@lambdacurry/arbor 0.20.32 → 0.20.33

package/dist/arbor.js

@@ -20993,11 +20993,70 @@ var ACTIONS = ACTION_DEFINITIONS.map((action) => {
 });
 
 // src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 var CONFIG_PATH = process.env.ARBOR_CONFIG ?? join(homedir(), ".arbor", "config.json");
 var DEFAULT_API_URL = process.env.ARBOR_API_URL ?? "https://arborthreads.com";
+var DEFAULT_CONFIG_PATH = join(homedir(), ".arbor", "config.json");
+var DEFAULT_TOKEN_OVERWRITE_REFUSAL = "refusing to overwrite ~/.arbor/config.json — a token already exists. Set ARBOR_CONFIG to an isolated path (e.g. ~/.arbor/<agent>.config.json) and retry.";
+var LOCK_TIMEOUT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+var LOCK_POLL_MS = 20;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireConfigLock(configPath) {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (;; ) {
+    try {
+      mkdirSync(lockPath);
+      return () => {
+        try {
+          rmSync(lockPath, { recursive: true, force: true });
+        } catch {}
+      };
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        throw err;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+          rmSync(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another arbor process to finish writing ${configPath}. If none is running, remove ${lockPath}.`);
+      }
+      sleepSync(LOCK_POLL_MS);
+    }
+  }
+}
+function defaultConfigOverwriteBlocked(opts) {
+  const isolated = opts?.isolated ?? Boolean(process.env.ARBOR_CONFIG);
+  const path = opts?.path ?? DEFAULT_CONFIG_PATH;
+  if (isolated)
+    return false;
+  if (!existsSync(path))
+    return false;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8"));
+    return Boolean(cfg.token);
+  } catch {
+    return false;
+  }
+}
 function loadConfig() {
   const envToken = process.env.ARBOR_TOKEN || undefined;
   const envUrl = process.env.ARBOR_API_URL || undefined;
@@ -21009,15 +21068,32 @@ function loadConfig() {
   }
   return { apiUrl: envUrl ?? DEFAULT_API_URL, token: envToken };
 }
-function saveConfig(cfg) {
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  writeFileSync(CONFIG_PATH, `${JSON.stringify(cfg, null, 2)}
-`);
-  chmodSync(CONFIG_PATH, 384);
+function writeConfigGuarded(opts) {
+  mkdirSync(dirname(opts.configPath), { recursive: true });
+  const release = acquireConfigLock(opts.configPath);
+  try {
+    if (!opts.allowDefaultTokenOverwrite && defaultConfigOverwriteBlocked({ isolated: opts.isolated, path: opts.defaultPath })) {
+      throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+    }
+    writeFileSync(opts.configPath, `${JSON.stringify(opts.cfg, null, 2)}
+`, { mode: 384 });
+    chmodSync(opts.configPath, 384);
+  } finally {
+    release();
+  }
+}
+function saveConfig(cfg, opts) {
+  writeConfigGuarded({
+    cfg,
+    configPath: CONFIG_PATH,
+    defaultPath: DEFAULT_CONFIG_PATH,
+    isolated: Boolean(process.env.ARBOR_CONFIG),
+    allowDefaultTokenOverwrite: opts?.allowDefaultTokenOverwrite
+  });
 }
 function clearToken() {
   const cfg = loadConfig();
-  saveConfig({ apiUrl: cfg.apiUrl });
+  saveConfig({ apiUrl: cfg.apiUrl }, { allowDefaultTokenOverwrite: true });
 }
 
 // src/errors.ts
@@ -21747,20 +21823,38 @@ async function runObjectVerb(positionals, flags, ctx) {
 // src/connect.ts
 var DEFAULT_POLL_INTERVAL_MS = 2000;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function bareConnectUrl(apiUrl, returnedUrl) {
+  const fallback = `${apiUrl.replace(/\/$/, "")}/connect`;
+  if (!returnedUrl)
+    return fallback;
+  try {
+    return `${new URL(returnedUrl).origin}/connect`;
+  } catch {
+    return fallback;
+  }
+}
 async function connect(opts) {
+  if (defaultConfigOverwriteBlocked()) {
+    throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+  }
   const apiUrl = opts.url ?? loadConfig().apiUrl;
   const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const body = JSON.stringify({ pairingKey: opts.pairingKey });
   const headers = { "content-type": "application/json" };
-  const initRes = await fetch(`${apiUrl}/api/agent/connect`, { method: "POST", headers, body });
+  const body = JSON.stringify({ pairingKey: opts.pairingKey });
+  const initRes = await fetch(`${apiUrl}/api/agent/connect`, {
+    method: "POST",
+    headers,
+    body
+  });
   const init = await initRes.json().catch(() => ({}));
   if (!initRes.ok || !init.url || !init.userCode) {
     throw new Error(`could not start pairing (${initRes.status}): ${init.error ?? "is the server reachable?"}`);
   }
+  const approvalUrl = bareConnectUrl(apiUrl, init.url);
   process.stderr.write(`
   Pairing against ${apiUrl}
 ` + `  Ask the person who will manage this agent${init.agentName ? ` (“${init.agentName}”)` : ""} to approve it:
-` + `    1. open   ${init.url}
+` + `    1. open   ${approvalUrl}
 ` + `    2. enter the code:   ${init.userCode}
 
 ` + `  Only approve an agent you intend to manage.
@@ -21835,7 +21929,7 @@ async function login(opts) {
     });
     const tok = await tokRes.json().catch(() => ({}));
     if (tok.access_token) {
-      saveConfig({ apiUrl, token: tok.access_token });
+      saveConfig({ apiUrl, token: tok.access_token }, { allowDefaultTokenOverwrite: true });
       return;
     }
     if (tok.error === "authorization_pending")
@@ -22037,7 +22131,7 @@ async function main() {
         if (!token)
           throw new UsageError("usage: arbor auth <token> [--url <api-url>]");
         const url2 = stringFlag(flags.url, "url") ?? loadConfig().apiUrl;
-        saveConfig({ apiUrl: url2, token });
+        saveConfig({ apiUrl: url2, token }, { allowDefaultTokenOverwrite: true });
         advise(`  ✓ Token saved (${CONFIG_PATH}).
   `, ctx);
         await renderMe(ctx, "auth");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.20.32",
+  "version": "0.20.33",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",