@meistrari/remy-cli 1.4.0 → 1.4.1

package/README.md

@@ -116,7 +116,7 @@ remy login \
   --target-application-id <target-application-uuid>
 ```
 
-Remy stores endpoint configuration in `~/.config/remy/config.json` and tokens in `~/.local/state/remy/tokens.json`. Set `XDG_CONFIG_HOME` or `XDG_STATE_HOME` to use different base directories. It refreshes an expired access token before each Coding Agent API request, so long-running sessions and reconnects remain authenticated. `remy logout` removes tokens but retains endpoint configuration; pass `--api-url` to require that the supplied URL matches the active API host before logging out.
+Remy stores endpoint configuration in `~/.config/remy/config.json` and tokens in `~/.local/state/remy/tokens.json`. Set `XDG_CONFIG_HOME` or `XDG_STATE_HOME` to use different base directories. Before each Coding Agent API request, it reloads the shared token file and refreshes an expired access token. When multiple Remy processes run at once, only one rotates and saves the refresh-token pair; the others wait and then use that newest saved pair. Long-running sessions and reconnects therefore stay authenticated after another process refreshes. `remy logout` removes tokens but retains endpoint configuration; pass `--api-url` to require that the supplied URL matches the active API host before logging out.
 
 ## Complete command reference
 

package/dist/remy.js

@@ -33234,16 +33234,21 @@ function loginUsage() {
 }
 
 // src/credential-state.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { lstat, mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename2, unlink as unlink2 } from "fs/promises";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { lstat, mkdir as mkdir3, open as open3, readFile as readFile3, rename as rename2, rmdir, unlink as unlink2 } from "fs/promises";
 import { dirname as dirname3, join as join2 } from "path";
+import { setTimeout as delay } from "timers/promises";
 var lockName = ".credential-state.lock";
+var lockOwnerName = "owner.json";
 var journalName = ".credential-promotion.journal.json";
+var lockRetryMilliseconds = 25;
 async function withCredentialState({
   stateDirectory,
+  signal,
+  lockFilesystem,
   action
 }) {
-  const owner = await acquireCredentialStateLock(stateDirectory);
+  const owner = await acquireCredentialStateLock({ stateDirectory, signal, renamePath: lockFilesystem?.renamePath });
   try {
     return await action();
   } finally {
@@ -33318,51 +33323,146 @@ async function removeCredentialTokenWhileLocked({
 function lockPath(stateDirectory) {
   return join2(stateDirectory, lockName);
 }
-async function acquireCredentialStateLock(stateDirectory) {
+async function acquireCredentialStateLock({
+  stateDirectory,
+  signal,
+  renamePath = rename2
+}) {
   await mkdir3(stateDirectory, { recursive: true, mode: 448 });
   const owner = { ownerId: randomUUID2(), pid: process.pid };
   const path = lockPath(stateDirectory);
+  const candidatePath = join2(stateDirectory, `.credential-state.candidate.${owner.ownerId}`);
+  await mkdir3(candidatePath, { mode: 448 });
   try {
-    await writeExclusivePrivateFile({ path, contents: `${JSON.stringify(owner)}
+    await writeExclusivePrivateFile({ path: join2(candidatePath, lockOwnerName), contents: `${JSON.stringify(owner)}
 ` });
-    return owner;
+    while (true) {
+      throwIfAborted(signal);
+      const recordedState = await readLockOwnerState(path);
+      if (recordedState.status === "missing") {
+        try {
+          await renamePath(candidatePath, path);
+          return owner;
+        } catch (error93) {
+          if (!isLockContentionError(error93))
+            throw error93;
+          continue;
+        }
+      }
+      if (recordedState.status === "malformed")
+        throw new Error("another Remy credential operation is active");
+      const recordedOwner = recordedState.owner;
+      if (!isPidAbsent(recordedOwner.pid)) {
+        await waitForCredentialStateLock(signal);
+        continue;
+      }
+      const confirmedState = await readLockOwnerState(path);
+      if (confirmedState.status === "missing")
+        continue;
+      if (confirmedState.status === "malformed")
+        throw new Error("another Remy credential operation is active");
+      const confirmedOwner = confirmedState.owner;
+      if (!sameLockOwner(confirmedOwner, recordedOwner) || !isPidAbsent(confirmedOwner.pid)) {
+        await waitForCredentialStateLock(signal);
+        continue;
+      }
+      await moveStaleLockAside({ stateDirectory, path, owner: recordedOwner, signal, renamePath });
+    }
   } catch (error93) {
-    if (!isExistsError(error93))
-      throw error93;
+    await removeLockDirectory({ path: candidatePath });
+    throw error93;
   }
-  const recordedOwner = await readLockOwner(path);
-  if (!recordedOwner || !isPidAbsent(recordedOwner.pid))
-    throw new Error("another Remy credential operation is active");
-  const stalePath = join2(stateDirectory, `.credential-state.stale.${recordedOwner.ownerId}.${randomUUID2()}`);
+}
+async function moveStaleLockAside({
+  stateDirectory,
+  path,
+  owner,
+  signal,
+  renamePath
+}) {
+  const stalePath = join2(stateDirectory, `.credential-state.stale.${lockOwnerFingerprint(owner)}`);
   try {
-    await rename2(path, stalePath);
-    await removeIfPresent({ path: stalePath });
-  } catch {
-    throw new Error("another Remy credential operation is active");
+    await renamePath(path, stalePath);
+  } catch (error93) {
+    if (isLockContentionError(error93)) {
+      await waitForCredentialStateLock(signal);
+      return;
+    }
+    if (isMissingFileError(error93))
+      return;
+    throw error93;
   }
+}
+function lockOwnerFingerprint(owner) {
+  return createHash2("sha256").update(`${owner.ownerId}\x00${owner.pid}`).digest("hex");
+}
+function sameLockOwner(left, right) {
+  return left?.ownerId === right.ownerId && left.pid === right.pid;
+}
+async function waitForCredentialStateLock(signal) {
+  throwIfAborted(signal);
   try {
-    await writeExclusivePrivateFile({ path, contents: `${JSON.stringify(owner)}
-` });
-    return owner;
-  } catch {
-    throw new Error("another Remy credential operation is active");
+    await delay(lockRetryMilliseconds, undefined, signal ? { signal } : undefined);
+  } catch (error93) {
+    if (signal?.aborted)
+      throw signal.reason ?? error93;
+    throw error93;
   }
 }
+function throwIfAborted(signal) {
+  if (signal?.aborted)
+    throw signal.reason ?? new Error("Credential operation aborted.");
+}
 async function releaseCredentialStateLock({ stateDirectory, owner }) {
   const path = lockPath(stateDirectory);
   const currentOwner = await readLockOwner(path);
   if (!currentOwner || currentOwner.ownerId !== owner.ownerId)
     return;
-  await removeIfPresent({ path });
+  const releasedPath = join2(stateDirectory, `.credential-state.released.${owner.ownerId}.${randomUUID2()}`);
+  try {
+    await rename2(path, releasedPath);
+  } catch (error93) {
+    if (isMissingFileError(error93))
+      return;
+    throw error93;
+  }
+  await removeLockDirectory({ path: releasedPath });
 }
 async function readLockOwner(path) {
+  const state = await readLockOwnerState(path);
+  return state.status === "valid" ? state.owner : undefined;
+}
+async function readLockOwnerState(path) {
+  const firstObservation = await observeLockOwner(path);
+  if (firstObservation.status !== "owner-missing")
+    return firstObservation;
+  const secondObservation = await observeLockOwner(path);
+  return secondObservation.status === "owner-missing" ? { status: "malformed" } : secondObservation;
+}
+async function observeLockOwner(path) {
+  let ownerPath;
   try {
-    const parsed = JSON.parse(await readFile3(path, "utf8"));
+    const metadata = await lstat(path);
+    ownerPath = metadata.isDirectory() ? join2(path, lockOwnerName) : path;
+  } catch (error93) {
+    return isMissingFileError(error93) ? { status: "missing" } : { status: "malformed" };
+  }
+  try {
+    const parsed = JSON.parse(await readFile3(ownerPath, "utf8"));
     if (!isLockOwner(parsed))
-      return;
-    return parsed;
-  } catch {
-    return;
+      return { status: "malformed" };
+    return { status: "valid", owner: parsed };
+  } catch (error93) {
+    return isMissingFileError(error93) ? { status: "owner-missing" } : { status: "malformed" };
+  }
+}
+async function removeLockDirectory({ path }) {
+  await removeIfPresent({ path: join2(path, lockOwnerName) });
+  try {
+    await rmdir(path);
+  } catch (error93) {
+    if (!isMissingFileError(error93))
+      throw error93;
   }
 }
 function isLockOwner(value) {
@@ -33474,8 +33574,8 @@ async function syncParentDirectory(path) {
     await handle.close();
   }
 }
-function isExistsError(error93) {
-  return error93 instanceof Error && "code" in error93 && error93.code === "EEXIST";
+function isLockContentionError(error93) {
+  return error93 instanceof Error && "code" in error93 && (error93.code === "EEXIST" || error93.code === "ENOTEMPTY" || error93.code === "EISDIR" || error93.code === "ENOTDIR");
 }
 function isMissingFileError(error93) {
   return error93 instanceof Error && "code" in error93 && error93.code === "ENOENT";
@@ -37197,7 +37297,7 @@ var compactMarkRows = 9;
 var compactMinWidth = 48;
 var compactMinHeight = 20;
 var markBrightnessGain = 4.2;
-var remyCliVersion = "1.4.0";
+var remyCliVersion = "1.4.1";
 async function showRemySplash({
   createRenderer = createRemyRenderer,
   durationMs = splashDurationMs,
@@ -37610,7 +37710,7 @@ function createCliShutdown({ abortSignal }) {
 function exitCodeForSignal(signal) {
   return signal === "SIGINT" ? 130 : 143;
 }
-function throwIfAborted(signal) {
+function throwIfAborted2(signal) {
   if (signal?.aborted)
     throw signal.reason ?? new CliInterruptedError("SIGINT");
 }
@@ -37678,19 +37778,20 @@ ${approvalUrl}
   let journalPrepared = false;
   try {
     const tokens = await flow.authenticate();
-    throwIfAborted(dependencies.abortSignal);
+    throwIfAborted2(dependencies.abortSignal);
     const candidateAuthConfiguration = toAuthConfiguration({ configuration, tokenPath: candidateTokenPath });
     const candidateClient = createCodingAgentClient({
       apiUrl: configuration.apiUrl,
       getAccessToken: async (signal) => await requireAccessToken(candidateAuthConfiguration, signal)
     });
     const identity = await materializeRemoteCurrentUser({ client: candidateClient, signal: dependencies.abortSignal });
-    throwIfAborted(dependencies.abortSignal);
+    throwIfAborted2(dependencies.abortSignal);
     await onCandidateIdentityValidated?.({ email: identity.email });
-    throwIfAborted(dependencies.abortSignal);
-    throwIfAborted(dependencies.abortSignal);
+    throwIfAborted2(dependencies.abortSignal);
+    throwIfAborted2(dependencies.abortSignal);
     await withCredentialState({
       stateDirectory: dirname6(paths.tokenPath),
+      signal: dependencies.abortSignal,
       action: async () => {
         await recoverCredentialPromotionWhileLocked({
           stateDirectory: dirname6(paths.tokenPath),
@@ -37762,7 +37863,7 @@ ${approvalUrl}
         });
       }
     });
-    throwIfAborted(dependencies.abortSignal);
+    throwIfAborted2(dependencies.abortSignal);
     dependencies.output.writeStderr(`Signed in as ${tokens.user.email ?? tokens.user.name ?? "authenticated user"}.
 `);
   } catch (error93) {
@@ -37782,6 +37883,7 @@ async function logout({ dependencies, flags }) {
   const removeTokenFile = dependencies.removeTokenFile ?? unlink3;
   await withCredentialState({
     stateDirectory: dirname6(paths.tokenPath),
+    signal: dependencies.abortSignal,
     action: async () => {
       await recoverCredentialPromotionWhileLocked({
         stateDirectory: dirname6(paths.tokenPath),
@@ -37838,6 +37940,7 @@ async function createAuthenticatedClient(dependencies) {
   const paths = resolveCliPaths(dependencies.environment);
   const snapshot = await withCredentialState({
     stateDirectory: dirname6(paths.tokenPath),
+    signal: dependencies.abortSignal,
     action: async () => {
       await recoverCredentialPromotionWhileLocked({
         stateDirectory: dirname6(paths.tokenPath),
@@ -37846,64 +37949,33 @@ async function createAuthenticatedClient(dependencies) {
         ...dependencies.credentialStateFilesystem
       });
       const configuration = await readCliConfiguration(paths.configPath);
-      const tokenGeneration = await readOptionalTokenFile(paths.tokenPath);
-      return { configuration, tokenGeneration };
+      return { configuration };
     }
   });
   const authConfiguration = toAuthConfiguration({ configuration: snapshot.configuration, tokenPath: paths.tokenPath });
   const identity = await loadStoredIdentity(authConfiguration);
   const getAccessToken = createRefreshingAccessTokenProvider({ dependencies, paths, snapshot });
-  try {
-    await getAccessToken(dependencies.abortSignal);
-    const client = createCodingAgentClient({
-      apiUrl: snapshot.configuration.apiUrl,
-      getAccessToken
-    });
-    const remoteIdentity = await materializeRemoteCurrentUser({ client, signal: dependencies.abortSignal });
-    return {
-      authConfiguration,
-      client,
-      identity,
-      authenticatedEmail: remoteIdentity.email
-    };
-  } catch (error93) {
-    if (error93 instanceof LoginRequiredError) {
-      await withCredentialState({
-        stateDirectory: dirname6(paths.tokenPath),
-        action: async () => {
-          await recoverCredentialPromotionWhileLocked({
-            stateDirectory: dirname6(paths.tokenPath),
-            configPath: paths.configPath,
-            tokenPath: paths.tokenPath,
-            ...dependencies.credentialStateFilesystem
-          });
-          await assertCredentialSnapshotCurrent({ paths, snapshot });
-          await removeCredentialTokenWhileLocked({
-            tokenPath: paths.tokenPath,
-            removeFile: dependencies.credentialStateFilesystem?.removeFile,
-            syncDirectory: dependencies.credentialStateFilesystem?.syncDirectory
-          });
-        }
-      });
-    }
-    throw error93;
-  }
+  const client = createCodingAgentClient({
+    apiUrl: snapshot.configuration.apiUrl,
+    getAccessToken
+  });
+  const remoteIdentity = await materializeRemoteCurrentUser({ client, signal: dependencies.abortSignal });
+  return {
+    authConfiguration,
+    client,
+    identity,
+    authenticatedEmail: remoteIdentity.email
+  };
 }
 function createRefreshingAccessTokenProvider({
   dependencies,
   paths,
   snapshot
 }) {
-  let tokenGeneration = snapshot.tokenGeneration;
   let pendingAccessToken;
   return async (signal) => {
-    if (!pendingAccessToken) {
-      const expectedTokenGeneration = tokenGeneration;
-      pendingAccessToken = refreshAccessToken({ dependencies, paths, configuration: snapshot.configuration, expectedTokenGeneration, signal }).then(({ accessToken: accessToken2, tokenGeneration: refreshedTokenGeneration }) => {
-        tokenGeneration = refreshedTokenGeneration;
-        return accessToken2;
-      });
-    }
+    if (!pendingAccessToken)
+      pendingAccessToken = refreshAccessToken({ dependencies, paths, configuration: snapshot.configuration, signal });
     const accessToken = pendingAccessToken;
     try {
       return await accessToken;
@@ -37917,33 +37989,13 @@ async function refreshAccessToken({
   dependencies,
   paths,
   configuration,
-  expectedTokenGeneration,
   signal
 }) {
   const candidateTokenPath = await createCandidateTokenPath(paths.tokenPath);
   try {
-    await withCredentialState({
-      stateDirectory: dirname6(paths.tokenPath),
-      action: async () => {
-        await recoverCredentialPromotionWhileLocked({
-          stateDirectory: dirname6(paths.tokenPath),
-          configPath: paths.configPath,
-          tokenPath: paths.tokenPath,
-          ...dependencies.credentialStateFilesystem
-        });
-        await assertCredentialSnapshotCurrent({
-          paths,
-          snapshot: { configuration, tokenGeneration: expectedTokenGeneration }
-        });
-        if (expectedTokenGeneration !== undefined)
-          await writeFile4(candidateTokenPath, expectedTokenGeneration, { mode: 384 });
-      }
-    });
-    const candidateAuthConfiguration = toAuthConfiguration({ configuration, tokenPath: candidateTokenPath });
-    const accessToken = await requireAccessToken(candidateAuthConfiguration, signal);
-    const candidateTokenGeneration = await readFile5(candidateTokenPath, "utf8");
-    await withCredentialState({
+    return await withCredentialState({
       stateDirectory: dirname6(paths.tokenPath),
+      signal,
       action: async () => {
         await recoverCredentialPromotionWhileLocked({
           stateDirectory: dirname6(paths.tokenPath),
@@ -37951,11 +38003,28 @@ async function refreshAccessToken({
           tokenPath: paths.tokenPath,
           ...dependencies.credentialStateFilesystem
         });
-        await assertCredentialSnapshotCurrent({
-          paths,
-          snapshot: { configuration, tokenGeneration: expectedTokenGeneration }
-        });
-        if (candidateTokenGeneration !== expectedTokenGeneration) {
+        const currentConfiguration = await readCliConfiguration(paths.configPath);
+        if (!sameCliConfiguration(currentConfiguration, configuration))
+          throw new Error("Credential configuration changed while preparing authentication. Retry the command.");
+        const currentTokenGeneration = await readOptionalTokenFile(paths.tokenPath);
+        if (currentTokenGeneration !== undefined)
+          await writeFile4(candidateTokenPath, currentTokenGeneration, { mode: 384 });
+        const candidateAuthConfiguration = toAuthConfiguration({ configuration, tokenPath: candidateTokenPath });
+        let accessToken;
+        try {
+          accessToken = await requireAccessToken(candidateAuthConfiguration, signal);
+        } catch (error93) {
+          if (error93 instanceof LoginRequiredError) {
+            await removeCredentialTokenWhileLocked({
+              tokenPath: paths.tokenPath,
+              removeFile: dependencies.credentialStateFilesystem?.removeFile,
+              syncDirectory: dependencies.credentialStateFilesystem?.syncDirectory
+            });
+          }
+          throw error93;
+        }
+        const candidateTokenGeneration = await readFile5(candidateTokenPath, "utf8");
+        if (candidateTokenGeneration !== currentTokenGeneration) {
           await replaceCredentialTokenWhileLocked({
             sourcePath: candidateTokenPath,
             tokenPath: paths.tokenPath,
@@ -37963,22 +38032,13 @@ async function refreshAccessToken({
             syncDirectory: dependencies.credentialStateFilesystem?.syncDirectory
           });
         }
+        return accessToken;
       }
     });
-    return { accessToken, tokenGeneration: candidateTokenGeneration };
   } finally {
     await removeCandidateToken({ path: candidateTokenPath, removeTokenFile: unlink3 });
   }
 }
-async function assertCredentialSnapshotCurrent({
-  paths,
-  snapshot
-}) {
-  const currentConfiguration = await readCliConfiguration(paths.configPath);
-  const currentTokenGeneration = await readOptionalTokenFile(paths.tokenPath);
-  if (!sameCliConfiguration(currentConfiguration, snapshot.configuration) || currentTokenGeneration !== snapshot.tokenGeneration)
-    throw new Error("Credential state changed while preparing authentication. Retry the command.");
-}
 async function readOptionalTokenFile(path) {
   try {
     return await readFile5(path, "utf8");
@@ -38007,7 +38067,7 @@ async function dashboard({
   bootstrap
 }) {
   assertInteractiveDashboard(dependencies);
-  throwIfAborted(dependencies.abortSignal);
+  throwIfAborted2(dependencies.abortSignal);
   const { operations, repositories, initialSessions } = bootstrap;
   const openDashboardTui = dependencies.openDashboardTui ?? createDashboardTui;
   const pages = [initialSessions];
@@ -38188,7 +38248,7 @@ async function authenticateBareDashboard({
       splash?.completeAuthentication({ email: email5 });
     }
   });
-  throwIfAborted(dependencies.abortSignal);
+  throwIfAborted2(dependencies.abortSignal);
   return await awaitWithAbort({
     value: prepareDashboardBootstrap({
       dependencies,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@meistrari/remy-cli",
-    "version": "1.4.0",
+    "version": "1.4.1",
     "description": "Remy, the Coding Agent terminal client.",
     "type": "module",
     "bin": {