agmsg-cloud 0.1.3 → 0.1.4

package/dist/src/authenticated-digest.js

@@ -78,6 +78,35 @@ export function writeAll(fd, bytes, what, write = writeSync) {
  * temp file, fsync, rename, fsync the directory — because a half-written
  * record is one `fetch` would either reject a good bundle over or, worse, read
  * a truncated digest from.
+ *
+ * Also clears any OTHER record already held for this same (origin, scope)
+ * (#523). A machine that stalls after this ceremony — the bundle never
+ * fetched — and then connects again performs a SECOND ceremony for the same
+ * credential and device, and without this the old approval sat beside the
+ * new one forever: `fetch` finds two records for one scope and, correctly,
+ * refuses to guess which bundle either belongs to. There is exactly one live
+ * approval per (credential, device) at a time, so the new one replacing the
+ * old is not a loss — the old one was already superseded the moment this
+ * ceremony ran, since it authenticates the account's current snapshot, not a
+ * fixed past one.
+ *
+ * Two ceremonies for the SAME credential and device, running at once, only
+ * clear records OLDER than the one each just wrote (raised in review) —
+ * never the newest, and never each other. Without that qualifier, two
+ * concurrent calls could each write their own record and then each delete
+ * the OTHER's, leaving zero records for a scope that just ran two
+ * successful ceremonies — worse than the pile-up this exists to fix. This
+ * guarantees the scope is never left with zero records, however two
+ * genuinely concurrent calls interleave; it does not by itself guarantee
+ * they converge to exactly one (a pair racing closely enough can both
+ * survive, since each only knows what predates it, not what is still being
+ * written elsewhere). Running two ceremonies for one scope at once is out
+ * of scope to serialize against, deliberately — nobody starts a second
+ * `request` on top of one already in flight. What this fix exists to
+ * guarantee, and does, is the case that actually happens: from a stuck
+ * two-record state, one ordinary retry always recovers to exactly one,
+ * because that retry's own record is newer than both existing ones and
+ * clears them both in the same pass.
  */
 export function recordAuthenticatedDigest(input, env = process.env) {
     if (!HEX64.test(input.handoffDigest)) {
@@ -94,10 +123,11 @@ export function recordAuthenticatedDigest(input, env = process.env) {
     // from the first one — the same reason credentials.ts does it (raised in review).
     enforceMode(dir, 0o700);
     const path = pathFor(dir, input.serverOrigin, input.requestId);
+    const scope = fingerprintScope(input.secret, input.devicePubkey);
     const record = {
         requestId: input.requestId,
         handoffDigest: input.handoffDigest,
-        scopeFingerprint: fingerprintScope(input.secret, input.devicePubkey),
+        scopeFingerprint: scope,
         recordedAt: new Date().toISOString(),
     };
     const tmp = `${path}.${randomBytes(8).toString('hex')}.tmp`;
@@ -143,6 +173,116 @@ export function recordAuthenticatedDigest(input, env = process.env) {
     // reason it is now probed rather than assumed (#512). Fixing only the other
     // site would have moved the EPERM here instead of removing it.
     syncDirectoryEntryIfSupported(dirname(path));
+    // AFTER the new record is durably in place, never before: deleting the old
+    // one first would leave a window with zero records for this scope if the
+    // write above failed partway. Best-effort from here — see
+    // removeOlderRecordsForScope — because the new record above is already
+    // durable, and nothing below may throw back to a caller who would only
+    // retry and pile up yet another new record (raised in review).
+    removeOlderRecordsForScope(dir, input.serverOrigin, scope, input.requestId, record.recordedAt);
+}
+/**
+ * Best-effort cleanup of every OTHER, OLDER record this (origin, scope)
+ * still holds — older BY `recordedAt`, strictly, never equal or newer
+ * (raised in review). That qualifier is what keeps this safe under two
+ * concurrent ceremonies for the same scope: each of the two only deletes
+ * what it can already tell predates it, so neither ever deletes the other
+ * when both are genuinely new, and whichever of the two IS the newest is
+ * never deleted by the other. What this does NOT guarantee: running two
+ * ceremonies for one scope AT THE SAME TIME can still leave both of their
+ * records behind — deliberately out of scope, since nobody runs a second
+ * `request` on top of one already in flight, and this never claims a
+ * concurrent pair converges to one on its own. What it does guarantee is
+ * the case that matters: from that stuck two-record state, ONE ordinary
+ * retry always recovers it, because the retry's own record is newer than
+ * both and this cleanup removes them both in that single pass. Never zero,
+ * either way, is unconditional.
+ *
+ * Best-effort, not authoritative, in two more ways. A neighbour this cannot
+ * parse, or whose `recordedAt` this cannot confidently compare, is left
+ * alone rather than guessed at, because a wrongly-deleted approval is a
+ * fetch nobody can complete, while a wrongly-kept one is only a state
+ * `fetch`'s own multiple-record refusal already handles. And a deletion that
+ * FAILS is caught rather than thrown, for the same reason: this runs after
+ * the new record is already durable, so throwing here would report failure
+ * for a call that mostly succeeded, and a caller who retries on that error
+ * would only record ANOTHER new approval on top (raised in review). Either
+ * way, `fetch`'s refusal stays the backstop for whatever this pass cannot
+ * confidently remove.
+ */
+function removeOlderRecordsForScope(dir, origin, scope, keepRequestId, keepRecordedAt) {
+    const prefix = `${Buffer.from(origin, 'utf8').toString('base64url')}.`;
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        // Same reasoning as a failed deletion below: the new record is already
+        // durable, so a directory this cannot even list must not fail the call.
+        return;
+    }
+    let removedAny = false;
+    for (const name of names) {
+        if (!name.startsWith(prefix) || !name.endsWith('.json'))
+            continue;
+        const candidate = join(dir, name);
+        let parsed;
+        try {
+            const fd = openSync(candidate, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                parsed = JSON.parse(readFileSync(fd, 'utf8'));
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch {
+            continue;
+        }
+        const r = parsed;
+        if (typeof r?.['requestId'] !== 'string' || r['requestId'] === keepRequestId)
+            continue;
+        if (r['scopeFingerprint'] !== scope)
+            continue;
+        // Strictly older, by ISO-8601 string comparison — valid because
+        // `recordedAt` is always written by `toISOString()` here, a fixed-width
+        // format lexical order agrees with chronological order on. Equal or
+        // unreadable is NOT older: a missing/malformed timestamp cannot be
+        // confidently placed before this one, and a tie (two ceremonies stamped
+        // in the same millisecond) must not delete either — that is what keeps
+        // a concurrent pair from being able to empty the scope between them.
+        if (typeof r['recordedAt'] !== 'string' || !(r['recordedAt'] < keepRecordedAt))
+            continue;
+        try {
+            rmSync(candidate, { force: true });
+            removedAny = true;
+        }
+        catch {
+            continue;
+        }
+    }
+    // Once, after every deletion in this pass, not per file: one flush covers
+    // everything this call removed. Without it, a crash right after could roll
+    // a removal back on disk while this pass has already moved on — putting the
+    // old record back and reintroducing the exact stuck state this cleanup
+    // exists to prevent (raised in review).
+    //
+    // Caught, not thrown (raised in review): this whole function runs after
+    // the caller's own new record is already durable, so a failure HERE must
+    // not be reported back as the call having failed — that would tell a
+    // caller whose write actually succeeded to retry, and a retry only
+    // records yet another new approval on top.
+    if (removedAny) {
+        try {
+            syncDirectoryEntryIfSupported(dir);
+        }
+        catch {
+            // Best-effort, like the deletions themselves: the files are gone from
+            // the directory listing either way, and `fetch`'s own multiple-record
+            // refusal is what protects a machine if this particular flush is what
+            // a crash rolls back.
+        }
+    }
 }
 /**
  * Every settled ceremony recorded for this origin.

package/dist/src/commands/fetch.js

@@ -4,6 +4,7 @@ import { join } from 'node:path';
 import { CourierClient } from '../api.js';
 import { clearAuthenticatedDigest, readAuthenticatedDigests } from '../authenticated-digest.js';
 import { originOf } from '../credentials.js';
+import { shellArg } from '../shell-arg.js';
 import { decryptWithIdentity, localTeamLookup, publicKeyOf, unlockBundle, verifyHandoffDigest, } from '../oss.js';
 import { deviceIdentityPath } from '../paths.js';
 import { NEEDS, ensurePreflight, preflight } from '../preflight.js';
@@ -107,7 +108,11 @@ env = process.env) {
             // not a weaker check — it is no check, in the shape of one.
             const ids = authenticated.map((a) => `  ${a.requestId}  (${a.recordedAt})`).join('\n');
             throw new Error(`${authenticated.length} approved enrollments are recorded for this service:\n\n${ids}\n\n` +
-                'Which one this bundle belongs to cannot be decided from here.');
+                'Which one this bundle belongs to cannot be decided from here.\n\n' +
+                `Run \`agmsg-cloud sync ${shellArg(args.team)}\` again and have it approved: a\n` +
+                'fresh approval replaces every other one recorded here for this machine, leaving\n' +
+                'exactly one. (Run `agmsg-cloud request <label>` instead if this machine got here\n' +
+                'through `request` on its own rather than through `sync`.)');
         }
         const consumed = authenticated[0];
         const expected = consumed.handoffDigest;

package/dist/src/commands/pull.js

@@ -53,8 +53,16 @@ export async function cmdPull(config, opts) {
     // What it adds is the route, which the OSS script no longer names because
     // its route is not ours. Phrased as a condition rather than a claim, so it
     // is true after either line above.
-    process.stdout.write(`\n"${opts.team}" is on this machine.\n`);
+    //
+    // BOTH lines withheld under `nextStepsFromCaller`, not just the route
+    // (#523). `sync` runs `fetch` immediately after this, and "is on this
+    // machine" reads as this step's own success — which it is — right before a
+    // failing `fetch` throws with nothing to say the two are different steps.
+    // The caller owns saying what happened once every one of its steps has
+    // run; this side saying its own half early is what let the two read as one
+    // outcome.
     if (opts.nextStepsFromCaller !== true) {
+        process.stdout.write(`\n"${opts.team}" is on this machine.\n`);
         process.stdout.write(`If it is still locked, \`agmsg-cloud sync ${shellArg(opts.team)}\` completes the key handoff:\n` +
             'it asks a machine that already has the team, and the two of you compare eight digits.\n');
     }

package/dist/src/commands/sync.js

@@ -216,7 +216,19 @@ export async function cmdSync(config, opts) {
     // server says the ceremony was approved — `request` waits for that, and
     // throws otherwise. The bundle is checked against the snapshot those digits
     // authenticated, by machine.
-    await fetch(config, { team: opts.team });
+    //
+    // `pull` no longer says anything on its own when it is a step of this
+    // command (#523), so if this throws, nothing above has claimed success yet
+    // — the operator has only been told the ceremony finished. Said here,
+    // before the error propagates, so a failure at this LAST step still reads
+    // as a failure and not as a silent stop after what looked like the finish.
+    try {
+        await fetch(config, { team: opts.team });
+    }
+    catch (err) {
+        out(`\n"${opts.team}" is on this machine, but the key has not arrived — it cannot be used yet.\n`);
+        throw err;
+    }
     // The last thing said, because "what now" is the question the screen leaves
     // otherwise: someone who has just run five steps and watched a code
     // comparison has every reason to expect a sixth.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agmsg-cloud",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Companion CLI for the agmsg cloud service: connect a team, join from another machine, and back up its keys.",
   "license": "UNLICENSED",
   "type": "module",