@ctrl-spc/cs 0.7.14 → 0.7.16

package/dist/config.js

@@ -1,12 +1,63 @@
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, chmodSync, openSync, closeSync, fsyncSync, renameSync } from 'node:fs';
 import { homedir, hostname, platform } from 'node:os';
-import { randomBytes, createHash } from 'node:crypto';
-import { execSync } from 'node:child_process';
+import { randomBytes, randomUUID, createHash } from 'node:crypto';
+import { execSync, execFileSync } from 'node:child_process';
 import { join } from 'node:path';
 /** Own config dir, isolated from the v1 CLI: `~/.config/ctrl-spc-v2`. */
 export function configDir() {
     return process.env.CTRL_SPC_V2_CONFIG_DIR || join(homedir(), '.config', 'ctrl-spc-v2');
 }
+/** Local control and process records are never hosted or shared with harness MCP. */
+export function lifecycleDir() {
+    return join(configDir(), 'lifecycle');
+}
+let securedLifecycleDir = null;
+export function ensureLifecycleDir() {
+    const path = lifecycleDir();
+    if (securedLifecycleDir === path && existsSync(path))
+        return path;
+    mkdirSync(path, { recursive: true, mode: 0o700 });
+    if (process.platform === 'win32') {
+        // Set an exact current-user ACL; removing inheritance alone leaves any
+        // explicit grants from an existing directory in place.
+        const script = "$ErrorActionPreference='Stop'; $sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User; $acl=New-Object System.Security.AccessControl.DirectorySecurity; $acl.SetOwner($sid); $acl.SetAccessRuleProtection($true,$false); $rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow'); $acl.AddAccessRule($rule); Set-Acl -LiteralPath $env:CTRL_SPC_LIFECYCLE_ACL_PATH -AclObject $acl";
+        execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
+            stdio: 'ignore', windowsHide: true, timeout: 3000, env: { ...process.env, CTRL_SPC_LIFECYCLE_ACL_PATH: path },
+        });
+    }
+    else
+        chmodSync(path, 0o700);
+    securedLifecycleDir = path;
+    return path;
+}
+export function readLifecycleToken() {
+    try {
+        return readFileSync(join(lifecycleDir(), 'token'), 'utf8').trim() || null;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+export function lifecycleToken() {
+    const prior = readLifecycleToken();
+    if (prior)
+        return prior;
+    const path = join(ensureLifecycleDir(), 'token');
+    const token = randomBytes(32).toString('hex');
+    try {
+        writeFileSync(path, token, { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    const result = readLifecycleToken();
+    if (!result)
+        throw new Error('Local service credential could not be created.');
+    return result;
+}
 function filePath(name) {
     return join(configDir(), name);
 }
@@ -145,26 +196,157 @@ export function clearSupersededMachineIds() {
     }
     catch { /* leave as-is */ }
 }
+/** Missing, intentionally signed out, and unreadable storage are different facts. */
+export function readSessionRecord() {
+    let text;
+    try {
+        text = readFileSync(filePath('session.json'), 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new Error('Local sign-in could not be read.', { cause: error });
+    }
+    try {
+        const value = JSON.parse(text);
+        if (!value || typeof value !== 'object')
+            throw new Error('Invalid record');
+        if (value.schema === undefined && typeof value.access_token === 'string' && value.access_token) {
+            if (value.refresh_token !== undefined && typeof value.refresh_token !== 'string')
+                throw new Error('Invalid credential');
+            // A stable legacy identity permits the first refresh to upgrade in place.
+            return { schema: 1, generation: createHash('sha256').update(text).digest('hex'), accountId: null,
+                state: 'signed-in', tokens: { access_token: value.access_token, refresh_token: value.refresh_token ?? '' } };
+        }
+        if (value.schema !== 1 || typeof value.generation !== 'string' || !value.generation
+            || !(value.accountId === null || (typeof value.accountId === 'string' && value.accountId)))
+            throw new Error('Invalid identity');
+        if (value.state === 'signed-out' || value.state === 'rejected') {
+            if ('tokens' in value)
+                throw new Error('Inactive record contains credentials');
+            return { schema: 1, generation: value.generation, accountId: value.accountId, state: value.state };
+        }
+        if (value.state !== 'signed-in' || typeof value.tokens?.access_token !== 'string' || !value.tokens.access_token
+            || typeof value.tokens.refresh_token !== 'string')
+            throw new Error('Invalid credentials');
+        return { schema: 1, generation: value.generation, accountId: value.accountId, state: 'signed-in',
+            tokens: { access_token: value.tokens.access_token, refresh_token: value.tokens.refresh_token } };
+    }
+    catch (error) {
+        throw new Error('Local sign-in storage is incomplete or invalid.', { cause: error });
+    }
+}
+/** Compatibility for passive consumers: inactive records never expose tokens. */
 export function readSession() {
-    const path = filePath('session.json');
-    if (!existsSync(path))
-        return null;
+    const record = readSessionRecord();
+    return record?.state === 'signed-in' ? record.tokens : null;
+}
+async function changeSession(change) {
+    // Dynamic import avoids config -> process helpers -> config initialization.
+    const { inspectProcess, processIdentityMatches } = await import('./win-shell.js');
+    const deadline = Date.now() + 5000;
+    const owner = await inspectProcess(process.pid, deadline);
+    if (!owner)
+        throw new Error('Cannot verify the sign-in writer process.');
+    mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+    const lock = filePath('session.lock');
+    const nonce = randomUUID();
+    let held = false;
+    while (Date.now() < deadline) {
+        try {
+            const fd = openSync(lock, 'wx', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify({ nonce, owner }));
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            held = true;
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        let prior;
+        try {
+            prior = JSON.parse(readFileSync(lock, 'utf8'));
+        }
+        catch (error) {
+            if (!(error instanceof SyntaxError) && error.code !== 'ENOENT')
+                throw error;
+        }
+        if (prior && typeof prior.nonce === 'string' && Number.isInteger(prior.owner?.pid)) {
+            const live = await inspectProcess(prior.owner.pid, deadline);
+            if (!live || !processIdentityMatches(prior.owner, live)) {
+                // Recheck the resource identity after asynchronous process inspection.
+                try {
+                    if (JSON.parse(readFileSync(lock, 'utf8')).nonce === prior.nonce)
+                        rmSync(lock);
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            }
+        }
+        await new Promise(resolve => setTimeout(resolve, 25));
+    }
+    if (!held)
+        throw new Error('Local sign-in is busy or its writer cannot be verified. Try again.');
+    const temp = filePath('session.' + nonce + '.tmp');
     try {
-        return JSON.parse(readFileSync(path, 'utf8'));
+        const record = change(readSessionRecord());
+        if (record) {
+            const fd = openSync(temp, 'wx', 0o600);
+            try {
+                writeFileSync(fd, JSON.stringify(record));
+                fsyncSync(fd);
+            }
+            finally {
+                closeSync(fd);
+            }
+            renameSync(temp, filePath('session.json'));
+        }
+        return record;
     }
-    catch {
-        return null;
+    finally {
+        rmSync(temp, { force: true });
+        if (JSON.parse(readFileSync(lock, 'utf8')).nonce === nonce)
+            rmSync(lock);
     }
 }
-export function writeSession(session) {
-    writeJson('session.json', session);
+export async function writeSession(session, accountId = null, expectedGeneration) {
+    if (!session.access_token || !session.refresh_token)
+        throw new Error('Sign-in did not return complete credentials.');
+    return (await changeSession(prior => {
+        if (expectedGeneration !== undefined && (prior?.generation ?? null) !== expectedGeneration)
+            throw new Error('The local sign-in changed while this request was being verified. Try again.');
+        return { schema: 1, generation: randomUUID(), accountId, state: 'signed-in', tokens: session };
+    }));
 }
-export function clearSession() {
-    const path = filePath('session.json');
-    if (!existsSync(path))
-        return false;
-    rmSync(path);
-    return true;
+export async function rotateSession(generation, session, accountId) {
+    let changed = false;
+    await changeSession(prior => {
+        if (prior?.state !== 'signed-in' || prior.generation !== generation || (prior.accountId !== null && prior.accountId !== accountId))
+            return null;
+        changed = true;
+        return { ...prior, accountId, tokens: session };
+    });
+    return changed;
+}
+export async function rejectSession(generation) {
+    await changeSession(prior => prior?.state === 'signed-in' && prior.generation === generation
+        ? { schema: 1, generation: randomUUID(), accountId: prior.accountId, state: 'rejected' } : null);
+}
+export async function clearSession() {
+    let wasSignedIn = false;
+    await changeSession(prior => {
+        wasSignedIn = prior?.state === 'signed-in';
+        return { schema: 1, generation: randomUUID(), accountId: prior?.accountId ?? null, state: 'signed-out' };
+    });
+    return wasSignedIn;
 }
 /** This machine's project mappings, stored locally (not in the cloud) so
  *  absolute paths never leave the machine. Keyed by project id. */