mcp-google-multi 6.0.0-alpha.76 → 6.0.0-alpha.77

package/dist/fs-atomic.js

@@ -10,6 +10,9 @@ const RENAME_RETRY_MS = 20;
 const LOCK_LEASE_MS = 60_000;
 // Breaking a lock takes microseconds, so an older breaker file was left by a crash.
 const BREAKER_STALE_MS = 2_000;
+// The no-hard-link fallback writes the lock in two syscalls (create, then the
+// pid); a reader can catch it empty in between. See docs/internals.md.
+const LOCK_WRITE_GRACE_MS = 2_000;
 const PROCESS_START_MS = performance.timeOrigin;
 const OWNER_NAME = /^(\d+)\.(\d+|host)\.(\d+)\.([0-9a-f]{8}|0)\.[0-9a-f]{12}\.owner$/;
 function startOf(pid) {
@@ -63,11 +66,19 @@ function sameFile(a, b) {
 function isEnoent(error) {
     return error.code === 'ENOENT';
 }
+function bindingRecord(id) {
+    return `${id.dev}:${id.ino}:${id.mtimeNs}`;
+}
+function matchesBinding(content, id) {
+    const m = /^(\d+):(\d+):(\d+)$/.exec(content);
+    return m !== null && BigInt(m[1]) === id.dev && BigInt(m[2]) === id.ino && BigInt(m[3]) === id.mtimeNs;
+}
 // Undefined when the lock changed hands while it was being read.
 function readHolder(lock) {
     const before = fs.lstatSync(lock, { bigint: true });
     const body = before.isFile() ? fs.readFileSync(lock, 'utf8') : '';
     let owner;
+    let ownerPending = false;
     if (before.isFile()) {
         const dir = path.dirname(lock);
         const prefix = `${path.basename(lock)}.`;
@@ -79,10 +90,12 @@ function readHolder(lock) {
                 continue;
             const ownerPath = path.join(dir, name);
             try {
-                if (sameFile(fs.lstatSync(ownerPath, { bigint: true }), before)) {
+                const ownerStat = fs.lstatSync(ownerPath, { bigint: true });
+                if (sameFile(ownerStat, before) || matchesBinding(fs.readFileSync(ownerPath, 'utf8'), before)) {
                     owner = { path: ownerPath, ns: m[2], start: m[3], boot: m[4] };
                     break;
                 }
+                ownerPending = true;
             }
             catch (error) {
                 if (!isEnoent(error))
@@ -93,7 +106,7 @@ function readHolder(lock) {
     const after = fs.lstatSync(lock, { bigint: true });
     if (!sameFile(before, after))
         return undefined;
-    return { body, ino: after.ino, dev: after.dev, mtimeNs: after.mtimeNs, mtimeMs: Number(after.mtimeNs) / 1e6, owner };
+    return { body, ino: after.ino, dev: after.dev, mtimeNs: after.mtimeNs, mtimeMs: Number(after.mtimeNs) / 1e6, owner, ownerPending };
 }
 // The owner file's random name tells two holders apart even when the second
 // lock reuses the first one's freed inode.
@@ -115,10 +128,21 @@ function probeDead(pid) {
         return false;
     }
 }
+// Symmetric: a clock step back must not make a write-in-progress lock look
+// permanently fresh (see docs/internals.md).
+function withinWriteGrace(now, mtimeMs) {
+    return Math.abs(now - mtimeMs) < LOCK_WRITE_GRACE_MS;
+}
 function holderDead(holder, now) {
+    if (holder.body === '' && withinWriteGrace(now, holder.mtimeMs))
+        return false;
     const pid = Number(holder.body);
     if (!(Number.isSafeInteger(pid) && pid > 0))
         return true;
+    // A same-pid owner file exists but is not yet bound (the fallback lock's two
+    // writes race a reader); give it the same grace as an empty lock.
+    if (!holder.owner && holder.ownerPending && withinWriteGrace(now, holder.mtimeMs))
+        return false;
     const leaseOver = now - holder.mtimeMs >= LOCK_LEASE_MS;
     const owner = holder.owner;
     // No owner file: an older writer, whose namespace is unknown.
@@ -196,6 +220,53 @@ function releaseBreaker(breaker, token) {
             throw error;
     }
 }
+// No hard links here (Android/Termux denies link() in private storage, some
+// filesystems lack it entirely): the lock is created directly with O_EXCL,
+// carrying the bare pid a linked owner file would carry, and the owner file
+// is bound to it by a recorded identity instead of a hard link. See docs/internals.md.
+function takeFallbackLock(lock, ownerFile) {
+    const fd = fs.openSync(lock, 'wx', 0o600);
+    let acquired;
+    try {
+        fs.writeSync(fd, String(process.pid));
+        const stat = fs.fstatSync(fd, { bigint: true });
+        acquired = { dev: stat.dev, ino: stat.ino, mtimeNs: stat.mtimeNs };
+    }
+    catch (error) {
+        // The lock is left empty; remove it only if it is still the one we just
+        // created, then rethrow so the caller never retries a write failure.
+        const stat = fs.fstatSync(fd, { bigint: true });
+        fs.closeSync(fd);
+        try {
+            if (sameFile(fs.lstatSync(lock, { bigint: true }), stat))
+                fs.rmSync(lock, { force: true });
+        }
+        catch (cleanupError) {
+            if (!isEnoent(cleanupError))
+                throw cleanupError;
+        }
+        throw error;
+    }
+    fs.closeSync(fd);
+    try {
+        fs.writeFileSync(ownerFile, bindingRecord(acquired));
+    }
+    catch (error) {
+        // The lock already exists holding our live pid; without this cleanup
+        // every other writer sees an ownerless holder and waits out the full lease.
+        try {
+            const current = fs.lstatSync(lock, { bigint: true });
+            if (sameFile(current, acquired) && current.mtimeNs === acquired.mtimeNs)
+                fs.rmSync(lock, { force: true });
+        }
+        catch (cleanupError) {
+            if (!isEnoent(cleanupError))
+                throw cleanupError;
+        }
+        throw error;
+    }
+    return acquired;
+}
 // Hardlink-based advisory lock; the lock body is the bare pid, as older
 // readers expect. See docs/internals.md.
 export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
@@ -206,17 +277,31 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
     fs.writeFileSync(ownerFile, String(process.pid), { mode: 0o600, flag: 'wx' });
     const deadline = Date.now() + LOCK_TIMEOUT_MS;
     let linked = false;
+    let acquired;
     try {
         while (true) {
             try {
                 fs.linkSync(ownerFile, lock);
                 linked = true;
+                acquired = fs.lstatSync(lock, { bigint: true });
                 break;
             }
             catch (error) {
                 const err = error;
-                if (err.code !== 'EEXIST')
+                if (err.code === 'EACCES' || err.code === 'EPERM') {
+                    try {
+                        acquired = takeFallbackLock(lock, ownerFile);
+                        linked = true;
+                        break;
+                    }
+                    catch (fbError) {
+                        if (fbError.code !== 'EEXIST')
+                            throw fbError;
+                    }
+                }
+                else if (err.code !== 'EEXIST') {
                     throw error;
+                }
                 try {
                     const holder = readHolder(lock);
                     if (holder && holderDead(holder, Date.now()) && breakLock(lock, holder))
@@ -238,23 +323,24 @@ export function withFileLock(absPath, fn, label = `lock: ${absPath}`) {
         if (!linked)
             fs.rmSync(ownerFile, { force: true });
     }
-    let bound = false;
     try {
-        // Some network and FUSE filesystems give each name of one file its own
-        // inode number; there the owner file cannot vouch for the lock.
-        bound = sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true }));
         return fn();
     }
     finally {
-        releaseLock(lock, ownerFile, bound);
+        releaseLock(lock, ownerFile, acquired);
     }
 }
 // A holder whose lock was broken (its owner file removed with it) must not
-// remove its successor's lock.
-function releaseLock(lock, ownerFile, bound) {
+// remove its successor's lock: only drop the lock if it is still the exact
+// file this call created, and our own owner file is still there to vouch for it.
+function releaseLock(lock, ownerFile, acquired) {
     try {
-        if (!bound || sameFile(fs.lstatSync(ownerFile, { bigint: true }), fs.lstatSync(lock, { bigint: true })))
-            fs.rmSync(lock, { force: true });
+        if (acquired) {
+            const current = fs.lstatSync(lock, { bigint: true });
+            if (sameFile(current, acquired) && current.mtimeNs === acquired.mtimeNs && fs.existsSync(ownerFile)) {
+                fs.rmSync(lock, { force: true });
+            }
+        }
     }
     catch (error) {
         if (!isEnoent(error))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.76",
+  "version": "6.0.0-alpha.77",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",