@danypops/tickets 0.9.0 → 0.10.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/tickets",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Unified CLI, daemon, and TypeScript library for issue tracking across GitHub, GitLab, and Jira.",
   "type": "module",
   "license": "MIT",

package/src/auth/browser.ts

@@ -9,8 +9,15 @@ import { spawn } from "node:child_process";
 
 export type Spawner = (command: string, args: string[]) => void;
 
-const defaultSpawner: Spawner = (command, args) => {
+// A spawn() failure (e.g. no `xdg-open` on a minimal Linux install) surfaces asynchronously as
+// an unlistened "error" event under Node, which is an uncaught exception that kills the whole
+// host process -- this runs from inside the long-lived pi-tickets extension host (tui.ts), not
+// just the standalone CLI, so that crash is a real live risk, not just a CLI inconvenience.
+export const defaultSpawner: Spawner = (command, args) => {
   const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", (error) => {
+    console.error(`failed to open URL via ${command}: ${error instanceof Error ? error.message : String(error)}`);
+  });
   child.unref();
 };
 

package/src/auth/token-store.ts

@@ -5,9 +5,14 @@
  * *to* GitHub/GitLab/Jira on the user's behalf. Same security posture as
  * vehicle-server's ensureAuthToken: 0700 directory, 0600 files, atomic write.
  */
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { createAtomicJsonWriter } from "@danypops/vehicle-core";
+import { createNodeAtomicJsonFsAdapter } from "@danypops/vehicle-server/atomic-json";
+
+const atomicJson = createAtomicJsonWriter({ fs: createNodeAtomicJsonFsAdapter() });
 
 export interface StoredToken {
   accessToken: string;
@@ -35,21 +40,19 @@ function tokenPath(backend: string, opts: TokenStoreEnv = {}): string {
   return join(tokenStoreDir(opts), `${backend}.json`);
 }
 
-export function saveToken(backend: string, token: StoredToken, opts: TokenStoreEnv = {}): void {
+export async function saveToken(backend: string, token: StoredToken, opts: TokenStoreEnv = {}): Promise<void> {
   const path = tokenPath(backend, opts);
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const temp = `${path}.${process.pid}.tmp`;
-  writeFileSync(temp, `${JSON.stringify(token, null, 2)}\n`, { mode: 0o600 });
-  renameSync(temp, path);
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  await atomicJson.write(path, token, { mode: 0o600, pretty: true, trailingNewline: true });
 }
 
-export function loadToken(backend: string, opts: TokenStoreEnv = {}): StoredToken | undefined {
+export async function loadToken(backend: string, opts: TokenStoreEnv = {}): Promise<StoredToken | undefined> {
   const path = tokenPath(backend, opts);
-  if (!existsSync(path)) return undefined;
-  chmodSync(path, 0o600);
   try {
-    return JSON.parse(readFileSync(path, "utf8")) as StoredToken;
+    return (await atomicJson.read(path)) as StoredToken | undefined;
   } catch {
+    // A corrupt/malformed token file is treated the same as no token --
+    // the caller re-authenticates rather than crashing on a parse error.
     return undefined;
   }
 }

package/src/cli/index.ts

@@ -550,7 +550,7 @@ auth
       if (type === "github" && opts.ghCli !== undefined) {
         const result = await readGhCliToken(opts.ghCli === true ? undefined : opts.ghCli);
         if (!result.ok) throw new Error(result.reason);
-        saveToken(opts.backend, { accessToken: result.token });
+        await saveToken(opts.backend, { accessToken: result.token });
         printJson({
           backend: opts.backend,
           status: "authorized",
@@ -577,7 +577,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -600,7 +600,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -627,7 +627,7 @@ auth
             }
           },
         });
-        saveToken(opts.backend, {
+        await saveToken(opts.backend, {
           accessToken: token.accessToken,
           refreshToken: token.refreshToken,
           expiresAt: token.expiresAt,
@@ -661,7 +661,7 @@ auth
       process.exitCode = 1;
       return;
     }
-    saveToken(backend, { accessToken: value });
+    await saveToken(backend, { accessToken: value });
     printJson({
       backend,
       status: "stored",
@@ -672,18 +672,20 @@ auth
 auth
   .command("status")
   .description("list backends with a locally stored delegated token")
-  .action(() => {
+  .action(async () => {
     const backends = listStoredBackends();
     printJson(
-      backends.map((backend) => {
-        const token = loadToken(backend);
-        return {
-          backend,
-          fresh: token ? isTokenFresh(token) : false,
-          expiresAt: token?.expiresAt ?? null,
-          scope: token?.scope ?? null,
-        };
-      }),
+      await Promise.all(
+        backends.map(async (backend) => {
+          const token = await loadToken(backend);
+          return {
+            backend,
+            fresh: token ? isTokenFresh(token) : false,
+            expiresAt: token?.expiresAt ?? null,
+            scope: token?.scope ?? null,
+          };
+        }),
+      ),
     );
   });
 

package/src/cli/tickets-client.ts

@@ -29,14 +29,22 @@ async function isAlive(handle: DaemonHandle, token: string): Promise<boolean> {
   }
 }
 
-/** Absolute path to the daemon's real entry point, resolved from this package's own root. Used both to spawn it on demand and to point a systemd unit's ExecStart at it (see cli/systemd-service.ts). */
+/** Absolute path to the daemon's real entry point, resolved from this package's own root. Used to spawn it on demand -- Armada's own ServiceSpec (see cli/systemd-service.ts) launches the CLI's own `serve` command instead, not this path directly. */
 export function resolveDaemonEntryPath(): string {
   const root = packageRoot(dirname(fileURLToPath(import.meta.url)));
   return join(root, "src", "process", "main.ts");
 }
 
-function spawnDaemon(): void {
+// A spawn() failure surfaces asynchronously as an unlistened "error" event under Node, which is
+// an uncaught exception that kills the whole host process. createTicketsClient (which calls
+// this via ensureDaemonRunning) runs from inside the long-lived pi-tickets extension host
+// (tui.ts) as well as the CLI, so a missing/misconfigured `bun` binary would otherwise crash
+// the whole Pi session, not just this one connect attempt.
+export function spawnDaemon(): void {
   const child = spawn("bun", ["run", resolveDaemonEntryPath()], { detached: true, stdio: "ignore" });
+  child.on("error", (error) => {
+    console.error(`tickets daemon auto-spawn failed: ${error instanceof Error ? error.message : String(error)}`);
+  });
   child.unref();
 }
 

package/src/config/config.ts

@@ -103,7 +103,7 @@ export async function preferredAuth(
   const fromEnigma = await tryEnigma(name, { env, token: env.ENIGMA_CLIENT_TOKEN });
   if (fromEnigma) return { token: fromEnigma.accessToken, oauth: true, extra: fromEnigma.extra };
 
-  const stored = loadToken(name, { env });
+  const stored = await loadToken(name, { env });
   if (stored && isTokenFresh(stored)) {
     return { token: stored.accessToken, oauth: true, extra: stored.extra };
   }