@dev-mainsequence/codex-plugin 0.4.2 → 0.7.10

package/dist/vendor/devtools/shared/repositories.js

@@ -53,6 +53,7 @@ const session_1 = require("./session.js");
 const repositoryIdentity_1 = require("./repositoryIdentity.js");
 const repositoryClient_1 = require("./repositoryClient.js");
 const repositoryModels_1 = require("./repositoryModels.js");
+const stateDirectory_1 = require("./stateDirectory.js");
 async function readProjectEnv(root) {
     let text;
     try {
@@ -92,8 +93,7 @@ async function resolveBackend(explicit, root, env = process.env) {
 /** Resolve non-secret workspace settings without requiring a session or writing configuration. */
 async function readWorkspacePreferences(options = {}) {
     const env = options.env ?? process.env, home = options.homeDir ?? os.homedir();
-    const directory = process.platform === 'darwin' ? path.join(home, 'Library', 'Application Support', 'MainSequenceCLI')
-        : process.platform === 'win32' ? path.join(env.APPDATA || home, 'MainSequenceCLI') : path.join(home, '.config', 'mainsequence');
+    const directory = (0, stateDirectory_1.mainSequenceStateDirectory)(env, home);
     const config = await fs.readFile(options.configPath ?? path.join(directory, 'config.json'), 'utf8')
         .then(text => JSON.parse(text)).catch(() => ({}));
     const folder = config?.mainsequence_path;

package/dist/vendor/devtools/shared/session.js

@@ -177,6 +177,12 @@ class MachineSessionService {
             throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No session is saved for this backend. Run login.');
         return { session, source: 'machine' };
     }
+    async selectionIdentity(input) {
+        const backend = requireBackend(input), { session, source } = await this.selected(backend);
+        const expiresAt = expiry(session.access);
+        return { key: crypto.createHash('sha256').update(JSON.stringify([backend, source, session.username, session.access, session.refresh])).digest('hex'),
+            ...(expiresAt ? { expiresAt: Date.parse(expiresAt) } : {}) };
+    }
     async http(backend, method, apiPath, body, access, timeoutMs) {
         this.options.signal?.throwIfAborted();
         if ((apiPath !== '/mcp' && !/^\/(api|auth)\//.test(apiPath)) || apiPath.includes('..'))
@@ -184,19 +190,25 @@ class MachineSessionService {
         const controller = new AbortController();
         const abort = () => controller.abort();
         this.options.signal?.addEventListener('abort', abort, { once: true });
-        const timer = setTimeout(abort, this.options.requestTimeoutMs ?? timeoutMs ?? 30_000);
+        const budget = this.options.requestTimeoutMs ?? timeoutMs ?? 30_000;
+        let timedOut = false;
+        const timer = setTimeout(() => { timedOut = true; controller.abort(); }, budget);
         try {
             const response = await (this.options.fetch ?? fetch)(backend + apiPath, {
                 method, redirect: 'error', signal: controller.signal,
+                // Opt-in shared transports may deduplicate only these stateless platform
+                // reads. Never infer read safety from arbitrary project tool annotations.
+                ...(apiPath === '/mcp' && body && typeof body === 'object' && (['initialize', 'notifications/initialized', 'tools/list'].includes(body.method)
+                    || body.method === 'tools/call' && ['agent.list', 'agent.search', 'agent.get', 'resource_release.mcp_endpoints'].includes(body.params?.name)) ? { cache: 'force-cache' } : {}),
                 headers: { 'Content-Type': 'application/json', ...(apiPath === '/mcp' ? { Accept: 'application/json, text/event-stream', 'MCP-Protocol-Version': '2025-11-25' } : {}), ...(access ? { Authorization: `Bearer ${access}` } : {}) },
                 body: body === undefined ? undefined : JSON.stringify(body)
             });
             if (response.status === 401 || response.status === 403)
                 throw new models_1.ToolingError('AUTH_REJECTED', 'The backend rejected the selected credentials.');
             if (!response.ok)
-                throw new models_1.ToolingError('API_ERROR', `The backend returned HTTP ${response.status}.`);
+                throw new models_1.ToolingError('API_ERROR', `The backend ${backend} returned HTTP ${response.status} for ${method} ${apiPath}.`);
             if (apiPath === '/mcp')
-                return await (0, mcpTransport_1.readMcpResponse)(response, body);
+                return await (0, mcpTransport_1.readMcpResponse)(response, body, 'platform MCP ' + backend);
             if (response.status === 204)
                 return undefined;
             try {
@@ -211,25 +223,33 @@ class MachineSessionService {
                 throw new models_1.ToolingError('CANCELLED', 'The action was cancelled.');
             if (error instanceof models_1.ToolingError)
                 throw error;
-            throw new models_1.ToolingError('BACKEND_UNREACHABLE', 'The backend could not be reached. The saved session has been kept.');
+            throw new models_1.ToolingError('BACKEND_UNREACHABLE', `The backend ${backend} could not be reached for ${method} ${apiPath}: `
+                + (timedOut ? `the request timed out after ${(0, mcpTransport_1.describeSeconds)(budget)} s` : (0, mcpTransport_1.failureReason)(error) || 'the connection failed') + '. The saved session has been kept.');
         }
         finally {
             clearTimeout(timer);
             this.options.signal?.removeEventListener('abort', abort);
         }
     }
-    renew(backend, expectedAccount) {
+    renew(backend, expectedAccount, stale) {
         const renewalKey = JSON.stringify([backend, expectedAccount]);
         const running = this.renewals.get(renewalKey);
         if (running)
             return running;
-        const task = (async () => {
+        const run = async () => {
             // Bypass cached state: another SDK process may have rotated the refresh token.
             const previous = await this.saved(backend);
             if (!previous?.refresh)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'No refreshable machine session is saved for this backend.');
             if (expectedAccount !== undefined && previous.username && previous.username !== expectedAccount)
                 throw this.accountChanged();
+            // Another host process may have renewed while this one waited for the
+            // shared lease. Reuse its saved pair; never rotate it a second time.
+            if (stale && previous.access && previous.access !== stale.access) {
+                if (expectedAccount !== undefined)
+                    await this.verifyAccount(backend, previous, expectedAccount);
+                return previous;
+            }
             let data;
             try {
                 data = await this.http(backend, 'POST', '/auth/jwt-token/token/refresh/', { refresh: previous.refresh });
@@ -242,7 +262,10 @@ class MachineSessionService {
             const session = this.remember(tokenPair(data, previous));
             if (expectedAccount !== undefined) {
                 const current = await this.saved(backend);
-                if (!current || current.access !== previous.access || current.refresh !== previous.refresh)
+                // A shared transport can coalesce simultaneous rotations. Another client
+                // may already have saved this exact returned pair; that is the same login.
+                if (!current || (current.access !== previous.access || current.refresh !== previous.refresh)
+                    && (current.access !== session.access || current.refresh !== session.refresh))
                     throw this.accountChanged();
             }
             // Refresh may rotate the old token. Keep the new pair even if the subsequent
@@ -251,7 +274,8 @@ class MachineSessionService {
             if (expectedAccount !== undefined)
                 await this.verifyAccount(backend, session, expectedAccount);
             return session;
-        })();
+        };
+        const task = this.options.sessionLock ? this.options.sessionLock(backend, run, this.options.signal) : run();
         this.renewals.set(renewalKey, task);
         void task.finally(() => this.renewals.delete(renewalKey)).catch(() => { });
         return task;
@@ -330,15 +354,22 @@ class MachineSessionService {
                 target(value);
                 return this.accountRequest(backend, method, apiPath, body, retrySafe, options, expectedAccount);
             },
-            status: async (value) => {
+            status: async (value, check = true) => {
                 target(value);
-                await this.accountRequest(backend, 'GET', '/api/v1/users/me/', undefined, true, undefined, expectedAccount);
+                // During one account-bound operation, reuse the identity verified for this
+                // exact access token. Still reread shared credentials on every boundary;
+                // a changed token must be verified before it can access the remote service.
+                if (check)
+                    await this.accountRequest(backend, 'GET', '/api/v1/users/me/', undefined, true, undefined, expectedAccount);
                 const current = await this.selected(backend);
                 await this.verifyAccount(backend, current.session, expectedAccount);
-                const status = await this.status(backend);
-                if (!status.authenticated)
+                const final = await this.selected(backend);
+                if (final.source !== current.source || final.session.access !== current.session.access || final.session.refresh !== current.session.refresh)
                     throw this.accountChanged();
-                return { ...status, username: expectedAccount, checked: true };
+                const source = current.source === 'environment' ? 'environment' : this.options.persistence?.mode ?? 'machine';
+                return { backend, authenticated: true, source, persistence: source,
+                    store: source === 'environment' ? null : this.options.persistence?.name ?? this.store?.name ?? null,
+                    username: expectedAccount, expiresAt: expiry(current.session.access), checked: true };
             },
             login: unsupported, logout: unsupported, refresh: unsupported,
             sanitize: text => this.sanitize(text),
@@ -353,7 +384,7 @@ class MachineSessionService {
         let { session, source } = await this.selected(backend);
         if (!session.access || (expiry(session.access) && Date.parse(expiry(session.access)) <= Date.now() + 30_000)) {
             if (source === 'machine')
-                session = await this.renew(backend, expectedAccount);
+                session = await this.renew(backend, expectedAccount, session);
             else if (!session.access)
                 throw new models_1.ToolingError('NOT_AUTHENTICATED', 'The explicit environment has no access token.');
         }
@@ -388,7 +419,7 @@ class MachineSessionService {
             if (!retrySafe)
                 throw error;
             const latest = await this.saved(backend);
-            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend, expectedAccount);
+            const retry = latest?.access && latest.access !== session.access ? latest : await this.renew(backend, expectedAccount, session);
             try {
                 return await send(retry);
             }