@ouro.bot/cli 0.1.0-alpha.411 → 0.1.0-alpha.412

package/changelog.json

@@ -1,6 +1,14 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.412",
+      "changes": [
+        "Cross-process bw CLI lock prevents concurrent access to the same Bitwarden app data directory, fixing the root cause of intermittent vault timeout errors during `ouro up` provider checks on multi-agent machines.",
+        "Two-layer locking in `execBw`: in-process async mutex serializes within a Node.js process, cross-process `O_EXCL` file lock with PID stale detection serializes across processes.",
+        "`@ouro.bot/cli` and the `ouro.bot` wrapper are version-synced for the vault concurrency fix release."
+      ]
+    },
     {
       "version": "0.1.0-alpha.411",
       "changes": [

package/dist/repertoire/bitwarden-store.js

@@ -45,6 +45,7 @@ exports.BitwardenCredentialStore = void 0;
 exports.sanitizeCredentialErrorDetail = sanitizeCredentialErrorDetail;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const runtime_1 = require("../nerves/runtime");
 const bw_installer_1 = require("./bw-installer");
 const MAX_ERROR_DETAIL_LENGTH = 500;
@@ -130,13 +131,118 @@ function isBwConfigLogoutRequired(err) {
     const message = err.message.toLowerCase();
     return message.includes("logout") && message.includes("required");
 }
+// ---------------------------------------------------------------------------
+// Cross-process bw CLI lock
+// ---------------------------------------------------------------------------
+// The bw CLI cannot handle concurrent access to the same app data directory.
+// Two processes (e.g. daemon worker + ouro up CLI) hitting the same dir
+// simultaneously corrupt bw's local state, producing empty/garbled output.
+//
+// We use two layers:
+//   1. In-process async mutex: a Map<string, Promise<void>> keyed by appDataDir
+//      serializes calls within a single Node.js process.
+//   2. Cross-process file lock: fs.openSync(lockPath, 'wx') with PID stale
+//      detection serializes across processes.
+// ---------------------------------------------------------------------------
+const BW_LOCK_FILENAME = ".ouro-bw.lock";
+const BW_LOCK_TIMEOUT_MS = 30_000;
+const BW_LOCK_POLL_MS = 100;
+/** In-process async mutex keyed by appDataDir. */
+const inProcessLocks = new Map();
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function acquireFileLock(lockPath) {
+    const content = `${process.pid}\n`;
+    const deadline = Date.now() + BW_LOCK_TIMEOUT_MS;
+    while (true) {
+        try {
+            const fd = fs.openSync(lockPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL);
+            fs.writeSync(fd, content);
+            fs.closeSync(fd);
+            return;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST") {
+                throw err;
+            }
+            // Lock file exists -- check for stale lock
+            try {
+                const existing = fs.readFileSync(lockPath, "utf8").trim();
+                const pid = parseInt(existing, 10);
+                if (!isNaN(pid) && !isPidAlive(pid)) {
+                    // Stale lock -- remove and retry immediately
+                    try {
+                        fs.unlinkSync(lockPath);
+                    }
+                    catch { /* race with another cleaner is fine */ }
+                    continue;
+                }
+            }
+            catch { /* v8 ignore next -- race: lock file disappeared between openSync and readFileSync @preserve */
+                continue;
+            }
+            if (Date.now() >= deadline) {
+                throw new Error(`bw CLI lock timeout: could not acquire ${lockPath} within ${BW_LOCK_TIMEOUT_MS}ms`);
+            }
+            // Yield to the event loop before retrying
+            await delay(BW_LOCK_POLL_MS);
+        }
+    }
+}
+function releaseFileLock(lockPath) {
+    try {
+        fs.unlinkSync(lockPath);
+    }
+    catch {
+        // Already removed or never created -- safe to ignore
+    }
+}
+async function withBwLock(appDataDir, fn) {
+    if (!appDataDir) {
+        // No appDataDir means the default bw data location. Still need in-process
+        // serialization but cannot do cross-process file lock without a dir.
+        return fn();
+    }
+    const lockKey = appDataDir;
+    const lockPath = path.join(appDataDir, BW_LOCK_FILENAME);
+    // In-process serialization: chain onto the previous promise for this key
+    const previous = inProcessLocks.get(lockKey) ?? Promise.resolve();
+    let releaseLock;
+    const current = new Promise((resolve) => { releaseLock = resolve; });
+    inProcessLocks.set(lockKey, current);
+    await previous;
+    let fileLockAcquired = false;
+    try {
+        // Cross-process file lock
+        await acquireFileLock(lockPath);
+        fileLockAcquired = true;
+        return await fn();
+    }
+    finally {
+        if (fileLockAcquired) {
+            releaseFileLock(lockPath);
+        }
+        releaseLock();
+        // Clean up the map entry if we are the latest
+        if (inProcessLocks.get(lockKey) === current) {
+            inProcessLocks.delete(lockKey);
+        }
+    }
+}
 function execBw(args, sessionToken, appDataDir, stdin) {
     const env = {
         ...process.env,
         ...(sessionToken ? { BW_SESSION: sessionToken } : {}),
         ...(appDataDir ? { BITWARDENCLI_APPDATA_DIR: appDataDir } : {}),
     };
-    return new Promise((resolve, reject) => {
+    const runCommand = () => new Promise((resolve, reject) => {
         const child = (0, node_child_process_1.execFile)("bw", args, { timeout: 30_000, env }, (err, stdout, stderr) => {
             if (err) {
                 if (isBwNotInstalled(err)) {
@@ -152,6 +258,7 @@ function execBw(args, sessionToken, appDataDir, stdin) {
             child?.stdin?.end(stdin);
         }
     });
+    return withBwLock(appDataDir, runCommand);
 }
 /** Check if the error indicates the bw CLI binary is not installed. */
 function isBwNotInstalled(err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.411",
+  "version": "0.1.0-alpha.412",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",