skillvault 0.11.1 → 0.11.2

package/dist/cli.js

@@ -24,7 +24,7 @@ import { resolveScope, resolveRoots, } from './scope.js';
 import { loadCredentials, saveCredentials, loadProjectConfig, saveProjectConfig, } from './credentials.js';
 import { registerProject, unregisterProject, getCurrentProject, listProjects, } from './projects-registry.js';
 import { confirmInstall } from './prompts.js';
-const VERSION = '0.11.1';
+const VERSION = '0.11.2';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');

package/dist/credentials.js

@@ -12,10 +12,63 @@
  *   <roots.configDir>/project.json (per install, project- or global-scoped)
  *     Active publishers in this specific install plus install metadata.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, openSync, closeSync, unlinkSync, } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { credentialsPath } from './scope.js';
+/**
+ * Run `fn` while holding an exclusive advisory lock on `<targetPath>.lock`.
+ * Same primitive as projects-registry.ts withFileLock — duplicated here so
+ * credentials.ts can be locked without crossing module boundaries. See that
+ * file for the design notes (POSIX O_EXCL semantics, busy-wait backoff,
+ * 1s stale-lock reclaim).
+ */
+function withFileLock(targetPath, fn) {
+    const lockPath = targetPath + '.lock';
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const start = Date.now();
+    const TIMEOUT_MS = 1000;
+    let fd = null;
+    while (fd === null) {
+        try {
+            fd = openSync(lockPath, 'wx', 0o600);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'EEXIST')
+                throw err;
+            if (Date.now() - start > TIMEOUT_MS) {
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch { }
+                try {
+                    fd = openSync(lockPath, 'wx', 0o600);
+                }
+                catch {
+                    throw new Error(`Could not acquire lock at ${lockPath} after ${TIMEOUT_MS}ms`);
+                }
+                break;
+            }
+            const buf = new SharedArrayBuffer(4);
+            const view = new Int32Array(buf);
+            Atomics.wait(view, 0, 0, 5 + Math.floor(Math.random() * 10));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        try {
+            unlinkSync(lockPath);
+        }
+        catch { }
+    }
+}
 /**
  * Load customer credentials from ~/.skillvault/credentials.json.
  *
@@ -75,11 +128,20 @@ export function loadCredentials() {
 }
 /**
  * Persist customer credentials to ~/.skillvault/credentials.json with mode 0600.
+ *
+ * Wrapped in withFileLock so two concurrent invites with different invite
+ * codes can't race and silently drop one of each other's publishers from
+ * the publishers[] array. The caller is expected to read-modify-write the
+ * full credentials object themselves; this function only serializes the
+ * write step. For full read-modify-write atomicity, callers should hold
+ * the lock across both load + save (see redeemInvite() in cli.ts).
  */
 export function saveCredentials(creds) {
     const path = credentialsPath();
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, JSON.stringify(creds, null, 2), { mode: 0o600 });
+    withFileLock(path, () => {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, JSON.stringify(creds, null, 2), { mode: 0o600 });
+    });
 }
 function projectConfigPath(roots) {
     return join(roots.configDir, 'project.json');

package/dist/projects-registry.js

@@ -6,10 +6,80 @@
  * `getCurrentProject()` to figure out whether the current CWD already has a
  * registered SkillVault install.
  */
-import { mkdirSync, readFileSync, writeFileSync, existsSync, statSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, statSync, openSync, closeSync, unlinkSync, } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { projectsRegistryPath } from './scope.js';
 const REGISTRY_VERSION = 1;
+/**
+ * Run `fn` while holding an exclusive advisory lock on `<targetPath>.lock`.
+ *
+ * Uses `openSync(..., 'wx')` to atomically create the lockfile (POSIX
+ * O_EXCL semantics — exactly one process succeeds, the rest get EEXIST).
+ * On contention, busy-waits with a small backoff up to ~1s before giving
+ * up. The lockfile is unlinked on completion (success or thrown error)
+ * via try/finally so a crash mid-operation can't permanently wedge
+ * subsequent invocations — though if a process is SIGKILL'd between the
+ * openSync and the closeSync, the lockfile will linger and the next
+ * caller will time out and either inherit the stale lock (forced) or
+ * throw. For our use case (a single-user CLI doing read-modify-write on
+ * a small JSON file), 1s is plenty.
+ *
+ * Used by registerProject + unregisterProject to fix the lost-update race
+ * when two `--invite` commands run concurrently against the same
+ * ~/.skillvault/projects.json (audit scenario 12-concurrent-install).
+ */
+function withFileLock(targetPath, fn) {
+    const lockPath = targetPath + '.lock';
+    mkdirSync(dirname(lockPath), { recursive: true });
+    const start = Date.now();
+    const TIMEOUT_MS = 1000;
+    let fd = null;
+    while (fd === null) {
+        try {
+            fd = openSync(lockPath, 'wx', 0o600);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code !== 'EEXIST')
+                throw err;
+            if (Date.now() - start > TIMEOUT_MS) {
+                // Stale lock — assume the previous holder crashed and reclaim it.
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch { }
+                // Loop one more time, but if it still fails, throw.
+                try {
+                    fd = openSync(lockPath, 'wx', 0o600);
+                }
+                catch {
+                    throw new Error(`Could not acquire lock at ${lockPath} after ${TIMEOUT_MS}ms`);
+                }
+                break;
+            }
+            // Busy-wait briefly. The Node.js event loop is single-threaded so
+            // we can't yield to a peer process via Promise without making the
+            // function async — and registerProject is sync. Atomics.wait on a
+            // SharedArrayBuffer is the cleanest sync sleep:
+            const buf = new SharedArrayBuffer(4);
+            const view = new Int32Array(buf);
+            Atomics.wait(view, 0, 0, 5 + Math.floor(Math.random() * 10));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        try {
+            closeSync(fd);
+        }
+        catch { }
+        try {
+            unlinkSync(lockPath);
+        }
+        catch { }
+    }
+}
 function readRegistry() {
     const path = projectsRegistryPath();
     if (!existsSync(path))
@@ -75,29 +145,39 @@ export function listProjects() {
 /**
  * Insert or update a project entry. Matching is by absolute path; if an entry
  * with the same path already exists, it is replaced.
+ *
+ * The read-modify-write is wrapped in withFileLock so two concurrent
+ * `--invite` calls can't race and lose one of each other's updates.
  */
 export function registerProject(entry) {
-    const reg = readRegistry();
-    const normalized = { ...entry, path: resolve(entry.path) };
-    const idx = reg.projects.findIndex((p) => resolve(p.path) === normalized.path);
-    if (idx >= 0) {
-        reg.projects[idx] = normalized;
-    }
-    else {
-        reg.projects.push(normalized);
-    }
-    writeRegistry(reg);
+    withFileLock(projectsRegistryPath(), () => {
+        const reg = readRegistry();
+        const normalized = { ...entry, path: resolve(entry.path) };
+        const idx = reg.projects.findIndex((p) => resolve(p.path) === normalized.path);
+        if (idx >= 0) {
+            reg.projects[idx] = normalized;
+        }
+        else {
+            reg.projects.push(normalized);
+        }
+        writeRegistry(reg);
+    });
 }
 /**
  * Remove the project entry whose path matches. No-op if not present.
+ *
+ * Wrapped in withFileLock for the same reason as registerProject — a
+ * concurrent uninstall + register would otherwise race.
  */
 export function unregisterProject(path) {
-    const reg = readRegistry();
-    const target = resolve(path);
-    const before = reg.projects.length;
-    reg.projects = reg.projects.filter((p) => resolve(p.path) !== target);
-    if (reg.projects.length !== before)
-        writeRegistry(reg);
+    withFileLock(projectsRegistryPath(), () => {
+        const reg = readRegistry();
+        const target = resolve(path);
+        const before = reg.projects.length;
+        reg.projects = reg.projects.filter((p) => resolve(p.path) !== target);
+        if (reg.projects.length !== before)
+            writeRegistry(reg);
+    });
 }
 /**
  * Look up the registry entry that matches the current working directory (or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {