@vincentt-xr/cli 0.6.0 → 0.8.0

package/dist/shared/config.d.ts

@@ -7,6 +7,16 @@ export interface MachineConfig {
     pat: string;
     /** Org slug commands act in when no --org flag or VINCENTT_ORG env is given. */
     activeOrg: string;
+    /**
+     * Durable authorization for unattended `dx --send`. Written only by
+     * `vincentt dx enable`, which requires a TTY. Cleared by `disable` and by `logout`.
+     */
+    dxSendEnabled?: boolean;
+    /**
+     * ISO8601 UTC, when enablement was granted. Its AGE is the mitigation for having
+     * no expiry, so an unparseable value fails closed rather than printing.
+     */
+    dxSendEnabledAt?: string;
 }
 export interface ProjectBinding {
     /** The backend Project id this working tree publishes to. */
@@ -26,9 +36,26 @@ export declare function loadMachineConfig(): Promise<Partial<MachineConfig>>;
  * every write, even when the file pre-existed with looser perms).
  */
 export declare function writeMachineConfig(patch: Partial<MachineConfig>): Promise<string>;
+/**
+ * Set or clear unattended-send enablement (`vincentt dx enable` / `disable`).
+ *
+ * A dedicated function rather than a `writeMachineConfig` patch because clearing
+ * has to DELETE the keys. A patch of `{dxSendEnabled: undefined}` happens to work
+ * — JSON.stringify drops undefined values — but only by a coincidence of the
+ * serializer, and the read of a key that survived would be the difference between
+ * off and on.
+ */
+export declare function writeDxEnablement(next: {
+    at: string;
+} | undefined): Promise<string>;
 /**
  * Remove the stored PAT from ~/.vincentt/config.json (used by `vincentt logout`),
  * preserving apiUrl and any other fields. Returns whether a token was present.
+ *
+ * Unattended-send enablement goes with the PAT. This function preserves every
+ * other field by design, which would leave a disconnected machine still armed to
+ * transmit for whoever signs in next — a creator who disconnects a machine has
+ * disconnected it.
  */
 export declare function clearMachineToken(): Promise<{
     path: string;

package/dist/shared/config.js

@@ -8,6 +8,7 @@
 // Env vars (VINCENTT_API_URL / VINCENTT_PAT) override the file for local/dogfood
 // runs so a creator can point at a dev backend without editing the machine config.
 // The binding's optional apiUrl does NOT — see decideApiUrl.
+import { randomBytes } from "node:crypto";
 import { promises as fs } from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -31,18 +32,44 @@ export async function loadMachineConfig() {
     return (await readJsonIfExists(MACHINE_CONFIG_PATH)) ?? {};
 }
 /**
- * Persist the machine config with owner-only perms. `writeFile`'s `mode` only applies when
- * it CREATES the file, so a pre-existing config.json with looser perms (e.g. 0644) would keep
- * them and leave a bearer credential world-readable. An explicit chmod after the write tightens
- * it to 0600 every time, whether the file was just created or already existed.
+ * Persist the machine config with owner-only perms, ATOMICALLY: write a sibling
+ * temp file at 0600, then rename it over the target. Rename is atomic on the same
+ * filesystem, so there is no window in which config.json is truncated.
+ *
+ * Atomicity is not incidental cleanup. `dx enable` is a third writer to this file
+ * and, unlike `login`/`logout`, one an AGENT can trigger — in a session where
+ * `login` may also be running, against the file holding the bearer credential. A
+ * `writeFile` interrupted mid-write leaves a truncated config with the PAT gone,
+ * and it presents as an unexplained logout or as every later command throwing a
+ * SyntaxError, neither of which points at the write that caused it.
+ *
+ * `writeFile`'s `mode` only applies when it CREATES the file, so the temp file is
+ * chmod'ed explicitly: a lingering 0644 temp file would be a second, world-readable
+ * copy of the PAT. The temp file is removed if the rename fails, so a failed write
+ * leaves neither a truncated config nor a stray credential copy.
+ *
+ * The temp name is unique per call. A fixed `config.json.tmp` is safe for one
+ * writer and destructive for two: concurrent `login` and `dx enable` would write
+ * the same path, so whichever renamed second would fail ENOENT with its write
+ * silently lost — and a failing writer's cleanup would delete the other's
+ * in-flight file. Uniqueness also makes the `catch` safe by construction, since
+ * a writer can then only ever remove its own temp file.
  */
 async function persistMachineConfig(next) {
     await fs.mkdir(path.dirname(MACHINE_CONFIG_PATH), { recursive: true, mode: 0o700 });
-    await fs.writeFile(MACHINE_CONFIG_PATH, JSON.stringify(next, null, 2) + "\n", {
-        encoding: "utf8",
-        mode: 0o600,
-    });
-    await fs.chmod(MACHINE_CONFIG_PATH, 0o600);
+    const tmp = `${MACHINE_CONFIG_PATH}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+    try {
+        await fs.writeFile(tmp, JSON.stringify(next, null, 2) + "\n", {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        await fs.chmod(tmp, 0o600);
+        await fs.rename(tmp, MACHINE_CONFIG_PATH);
+    }
+    catch (err) {
+        await fs.rm(tmp, { force: true }).catch(() => { });
+        throw err;
+    }
     return MACHINE_CONFIG_PATH;
 }
 /**
@@ -55,14 +82,42 @@ export async function writeMachineConfig(patch) {
     const next = { ...(await loadMachineConfig()), ...patch };
     return persistMachineConfig(next);
 }
+/**
+ * Set or clear unattended-send enablement (`vincentt dx enable` / `disable`).
+ *
+ * A dedicated function rather than a `writeMachineConfig` patch because clearing
+ * has to DELETE the keys. A patch of `{dxSendEnabled: undefined}` happens to work
+ * — JSON.stringify drops undefined values — but only by a coincidence of the
+ * serializer, and the read of a key that survived would be the difference between
+ * off and on.
+ */
+export async function writeDxEnablement(next) {
+    const cfg = await loadMachineConfig();
+    if (next === undefined) {
+        delete cfg.dxSendEnabled;
+        delete cfg.dxSendEnabledAt;
+    }
+    else {
+        cfg.dxSendEnabled = true;
+        cfg.dxSendEnabledAt = next.at;
+    }
+    return persistMachineConfig(cfg);
+}
 /**
  * Remove the stored PAT from ~/.vincentt/config.json (used by `vincentt logout`),
  * preserving apiUrl and any other fields. Returns whether a token was present.
+ *
+ * Unattended-send enablement goes with the PAT. This function preserves every
+ * other field by design, which would leave a disconnected machine still armed to
+ * transmit for whoever signs in next — a creator who disconnects a machine has
+ * disconnected it.
  */
 export async function clearMachineToken() {
     const current = await loadMachineConfig();
     const hadToken = Boolean(current.pat);
     delete current.pat;
+    delete current.dxSendEnabled;
+    delete current.dxSendEnabledAt;
     await persistMachineConfig(current);
     return { path: MACHINE_CONFIG_PATH, hadToken };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vincentt-xr/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay)",
   "license": "UNLICENSED",
   "type": "module",