@standchat/cli 0.1.0 → 0.1.1

package/README.md

@@ -7,7 +7,7 @@ Command-line access for installing and managing Stand Chat. The CLI covers the 1
 After the release is publicly published:
 
 ```sh
-npm install --global @standchat/cli
+npm install --global @standchat/cli@0.1.1
 stand auth login --setup --json
 stand setup status --json
 ```

package/dist/config.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { link, lstat, mkdir, open, readdir, rename, rm } from 'node:fs/promises';
+import { lstat, mkdir, open, readdir, rename, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { isAbsolute, join } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -82,39 +82,6 @@ export async function writePrivateJson(path, data) {
         await rm(temporary, { force: true });
     }
 }
-// Keep the observed inode alive until recovery finishes. A pathname can be
-// released and reused by another legacy client while we check the first PID.
-async function observeCredentialLock(path) {
-    let file;
-    try {
-        file = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
-        const stat = await file.stat({ bigint: true });
-        if (!stat.isFile() || stat.size > 128n * 1024n || (process.platform !== 'win32'
-            && ((stat.mode & 63n) !== 0n || (process.getuid && stat.uid !== BigInt(process.getuid()))))) {
-            throw new CliError('UNSAFE_CONFIG', 'Invalid credential lock type, size, ownership, or permissions.', 4);
-        }
-        const buffer = Buffer.alloc(Number(stat.size) + 1);
-        const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-        let owner;
-        // A size change or short read makes this observation opaque.
-        if (BigInt(bytesRead) === stat.size) {
-            try {
-                owner = JSON.parse(buffer.toString('utf8', 0, bytesRead));
-            }
-            catch { /* Wait for an opaque owner. */ }
-        }
-        return { file, dev: stat.dev, ino: stat.ino, owner };
-    }
-    catch (error) {
-        await file?.close();
-        if (isObject(error) && error.code === 'ENOENT')
-            return undefined;
-        if (isObject(error) && error.code === 'ELOOP') {
-            throw new CliError('UNSAFE_CONFIG', 'Credential locks must be regular files, not symbolic links.', 4);
-        }
-        throw error;
-    }
-}
 async function withPrivateFileLock(root, path, resource, fn, signal) {
     const busyCode = resource === 'credential' ? 'CREDENTIAL_BUSY' : 'CONFIG_BUSY';
     const title = resource === 'credential' ? 'Credential' : 'Configuration';
@@ -126,12 +93,11 @@ async function withPrivateFileLock(root, path, resource, fn, signal) {
     await privateDirectory(queue);
     const id = `${process.pid}-${randomUUID()}.json`;
     const claim = join(queue, id);
-    const candidate = `${claim}.lock`;
     const deadline = performance.now() + 120_000;
     const wait = async () => {
         cancelled();
         if (performance.now() >= deadline)
-            throw new CliError(busyCode, `Another command owns this ${resource}, or its ownership cannot be verified. Retry after it finishes. Lock: ${path}; queue: ${queue}. Repair these paths only after verifying no Stand CLI process is running; never remove a live process’s lock.`, 4);
+            throw new CliError(busyCode, `Another command owns this ${resource}, or its ownership cannot be verified. Retry after it finishes. Queue: ${queue}. Repair this directory only after verifying no Stand CLI process is running; never remove a live process’s lock.`, 4);
         await sleep(50, signal);
     };
     const dead = (pid) => {
@@ -154,12 +120,11 @@ async function withPrivateFileLock(root, path, resource, fn, signal) {
                 continue;
             if (!isObject(value) || !Number.isSafeInteger(value.pid) || Number(value.pid) <= 0
                 || name.split('-')[0] !== String(value.pid) || !Number.isSafeInteger(value.ticket) || Number(value.ticket) < 0) {
-                throw new CliError(busyCode, `${title} lock ownership is invalid. Lock: ${path}; queue: ${queue}. Verify no Stand CLI process is running before repairing these files.`, 4);
+                throw new CliError(busyCode, `${title} lock ownership is invalid. Queue: ${queue}. Verify no Stand CLI process is running before repairing these files.`, 4);
             }
             if (dead(Number(value.pid))) {
                 // Names are unique and never reused. A competing cleanup cannot delete
                 // another process's replacement claim as it could with a fixed lock path.
-                await rm(`${file}.lock`, { force: true });
                 await rm(file, { force: true });
             }
             else
@@ -167,12 +132,12 @@ async function withPrivateFileLock(root, path, resource, fn, signal) {
         }
         return active;
     };
-    // Lamport's bakery arbitration serializes new clients before any stale
-    // canonical-lock recovery. Publish choosing=0 atomically before inspecting
-    // peers; new arrivals then observe us or wait for our ticket publication.
-    let acquired = false;
-    await writePrivateJson(claim, { pid: process.pid, ticket: 0 });
+    // Each attempt owns a unique claim for its whole lifetime, so stale cleanup
+    // never unlinks a new owner's claim. Publish choosing=0 atomically before
+    // inspecting peers; arrivals then observe us or wait for our ticket. The
+    // bakery queue is the only lock: there is no reusable PID-file pathname.
     try {
+        await writePrivateJson(claim, { pid: process.pid, ticket: 0 });
         const ticket = Math.max(0, ...(await claims()).map(peer => peer.ticket)) + 1;
         if (!Number.isSafeInteger(ticket))
             throw new CliError(busyCode, `${title} lock ticket limit reached.`, 4);
@@ -180,65 +145,11 @@ async function withPrivateFileLock(root, path, resource, fn, signal) {
         while ((await claims()).some(peer => peer.id !== id
             && (peer.ticket === 0 || peer.ticket < ticket || (peer.ticket === ticket && peer.id < id))))
             await wait();
-        // Credential users retain the prior PID-file protocol for N-1 clients.
-        // Configuration serialization requires all writers to use this new lock.
-        // A complete candidate is linked exclusively, avoiding new empty locks
-        // if this process dies between creation and writing its PID.
-        const file = await open(candidate, 'wx', 0o600);
-        try {
-            await file.writeFile(String(process.pid));
-            await file.sync();
-        }
-        finally {
-            await file.close();
-        }
-        for (;;) {
-            cancelled();
-            try {
-                await link(candidate, path);
-                acquired = true;
-                break;
-            }
-            catch (error) {
-                if (!isObject(error) || error.code !== 'EEXIST')
-                    throw error;
-            }
-            const observed = await observeCredentialLock(path);
-            try {
-                if (observed && Number.isSafeInteger(observed.owner) && Number(observed.owner) > 0 && dead(Number(observed.owner))) {
-                    const current = await observeCredentialLock(path);
-                    try {
-                        // Holding the original descriptor prevents inode reuse. Only
-                        // remove that same dead owner's lock, never a replacement owner.
-                        // Bakery arbitration excludes another new-client recoverer;
-                        // legacy clients never remove a lock owned by another process.
-                        if (current && current.dev === observed.dev && current.ino === observed.ino && current.owner === observed.owner) {
-                            cancelled();
-                            await rm(path, { force: true });
-                        }
-                    }
-                    finally {
-                        await current?.file.close();
-                    }
-                }
-            }
-            finally {
-                await observed?.file.close();
-            }
-            await wait();
-        }
         cancelled();
         return await fn();
     }
     finally {
-        try {
-            if (acquired)
-                await rm(path, { force: true });
-        }
-        finally {
-            await rm(candidate, { force: true });
-            await rm(claim, { force: true });
-        }
+        await rm(claim, { force: true });
     }
 }
 export class ConfigStore {
@@ -290,7 +201,6 @@ export class ConfigStore {
     }
     // Every mutation of the shared file must derive its result after acquiring
     // this global lock. A per-profile lock cannot protect the other profile rows.
-    // Older CLI versions do not take this lock and must not write concurrently.
     async update(name, change, signal) {
         const selected = profileName(name);
         return withPrivateFileLock(this.root, join(this.root, 'config.json.lock'), 'configuration', async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standchat/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Stand Chat command-line client for humans and agents",
   "type": "module",
   "bin": {