@remodex/rmx 1.0.2

package/src/integrations/writer.ts

@@ -0,0 +1,492 @@
+/**
+ * Apply, disable and restore an opencodex provider block in a client's config.
+ *
+ * Everything here exists to keep one promise: a toggle can always be undone.
+ * That means every mutation snapshots first, writes atomically, and journals
+ * what it did — and that a mutation refuses rather than guesses whenever the
+ * file is not in a state we can reason about. A disable that deletes work the
+ * user did after us would be worse than never shipping the feature.
+ *
+ * Design of record: devlog/_fin/260802_client_toggle_api/030 and 031.
+ */
+import { dirname } from "node:path";
+import { EXPORT_CLIENTS, type ExportModel } from "../clients/config-export";
+import { isLoopbackHostname } from "../codex/inject";
+import type { OcxConfig } from "../types";
+import { PARSE_FAILED, defaultIntegrationIO, loadTarget, parseConfig, type IntegrationIO } from "./config-io";
+import { fingerprint, canonicalContribution, fragmentPathsOf, type OwnershipRecord } from "./ownership";
+import { createdContainerPaths, mergeContribution, removeFragments } from "./merge";
+import { INTEGRATION_CLIENTS, isLoopbackOnly, type IntegrationClientId } from "./registry";
+import { classifyIntegration, exportContextOf } from "./state";
+import type { IntegrationState } from "./state";
+import { serializeDocument, UnserializableValueError } from "./serialize";
+import { ClientPathError } from "../clients/config-export";
+import { matchesOperationResult, newOpId, type JournalEntry } from "./journal";
+import { createIntegrationStateStore, type IntegrationStateStore } from "./store";
+
+export type RefusalReason =
+  | "not_installed"
+  | "conflict"
+  | "unsafe"
+  | "non_loopback"
+  | "drift_requires_confirm"
+  | "snapshot_expired"
+  | "write_failed";
+
+export interface WriteOk {
+  ok: true;
+  changed: boolean;
+  state: IntegrationState;
+  clientId: IntegrationClientId;
+  opId?: string;
+  message: string;
+}
+
+export interface WriteRefused {
+  ok: false;
+  reason: RefusalReason;
+  state: IntegrationState;
+  clientId: IntegrationClientId;
+  message: string;
+  /** Absolute path of a recoverable snapshot, when one exists. */
+  snapshotPath?: string;
+  /** True when compensation itself failed and the file is intermediate. */
+  residual?: boolean;
+}
+
+export type WriteOutcome = WriteOk | WriteRefused;
+
+export interface IntegrationWriteInput {
+  clientId: IntegrationClientId;
+  models: readonly ExportModel[];
+  config: OcxConfig;
+  port: number;
+  env?: NodeJS.ProcessEnv;
+  home?: string;
+  store?: IntegrationStateStore;
+  io?: IntegrationIO;
+}
+
+export interface IntegrationRestoreInput extends IntegrationWriteInput {
+  opId: string;
+  confirmDrift?: boolean;
+}
+
+function refuse(
+  clientId: IntegrationClientId,
+  reason: RefusalReason,
+  state: IntegrationState,
+  message: string,
+  snapshotPath?: string,
+): WriteRefused {
+  return { ok: false, reason, state, clientId, message, ...(snapshotPath ? { snapshotPath } : {}) };
+}
+
+function messageOf(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+interface CommitArgs {
+  io: IntegrationIO;
+  store: IntegrationStateStore;
+  clientId: IntegrationClientId;
+  configPath: string;
+  before: string | null;
+  nextText: string | null;
+  record: OwnershipRecord | null;
+  priorRecord: OwnershipRecord | null;
+  entry: JournalEntry;
+  state: IntegrationState;
+  snapshotPath?: string;
+}
+
+/**
+ * Client file, then ownership record, then journal row.
+ *
+ * The row is last on purpose: a record without a row is a thin history, while
+ * a row without a record would advertise an operation the classifier cannot
+ * corroborate. If either bookkeeping step fails we put the file back AND
+ * restore the ownership the operation replaced.
+ */
+function commit(args: CommitArgs): WriteOutcome {
+  const { io, clientId, configPath } = args;
+  try {
+    if (args.nextText === null) io.removeFile(configPath);
+    else {
+      io.mkdirp(dirname(configPath));
+      io.writeText(configPath, args.nextText);
+    }
+  } catch (error) {
+    return refuse(clientId, "write_failed", args.state, messageOf(error), args.snapshotPath);
+  }
+  try {
+    if (args.record) io.putRecord(args.record);
+    else io.dropRecord(clientId);
+  } catch (error) {
+    return compensate(args, error, "could not record ownership");
+  }
+  try {
+    io.appendJournal(args.entry);
+  } catch (error) {
+    return compensate(args, error, "could not append the journal row");
+  }
+  return {
+    ok: true,
+    changed: true,
+    state: args.state,
+    clientId,
+    opId: args.entry.opId,
+    message: "ok",
+  };
+}
+
+function compensate(args: CommitArgs, cause: unknown, what: string): WriteRefused {
+  const { io, clientId, configPath } = args;
+  try {
+    if (args.before === null) io.removeFile(configPath);
+    else io.writeText(configPath, args.before);
+    if (args.priorRecord) io.putRecord(args.priorRecord);
+    else io.dropRecord(clientId);
+  } catch {
+    // Say so. A false "rolled back" is worse than the original error, because
+    // the user would stop looking for the file we left half-written.
+    return {
+      ok: false,
+      reason: "write_failed",
+      state: args.state,
+      clientId,
+      residual: true,
+      ...(args.snapshotPath ? { snapshotPath: args.snapshotPath } : {}),
+      message: `${what}, and the change could not be rolled back. The file or its ownership record is in an intermediate state; the backup is at ${args.snapshotPath ?? "(none)"}.`,
+    };
+  }
+  return refuse(clientId, "write_failed", args.state, `${what}; the change was rolled back. Cause: ${messageOf(cause)}`, args.snapshotPath);
+}
+
+function snapshotAbsPath(store: IntegrationStateStore, entry: JournalEntry): string | undefined {
+  const snapshot = store.readSnapshot(entry);
+  return snapshot.kind === "stored" ? snapshot.path : undefined;
+}
+
+/** Shared preflight: detect, gate, read, parse and classify. */
+function preflight(input: IntegrationWriteInput) {
+  const store = input.store ?? createIntegrationStateStore();
+  const io = input.io ?? defaultIntegrationIO(store);
+  const clientId = input.clientId;
+  const spec = INTEGRATION_CLIENTS[clientId];
+  const exportSpec = EXPORT_CLIENTS[clientId];
+  /*
+   * Resolution itself can refuse: a relative OPENCLAW_* selector is rejected
+   * because we cannot know the gateway's working directory. That is a refusal
+   * about the user's configuration, not an internal fault, so it must not
+   * escape as an exception — the collection route would answer 500 for the
+   * whole Integrations page because one client is misconfigured.
+   */
+  let configPath: string;
+  try {
+    configPath = spec.configPath(input.env, input.home);
+  } catch (error) {
+    if (!(error instanceof ClientPathError)) throw error;
+    return { failed: refuse(clientId, "unsafe", "unsafe", error.message) } as const;
+  }
+  store.retryPendingPrunes();
+
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return {
+      failed: refuse(clientId, "unsafe", "unsafe",
+        target.why === "read-failed"
+          ? `${configPath} exists but could not be read`
+          : `${configPath} is not a regular file`),
+    } as const;
+  }
+  const before = target.before;
+  const parsed = parseConfig(before, exportSpec.format);
+  if (parsed === PARSE_FAILED) {
+    return { failed: refuse(clientId, "unsafe", "unsafe", `${configPath} could not be parsed`) } as const;
+  }
+  const contribution = exportSpec.buildContribution(exportContextOf(input));
+  // A record proves ownership of the file it was written FOR. Matching only by
+  // client id let a record for one home authorize a write to another whose
+  // bytes happened to hash the same — which deleted a config we never touched.
+  const stored = store.readRecords()[clientId] ?? null;
+  const record = stored && stored.clientId === clientId && stored.configPath === configPath
+    ? stored
+    : null;
+  // `configPath`/`clientId` are load-bearing, not decoration: a record proves
+  // ownership of ONE file, and the writer mutates whatever path resolves NOW.
+  // Without them a record written for another home directory would grant
+  // ownership here and disable would delete fragments it never wrote.
+  const classified = classifyIntegration({
+    fileText: before, fileIsRegular: true, parsed, record, contribution, configPath, clientId,
+  });
+  return { failed: undefined, store, io, clientId, spec, exportSpec, configPath, before, parsed, contribution, record, classified } as const;
+}
+
+export function applyIntegration(input: IntegrationWriteInput): WriteOutcome {
+  const pre = preflight(input);
+  if (pre.failed) return pre.failed;
+  const { store, io, clientId, spec, exportSpec, configPath, before, parsed, contribution, record, classified } = pre;
+
+  if (io.statKind(spec.detectDir(input.env, input.home)) !== "dir") {
+    return refuse(clientId, "not_installed", "absent", `${clientId} is not installed`);
+  }
+  if (isLoopbackOnly(clientId) && !isLoopbackHostname(input.config.hostname)) {
+    return refuse(clientId, "non_loopback", classified.state,
+      `The generated ${clientId} integration is loopback-only and does not emit the admission header a non-loopback bind requires. Give it loopback access instead, through a tunnel or a local forwarder.`);
+  }
+  if (classified.state === "conflict") {
+    return refuse(clientId, "conflict", "conflict",
+      classified.reason === "foreign-edit"
+        ? `${configPath} changed after Remodex wrote it`
+        : `${configPath} already contains a Remodex block we did not write`);
+  }
+  /*
+   * `unsafe` from the classifier means the document is not one we may write
+   * through — today that is a container on our fragment path holding a
+   * non-object value the merge would replace with `{}`. Unreadable and
+   * unparseable files are caught earlier in preflight; this branch exists
+   * because the classifier can also refuse a file it CAN read.
+   */
+  if (classified.state === "unsafe") {
+    return refuse(clientId, "unsafe", "unsafe",
+      classified.reason === "blocked-container"
+        ? `${configPath} holds a value where Remodex would have to write a section, so applying would replace it`
+        : `${configPath} cannot be changed safely`);
+  }
+  if (classified.state === "current") {
+    return { ok: true, changed: false, state: "current", clientId, message: "already applied" };
+  }
+
+  // A stale refresh drops what the PREVIOUS record owned before merging: a
+  // model that left the catalog would otherwise stay behind as an orphan the
+  // new record no longer covers, and disable could never remove it.
+  /*
+   * The previous record's `createdContainers` has to travel with this removal.
+   * Without it the refresh leaves our own empty scaffolding behind in `base`,
+   * `createdContainerPaths` then sees the container already present and
+   * concludes the user owns it, and the replacement record forgets we made it
+   * — so a later disable strands it forever.
+   */
+  const base = classified.state === "stale" && record
+    ? removeFragments(parsed, record.fragmentPaths, new Set(record.createdContainers ?? [])).doc
+    : parsed;
+  // Computed against the document as it stands BEFORE the merge: afterwards
+  // every container exists and "did we create this?" is unanswerable.
+  const created = createdContainerPaths(base, contribution);
+  /*
+   * A document can hold a value its own format cannot round-trip through our
+   * renderers. That used to throw straight out of the writer and reach the
+   * user as a 500 with no path and no advice; it is a refusal like any other,
+   * and the file is untouched because this happens before any write.
+   */
+  let text: string;
+  try {
+    text = serializeDocument(mergeContribution(base, contribution), exportSpec.format);
+  } catch (error) {
+    if (!(error instanceof UnserializableValueError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe",
+      `${configPath} contains something Remodex cannot rewrite safely (${error.message}), so it was left alone`);
+  }
+
+  // Compare-before-commit: someone may have written between classify and now.
+  const recheck = io.readText(configPath);
+  const rechecked = recheck.kind === "text" ? recheck.text : recheck.kind === "missing" ? null : undefined;
+  if (rechecked === undefined || rechecked !== before) {
+    return refuse(clientId, "conflict", "conflict", `${configPath} changed while applying`);
+  }
+
+  const opId = newOpId();
+  const snapshot = store.captureSnapshot(clientId, opId, before);
+  const at = new Date(io.now()).toISOString();
+  const entry: JournalEntry = {
+    opId, clientId, kind: classified.state === "stale" ? "refresh" : "apply", at, configPath,
+    snapshot, resultFingerprint: fingerprint(text), resultAbsent: false, priorRecord: record,
+  };
+  return commit({
+    io, store, clientId, configPath, before, nextText: text, state: "current",
+    priorRecord: record,
+    record: {
+      clientId, configPath, fileFingerprint: fingerprint(text),
+      blockFingerprint: fingerprint(canonicalContribution(contribution)),
+      fragmentPaths: fragmentPathsOf(contribution), createdContainers: created,
+      appliedAt: at, opId,
+    },
+    entry,
+    snapshotPath: snapshotAbsPath(store, entry),
+  });
+}
+
+export function disableIntegration(input: IntegrationWriteInput): WriteOutcome {
+  const pre = preflight(input);
+  if (pre.failed) return pre.failed;
+  const { store, io, clientId, exportSpec, configPath, before, parsed, record, classified } = pre;
+
+  if (classified.state === "absent") {
+    return { ok: true, changed: false, state: "absent", clientId, message: "not applied" };
+  }
+  if (classified.state === "conflict") {
+    return refuse(clientId, "conflict", "conflict",
+      classified.reason === "foreign-edit"
+        ? `${configPath} changed after Remodex wrote it; disabling would discard that edit`
+        : `${configPath} contains a Remodex block we did not write`);
+  }
+  /*
+   * `unsafe` reaches here the same way it reaches apply, and the code below
+   * dereferences `record` on the assumption that anything past this point is
+   * `current` or `stale`. A blocked container has no record, so disable threw
+   * a TypeError and the route answered 500 — the GUI locks the switch, but the
+   * CLI and direct API callers do not.
+   */
+  if (classified.state === "unsafe") {
+    return refuse(clientId, "unsafe", "unsafe",
+      classified.reason === "blocked-container"
+        ? `${configPath} holds a value where Remodex would have to read a section, so nothing can be removed safely`
+        : `${configPath} cannot be changed safely`);
+  }
+
+  // current | stale only: the file fingerprint still matches our record, so the
+  // recorded paths are exactly what we put there.
+  const { doc, removed } = removeFragments(
+    parsed,
+    record!.fragmentPaths,
+    new Set(record!.createdContainers ?? []),
+  );
+  if (!removed) {
+    return { ok: true, changed: false, state: "absent", clientId, message: "nothing to remove" };
+  }
+  let text: string;
+  try {
+    text = serializeDocument(doc, exportSpec.format);
+  } catch (error) {
+    if (!(error instanceof UnserializableValueError)) throw error;
+    return refuse(clientId, "unsafe", "unsafe",
+      `${configPath} contains something Remodex cannot rewrite safely (${error.message}), so nothing was removed`);
+  }
+
+  const recheck = io.readText(configPath);
+  const rechecked = recheck.kind === "text" ? recheck.text : recheck.kind === "missing" ? null : undefined;
+  if (rechecked === undefined || rechecked !== before) {
+    return refuse(clientId, "conflict", "conflict", `${configPath} changed while disabling`);
+  }
+
+  const opId = newOpId();
+  const snapshot = store.captureSnapshot(clientId, opId, before);
+  const at = new Date(io.now()).toISOString();
+  const entry: JournalEntry = {
+    opId, clientId, kind: "disable", at, configPath, snapshot,
+    resultFingerprint: fingerprint(text), resultAbsent: false, priorRecord: record,
+  };
+  return commit({
+    io, store, clientId, configPath, before, nextText: text, state: "absent",
+    record: null, priorRecord: record, entry,
+    snapshotPath: snapshotAbsPath(store, entry),
+  });
+}
+
+export function restoreIntegration(input: IntegrationRestoreInput): WriteOutcome {
+  const store = input.store ?? createIntegrationStateStore();
+  const io = input.io ?? defaultIntegrationIO(store);
+  const entry = store.findOperation(input.opId);
+  if (!entry) throw new Error(`unknown operation ${input.opId}`);
+  if (entry.clientId !== input.clientId) throw new Error("restore input names a different client than the operation");
+
+  const clientId = entry.clientId;
+  const resolvedPath = INTEGRATION_CLIENTS[clientId].configPath(input.env, input.home);
+  // Restore acts on the path the operation was journaled against. Resolving a
+  // different path here would let an operation recorded for one home delete a
+  // file in another.
+  const configPath = entry.configPath;
+  if (resolvedPath !== configPath) {
+    return refuse(clientId, "conflict", "conflict",
+      `that operation was recorded for ${configPath}, but this client now resolves to ${resolvedPath}`);
+  }
+  const snapshot = store.readSnapshot(entry);
+  if (snapshot.kind === "expired") {
+    return refuse(clientId, "snapshot_expired", "absent", "that backup has expired");
+  }
+  const backupHint = snapshot.kind === "stored" ? snapshot.path : undefined;
+
+  const target = loadTarget(io, configPath);
+  if (!target.ok) {
+    return refuse(clientId, "unsafe", "unsafe",
+      target.why === "read-failed"
+        ? `${configPath} exists but could not be read; the backup is at ${backupHint ?? "(none)"}`
+        : `${configPath} is not a regular file; the backup is at ${backupHint ?? "(none)"}`,
+      backupHint);
+  }
+  const current = target.before;
+
+  /*
+   * Drift: the file changed after the operation we are undoing.
+   *
+   * Through the shared matcher, because `fingerprint(current ?? "")` treated a
+   * MISSING file as an empty one — so restoring an operation whose result was
+   * absence, with the file still absent, read as drift and demanded a
+   * confirmation for edits nobody had made. The journal meanwhile offered the
+   * same row as Undo.
+   */
+  if (!matchesOperationResult(entry, current) && !input.confirmDrift) {
+    return refuse(clientId, "drift_requires_confirm", "conflict",
+      "this file changed after that operation; confirm to replace it (the current version is backed up first)");
+  }
+
+  // Restore is itself journaled and itself undoable: snapshot the CURRENT file
+  // first, so a confirmed drift-restore never destroys the newer edits.
+  const opId = newOpId();
+  const preSnapshot = store.captureSnapshot(clientId, opId, current);
+  const restoredText = snapshot.kind === "none" ? null : snapshot.text;
+
+  // Provenance is RESTORED, never re-derived: `priorRecord` described these
+  // exact bytes when the snapshot was taken. Re-deriving it from the file would
+  // mean guessing which entries are ours, and a wrong guess deletes a user's.
+  const restoredRecord = entry.priorRecord;
+  const fresh = EXPORT_CLIENTS[clientId].buildContribution(exportContextOf(input));
+  /*
+   * Does the restored record actually describe the restored bytes?
+   *
+   * It usually does — `priorRecord` was written for exactly this snapshot. But
+   * a CONFIRMED drift-restore snapshots the user's edited file first, and
+   * undoing that restore puts those edited bytes back while carrying a record
+   * that describes what Remodex had written. Overwriting the record's
+   * fingerprint with the restored bytes then laundered a foreign edit into
+   * owned content: the state read `current`, and a later disable deleted
+   * fields the user had added by hand.
+   */
+  const restoredFingerprint = restoredText === null ? "" : fingerprint(restoredText);
+  const recordDescribesBytes = restoredRecord !== null
+    && restoredRecord.fileFingerprint === restoredFingerprint;
+  const state: IntegrationState = restoredRecord === null
+    ? (restoredText === null ? "absent" : "conflict")
+    : !recordDescribesBytes
+      ? "conflict"
+      : restoredRecord.blockFingerprint === fingerprint(canonicalContribution(fresh))
+        ? "current"
+        : "stale";
+
+  const at = new Date(io.now()).toISOString();
+  const priorRecord = store.readRecords()[clientId] ?? null;
+  const restoreEntry: JournalEntry = {
+    opId, clientId, kind: "restore", at, configPath, snapshot: preSnapshot,
+    resultFingerprint: restoredText === null ? "" : fingerprint(restoredText),
+    resultAbsent: restoredText === null,
+    priorRecord,
+  };
+  return commit({
+    io, store, clientId, configPath, before: current, nextText: restoredText, state,
+    priorRecord,
+    /*
+     * Keep the record's ORIGINAL `fileFingerprint`. Restoring bytes it does not
+     * describe leaves the classifier reading `conflict`, which is the honest
+     * answer — we are no longer sure the block on disk is ours, and refusing
+     * is what stops a disable from deleting the user's edit.
+     */
+    record: restoredRecord === null ? null : {
+      ...restoredRecord,
+      appliedAt: at,
+      opId,
+    },
+    entry: restoreEntry,
+    snapshotPath: snapshotAbsPath(store, restoreEntry),
+  });
+}

package/src/lib/abort.ts

@@ -0,0 +1,146 @@
+export interface LinkedAbortSignal {
+  signal: AbortSignal;
+  cleanup: () => void;
+}
+
+export interface ClearableDeadline {
+  /** Parent-linked signal passed to fetch; remains parent-linked after clear(). */
+  signal: AbortSignal;
+  /** Stable reason object used when this deadline wins the abort race. */
+  timeoutReason: DOMException;
+  /** True only when this deadline, rather than the parent, fired first. */
+  didExpire: () => boolean;
+  /** Clear only the timer. Never aborts the deadline controller or detaches the parent. */
+  clear: () => void;
+}
+
+export interface IdleDeadline {
+  /** (Re-)arm the timer for one idle window. Call when a wait for progress BEGINS. No-op after fire/cancel. */
+  reset: () => void;
+  /** Disarm the timer WITHOUT retiring the deadline (call when the awaited progress arrives). No-op after fire/cancel. */
+  pause: () => void;
+  /** Retire permanently (success/teardown paths). Idempotent. */
+  cancel: () => void;
+}
+
+/**
+ * Resettable inactivity deadline (devlog 260716_passthrough_followups/010).
+ *
+ * Fires `onIdle` at most ONCE after `idleMs` elapses with no `reset()`/`pause()`.
+ * Contract:
+ * - `idleMs <= 0` returns an inert no-op deadline — the 0-disable responsibility
+ *   lives here so callers cannot mis-handle it.
+ * - The timer starts DISARMED: callers arm it with `reset()` when a wait begins and
+ *   `pause()` it when the wait settles, so pull-based relays never count downstream
+ *   backpressure (no pending read) as upstream inactivity.
+ * - First terminal wins: after `onIdle` runs or `cancel()` is called, every method
+ *   is a no-op and `onIdle` never runs again.
+ * - Never linked to fetch signals — the consumer decides how to kill its stream
+ *   (e.g. reader.cancel), keeping body-lifetime semantics unchanged.
+ */
+export function idleDeadline(idleMs: number, onIdle: () => void): IdleDeadline {
+  if (idleMs <= 0) return { reset: () => {}, pause: () => {}, cancel: () => {} };
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let done = false;
+  const disarm = () => {
+    if (timer !== undefined) clearTimeout(timer);
+    timer = undefined;
+  };
+  return {
+    reset: () => {
+      if (done) return;
+      disarm();
+      timer = setTimeout(() => {
+        if (done) return;
+        done = true;
+        timer = undefined;
+        onIdle();
+      }, idleMs);
+    },
+    pause: () => {
+      if (done) return;
+      disarm();
+    },
+    cancel: () => {
+      if (done) return;
+      done = true;
+      disarm();
+    },
+  };
+}
+
+/**
+ * Response-header deadline whose timer can be cleared without severing body-lifetime cancellation.
+ *
+ * `signalWithTimeout().cleanup()` intentionally removes its parent listener and is therefore suited
+ * to operations that are completely finished at cleanup. A fetch response body is different: once
+ * headers arrive the deadline ends, but the original parent/client signal must remain attached to
+ * the body. `AbortSignal.any()` supplies that direct lifetime link while `clear()` owns only the
+ * timer.
+ */
+export function clearableDeadline(timeoutMs: number, parent?: AbortSignal): ClearableDeadline {
+  const deadline = new AbortController();
+  const timeoutReason = new DOMException("Timeout elapsed", "TimeoutError");
+  let timer: ReturnType<typeof setTimeout> | undefined = setTimeout(() => {
+    timer = undefined;
+    if (!deadline.signal.aborted) deadline.abort(timeoutReason);
+  }, timeoutMs);
+  const signal = parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal;
+
+  return {
+    signal,
+    timeoutReason,
+    didExpire: () => signal.aborted && signal.reason === timeoutReason,
+    clear: () => {
+      if (timer !== undefined) clearTimeout(timer);
+      timer = undefined;
+    },
+  };
+}
+
+export function signalWithTimeout(timeoutMs: number, parent?: AbortSignal): LinkedAbortSignal {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => {
+    if (!controller.signal.aborted) controller.abort(new DOMException("Timeout elapsed", "TimeoutError"));
+  }, timeoutMs);
+
+  const abortFromParent = () => {
+    if (!controller.signal.aborted) controller.abort(parent?.reason);
+  };
+
+  if (parent?.aborted) {
+    abortFromParent();
+  } else {
+    parent?.addEventListener("abort", abortFromParent, { once: true });
+  }
+
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timeout);
+      parent?.removeEventListener("abort", abortFromParent);
+    },
+  };
+}
+
+/**
+ * Bind a response body's lifetime to an abort signal.
+ *
+ * Bun's HTTP client, when a `fetch(..., { signal })` is aborted AFTER the response resolved, tears
+ * down the response body stream and rejects any in-flight internal read. If our code hasn't attached
+ * a reader yet (e.g. the abort lands between `await fetch()` and the decoder's first read), that
+ * rejection is orphaned off the awaited path and Bun reports it as
+ * `unhandledRejection: TypeError: null is not an object` (native-only stack) — uncatchable by any
+ * caller try/catch. Proactively cancelling the body on abort makes US the consumer that settles it,
+ * so the rejection is absorbed. Returns a cleanup to detach the listener on the normal path.
+ */
+export function cancelBodyOnAbort(body: ReadableStream<Uint8Array> | null, signal?: AbortSignal): () => void {
+  if (!body || !signal) return () => {};
+  const onAbort = () => { void body.cancel().catch(() => {}); };
+  if (signal.aborted) {
+    onAbort();
+    return () => {};
+  }
+  signal.addEventListener("abort", onAbort, { once: true });
+  return () => signal.removeEventListener("abort", onAbort);
+}

package/src/lib/admin-secrets.ts

@@ -0,0 +1,25 @@
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config";
+
+export const ADMIN_TOKEN_FILE = "admin-api-token";
+
+export function adminApiTokenFilePath(configDir = getConfigDir()): string {
+  return join(configDir, ADMIN_TOKEN_FILE);
+}
+
+export function loadAdminTokenFromFile(configDir = getConfigDir()): string | null {
+  const path = adminApiTokenFilePath(configDir);
+  try {
+    const stat = lstatSync(path);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 512) return null;
+    const token = readFileSync(path, "utf8").trim();
+    return /^ocx_admin_[A-Za-z0-9_-]{43}$/.test(token) ? token : null;
+  } catch {
+    return null;
+  }
+}
+
+export function configuredAdminToken(configDir = getConfigDir(), env: NodeJS.ProcessEnv = process.env): string | null {
+  return env.OPENCODEX_ADMIN_AUTH_TOKEN?.trim() || loadAdminTokenFromFile(configDir);
+}