@duckmind/dm-darwin-x64 0.66.5 → 0.66.6

package/extensions/dm-mcp-adapter/dist/agent-plugin-loader.js

@@ -0,0 +1,392 @@
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, resolve } from "node:path";
+import { getAgentPath } from "./agent-dir.js";
+import { markBuiltInAgentPlugin } from "./agent-plugin-provenance.js";
+import { resolveRealContainedPath } from "./utils.js";
+const PLUGIN_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+const MCP_SCHEMA = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+const PLUGIN_NAME_PATTERN = /^(?!.*(?:--|\.\.))[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/;
+const PLUGIN_MANIFEST_FIELDS = new Set([
+  "$schema",
+  "name",
+  "version",
+  "description",
+  "author",
+  "homepage",
+  "repository",
+  "license",
+  "keywords",
+  "extensions"
+]);
+const MCP_CONFIG_FIELDS = new Set(["$schema", "mcpServers"]);
+const STDIO_FIELDS = new Set(["type", "command", "args", "env", "cwd"]);
+const HTTP_FIELDS = new Set(["type", "url", "headers"]);
+const STRING_MANIFEST_FIELDS = ["version", "description", "homepage", "repository", "license"];
+const AUTHOR_FIELDS = new Set(["name", "email", "url"]);
+export function loadAgentPluginConfigs(paths, cwd = process.cwd()) {
+  const mcpServers = {};
+  for (const pluginPath of getPluginPaths(paths)) {
+    const loaded = loadAgentPluginMcpConfig(pluginPath, cwd);
+    if (!loaded)
+      continue;
+    for (const [serverName, server] of Object.entries(loaded.mcpServers)) {
+      if (mcpServers[serverName]) {
+        console.warn(`Agent Plugin at ${resolvePluginPath(pluginPath, cwd)} skips duplicate normalized MCP server ${serverName}`);
+        continue;
+      }
+      mcpServers[serverName] = server;
+    }
+  }
+  return { mcpServers };
+}
+export function getAgentPluginSummaries(paths, cwd = process.cwd()) {
+  return getPluginPaths(paths).map((path) => {
+    const pluginRoot = resolvePluginRoot(path, cwd);
+    const loaded = loadAgentPluginMcpConfig(path, cwd);
+    const manifest = loaded ? readPluginManifest(pluginRoot, false) : null;
+    return {
+      path: pluginRoot,
+      ...manifest?.name ? { name: manifest.name } : {},
+      serverCount: loaded ? Object.keys(loaded.mcpServers).length : 0
+    };
+  });
+}
+function getPluginPaths(paths) {
+  return Array.isArray(paths) ? paths.filter((path) => typeof path === "string") : [];
+}
+function loadAgentPluginMcpConfig(path, cwd) {
+  const pluginRoot = resolvePluginRoot(path, cwd);
+  const manifest = readPluginManifest(pluginRoot, true);
+  if (!manifest)
+    return null;
+  const mcpPath = resolve(pluginRoot, "mcp.json");
+  if (!existsSync(mcpPath))
+    return { mcpServers: {} };
+  if (!statSync(mcpPath).isFile()) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcp.json is not a regular file`);
+    return { mcpServers: {} };
+  }
+  const resolvedMcpPath = resolveRealContainedPath(pluginRoot, mcpPath);
+  if (!resolvedMcpPath) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcp.json must stay inside the plugin directory`);
+    return { mcpServers: {} };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(resolvedMcpPath, "utf8"));
+  } catch (error) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: failed to parse mcp.json`, error);
+    return { mcpServers: {} };
+  }
+  return translateAgentPluginMcpConfig(raw, manifest, pluginRoot);
+}
+function readPluginManifest(pluginRoot, report) {
+  const manifestPath = resolve(pluginRoot, "plugin.json");
+  if (!existsSync(manifestPath)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: missing plugin.json`);
+    return null;
+  }
+  if (!statSync(manifestPath).isFile()) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json is not a regular file`);
+    return null;
+  }
+  const resolvedManifestPath = resolveRealContainedPath(pluginRoot, manifestPath);
+  if (!resolvedManifestPath) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json must stay inside the plugin directory`);
+    return null;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(resolvedManifestPath, "utf8"));
+  } catch (error) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: failed to parse plugin.json`, error);
+    return null;
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json must be an object`);
+    return null;
+  }
+  const manifest = raw;
+  for (const key of Object.keys(manifest)) {
+    if (!PLUGIN_MANIFEST_FIELDS.has(key) && report) {
+      console.warn(`Agent Plugin at ${pluginRoot} ignores unknown plugin.json field: ${key}`);
+    }
+  }
+  if (manifest.$schema !== PLUGIN_SCHEMA) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: unsupported plugin.json $schema`);
+    return null;
+  }
+  if (typeof manifest.name !== "string" || manifest.name.length < 1 || manifest.name.length > 64 || !PLUGIN_NAME_PATTERN.test(manifest.name)) {
+    if (report)
+      console.warn(`Agent Plugin at ${pluginRoot} is invalid: plugin.json name is invalid`);
+    return null;
+  }
+  for (const field of STRING_MANIFEST_FIELDS) {
+    if (manifest[field] !== undefined && typeof manifest[field] !== "string") {
+      if (report)
+        console.warn(`Agent Plugin ${manifest.name} is invalid: plugin.json ${field} must be a string`);
+      return null;
+    }
+  }
+  if (manifest.keywords !== undefined && (!Array.isArray(manifest.keywords) || manifest.keywords.some((value) => typeof value !== "string"))) {
+    if (report)
+      console.warn(`Agent Plugin ${manifest.name} is invalid: plugin.json keywords must be an array of strings`);
+    return null;
+  }
+  if (manifest.author !== undefined && !isValidManifestAuthor(manifest.author)) {
+    if (report)
+      console.warn(`Agent Plugin ${manifest.name} is invalid: plugin.json author is invalid`);
+    return null;
+  }
+  if (manifest.extensions !== undefined && (!manifest.extensions || typeof manifest.extensions !== "object" || Array.isArray(manifest.extensions))) {
+    if (report)
+      console.warn(`Agent Plugin ${manifest.name} ignores non-object plugin.json extensions`);
+  }
+  return { name: manifest.name };
+}
+function translateAgentPluginMcpConfig(raw, manifest, pluginRoot) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcp.json must be an object`);
+    return { mcpServers: {} };
+  }
+  const mcpConfig = raw;
+  for (const key of Object.keys(mcpConfig)) {
+    if (!MCP_CONFIG_FIELDS.has(key)) {
+      console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: unknown top-level field ${key}`);
+      return { mcpServers: {} };
+    }
+  }
+  if (mcpConfig.$schema !== MCP_SCHEMA) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: unsupported mcp.json $schema`);
+    return { mcpServers: {} };
+  }
+  if (!mcpConfig.mcpServers || typeof mcpConfig.mcpServers !== "object" || Array.isArray(mcpConfig.mcpServers)) {
+    console.warn(`Agent Plugin ${manifest.name} has invalid MCP config: mcpServers must be an object`);
+    return { mcpServers: {} };
+  }
+  const mcpServers = {};
+  for (const [serverName, entry] of Object.entries(mcpConfig.mcpServers)) {
+    const translated = translateAgentPluginServer(manifest, pluginRoot, serverName, entry);
+    if (!translated)
+      continue;
+    const normalizedName = formatAgentPluginServerName(manifest.name, serverName);
+    if (mcpServers[normalizedName]) {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: normalized server name ${normalizedName} already exists`);
+      continue;
+    }
+    mcpServers[normalizedName] = translated;
+  }
+  return { mcpServers };
+}
+function translateAgentPluginServer(manifest, pluginRoot, serverName, entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: entry must be an object`);
+    return null;
+  }
+  const raw = entry;
+  if (raw.type === "stdio")
+    return translateStdioServer(manifest, pluginRoot, serverName, raw);
+  if (raw.type === "streamable-http" || raw.type === "sse")
+    return translateHttpServer(manifest, serverName, raw, raw.type);
+  console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: unsupported type`);
+  return null;
+}
+function translateStdioServer(manifest, pluginRoot, serverName, raw) {
+  for (const key of Object.keys(raw)) {
+    if (!STDIO_FIELDS.has(key))
+      return skipServer(manifest, serverName, `unknown field ${key}`);
+  }
+  if (typeof raw.command !== "string" || raw.command.length === 0)
+    return skipServer(manifest, serverName, "command must be a non-empty string");
+  if (!isBareCommand(raw.command) && !raw.command.startsWith("./"))
+    return skipServer(manifest, serverName, "command must be bare or plugin-relative");
+  const args = translateStringArray(raw.args, manifest, serverName, "args");
+  if (args === null)
+    return null;
+  const env = translateEnv(raw.env, manifest, serverName);
+  if (env === null)
+    return null;
+  const command = raw.command.startsWith("./") ? resolveRealContainedPath(pluginRoot, resolve(pluginRoot, raw.command)) : raw.command;
+  if (command === null)
+    return skipServer(manifest, serverName, "command must resolve to an accessible path inside the plugin directory");
+  const pluginDataDir = getAgentPath("agent-plugin-data", manifest.name);
+  const cwd = resolvePluginCwd(raw.cwd, pluginRoot, pluginDataDir);
+  if (cwd === null)
+    return skipServer(manifest, serverName, "cwd must resolve from an allowed root and stay contained");
+  return markBuiltInAgentPlugin({
+    command,
+    args: args.map((value) => expandPluginPlaceholders(value, pluginRoot, pluginDataDir)),
+    env: {
+      ...Object.fromEntries(Object.entries(env).map(([key, value]) => [key, expandPluginPlaceholders(value, pluginRoot, pluginDataDir)])),
+      PLUGIN_ROOT: pluginRoot,
+      PLUGIN_DATA: pluginDataDir
+    },
+    cwd,
+    pluginDataDir,
+    literalEnv: true
+  }, ["args", "env", "cwd"]);
+}
+function translateHttpServer(manifest, serverName, raw, type) {
+  for (const key of Object.keys(raw)) {
+    if (!HTTP_FIELDS.has(key))
+      return skipServer(manifest, serverName, `unknown field ${key}`);
+  }
+  if (typeof raw.url !== "string" || raw.url.length === 0)
+    return skipServer(manifest, serverName, "url must be a non-empty string");
+  if (!isValidAgentPluginUrl(raw.url))
+    return skipServer(manifest, serverName, "url must be an allowed absolute HTTP(S) URL");
+  const headers = translateHeaders(raw.headers, manifest, serverName);
+  if (headers === null)
+    return null;
+  return markBuiltInAgentPlugin({
+    url: raw.url,
+    httpTransport: type,
+    ...headers ? { headers } : {}
+  }, headers ? ["headers"] : []);
+}
+function formatAgentPluginServerName(pluginName, serverName) {
+  const pluginPart = pluginName.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "plugin";
+  const serverPart = serverName.replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "server";
+  return `${pluginPart}__${serverPart}`;
+}
+function skipServer(manifest, serverName, reason) {
+  console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: ${reason}`);
+  return null;
+}
+function translateStringArray(value, manifest, serverName, field) {
+  if (value === undefined)
+    return [];
+  if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: ${field} must be an array of strings`);
+    return null;
+  }
+  return value;
+}
+function translateEnv(value, manifest, serverName) {
+  if (value === undefined)
+    return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env must be an object of strings`);
+    return null;
+  }
+  const entries = [];
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "PLUGIN_ROOT" || key === "PLUGIN_DATA") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env must not define ${key}`);
+      return null;
+    }
+    if (typeof entry !== "string") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: env values must be strings`);
+      return null;
+    }
+    entries.push([key, entry]);
+  }
+  return Object.fromEntries(entries);
+}
+function translateHeaders(value, manifest, serverName) {
+  if (value === undefined)
+    return;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: headers must be an object of strings`);
+    return null;
+  }
+  const entries = [];
+  const seen = new Set;
+  for (const [key, entry] of Object.entries(value)) {
+    if (typeof entry !== "string") {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: header values must be strings`);
+      return null;
+    }
+    const normalized = key.toLowerCase();
+    if (seen.has(normalized)) {
+      console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: duplicate header ${key}`);
+      return null;
+    }
+    seen.add(normalized);
+    entries.push([key, entry]);
+  }
+  const headers = Object.fromEntries(entries);
+  try {
+    new Headers(headers);
+  } catch {
+    console.warn(`Agent Plugin ${manifest.name} skips invalid MCP server ${serverName}: headers are not valid HTTP fields`);
+    return null;
+  }
+  return Object.keys(headers).length > 0 ? headers : undefined;
+}
+function resolvePluginPath(path, cwd) {
+  if (path === "~")
+    return resolve(process.env.HOME ?? "", ".");
+  if (path.startsWith("~/"))
+    return resolve(process.env.HOME ?? "", path.slice(2));
+  return isAbsolute(path) ? resolve(path) : resolve(cwd, path);
+}
+function resolvePluginRoot(path, cwd) {
+  const resolved = resolvePluginPath(path, cwd);
+  try {
+    return realpathSync(resolved);
+  } catch {
+    return resolved;
+  }
+}
+function isValidManifestAuthor(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
+  return Object.entries(value).every(([key, entry]) => AUTHOR_FIELDS.has(key) && typeof entry === "string");
+}
+function isBareCommand(command) {
+  return !command.includes("/") && !command.includes("\\") && !command.includes("${PLUGIN_ROOT}") && !command.includes("${PLUGIN_DATA}");
+}
+function resolvePluginCwd(value, pluginRoot, pluginDataDir) {
+  if (value === undefined)
+    return pluginRoot;
+  if (typeof value !== "string")
+    return null;
+  const expanded = expandPluginPlaceholders(value, pluginRoot, pluginDataDir);
+  if (value.startsWith("./") || value === "${PLUGIN_ROOT}" || value.startsWith("${PLUGIN_ROOT}/")) {
+    return resolveRealContainedPath(pluginRoot, resolve(pluginRoot, expanded));
+  }
+  if (value === "${PLUGIN_DATA}" || value.startsWith("${PLUGIN_DATA}/")) {
+    return resolvePluginDataCwd(pluginDataDir, expanded);
+  }
+  return null;
+}
+function resolvePluginDataCwd(pluginDataDir, expanded) {
+  if (existsSync(pluginDataDir) && !resolveRealContainedPath(dirname(pluginDataDir), pluginDataDir))
+    return null;
+  return resolveRealContainedPath(pluginDataDir, resolve(pluginDataDir, expanded), true);
+}
+function expandPluginPlaceholders(value, pluginRoot, pluginDataDir) {
+  return value.replace(/\$\{PLUGIN_(ROOT|DATA)\}/g, (_, name) => name === "ROOT" ? pluginRoot : pluginDataDir);
+}
+function isValidAgentPluginUrl(value) {
+  if (value.includes("${") || value.includes("$env:") || value.includes("{env:"))
+    return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:")
+    return false;
+  if (url.username || url.password || url.hash)
+    return false;
+  if (url.protocol === "https:")
+    return true;
+  return isLoopbackHost(url.hostname);
+}
+function isLoopbackHost(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]")
+    return true;
+  if (/^127(?:\.\d{1,3}){3}$/.test(host))
+    return true;
+  return false;
+}

package/extensions/dm-mcp-adapter/dist/agent-plugin-provenance.js

@@ -0,0 +1,26 @@
+const LITERAL_PLUGIN_FIELDS = ["args", "env", "cwd", "headers"];
+const BUILT_IN_AGENT_PLUGIN = Symbol("built-in-agent-plugin");
+export function markBuiltInAgentPlugin(definition, fields) {
+  definition[BUILT_IN_AGENT_PLUGIN] = new Set(fields);
+  return definition;
+}
+export function isBuiltInAgentPlugin(definition, field) {
+  return definition[BUILT_IN_AGENT_PLUGIN]?.has(field) === true;
+}
+export function cloneBuiltInAgentPluginEntry(source) {
+  const fields = LITERAL_PLUGIN_FIELDS.filter((field) => Object.hasOwn(source, field) && isBuiltInAgentPlugin(source, field));
+  if (fields.length === 0)
+    return;
+  return markBuiltInAgentPlugin(structuredClone(source), fields);
+}
+export function mergeBuiltInAgentPluginEntries(base, next) {
+  const merged = { ...base, ...next };
+  delete merged[BUILT_IN_AGENT_PLUGIN];
+  const fields = LITERAL_PLUGIN_FIELDS.filter((field) => {
+    const owner = Object.hasOwn(next, field) ? next : base;
+    return Object.hasOwn(owner, field) && isBuiltInAgentPlugin(owner, field);
+  });
+  if (fields.length > 0)
+    markBuiltInAgentPlugin(merged, fields);
+  return merged;
+}

package/extensions/dm-mcp-adapter/dist/bearer-command-resolver.js

@@ -0,0 +1,182 @@
+import { spawn } from "node:child_process";
+const DEFAULT_TTL_MS = 5 * 60000;
+const ENV_TTL_MS = "DM_MCP_ADAPTER_BEARER_COMMAND_TTL_MS";
+const COMMAND_TIMEOUT_MS = 1e4;
+const COMMAND_MAX_OUTPUT_BYTES = 1024 * 1024;
+const USE_PROCESS_GROUP = process.platform !== "win32";
+function resolveDefaultTtlMs() {
+  const parsed = Number(process.env[ENV_TTL_MS] || DEFAULT_TTL_MS);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : DEFAULT_TTL_MS;
+}
+function abortReason(signal) {
+  return signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+function runCommand(command, context, signal) {
+  return new Promise((resolve, reject) => {
+    let output = Buffer.alloc(0);
+    let settled = false;
+    let terminating = false;
+    const child = spawn(command.slice(1), {
+      shell: true,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true,
+      detached: USE_PROCESS_GROUP
+    });
+    const kill = async () => {
+      if (child.pid === undefined)
+        return;
+      if (!USE_PROCESS_GROUP) {
+        await new Promise((resolveKill, rejectKill) => {
+          const killer = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+            windowsHide: true
+          });
+          killer.on("error", () => rejectKill(new Error("Failed to stop bearer token command")));
+          killer.on("close", (code) => {
+            if (code === 0 || code === 128)
+              resolveKill();
+            else
+              rejectKill(new Error(`Failed to stop bearer token command: taskkill exited with code ${code ?? "unknown"}`));
+          });
+        });
+        return;
+      }
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch (error) {
+        if (error.code !== "ESRCH")
+          throw error;
+      }
+    };
+    const finish = (error, token) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      if (error !== undefined)
+        reject(error);
+      else
+        resolve(token);
+    };
+    const terminate = async (error) => {
+      if (settled || terminating)
+        return;
+      terminating = true;
+      clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      try {
+        await kill();
+        finish(error);
+      } catch (cleanupError) {
+        finish(cleanupError);
+      }
+    };
+    const onAbort = () => {
+      terminate(abortReason(signal));
+    };
+    const timer = setTimeout(() => {
+      terminate(new Error(`Failed to resolve ${context}: command timed out after ${COMMAND_TIMEOUT_MS}ms`));
+    }, COMMAND_TIMEOUT_MS);
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    child.on("error", () => {
+      if (!terminating)
+        finish(new Error(`Failed to resolve ${context}: command failed to start`));
+    });
+    child.stdout.on("data", (chunk) => {
+      if (settled || terminating)
+        return;
+      output = Buffer.concat([output, Buffer.from(chunk)]);
+      if (output.byteLength > COMMAND_MAX_OUTPUT_BYTES) {
+        terminate(new Error(`Failed to resolve ${context}: command output exceeded 1 MiB`));
+      }
+    });
+    child.on("close", (code) => {
+      if (settled || terminating)
+        return;
+      if (code !== 0) {
+        finish(new Error(`Failed to resolve ${context}: command exited with code ${code ?? "unknown"}`));
+        return;
+      }
+      const token = output.toString("utf8").trim();
+      if (!token) {
+        finish(new Error(`Failed to resolve ${context}: command returned empty output`));
+        return;
+      }
+      finish(undefined, token);
+    });
+  });
+}
+
+export class BearerCommandResolver {
+  #command;
+  #context;
+  #ttlMs;
+  #cached;
+  #failure;
+  #inflight;
+  constructor(command, context, ttlMs = resolveDefaultTtlMs()) {
+    this.#command = command;
+    this.#context = context;
+    this.#ttlMs = ttlMs;
+  }
+  resolve(signal) {
+    if (signal?.aborted)
+      return Promise.reject(abortReason(signal));
+    const now = Date.now();
+    if (this.#cached !== undefined && now < this.#cached.expiresAt) {
+      return Promise.resolve(this.#cached.token);
+    }
+    if (this.#failure !== undefined && now < this.#failure.retryAt) {
+      return this.#cached !== undefined ? Promise.resolve(this.#cached.token) : Promise.reject(this.#failure.error);
+    }
+    let inflight = this.#inflight;
+    if (inflight === undefined) {
+      const controller = new AbortController;
+      let current;
+      const promise = runCommand(this.#command, this.#context, controller.signal).then((token) => {
+        this.#cached = { token, expiresAt: Date.now() + this.#ttlMs };
+        this.#failure = undefined;
+        return token;
+      }).catch((error) => {
+        if (!controller.signal.aborted) {
+          this.#failure = { error, retryAt: Date.now() + this.#ttlMs };
+        }
+        if (this.#cached !== undefined)
+          return this.#cached.token;
+        throw error;
+      }).finally(() => {
+        if (this.#inflight === current)
+          this.#inflight = undefined;
+      });
+      current = { controller, promise, waiters: 0 };
+      this.#inflight = current;
+      inflight = current;
+    }
+    return this.#wait(inflight, signal);
+  }
+  #wait(inflight, signal) {
+    inflight.waiters++;
+    let onAbort;
+    const result = signal === undefined ? inflight.promise : Promise.race([
+      inflight.promise,
+      new Promise((_resolve, reject) => {
+        onAbort = () => reject(abortReason(signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    ]);
+    return result.finally(() => {
+      if (onAbort)
+        signal.removeEventListener("abort", onAbort);
+      inflight.waiters--;
+      if (this.#inflight === inflight && inflight.waiters === 0) {
+        this.#inflight = undefined;
+        inflight.controller.abort(signal?.reason);
+      }
+    });
+  }
+}