@gloom-sh/terminal 0.19.1 → 0.19.3

package/src/data/app-persistence.ts

@@ -1,7 +1,7 @@
 import { PluginStateStore } from "./plugin-state-store";
 import { ResourceStore } from "./resource-store";
 import { SessionStore } from "./session-store";
-import { SqliteDatabase } from "./sqlite/database";
+import { SqliteDatabase, type SqliteDatabaseOptions } from "./sqlite/database";
 import { TickerStore } from "./ticker-store";
 
 export class AppPersistence {
@@ -11,15 +11,17 @@ export class AppPersistence {
   readonly pluginState: PluginStateStore;
   readonly sessions: SessionStore;
 
-  constructor(dbPath: string) {
-    this.database = new SqliteDatabase(dbPath);
-    this.tickers = new TickerStore(this.database.connection);
-    this.resources = new ResourceStore(this.database.connection);
-    this.pluginState = new PluginStateStore(this.database.connection);
-    this.sessions = new SessionStore(this.database.connection);
+  constructor(dbPath: string, options: SqliteDatabaseOptions = {}) {
+    this.database = new SqliteDatabase(dbPath, options);
+    const { connection, access } = this.database;
+    this.tickers = new TickerStore(connection, access);
+    this.resources = new ResourceStore(connection, access);
+    this.pluginState = new PluginStateStore(connection, access);
+    this.sessions = new SessionStore(connection, access);
   }
 
   close(): void {
+    this.resources.close();
     this.database.close();
   }
 }

package/src/data/config/store/node.ts

@@ -1,6 +1,6 @@
 import { logFailure } from "../../../utils/log-failure";
 import { existsSync, readdirSync, type Dirent } from "fs";
-import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import { readFile, rename, rm } from "fs/promises";
 import { dirname, join, resolve } from "path";
 import { expandUserHome, getGloomberbDirs } from "../home";
 import type { AppConfig } from "../../../types/config";
@@ -8,6 +8,8 @@ import { createDefaultConfig } from "../../../types/config";
 import { debugLog } from "../../../utils/debug-log";
 import { findAbsorbedCheckout, isDirectoryOrLink, isPluginDirectory } from "../../../plugins/loader";
 import { EXTRACTED_PLUGINS } from "../../../plugins/extracted-plugins";
+import { makePrivateDir, writePrivateFile } from "../../../utils/private-files";
+import { tightenProfilePermissions } from "../../profile-permissions";
 import type { ConfigMigrationHost } from "./migrations";
 import {
   normalizeConfigForSave,
@@ -113,11 +115,12 @@ const saveQueues = new Map<string, Promise<void>>();
 let tempFileCounter = 0;
 
 async function writeConfigFile(configPath: string, contents: string): Promise<void> {
-  await mkdir(dirname(configPath), { recursive: true });
+  await makePrivateDir(dirname(configPath));
   // Unique per call: a clock tick is not, and two saves can land in one.
   const tempPath = `${configPath}.${process.pid}.${Date.now()}.${tempFileCounter++}.tmp`;
   try {
-    await writeFile(tempPath, contents, "utf-8");
+    // Readable by the user alone: config.json holds broker credentials.
+    await writePrivateFile(tempPath, contents);
     await rename(tempPath, configPath);
   } catch (error) {
     await rm(tempPath, { force: true }).catch(() => { /* Intentional ignore: Remove a partial temporary file while preserving the write error rethrown below. */ });
@@ -149,11 +152,12 @@ export async function saveConfig(config: AppConfig): Promise<void> {
 
 export async function initDataDir(dataDir: string): Promise<AppConfig> {
   configLog.info(`Initializing data directory: ${dataDir}`);
-  await mkdir(dataDir, { recursive: true });
+  await makePrivateDir(dataDir);
   const { config, needsSave } = await loadConfigState(dataDir);
   if (needsSave) {
     await saveConfig(config);
   }
+  await tightenProfilePermissions(dataDir, [configFileFor(dataDir), getGloomberbDirs().configFile]);
   return config;
 }
 
@@ -166,7 +170,9 @@ export async function resetAllData(dataDir: string): Promise<void> {
 
 export async function exportConfig(config: AppConfig, destPath: string): Promise<void> {
   const { dataDir, ...rest } = config;
-  await writeFile(expandHomePath(destPath), JSON.stringify(rest, null, 2), "utf-8");
+  // The export carries broker credentials as config.json does: readable by the
+  // user alone, an existing file included, and never written through a link.
+  await writePrivateFile(expandHomePath(destPath), JSON.stringify(rest, null, 2));
 }
 
 export async function importConfig(dataDir: string, srcPath: string): Promise<AppConfig> {

package/src/data/config/store/normalize.ts

@@ -30,6 +30,7 @@ import { DEFAULT_THEME, themes } from "../../../theme/themes";
 import { sanitizeStarPrompt } from "../../../app/star-prompt/model";
 import { sanitizeCommandBarOpens } from "../../../app/command-bar-intro";
 import { sanitizeUpdatesConfig } from "../../../updater/channel";
+import { ATTENTION_NOTICE_ACCOUNTS } from "../../../telemetry/attention-setting";
 
 const configLog = debugLog.createLogger("config");
 const reportedUnknownThemes = new Set<string>();
@@ -201,17 +202,28 @@ function withUpdates(updates: AppConfig["updates"]): Pick<AppConfig, "updates">
   return updates ? { updates } : {};
 }
 
-/** Only the switches that are set survive; an empty object is the same as none. */
+/**
+ * Only the switches that are set survive; an empty object is the same as none.
+ * Attention Counts is on by default, so a value that cannot be read turns it
+ * off instead: a hand-edited "false" or a broken block never counts as on.
+ */
 function sanitizeTelemetry(value: unknown): TelemetryConfig | undefined {
-  if (!isRecord(value)) return undefined;
+  if (value === undefined) return undefined;
+  if (!isRecord(value)) return { attention: false };
   const telemetry: TelemetryConfig = {
     ...(typeof value.crashReports === "boolean" ? { crashReports: value.crashReports } : {}),
     ...(typeof value.usage === "boolean" ? { usage: value.usage } : {}),
-    ...(typeof value.attention === "boolean" ? { attention: value.attention } : {}),
+    ...(value.attention !== undefined ? { attention: value.attention === true } : {}),
+    ...sanitizeAttentionNotice(value.attentionNoticeShownTo),
   };
   return Object.keys(telemetry).length > 0 ? telemetry : undefined;
 }
 
+function sanitizeAttentionNotice(value: unknown): Pick<TelemetryConfig, "attentionNoticeShownTo"> {
+  const accounts = sanitizeUniqueStringList(value).slice(-ATTENTION_NOTICE_ACCOUNTS);
+  return accounts.length > 0 ? { attentionNoticeShownTo: accounts } : {};
+}
+
 /**
  * Keeps the shape honest without judging the contents: a chord that does not
  * parse stays in the file and is reported when the table resolves, so a typo
@@ -286,6 +298,7 @@ function sanitizeOnboardingProgress(value: unknown): OnboardingProgress | undefi
     accountStatus,
     checkoutOpenedAt: typeof value.checkoutOpenedAt === "string" ? value.checkoutOpenedAt : undefined,
     desks: Array.isArray(value.desks) ? sanitizeUniqueStringList(value.desks) : undefined,
+    rerun: value.rerun === true ? true : undefined,
   };
 }
 

package/src/data/plugin-cache.ts

@@ -2,6 +2,7 @@ import { logFailure } from "../utils/log-failure";
 import type { CachePolicy } from "../types/persistence";
 import type { PluginPersistence } from "../types/plugin";
 import { CachedQuery, type CachedValue } from "./cached-query";
+import { isTransientFailure } from "../api-client/errors";
 
 export interface PluginCacheResult<T> {
   data: T;
@@ -12,6 +13,20 @@ export interface PluginCacheResult<T> {
   source: "cache" | "network" | "stale-fallback";
 }
 
+/**
+ * `result`, or the failure of the refresh it stands in for when a saved copy
+ * may not answer for it. A saved copy covers only a failure asking again may
+ * get past (`isTransientFailure`: no connection, a timeout, a rate-limited or
+ * overloaded server, a reply whose source did not answer this time); a
+ * refusal (another 4xx, such as a series no longer served or a signed-out
+ * session) and an answer that failed validation are thrown, so they show as
+ * the errors they are instead of as old data.
+ */
+export function savedCopyForTransientFailure<R extends { source?: PluginCacheResult<unknown>["source"]; error?: unknown }>(result: R): R {
+  if (result.source === "stale-fallback" && !isTransientFailure(result.error)) throw result.error;
+  return result;
+}
+
 /** Shared persistence/request lifecycle; keys, codecs, validation and policies stay with the plugin. */
 export function createPluginCache<T, Stored = T>(options: {
   kind: string;

package/src/data/plugin-state-store.ts

@@ -1,6 +1,6 @@
 import type { Database } from "bun:sqlite";
+import { createSqliteAccess, type SqliteAccess } from "./sqlite/access";
 import { safeParseJson, serializeJson } from "./sqlite/json";
-import { withSqliteBusyRetry } from "./sqlite/retry";
 
 const DEFAULT_PLUGIN_STATE_SCHEMA_VERSION = 1;
 
@@ -24,14 +24,39 @@ interface CachedPluginStateRecord {
   rawValue: string;
 }
 
+/** A queued write's record (null for a delete), one object per write. */
+interface PendingPluginState {
+  pluginId: string;
+  key: string;
+  record: CachedPluginStateRecord | null;
+}
+
+function stateKey(pluginId: string, key: string): string {
+  return `${pluginId}:${key}`;
+}
+
+/** A queued write's row, unambiguous where ids and keys hold colons. */
+function rowKey(pluginId: string, key: string): string {
+  return `${pluginId}\u0000${key}`;
+}
+
 export class PluginStateStore {
   private readonly cache = new Map<string, CachedPluginStateRecord>();
+  /** Writes queued behind another program's lock, read back until they land. */
+  private readonly pending = new Map<string, PendingPluginState>();
 
-  constructor(private readonly db: Database) {}
+  constructor(
+    private readonly db: Database,
+    private readonly access: SqliteAccess = createSqliteAccess(db),
+  ) {}
 
   get<T>(pluginId: string, key: string, schemaVersion = DEFAULT_PLUGIN_STATE_SCHEMA_VERSION): PluginStateRecord<T> | null {
-    const cacheKey = `${pluginId}:${key}`;
-    const row = withSqliteBusyRetry("load plugin state", () => (
+    const cacheKey = stateKey(pluginId, key);
+    const pending = this.pending.get(rowKey(pluginId, key));
+    if (pending) {
+      return pending.record?.schemaVersion === schemaVersion ? pending.record as PluginStateRecord<T> : null;
+    }
+    const row = this.access.run("load plugin state", () => (
       this.db
         .query<{ schema_version: number; value: string; updated_at: number }, [string, string]>(
           "SELECT schema_version, value, updated_at FROM plugin_state WHERE plugin_id = ? AND key = ?",
@@ -77,46 +102,42 @@ export class PluginStateStore {
   setMany(entries: PluginStateSetEntry[]): void {
     if (entries.length === 0) return;
     const updatedAt = Date.now();
-    const records = entries.map((entry) => ({
+    const writes: PendingPluginState[] = entries.map((entry) => ({
       pluginId: entry.pluginId,
       key: entry.key,
-      value: entry.value,
-      schemaVersion: entry.schemaVersion ?? DEFAULT_PLUGIN_STATE_SCHEMA_VERSION,
-      rawValue: serializeJson(entry.value),
+      record: {
+        value: entry.value,
+        schemaVersion: entry.schemaVersion ?? DEFAULT_PLUGIN_STATE_SCHEMA_VERSION,
+        updatedAt,
+        rawValue: serializeJson(entry.value),
+      },
     }));
 
-    withSqliteBusyRetry("save plugin state", () => {
+    this.write("save plugin state", writes, writes.length === 1, () => {
       const insert = this.db.query(
         `INSERT OR REPLACE INTO plugin_state (plugin_id, key, schema_version, value, updated_at)
          VALUES (?, ?, ?, ?, ?)`,
       );
       const tx = this.db.transaction(() => {
-        for (const record of records) {
-          insert.run(record.pluginId, record.key, record.schemaVersion, record.rawValue, updatedAt);
+        for (const { pluginId, key, record } of writes) {
+          insert.run(pluginId, key, record!.schemaVersion, record!.rawValue, updatedAt);
         }
       });
       tx();
     });
 
-    for (const record of records) {
-      this.cache.set(`${record.pluginId}:${record.key}`, {
-        value: record.value,
-        schemaVersion: record.schemaVersion,
-        updatedAt,
-        rawValue: record.rawValue,
-      });
-    }
+    for (const { pluginId, key, record } of writes) this.cache.set(stateKey(pluginId, key), record!);
   }
 
   delete(pluginId: string, key: string): void {
-    withSqliteBusyRetry("delete plugin state", () => {
+    this.write("delete plugin state", [{ pluginId, key, record: null }], true, () => {
       this.db.query("DELETE FROM plugin_state WHERE plugin_id = ? AND key = ?").run(pluginId, key);
     });
-    this.cache.delete(`${pluginId}:${key}`);
+    this.cache.delete(stateKey(pluginId, key));
   }
 
   keys(pluginId: string): string[] {
-    return withSqliteBusyRetry("list plugin state keys", () => (
+    const stored = this.access.run("list plugin state keys", () => (
       this.db
         .query<{ key: string }, [string]>(
           "SELECT key FROM plugin_state WHERE plugin_id = ? ORDER BY key",
@@ -124,10 +145,18 @@ export class PluginStateStore {
         .all(pluginId)
         .map((row) => row.key)
     ));
+    if (this.pending.size === 0) return stored;
+    const keys = new Set(stored);
+    for (const entry of this.pending.values()) {
+      if (entry.pluginId !== pluginId) continue;
+      if (entry.record) keys.add(entry.key);
+      else keys.delete(entry.key);
+    }
+    return [...keys].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
   }
 
   pluginIds(): string[] {
-    return withSqliteBusyRetry("list plugin state ids", () => (
+    const stored = this.access.run("list plugin state ids", () => (
       this.db
         .query<{ plugin_id: string }, []>(
           "SELECT DISTINCT plugin_id FROM plugin_state ORDER BY plugin_id",
@@ -135,10 +164,19 @@ export class PluginStateStore {
         .all()
         .map((row) => row.plugin_id)
     ));
+    if (this.pending.size === 0) return stored;
+    const ids = new Set(stored);
+    for (const { pluginId } of this.pending.values()) {
+      if (this.keys(pluginId).length > 0) ids.add(pluginId);
+      else ids.delete(pluginId);
+    }
+    return [...ids].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
   }
 
   clear(pluginId: string): void {
-    withSqliteBusyRetry("clear plugin state", () => {
+    const cleared = this.keys(pluginId).map((key): PendingPluginState => ({ pluginId, key, record: null }));
+    // Deletes rows this store may not know of: never one row's write.
+    this.write("clear plugin state", cleared, false, () => {
       this.db.query("DELETE FROM plugin_state WHERE plugin_id = ?").run(pluginId);
     });
     for (const cacheKey of this.cache.keys()) {
@@ -147,4 +185,23 @@ export class PluginStateStore {
       }
     }
   }
+
+  /**
+   * Runs `statement` through the write queue, reading `entries` back until it
+   * lands. A write of exactly one row (`oneRow`) replaces a queued write of
+   * the same row.
+   */
+  private write(operationName: string, entries: PendingPluginState[], oneRow: boolean, statement: () => void): void {
+    for (const entry of entries) this.pending.set(rowKey(entry.pluginId, entry.key), entry);
+    const only = oneRow && entries.length === 1 ? entries[0] : undefined;
+    this.access.write(operationName, statement, {
+      ...(only ? { key: `plugin_state\u0000${rowKey(only.pluginId, only.key)}` } : {}),
+      settled: () => {
+        for (const entry of entries) {
+          const pendingKey = rowKey(entry.pluginId, entry.key);
+          if (this.pending.get(pendingKey) === entry) this.pending.delete(pendingKey);
+        }
+      },
+    });
+  }
 }

package/src/data/profile-permissions.ts

@@ -0,0 +1,47 @@
+import { readdir } from "fs/promises";
+import { dirname, join } from "path";
+import { logFailure } from "../utils/log-failure";
+import { restrictDir, restrictFile } from "../utils/private-files";
+
+/** The data folder's files that hold the Cloud session and cache, or logs of what the user did. */
+const PRIVATE_DATA_FILES = [
+  ".gloomberb-cache.db",
+  ".gloomberb-cache.db-wal",
+  ".gloomberb-cache.db-shm",
+  "stall-log.txt",
+  "stall-reports.json",
+  "crash-reports.json",
+  "desktop-view-ids.json",
+];
+/** `remote-control.json` and one per app (`remote-control.tui.json`): each holds the remote-control token. */
+const REMOTE_ENDPOINT_FILE = /^remote-control(?:\.[\w-]+)?\.json$/;
+
+/**
+ * Tightens a profile made before its folders and files were created private,
+ * or under a umask that let others read them: the data folder and each
+ * config.json's folder open to the user alone, config.json (broker
+ * credentials) and the files above readable by the user alone. A step that
+ * fails (a folder another account owns, a disk without POSIX modes) is logged
+ * and the others still run; startup goes on either way. Nothing to do on
+ * Windows (see private-files.ts).
+ */
+export async function tightenProfilePermissions(dataDir: string, configFiles: readonly string[]): Promise<void> {
+  if (process.platform === "win32") return;
+  const steps: Array<() => Promise<void>> = [
+    ...[...new Set([dataDir, ...configFiles.map((file) => dirname(file))])].map((dir) => () => restrictDir(dir)),
+    ...[...new Set(configFiles)].map((file) => () => restrictFile(file)),
+    ...PRIVATE_DATA_FILES.map((name) => () => restrictFile(join(dataDir, name))),
+    async () => {
+      for (const name of await readdir(dataDir)) {
+        if (REMOTE_ENDPOINT_FILE.test(name)) await restrictFile(join(dataDir, name));
+      }
+    },
+  ];
+  for (const step of steps) {
+    try {
+      await step();
+    } catch (error) {
+      logFailure("data.profile-permissions", "Restricting a profile file to its user failed")(error);
+    }
+  }
+}