resolve the same dir. An absolute override is
   // used as-is (resolve(base, absolute) returns the absolute path unchanged).
   if (override) return resolve(projectDirectory, override)
-  const hash = createHash('sha256')
-    .update(projectDirectory)
-    .digest('hex')
-    .slice(0, 16)
-  const base = process.env.XDG_STATE_HOME || join(homedir(), '.local', 'state')
-  return join(base, 'cortexkit', 'openai-auth', 'rpc', hash)
+  return join(defaultRpcRoot(), `openai-auth-${rpcHash(projectDirectory)}`)
+}
+
+export async function resolveRpcDir(
+  projectDirectory: string,
+): Promise<RpcDirResolution> {
+  const override = process.env[RPC_DIR_ENV]?.trim()
+  if (override) {
+    return { dir: resolve(projectDirectory, override), secureDir: false }
+  }
+  const dir = getRpcDir(projectDirectory)
+  return { dir, secureDir: true, sweepRoot: dirname(dir) }
 }
 
 export { tmpdir }