@cortexkit/opencode-openai-auth 1.0.3 → 1.0.5

package/src/tui-compiled/runtime/shared/7211cfec06a298bc-atomic-write.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, rename, rm } from "node:fs/promises";
 import { dirname } from "node:path";
+import { PrivateFileError, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from "./375d9cca2def037d-private-files.js";
 /** Internal classification of fsync failures, including a failure after rename. */
 export class AtomicSyncError extends Error {
     constructor(cause) {
@@ -16,6 +17,18 @@ export async function writeJsonAtomic(path, value, options = {}) {
  * and removed ids here, because a later directory sync cannot undo the rename.
  */
 export async function writeJsonAtomicTracked(path, value, options, onRenamed) {
+    if (windowsPrivateFiles) {
+        return writePrivateAtomic(path, options.serialize
+            ? options.serialize(value)
+            : `${JSON.stringify(value, null, 2)}\n`, {
+            beforeRename: options.beforeRename,
+            stagePath: `${path}.${(options.stageName ?? randomUUID)()}.tmp`,
+            onRenamed,
+            durable: options.durable,
+            durability: options.durability,
+            onOutcome: options.onOutcome,
+        });
+    }
     await mkdir(dirname(path), { recursive: true });
     const tempPath = `${path}.${(options.stageName ?? randomUUID)()}.tmp`;
     let handle;
@@ -63,6 +76,14 @@ export async function writeJsonAtomicTracked(path, value, options, onRenamed) {
 }
 /** Make an already renamed file and its directory durable without rewriting bytes. */
 export async function syncJsonFile(path) {
+    if (windowsPrivateFiles) {
+        await verifyPrivate(path, 'file');
+        const error = new PrivateFileError(path, 'directory-sync-unsupported', {
+            code: 'ENOTSUP',
+        });
+        error.published = true;
+        throw error;
+    }
     const file = await open(path, 'r');
     try {
         await file.sync();

package/src/tui-compiled/runtime/shared/905bffc0220f43d0-map.js

@@ -83,6 +83,40 @@ export function isCreditBudgetEntry(value) {
         optional(value, 'remaining', isFiniteNumber) &&
         optional(value, 'unit', isString));
 }
+function isQuotaCounter(value) {
+    return (isRecord(value) &&
+        isFiniteNumber(value.value) &&
+        Number.isInteger(value.value) &&
+        value.value >= 0 &&
+        isFiniteNumber(value.checkedAt));
+}
+export function isQuotaCounters(value) {
+    return isRecord(value) && Object.values(value).every(isQuotaCounter);
+}
+/** Keep usable counters without letting one malformed count hide a quota map. */
+export function readQuotaCounters(value) {
+    if (!isRecord(value))
+        return undefined;
+    const entries = Object.entries(value).filter(([, entry]) => isQuotaCounter(entry));
+    return entries.length === 0
+        ? undefined
+        : Object.fromEntries(entries);
+}
+/** Decode persisted quota, dropping malformed counters but not limit evidence. */
+export function decodeQuotaMap(value) {
+    // A valid map is returned as the same object, so stored quota keeps the
+    // identity it had before counters existed; only a map with a malformed
+    // counter is copied without it.
+    if (isQuotaMap(value))
+        return value;
+    if (!isRecord(value))
+        return undefined;
+    const { counters: rawCounters, ...rest } = value;
+    if (!isQuotaMap(rest))
+        return undefined;
+    const counters = readQuotaCounters(rawCounters);
+    return { ...rest, ...(counters === undefined ? {} : { counters }) };
+}
 /**
  * True when `value` is a well-formed quota map. Unrecognised top-level keys
  * are tolerated (and preserved by merge) so a newer writer's additions
@@ -101,5 +135,6 @@ export function isQuotaMap(value) {
             return false;
         seen.add(key);
     }
-    return optional(value, 'budget', isCreditBudgetEntry);
+    return (optional(value, 'budget', isCreditBudgetEntry) &&
+        optional(value, 'counters', isQuotaCounters));
 }

package/src/tui-compiled/runtime/shared/a09b6a533c11858f-tui-preferences.js

@@ -1,7 +1,7 @@
-import { readFile } from "node:fs/promises";
 import { applyEdits, modify, parse } from "jsonc-parser";
 import { writeJsonAtomic } from "./7211cfec06a298bc-atomic-write.js";
 import { WRITER_LOCK_CONSTANTS } from "./9b4da614c45f9cd0-lock-constants.js";
+import { PrivateFileError, readPrivateText, windowsPrivateFiles, } from "./375d9cca2def037d-private-files.js";
 import { withLock } from "./4825e03209d6ae3e-with-lock.js";
 function isRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -10,12 +10,14 @@ function isRecord(value) {
 export async function readTuiPreferencesFile(file) {
     try {
         const errors = [];
-        const root = parse(await readFile(file, 'utf8'), errors, {
+        const root = parse(await readPrivateText(file, windowsPrivateFiles), errors, {
             allowTrailingComma: true,
         });
         return errors.length === 0 && isRecord(root) ? root : {};
     }
-    catch {
+    catch (error) {
+        if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+            throw error;
         return {};
     }
 }
@@ -42,7 +44,7 @@ export function createTuiPreferenceWriter(options) {
         await withLock(file, lockOptions, async (lock) => {
             let text;
             try {
-                text = await readFile(file, 'utf8');
+                text = await readPrivateText(file, windowsPrivateFiles);
             }
             catch (error) {
                 if (error.code !== 'ENOENT')

package/src/tui-compiled/runtime/shared/c14988621dc60a75-port-file.js

@@ -1,6 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
-import { chmod, mkdir, open, readdir, readFile, rename, rmdir, stat, unlink, } from "node:fs/promises";
+import { chmod, mkdir, open, readdir, rename, rmdir, stat, unlink, } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import { ensurePrivateDirectory, PrivateFileError, readPrivateText, verifyPrivate, windowsPrivateFiles, writePrivateAtomic, } from "./375d9cca2def037d-private-files.js";
 /**
  * A PID a liveness probe may address. `process.kill(0 | negative, 0)` signals
  * a process group rather than a process, and an unsafe integer cannot name a
@@ -68,6 +69,15 @@ export async function writePortFile(dir, entry, options = {}) {
     // persistent ENOENT (e.g. permission, read-only parent) will surface on
     // the second attempt — failing fast beats an unbounded loop.
     const writeOnce = async () => {
+        const target = join(dir, `port-${entry.pid}.json`);
+        if (windowsPrivateFiles) {
+            await ensurePrivateDirectory(dir, options.secureDir ?? false);
+            await options.beforeWrite?.();
+            await writePrivateAtomic(target, JSON.stringify({ ...entry, startedAt: Date.now() }), {
+                stagePath: `${target}.${(options.stageName ?? randomUUID)()}.tmp`,
+            });
+            return target;
+        }
         await mkdir(dir, {
             recursive: true,
             mode: options.secureDir ? 0o700 : undefined,
@@ -76,7 +86,6 @@ export async function writePortFile(dir, entry, options = {}) {
             await chmod(dir, 0o700);
         await options.beforeWrite?.();
         const full = { ...entry, startedAt: Date.now() };
-        const target = join(dir, `port-${entry.pid}.json`);
         const tmp = `${target}.${(options.stageName ?? randomUUID)()}.tmp`;
         let handle;
         let created = false;
@@ -139,9 +148,11 @@ export async function sweepRpcState(root, activeDir, isManagedDir, log) {
             const portFile = join(dir, name);
             let raw;
             try {
-                raw = await readFile(portFile, 'utf8');
+                raw = await readPrivateText(portFile);
             }
-            catch {
+            catch (error) {
+                if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+                    throw error;
                 continue;
             }
             if (raw === undefined)
@@ -172,19 +183,27 @@ export async function portFileIdentity(dir, entry) {
         return null;
     const path = join(resolve(dir), `port-${entry.pid}.json`);
     try {
+        if (windowsPrivateFiles)
+            await verifyPrivate(path, 'file');
         const info = await stat(path);
         return `${path}:${info.dev}:${info.ino}:${info.mtimeMs}:${info.size}`;
     }
-    catch {
+    catch (error) {
+        if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+            throw error;
         return null;
     }
 }
 export async function discoverPortFile(dir, expectedPid, options = {}) {
     let names;
     try {
+        if (windowsPrivateFiles)
+            await verifyPrivate(dir, 'directory');
         names = await readdir(dir);
     }
-    catch {
+    catch (error) {
+        if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+            throw error;
         return null;
     }
     const live = [];
@@ -192,7 +211,7 @@ export async function discoverPortFile(dir, expectedPid, options = {}) {
         if (!name.startsWith('port-') || !name.endsWith('.json'))
             continue;
         try {
-            const parsed = JSON.parse(await readFile(join(dir, name), 'utf8'));
+            const parsed = JSON.parse(await readPrivateText(join(dir, name)));
             if (isUsablePortFileEntry(parsed, name)) {
                 if (pidAlive(parsed.pid))
                     live.push(parsed);
@@ -200,7 +219,10 @@ export async function discoverPortFile(dir, expectedPid, options = {}) {
                     await unlink(join(dir, name)).catch(() => { });
             }
         }
-        catch { }
+        catch (error) {
+            if (error instanceof PrivateFileError && error.code !== 'ENOENT')
+                throw error;
+        }
     }
     if (live.length === 0)
         return null;

package/src/tui-compiled/runtime/shared/c64d7afbc14ca125-sidebar-file.js

@@ -1,6 +1,7 @@
-import { chmod, mkdir, readFile } from "node:fs/promises";
+import { chmod, mkdir } from "node:fs/promises";
 import { dirname } from "node:path";
 import { LockContentionError, LockOwnershipError, WRITER_LOCK_CONSTANTS, withLock, writeJsonAtomic, } from "./ec971142548df90e-index.js";
+import { ensurePrivateDirectory, PrivateFileError, readPrivateText, windowsPrivateFiles, } from "./375d9cca2def037d-private-files.js";
 /** Binds generic persistence to a caller's path and normalization policy. */
 export function createSidebarFile(options) {
     const { path, defaultValue, normalize } = options;
@@ -17,7 +18,9 @@ export function createSidebarFile(options) {
     };
     const readRaw = async () => {
         try {
-            return await readFile(path, 'utf8');
+            if (windowsPrivateFiles)
+                await ensurePrivateDirectory(dirname(path), options.secureDir ?? true);
+            return await readPrivateText(path, windowsPrivateFiles);
         }
         catch (error) {
             if (error.code === 'ENOENT')
@@ -29,7 +32,9 @@ export function createSidebarFile(options) {
         try {
             return parse(await readRaw());
         }
-        catch {
+        catch (error) {
+            if (error instanceof PrivateFileError)
+                throw error;
             return defaultValue;
         }
     };
@@ -109,11 +114,15 @@ export function createSidebarFile(options) {
         const hooks = writeOptions;
         const parent = dirname(path);
         const secureDir = options.secureDir ?? true;
-        await mkdir(parent, { recursive: true, mode: 0o700 });
-        if (secureDir) {
-            await chmod(parent, 0o700).catch((error) => {
-                options.logger?.warn('sidebar directory permission remediation failed', { error: error instanceof Error ? error.message : String(error) });
-            });
+        if (windowsPrivateFiles)
+            await ensurePrivateDirectory(parent, secureDir);
+        else {
+            await mkdir(parent, { recursive: true, mode: 0o700 });
+            if (secureDir) {
+                await chmod(parent, 0o700).catch((error) => {
+                    options.logger?.warn('sidebar directory permission remediation failed', { error: error instanceof Error ? error.message : String(error) });
+                });
+            }
         }
         const committed = await withLock(path, lockOptions, async (lock) => {
             const commit = async (value) => ({

package/src/tui-compiled/runtime/shared/c852a15cfe489d12-pool.js

@@ -60,6 +60,9 @@ export function openPoolStore(options) {
             now: options.now ?? Date.now,
             ...(options.onLockEvent ? { onLockEvent: options.onLockEvent } : {}),
             ...(options.onLockStep ? { onLockStep: options.onLockStep } : {}),
+            ...(options.onRenewalTimer
+                ? { onRenewalTimer: options.onRenewalTimer }
+                : {}),
         },
         removedIds: memory.removedIds,
         requireCredentialStamps: options.requireCredentialStamps === true,

package/src/tui-compiled/runtime/shared/cd94316a888b0a8e-schema.js

@@ -420,7 +420,8 @@ function parseEntry(raw, codec) {
         return undefined;
     if ('disabledReason' in raw && typeof raw.disabledReason !== 'string')
         return undefined;
-    if ('quota' in raw && !codec.validate(raw.quota))
+    const quota = 'quota' in raw && codec.decode ? codec.decode(raw.quota) : raw.quota;
+    if ('quota' in raw && !codec.validate(quota))
         return undefined;
     if ('staged' in raw && !parseReservation(raw.staged))
         return undefined;
@@ -430,7 +431,7 @@ function parseEntry(raw, codec) {
         ...(typeof raw.disabledReason === 'string'
             ? { disabledReason: raw.disabledReason }
             : {}),
-        ...('quota' in raw ? { quota: raw.quota } : {}),
+        ...('quota' in raw ? { quota } : {}),
     };
 }
 function credentialFor(raw, stateEntry) {

package/src/tui-compiled/runtime/shared/d5a8f1061ee2f114-index.js

@@ -1,5 +1,5 @@
 export { quotaCodec } from "./053cc17b5419261e-codec.js";
-export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, } from "./0332701351b3eeec-format.js";
-export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, emptyQuotaMap, isQuotaMap, } from "./905bffc0220f43d0-map.js";
+export { formatQuota, NO_LIMITS_REPORTED, NO_QUOTA_READING, QUOTA_STALE_AFTER_MS, quotaTextParts, quotaWindowName, quotaWindowParts, } from "./0332701351b3eeec-format.js";
+export { ALL_SCOPE, DEFAULT_REQUIRED_LABELS, decodeQuotaMap, emptyQuotaMap, isQuotaMap, } from "./905bffc0220f43d0-map.js";
 export { isQuotaObservation, mergeQuotaObservation, QuotaCodecError, } from "./4f36d333d081d040-merge.js";
 export { budgetExhaustedResetAt, futureResetAt, projectQuota, readsExhausted, } from "./39c3cb05738fcf6d-projection.js";

package/src/tui-compiled/runtime/shared/d7dcba96fea1685c-engine.js

@@ -1,4 +1,7 @@
 import { appendFileSync, chmodSync, existsSync, renameSync, statSync, } from "node:fs";
+import { open } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { createPrivateBytes, ensurePrivateDirectory, privateOperation, replaceWindowsFile, verifyPrivate, windowsPrivateFiles, } from "./375d9cca2def037d-private-files.js";
 import { createRedactor } from "./d319517e3ea6ad70-redact.js";
 const ORDER = {
     error: 0,
@@ -36,6 +39,75 @@ function rotateIfNeeded(f) {
         /* never throw */
     }
 }
+async function closeWindowsFile(sink) {
+    const { file, handle } = sink;
+    sink.file = undefined;
+    sink.handle = undefined;
+    if (file && handle)
+        await privateOperation(file, 'log-close', () => handle.close());
+}
+async function openWindowsFile(sink, file) {
+    await ensurePrivateDirectory(dirname(file));
+    try {
+        await verifyPrivate(file, 'file', true);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        try {
+            await createPrivateBytes(file, '');
+        }
+        catch (creationError) {
+            if (creationError.code !== 'EEXIST')
+                throw creationError;
+            await verifyPrivate(file, 'file', true);
+        }
+    }
+    // The safe-parent policy denies other ordinary users the ability to create, replace or link entries between verification and fs.open.
+    // This protects against other ordinary users, not the owner or administrators, whose ability to change that namespace is outside our threat model.
+    sink.handle = await privateOperation(file, 'log-open', () => open(file, 'a'));
+    sink.file = file;
+    return sink.handle;
+}
+async function flushWindowsFile(sink, file, text) {
+    file = resolve(file);
+    try {
+        if (sink.file !== file)
+            await closeWindowsFile(sink);
+        let handle = sink.handle ?? (await openWindowsFile(sink, file));
+        const info = await privateOperation(file, 'log-stat', () => handle.stat());
+        if (info.size >= MAX_BYTES) {
+            await closeWindowsFile(sink);
+            for (let i = ROTATE_KEEP - 1; i >= 0; i--) {
+                const source = i === 0 ? file : `${file}.${i}`;
+                const target = `${file}.${i + 1}`;
+                try {
+                    await verifyPrivate(source, 'file', true);
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        continue;
+                    throw error;
+                }
+                try {
+                    await verifyPrivate(target, 'file', true);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+                await replaceWindowsFile(source, target);
+                await verifyPrivate(target, 'file');
+            }
+            handle = await openWindowsFile(sink, file);
+        }
+        await privateOperation(file, 'log-append', () => handle.appendFile(text, 'utf8'));
+    }
+    catch (error) {
+        await closeWindowsFile(sink).catch(() => { });
+        throw error;
+    }
+}
 function safeSerialize(data) {
     try {
         return ` ${JSON.stringify(data)}`;
@@ -63,7 +135,19 @@ function createEngine(options) {
     let captureSink;
     let buffer = [];
     let timer;
+    let orderedSink = Promise.resolve();
+    let sinkError;
+    const windowsFile = {};
+    function queueWindows(operation) {
+        const next = orderedSink.then(operation);
+        orderedSink = next.catch((error) => {
+            sinkError = error;
+        });
+        return next;
+    }
     function configure(next) {
+        if (windowsPrivateFiles && next.file !== logFileSource)
+            void queueWindows(() => closeWindowsFile(windowsFile)).catch(() => { });
         logFileSource = next.file;
         initLevelSource = next.level;
         redactor = createRedactor(next);
@@ -89,25 +173,49 @@ function createEngine(options) {
             return floor;
         return 'info';
     }
-    function flushLogs() {
+    function flushLogs(close = true) {
         if (timer) {
             clearTimeout(timer);
             timer = undefined;
         }
-        if (!buffer.length)
+        if (!buffer.length) {
+            if (windowsPrivateFiles)
+                return queueWindows(async () => {
+                    if (close)
+                        await closeWindowsFile(windowsFile);
+                    if (sinkError)
+                        throw sinkError;
+                });
             return;
+        }
         let file;
         try {
             file = logFilePath();
         }
         catch {
             buffer = [];
+            if (windowsPrivateFiles && close)
+                return queueWindows(() => closeWindowsFile(windowsFile));
             return;
         }
         const text = buffer.join('');
         buffer = [];
-        if (!file)
+        if (!file) {
+            if (windowsPrivateFiles && close)
+                return queueWindows(() => closeWindowsFile(windowsFile));
             return;
+        }
+        if (windowsPrivateFiles) {
+            return queueWindows(async () => {
+                try {
+                    await flushWindowsFile(windowsFile, file, text);
+                }
+                finally {
+                    if (close)
+                        await closeWindowsFile(windowsFile);
+                }
+            });
+        }
         try {
             rotateIfNeeded(file);
             if (existsSync(file))
@@ -122,7 +230,9 @@ function createEngine(options) {
         if (!timer)
             timer = setTimeout(() => {
                 timer = undefined;
-                flushLogs();
+                const flushed = flushLogs(false);
+                if (flushed instanceof Promise)
+                    void flushed.catch(() => { });
             }, 500);
     }
     function emit(channel, level, message, data) {
@@ -157,8 +267,11 @@ function createEngine(options) {
             if (logFileSource === undefined)
                 return;
             buffer.push(line);
-            if (buffer.length >= 50)
-                flushLogs();
+            if (buffer.length >= 50) {
+                const flushed = flushLogs(false);
+                if (flushed instanceof Promise)
+                    void flushed.catch(() => { });
+            }
             else
                 schedule();
         }
@@ -176,6 +289,9 @@ function createEngine(options) {
         };
     }
     function reset() {
+        if (windowsPrivateFiles)
+            void queueWindows(() => closeWindowsFile(windowsFile)).catch(() => { });
+        sinkError = undefined;
         buffer = [];
         if (timer) {
             clearTimeout(timer);
@@ -222,18 +338,17 @@ export function setLogLevel(l) {
     defaultEngine.setLogLevel(l);
 }
 /**
- * Write whatever the default logger has buffered. Safe to call synchronously
- * from a process-exit handler, which is how each host drains the buffer on
- * shutdown.
+ * Write whatever the default logger has buffered. On Windows await the
+ * promise before shutdown; POSIX keeps synchronous process-exit flushing.
  */
 export function flushLogs() {
-    defaultEngine.flushLogs();
+    return defaultEngine.flushLogs();
 }
 export function createLogger(channel) {
     return defaultEngine.createLogger(channel);
 }
 export async function flushForTest() {
-    defaultEngine.flushLogs();
+    return defaultEngine.flushLogs();
 }
 /**
  * Return the default logger to its uninitialised state. Only a test needs