@go-labs-sg/gosh 0.4.2 → 0.5.0

package/dist/index.js

@@ -375,6 +375,20 @@ import_dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true })
 // src/cli.ts
 import { readFileSync } from "fs";
 
+// ../../cli-auth/src/client/credential-store.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open as open2,
+  readFile,
+  stat,
+  unlink
+} from "fs/promises";
+import { userInfo } from "os";
+import { join } from "path";
+
 // ../../cli-auth/src/protocol/constants.ts
 var CLI_ACCESS_TOKEN_TTL_MS = 15 * 60 * 1000;
 var CLI_DEVICE_AUTHORIZATION_TTL_MS = 10 * 60 * 1000;
@@ -19028,13 +19042,15 @@ var deviceTokenErrorSchema = exports_external.object({
     "authorization_pending",
     "slow_down",
     "access_denied",
-    "expired_token"
+    "expired_token",
+    "invalid_grant"
   ])
 }).strict();
 var refreshRequestSchema = exports_external.object({ refreshToken: exports_external.string().min(40) }).strict();
 var storedCliCredentialsSchema = exports_external.object({
   accessToken: exports_external.string().min(1),
   accessTokenExpiresAt: dateTimeString,
+  issuer: exports_external.string().url().optional(),
   refreshToken: exports_external.string().min(1),
   refreshTokenExpiresAt: dateTimeString,
   session: cliSessionIdentitySchema
@@ -19086,6 +19102,77 @@ var defaultSecrets = () => {
   assertBunRuntime();
   return Bun.secrets;
 };
+var refreshLockTimeoutMs = 5 * 60 * 1000;
+var refreshLockRetryMs = 50;
+var getCredentialLockDirectoryPath = () => {
+  return join(userInfo().homedir, ".cache", "go-labs-cli", "locks");
+};
+var ensurePrivateCredentialLockDirectory = async () => {
+  const directory = getCredentialLockDirectoryPath();
+  await mkdir(directory, { mode: 448, recursive: true });
+  const inspectDirectory = async () => {
+    const directoryStat2 = await lstat(directory);
+    if (directoryStat2.isSymbolicLink() || !directoryStat2.isDirectory()) {
+      throw new Error("The CLI credential lock path is not a private directory.");
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && directoryStat2.uid !== uid) {
+      throw new Error("The CLI credential lock directory belongs to another user.");
+    }
+    return directoryStat2;
+  };
+  const directoryStat = await inspectDirectory();
+  if ((directoryStat.mode & 63) !== 0) {
+    await chmod(directory, 448);
+    const securedDirectoryStat = await inspectDirectory();
+    if ((securedDirectoryStat.mode & 63) !== 0) {
+      throw new Error("Unable to secure the CLI credential lock directory.");
+    }
+  }
+  return directory;
+};
+var getCredentialLockPath = async (product, account) => {
+  const key = createHash2("sha256").update(`${product}:${account}`).digest("hex");
+  return join(await ensurePrivateCredentialLockDirectory(), `${key}.lock`);
+};
+var acquireRefreshLock = async (path2) => {
+  const deadline = Date.now() + refreshLockTimeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const handle = await open2(path2, "wx");
+      const owner = randomUUID();
+      try {
+        await handle.writeFile(owner);
+      } catch (cause) {
+        await handle.close().catch(() => {
+          return;
+        });
+        await unlink(path2).catch(() => {
+          return;
+        });
+        throw cause;
+      }
+      return { handle, owner };
+    } catch (cause) {
+      if (!(cause instanceof Error) || !("code" in cause) || cause.code !== "EEXIST") {
+        throw cause;
+      }
+      try {
+        const lock = await stat(path2);
+        if (Date.now() - lock.mtimeMs > refreshLockTimeoutMs) {
+          throw new Error(`The CLI credential lock appears stale at ${path2}. Ensure no CLI authentication command is running, remove that lock file, and retry.`);
+        }
+      } catch (statCause) {
+        if (statCause instanceof Error && "code" in statCause && statCause.code === "ENOENT") {
+          continue;
+        }
+        throw statCause;
+      }
+      await Bun.sleep(refreshLockRetryMs);
+    }
+  }
+  throw new Error("Timed out waiting for another CLI process to refresh credentials. Retry the command.");
+};
 var createBunCredentialStore = ({
   account = "default",
   product,
@@ -19113,16 +19200,46 @@ var createBunCredentialStore = ({
         service,
         value: JSON.stringify(parsed)
       }));
+    },
+    withCredentialLock: async (operation) => {
+      const refreshLockPath = await getCredentialLockPath(product, account);
+      const lock = await acquireRefreshLock(refreshLockPath);
+      try {
+        return await operation();
+      } finally {
+        await lock.handle.close();
+        const owner = await readFile(refreshLockPath, "utf8").catch(() => null);
+        if (owner === lock.owner) {
+          await unlink(refreshLockPath).catch(() => {
+            return;
+          });
+        }
+      }
     }
   };
 };
 // ../../cli-auth/src/client/login.ts
 import { hostname as hostname3 } from "os";
-var normalizeBaseUrl = (value) => value.replace(/\/+$/, "");
-var postJson = async (fetchImplementation, url2, body) => fetchImplementation(url2, {
+var normalizeCliAuthIssuer = (value) => {
+  const url2 = new URL(value);
+  url2.hash = "";
+  url2.search = "";
+  url2.pathname = url2.pathname.replace(/\/+$/, "");
+  return url2.toString().replace(/\/+$/, "");
+};
+var isCliCredentialForIssuer = (credentials, apiBaseUrl) => credentials.issuer === normalizeCliAuthIssuer(apiBaseUrl);
+var credentialIssuerError = (issuer) => issuer ? new Error("These CLI credentials belong to a different API URL. Run auth login for this API URL before retrying.") : new Error("These CLI credentials were created by an older CLI and are not bound to an API URL. Run auth login again.");
+var assertCredentialIssuer = (credentials, apiBaseUrl) => {
+  const expectedIssuer = normalizeCliAuthIssuer(apiBaseUrl);
+  if (!credentials.issuer || credentials.issuer !== expectedIssuer) {
+    throw credentialIssuerError(credentials.issuer);
+  }
+};
+var postJson = async (fetchImplementation, url2, body, options = {}) => fetchImplementation(url2, {
   body: JSON.stringify(body),
   headers: { "content-type": "application/json" },
-  method: "POST"
+  method: "POST",
+  ...options
 });
 var readJson = async (response) => {
   try {
@@ -19131,9 +19248,29 @@ var readJson = async (response) => {
     throw new Error(`CLI authentication returned HTTP ${response.status} without valid JSON.`);
   }
 };
-var toStoredCredentials = (response, now) => ({
+var localCredentialLocks = new WeakMap;
+var withCredentialLock = (store, operation) => {
+  if (store.withCredentialLock) {
+    return store.withCredentialLock(operation);
+  }
+  const previous = localCredentialLocks.get(store) ?? Promise.resolve();
+  const pending = previous.then(operation, operation);
+  const tail = pending.then(() => {
+    return;
+  }, () => {
+    return;
+  });
+  localCredentialLocks.set(store, tail);
+  return pending.finally(() => {
+    if (localCredentialLocks.get(store) === tail) {
+      localCredentialLocks.delete(store);
+    }
+  });
+};
+var toStoredCredentials = (response, issuer, now) => ({
   accessToken: response.accessToken,
   accessTokenExpiresAt: new Date(now.getTime() + response.expiresIn * 1000).toISOString(),
+  issuer,
   refreshToken: response.refreshToken,
   refreshTokenExpiresAt: new Date(now.getTime() + response.refreshExpiresIn * 1000).toISOString(),
   session: response.session
@@ -19167,7 +19304,7 @@ var loginWithBrowser = async ({
   sleep = (milliseconds) => Bun.sleep(milliseconds),
   store
 }) => {
-  const baseUrl = normalizeBaseUrl(apiBaseUrl);
+  const baseUrl = normalizeCliAuthIssuer(apiBaseUrl);
   const pkce = createPkcePair();
   const beginResponse = await postJson(fetchImplementation, `${baseUrl}/api/cli-auth/device`, {
     clientName,
@@ -19194,8 +19331,8 @@ var loginWithBrowser = async ({
     const payload = await readJson(response);
     if (response.ok) {
       const issued = tokenResponseSchema.parse(payload);
-      const credentials = toStoredCredentials(issued, now());
-      await store.set(credentials);
+      const credentials = toStoredCredentials(issued, baseUrl, now());
+      await withCredentialLock(store, () => store.set(credentials));
       return credentials;
     }
     const error61 = deviceTokenErrorSchema.safeParse(payload);
@@ -19216,6 +19353,26 @@ var loginWithBrowser = async ({
   throw new Error("CLI authentication expired. Run auth login again.");
 };
 var refreshes = new WeakMap;
+var refreshRequestTimeoutMs = 30000;
+var isInvalidGrantResponse = (payload) => {
+  const parsed = deviceTokenErrorSchema.safeParse(payload);
+  return parsed.success && parsed.data.error === "invalid_grant";
+};
+var readJsonOrNull = async (response) => {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+};
+var deleteInvalidCredentials = async (store, credentials) => {
+  const current = await store.get();
+  if (!current)
+    return;
+  if (current.issuer === credentials.issuer && current.refreshToken === credentials.refreshToken) {
+    await store.delete();
+  }
+};
 var refreshAccessToken = async ({
   apiBaseUrl,
   credentials,
@@ -19223,16 +19380,56 @@ var refreshAccessToken = async ({
   now,
   store
 }) => {
-  const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken });
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  let response;
+  try {
+    response = await postJson(fetchImplementation, `${normalizeCliAuthIssuer(apiBaseUrl)}/api/cli-auth/refresh`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API could not be reached. Credentials were kept; retry the command.");
+  }
   if (!response.ok) {
-    await store.delete();
-    throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    const payload2 = await readJsonOrNull(response);
+    if (isInvalidGrantResponse(payload2)) {
+      await deleteInvalidCredentials(store, credentials);
+      throw new Error("The CLI session expired or was revoked. Run auth login again.");
+    }
+    throw new Error(`Unable to refresh the CLI session (HTTP ${response.status}). Credentials were kept; retry the command.`);
+  }
+  const payload = await readJsonOrNull(response);
+  if (payload === null) {
+    throw new Error("Unable to refresh the CLI session because the API returned malformed JSON. Credentials were kept; retry the command.");
+  }
+  let issued;
+  try {
+    issued = tokenResponseSchema.parse(payload);
+  } catch {
+    throw new Error("Unable to refresh the CLI session because the API returned invalid credentials. Credentials were kept; retry the command.");
   }
-  const issued = tokenResponseSchema.parse(await readJson(response));
-  const stored = toStoredCredentials(issued, now());
+  const stored = toStoredCredentials(issued, normalizeCliAuthIssuer(apiBaseUrl), now());
   await store.set(stored);
   return stored.accessToken;
 };
+var refreshWithCurrentCredentials = async ({
+  apiBaseUrl,
+  fetch: fetchImplementation,
+  now,
+  store
+}) => {
+  const credentials = await store.get();
+  if (!credentials)
+    throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
+  if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
+    return credentials.accessToken;
+  }
+  return refreshAccessToken({
+    apiBaseUrl,
+    credentials,
+    fetch: fetchImplementation,
+    now,
+    store
+  });
+};
 var getAuthenticatedAccessToken = async ({
   apiBaseUrl,
   fetch: fetchImplementation = globalThis.fetch,
@@ -19242,19 +19439,20 @@ var getAuthenticatedAccessToken = async ({
   const credentials = await store.get();
   if (!credentials)
     throw new Error("Not authenticated. Run auth login first.");
+  assertCredentialIssuer(credentials, apiBaseUrl);
   if (Date.parse(credentials.accessTokenExpiresAt) - now().getTime() > 60000) {
     return credentials.accessToken;
   }
   const existing = refreshes.get(store);
   if (existing)
     return existing;
-  const refresh = refreshAccessToken({
+  const refreshOperation = () => withCredentialLock(store, () => refreshWithCurrentCredentials({
     apiBaseUrl,
-    credentials,
     fetch: fetchImplementation,
     now,
     store
-  }).finally(() => refreshes.delete(store));
+  }));
+  const refresh = refreshOperation().finally(() => refreshes.delete(store));
   refreshes.set(store, refresh);
   return refresh;
 };
@@ -19263,18 +19461,22 @@ var logoutCliSession = async ({
   fetch: fetchImplementation = globalThis.fetch,
   store
 }) => {
-  const credentials = await store.get();
-  let remoteRevoked = credentials === null;
-  if (credentials) {
-    try {
-      const response = await postJson(fetchImplementation, `${normalizeBaseUrl(apiBaseUrl)}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken });
-      remoteRevoked = response.ok;
-    } catch {
-      remoteRevoked = false;
+  const issuer = normalizeCliAuthIssuer(apiBaseUrl);
+  return withCredentialLock(store, async () => {
+    const credentials = await store.get();
+    let remoteRevoked = credentials === null;
+    if (credentials) {
+      try {
+        assertCredentialIssuer(credentials, apiBaseUrl);
+        const response = await postJson(fetchImplementation, `${issuer}/api/cli-auth/revoke`, { refreshToken: credentials.refreshToken }, { signal: AbortSignal.timeout(refreshRequestTimeoutMs) });
+        remoteRevoked = response.ok;
+      } catch {
+        remoteRevoked = false;
+      }
     }
-  }
-  await store.delete();
-  return { remoteRevoked };
+    await store.delete();
+    return { remoteRevoked };
+  });
 };
 // src/api-client.ts
 import {
@@ -20491,7 +20693,7 @@ var findCommand = (positional) => {
   return;
 };
 // src/features/upload.ts
-import { open as open2, readFile, stat } from "fs/promises";
+import { open as open3, readFile as readFile2, stat as stat2 } from "fs/promises";
 import { basename, extname } from "path";
 var contentTypes = {
   ".gif": "image/gif",
@@ -20561,7 +20763,7 @@ var uploadMultipartMissionMedia = async ({
   input: input2,
   metadata
 }) => {
-  const file2 = await open2(filePath, "r");
+  const file2 = await open3(filePath, "r");
   const completedParts = [];
   try {
     for (const part of metadata.parts) {
@@ -20607,7 +20809,7 @@ var uploadFileForCommand = async ({
   if (!isRecord2(input2)) {
     throw new CliError("VALIDATION", "Upload command input must be an object.");
   }
-  const file2 = await stat(filePath).catch(() => null);
+  const file2 = await stat2(filePath).catch(() => null);
   if (!file2?.isFile()) {
     throw new CliError("VALIDATION", `File not found: ${filePath}`);
   }
@@ -20634,7 +20836,7 @@ var uploadFileForCommand = async ({
     return { completed, key: multipart.key, strategy: multipart.strategy };
   }
   const single = asSingleResult(requested);
-  const singleFile = await readFile(filePath);
+  const singleFile = await readFile2(filePath);
   await putPart(single.uploadUrl, singleFile.buffer.slice(singleFile.byteOffset, singleFile.byteOffset + singleFile.byteLength), contentType);
   return {
     ...single.imageUrl ? { imageUrl: single.imageUrl } : {},
@@ -20842,7 +21044,7 @@ Waiting for approval\u2026
     }
     if (first === "auth" && rest[0] === "status" && rest.length === 1) {
       const credentials = await credentialStore.get();
-      return emitSuccess(dependencies.runtime, { apiBaseUrl, cliVersion: GOSH_CLI_VERSION, command: "auth status" }, credentials ? {
+      return emitSuccess(dependencies.runtime, { apiBaseUrl, cliVersion: GOSH_CLI_VERSION, command: "auth status" }, credentials && isCliCredentialForIssuer(credentials, apiBaseUrl) ? {
         authenticated: true,
         accessTokenExpiresAt: credentials.accessTokenExpiresAt,
         refreshTokenExpiresAt: credentials.refreshTokenExpiresAt,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-labs-sg/gosh",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "GOSH CLI for organizers and AI agents — manage organizations, events, teams, stations, missions, templates, and live operations through the GOSH API.",
   "type": "module",
   "main": "./dist/index.js",