github-router 0.3.261 → 0.3.269

package/dist/{token-DWknHe9M.js → token-C_q95GF7.js}

@@ -1,4 +1,4 @@
-import { t as PATHS } from "./paths-BXrbboAS.js";
+import { t as PATHS } from "./paths-Bg1_DWhi.js";
 import consola from "consola";
 import path from "node:path";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -876,20 +876,46 @@ const cacheCopilotVersion = async () => {
 };
 //#endregion
 //#region src/services/github/poll-access-token.ts
+/**
+* Per-attempt cap for a single device-code poll.
+*
+* Deliberately NOT the shared transient-retry layer: a non-OK response here is
+* the EXPECTED steady state (`authorization_pending` until the user finishes in
+* their browser), so retrying it as a transient fault would just hammer GitHub
+* inside a loop that is already a retry loop with its own interval.
+*
+* What was genuinely missing is a bound on a single attempt. Without a signal a
+* hung socket blocks the loop forever: the `expiresAt` check only runs between
+* attempts, so it can never fire while one attempt is stuck. This caps each
+* attempt so the loop keeps ticking and the expiry bound stays real.
+*/
+const POLL_ATTEMPT_TIMEOUT_MS = 3e4;
 async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
 	const sleepDuration = (deviceCode.interval + 1) * 1e3;
 	consola.debug(`Polling access token with interval of ${sleepDuration}ms`);
 	const expiresAt = Date.now() + deviceCode.expires_in * 1e3;
+	let lastFetchError;
 	while (Date.now() < expiresAt) {
-		const response = await fetch(`${GITHUB_BASE_URL}/login/oauth/access_token`, {
-			method: "POST",
-			headers: standardHeaders(),
-			body: JSON.stringify({
-				client_id: clientId,
-				device_code: deviceCode.device_code,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			})
-		});
+		let response;
+		try {
+			response = await fetch(`${GITHUB_BASE_URL}/login/oauth/access_token`, {
+				method: "POST",
+				headers: standardHeaders(),
+				body: JSON.stringify({
+					client_id: clientId,
+					device_code: deviceCode.device_code,
+					grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+				}),
+				signal: AbortSignal.timeout(POLL_ATTEMPT_TIMEOUT_MS)
+			});
+		} catch (err) {
+			lastFetchError = err;
+			consola.debug("Access-token poll attempt failed; retrying:", err);
+			if (Date.now() >= expiresAt) break;
+			await sleep(sleepDuration);
+			continue;
+		}
+		lastFetchError = void 0;
 		if (!response.ok) {
 			consola.error("Failed to poll access token:", await response.text());
 			if (Date.now() >= expiresAt) break;
@@ -903,23 +929,107 @@ async function pollAccessToken(deviceCode, clientId = GITHUB_CLIENT_ID) {
 		if (Date.now() >= expiresAt) break;
 		await sleep(sleepDuration);
 	}
+	if (lastFetchError !== void 0) throw new Error("Could not reach GitHub to complete device-code authorization. Check network/proxy/TLS settings and run auth again.", { cause: lastFetchError });
 	throw new Error("Device code expired. Please run auth again.");
 }
 //#endregion
 //#region src/lib/token.ts
 const readGithubToken = () => fs.readFile(PATHS.GITHUB_TOKEN_PATH, "utf8");
-const writeGithubToken = (token) => fs.writeFile(PATHS.GITHUB_TOKEN_PATH, token);
+/**
+* Backoff for a transient Windows rename failure. On Windows `fs.rename` over
+* an existing destination transiently fails with EPERM / EBUSY / EACCES when
+* anything else holds the target open for a moment (antivirus, the search
+* indexer, a backup agent). Nothing is wrong and the handle closes microseconds
+* later — but without a retry, a scan landing on the wrong millisecond throws
+* out of a credential write and costs the user a re-auth. Same delays as
+* `renameWithRetry` in `~/lib/claude-md-injection`, which documents the
+* underlying behavior at length.
+*/
+const RENAME_RETRY_DELAYS_MS = [
+	50,
+	200,
+	500
+];
+/**
+* Replace a credential file atomically: temp + rename, with bounded retry.
+*
+* A plain `fs.writeFile` truncates the destination before it writes, so a
+* crash, a full disk, or a kill mid-write leaves a truncated token on disk and
+* forces the user through a re-auth. `rename` within the same directory is
+* atomic on both NTFS and POSIX, so a reader sees either the old token or the
+* new one, never a partial.
+*
+* The temp name uses `randomBytes`, not `Math.random()`: this names a file that
+* briefly holds a credential, and a predictable name in a shared directory
+* invites a pre-creation race. Combined with `flag: "wx"` (fail if it exists)
+* the write refuses to follow anything an attacker pre-placed, rather than
+* silently writing the token through a planted symlink.
+*
+* Permissions: the temp file is created 0o600, and `rename` carries that mode
+* with it on POSIX — so the destination's mode is preserved, not weakened.
+* (On Windows `chmod` is a no-op anyway; see `chmodIfPossible` in `~/lib/paths`.
+* Both token files live under `CLAUDE_RUNTIME_DIR`, which is chmod'd 0o700, so
+* directory ACLs are what actually protect them there.)
+*/
+async function writeTokenFileAtomic(filePath, token) {
+	const tmp = `${filePath}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+	try {
+		await fs.writeFile(tmp, token, {
+			mode: 384,
+			flag: "wx"
+		});
+		let lastErr;
+		let renamed = false;
+		for (let attempt = 0; attempt <= RENAME_RETRY_DELAYS_MS.length; attempt++) try {
+			await fs.rename(tmp, filePath);
+			renamed = true;
+			break;
+		} catch (err) {
+			lastErr = err;
+			if (attempt < RENAME_RETRY_DELAYS_MS.length) await new Promise((resolve) => setTimeout(resolve, RENAME_RETRY_DELAYS_MS[attempt]));
+		}
+		if (!renamed) throw lastErr;
+	} catch (err) {
+		await fs.unlink(tmp).catch(() => {});
+		throw err;
+	}
+}
+const writeGithubToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_TOKEN_PATH, token);
 const readGithubAgentToken = () => fs.readFile(PATHS.GITHUB_AGENT_TOKEN_PATH, "utf8");
-const writeGithubAgentToken = (token) => fs.writeFile(PATHS.GITHUB_AGENT_TOKEN_PATH, token, { mode: 384 });
+const writeGithubAgentToken = (token) => writeTokenFileAtomic(PATHS.GITHUB_AGENT_TOKEN_PATH, token);
+/**
+* Fetch the Copilot token and keep it fresh in the background.
+*
+* Returns a disposer that stops the refresh loop. **Long-lived callers**
+* (`start`/`claude`/`codex`, via `setupAndServe`) can ignore it — the interval
+* is `unref()`d, so it never holds the event loop open on its own. The one-shot
+* `models` command calls it, so ownership of the timer is explicit rather than
+* implied by a runtime flag. (`check-usage` does not call this function at all;
+* it only needs `setupGitHubToken`.)
+*
+* Both halves are load-bearing, for different failure modes. Without the
+* `unref()`, `github-router models` printed its full correct output and then
+* hung forever: its success path just returns (only the failure branches call
+* `process.exit`), and the un-unref'd interval pinned the event loop. Without
+* the disposer, that fix would depend on a property no caller can see, so the
+* next one-shot command would inherit the same trap.
+*/
 const setupCopilotToken = async () => {
 	const { token, refresh_in } = await getCopilotToken();
 	state.copilotToken = token;
 	consola.debug("GitHub Copilot Token fetched successfully!");
 	if (state.showToken) consola.info("Copilot token:", token);
 	const refreshInterval = Math.max((refresh_in - 60) * 1e3, 1e3);
-	setInterval(() => {
+	const handle = setInterval(() => {
 		refreshCopilotToken("interval");
 	}, refreshInterval);
+	handle.unref?.();
+	let stopped = false;
+	return () => {
+		if (stopped) return;
+		stopped = true;
+		clearInterval(handle);
+	};
 };
 let inflightRefresh;
 let lastRefreshSuccess = 0;
@@ -1072,4 +1182,4 @@ async function warnIfAgentScopesInsufficient() {
 //#endregion
 export { copilotHeaders as C, githubHeaders as D, githubAgentHeaders as E, state as O, copilotBaseUrl as S, githubAgentGraphQLHeaders as T, withTransientRetry as _, cacheCopilotVersion as a, GITHUB_API_BASE_URL as b, filterBetaHeader as c, resolveModel as d, sleep as f, fetchWithTransientRetry as g, isAllowedCopilotHost as h, tryRefreshAndRetry as i, isNullish as l, getGitHubUser as m, setupGitHubAgentToken as n, cacheModels as o, getModels as p, setupGitHubToken as r, cacheVSCodeVersion as s, setupCopilotToken as t, resolveCodexModel as u, HTTPError as v, copilotVersion as w, GITHUB_GRAPHQL_URL as x, forwardError as y };
 
-//# sourceMappingURL=token-DWknHe9M.js.map
+//# sourceMappingURL=token-C_q95GF7.js.map