@mkterswingman/5mghost-twinkler 0.1.4 → 0.1.5

package/dist/auth.d.ts

@@ -21,6 +21,8 @@ export interface TokenProviderOptions {
     env?: NodeJS.ProcessEnv;
     fetchImpl?: typeof fetch;
     authUrl?: string;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
 }
 export declare function getAuthStatus(options: TokenProviderOptions): AuthStatus;
 export declare function getValidToken(options: TokenProviderOptions): Promise<string | null>;

package/dist/auth.js

@@ -1,9 +1,12 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 export const MKTERSWINGMAN_PAT_ENV = "MKTERSWINGMAN_PAT";
 export const PAT_LOGIN_URL = "https://mkterswingman.com/pat/login";
 const DEFAULT_AUTH_URL = "https://mkterswingman.com";
 const REFRESH_SKEW_MS = 60_000;
+const REFRESH_LOCK_STALE_MS = 30_000;
+const REFRESH_LOCK_TIMEOUT_MS = 90_000;
+const REFRESH_LOCK_POLL_MS = 50;
 export function getAuthStatus(options) {
     if (options.env?.[MKTERSWINGMAN_PAT_ENV]) {
         return {
@@ -54,26 +57,35 @@ export async function getValidToken(options) {
         return null;
     if (auth.type === "pat")
         return auth.pat || null;
-    if (auth.access_token && auth.expires_at && Date.now() + REFRESH_SKEW_MS < auth.expires_at) {
+    if (hasUsableAccessToken(auth, options.now)) {
         return auth.access_token;
     }
-    if (!auth.refresh_token)
-        return null;
-    const refreshed = await refreshJwt(auth.refresh_token, {
-        clientId: auth.client_id,
-        authUrl: options.authUrl,
-        fetchImpl: options.fetchImpl
-    });
-    if (!refreshed)
-        return null;
-    writeSharedAuth(options.authJsonPath, {
-        type: "jwt",
-        access_token: refreshed.access_token,
-        refresh_token: refreshed.refresh_token,
-        expires_at: Date.now() + refreshed.expires_in * 1000,
-        client_id: auth.client_id
+    return withRefreshLock(options, async () => {
+        const latest = readSharedAuth(options.authJsonPath);
+        if (!latest)
+            return null;
+        if (latest.type === "pat")
+            return latest.pat || null;
+        if (hasUsableAccessToken(latest, options.now))
+            return latest.access_token;
+        if (!latest.refresh_token)
+            return null;
+        const refreshed = await refreshJwt(latest.refresh_token, {
+            clientId: latest.client_id,
+            authUrl: options.authUrl,
+            fetchImpl: options.fetchImpl
+        });
+        if (!refreshed)
+            return null;
+        writeSharedAuth(options.authJsonPath, {
+            type: "jwt",
+            access_token: refreshed.access_token,
+            refresh_token: refreshed.refresh_token,
+            expires_at: (options.now ?? Date.now)() + refreshed.expires_in * 1000,
+            client_id: latest.client_id
+        });
+        return refreshed.access_token;
     });
-    return refreshed.access_token;
 }
 export function savePat(authJsonPath, pat) {
     const normalized = pat.trim();
@@ -112,6 +124,95 @@ export function writeSharedAuth(authJsonPath, data) {
         // Windows may ignore POSIX modes.
     }
 }
+function hasUsableAccessToken(auth, now) {
+    return Boolean(auth.access_token &&
+        auth.expires_at &&
+        (now ?? Date.now)() + REFRESH_SKEW_MS < auth.expires_at);
+}
+async function withRefreshLock(options, fn) {
+    const lockPath = `${options.authJsonPath}.refresh.lock`;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const deadline = now() + REFRESH_LOCK_TIMEOUT_MS;
+    mkdirSync(dirname(options.authJsonPath), { recursive: true });
+    while (true) {
+        try {
+            mkdirSync(lockPath, { mode: 0o700 });
+            try {
+                writeLockOwner(lockPath, now());
+            }
+            catch (error) {
+                rmSync(lockPath, { recursive: true, force: true });
+                throw error;
+            }
+            try {
+                return await fn();
+            }
+            finally {
+                rmSync(lockPath, { recursive: true, force: true });
+            }
+        }
+        catch (error) {
+            if (!isAlreadyExistsError(error))
+                throw error;
+            if (canRecoverRefreshLock(lockPath, now())) {
+                rmSync(lockPath, { recursive: true, force: true });
+                continue;
+            }
+            if (now() >= deadline) {
+                throw new Error("Timed out waiting for mkterswingman auth refresh lock");
+            }
+            await sleep(REFRESH_LOCK_POLL_MS);
+        }
+    }
+}
+function isAlreadyExistsError(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "EEXIST");
+}
+function writeLockOwner(lockPath, createdAtMs) {
+    writeFileSync(`${lockPath}/owner.json`, JSON.stringify({ pid: process.pid, created_at: createdAtMs }), { encoding: "utf8", mode: 0o600 });
+}
+function canRecoverRefreshLock(lockPath, nowMs) {
+    const owner = readRefreshLockOwner(lockPath);
+    if (owner) {
+        return nowMs - owner.created_at > REFRESH_LOCK_STALE_MS && !isProcessAlive(owner.pid);
+    }
+    try {
+        return nowMs - statSync(lockPath).mtimeMs > REFRESH_LOCK_STALE_MS;
+    }
+    catch {
+        return false;
+    }
+}
+function readRefreshLockOwner(lockPath) {
+    try {
+        const owner = JSON.parse(readFileSync(`${lockPath}/owner.json`, "utf8"));
+        if (typeof owner.pid === "number" && typeof owner.created_at === "number") {
+            return { pid: owner.pid, created_at: owner.created_at };
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function isProcessAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return (typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "EPERM");
+    }
+}
 async function refreshJwt(refreshToken, options) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const response = await fetchImpl(`${options.authUrl ?? DEFAULT_AUTH_URL}/oauth/token`, {

package/dist/cli.js

@@ -3,7 +3,7 @@ import { readFileSync, realpathSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { getAuthStatus, logout, PAT_LOGIN_URL, savePat } from "./auth.js";
+import { getAuthStatus, getValidToken, logout, PAT_LOGIN_URL, savePat } from "./auth.js";
 import { resolveTwinklerPaths } from "./paths.js";
 import { installBundledSkills } from "./skillInstall.js";
 import { callTwinkler } from "./twinklerClient.js";
@@ -51,20 +51,28 @@ export async function runCli(context = {}) {
                 out(readPackageVersion());
                 return 0;
             case "auth":
-                return await runAuthCommand(args, { paths, env, out, stdin: context.stdin ?? process.stdin });
+                return await runAuthCommand(args, {
+                    paths,
+                    env,
+                    out,
+                    stdin: context.stdin ?? process.stdin,
+                    fetchImpl: context.fetchImpl
+                });
             case "login":
                 return await runAuthCommand(["login", "--pat-stdin", ...args.filter((arg) => arg !== "--pat-stdin")], {
                     paths,
                     env,
                     out,
-                    stdin: context.stdin ?? process.stdin
+                    stdin: context.stdin ?? process.stdin,
+                    fetchImpl: context.fetchImpl
                 });
             case "ensure":
-                return runEnsureCommand(args, {
+                return await runEnsureCommand(args, {
                     paths,
                     env,
                     out,
                     err,
+                    fetchImpl: context.fetchImpl,
                     spawnSyncImpl: context.spawnSyncImpl ?? spawnSync
                 });
             case "call": {
@@ -92,7 +100,7 @@ export async function runCli(context = {}) {
             }
             case "setup": {
                 const results = installBundledSkills({ homeDir: paths.homeDir });
-                const auth = getAuthStatus({ authJsonPath: paths.authJsonPath, env });
+                const auth = await getVerifiedAuthStatus(paths, env, context.fetchImpl);
                 out([
                     "Twinkler setup",
                     renderSkillInstallResults(results),
@@ -106,7 +114,7 @@ export async function runCli(context = {}) {
             case "upgrade":
                 return runUpdateCommand(args, { env, out, err, spawnSyncImpl: context.spawnSyncImpl ?? spawnSync });
             case "doctor": {
-                const auth = getAuthStatus({ authJsonPath: paths.authJsonPath, env });
+                const auth = await getVerifiedAuthStatus(paths, env, context.fetchImpl);
                 out([
                     "Twinkler doctor",
                     `Node: ${process.version}`,
@@ -145,7 +153,7 @@ async function runAuthCommand(args, context) {
         return 0;
     }
     if (subcommand === "status") {
-        const status = getAuthStatus({ authJsonPath: context.paths.authJsonPath, env: context.env });
+        const status = await getVerifiedAuthStatus(context.paths, context.env, context.fetchImpl);
         if (!status.authenticated) {
             context.out([
                 "Not logged in.",
@@ -184,12 +192,12 @@ async function runAuthCommand(args, context) {
     context.out(`Unknown auth subcommand: ${subcommand}`);
     return 1;
 }
-function runEnsureCommand(args, context) {
+async function runEnsureCommand(args, context) {
     const json = args.includes("--json");
     const autoUpdate = args.includes("--auto-update");
     const localVersion = readPackageVersion();
     const latest = readNpmLatestVersion(context.spawnSyncImpl, context.env);
-    const auth = getAuthStatus({ authJsonPath: context.paths.authJsonPath, env: context.env });
+    const auth = await getVerifiedAuthStatus(context.paths, context.env, context.fetchImpl);
     const updateNeeded = latest.version !== null && compareSemver(latest.version, localVersion) > 0;
     let update = {
         needed: updateNeeded,
@@ -242,6 +250,13 @@ function runEnsureCommand(args, context) {
         context.err(update.error);
     return exitCode;
 }
+async function getVerifiedAuthStatus(paths, env, fetchImpl) {
+    const auth = getAuthStatus({ authJsonPath: paths.authJsonPath, env });
+    if (!auth.authenticated)
+        return auth;
+    const token = await getValidToken({ authJsonPath: paths.authJsonPath, env, fetchImpl });
+    return { ...auth, authenticated: Boolean(token) };
+}
 function renderEnsureResult(result) {
     const latest = result.latest_version ?? `unknown (${result.latest_check.ok ? "not checked" : result.latest_check.error})`;
     const lines = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mkterswingman/5mghost-twinkler",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Lightweight AI helper for the 5mghost Twinkler API",
   "type": "module",
   "engines": {