@moewolf/moe-icons-cli 0.0.8 → 0.0.10

package/README.md

@@ -281,6 +281,12 @@ Log out before switching storage methods. Official production refresh uses the
 existing public Auth0 configuration; custom/local environments must provide
 matching issuer and client ID. Account and refresh requests have a deadline
 covering headers and body. Revoked refresh credentials require a new login.
+Overlapping CLI processes coordinate refreshes and reuse the same renewed
+session. A cancelled waiter does not cancel the refresh owned by another process.
+After a process is forcibly stopped during refresh, a remaining
+`session-refresh.lock` in the selected store directory (or the CLI state directory
+for native credentials) reports an error. Confirm the PID in its `owner.json`
+has stopped before removing that lock directory and retrying.
 
 The VS Code extension reads credentials on its own host. For Remote SSH, WSL
 or a container, run the CLI login on that host; local credentials are not copied.

package/dist/auth/device-login.js

@@ -72,34 +72,53 @@ export async function loginWithDeviceSession(config, deps, signal) {
     }
 }
 export async function refreshAuth0Session(config, session, deps) {
-    const response = await boundedResponse(deps.fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-            grant_type: "refresh_token",
-            client_id: config.auth0ClientId,
-            refresh_token: session.refreshToken,
-        }),
-        ...(deps.signal ? { signal: deps.signal } : {}),
-    });
-    if (response.status >= 500 || response.status === 429)
-        throw new CliError("NETWORK_ERROR", "Auth0 refresh temporarily unavailable; retry");
-    const body = (await response.json());
-    if (!response.ok || typeof body.access_token !== "string") {
-        throw new CliError("AUTH_ERROR", "Auth0 refresh failed");
-    }
-    if (body.expires_in !== undefined && (typeof body.expires_in !== "number" || !Number.isSafeInteger(body.expires_in) || body.expires_in <= 0))
-        throw new CliError("VALIDATION_ERROR", "invalid Auth0 token lifetime");
-    const updated = {
-        ...session,
-        accessToken: body.access_token,
-        refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : session.refreshToken,
-        expiresAt: deps.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
-        storedAt: deps.now(),
+    const perform = async () => {
+        const current = deps.tokenStore.getActive();
+        if (!current || current.accountId !== session.accountId)
+            throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
+        if (current.accessToken !== session.accessToken || current.storedAt !== session.storedAt) {
+            if (current.expiresAt > deps.now())
+                return current;
+            throw new CliError("NETWORK_ERROR", "session changed during refresh; retry with the current account");
+        }
+        const response = await boundedResponse(deps.fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                client_id: config.auth0ClientId,
+                refresh_token: session.refreshToken,
+            }),
+            ...(deps.signal ? { signal: deps.signal } : {}),
+        });
+        if (response.status >= 500 || response.status === 429)
+            throw new CliError("NETWORK_ERROR", "Auth0 refresh temporarily unavailable; retry");
+        const body = (await response.json());
+        if (!response.ok || typeof body.access_token !== "string") {
+            throw new CliError("AUTH_ERROR", "Auth0 refresh failed");
+        }
+        if (body.expires_in !== undefined &&
+            (typeof body.expires_in !== "number" ||
+                !Number.isSafeInteger(body.expires_in) ||
+                body.expires_in <= 0))
+            throw new CliError("VALIDATION_ERROR", "invalid Auth0 token lifetime");
+        const updated = {
+            ...session,
+            accessToken: body.access_token,
+            refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : session.refreshToken,
+            expiresAt: deps.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
+            storedAt: deps.now(),
+        };
+        const latest = deps.tokenStore.getActive();
+        if (!latest ||
+            latest.accountId !== session.accountId ||
+            latest.accessToken !== session.accessToken ||
+            latest.storedAt !== session.storedAt)
+            throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
+        deps.tokenStore.set(updated);
+        return updated;
     };
-    const latest = deps.tokenStore.getActive();
-    if (!latest || latest.accessToken !== session.accessToken || latest.storedAt !== session.storedAt)
-        throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
-    deps.tokenStore.set(updated);
-    return updated;
+    return deps.tokenStore.withRefreshLock
+        ? deps.tokenStore.withRefreshLock(perform, deps.signal)
+        : perform();
 }

package/dist/auth/refresh-lock.d.ts

@@ -0,0 +1,2 @@
+/** Coordinates refresh rotation across CLI processes without storing credentials. */
+export declare function withRefreshLock<T>(root: string, operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/auth/refresh-lock.js

@@ -0,0 +1,66 @@
+import { mkdirSync, writeFileSync, readFileSync, lstatSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { CliError } from "../errors/index.js";
+/** Coordinates refresh rotation across CLI processes without storing credentials. */
+export async function withRefreshLock(root, operation, signal) {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const path = join(root, "session-refresh.lock");
+    const deadline = Date.now() + 20_000;
+    for (;;) {
+        if (signal?.aborted)
+            throw new CliError("CANCELLED", "session refresh cancelled");
+        try {
+            mkdirSync(path, { mode: 0o700 });
+            try {
+                writeFileSync(join(path, "owner.json"), JSON.stringify({ pid: process.pid }), {
+                    flag: "wx",
+                    mode: 0o600,
+                });
+            }
+            catch (error) {
+                rmSync(path, { recursive: true, force: true });
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw new CliError("NETWORK_ERROR", "session refresh coordination unavailable; retry");
+            try {
+                const metadata = lstatSync(path);
+                if (!metadata.isDirectory() || metadata.isSymbolicLink())
+                    throw new CliError("NETWORK_ERROR", "invalid session refresh lock; repair credential storage");
+                const owner = JSON.parse(readFileSync(join(path, "owner.json"), "utf8"));
+                if (Number.isInteger(owner.pid) && owner.pid > 0) {
+                    try {
+                        process.kill(owner.pid, 0);
+                    }
+                    catch (cause) {
+                        if (cause.code === "ESRCH") {
+                            throw new CliError("NETWORK_ERROR", "a stopped process left a session refresh lock; repair credential storage before retrying");
+                        }
+                    }
+                }
+            }
+            catch (cause) {
+                if (cause instanceof CliError)
+                    throw cause; /* Owner may still be writing its marker. */
+            }
+            if (Date.now() >= deadline)
+                throw new CliError("NETWORK_ERROR", "session refresh is busy; retry or repair a stale credential lock");
+            try {
+                await delay(50, undefined, signal ? { signal } : undefined);
+            }
+            catch {
+                throw new CliError("CANCELLED", "session refresh cancelled");
+            }
+        }
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        rmSync(path, { recursive: true, force: true });
+    }
+}

package/dist/auth/session-policy.cjs

@@ -1,13 +1,13 @@
 // Canonical CLI/extension session-store selection. Contains no credentials.
 const {homedir} = require('node:os');
 const {join, isAbsolute} = require('node:path');
-const {existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync} = require('node:fs');
+const {lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync} = require('node:fs');
 function stateRoot(env) { const root=env.MOEICONS_STATE_DIR || join(homedir(), '.moeicons'); if(!isAbsolute(root)) throw new Error('MOEICONS_STATE_DIR must be absolute'); return root; }
 function selectedStore(env) {
   if (env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' && env.MOEICONS_TOKEN_STORE_DIR) { if(!isAbsolute(env.MOEICONS_TOKEN_STORE_DIR)) throw new Error('MOEICONS_TOKEN_STORE_DIR must be absolute'); return {mode:'file', rootDir:env.MOEICONS_TOKEN_STORE_DIR}; }
   const path = join(stateRoot(env), 'session-store.json');
-  if (!existsSync(path)) return {mode:env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' ? 'none' : 'system'};
-  const meta=lstatSync(path);
+  let meta;
+  try { meta=lstatSync(path); } catch(error) { if(error.code==='ENOENT') return {mode:env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' ? 'none' : 'system'}; throw error; }
   if (!meta.isFile() || meta.isSymbolicLink() || meta.size>4096 || (process.platform!=='win32' && ((meta.mode & 0o077)!==0 || meta.uid!==process.getuid()))) throw new Error('Session storage preference is not readable securely');
   const value=JSON.parse(readFileSync(path,'utf8'));
   if (value.schemaVersion!==1 || value.mode!=='file' || typeof value.rootDir!=='string' || !isAbsolute(value.rootDir)) throw new Error('Invalid session storage preference');

package/dist/auth/token-store.d.ts

@@ -17,6 +17,7 @@ export interface TokenStore {
     set(session: StoredSession): void;
     delete(accountId: string): void;
     clear(): void;
+    withRefreshLock?<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;
 }
 /**
  * File-backed fallback store (mode 0600). Used only when no OS keychain is

package/dist/auth/token-store.js

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, lstatSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { missingCredential } from "./session-policy.cjs";
+import { missingCredential, stateRoot } from "./session-policy.cjs";
+import { withRefreshLock } from "./refresh-lock.js";
 import { CliError } from "../errors/index.js";
 import { execFileSync } from "node:child_process";
 function parseSession(value) {
@@ -24,10 +25,16 @@ export function createFileTokenStore(options = {}) {
     const root = options.rootDir ?? join(homedir(), ".moeicons");
     const file = join(root, "token-store.json");
     function readAll() {
-        if (!existsSync(file))
-            return {};
+        let meta;
+        try {
+            meta = lstatSync(file);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return {};
+            throw new CliError("AUTH_ERROR", "file credential storage unavailable; check permissions or repair the store");
+        }
         try {
-            const meta = lstatSync(file);
             if (!meta.isFile() || meta.isSymbolicLink() || meta.size > 1_000_000 || (process.platform !== "win32" && ((meta.mode & 0o077) !== 0 || typeof process.getuid === "function" && meta.uid !== process.getuid())))
                 throw new Error("insecure store");
             const raw = JSON.parse(readFileSync(file, "utf8"));
@@ -48,6 +55,7 @@ export function createFileTokenStore(options = {}) {
         chmodSync(file, 0o600);
     }
     return {
+        withRefreshLock: (operation, signal) => withRefreshLock(root, operation, signal),
         get(accountId) {
             return readAll()[accountId];
         },
@@ -64,7 +72,7 @@ export function createFileTokenStore(options = {}) {
             delete all[accountId];
             writeAll(all);
         },
-        clear() { writeAll({}); },
+        clear() { readAll(); writeAll({}); },
     };
 }
 /** Use the native credential store when the platform provides a supported CLI. */
@@ -97,7 +105,7 @@ export function createSystemTokenStore(options = {}) {
         const prefix = "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$v=[Windows.Security.Credentials.PasswordVault]::new();";
         read = () => invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$c=$v.Retrieve('${service}','${account}');$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147023728){exit 44};$e=$e.InnerException};exit 45}`]);
         write = (value) => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}$p=[Console]::In.ReadToEnd();try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{};$v.Add([Windows.Security.Credentials.PasswordCredential]::new('${service}','${account}',$p))`], value); };
-        remove = () => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{}`]); };
+        remove = () => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147023728){exit 44};$e=$e.InnerException};exit 45}`]); };
     }
     else {
         return undefined;
@@ -119,6 +127,7 @@ export function createSystemTokenStore(options = {}) {
         }
     };
     return {
+        withRefreshLock: (operation, signal) => withRefreshLock(stateRoot(process.env), operation, signal),
         get: (accountId) => { const value = active(); return value?.accountId === accountId ? value : undefined; },
         getActive: active,
         set: (session) => { try {
@@ -131,7 +140,10 @@ export function createSystemTokenStore(options = {}) {
             try {
                 remove();
             }
-            catch { /* already absent */ }
+            catch (error) {
+                if (!missingCredential(platform, error))
+                    throw new CliError("AUTH_ERROR", "cannot clear system credentials; check credential store permissions");
+            }
         } },
         clear: () => { try {
             remove();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moewolf/moe-icons-cli",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "Moeicons CLI: install React, Vue, Vanilla, or Assets icon targets, manage releases and login, and expose an MCP server.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -74,5 +74,5 @@
     "fflate": "^0.8.2",
     "jsonc-parser": "^3.3.1"
   },
-  "payloadHash": "f856bfbd0728c3b91ad0b2673dfb5ec7bb67a41023922ce28a901843dd69556b"
+  "payloadHash": "39f10c2d8048f41a7fb47fade28d280399eead23a68645c7c4b6bf71243547b0"
 }