@go-labs-sg/bb 2.24.2 → 2.25.0

package/dist/index.js

@@ -372,6 +372,20 @@ var import_dotenv = __toESM(require_main(), 1);
 import path from "path";
 import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
 
+// ../../cli-auth/src/client/credential-store.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open as open2,
+  readFile,
+  stat,
+  unlink
+} from "fs/promises";
+import { userInfo } from "os";
+import { join } from "path";
+
 // ../../cli-auth/src/protocol/constants.ts
 var CLI_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
 var CLI_DEVICE_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
@@ -19025,13 +19039,15 @@ var deviceTokenErrorSchema = exports_external.object({
     "authorization_pending",
     "slow_down",
     "access_denied",
-    "expired_token"
+    "expired_token",
+    "invalid_grant"
   ])
 }).strict();
 var refreshRequestSchema = exports_external.object({ refreshToken: exports_external.string().min(40) }).strict();
 var storedCliCredentialsSchema = exports_external.object({
   accessToken: exports_external.string().min(1),
   accessTokenExpiresAt: dateTimeString,
+  issuer: exports_external.string().url().optional(),
   refreshToken: exports_external.string().min(1),
   refreshTokenExpiresAt: dateTimeString,
   session: cliSessionIdentitySchema
@@ -19083,6 +19099,77 @@ var defaultSecrets = () => {
   assertBunRuntime();
   return Bun.secrets;
 };
+var refreshLockTimeoutMs = 5 * 60 * 1000;
+var refreshLockRetryMs = 50;
+var getCredentialLockDirectoryPath = () => {
+  return join(userInfo().homedir, ".cache", "go-labs-cli", "locks");
+};
+var ensurePrivateCredentialLockDirectory = async () => {
+  const directory = getCredentialLockDirectoryPath();
+  await mkdir(directory, { mode: 448, recursive: true });
+  const inspectDirectory = async () => {
+    const directoryStat2 = await lstat(directory);
+    if (directoryStat2.isSymbolicLink() || !directoryStat2.isDirectory()) {
+      throw new Error("The CLI credential lock path is not a private directory.");
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && directoryStat2.uid !== uid) {
+      throw new Error("The CLI credential lock directory belongs to another user.");
+    }
+    return directoryStat2;
+  };
+  const directoryStat = await inspectDirectory();
+  if ((directoryStat.mode & 63) !== 0) {
+    await chmod(directory, 448);
+    const securedDirectoryStat = await inspectDirectory();
+    if ((securedDirectoryStat.mode & 63) !== 0) {
+      throw new Error("Unable to secure the CLI credential lock directory.");
+    }
+  }
+  return directory;
+};
+var getCredentialLockPath = async (product, account) => {
+  const key = createHash2("sha256").update(`${product}:${account}`).digest("hex");
+  return join(await ensurePrivateCredentialLockDirectory(), `${key}.lock`);
+};
+var acquireRefreshLock = async (path2) => {
+  const deadline = Date.now() + refreshLockTimeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const handle = await open2(path2, "wx");
+      const owner = randomUUID();
+      try {
+        await handle.writeFile(owner);
+      } catch (cause) {
+        await handle.close().catch(() => {
+          return;
+        });
+        await unlink(path2).catch(() => {
+          return;
+        });
+        throw cause;
+      }
+      return { handle, owner };
+    } catch (cause) {
+      if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "EEXIST") {
+        throw cause;
+      }
+      try {
+        const lock = await stat(path2);
+        if (Date.now() - lock.mtimeMs > refreshLockTimeoutMs) {
+          throw new Error(`The CLI credential lock appears stale at ${path2}. Ensure no CLI authentication command is running, remove that lock file, and retry.`);
+        }
+      } catch (statCause) {
+        if (statCause instanceof Error && "code" in statCause && statCause.code === "ENOENT") {
+          continue;
+        }
+        throw statCause;
+      }
+      await Bun.sleep(refreshLockRetryMs);
+    }
+  }
+  throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
+};
 var createBunCredentialStore = ({
   account = "default",
   product,
@@ -19110,16 +19197,46 @@ var createBunCredentialStore = ({
         service,
         value: JSON.stringify(parsed)
       }));
+    },
+    withCredentialLock: async (operation) => {
+      const refreshLockPath = await getCredentialLockPath(product, account);
+      const lock = await acquireRefreshLock(refreshLockPath);
+      try {
+        return await operation();
+      } finally {
+        await lock.handle.close();
+        const owner = await readFile(refreshLockPath, "utf8").catch(() => null);
+        if (owner === lock.owner) {
+          await unlink(refreshLockPath).catch(() => {
+            return;
+          });
+        }
+      }
     }
   };
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname as hostname3 } from "os";
-var normalizeBaseUrl = (value) => value.replace(/\/+$/, "");
-var postJson = async (fetchImplementation, url2, body) => fetchImplementation(url2, {
+var normalizeCliAuthIssuer = (value) => {
+  const url2 = new URL(value);
+  url2.hash = "";
+  url2.search = "";
+  url2.pathname = url2.pathname.replace(/\/+$/, "");
+  return url2.toString().replace(/\/+$/, "");
+};
+var isCliCredentialForIssuer = (credentials, apiBaseUrl) => credentials.issuer === normalizeCliAuthIssuer(apiBaseUrl);
+var credentialIssuerError = (issuer) => issuer ? new Error("These CLI credentials belong to a different API URL. Run auth login for this API URL before retrying.") : new Error("These CLI credentials were created by an older CLI and are not bound to an API URL. Run auth login again.");
+var assertCredentialIssuer = (credentials, apiBaseUrl) => {
+  const expectedIssuer = normalizeCliAuthIssuer(apiBaseUrl);
+  if (!credentials.issuer || credentials.issuer !== expectedIssuer) {
+    throw credentialIssuerError(credentials.issuer);
+  }
+};
+var postJson = async (fetchImplementation, url2, body, options = {}) => fetchImplementation(url2, {
   body: JSON.stringify(body),
   headers: { "content-type": "application/json" },
-  method: "POST"
+  method: "POST",
+  ...options
 });
 var readJson = async (response) => {
   try {
@@ -19128,9 +19245,29 @@ var readJson = async (response) => {
     throw new Error(`CLI authentication returned HTTP ${response.status} without valid JSON.`);
   }
 };
-var toStoredCredentials = (response, now) => ({
+var localCredentialLocks = new WeakMap;
+var withCredentialLock = (store, operation) => {
+  if (store.withCredentialLock) {
+    return store.withCredentialLock(operation);
+  }
+  const previous = localCredentialLocks.get(store) ?? Promise.resolve();
+  const pending = previous.then(operation, operation);
+  const tail = pending.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  localCredentialLocks.set(store, tail);
+  return pending.finally(() => {
+    if (localCredentialLocks.get(store) === tail) {
+      localCredentialLocks.delete(store);
+    }
+  });
+};
+var toStoredCredentials = (response, issuer, now) => ({
   accessToken: response.accessToken,
   accessTokenExpiresAt: new Date(now.getTime() + response.expiresIn * 1000).toISOString(),
+  issuer,
   refreshToken: response.refreshToken,
   refreshTokenExpiresAt: new Date(now.getTime() + response.refreshExpiresIn * 1000).toISOString(),
   session: response.session
@@ -19164,7 +19301,7 @@ var loginWithBrowser = async ({
   sleep = (milliseconds) => Bun.sleep(milliseconds),
   store
 }) => {
-  const baseUrl = normalizeBaseUrl(apiBaseUrl);
+  const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -19191,8 +19328,8 @@ var loginWithBrowser = async ({
     const payload = await readJson(response);
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
-      const credentials = toStoredCredentials(issued, now());
-      await store.set(credentials);
+      const credentials = toStoredCredentials(issued, baseUrl, now());
+      await withCredentialLock(store, () => store.set(credentials));
       return credentials;
     }
     const error61 = deviceTokenErrorSchema.safeParse(payload);
@@ -19213,6 +19350,26 @@ var loginWithBrowser = async ({
   throw new Error("CLI authentication expired. Run auth login again.");
 };
 var refreshes = new WeakMap;
+var refreshRequestTimeoutMs = 30000;
+var isInvalidGrantResponse = (payload) => {
+  const parsed = deviceTokenErrorSchema.safeParse(payload);
+  return parsed.success && parsed.data.error === "invalid_grant";
+};
+var readJsonOrNull = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var deleteInvalidCredentials = async (store, credentials) => {
+  const current = await store.get();
+  if (!current)
+    return;
+  if (current.issuer === credentials.issuer && current.refreshToken === credentials.refreshToken) {
+    await store.delete();
+  }
+};
 var refreshAccessToken = async ({
   apiBaseUrl,
   credentials,
@@ -19220,16 +19377,56 @@ var refreshAccessToken = async ({
   now,
   store
 }) => {
-  const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken });
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  let response;
+  try {
+    response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API could not be reached. Credentials were kept; retry the command.");
+  }
   if (!response.ok) {
-    await store.delete();
-    throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    const payload2 = await readJsonOrNull(response);
+    if (isInvalidGrantResponse(payload2)) {
+      await deleteInvalidCredentials(store, credentials);
+      throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    }
+    throw new Error(`Unable to refresh the CLI session (HTTP ${response.status}). Credentials were kept; retry the command.`);
+  }
+  const payload = await readJsonOrNull(response);
+  if (payload === null) {
+    throw new Error("Unable to refresh the CLI session because the API returned malformed JSON. Credentials were kept; retry the command.");
+  }
+  let issued;
+  try {
+    issued = tokenResponseSchema.parse(payload);
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
   }
-  const issued = tokenResponseSchema.parse(await readJson(response));
-  const stored = toStoredCredentials(issued, now());
+  const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
   await store.set(stored);
   return stored.accessToken;
 };
+var refreshWithCurrentCredentials = async ({
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  now,
+  store
+}) => {
+  const credentials = await store.get();
+  if (!credentials)
+    throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
+    return credentials.accessToken;
+  }
+  return refreshAccessToken({
+    apiBaseUrl,
+    credentials,
+    fetch: fetchImplementation,
+    now,
+    store
+  });
+};
 var getAuthenticatedAccessToken = async ({
   apiBaseUrl,
   fetch: fetchImplementation = globalThis.fetch,
@@ -19239,19 +19436,20 @@ var getAuthenticatedAccessToken = async ({
   const credentials = await store.get();
   if (!credentials)
     throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
   if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
     return credentials.accessToken;
   }
   const existing = refreshes.get(store);
   if (existing)
     return existing;
-  const refresh = refreshAccessToken({
+  const refreshOperation = () => withCredentialLock(store, () => refreshWithCurrentCredentials({
     apiBaseUrl,
-    credentials,
     fetch: fetchImplementation,
     now,
     store
-  }).finally(() => refreshes.delete(store));
+  }));
+  const refresh = refreshOperation().finally(() => refreshes.delete(store));
   refreshes.set(store, refresh);
   return refresh;
 };
@@ -19260,18 +19458,22 @@ var logoutCliSession = async ({
   fetch: fetchImplementation = globalThis.fetch,
   store
 }) => {
-  const credentials = await store.get();
-  let remoteRevoked = credentials === null;
-  if (credentials) {
-    try {
-      const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken });
-      remoteRevoked = response.ok;
-    } catch {
-      remoteRevoked = false;
+  const issuer = normalizeCliAuthIssuer(apiBaseUrl);
+  return withCredentialLock(store, async () => {
+    const credentials = await store.get();
+    let remoteRevoked = credentials === null;
+    if (credentials) {
+      try {
+        assertCredentialIssuer(credentials, apiBaseUrl);
+        const response = await postJson(fetchImplementation, `${issuer}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+        remoteRevoked = response.ok;
+      } catch {
+        remoteRevoked = false;
+      }
     }
-  }
-  await store.delete();
-  return { remoteRevoked };
+    await store.delete();
+    return { remoteRevoked };
+  });
 };
 // src/cli.ts
 import { readFileSync } from "fs";
@@ -19426,8 +19628,8 @@ var api2 = new Proxy({}, {
 });
 
 // src/commands/index.ts
-import { randomUUID } from "crypto";
-import { readFile, writeFile } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+import { readFile as readFile2, writeFile } from "fs/promises";
 import { basename } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 
@@ -21236,7 +21438,7 @@ var rethrowAfterStagedPaymentProofCleanup = async (error61, cleanup) => {
   throw error61;
 };
 var stageBillPaymentProof = async (projectId, filePath) => {
-  const buffer = await readFile(filePath);
+  const buffer = await readFile2(filePath);
   const fileName = basename(filePath);
   const size = buffer.byteLength;
   const contentType2 = billAttachmentContentTypeForFileName(fileName);
@@ -21272,7 +21474,7 @@ var stageBillPaymentProof = async (projectId, filePath) => {
     }
     throw uploadError;
   }
-  return { id: randomUUID(), key, name: fileName, size };
+  return { id: randomUUID2(), key, name: fileName, size };
 };
 async function updateBillStatus(opts) {
   validateBillStatusUpdateOptions(opts);
@@ -21327,7 +21529,7 @@ async function getBillAttachments(id) {
 async function stageBillAttachmentsFromPaths(projectId, filePaths) {
   const attachments = [];
   for (const filePath of filePaths) {
-    const buffer = await readFile(filePath);
+    const buffer = await readFile2(filePath);
     const fileName = basename(filePath);
     const size = buffer.byteLength;
     const contentType2 = billAttachmentContentTypeForFileName(fileName);
@@ -21345,7 +21547,7 @@ async function stageBillAttachmentsFromPaths(projectId, filePaths) {
     if (!response.ok) {
       throw new Error(`S3 upload failed: HTTP ${response.status} ${(await response.text()).slice(0, 500)}`);
     }
-    attachments.push({ id: randomUUID(), key, name: fileName, size });
+    attachments.push({ id: randomUUID2(), key, name: fileName, size });
   }
   out({
     success: true,
@@ -21366,7 +21568,7 @@ async function uploadBillAttachmentFromPath(billId, filePath, type = "BILL") {
   out(confirmed);
 }
 var uploadSingleBillAttachmentFromPath = async (billId, filePath, type = "BILL") => {
-  const buf = await readFile(filePath);
+  const buf = await readFile2(filePath);
   const fileName = basename(filePath);
   const size = buf.byteLength;
   const attachmentContentType = billAttachmentContentTypeForFileName(fileName);
@@ -21435,14 +21637,14 @@ async function uploadBillDocumentsFromPaths({
   });
 }
 async function uploadQuotationAttachmentFromPath(projectId, filePath) {
-  const buf = await readFile(filePath);
+  const buf = await readFile2(filePath);
   const fileName = basename(filePath);
   if (buf.byteLength > QUOTATION_ATTACHMENT_MAX_SIZE) {
     throw new Error("Quotation attachment must be 20MB or smaller.");
   }
   const attachmentContentType = quotationAttachmentContentTypeForFileName(fileName);
   const ext = fileName.split(".").pop()?.toLowerCase().replace(/[^a-z0-9]/g, "");
-  const key = `quotations/${projectId}/${randomUUID()}.${ext || "pdf"}`;
+  const key = `quotations/${projectId}/${randomUUID2()}.${ext || "pdf"}`;
   const uploadUrl = await api2.attachment.getPresignedUrlToUpload.mutate({
     key,
     size: buf.byteLength,
@@ -21457,7 +21659,7 @@ async function uploadQuotationAttachmentFromPath(projectId, filePath) {
     throw new Error(`S3 upload failed: HTTP ${res.status} ${(await res.text()).slice(0, 500)}`);
   }
   out({
-    id: randomUUID(),
+    id: randomUUID2(),
     name: fileName,
     key,
     size: buf.byteLength
@@ -21472,7 +21674,7 @@ var cleanupStagedQuotationAttachments = async (projectId, keys) => {
 };
 async function uploadBudgetAttachmentFromPath(budgetId, filePath) {
   await confirmLockedBudgetChangeByBudgetId(budgetId, "Upload budget attachment");
-  const buf = await readFile(filePath);
+  const buf = await readFile2(filePath);
   const fileName = basename(filePath);
   const size = buf.byteLength;
   const attachmentContentType = attachmentContentTypeForFileName(fileName);
@@ -21505,7 +21707,7 @@ async function uploadBudgetWinProofFromPath(budgetId, filePath, opts) {
     details: "by uploading proof and setting status to ESTIMATE_ACCEPTED"
   });
   await confirmLockedBudgetChangeByBudgetId(budgetId, "Mark budget won");
-  const buf = await readFile(filePath);
+  const buf = await readFile2(filePath);
   const fileName = basename(filePath);
   const size = buf.byteLength;
   const attachmentContentType = attachmentContentTypeForFileName(fileName);
@@ -24065,7 +24267,7 @@ Waiting for approval\u2026
           authenticated: true,
           method: "api-key",
           storage: "environment"
-        } : credentials ? {
+        } : credentials && isCliCredentialForIssuer(credentials, BUDGET_BUILDER_API_BASE_URL) ? {
           authenticated: true,
           method: "browser-session",
           accessTokenExpiresAt: credentials.accessTokenExpiresAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/bb",
-  "version": "2.24.2",
+  "version": "2.25.0",
   "description": "Budget Builder CLI for AI agents — manage budgets, bills, claims, quotations, and customer invoices with explicit workflow previews for sensitive changes.",
   "type": "module",
   "main": "./dist/index.js",