@indigoai-us/hq-cli 5.225.0 → 5.227.0

package/dist/utils/cognito-session.js

@@ -19,12 +19,13 @@
  *   HQ_VAULT_API_URL           — vault-service API Gateway URL
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomBytes } from "node:crypto";
 import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import * as yaml from "js-yaml";
 import chalk from "chalk";
-import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, CognitoRefreshError, accessTokenFingerprint, invalidateCachedTokensByFingerprint, } from "@indigoai-us/hq-cloud";
+import { loadCachedTokens, isExpiring, refreshTokens, saveCachedTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, CognitoRefreshError, accessTokenFingerprint, invalidateCachedTokensByFingerprint, } from "@indigoai-us/hq-cloud";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
@@ -519,6 +520,194 @@ export async function refreshActivePersonTokens(cached, env = process.env) {
     }
     return refreshed;
 }
+function throwIfAborted(signal) {
+    if (signal.aborted)
+        throw signal.reason ?? new Error("Token acquisition was aborted");
+}
+function waitForRefreshLock(signal, delayMs) {
+    return new Promise((resolve, reject) => {
+        const finish = (error) => {
+            clearTimeout(timer);
+            signal.removeEventListener("abort", onAbort);
+            if (error)
+                reject(error);
+            else
+                resolve();
+        };
+        const timer = setTimeout(() => finish(), delayMs);
+        const onAbort = () => finish(signal.reason ?? new Error("Token acquisition was aborted"));
+        if (signal.aborted)
+            onAbort();
+        else
+            signal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+/**
+ * Refresh-lock protocol shared with hq-cloud, with caller cancellation while
+ * waiting. The flag lookup is best-effort, so it never refreshes unlocked.
+ */
+async function withAbortablePersonRefreshLock(signal, fn) {
+    const lockFile = `${personTokenCacheFile()}.lock`;
+    const stateDir = path.dirname(lockFile);
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    const candidate = `${lockFile}.candidate.${process.pid}.${randomBytes(8).toString("hex")}`;
+    fs.writeFileSync(candidate, String(process.pid), { flag: "wx", mode: 0o600 });
+    let held = false;
+    try {
+        for (;;) {
+            throwIfAborted(signal);
+            try {
+                fs.linkSync(candidate, lockFile);
+                held = true;
+                break;
+            }
+            catch (error) {
+                if (error.code !== "EEXIST")
+                    throw error;
+                let ownerPid = null;
+                try {
+                    const parsed = Number.parseInt(fs.readFileSync(lockFile, "utf8").trim(), 10);
+                    if (Number.isInteger(parsed) && parsed > 0)
+                        ownerPid = parsed;
+                }
+                catch {
+                    // An absent or malformed lock may be reclaimed below.
+                }
+                let ownerAlive = false;
+                if (ownerPid !== null) {
+                    try {
+                        process.kill(ownerPid, 0);
+                        ownerAlive = true;
+                    }
+                    catch (probeError) {
+                        ownerAlive = probeError.code === "EPERM";
+                    }
+                }
+                if (!ownerAlive) {
+                    try {
+                        fs.unlinkSync(lockFile);
+                    }
+                    catch {
+                        // Another contender may have reclaimed it first.
+                    }
+                    continue;
+                }
+                await waitForRefreshLock(signal, 50);
+            }
+        }
+        throwIfAborted(signal);
+        return await fn();
+    }
+    finally {
+        if (held) {
+            try {
+                const owner = Number.parseInt(fs.readFileSync(lockFile, "utf8").trim(), 10);
+                if (owner === process.pid)
+                    fs.unlinkSync(lockFile);
+            }
+            catch {
+                // A failed request must not mask its original error.
+            }
+        }
+        try {
+            fs.unlinkSync(candidate);
+        }
+        catch {
+            // The candidate may already have been removed.
+        }
+    }
+}
+/**
+ * Client-health's short-lived flag read cannot use hq-cloud's unbounded refresh
+ * helper. Reuse its lockfile protocol, attach the caller signal to the refresh
+ * request, and persist only after the request has completed before the deadline.
+ */
+export async function refreshActivePersonTokensForClientHealth(cached, signal) {
+    // Cognito refresh rotation is off for this client (#2603; ALLOW_REFRESH_TOKEN_AUTH stays), so aborting loses no rotated token; keep this lock protocol identical to hq-cloud withRefreshLock.
+    return withAbortablePersonRefreshLock(signal, async () => {
+        throwIfAborted(signal);
+        const onDisk = readPersonTokenFile();
+        const diskKey = cognitoSubjectKey(onDisk);
+        const cachedKey = cognitoSubjectKey(cached);
+        if (diskKey && cachedKey && diskKey !== cachedKey) {
+            throw new IdentitySwapRefusal(`refusing token refresh: cached subject ${formatCognitoSubject(cached)} ` +
+                `does not match active subject ${formatCognitoSubject(onDisk)}`);
+        }
+        const activeTokens = onDisk ?? cached;
+        if (!isExpiring(activeTokens, 120))
+            return activeTokens;
+        if (!activeTokens.refreshToken) {
+            throw new CognitoRefreshError("No refresh token is available for the cached HQ session", true);
+        }
+        const body = new URLSearchParams({
+            grant_type: "refresh_token",
+            client_id: DEFAULT_COGNITO.clientId,
+            refresh_token: activeTokens.refreshToken,
+        });
+        const endpoint = `https://${DEFAULT_COGNITO.userPoolDomain}.auth.${DEFAULT_COGNITO.region}.amazoncognito.com/oauth2/token`;
+        const fingerprint = accessTokenFingerprint(activeTokens.accessToken);
+        let response;
+        for (let attempt = 0; attempt < 2; attempt++) {
+            throwIfAborted(signal);
+            try {
+                response = await fetch(endpoint, {
+                    method: "POST",
+                    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                    body: body.toString(),
+                    signal,
+                });
+            }
+            catch (err) {
+                throwIfAborted(signal);
+                if (attempt === 0)
+                    continue;
+                throw new CognitoRefreshError(`Cognito refresh request failed: ${err instanceof Error ? err.message : String(err)}`, false, undefined, fingerprint);
+            }
+            throwIfAborted(signal);
+            if (response.ok)
+                break;
+            const retryable = response.status === 401 ||
+                response.status === 408 ||
+                response.status === 429 ||
+                response.status >= 500;
+            if (retryable && attempt === 0)
+                continue;
+            const reauth = response.status === 401 ||
+                (response.status >= 400 && response.status < 500 && ![408, 429].includes(response.status));
+            throw new CognitoRefreshError(`Cognito refresh failed (${response.status})`, reauth, response.status, fingerprint);
+        }
+        if (!response?.ok) {
+            throw new CognitoRefreshError("Cognito refresh failed after retry", false, undefined, fingerprint);
+        }
+        const data = (await response.json());
+        throwIfAborted(signal);
+        if (typeof data.access_token !== "string" ||
+            typeof data.id_token !== "string" ||
+            typeof data.expires_in !== "number" ||
+            !Number.isFinite(data.expires_in) ||
+            data.expires_in <= 0) {
+            throw new CognitoRefreshError("Cognito refresh returned an invalid token response", false);
+        }
+        const refreshed = {
+            accessToken: data.access_token,
+            idToken: data.id_token,
+            refreshToken: typeof data.refresh_token === "string" && data.refresh_token.length > 0
+                ? data.refresh_token
+                : activeTokens.refreshToken,
+            expiresAt: Date.now() + data.expires_in * 1_000,
+            tokenType: "Bearer",
+        };
+        const activeKey = cognitoSubjectKey(activeTokens);
+        const nextKey = cognitoSubjectKey(refreshed);
+        if (activeKey && nextKey && nextKey !== activeKey) {
+            throw new IdentitySwapRefusal(`refusing token refresh: refreshed subject ${formatCognitoSubject(refreshed)} ` +
+                `does not match active subject ${formatCognitoSubject(activeTokens)}`);
+        }
+        throwIfAborted(signal);
+        saveCachedTokens(refreshed);
+        return refreshed;
+    });
+}
 /** Derive actor kind from an ID token's custom:entity* claims (no verify). */
 export function actorKindFromIdToken(idToken) {
     const claims = decodeJwtPayload(idToken);
@@ -769,12 +958,16 @@ async function ensureCognitoTokenUnserialized(options) {
  * identical to `ensureCognitoToken` there.
  */
 export async function ensureCognitoIdToken(options = {}) {
+    if (options.signal?.aborted)
+        throw options.signal.reason ?? new Error("Token acquisition was aborted");
     if (wantsMachineCognitoTokens(options))
         return ensureCognitoIdTokenUnserialized(options);
     return withTokenStateDirSection(() => ensureCognitoIdTokenUnserialized(options));
 }
 async function ensureCognitoIdTokenUnserialized(options) {
     const interactive = options.interactive ?? true;
+    if (options.signal?.aborted)
+        throw options.signal.reason ?? new Error("Token acquisition was aborted");
     if (wantsMachineCognitoTokens(options)) {
         const machine = await ensureMachineTokensMaybeFallback(options);
         return machine.idToken;
@@ -788,11 +981,13 @@ async function ensureCognitoIdTokenUnserialized(options) {
             if (interactive) {
                 console.error(chalk.dim("  Refreshing expiring HQ session..."));
             }
-            const refreshed = await refreshActivePersonTokens(cached);
+            const refreshed = options.signal
+                ? await refreshActivePersonTokensForClientHealth(cached, options.signal)
+                : await refreshActivePersonTokens(cached);
             return refreshed.idToken;
         }
         catch (err) {
-            if (isIdentitySwapRefusal(err))
+            if (options.signal?.aborted || isIdentitySwapRefusal(err))
                 throw err;
             if (!isDefinitivePersonAuthRejection(err)) {
                 throw err;

package/dist/utils/upload-author.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The identity stamped onto uploaded objects (`Metadata['created-by']`,
+ * `created-by-sub`). It must be the identity the push authenticates as: a
+ * machine push on a host that also has a person signed in is the agent, never
+ * the person. The private-folder creator backfill reads `created-by-sub`.
+ */
+import type { UploadAuthor } from "@indigoai-us/hq-cloud";
+/**
+ * Resolve the upload author from the cached id token of the session the push
+ * uses. Decoded, not verified: Cognito verified it at issuance and no auth
+ * decision rides on the label. Returns undefined when that session has no
+ * cached token or the token lacks `sub`/`email`; share() then skips the stamp.
+ */
+export declare function resolveUploadAuthor(env?: NodeJS.ProcessEnv, home?: string): UploadAuthor | undefined;
+//# sourceMappingURL=upload-author.d.ts.map

package/dist/utils/upload-author.js

@@ -0,0 +1,39 @@
+/**
+ * The identity stamped onto uploaded objects (`Metadata['created-by']`,
+ * `created-by-sub`). It must be the identity the push authenticates as: a
+ * machine push on a host that also has a person signed in is the agent, never
+ * the person. The private-folder creator backfill reads `created-by-sub`.
+ */
+import * as os from "node:os";
+import { loadMachineCachedTokens, readPersonTokenFile, wantsMachineCognitoTokens, } from "./cognito-session.js";
+function authorFromIdToken(idToken) {
+    if (!idToken)
+        return undefined;
+    const parts = idToken.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        if (claims.sub && claims.email) {
+            return { userSub: claims.sub, email: claims.email };
+        }
+        return undefined;
+    }
+    catch {
+        // Unparseable claims only mean no author label; share() skips the stamp.
+        return undefined;
+    }
+}
+/**
+ * Resolve the upload author from the cached id token of the session the push
+ * uses. Decoded, not verified: Cognito verified it at issuance and no auth
+ * decision rides on the label. Returns undefined when that session has no
+ * cached token or the token lacks `sub`/`email`; share() then skips the stamp.
+ */
+export function resolveUploadAuthor(env = process.env, home = os.homedir()) {
+    const tokens = wantsMachineCognitoTokens({}, env)
+        ? loadMachineCachedTokens(home, env)
+        : readPersonTokenFile(home, env);
+    return authorFromIdToken(tokens?.idToken);
+}
+//# sourceMappingURL=upload-author.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.225.0",
+  "version": "5.227.0",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {