@moewolf/moe-icons-cli 0.0.9 → 0.0.11

package/README.md

@@ -281,6 +281,12 @@ Log out before switching storage methods. Official production refresh uses the
 existing public Auth0 configuration; custom/local environments must provide
 matching issuer and client ID. Account and refresh requests have a deadline
 covering headers and body. Revoked refresh credentials require a new login.
+Overlapping CLI processes coordinate refreshes and reuse the same renewed
+session. A cancelled waiter does not cancel the refresh owned by another process.
+After a process is forcibly stopped during refresh, a remaining
+`session-refresh.lock` in the selected store directory (or the CLI state directory
+for native credentials) reports an error. Confirm the PID in its `owner.json`
+has stopped before removing that lock directory and retrying.
 
 The VS Code extension reads credentials on its own host. For Remote SSH, WSL
 or a container, run the CLI login on that host; local credentials are not copied.

package/dist/auth/device-login.js

@@ -72,34 +72,53 @@ export async function loginWithDeviceSession(config, deps, signal) {
     }
 }
 export async function refreshAuth0Session(config, session, deps) {
-    const response = await boundedResponse(deps.fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-            grant_type: "refresh_token",
-            client_id: config.auth0ClientId,
-            refresh_token: session.refreshToken,
-        }),
-        ...(deps.signal ? { signal: deps.signal } : {}),
-    });
-    if (response.status >= 500 || response.status === 429)
-        throw new CliError("NETWORK_ERROR", "Auth0 refresh temporarily unavailable; retry");
-    const body = (await response.json());
-    if (!response.ok || typeof body.access_token !== "string") {
-        throw new CliError("AUTH_ERROR", "Auth0 refresh failed");
-    }
-    if (body.expires_in !== undefined && (typeof body.expires_in !== "number" || !Number.isSafeInteger(body.expires_in) || body.expires_in <= 0))
-        throw new CliError("VALIDATION_ERROR", "invalid Auth0 token lifetime");
-    const updated = {
-        ...session,
-        accessToken: body.access_token,
-        refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : session.refreshToken,
-        expiresAt: deps.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
-        storedAt: deps.now(),
+    const perform = async () => {
+        const current = deps.tokenStore.getActive();
+        if (!current || current.accountId !== session.accountId)
+            throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
+        if (current.accessToken !== session.accessToken || current.storedAt !== session.storedAt) {
+            if (current.expiresAt > deps.now())
+                return current;
+            throw new CliError("NETWORK_ERROR", "session changed during refresh; retry with the current account");
+        }
+        const response = await boundedResponse(deps.fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "refresh_token",
+                client_id: config.auth0ClientId,
+                refresh_token: session.refreshToken,
+            }),
+            ...(deps.signal ? { signal: deps.signal } : {}),
+        });
+        if (response.status >= 500 || response.status === 429)
+            throw new CliError("NETWORK_ERROR", "Auth0 refresh temporarily unavailable; retry");
+        const body = (await response.json());
+        if (!response.ok || typeof body.access_token !== "string") {
+            throw new CliError("AUTH_ERROR", "Auth0 refresh failed");
+        }
+        if (body.expires_in !== undefined &&
+            (typeof body.expires_in !== "number" ||
+                !Number.isSafeInteger(body.expires_in) ||
+                body.expires_in <= 0))
+            throw new CliError("VALIDATION_ERROR", "invalid Auth0 token lifetime");
+        const updated = {
+            ...session,
+            accessToken: body.access_token,
+            refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : session.refreshToken,
+            expiresAt: deps.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
+            storedAt: deps.now(),
+        };
+        const latest = deps.tokenStore.getActive();
+        if (!latest ||
+            latest.accountId !== session.accountId ||
+            latest.accessToken !== session.accessToken ||
+            latest.storedAt !== session.storedAt)
+            throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
+        deps.tokenStore.set(updated);
+        return updated;
     };
-    const latest = deps.tokenStore.getActive();
-    if (!latest || latest.accessToken !== session.accessToken || latest.storedAt !== session.storedAt)
-        throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
-    deps.tokenStore.set(updated);
-    return updated;
+    return deps.tokenStore.withRefreshLock
+        ? deps.tokenStore.withRefreshLock(perform, deps.signal)
+        : perform();
 }

package/dist/auth/refresh-lock.d.ts

@@ -0,0 +1,2 @@
+/** Coordinates refresh rotation across CLI processes without storing credentials. */
+export declare function withRefreshLock<T>(root: string, operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/auth/refresh-lock.js

@@ -0,0 +1,66 @@
+import { mkdirSync, writeFileSync, readFileSync, lstatSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { CliError } from "../errors/index.js";
+/** Coordinates refresh rotation across CLI processes without storing credentials. */
+export async function withRefreshLock(root, operation, signal) {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const path = join(root, "session-refresh.lock");
+    const deadline = Date.now() + 20_000;
+    for (;;) {
+        if (signal?.aborted)
+            throw new CliError("CANCELLED", "session refresh cancelled");
+        try {
+            mkdirSync(path, { mode: 0o700 });
+            try {
+                writeFileSync(join(path, "owner.json"), JSON.stringify({ pid: process.pid }), {
+                    flag: "wx",
+                    mode: 0o600,
+                });
+            }
+            catch (error) {
+                rmSync(path, { recursive: true, force: true });
+                throw error;
+            }
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw new CliError("NETWORK_ERROR", "session refresh coordination unavailable; retry");
+            try {
+                const metadata = lstatSync(path);
+                if (!metadata.isDirectory() || metadata.isSymbolicLink())
+                    throw new CliError("NETWORK_ERROR", "invalid session refresh lock; repair credential storage");
+                const owner = JSON.parse(readFileSync(join(path, "owner.json"), "utf8"));
+                if (Number.isInteger(owner.pid) && owner.pid > 0) {
+                    try {
+                        process.kill(owner.pid, 0);
+                    }
+                    catch (cause) {
+                        if (cause.code === "ESRCH") {
+                            throw new CliError("NETWORK_ERROR", "a stopped process left a session refresh lock; repair credential storage before retrying");
+                        }
+                    }
+                }
+            }
+            catch (cause) {
+                if (cause instanceof CliError)
+                    throw cause; /* Owner may still be writing its marker. */
+            }
+            if (Date.now() >= deadline)
+                throw new CliError("NETWORK_ERROR", "session refresh is busy; retry or repair a stale credential lock");
+            try {
+                await delay(50, undefined, signal ? { signal } : undefined);
+            }
+            catch {
+                throw new CliError("CANCELLED", "session refresh cancelled");
+            }
+        }
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        rmSync(path, { recursive: true, force: true });
+    }
+}

package/dist/auth/session-policy.cjs

@@ -1,13 +1,13 @@
 // Canonical CLI/extension session-store selection. Contains no credentials.
 const {homedir} = require('node:os');
 const {join, isAbsolute} = require('node:path');
-const {existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync} = require('node:fs');
+const {lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync} = require('node:fs');
 function stateRoot(env) { const root=env.MOEICONS_STATE_DIR || join(homedir(), '.moeicons'); if(!isAbsolute(root)) throw new Error('MOEICONS_STATE_DIR must be absolute'); return root; }
 function selectedStore(env) {
   if (env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' && env.MOEICONS_TOKEN_STORE_DIR) { if(!isAbsolute(env.MOEICONS_TOKEN_STORE_DIR)) throw new Error('MOEICONS_TOKEN_STORE_DIR must be absolute'); return {mode:'file', rootDir:env.MOEICONS_TOKEN_STORE_DIR}; }
   const path = join(stateRoot(env), 'session-store.json');
-  if (!existsSync(path)) return {mode:env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' ? 'none' : 'system'};
-  const meta=lstatSync(path);
+  let meta;
+  try { meta=lstatSync(path); } catch(error) { if(error.code==='ENOENT') return {mode:env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' ? 'none' : 'system'}; throw error; }
   if (!meta.isFile() || meta.isSymbolicLink() || meta.size>4096 || (process.platform!=='win32' && ((meta.mode & 0o077)!==0 || meta.uid!==process.getuid()))) throw new Error('Session storage preference is not readable securely');
   const value=JSON.parse(readFileSync(path,'utf8'));
   if (value.schemaVersion!==1 || value.mode!=='file' || typeof value.rootDir!=='string' || !isAbsolute(value.rootDir)) throw new Error('Invalid session storage preference');

package/dist/auth/token-store.d.ts

@@ -17,6 +17,7 @@ export interface TokenStore {
     set(session: StoredSession): void;
     delete(accountId: string): void;
     clear(): void;
+    withRefreshLock?<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;
 }
 /**
  * File-backed fallback store (mode 0600). Used only when no OS keychain is

package/dist/auth/token-store.js

@@ -1,7 +1,8 @@
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { missingCredential } from "./session-policy.cjs";
+import { missingCredential, stateRoot } from "./session-policy.cjs";
+import { withRefreshLock } from "./refresh-lock.js";
 import { CliError } from "../errors/index.js";
 import { execFileSync } from "node:child_process";
 function parseSession(value) {
@@ -54,6 +55,7 @@ export function createFileTokenStore(options = {}) {
         chmodSync(file, 0o600);
     }
     return {
+        withRefreshLock: (operation, signal) => withRefreshLock(root, operation, signal),
         get(accountId) {
             return readAll()[accountId];
         },
@@ -103,7 +105,7 @@ export function createSystemTokenStore(options = {}) {
         const prefix = "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$v=[Windows.Security.Credentials.PasswordVault]::new();";
         read = () => invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$c=$v.Retrieve('${service}','${account}');$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147023728){exit 44};$e=$e.InnerException};exit 45}`]);
         write = (value) => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}$p=[Console]::In.ReadToEnd();try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{};$v.Add([Windows.Security.Credentials.PasswordCredential]::new('${service}','${account}',$p))`], value); };
-        remove = () => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{}`]); };
+        remove = () => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147023728){exit 44};$e=$e.InnerException};exit 45}`]); };
     }
     else {
         return undefined;
@@ -125,6 +127,7 @@ export function createSystemTokenStore(options = {}) {
         }
     };
     return {
+        withRefreshLock: (operation, signal) => withRefreshLock(stateRoot(process.env), operation, signal),
         get: (accountId) => { const value = active(); return value?.accountId === accountId ? value : undefined; },
         getActive: active,
         set: (session) => { try {
@@ -137,7 +140,10 @@ export function createSystemTokenStore(options = {}) {
             try {
                 remove();
             }
-            catch { /* already absent */ }
+            catch (error) {
+                if (!missingCredential(platform, error))
+                    throw new CliError("AUTH_ERROR", "cannot clear system credentials; check credential store permissions");
+            }
         } },
         clear: () => { try {
             remove();

package/dist/core/bitmap-shard-budget.d.ts

@@ -14,8 +14,8 @@
  * the measured 89.5/90.0 MiB worst case with headroom; `AUD-FIX-30` records the
  * production freeze. No consumer may invent its own limit — every shard
  * download/expand path takes its numbers from here, and the legacy
- * `ICON_ARCHIVE_MAX_EXPANDED_BYTES` 512 MiB aggregate cap is deliberately not a
- * shard budget.
+ * `ICON_ARCHIVE_MAX_EXPANDED_BYTES` 768 MiB aggregate cap is deliberately not a
+ * shard budget. Per-shard and temporary-disk bounds remain independently set.
  */
 export interface BitmapShardBudget {
     /** Largest signed compressed shard archive accepted for one tuple. */

package/dist/core/bitmap-shard-budget.js

@@ -3,7 +3,7 @@ export const BITMAP_SHARD_BUDGET = Object.freeze({
     expandedBytes: 128 * 1024 * 1024,
     entries: 2000,
     singleFileBytes: 16 * 1024 * 1024,
-    totalDownloadBytes: 512 * 1024 * 1024,
+    totalDownloadBytes: 768 * 1024 * 1024,
     tempDiskBytes: 256 * 1024 * 1024,
     concurrency: 1,
     descriptorTimeoutMs: 5_000,

package/dist/core/selected-resources.js

@@ -169,8 +169,8 @@ export function planSelectedResources(config, catalog, index) {
     const paths = [...chosen].sort();
     const payloadBytes = paths.reduce((sum, p) => sum + index.files[p].compressedSize, 0);
     const expandedBytes = paths.reduce((sum, p) => sum + index.files[p].size, 0);
-    if (paths.length > 20000 || expandedBytes > 512 * 1024 * 1024 || payloadBytes > 512 * 1024 * 1024)
-        return fail("selected resources exceed 20,000 files/512 MiB budget; reduce icons/themes or explicitly use downloadMode=full");
+    if (paths.length > 20000 || expandedBytes > 768 * 1024 * 1024 || payloadBytes > 768 * 1024 * 1024)
+        return fail("selected resources exceed 20,000 files/768 MiB budget; reduce icons/themes or explicitly use downloadMode=full");
     return { paths, payloadBytes, expandedBytes, fallbacks: [...fallbacks].sort() };
 }
 export function verifyResource(bytes, entry, name) {

package/dist/project/tar-gz.d.ts

@@ -2,8 +2,8 @@
  * Combined release archives contain all four target trees. The current Pro
  * contract is roughly 60k regular files (9 groups × 554 icons), so the former
  * 20k cap rejected valid official packages. The six-spec bitmap matrix expands
- * to ~205 MiB (tar stream ~257 MiB), so the expanded ceiling covers that with
- * headroom while staying finite for zip-bomb protection. `extractTarGz` enforces
+ * to ~205 MiB (tar stream ~257 MiB). The 768 MiB expanded ceiling supports the
+ * release capacity contract while staying finite for zip-bomb protection. `extractTarGz` enforces
  * the same bound during gunzip via `maxOutputLength`, before the tar stream is
  * materialised.
  */

package/dist/project/tar-gz.js

@@ -5,13 +5,13 @@ const BLOCK = 512;
  * Combined release archives contain all four target trees. The current Pro
  * contract is roughly 60k regular files (9 groups × 554 icons), so the former
  * 20k cap rejected valid official packages. The six-spec bitmap matrix expands
- * to ~205 MiB (tar stream ~257 MiB), so the expanded ceiling covers that with
- * headroom while staying finite for zip-bomb protection. `extractTarGz` enforces
+ * to ~205 MiB (tar stream ~257 MiB). The 768 MiB expanded ceiling supports the
+ * release capacity contract while staying finite for zip-bomb protection. `extractTarGz` enforces
  * the same bound during gunzip via `maxOutputLength`, before the tar stream is
  * materialised.
  */
 export const ICON_ARCHIVE_MAX_ENTRIES = 100_000;
-export const ICON_ARCHIVE_MAX_EXPANDED_BYTES = 512 * 1024 * 1024;
+export const ICON_ARCHIVE_MAX_EXPANDED_BYTES = 768 * 1024 * 1024;
 /** True when a zlib gunzip failure means the bounded output was exceeded. */
 function isOutputLimitError(error) {
     const code = error?.code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moewolf/moe-icons-cli",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "description": "Moeicons CLI: install React, Vue, Vanilla, or Assets icon targets, manage releases and login, and expose an MCP server.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -74,5 +74,5 @@
     "fflate": "^0.8.2",
     "jsonc-parser": "^3.3.1"
   },
-  "payloadHash": "2c4faa8c395ce82af178bd941ababfede769b22f1721b7e6faf3c655cc003231"
+  "payloadHash": "d904489ab55079dde70252d359b30361e2046bc5345df4c3896f92e64d32db16"
 }