@happier-dev/stack 0.1.0 → 0.2.0

package/scripts/utils/auth/credentials_paths.mjs

@@ -1,4 +1,4 @@
-import { existsSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileHasContent } from '../fs/file_has_content.mjs';
 
@@ -8,6 +8,12 @@ function normalizeServerUrl(url) {
   return String(url ?? '').trim().replace(/\/+$/, '');
 }
 
+function normalizeLoopbackHost(rawHost) {
+  const host = String(rawHost ?? '').trim().toLowerCase();
+  if (host === '127.0.0.1' || host === '::1' || host === '[::1]' || host === '0.0.0.0') return 'localhost';
+  return host;
+}
+
 function sanitizeServerIdForFilesystem(raw, fallback = 'default') {
   const value = String(raw ?? '').trim();
   if (!value) return String(fallback ?? '').trim() || 'default';
@@ -17,12 +23,83 @@ function sanitizeServerIdForFilesystem(raw, fallback = 'default') {
   return value;
 }
 
+function readStackCliSettingsSnapshot({ cliHomeDir }) {
+  const home = String(cliHomeDir ?? '').trim();
+  if (!home) return null;
+  const settingsPath = join(home, 'settings.json');
+  if (!existsSync(settingsPath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+    if (!parsed || typeof parsed !== 'object') return null;
+    const servers = parsed.servers && typeof parsed.servers === 'object' ? parsed.servers : null;
+    return {
+      activeServerId: typeof parsed.activeServerId === 'string' ? parsed.activeServerId.trim() : '',
+      servers,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function profileMatchesServerUrl(profile, serverUrl) {
+  const target = normalizeServerUrl(serverUrl);
+  if (!target || !profile || typeof profile !== 'object') return false;
+
+  const values = [
+    profile.serverUrl,
+    profile.publicServerUrl,
+    profile.localServerUrl,
+  ]
+    .map((value) => normalizeServerUrl(value))
+    .filter(Boolean);
+
+  return values.some((value) => value === target);
+}
+
+export function resolvePreferredStackServerIdFromCliSettings({ cliHomeDir, serverUrl = '' } = {}) {
+  const settings = readStackCliSettingsSnapshot({ cliHomeDir });
+  if (!settings) return '';
+
+  const entries = Object.entries(settings.servers ?? {});
+  if (!entries.length) return '';
+
+  const activeServerId = sanitizeServerIdForFilesystem(settings.activeServerId, '');
+  const activeProfile = activeServerId ? settings.servers?.[activeServerId] : null;
+  if (activeServerId && profileMatchesServerUrl(activeProfile, serverUrl)) {
+    return activeServerId;
+  }
+
+  const matches = entries
+    .filter(([, profile]) => profileMatchesServerUrl(profile, serverUrl))
+    .map(([id]) => sanitizeServerIdForFilesystem(id, ''))
+    .filter(Boolean);
+
+  if (!matches.length) return '';
+  if (matches.length === 1) return matches[0];
+
+  if (activeServerId && matches.includes(activeServerId)) {
+    return activeServerId;
+  }
+
+  const preferred = [...matches].sort((a, b) => {
+    const aStable = a.includes('__id_') ? 1 : 0;
+    const bStable = b.includes('__id_') ? 1 : 0;
+    if (aStable !== bStable) return aStable - bStable;
+    return a.localeCompare(b);
+  });
+  return preferred[0] || '';
+}
+
 function resolveActiveServerIdOverride(env = process.env) {
   const raw = String(env?.HAPPIER_ACTIVE_SERVER_ID ?? '').trim();
   if (!raw) return '';
   return sanitizeServerIdForFilesystem(raw, '');
 }
 
+function hasExplicitServerContext({ serverUrl = '', env = process.env }) {
+  return normalizeServerUrl(serverUrl) !== '' || resolveActiveServerIdOverride(env) !== '';
+}
+
 function deriveServerIdFromUrl(url) {
   const normalized = normalizeServerUrl(url);
   let h = 2166136261;
@@ -33,6 +110,21 @@ function deriveServerIdFromUrl(url) {
   return `env_${(h >>> 0).toString(16)}`;
 }
 
+function deriveLoopbackHostPortServerId(url) {
+  const normalized = normalizeServerUrl(url);
+  if (!normalized) return '';
+  try {
+    const parsed = new URL(normalized);
+    const host = normalizeLoopbackHost(parsed.hostname);
+    if (host !== 'localhost') return '';
+    const port = String(parsed.port ?? '').trim();
+    if (!port) return '';
+    return sanitizeServerIdForFilesystem(`${host}-${port}`, '');
+  } catch {
+    return '';
+  }
+}
+
 function requireCliHomeDir(cliHomeDir) {
   const home = String(cliHomeDir ?? '').trim();
   if (!home) {
@@ -49,20 +141,34 @@ export function resolveStackCredentialPaths({ cliHomeDir, serverUrl = '', env =
     normalizedServerUrl ? deriveServerIdFromUrl(normalizedServerUrl) : 'default',
     'default'
   );
-  const overrideServerId = resolveActiveServerIdOverride(env);
-  const activeServerId = overrideServerId || urlHashServerId;
+  const hostPortServerId = deriveLoopbackHostPortServerId(normalizedServerUrl);
+  const stableScopeServerId = resolveActiveServerIdOverride(env);
+  const settingsServerId = resolvePreferredStackServerIdFromCliSettings({ cliHomeDir: home, serverUrl: normalizedServerUrl });
+  const activeServerId = settingsServerId || stableScopeServerId || urlHashServerId;
   const serverScopedPath = join(home, 'servers', activeServerId, 'access.key');
-  const urlHashServerScopedPath =
-    urlHashServerId && urlHashServerId !== activeServerId
-      ? join(home, 'servers', urlHashServerId, 'access.key')
-      : '';
-  const paths = [serverScopedPath, urlHashServerScopedPath, legacyPath].filter(Boolean);
+  const aliasServerIds = [
+    stableScopeServerId && stableScopeServerId !== activeServerId ? stableScopeServerId : null,
+    urlHashServerId && urlHashServerId !== activeServerId ? urlHashServerId : null,
+    hostPortServerId && hostPortServerId !== activeServerId && hostPortServerId !== urlHashServerId ? hostPortServerId : null,
+  ]
+    .filter(Boolean);
+  const uniqueAliasServerIds = [...new Set(aliasServerIds)];
+  const aliasServerScopedPaths = uniqueAliasServerIds.map((id) => join(home, 'servers', id, 'access.key'));
+  const urlHashServerScopedPath = aliasServerScopedPaths.find((path) => path.includes(`/servers/${urlHashServerId}/`)) || '';
+  const hostPortServerScopedPath =
+    aliasServerScopedPaths.find((path) => path.includes(`/servers/${hostPortServerId}/`)) || '';
+  const paths = [serverScopedPath, ...aliasServerScopedPaths, legacyPath].filter(Boolean);
   return {
     activeServerId,
+    settingsServerId,
+    stableScopeServerId,
     urlHashServerId,
+    hostPortServerId,
     legacyPath,
     serverScopedPath,
     urlHashServerScopedPath,
+    hostPortServerScopedPath,
+    aliasServerScopedPaths,
     paths,
   };
 }
@@ -74,49 +180,72 @@ export function resolveStackDaemonStatePaths({ cliHomeDir, serverUrl = '', env =
     normalizedServerUrl ? deriveServerIdFromUrl(normalizedServerUrl) : 'default',
     'default'
   );
-  const overrideServerId = resolveActiveServerIdOverride(env);
-  const activeServerId = overrideServerId || urlHashServerId;
+  const hostPortServerId = deriveLoopbackHostPortServerId(normalizedServerUrl);
+  const stableScopeServerId = resolveActiveServerIdOverride(env);
+  const settingsServerId = resolvePreferredStackServerIdFromCliSettings({ cliHomeDir: home, serverUrl: normalizedServerUrl });
+  const activeServerId = settingsServerId || stableScopeServerId || urlHashServerId;
 
   const legacyStatePath = join(home, 'daemon.state.json');
   const legacyLockPath = join(home, 'daemon.state.json.lock');
   const serverScopedStatePath = join(home, 'servers', activeServerId, 'daemon.state.json');
   const serverScopedLockPath = join(home, 'servers', activeServerId, 'daemon.state.json.lock');
-  const urlHashServerScopedStatePath =
-    urlHashServerId && urlHashServerId !== activeServerId
-      ? join(home, 'servers', urlHashServerId, 'daemon.state.json')
-      : '';
-  const urlHashServerScopedLockPath =
-    urlHashServerId && urlHashServerId !== activeServerId
-      ? join(home, 'servers', urlHashServerId, 'daemon.state.json.lock')
-      : '';
+  const aliasServerIds = [
+    stableScopeServerId && stableScopeServerId !== activeServerId ? stableScopeServerId : null,
+    urlHashServerId && urlHashServerId !== activeServerId ? urlHashServerId : null,
+    hostPortServerId && hostPortServerId !== activeServerId && hostPortServerId !== urlHashServerId ? hostPortServerId : null,
+  ]
+    .filter(Boolean);
+  const uniqueAliasServerIds = [...new Set(aliasServerIds)];
+  const aliasStatePaths = uniqueAliasServerIds.map((id) => ({
+    statePath: join(home, 'servers', id, 'daemon.state.json'),
+    lockPath: join(home, 'servers', id, 'daemon.state.json.lock'),
+  }));
+  const urlHashServerScopedStatePath = aliasStatePaths.find((pair) => pair.statePath.includes(`/servers/${urlHashServerId}/`))?.statePath || '';
+  const urlHashServerScopedLockPath = aliasStatePaths.find((pair) => pair.lockPath.includes(`/servers/${urlHashServerId}/`))?.lockPath || '';
+  const hostPortServerScopedStatePath = aliasStatePaths.find((pair) => pair.statePath.includes(`/servers/${hostPortServerId}/`))?.statePath || '';
+  const hostPortServerScopedLockPath = aliasStatePaths.find((pair) => pair.lockPath.includes(`/servers/${hostPortServerId}/`))?.lockPath || '';
 
   return {
     activeServerId,
+    settingsServerId,
+    stableScopeServerId,
     urlHashServerId,
+    hostPortServerId,
     legacyStatePath,
     legacyLockPath,
     serverScopedStatePath,
     serverScopedLockPath,
     urlHashServerScopedStatePath,
     urlHashServerScopedLockPath,
+    hostPortServerScopedStatePath,
+    hostPortServerScopedLockPath,
+    aliasStatePaths,
     pairs: [
       { statePath: serverScopedStatePath, lockPath: serverScopedLockPath },
-      ...(urlHashServerScopedStatePath
-        ? [{ statePath: urlHashServerScopedStatePath, lockPath: urlHashServerScopedLockPath }]
-        : []),
+      ...aliasStatePaths,
       { statePath: legacyStatePath, lockPath: legacyLockPath },
     ],
   };
 }
 
 export function resolvePreferredStackDaemonStatePaths({ cliHomeDir, serverUrl = '', env = process.env }) {
+  const home = requireCliHomeDir(cliHomeDir);
   const resolved = resolveStackDaemonStatePaths({ cliHomeDir, serverUrl, env });
+  const allowAnyServerScopedFallback = !hasExplicitServerContext({ serverUrl, env });
   const serverScopedExists =
     fileHasContent(resolved.serverScopedStatePath) || existsSync(resolved.serverScopedLockPath);
   if (serverScopedExists) {
     return { statePath: resolved.serverScopedStatePath, lockPath: resolved.serverScopedLockPath };
   }
 
+  if (resolved.hostPortServerScopedStatePath) {
+    const hostPortExists =
+      fileHasContent(resolved.hostPortServerScopedStatePath) || existsSync(resolved.hostPortServerScopedLockPath);
+    if (hostPortExists) {
+      return { statePath: resolved.hostPortServerScopedStatePath, lockPath: resolved.hostPortServerScopedLockPath };
+    }
+  }
+
   if (resolved.urlHashServerScopedStatePath) {
     const urlHashExists =
       fileHasContent(resolved.urlHashServerScopedStatePath) || existsSync(resolved.urlHashServerScopedLockPath);
@@ -125,6 +254,13 @@ export function resolvePreferredStackDaemonStatePaths({ cliHomeDir, serverUrl =
     }
   }
 
+  if (allowAnyServerScopedFallback) {
+    const anyServerScoped = findAnyDaemonStatePairInCliHome({ cliHomeDir: home });
+    if (anyServerScoped) {
+      return anyServerScoped;
+    }
+  }
+
   const legacyExists = fileHasContent(resolved.legacyStatePath) || existsSync(resolved.legacyLockPath);
   if (legacyExists) {
     return { statePath: resolved.legacyStatePath, lockPath: resolved.legacyLockPath };
@@ -133,9 +269,61 @@ export function resolvePreferredStackDaemonStatePaths({ cliHomeDir, serverUrl =
   return { statePath: resolved.serverScopedStatePath, lockPath: resolved.serverScopedLockPath };
 }
 
+export function findAnyDaemonStatePairInCliHome({ cliHomeDir }) {
+  const home = requireCliHomeDir(cliHomeDir);
+
+  const serversDir = join(home, 'servers');
+  try {
+    const entries = readdirSync(serversDir, { withFileTypes: true })
+      .filter((ent) => ent.isDirectory())
+      .map((ent) => ent.name)
+      .sort();
+    let best = null;
+    let bestMtimeMs = -1;
+    for (const id of entries) {
+      const statePath = join(serversDir, id, 'daemon.state.json');
+      const lockPath = join(serversDir, id, 'daemon.state.json.lock');
+      const stateExists = fileHasContent(statePath);
+      const lockExists = existsSync(lockPath);
+      if (!stateExists && !lockExists) continue;
+
+      let mtimeMs = 0;
+      try {
+        if (stateExists) {
+          mtimeMs = Math.max(mtimeMs, Number(statSync(statePath).mtimeMs) || 0);
+        }
+      } catch {
+        // ignore
+      }
+      try {
+        if (lockExists) {
+          mtimeMs = Math.max(mtimeMs, Number(statSync(lockPath).mtimeMs) || 0);
+        }
+      } catch {
+        // ignore
+      }
+      if (mtimeMs >= bestMtimeMs) {
+        bestMtimeMs = mtimeMs;
+        best = { statePath, lockPath };
+      }
+    }
+    if (best) return best;
+  } catch {
+    // ignore
+  }
+
+  const legacyStatePath = join(home, 'daemon.state.json');
+  const legacyLockPath = join(home, 'daemon.state.json.lock');
+  const legacyExists = fileHasContent(legacyStatePath) || existsSync(legacyLockPath);
+  return legacyExists ? { statePath: legacyStatePath, lockPath: legacyLockPath } : null;
+}
+
 export function findExistingStackCredentialPath({ cliHomeDir, serverUrl = '', env = process.env }) {
   const resolved = resolveStackCredentialPaths({ cliHomeDir, serverUrl, env });
   if (fileHasContent(resolved.serverScopedPath)) return resolved.serverScopedPath;
+  if (resolved.hostPortServerScopedPath && fileHasContent(resolved.hostPortServerScopedPath)) {
+    return resolved.hostPortServerScopedPath;
+  }
   if (resolved.urlHashServerScopedPath && fileHasContent(resolved.urlHashServerScopedPath)) {
     return resolved.urlHashServerScopedPath;
   }

package/scripts/utils/auth/credentials_paths.test.mjs

@@ -10,6 +10,7 @@ import {
   findAnyCredentialPathInCliHome,
   resolveStackDaemonStatePaths,
   resolvePreferredStackDaemonStatePaths,
+  findAnyDaemonStatePairInCliHome,
 } from './credentials_paths.mjs';
 
 test('resolveStackCredentialPaths returns legacy + server-scoped paths', async () => {
@@ -19,7 +20,9 @@ test('resolveStackCredentialPaths returns legacy + server-scoped paths', async (
   assert.equal(out.legacyPath, join(dir, 'access.key'));
   assert.ok(out.serverScopedPath.startsWith(join(dir, 'servers', 'env_')));
   assert.ok(out.serverScopedPath.endsWith('/access.key'));
-  assert.deepEqual(out.paths, [out.serverScopedPath, out.legacyPath]);
+  assert.equal(out.hostPortServerId, 'localhost-3009');
+  assert.ok(out.hostPortServerScopedPath.endsWith('/servers/localhost-3009/access.key'));
+  assert.deepEqual(out.paths, [out.serverScopedPath, out.hostPortServerScopedPath, out.legacyPath]);
 });
 
 test('resolveStackCredentialPaths uses a neutral default server id when serverUrl is empty', async () => {
@@ -102,6 +105,84 @@ test('resolveStackCredentialPaths uses HAPPIER_ACTIVE_SERVER_ID when provided',
   assert.notEqual(out.serverScopedPath, out.urlHashServerScopedPath);
 });
 
+test('resolveStackCredentialPaths prefers the matching cli settings server id over a leaked stable scope alias', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-cred-paths-settings-'));
+  const serverUrl = 'http://127.0.0.1:3009';
+  const canonicalServerId = 'stack-dev-profile';
+  await writeFile(
+    join(dir, 'settings.json'),
+    JSON.stringify(
+      {
+        schemaVersion: 6,
+        activeServerId: canonicalServerId,
+        servers: {
+          [canonicalServerId]: {
+            id: canonicalServerId,
+            name: canonicalServerId,
+            serverUrl,
+            webappUrl: 'http://localhost:3009',
+            createdAt: 1,
+            updatedAt: 1,
+            lastUsedAt: 1,
+          },
+        },
+      },
+      null,
+      2,
+    ) + '\n',
+    'utf-8',
+  );
+
+  const out = resolveStackCredentialPaths({
+    cliHomeDir: dir,
+    serverUrl,
+    env: { HAPPIER_ACTIVE_SERVER_ID: 'stack_dev__id_default' },
+  });
+
+  assert.equal(out.activeServerId, canonicalServerId);
+  assert.equal(out.serverScopedPath, join(dir, 'servers', canonicalServerId, 'access.key'));
+  assert.ok(out.paths.includes(join(dir, 'servers', 'stack_dev__id_default', 'access.key')));
+});
+
+test('resolveStackDaemonStatePaths prefers the matching cli settings server id over a leaked stable scope alias', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-paths-settings-'));
+  const serverUrl = 'http://127.0.0.1:3012';
+  const canonicalServerId = 'stack-dev-profile';
+  await writeFile(
+    join(dir, 'settings.json'),
+    JSON.stringify(
+      {
+        schemaVersion: 6,
+        activeServerId: canonicalServerId,
+        servers: {
+          [canonicalServerId]: {
+            id: canonicalServerId,
+            name: canonicalServerId,
+            serverUrl,
+            webappUrl: 'http://localhost:3012',
+            createdAt: 1,
+            updatedAt: 1,
+            lastUsedAt: 1,
+          },
+        },
+      },
+      null,
+      2,
+    ) + '\n',
+    'utf-8',
+  );
+
+  const out = resolveStackDaemonStatePaths({
+    cliHomeDir: dir,
+    serverUrl,
+    env: { HAPPIER_ACTIVE_SERVER_ID: 'stack_dev__id_default' },
+  });
+
+  assert.equal(out.activeServerId, canonicalServerId);
+  assert.equal(out.serverScopedStatePath, join(dir, 'servers', canonicalServerId, 'daemon.state.json'));
+  assert.ok(out.pairs.some((pair) => pair.statePath === join(dir, 'servers', 'stack_dev__id_default', 'daemon.state.json')));
+});
+
 test('findExistingStackCredentialPath falls back to url-hash path when stable scope path is empty', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-cred-paths-'));
   const serverUrl = 'http://127.0.0.1:3009';
@@ -132,6 +213,8 @@ test('resolveStackDaemonStatePaths returns legacy + server-scoped state and lock
   assert.ok(out.serverScopedStatePath.startsWith(join(dir, 'servers', 'env_')));
   assert.ok(out.serverScopedStatePath.endsWith('/daemon.state.json'));
   assert.ok(out.serverScopedLockPath.endsWith('/daemon.state.json.lock'));
+  assert.ok(out.hostPortServerScopedStatePath.endsWith('/servers/localhost-3009/daemon.state.json'));
+  assert.ok(out.hostPortServerScopedLockPath.endsWith('/servers/localhost-3009/daemon.state.json.lock'));
 });
 
 test('resolvePreferredStackDaemonStatePaths prefers server-scoped paths when present', async () => {
@@ -159,6 +242,63 @@ test('resolvePreferredStackDaemonStatePaths falls back to legacy paths', async (
   assert.equal(preferred.lockPath, out.legacyLockPath);
 });
 
+test('findAnyDaemonStatePairInCliHome prefers the newest server-scoped daemon state over legacy', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-any-'));
+  const legacyStatePath = join(dir, 'daemon.state.json');
+  const newerServerDir = join(dir, 'servers', 'stack_dev-built__id_default');
+  const olderServerDir = join(dir, 'servers', 'stack_main__id_default');
+  await mkdir(newerServerDir, { recursive: true });
+  await mkdir(olderServerDir, { recursive: true });
+
+  await writeFile(legacyStatePath, '{"pid":1}\n', 'utf-8');
+  await writeFile(join(olderServerDir, 'daemon.state.json'), '{"pid":2}\n', 'utf-8');
+  await new Promise((resolve) => setTimeout(resolve, 15));
+  await writeFile(join(newerServerDir, 'daemon.state.json'), '{"pid":3}\n', 'utf-8');
+
+  const found = findAnyDaemonStatePairInCliHome({ cliHomeDir: dir });
+  assert.deepEqual(found, {
+    statePath: join(newerServerDir, 'daemon.state.json'),
+    lockPath: join(newerServerDir, 'daemon.state.json.lock'),
+  });
+});
+
+test('resolvePreferredStackDaemonStatePaths falls back to any existing server-scoped daemon state before legacy when no server context is requested', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-any-preferred-'));
+  const legacyStatePath = join(dir, 'daemon.state.json');
+  const serverDir = join(dir, 'servers', 'stack_dev-built__id_default');
+  await mkdir(serverDir, { recursive: true });
+
+  await writeFile(legacyStatePath, '{"pid":1}\n', 'utf-8');
+  await new Promise((resolve) => setTimeout(resolve, 15));
+  await writeFile(join(serverDir, 'daemon.state.json'), '{"pid":3}\n', 'utf-8');
+
+  const preferred = resolvePreferredStackDaemonStatePaths({ cliHomeDir: dir, serverUrl: '' });
+  assert.equal(preferred.statePath, join(serverDir, 'daemon.state.json'));
+  assert.equal(preferred.lockPath, join(serverDir, 'daemon.state.json.lock'));
+});
+
+test('resolvePreferredStackDaemonStatePaths does not fall back to another server-scoped daemon state for a requested server context', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-isolated-preferred-'));
+  const serverUrl = 'http://127.0.0.1:4311';
+  const paths = resolveStackDaemonStatePaths({
+    cliHomeDir: dir,
+    serverUrl,
+    env: { HAPPIER_ACTIVE_SERVER_ID: 'stack_dev2__id_default' },
+  });
+  const otherServerDir = join(dir, 'servers', 'stack_dev__id_default');
+  await mkdir(otherServerDir, { recursive: true });
+  await writeFile(join(otherServerDir, 'daemon.state.json'), '{"pid":3}\n', 'utf-8');
+
+  const preferred = resolvePreferredStackDaemonStatePaths({
+    cliHomeDir: dir,
+    serverUrl,
+    env: { HAPPIER_ACTIVE_SERVER_ID: 'stack_dev2__id_default' },
+  });
+
+  assert.equal(preferred.statePath, paths.serverScopedStatePath);
+  assert.equal(preferred.lockPath, paths.serverScopedLockPath);
+});
+
 test('resolvePreferredStackDaemonStatePaths falls back to url-hash server-scoped state when stable scope is empty', async () => {
   const dir = await mkdtemp(join(tmpdir(), 'happy-stacks-daemon-paths-'));
   const serverUrl = 'http://127.0.0.1:3011';

package/scripts/utils/auth/ensure_active_access_key_valid.mjs

@@ -0,0 +1,157 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { chmod, copyFile, mkdir } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { resolveStackCredentialPaths } from './credentials_paths.mjs';
+import { decodeJwtPayloadUnsafe } from './decode_jwt_payload_unsafe.mjs';
+
+function readAuthTokenFromCredentialPath(path) {
+  const p = String(path ?? '').trim();
+  if (!p || !existsSync(p)) return null;
+  try {
+    const raw = readFileSync(p, 'utf-8').trim();
+    if (!raw) return null;
+    try {
+      const parsed = JSON.parse(raw);
+      if (typeof parsed?.token === 'string' && parsed.token.trim()) {
+        return parsed.token.trim();
+      }
+    } catch {
+      // fall through
+    }
+    return raw;
+  } catch {
+    return null;
+  }
+}
+
+async function validateTokenAgainstServer({ token, serverUrl, timeoutMs }) {
+  const t = String(token ?? '').trim();
+  if (!t) return { ok: false, status: null };
+  const base = String(serverUrl ?? '').trim().replace(/\/+$/, '');
+  if (!base) return { ok: false, status: null };
+
+  const ctl = new AbortController();
+  const timeout = setTimeout(() => ctl.abort(), Math.max(100, timeoutMs ?? 2_500));
+  try {
+    const res = await fetch(`${base}/v1/account/profile`, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${t}` },
+      signal: ctl.signal,
+    });
+    return { ok: res.status >= 200 && res.status < 300, status: res.status };
+  } catch {
+    return { ok: false, status: null };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+/**
+ * Ensures the active server-scoped `access.key` file is usable for API calls.
+ *
+ * Context:
+ * - stack daemons often force a stable `HAPPIER_ACTIVE_SERVER_ID` (e.g. stack_<name>__id_default)
+ * - interactive logins may have written credentials under the url-hash server id (env_<hash>)
+ * - if the stable-scoped credentials are missing or stale, the daemon will fail to register the machine (401)
+ *
+ * This helper validates the active server-scoped token against `/v1/account/profile`. If it fails,
+ * it tries fallback credentials (url-hash scoped, then legacy) and copies the first valid candidate
+ * into the active server-scoped path.
+ */
+export async function ensureActiveAccessKeyValid({ cliHomeDir, serverUrl, env = process.env, timeoutMs = 2_500 }) {
+  const resolved = resolveStackCredentialPaths({ cliHomeDir, serverUrl, env });
+
+  const activePath = resolved.serverScopedPath;
+  const activeToken = readAuthTokenFromCredentialPath(activePath);
+  const allowAccountSwitch =
+    (env.HAPPIER_STACK_AUTH_REPAIR_ALLOW_ACCOUNT_SWITCH ?? '').toString().trim() === '1';
+  const activeSub = activeToken ? decodeJwtPayloadUnsafe(activeToken)?.sub ?? null : null;
+  const activeValid = activeToken
+    ? await validateTokenAgainstServer({ token: activeToken, serverUrl, timeoutMs })
+    : { ok: false, status: null };
+
+  if (activeValid.ok) {
+    return { kind: 'ok', activePath };
+  }
+
+  const candidates = [resolved.urlHashServerScopedPath, resolved.legacyPath]
+    .map((p) => String(p ?? '').trim())
+    .filter(Boolean)
+    .filter((p) => p !== activePath);
+  const hostPortPath = String(resolved.hostPortServerScopedPath ?? '').trim();
+  if (hostPortPath && hostPortPath !== activePath && !candidates.includes(hostPortPath)) {
+    candidates.unshift(hostPortPath);
+  }
+
+  const validCandidates = [];
+  for (const candidatePath of candidates) {
+    const token = readAuthTokenFromCredentialPath(candidatePath);
+    if (!token) continue;
+    const validated = await validateTokenAgainstServer({ token, serverUrl, timeoutMs });
+    if (!validated.ok) continue;
+
+    validCandidates.push({ candidatePath, token, sub: decodeJwtPayloadUnsafe(token)?.sub ?? null });
+    if (!allowAccountSwitch) {
+      // If we know the intended account for the active scope (JWT sub), avoid silently repairing
+      // from a different account's credentials.
+      if (activeSub && String(activeSub) !== String(decodeJwtPayloadUnsafe(token)?.sub ?? '')) {
+        continue;
+      }
+      // If multiple valid candidates exist and we can't prove they refer to the same account,
+      // fail closed to avoid a silent account switch.
+      //
+      // (We'll decide below once we've collected all valid candidates.)
+      continue;
+    }
+
+    try {
+      await mkdir(dirname(activePath), { recursive: true });
+      await copyFile(candidatePath, activePath);
+      await chmod(activePath, 0o600).catch(() => {});
+      return { kind: 'repaired', activePath, sourcePath: candidatePath };
+    } catch {
+      // If we can't write, continue trying other candidates.
+    }
+  }
+
+  if (!allowAccountSwitch) {
+    const matching =
+      activeSub
+        ? validCandidates.filter((c) => c.sub && String(c.sub) === String(activeSub))
+        : validCandidates;
+
+    if (matching.length === 1) {
+      const chosen = matching[0];
+      try {
+        await mkdir(dirname(activePath), { recursive: true });
+        await copyFile(chosen.candidatePath, activePath);
+        await chmod(activePath, 0o600).catch(() => {});
+        return { kind: 'repaired', activePath, sourcePath: chosen.candidatePath };
+      } catch {
+        // fall through to unresolved
+      }
+    }
+
+    if (!activeSub && matching.length > 1) {
+      const subs = new Set(matching.map((c) => c.sub).filter(Boolean).map((s) => String(s)));
+      if (subs.size === 1 && subs.values().next().value) {
+        const chosen = matching[0];
+        try {
+          await mkdir(dirname(activePath), { recursive: true });
+          await copyFile(chosen.candidatePath, activePath);
+          await chmod(activePath, 0o600).catch(() => {});
+          return { kind: 'repaired', activePath, sourcePath: chosen.candidatePath };
+        } catch {
+          // fall through to unresolved
+        }
+      }
+    }
+  }
+
+  return {
+    kind: 'unresolved',
+    activePath,
+    attemptedPaths: candidates,
+    status: activeValid.status,
+  };
+}