vault-go 0.18.0 → 0.19.0

package/dist/updater.d.ts

@@ -0,0 +1,34 @@
+export interface UpdateState {
+    enabled: boolean;
+    current: string;
+    latest?: string;
+    updateAvailable: boolean;
+    status: 'idle' | 'disabled' | 'current' | 'available' | 'ready' | 'failed';
+    lastCheckedAt?: string;
+    nextCheckAt?: string;
+    lastError?: 'check_failed' | 'invalid_metadata' | 'install_failed' | 'update_busy';
+    packageRoot?: string;
+    restartRequired: boolean;
+}
+export interface UpdateProcessOptions {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    timeout: number;
+    maxBuffer: number;
+    shell: false;
+}
+export interface UpdateOptions {
+    force?: boolean;
+    now?: () => number;
+    fetch?: (url: string, init: RequestInit) => Promise<Response>;
+    execute?: (file: string, args: readonly string[], options: UpdateProcessOptions) => Promise<{
+        stdout: string;
+    }>;
+    timeoutMs?: number;
+    lockTimeoutMs?: number;
+}
+/** Only allowlisted state is exposed; credentials and raw process errors never enter this file. */
+export declare function updateStatus(home: string): UpdateState;
+export declare function setAutoUpdate(home: string, enabled: boolean): UpdateState;
+export declare function checkForUpdate(home: string, options?: UpdateOptions): Promise<UpdateState>;
+export declare function installUpdate(home: string, options?: UpdateOptions): Promise<UpdateState>;

package/dist/updater.js

@@ -0,0 +1,404 @@
+import { execFile } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { chmodSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { delimiter, dirname, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+const REGISTRY = 'https://registry.npmjs.org';
+const METADATA_URL = `${REGISTRY}/vault-go/latest`;
+const DAY = 86_400_000;
+const RETRY = 900_000;
+const MAX_METADATA = 1_048_576;
+const executeFile = promisify(execFile);
+const STATUS_VALUES = new Set(['idle', 'disabled', 'current', 'available', 'ready', 'failed']);
+const ERROR_VALUES = new Set(['check_failed', 'invalid_metadata', 'install_failed', 'update_busy']);
+function stableVersion(value) {
+    if (typeof value !== 'string' || value.length > 48 || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value))
+        return false;
+    return value.split('.').every(part => Number.isSafeInteger(Number(part)));
+}
+function newer(candidate, current) {
+    const next = candidate.split('.').map(Number);
+    const previous = current.split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        if (next[i] !== previous[i])
+            return next[i] > previous[i];
+    }
+    return false;
+}
+function readObject(path, maxBytes = 65_536) {
+    try {
+        if (statSync(path).size > maxBytes)
+            return {};
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    }
+    catch {
+        return {};
+    }
+}
+function currentVersion(home) {
+    const active = readObject(join(home, 'local-runtime', 'package.json'));
+    if ((active.name === 'vault-go-local-runtime' || active.name === 'vault-go') && stableVersion(active.version))
+        return active.version;
+    const packaged = readObject(fileURLToPath(new URL('../package.json', import.meta.url)));
+    if (packaged.name !== 'vault-go' || !stableVersion(packaged.version))
+        throw Error('Invalid installed Vault Go version');
+    return packaged.version;
+}
+function timestamp(value) {
+    return typeof value === 'string' && value.length <= 30 && Number.isFinite(Date.parse(value));
+}
+function releaseRoot(home, version) {
+    return join(resolve(home), 'releases', version, 'node_modules', 'vault-go');
+}
+/** Only allowlisted state is exposed; credentials and raw process errors never enter this file. */
+export function updateStatus(home) {
+    const saved = readObject(join(home, 'update-state.json'));
+    const current = currentVersion(home);
+    const enabled = typeof saved.enabled === 'boolean' ? saved.enabled : true;
+    const latest = stableVersion(saved.latest) ? saved.latest : undefined;
+    const updateAvailable = latest !== undefined && newer(latest, current);
+    const state = {
+        enabled, current, updateAvailable, restartRequired: false,
+        status: typeof saved.status === 'string' && STATUS_VALUES.has(saved.status) ? saved.status : 'idle',
+    };
+    if (latest)
+        state.latest = latest;
+    if (timestamp(saved.lastCheckedAt))
+        state.lastCheckedAt = saved.lastCheckedAt;
+    if (timestamp(saved.nextCheckAt))
+        state.nextCheckAt = saved.nextCheckAt;
+    if (typeof saved.lastError === 'string' && ERROR_VALUES.has(saved.lastError))
+        state.lastError = saved.lastError;
+    if (latest && updateAvailable && state.status === 'ready' && saved.packageRoot === releaseRoot(home, latest)) {
+        try {
+            if (lstatSync(join(home, 'releases')).isSymbolicLink() || lstatSync(join(home, 'releases', latest)).isSymbolicLink())
+                throw new UpdateFailure('install_failed');
+            validatePackage(releaseRoot(home, latest), latest, join(resolve(home), 'releases', latest));
+            state.packageRoot = releaseRoot(home, latest);
+            state.restartRequired = true;
+        }
+        catch {
+            state.status = 'available';
+        }
+    }
+    else if (state.status === 'ready')
+        state.status = updateAvailable ? 'available' : 'current';
+    return state;
+}
+function ensureHome(home) {
+    mkdirSync(home, { recursive: true, mode: 0o700 });
+    chmodSync(home, 0o700);
+}
+function saveState(home, state) {
+    ensureHome(home);
+    const temporary = join(home, `.update-state-${randomUUID()}.tmp`);
+    try {
+        writeFileSync(temporary, JSON.stringify(state, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+        renameSync(temporary, join(home, 'update-state.json'));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+    return updateStatus(home);
+}
+export function setAutoUpdate(home, enabled) {
+    const state = updateStatus(home);
+    state.enabled = enabled;
+    if (!enabled)
+        state.status = 'disabled';
+    else if (state.status === 'disabled')
+        state.status = state.updateAvailable ? 'available' : 'idle';
+    return saveState(home, state);
+}
+class UpdateFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code !== 'ESRCH';
+    }
+}
+async function withLock(home, options, action) {
+    ensureHome(home);
+    const path = join(home, 'update.lock');
+    const token = randomUUID();
+    const started = Date.now();
+    const waitLimit = Math.max(1, Math.min(options.lockTimeoutMs ?? 360_000, 360_000));
+    for (;;) {
+        let descriptor;
+        try {
+            descriptor = openSync(path, 'wx', 0o600);
+            writeFileSync(descriptor, JSON.stringify({ pid: process.pid, token, createdAt: Date.now() }));
+            closeSync(descriptor);
+            break;
+        }
+        catch (error) {
+            if (descriptor !== undefined)
+                closeSync(descriptor);
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const before = lstatSync(path);
+                const existing = readObject(path);
+                const knownPid = typeof existing.pid === 'number' && Number.isInteger(existing.pid) && existing.pid > 0;
+                const stale = knownPid ? !alive(existing.pid) : Date.now() - before.mtimeMs > 600_000;
+                // Compare the file identity before removing a dead owner's lock.
+                if (stale && lstatSync(path).ino === before.ino) {
+                    unlinkSync(path);
+                    continue;
+                }
+            }
+            catch (error) {
+                if (error.code === 'ENOENT')
+                    continue;
+            }
+            if (Date.now() - started >= waitLimit)
+                throw new UpdateFailure('update_busy');
+            await new Promise(resolveWait => setTimeout(resolveWait, Math.min(25, waitLimit)));
+        }
+    }
+    try {
+        return await action();
+    }
+    finally {
+        if (readObject(path).token === token)
+            unlinkSync(path);
+    }
+}
+function failureState(home, code, persist = true, now = Date.now()) {
+    const state = updateStatus(home);
+    state.status = 'failed';
+    state.lastError = code;
+    state.restartRequired = false;
+    state.nextCheckAt = new Date(now + RETRY).toISOString();
+    delete state.packageRoot;
+    return persist ? saveState(home, state) : state;
+}
+async function registryVersion(options) {
+    const controller = new AbortController();
+    const timeout = Math.max(1, Math.min(options.timeoutMs ?? 10_000, 30_000));
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => { controller.abort(); reject(new UpdateFailure('check_failed')); }, timeout);
+    });
+    const request = async () => {
+        const response = await (options.fetch ?? fetch)(METADATA_URL, { signal: controller.signal, redirect: 'error', headers: { Accept: 'application/json' } });
+        if (!response.ok || !response.body)
+            throw new UpdateFailure('check_failed');
+        const advertisedSize = Number(response.headers.get('content-length'));
+        if (advertisedSize > MAX_METADATA) {
+            await response.body.cancel();
+            throw new UpdateFailure('invalid_metadata');
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        try {
+            for (;;) {
+                const part = await reader.read();
+                if (part.done)
+                    break;
+                size += part.value.byteLength;
+                if (size > MAX_METADATA)
+                    throw new UpdateFailure('invalid_metadata');
+                chunks.push(part.value);
+            }
+        }
+        finally {
+            await reader.cancel().catch(() => { });
+        }
+        let value;
+        try {
+            value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        }
+        catch {
+            throw new UpdateFailure('invalid_metadata');
+        }
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new UpdateFailure('invalid_metadata');
+        const metadata = value;
+        if (metadata.name !== 'vault-go' || !stableVersion(metadata.version))
+            throw new UpdateFailure('invalid_metadata');
+        return metadata.version;
+    };
+    try {
+        return await Promise.race([request(), deadline]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+async function checkUnlocked(home, options) {
+    const previous = updateStatus(home);
+    if (!previous.enabled && !options.force)
+        return { ...previous, status: 'disabled' };
+    const now = options.now?.() ?? Date.now();
+    if (!options.force && previous.nextCheckAt && Date.parse(previous.nextCheckAt) > now)
+        return previous;
+    let latest;
+    try {
+        latest = await registryVersion(options);
+    }
+    catch (error) {
+        const state = updateStatus(home);
+        state.lastCheckedAt = new Date(now).toISOString();
+        state.nextCheckAt = new Date(now + RETRY).toISOString();
+        state.status = 'failed';
+        state.lastError = error instanceof UpdateFailure ? error.code : 'check_failed';
+        state.restartRequired = false;
+        delete state.packageRoot;
+        return saveState(home, state);
+    }
+    const state = updateStatus(home); // Preserve a preference changed while awaiting the network.
+    state.latest = latest;
+    state.updateAvailable = newer(latest, state.current);
+    state.lastCheckedAt = new Date(now).toISOString();
+    state.nextCheckAt = new Date(now + DAY).toISOString();
+    state.status = state.updateAvailable ? 'available' : 'current';
+    state.restartRequired = false;
+    delete state.packageRoot;
+    delete state.lastError;
+    return saveState(home, state);
+}
+export async function checkForUpdate(home, options = {}) {
+    try {
+        return await withLock(home, options, () => checkUnlocked(home, options));
+    }
+    catch (error) {
+        const code = error instanceof UpdateFailure ? error.code : 'check_failed';
+        return failureState(home, code, code !== 'update_busy');
+    }
+}
+function contained(path, root) {
+    const realRoot = realpathSync(root);
+    const realPath = realpathSync(path);
+    return realPath === realRoot || realPath.startsWith(realRoot + sep);
+}
+function validatePackage(root, version, container) {
+    if (lstatSync(root).isSymbolicLink() || !contained(root, container))
+        throw new UpdateFailure('install_failed');
+    const manifestPath = join(root, 'package.json');
+    if (!contained(manifestPath, root))
+        throw new UpdateFailure('install_failed');
+    const manifest = readObject(manifestPath);
+    if (manifest.name !== 'vault-go' || manifest.version !== version)
+        throw new UpdateFailure('install_failed');
+    for (const file of ['index.js', 'local-worker.js', 'hook-runner.js']) {
+        const path = join(root, 'dist', file);
+        if (!contained(path, root) || !statSync(path).isFile())
+            throw new UpdateFailure('install_failed');
+    }
+}
+function processOptions(directory) {
+    // Allowlist instead of inheriting login credentials, NODE_OPTIONS or npm hooks/config.
+    const env = {
+        PATH: [dirname(process.execPath), '/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin'].join(delimiter),
+        NPM_CONFIG_USERCONFIG: join(directory, '.npmrc'),
+        NPM_CONFIG_GLOBALCONFIG: join(directory, '.npmrc-global'),
+        NPM_CONFIG_CACHE: join(directory, '.npm-cache'),
+        NPM_CONFIG_REGISTRY: REGISTRY,
+        NPM_CONFIG_IGNORE_SCRIPTS: 'true',
+        NPM_CONFIG_UPDATE_NOTIFIER: 'false',
+        VAULT_GO_HOME: join(directory, '.smoke-home'),
+    };
+    if (process.platform === 'win32') {
+        for (const name of ['SystemRoot', 'WINDIR', 'TEMP', 'TMP'])
+            if (process.env[name])
+                env[name] = process.env[name];
+    }
+    return { cwd: directory, env, timeout: 300_000, maxBuffer: 65_536, shell: false };
+}
+function npmProcess(args) {
+    if (process.platform !== 'win32')
+        return { file: 'npm', args };
+    // .cmd launchers require a shell on Windows; invoke npm's JS entry with the runtime instead.
+    const candidates = [join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'), join(dirname(process.execPath), '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js')];
+    const entry = candidates.find(candidate => existsSync(candidate));
+    if (!entry)
+        throw new UpdateFailure('install_failed');
+    return { file: process.execPath, args: [entry, ...args] };
+}
+async function runProcess(file, args, options) {
+    const result = await executeFile(file, [...args], { ...options, encoding: 'utf8' });
+    return { stdout: result.stdout };
+}
+async function smoke(root, version, directory, options) {
+    const result = await (options.execute ?? runProcess)(process.execPath, [join(root, 'dist', 'index.js'), '--version'], { ...processOptions(directory), timeout: 15_000 });
+    if (result.stdout.trim() !== version)
+        throw new UpdateFailure('install_failed');
+}
+export async function installUpdate(home, options = {}) {
+    try {
+        return await withLock(home, options, async () => {
+            const checked = await checkUnlocked(home, options);
+            if (checked.status === 'failed' || (!checked.enabled && !options.force) || !checked.updateAvailable || !checked.latest)
+                return checked;
+            const version = checked.latest;
+            const releases = join(resolve(home), 'releases');
+            mkdirSync(releases, { recursive: true, mode: 0o700 });
+            if (lstatSync(releases).isSymbolicLink())
+                throw new UpdateFailure('install_failed');
+            chmodSync(releases, 0o700);
+            const destination = join(releases, version);
+            const packageRoot = releaseRoot(home, version);
+            let staging;
+            try {
+                if (existsSync(destination)) {
+                    if (lstatSync(destination).isSymbolicLink())
+                        throw new UpdateFailure('install_failed');
+                    validatePackage(packageRoot, version, destination);
+                    await smoke(packageRoot, version, destination, options);
+                }
+                else {
+                    staging = mkdtempSync(join(releases, `.staging-${version}-`));
+                    chmodSync(staging, 0o700);
+                    writeFileSync(join(staging, 'package.json'), JSON.stringify({ name: 'vault-go-update-stage', private: true }), { mode: 0o600 });
+                    writeFileSync(join(staging, '.npmrc'), '', { mode: 0o600 });
+                    writeFileSync(join(staging, '.npmrc-global'), '', { mode: 0o600 });
+                    const command = npmProcess(['install', '--ignore-scripts', '--no-audit', '--no-fund', '--prefix', staging, `vault-go@${version}`, `--registry=${REGISTRY}`]);
+                    await (options.execute ?? runProcess)(command.file, command.args, processOptions(staging));
+                    const root = join(staging, 'node_modules', 'vault-go');
+                    validatePackage(root, version, staging);
+                    await smoke(root, version, staging, options);
+                    // The lock serializes cooperating updaters. Never replace an already present release.
+                    if (existsSync(destination))
+                        throw new UpdateFailure('install_failed');
+                    renameSync(staging, destination);
+                    staging = undefined;
+                }
+                const state = updateStatus(home);
+                if (!newer(version, state.current))
+                    return saveState(home, { ...state, updateAvailable: false, restartRequired: false, status: 'current' });
+                state.latest = version;
+                state.updateAvailable = true;
+                state.packageRoot = packageRoot;
+                state.restartRequired = true;
+                state.status = 'ready';
+                delete state.lastError;
+                return saveState(home, state);
+            }
+            catch {
+                return failureState(home, 'install_failed', true, options.now?.() ?? Date.now());
+            }
+            finally {
+                if (staging)
+                    rmSync(staging, { recursive: true, force: true });
+            }
+        });
+    }
+    catch (error) {
+        const code = error instanceof UpdateFailure ? error.code : 'install_failed';
+        return failureState(home, code, code !== 'update_busy', options.now?.() ?? Date.now());
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vault-go",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Servidor MCP universal com autenticação e instalação multi-cliente para a plataforma Vault.",
   "type": "module",
   "bin": {
@@ -66,7 +66,23 @@
     "dist/server.d.ts",
     "assets/",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "dist/mcp-result.js",
+    "dist/mcp-result.d.ts",
+    "dist/parity-tools.js",
+    "dist/parity-tools.d.ts",
+    "dist/capabilities.js",
+    "dist/capabilities.d.ts",
+    "dist/smart-code.js",
+    "dist/smart-code.d.ts",
+    "dist/updater.js",
+    "dist/updater.d.ts",
+    "dist/update-control.js",
+    "dist/update-control.d.ts",
+    "dist/update-runner.js",
+    "dist/update-runner.d.ts",
+    "dist/modes.js",
+    "dist/modes.d.ts"
   ],
   "scripts": {
     "clean": "bun -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
@@ -111,6 +127,7 @@
   "author": "Gutierrez Henrique",
   "license": "MIT",
   "dependencies": {
+    "@ast-grep/napi": "0.45.3",
     "@modelcontextprotocol/sdk": "1.29.0",
     "zod": "3.25.76"
   },